Debian 9

libapache2-mod-php => 1:7.0+49
libapache2-mod-php7.0 => 7.0.33-0+deb9u3
php-bcmath => 1:7.0+49
php-common => 1:49
php-gd => 1:7.0+49
php-ldap => 1:7.0+49
php-mbstring => 1:7.0+49
php-mysql => 1:7.0+49
php-xml => 1:7.0+49
php7.0-bcmath => 7.0.33-0+deb9u3
php7.0-cli => 7.0.33-0+deb9u3
php7.0-common => 7.0.33-0+deb9u3
php7.0-gd => 7.0.33-0+deb9u3
php7.0-json => 7.0.33-0+deb9u3
php7.0-ldap => 7.0.33-0+deb9u3
php7.0-mbstring => 7.0.33-0+deb9u3
php7.0-mysql => 7.0.33-0+deb9u3
php7.0-opcache => 7.0.33-0+deb9u3
php7.0-readline => 7.0.33-0+deb9u3
php7.0-xml => 7.0.33-0+deb9u3

opsgenie-zabbix => 2.22.0
zabbix-frontend-php => 1:4.2.6-1+stretch
zabbix-release => 4.2-2+stretch
zabbix-server-mysql => 1:4.2.6-1+stretch

Hello Steve,

`Did you try 4.2.5 frontend? Does it work properly?

Hello Alexey,

It's working on 4.2.4 and 4.2.5.

We faced the issue after upgrading from 4.2.5 to 4.2.6

Thank you and best regards.

Calvario it could be related to JSON and PHP library versions used by your installation.
Issue is having "\" symbols in the "groupids":"[\"39\"]"

Hello Marcis,

Yesterday afternoon I upgraded the PHP version from 7.0 to 7.3 and still faced the same issue.

After that, I upgraded Zabbix from 4.2.6 to 4.4.0beta1 and the issue is now affecting all the widgets.

Some widgets that were not impacted on the 4.2.6 are now stuck with errors. (Print screen attached)

Example of errors:

• Invalid parameter "Host groups/1": a number is expected.
• Invalid parameter "Exclude host groups/1": a number is expected.
• Invalid parameter "Hosts/1": a number is expected.
• Invalid parameter "Severity/1": an integer is expected.
• Invalid parameter "/1": an array is expected.
• Invalid parameter "Overrides": an array is expected.
• Invalid parameter "Problem hosts": an array is expected.
• Invalid parameter "Data set": an array is expected.
• Invalid parameter "Graph/1": a number is expected.
• ksort() expects parameter 1 to be array, string given [zabbix.php:21 → require_once() → ZBase->run() → ZBase->processRequest() → CController->run() → CControllerWidget->checkInput() → CWidgetConfig::getForm() → CWidgetFormSvgGraph->__construct() → ksort() in include/classes/widgets/forms/CWidgetFormSvgGraph.php:32]
• 
  ksort() expects parameter 1 to be array, string given [zabbix.php:21 → require_once() → ZBase->run() → ZBase->processRequest() → CController->run() → CControllerWidget->checkInput() → CWidgetConfig::getForm() → CWidgetFormSvgGraph->__construct() → ksort() in include/classes/widgets/forms/CWidgetFormSvgGraph.php:32]

The widget for "Screen" provide an error, but it's the only widget after editing it and adding the values again that work again.

After some investigation, the double "escaping" occur on the "prototype.js" function "inspect(useDoubleQuotes)" :

• https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/frontends/php/js/vendors/prototype.js#578

Thank you and best regards.

Steve, clarify please. Was you able to fix it?
If so, how?

Hello Oleksiy,

Sorry if it was not clear enough, I was not able to fix it but only find out the function that is adding the extra "\".

It's only a clue, sadly this file was not changed looking at the git history, so I guess Marcis was right about something related to the JSON itself.

You can find below all the steps from the beginning of the AJAX call until this function:

• https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/frontends/php/js/dashboard.grid.js#2260
• https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/frontends/php/js/vendors/prototype.js#1053
• https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/frontends/php/js/vendors/prototype.js#182
• https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/frontends/php/js/vendors/prototype.js#589
• https://git.zabbix.com/projects/ZBX/repos/zabbix/browse/frontends/php/js/vendors/prototype.js#578

Example, when it's on the dashboard.grid.js#2260 the content of "fields" for "JSON.stringify(fields);" is the following :

fields: {…}
    evaltype: "2"
    hostids: (1) […]
        0: "247352"
        length: 1
        <prototype>: []
    problem: ""
    rf_rate: "-1"
    show: "1"
    show_lines: "5"
    show_opdata: "0"
    show_suppressed: "0"
    show_tags: "0"
    show_timeline: "0"
    sort_triggers: "4"
    tags: Object(1)
    unacknowledged: "0"

When the hostid : "247352" arrive into prototype.js#578 the return is "\"247352\""

After, when it's the return of prototype.js#1059, the value is  "[\"247352\"]"

Then this is the content of the "fields" sent on the AJAX call :

{"rf_rate":"-1","show":"1","hostids":"[\"247352\"]","problem":"","evaltype":"2","tags":{"0":{"tag":"","operator":"0","value":""}},"show_tags":"0","show_suppressed":"0","unacknowledged":"0","show_opdata":"0","sort_triggers":"4","show_timeline":"0","show_lines":"5"}

Thank you.

Hello guys, 

Does anyone solve this issue? After Zabbix Server and Frontend version upgrade from version 4.2.5 to 4.2.6 I've been facing this problem. Before the upgrade everything was working just fine. 

Thank you and best regards.

I wonder, could it be a browser specific issue?

Hi Oleksiy, 

I don't think so, because I've already used Opera, Mozilla Firefox and Google Chrome the same issue. The old version was woking. I'm still looking for what could it be.

Are you facing the same issue?

Thank you and best regards. 

Thanks. I have the issue on a remote installation (v 4.0.12), where I have not access to, but I need to resolve that too.

I have the same problem after upgrading fro 4.2.x to 4.4.0rc1.

Same with 4.2.7, new install on debian 9. 

A short investigation shows that jsLoader cannot parse correct cookie.

cookie.read('localstoragePath') returns NULL. When it try to read document.cookie contrains only last part of it 'tab=1'.

If I manually insert correct value for cookie.read('localstoragePath') everything is ok.

It seems like race contition... Something modify document.cookie

Hi guys, 

We tried to upgrade from 4.2.7 to 4.4.0 in our test environment nothing happens, still the same issue.  We have a  CentOS 7 virtual machine with PHP 7.2,  Apache 2.4.6 and PostgreSQL  10.

Thank you and best regards.  

Hi guys, 

Let me say What I've done:

• Backup conf files /etc/zabbix , /usr/share/zabbix  and PostgreSQL dump;
• Upgrade from version 4.2.7 to 4.4.0;
• Reinstall of zabbix-web and zabbix-web-pgsql packages;
• Restore backup of conf files and /usr/share/zabbix only;

The issue still remains so I try to edit the dashboards so I've seen a strange behavior on the name field instead of dashboard name showed me my zabbix user name. Then I've edited to dashboard to its old name and click apply button it made back to normal.

But after a simple page refresh or if I save changes on Dashboard painel the issue remains. In our Apache configuration security modules are enable:

mod_security
mod_evasive

For Grafana dashboards don't work normaly when Apache mod_evasive is enabled. We'll try
if this module disabled. 

Today I've tried and nothing happens still the same.

If I have some news I'll post it here.
  

PS: I've added some images.

Thank you and best regards.   

I have the same issue on a fresh install of 4.4
Amazon Linux (CentOS 6) PHP 7.1.32

Edit:
It looks like a bunch of other GUI elements are broken.
Configuration -> Hosts is missing hosts. Only Zabbix server is visible.
If I try to perform an action on it (like disabling it) other hosts show up, but action is not saved and the host is still enabled on refresh.

Only exception I see is:

uncaught exception: Local storage instantiation must be versioned, and prefixed. jsLoader.php:12197:3
    ZBX_LocalStorage https://mydom.com/jsLoader.php?ver=4.4.0&lang=en_GB&showGuiMessaging=1:12197
    <anonymous> https://mydom.com/jsLoader.php?ver=4.4.0&lang=en_GB&showGuiMessaging=1:12717

Same issue on:

1. rpm -qa | grep ^zabbix
   zabbix-web-mysql-4.0.13-1.el7.noarch
   zabbix-release-4.0-2.el7.noarch
   zabbix-web-4.0.13-1.el7.noarch
   zabbix-agent-4.0.13-1.el7.x86_64
   zabbix-server-mysql-4.0.13-1.el7.x86_64
2. cat /etc/redhat-release
   Red Hat Enterprise Linux Server release 7.7 (Maipo)
3. rpm -qa | grep ^php
   php-ldap-5.4.16-46.el7.x86_64
   php-gd-5.4.16-46.el7.x86_64
   php-cli-5.4.16-46.el7.x86_64
   php-common-5.4.16-46.el7.x86_64
   php-pdo-5.4.16-46.el7.x86_64
   php-5.4.16-46.el7.x86_64
   php-xml-5.4.16-46.el7.x86_64
   php-mysql-5.4.16-46.el7.x86_64
   php-fpm-5.4.16-46.el7.x86_64
   php-mbstring-5.4.16-46.el7.x86_64
   php-bcmath-5.4.16-46.el7.x86_64
4. rpm -qa | grep ^httpd
   httpd-tools-2.4.6-90.el7.x86_64
   httpd-2.4.6-90.el7.x86_64
5. rpm -qa | grep ^mod
   mod_ssl-2.4.6-90.el7.x86_64

Hello,

The problem seems to be because of extra hardening in web server configuration.
The cookie 'localstoragePath' is expected to be readable by JS, but if web server is adding 'httpOnly' flag to all cookies, this cookie is not accessible by JS any more.
This results in error in JS, which leads to error you are observing.

This is also explained in ZBX-16580.
I will not close the issue just yet, but this comment should help you to avoid this error on your installations.

My issue ended up being caching that was set too aggressively by the TCP proxy sitting in front of Zabbix front end. Resolved simply by disabling and clearing cache.

I do still see Zabbix cookies being set with httpOnly and Secure flags, but it doesn't seem to affect Web GUI functionality. Maybe devs realized it wasn't a good decision to simply ignore the issue since it isn't always possible to disable secure cookies and fixed it?

Hello guys,

After what Valdis Murzins commented We check our httpd.conf file and commented this part:

<IfModule mod_headers.c>
 Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure
</IfModule>

So everything works just fine. In the issue ZBX - 16580 
One of last comments says:

"We discussed the issue with development team. Conclusion is that there is no need to use additional security hardening because Zabbix cookies are already secured. Enabling additional security breaks Zabbix functionality. This is not a bug in Zabbix."

Does anyone know if this still the same in the latest version?

Thank you and best regards. 
 

I dont have such configuration in my httpd.conf file and yet the issue persists. Does using php-fpm have any such concerns?

Fixed in development branch feature/ZBX-16605-4.0

Last commit worked for me Miks Kronkalns. Many thanks!

Good to hear SuNova! Thank you for feedback.

Fixed in:

• 4.0.14rc1 83cf2e9cd14
• 4.2.8rc1 2df706ead99
• 4.4.1rc1 fb5dac0fb07
• 5.0.0alpha1 (master) e88979f6133

I just noticed since I applied your commit to my own instance of Zabbix web interface, another problem is showing up, which I noticed is probably js related, as I'm not getting any errors in Apache error log:

Uncaught TypeError: jQuery(...).textareaFlexible is not a function
at HTMLDocument.<anonymous> (hosts.php?form=update&hostid=10318&groupid=65:646)
at l (jsLoader.php?ver=4.4.0&lang=en_GB&showGuiMessaging=1:4978)
at c (jsLoader.php?ver=4.4.0&lang=en_GB&showGuiMessaging=1:4978)

There also is a warning which may be related:

jsLoader.php?ver=4.4.0&lang=en_GB&showGuiMessaging=1:4978 jQuery.Deferred exception: jQuery(...).textareaFlexible is not a function TypeError: jQuery(...).textareaFlexible is not a function
at HTMLDocument.<anonymous> (https://zabbix.asr24.com/hosts.php?form=update&hostid=10318&groupid=65:646:23)
at l (https://zabbix.asr24.com/jsLoader.php?ver=4.4.0&lang=en_GB&showGuiMessaging=1:4978:29375)
at c (https://zabbix.asr24.com/jsLoader.php?ver=4.4.0&lang=en_GB&showGuiMessaging=1:4978:29677) undefined
w.Deferred.exceptionHook @ jsLoader.php?ver=4.4.0&lang=en_GB&showGuiMessaging=1:4978

Symptoms seem to be disappearance of tabs in host and trigger configuration sections (items are not affected as I noticed). Also tab contents are merged together and one page containing all configuration fields is shown.
I don't know if this is related to the way I applied the patch, or it's a real bug. Here is my approach to apply:

cd /usr/share/zabbix/
cd js
curl -o class.localstorage.js https://git.zabbix.com/projects/ZBX/repos/zabbix/raw/frontends/php/js/class.localstorage.js?at=refs%2Fheads%2Ffeature%2FZBX-16605-4.0
cd ..
curl -o jsLoader.php https://git.zabbix.com/projects/ZBX/repos/zabbix/raw/frontends/php/jsLoader.php?at=refs%2Fheads%2Ffeature%2FZBX-16605-4.0

Screenshots are attached. And @Maks it's an honor to contribute to this awesome opensource and actively developed software

I hate to be a goldfish, forgot to mention I restarted Apache after applying the patch to prevent possible issues.

SuNova, please make sure you have downloaded files from correct version of Zabbix. It looks like you are using 4.4 but jsLoader.php has been fetched from development branch which was made for 4.0.

Btw, this fix is already included in latest release available in sourceforge.

Sorry I haven't noticed about actual branch. It's fixed. Thanks for your help.

I want to mention that in this task the cookie "localstoragePath" was removed, so it should no longer create problems with extra hardening in web server configuration. Although this hardrning should not be required, as all cookies in Zabbix have correct security options defined.