[ZBX-2499] templated trigger editing problem with permissions Created: 2010 Jun 02  Updated: 2019 Dec 10

Status: Confirmed
Project: ZABBIX BUGS AND ISSUES
Component/s: Frontend (F)
Affects Version/s: None
Fix Version/s: None

Type: Incident report Priority: Trivial
Reporter: richlv Assignee: Unassigned
Resolution: Unresolved Votes: 0
Labels: permissions
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified

Issue Links:
Duplicate
duplicates ZBX-3783 Proper API validation Reopened

 Description   

followup issue to ZBXNEXT-279

have a template that is linked to another template which is set to "deny" for the current user. edit a trigger in the upper level template :

Host does not exist.Check expression part starting from '{Template 3:system.cpu.load.last(0)}>4'

3.1. space missing before "Check";
3.2. this works with items, so should work with triggers as well...
3.3. operation is not atomic - it changes trigger for the hosts user has permission, but not for "deny" ones.



 Comments   
Comment by Aleksandrs Saveljevs [ 2016 Jan 22 ]

This is an old issue, but the problem is still present in current pre-3.0.0beta2 (trunk) r57938.

The way the problem manifests is a bit different though. Here are the steps to reproduce:

  1. start with a fresh Zabbix installation;
  2. clone "Zabbix server" to "Zabbix server COPY";
  3. create an admin with permissions for "Template App Zabbix Agent" and "Zabbix server COPY" (this way, the user does not have permissions for "Template OS Linux" and "Zabbix server").

Now, try to update an item in Zabbix agent template and observe the following result:

Updated: Item "Agent ping" on "Template App Zabbix Agent".
Updated: Item "Agent ping" on "Template OS Linux".
Updated: Item "Agent ping" on "Template OS OpenBSD".
Updated: Item "Agent ping" on "Template OS FreeBSD".
Updated: Item "Agent ping" on "Template OS AIX".
Updated: Item "Agent ping" on "Template OS HP-UX".
Updated: Item "Agent ping" on "Template OS Solaris".
Updated: Item "Agent ping" on "Template OS Mac OS X".
Updated: Item "Agent ping" on "Template OS Windows".

The item was successfully updated on templates, but not on Zabbix server hosts.

Trying the same with triggers, it is even more sad:

Updated: Trigger "Version of zabbix_agent(d) was changed on {HOST.NAME}" on "Template App Zabbix Agent".
Created: Trigger "Version of zabbix_agent(d) was changed on {HOST.NAME}" on "Template OS Linux".
Invalid argument supplied for foreach() [triggers.php:219 → CFrontendApiWrapper->update() → CApiWrapper->__call() → CFrontendApiWrapper->callMethod() → CApiWrapper->callMethod() → CFrontendApiWrapper->callClientMethod() → CLocalApiClient->callMethod() → call_user_func_array() → CTrigger->update() → CTriggerGeneral->inherit() → CTriggerGeneral->inherit() → CTriggerGeneral->inheritOnHost() in include/classes/api/services/CTriggerGeneral.php:206]
Created: Trigger "Version of zabbix_agent(d) was changed on {HOST.NAME}" on "Zabbix server".
Invalid argument supplied for foreach() [triggers.php:219 → CFrontendApiWrapper->update() → CApiWrapper->__call() → CFrontendApiWrapper->callMethod() → CApiWrapper->callMethod() → CFrontendApiWrapper->callClientMethod() → CLocalApiClient->callMethod() → call_user_func_array() → CTrigger->update() → CTriggerGeneral->inherit() → CTriggerGeneral->inherit() → CTriggerGeneral->inheritOnHost() in include/classes/api/services/CTriggerGeneral.php:206]
Created: Trigger "Version of zabbix_agent(d) was changed on {HOST.NAME}" on "Zabbix server COPY".
Created: Trigger "Version of zabbix_agent(d) was changed on {HOST.NAME}" on "Template OS OpenBSD".
Created: Trigger "Version of zabbix_agent(d) was changed on {HOST.NAME}" on "Template OS FreeBSD".
Created: Trigger "Version of zabbix_agent(d) was changed on {HOST.NAME}" on "Template OS AIX".
Created: Trigger "Version of zabbix_agent(d) was changed on {HOST.NAME}" on "Template OS HP-UX".
Created: Trigger "Version of zabbix_agent(d) was changed on {HOST.NAME}" on "Template OS Solaris".
Created: Trigger "Version of zabbix_agent(d) was changed on {HOST.NAME}" on "Template OS Mac OS X".

Note invalid arguments and the fact that it created duplicate triggers instead of updating existing ones.

Comment by Aleksandrs Saveljevs [ 2016 Jan 22 ]

Also, when such a user goes into "Zabbix server COPY" configuration, the "Templates" tab does not show any templates, presumably because it would normally show "Template OS Linux", which the user does not have access to. However, in item list for this host he can see that items come from this template. Should probably be consistent - it does not make sense to hide "Template OS Linux" in the template list if the user can see it in the item list.

Comment by Aleksandrs Saveljevs [ 2016 Feb 02 ]

When fixing this issue, consider scenario in ZBX-4514.

Generated at Tue Jan 21 12:41:53 EET 2025 using Jira 9.12.4#9120004-sha1:625303b708afdb767e17cb2838290c41888e9ff0.