From e34bb7235ceb01fbd7df303f6c09f40224a81439 Mon Sep 17 00:00:00 2001 From: laf Date: Wed, 22 Apr 2015 20:39:09 +0100 Subject: [PATCH 1/7] Added function for read only admin and update ajax_search to honour perms --- html/ajax_search.php | 24 ++++++++++++++++++++---- html/includes/functions.inc.php | 9 +++++++++ 2 files changed, 29 insertions(+), 4 deletions(-) diff --git a/html/ajax_search.php b/html/ajax_search.php index 2000e3182..410aac111 100755 --- a/html/ajax_search.php +++ b/html/ajax_search.php @@ -47,7 +47,11 @@ if (isset($_REQUEST['search'])) } elseif($_REQUEST['type'] == 'device') { // Device search - $results = dbFetchRows("SELECT * FROM `devices` WHERE `hostname` LIKE '%" . $search . "%' OR `location` LIKE '%" . $search . "%' ORDER BY hostname LIMIT 8"); + if (is_admin() === TRUE || is_read() === TRUE) { + $results = dbFetchRows("SELECT * FROM `devices` WHERE `hostname` LIKE '%" . $search . "%' OR `location` LIKE '%" . $search . "%' ORDER BY hostname LIMIT 8"); + } else { + $results = dbFetchRows("SELECT * FROM `devices` AS `D`, `devices_perms` AS `P` WHERE `P`.`user_id` = ? AND `P`.`device_id` = `D`.`device_id` AND (`hostname` LIKE '%" . $search . "%' OR `location` LIKE '%" . $search . "%') ORDER BY hostname LIMIT 8", array($_SESSION['user_id'])); + } if (count($results)) { $found = 1; @@ -72,7 +76,11 @@ if (isset($_REQUEST['search'])) { $highlight_colour = '#008000'; } - $num_ports = dbFetchCell("SELECT COUNT(*) FROM `ports` WHERE device_id = ?", array($result['device_id'])); + if (is_admin() === TRUE || is_read() === TRUE) { + $num_ports = dbFetchCell("SELECT COUNT(*) FROM `ports` WHERE device_id = ?", array($result['device_id'])); + } else { + $num_ports = dbFetchCell("SELECT COUNT(*) FROM `ports` AS `I`, `devices` AS `D`, `devices_perms` AS `P` WHERE `P`.`user_id` = ? AND `P`.`device_id` = `D`.`device_id` AND `I`.`device_id` = `D`.`device_id` AND device_id = ?", array($_SESSION['user_id'],$result['device_id'])); + } $device[]=array('name'=>$name, 'device_id'=>$result['device_id'], 'url'=> generate_device_url($result), @@ -91,7 +99,11 @@ if (isset($_REQUEST['search'])) } elseif($_REQUEST['type'] == 'ports') { // Search ports - $results = dbFetchRows("SELECT `ports`.*,`devices`.* FROM `ports` LEFT JOIN `devices` ON `ports`.`device_id` = `devices`.`device_id` WHERE `ifAlias` LIKE '%" . $search . "%' OR `ifDescr` LIKE '%" . $search . "%' ORDER BY ifDescr LIMIT 8"); + if (is_admin() === TRUE || is_read() === TRUE) { + $results = dbFetchRows("SELECT `ports`.*,`devices`.* FROM `ports` LEFT JOIN `devices` ON `ports`.`device_id` = `devices`.`device_id` WHERE `ifAlias` LIKE '%" . $search . "%' OR `ifDescr` LIKE '%" . $search . "%' ORDER BY ifDescr LIMIT 8"); + } else { + $results = dbFetchRows("SELECT DISTINCT(`I`.`port_id`), `I`.*, `D`.`hostname` FROM `ports` AS `I`, `devices` AS `D`, `devices_perms` AS `P`, `ports_perms` AS `PP` WHERE ((`P`.`user_id` = ? AND `P`.`device_id` = `D`.`device_id`) OR (`PP`.`user_id` = ? AND `PP`.`port_id` = `I`.`port_id` AND `I`.`device_id` = `D`.`device_id`)) AND `D`.`device_id` = `I`.`device_id` AND (`ifAlias` LIKE '%" . $search . "%' OR `ifDescr` LIKE '%" . $search . "%') ORDER BY ifDescr LIMIT 8", array($_SESSION['user_id'],$_SESSION['user_id'])); + } if (count($results)) { @@ -144,7 +156,11 @@ if (isset($_REQUEST['search'])) } elseif($_REQUEST['type'] == 'bgp') { // Search bgp peers - $results = dbFetchRows("SELECT `bgpPeers`.*,`devices`.* FROM `bgpPeers` LEFT JOIN `devices` ON `bgpPeers`.`device_id` = `devices`.`device_id` WHERE `astext` LIKE '%" . $search . "%' OR `bgpPeerIdentifier` LIKE '%" . $search . "%' OR `bgpPeerRemoteAs` LIKE '%" . $search . "%' ORDER BY `astext` LIMIT 8"); + if (is_admin() === TRUE || is_read() === TRUE) { + $results = dbFetchRows("SELECT `bgpPeers`.*,`devices`.* FROM `bgpPeers` LEFT JOIN `devices` ON `bgpPeers`.`device_id` = `devices`.`device_id` WHERE `astext` LIKE '%" . $search . "%' OR `bgpPeerIdentifier` LIKE '%" . $search . "%' OR `bgpPeerRemoteAs` LIKE '%" . $search . "%' ORDER BY `astext` LIMIT 8"); + } else { + $results = dbFetchRows("SELECT `bgpPeers`.*,`D`.* FROM `bgpPeers`, `devices` AS `D`, `devices_perms` AS `P` WHERE `P`.`user_id` = ? AND `P`.`device_id` = `D`.`device_id` AND `bgpPeers`.`device_id`=`D`.`device_id` AND (`astext` LIKE '%" . $search . "%' OR `bgpPeerIdentifier` LIKE '%" . $search . "%' OR `bgpPeerRemoteAs` LIKE '%" . $search . "%') ORDER BY `astext` LIMIT 8", array($_SESSION['user_id'])); + } if (count($results)) { $found = 1; diff --git a/html/includes/functions.inc.php b/html/includes/functions.inc.php index 48295cd3e..b6d1a42d0 100644 --- a/html/includes/functions.inc.php +++ b/html/includes/functions.inc.php @@ -730,6 +730,15 @@ function is_admin() { return $allowed; } +function is_read() { + if ($_SESSION['userlevel'] == '5') { + $allowed = true; + } else { + $allowed = false; + } + return $allowed; +} + function demo_account() { print_error("You are logged in as a demo account, this page isn't accessible to you"); } From 2891346a5293149724f1015a47acad25301bf36d Mon Sep 17 00:00:00 2001 From: laf Date: Wed, 22 Apr 2015 20:51:14 +0100 Subject: [PATCH 2/7] Fixed user perms for alert log dropdown --- html/includes/table/alertlog.inc.php | 2 +- html/pages/alert-log.inc.php | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/html/includes/table/alertlog.inc.php b/html/includes/table/alertlog.inc.php index 0dd0a4d60..0d15037c3 100644 --- a/html/includes/table/alertlog.inc.php +++ b/html/includes/table/alertlog.inc.php @@ -11,7 +11,7 @@ if ($_SESSION['userlevel'] >= '5') { $sql = " FROM `alert_log` AS E LEFT JOIN devices AS D ON E.device_id=D.device_id RIGHT JOIN alert_rules AS R ON E.rule_id=R.id WHERE $where"; } else { $sql = " FROM `alert_log` AS E LEFT JOIN devices AS D ON E.device_id=D.device_id RIGHT JOIN alert_rules AS R ON E.rule_id=R.id RIGHT JOIN devices_perms AS P ON E.device_id = P.device_id WHERE $where AND P.user_id = ?"; - $param[] = $_SESSION['user_id']; + $param[] = array($_SESSION['user_id']); } if (isset($searchPhrase) && !empty($searchPhrase)) { diff --git a/html/pages/alert-log.inc.php b/html/pages/alert-log.inc.php index 0d67679dc..45cfac998 100644 --- a/html/pages/alert-log.inc.php +++ b/html/pages/alert-log.inc.php @@ -45,12 +45,15 @@ var grid = $("#alertlog").bootgrid({ ""+ '.$hostname.'"+'); + echo('">'.$hostname.'"+'); } + } ?> ""+ ""+ From 99c97c23ddf3290a078a0249833117a3b0e9e1cc Mon Sep 17 00:00:00 2001 From: laf Date: Wed, 22 Apr 2015 20:54:25 +0100 Subject: [PATCH 3/7] Fixed user perms for eventlog dropdown --- html/pages/eventlog.inc.php | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/html/pages/eventlog.inc.php b/html/pages/eventlog.inc.php index bd6743253..4e1cad13d 100644 --- a/html/pages/eventlog.inc.php +++ b/html/pages/eventlog.inc.php @@ -26,11 +26,12 @@ print_optionbar_start(); ".$hostname.""); + $device_id = getidbyname($hostname); + if (device_permitted($device_id)) { + echo(""); + } } ?> From e66165f9fa9e0a6dcf08dddc5176e4a99de1cc5e Mon Sep 17 00:00:00 2001 From: laf Date: Wed, 22 Apr 2015 20:55:43 +0100 Subject: [PATCH 4/7] Fixed user perms for inventory dropdown --- html/pages/inventory.inc.php | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/html/pages/inventory.inc.php b/html/pages/inventory.inc.php index dc0a5dad6..e53daab96 100644 --- a/html/pages/inventory.inc.php +++ b/html/pages/inventory.inc.php @@ -56,11 +56,13 @@ foreach (dbFetchRows("SELECT `entPhysicalModelName` FROM `entPhysical` GROUP BY '.$data['hostname'].'"+'); } - echo('">'.$data['hostname'].'"+'); } ?> ""+ From 0026ae90f744cdb88a0c84422e5bd6daf393a803 Mon Sep 17 00:00:00 2001 From: laf Date: Wed, 22 Apr 2015 21:09:13 +0100 Subject: [PATCH 5/7] Fixed user perms on devices pages --- html/pages/devices.inc.php | 40 +++++++++++++++++++++++++++++++++----- 1 file changed, 35 insertions(+), 5 deletions(-) diff --git a/html/pages/devices.inc.php b/html/pages/devices.inc.php index 9305c519f..488ed0ba6 100644 --- a/html/pages/devices.inc.php +++ b/html/pages/devices.inc.php @@ -216,7 +216,13 @@ var grid = $("#devices").bootgrid({ ""+ All Versions"+ All Platforms"+ All Featuresets"+ All Device Types"+ Date: Wed, 22 Apr 2015 21:11:18 +0100 Subject: [PATCH 6/7] Fixed user perms on devices menu --- html/includes/print-menubar.php | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/html/includes/print-menubar.php b/html/includes/print-menubar.php index 6c15928e0..c90763560 100644 --- a/html/includes/print-menubar.php +++ b/html/includes/print-menubar.php @@ -95,7 +95,13 @@ if ($_SESSION['userlevel'] >= '10') {
    Date: Wed, 22 Apr 2015 21:35:16 +0100 Subject: [PATCH 7/7] Fixed user perms on ports page --- html/pages/ports.inc.php | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) diff --git a/html/pages/ports.inc.php b/html/pages/ports.inc.php index 386100262..2000ffdab 100644 --- a/html/pages/ports.inc.php +++ b/html/pages/ports.inc.php @@ -140,7 +140,14 @@ foreach ($results as $data)