Attached ZBXNEXT-2122.patch. This is for Zabbix 2.2.1. It removes the permissions checks around adding/deleting/updating media types in CUser.php. It also enables the Media tab for all users.

Edit: Patch has been removed due to the security hole it widened. A fixed patch will be posted shortly.

Well, this patch of mine revealed a security hole in Zabbix. With the patch, any zabbix user can modify the media for any other Zabbix user by using the API. That got me thinking that the only thing I did was remove the check that makes sure that the currently logged in user was least of type "Zabbix Admin". Based on the UI, I would assume (and hope) that only Zabbix Super Admins could modify the media for any user. I reverted my patch and did a quick check. A "Zabbix Admin" user can modify the media for any users in the zabbix system!

In summary, there is a security hole in Zabbix where users of type "Zabbix Admin" can modify the media for any user by going through the API. My patch just made the original hole a little wider.

Added ZBXNEXT-2122-fixed.patch. This patch incorporates the changes from the patch attached to ZBX-7693. The security hole is fixed in this patch and it allows the "Zabbix User" type to modify their own media both in the API and in the Web UI.

Is this going to be integrated into zabbix?

Issue still exists in Zabbix 2.2. This action is still unassigned, when will this be this fixed?

Corey, this implementation involves a little risk:

• Users may add media they should not:

For instance, you may be running a somewhat global media type, like syslog or an IRC bot. I'm actually running a media type that manipulates routing. This could be implemented as a remote command, but people may still do it like this. These media types are not intended to be run more often than once at a time. If a user can add such a media, this can break things or even pose a security breach.

• Users may receive messages not intended for them by adding a media:

Imagine an operation notifying a group the user is part of. Media type is set to "SMS" there. Some users are known not to have SMS configured and thus don't receive notifications – on purpose. If the user can now add a SMS media, he suddenly is notified of something that may not be of his business. Furthermore, SMS usually cost money.

I would generally want to see that as a user group option, whether a user is allowed to manipulate these settings or not. One could also limit it per media type. I'm afraid it could get fairly complex to meet all conceivable needs.

Another perspective would be the ability of making each specific media type available to one or more usergroups.

This way, a usergroup 'E-mail users' includes users which can enable/configure the e-mail media type.

Much simpler in my eyes.

arjen, you mean something like this: ZBXNEXT-1670?

New patch to fit 2.2.5

Correction to the previous

Ported to 2.4.2.

This patch still includes the potential security issues that Volker mentioned previously. Whether or not those are a problem depends on the environment.

Ported to 2.4.4

Will this patch be ported to 3.0.1?

I tried, but failed on my first attempt.

My iteration for user change (zabbix 3.0.4 based). Only the users with admin privileges can change their media.

What happened to the original idea that users can change their own media settings? They still can't. So why is this issue closed?