[pkg-nagios-changes] [Git][nagios-team/nagvis][upstream] New upstream version 1.10.6
Bas Couwenberg (@sebastic)
gitlab at salsa.debian.org
Thu Jul 23 18:43:21 BST 2026
Bas Couwenberg pushed to branch upstream at Debian Nagios Maintainer Group / nagvis
Commits:
d2d580dd by Bas Couwenberg at 2026-07-23T19:38:27+02:00
New upstream version 1.10.6
- - - - -
13 changed files:
- ChangeLog
- docs/de_DE/installer.html
- docs/en_US/installer.html
- package-lock.json
- share/frontend/nagvis-js/js/ElementHover.js
- share/server/core/classes/CoreAuthorisationHandler.php
- share/server/core/classes/CorePDOHandler.php
- share/server/core/classes/ViewManageRoles.php
- share/server/core/classes/ViewMapAddModify.php
- share/server/core/classes/objects/NagVisHost.php
- share/server/core/classes/objects/NagVisMapObj.php
- share/server/core/defines/global.php
- share/server/core/functions/html.php
Changes:
=====================================
ChangeLog
=====================================
@@ -1,3 +1,9 @@
+1.10.6
+ * FEAT: The "editHtml" permission can now be granted to roles via the role management GUI, instead of only being available to administrators (#452)
+ * FIX: Non-admin roles (e.g. Managers) can edit maps again - the editHtml permission is now only required to change HTML content, not for every map modification (#452)
+ * FIX: Fix PHP memory exhaustion on maps with many hosts by lazily loading host services on demand (#437)
+ * FIX: Hover menus no longer render unset optional state macros as literal [obj_*] tokens - they now collapse to an empty string
+
1.10.5
* FEAT: Add Georgian (ka_GE) language translation (#445)
* FIX: Restore service list in host hover menus that disappeared after the lazy group member loading change (#437)
=====================================
docs/de_DE/installer.html
=====================================
@@ -18,7 +18,7 @@
<h3>NagVis entpacken</h3>
<p>Entpacken Sie das Archiv in ein beliebiges Verzeichnis (z.B. /tmp) und wechseln Sie in dieses Verzeichnis</p>
- <pre>tar xvzf nagvis-1.8*.tar.gz /tmp
+ <pre>tar xvzf nagvis-1.8*.tar.gz -C /tmp
cd /tmp/nagvis-1.8*</pre>
<h3>Machen Sie den Installer ausführbar</h3>
=====================================
docs/en_US/installer.html
=====================================
@@ -19,7 +19,7 @@
<h3>Unpack NagVis</h3>
<p>Unpack the archive to a temporary place (for example /tmp) and change to that directory</p>
- <pre>tar xvzf nagvis-1.8*.tar.gz /tmp
+ <pre>tar xvzf nagvis-1.8*.tar.gz -C /tmp
cd /tmp/nagvis-1.8*</pre>
<h3>Make installer executable</h3>
=====================================
package-lock.json
=====================================
@@ -769,10 +769,20 @@
"license": "ISC"
},
"node_modules/js-yaml": {
- "version": "4.1.1",
- "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
- "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
- "dev": true,
+ "version": "4.3.0",
+ "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+ "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+ "dev": true,
+ "funding": [
+ {
+ "type": "github",
+ "url": "https://github.com/sponsors/puzrin"
+ },
+ {
+ "type": "github",
+ "url": "https://github.com/sponsors/nodeca"
+ }
+ ],
"license": "MIT",
"dependencies": {
"argparse": "^2.0.1"
=====================================
share/frontend/nagvis-js/js/ElementHover.js
=====================================
@@ -506,7 +506,16 @@ const ElementHover = Element.extend({
},
replaceDynamicMacros: function (template_html) {
- const oMacros = {};
+ // Defaults: unset optional state macros collapse to an empty string
+ // instead of rendering as literal [obj_*] tokens.
+ const oMacros = {
+ obj_summary_acknowledged: "",
+ obj_acknowledged: "",
+ obj_summary_in_downtime: "",
+ obj_in_downtime: "",
+ obj_summary_stale: "",
+ obj_stale: ""
+ };
if (g_view.type === "map") oMacros.map_name = oPageProperties.map_name;
=====================================
share/server/core/classes/CoreAuthorisationHandler.php
=====================================
@@ -63,7 +63,6 @@ class CoreAuthorisationHandler
'createObject' => 'edit',
'deleteObject' => 'edit',
'addModify' => 'edit',
- 'editHtml' => 'edit',
],
'Overview' => [
'getOverviewRotations' => 'view',
=====================================
share/server/core/classes/CorePDOHandler.php
=====================================
@@ -174,6 +174,10 @@ class CorePDOHandler
],
'updates' => [
+ '1100500' => [
+ ['-perm-add', ['mod' => 'Map', 'act' => 'editHtml', 'obj' => '*']],
+ ],
+
'1091500' => [
['-perm-change-act', ['mod' => 'ChangePassword', 'old_act' => 'change', 'new_act' => '*']]
],
@@ -830,6 +834,10 @@ class CorePDOHandler
$this->queryFatal('-perm-add', ['mod' => 'Map', 'act' => 'manage', 'obj' => '*']);
$this->queryFatal('-perm-add', ['mod' => 'Map', 'act' => 'add', 'obj' => '*']);
+ // Access controll: Edit HTML content of map objects, grantable via the
+ // role management GUI (CVE-2024-47090)
+ $this->queryFatal('-perm-add', ['mod' => 'Map', 'act' => 'editHtml', 'obj' => '*']);
+
$this->queryFatal('-perm-add', ['mod' => 'MainCfg', 'act' => 'edit', 'obj' => '*']);
// Access control: View URLs e.g. in rotation pools
=====================================
share/server/core/classes/ViewManageRoles.php
=====================================
@@ -205,7 +205,12 @@ class ViewManageRoles
'rotations' => [],
];
foreach ($AUTHORISATION->getAllVisiblePerms() as $perm) {
- if ($perm['mod'] == 'Map' && $perm['act'] != 'add' && $perm['act'] != 'manage') {
+ if (
+ $perm['mod'] == 'Map'
+ && $perm['act'] != 'add'
+ && $perm['act'] != 'manage'
+ && $perm['act'] != 'editHtml'
+ ) {
$map_name = $perm['obj'];
if (!isset($permissions_by_section['maps'][$map_name])) {
$permissions_by_section['maps'][$map_name] = [];
=====================================
share/server/core/classes/ViewMapAddModify.php
=====================================
@@ -160,9 +160,24 @@ class ViewMapAddModify
$perm_user = get_checkbox('perm_user');
$show_dialog = false;
+ // Only block when an HTML field (e.g. textbox "text") is actually
+ // changed, so regular map editing works without editHtml (CVE-2024-47090).
global $AUTHORISATION;
if (!$AUTHORISATION->isPermitted('Map', 'editHtml', '*')) {
- throw new NagVisException(l('Cannot edit HTML. Please contact your administrator'));
+ $attrDefs = $this->MAPCFG->getValidObjectType($this->object_type);
+ foreach ($this->attrs as $key => $val) {
+ if (!isset($attrDefs[$key]['field_type']) || $attrDefs[$key]['field_type'] !== 'textarea') {
+ continue;
+ }
+
+ $current = ($this->object_id !== null && $this->MAPCFG->objExists($this->object_id))
+ ? $this->MAPCFG->getValue($this->object_id, $key, true)
+ : null;
+
+ if ($val !== $current) {
+ throw new NagVisException(l('Cannot edit HTML. Please contact your administrator'));
+ }
+ }
}
// Modification/Creation?
=====================================
share/server/core/classes/objects/NagVisHost.php
=====================================
@@ -89,6 +89,44 @@ class NagVisHost extends NagVisStatefulObject
}
}
+ /**
+ * Returns the number of service members.
+ * When the service details have not been loaded yet (lazy loading), the
+ * total is derived from the service state counts fetched via hostMemberState.
+ * The host's own state, which is merged into the counts for the summary
+ * calculation, is excluded. The count is only reported when the host is
+ * configured to show its services in the hover menu, matching the condition
+ * under which the service details are loaded on demand.
+ *
+ * @return int
+ */
+ public function getNumMembers()
+ {
+ if (!empty($this->members)) {
+ return count($this->members);
+ }
+ if (
+ !$this->recognize_services
+ || $this->hover_menu != 1
+ || $this->hover_childs_show != 1
+ || $this->aStateCounts === null
+ ) {
+ return 0;
+ }
+ $total = 0;
+ foreach ($this->aStateCounts as $sState => $aSubstates) {
+ // The host state is added to the counts for summary purposes; only
+ // the service states represent actual members.
+ if (is_host_state($sState)) {
+ continue;
+ }
+ foreach ($aSubstates as $iCount) {
+ $total += $iCount;
+ }
+ }
+ return $total;
+ }
+
/**
* Queues the state fetching to the backend.
*
=====================================
share/server/core/classes/objects/NagVisMapObj.php
=====================================
@@ -357,24 +357,32 @@ class NagVisMapObj extends NagVisStatefulObject
foreach ($this->getStateRelevantMembers() as $OBJ) {
$sType = $OBJ->getType();
- // Host- and servicegroups can contain thousands of members. To avoid
- // exhausting the PHP memory limit their member details are not loaded
- // on map load, but lazily on demand via the getObjectMembers endpoint
- // when a hover menu is opened (see #437). Only the cheap aggregate
- // state counts are queried here, which is enough for icon colouring
- // and for reporting the correct num_members to the frontend.
- $bLazyMembers = $sType === 'hostgroup' || $sType === 'servicegroup';
+ // Hosts (with their services) and host-/servicegroups can contain
+ // thousands of members. To avoid exhausting the PHP memory limit their
+ // member details are not loaded on map load, but lazily on demand via
+ // the getObjectMembers endpoint when a hover menu is opened (see #437).
+ // Only the cheap aggregate state counts are queried here, which is
+ // enough for icon colouring and for reporting the correct num_members
+ // to the frontend so it can trigger the lazy fetch.
+ //
+ // Hosts only expose a num_members fallback (and therefore only support
+ // lazy loading) when recognize_services is enabled, because that is the
+ // only case in which the aggregate service state counts are fetched.
+ // Without it, hosts keep loading their services eagerly.
+ $bLazyMembers = $sType === 'hostgroup'
+ || $sType === 'servicegroup'
+ || ($sType === 'host' && $OBJ->getRecognizeServices());
// Gadgets render synchronously and read conf.members directly at
// render time, so their member details must be loaded eagerly even
- // for the otherwise lazily loaded group types.
+ // for the otherwise lazily loaded object types.
$bGadget = $OBJ->get('view_type') === 'gadget';
if ($bLazyMembers && !$bGadget) {
$OBJ->queueState(GET_STATE, DONT_GET_SINGLE_MEMBER_STATES);
} elseif ($this->isView === true || $bGadget) {
- // On a viewed map the hover menus of hosts, dyngroups, aggregates
- // and submaps need their single member states right away. When the
+ // On a viewed map the hover menus of dyngroups, aggregates and
+ // submaps need their single member states right away. When the
// map object is only rendered as a summary icon (e.g. overview or
// multisite snapin) no hover menu is shown, so the details are not
// fetched.
=====================================
share/server/core/defines/global.php
=====================================
@@ -24,7 +24,7 @@
*****************************************************************************/
// NagVis Version
-const CONST_VERSION = '1.10.5';
+const CONST_VERSION = '1.10.6';
// Set PHP error handling to standard level
// Different levels for php versions below 5.1 because PHP 5.1 reports
=====================================
share/server/core/functions/html.php
=====================================
@@ -431,7 +431,10 @@ function textarea($name, $default = '', $class = '', $style = '')
global $AUTHORISATION;
if (!$AUTHORISATION->isPermitted('Map', 'editHtml', '*')) {
- echo '<b>Cannot edit HTML. Please contact your administrator.</b>';
+ // No editHtml permission (CVE-2024-47090): hide the editor but keep the
+ // current value so the object can still be saved/moved unchanged.
+ hidden($name, $default);
+ echo '<b>' . l('Cannot edit HTML. Please contact your administrator') . '</b>';
return;
}
// plain <textarea>
View it on GitLab: https://salsa.debian.org/nagios-team/nagvis/-/commit/d2d580ddde95e2c119e810eb329da766ba6bece1
--
View it on GitLab: https://salsa.debian.org/nagios-team/nagvis/-/commit/d2d580ddde95e2c119e810eb329da766ba6bece1
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-nagios-changes/attachments/20260723/52862579/attachment-0001.htm>
More information about the pkg-nagios-changes
mailing list