[#ZBX-5700] Lack of permission checks in Frontend.

[ZBX-5700] Lack of permission checks in Frontend. Created: 2012 Oct 17 Updated: 2017 May 30 Resolved: 2012 Oct 24
Status:	Closed
Project:	ZABBIX BUGS AND ISSUES
Component/s:	Frontend (F)
Affects Version/s:	2.0.4, 2.1.0
Fix Version/s:	2.0.4rc1, 2.1.0

Type:

Incident report

Priority:

Minor

Reporter:

Eduards Samersovs (Inactive)

Assignee:

Oleg Egorov (Inactive)

Resolution:

Fixed

Votes:

Labels:

None

Remaining Estimate:

Not Specified

Time Spent:

Not Specified

Original Estimate:

Not Specified

Issue Links:

Duplicate
is duplicated by	~~ZBX-4183~~	Attempt to save an already deleted im...	Closed
is duplicated by	~~ZBX-4185~~	Attempt to save an already deleted us...	Closed
is duplicated by	~~ZBX-4186~~	Attempt to save an already deleted me...	Closed

Description

It is possible to open many pages with incorrect ID and see undefined indexes or no data. Instead correct error message must be showen. Code must be similar with:
$myIds = get_request('myid');
if (empty($myIds))

{ access_deny(); }

Affected pages:
Administration->General->Icon mapping
Administration->General->Images
Administration->General->Value mapping
Administration->General->Regular expressions
Administration->MediaTypes
.. and others

Comments

Comment by Oleg Egorov (Inactive) [ 2012 Oct 18 ]

Fixed error after deleting image:
Undefined index: name [adm.images.php:114]
If refresh page after delete.

Comment by Oleg Egorov (Inactive) [ 2012 Oct 18 ]

Affected pages:
...
Administration->General->Users
Administration->General->Users groups
Administration->General->Media types
Administration->General->DM
Administration->Configuration->Discovery
Administration->Configuration->Slide shows
Administration->Configuration->Web
Administration->Configuration->Maintenance
Administration->Configuration->Host->Applications

oleg.egorov RESOLVED IN svn://svn.zabbix.com/branches/dev/ZBX-5700 r30942

Comment by Eduards Samersovs (Inactive) [ 2012 Oct 22 ]

(1) Require put id validation also on delete. For example in slide shows if we with hands open url "slideconf.php?delete=1&form=update&slideshowid=2000000&sid=45b2c4a742fe312a" with incorrect slideshowid nothing happens, but must be access_deny() error.

oleg.egorov RESOLVED

Comment by Eduards Samersovs (Inactive) [ 2012 Oct 22 ]

(2) Please move permission checks on top of php script (after input params validation).

oleg.egorov RESOLVED IN svn://svn.zabbix.com/branches/dev/ZBX-5700 r31013

Comment by Oleg Egorov (Inactive) [ 2012 Oct 22 ]

Fixed duplicates in audit log after deleting

Comment by Oleg Egorov (Inactive) [ 2012 Oct 22 ]

Fixed problem with spaces in audit log