[pkg-nagios-changes] [Git][nagios-team/nagvis][upstream] New upstream version 1.10.6

Bas Couwenberg (@sebastic) gitlab at salsa.debian.org
Thu Jul 23 18:43:21 BST 2026



Bas Couwenberg pushed to branch upstream at Debian Nagios Maintainer Group / nagvis


Commits:
d2d580dd by Bas Couwenberg at 2026-07-23T19:38:27+02:00
New upstream version 1.10.6
- - - - -


13 changed files:

- ChangeLog
- docs/de_DE/installer.html
- docs/en_US/installer.html
- package-lock.json
- share/frontend/nagvis-js/js/ElementHover.js
- share/server/core/classes/CoreAuthorisationHandler.php
- share/server/core/classes/CorePDOHandler.php
- share/server/core/classes/ViewManageRoles.php
- share/server/core/classes/ViewMapAddModify.php
- share/server/core/classes/objects/NagVisHost.php
- share/server/core/classes/objects/NagVisMapObj.php
- share/server/core/defines/global.php
- share/server/core/functions/html.php


Changes:

=====================================
ChangeLog
=====================================
@@ -1,3 +1,9 @@
+1.10.6
+  * FEAT: The "editHtml" permission can now be granted to roles via the role management GUI, instead of only being available to administrators (#452)
+  * FIX: Non-admin roles (e.g. Managers) can edit maps again - the editHtml permission is now only required to change HTML content, not for every map modification (#452)
+  * FIX: Fix PHP memory exhaustion on maps with many hosts by lazily loading host services on demand (#437)
+  * FIX: Hover menus no longer render unset optional state macros as literal [obj_*] tokens - they now collapse to an empty string
+
 1.10.5
   * FEAT: Add Georgian (ka_GE) language translation (#445)
   * FIX: Restore service list in host hover menus that disappeared after the lazy group member loading change (#437)


=====================================
docs/de_DE/installer.html
=====================================
@@ -18,7 +18,7 @@
         
         <h3>NagVis entpacken</h3>
         <p>Entpacken Sie das Archiv in ein beliebiges Verzeichnis (z.B. /tmp) und wechseln Sie in dieses Verzeichnis</p>
-        <pre>tar xvzf nagvis-1.8*.tar.gz /tmp
+        <pre>tar xvzf nagvis-1.8*.tar.gz -C /tmp
 cd /tmp/nagvis-1.8*</pre>
         
         <h3>Machen Sie den Installer ausführbar</h3>


=====================================
docs/en_US/installer.html
=====================================
@@ -19,7 +19,7 @@
         
         <h3>Unpack NagVis</h3>
         <p>Unpack the archive to a temporary place (for example /tmp) and change to that directory</p>
-        <pre>tar xvzf nagvis-1.8*.tar.gz /tmp
+        <pre>tar xvzf nagvis-1.8*.tar.gz -C /tmp
 cd /tmp/nagvis-1.8*</pre>
         
         <h3>Make installer executable</h3>


=====================================
package-lock.json
=====================================
@@ -769,10 +769,20 @@
             "license": "ISC"
         },
         "node_modules/js-yaml": {
-            "version": "4.1.1",
-            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-            "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
-            "dev": true,
+            "version": "4.3.0",
+            "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
+            "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+            "dev": true,
+            "funding": [
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/puzrin"
+                },
+                {
+                    "type": "github",
+                    "url": "https://github.com/sponsors/nodeca"
+                }
+            ],
             "license": "MIT",
             "dependencies": {
                 "argparse": "^2.0.1"


=====================================
share/frontend/nagvis-js/js/ElementHover.js
=====================================
@@ -506,7 +506,16 @@ const ElementHover = Element.extend({
     },
 
     replaceDynamicMacros: function (template_html) {
-        const oMacros = {};
+        // Defaults: unset optional state macros collapse to an empty string
+        // instead of rendering as literal [obj_*] tokens.
+        const oMacros = {
+            obj_summary_acknowledged: "",
+            obj_acknowledged: "",
+            obj_summary_in_downtime: "",
+            obj_in_downtime: "",
+            obj_summary_stale: "",
+            obj_stale: ""
+        };
 
         if (g_view.type === "map") oMacros.map_name = oPageProperties.map_name;
 


=====================================
share/server/core/classes/CoreAuthorisationHandler.php
=====================================
@@ -63,7 +63,6 @@ class CoreAuthorisationHandler
             'createObject' => 'edit',
             'deleteObject' => 'edit',
             'addModify' => 'edit',
-            'editHtml' => 'edit',
         ],
         'Overview' => [
             'getOverviewRotations' => 'view',


=====================================
share/server/core/classes/CorePDOHandler.php
=====================================
@@ -174,6 +174,10 @@ class CorePDOHandler
                 ],
 
                 'updates' => [
+                    '1100500' => [
+                        ['-perm-add', ['mod' => 'Map', 'act' => 'editHtml', 'obj' => '*']],
+                    ],
+
                     '1091500' => [
                         ['-perm-change-act', ['mod' => 'ChangePassword', 'old_act' => 'change', 'new_act' => '*']]
                     ],
@@ -830,6 +834,10 @@ class CorePDOHandler
         $this->queryFatal('-perm-add', ['mod' => 'Map', 'act' => 'manage', 'obj' => '*']);
         $this->queryFatal('-perm-add', ['mod' => 'Map', 'act' => 'add', 'obj' => '*']);
 
+        // Access controll: Edit HTML content of map objects, grantable via the
+        // role management GUI (CVE-2024-47090)
+        $this->queryFatal('-perm-add', ['mod' => 'Map', 'act' => 'editHtml', 'obj' => '*']);
+
         $this->queryFatal('-perm-add', ['mod' => 'MainCfg', 'act' => 'edit', 'obj' => '*']);
 
         // Access control: View URLs e.g. in rotation pools


=====================================
share/server/core/classes/ViewManageRoles.php
=====================================
@@ -205,7 +205,12 @@ class ViewManageRoles
             'rotations' => [],
         ];
         foreach ($AUTHORISATION->getAllVisiblePerms() as $perm) {
-            if ($perm['mod'] == 'Map' && $perm['act'] != 'add' && $perm['act'] != 'manage') {
+            if (
+                $perm['mod'] == 'Map'
+                && $perm['act'] != 'add'
+                && $perm['act'] != 'manage'
+                && $perm['act'] != 'editHtml'
+            ) {
                 $map_name = $perm['obj'];
                 if (!isset($permissions_by_section['maps'][$map_name])) {
                     $permissions_by_section['maps'][$map_name] = [];


=====================================
share/server/core/classes/ViewMapAddModify.php
=====================================
@@ -160,9 +160,24 @@ class ViewMapAddModify
         $perm_user = get_checkbox('perm_user');
         $show_dialog = false;
 
+        // Only block when an HTML field (e.g. textbox "text") is actually
+        // changed, so regular map editing works without editHtml (CVE-2024-47090).
         global $AUTHORISATION;
         if (!$AUTHORISATION->isPermitted('Map', 'editHtml', '*')) {
-            throw new NagVisException(l('Cannot edit HTML. Please contact your administrator'));
+            $attrDefs = $this->MAPCFG->getValidObjectType($this->object_type);
+            foreach ($this->attrs as $key => $val) {
+                if (!isset($attrDefs[$key]['field_type']) || $attrDefs[$key]['field_type'] !== 'textarea') {
+                    continue;
+                }
+
+                $current = ($this->object_id !== null && $this->MAPCFG->objExists($this->object_id))
+                    ? $this->MAPCFG->getValue($this->object_id, $key, true)
+                    : null;
+
+                if ($val !== $current) {
+                    throw new NagVisException(l('Cannot edit HTML. Please contact your administrator'));
+                }
+            }
         }
 
         // Modification/Creation?


=====================================
share/server/core/classes/objects/NagVisHost.php
=====================================
@@ -89,6 +89,44 @@ class NagVisHost extends NagVisStatefulObject
         }
     }
 
+    /**
+     * Returns the number of service members.
+     * When the service details have not been loaded yet (lazy loading), the
+     * total is derived from the service state counts fetched via hostMemberState.
+     * The host's own state, which is merged into the counts for the summary
+     * calculation, is excluded. The count is only reported when the host is
+     * configured to show its services in the hover menu, matching the condition
+     * under which the service details are loaded on demand.
+     *
+     * @return int
+     */
+    public function getNumMembers()
+    {
+        if (!empty($this->members)) {
+            return count($this->members);
+        }
+        if (
+            !$this->recognize_services
+            || $this->hover_menu != 1
+            || $this->hover_childs_show != 1
+            || $this->aStateCounts === null
+        ) {
+            return 0;
+        }
+        $total = 0;
+        foreach ($this->aStateCounts as $sState => $aSubstates) {
+            // The host state is added to the counts for summary purposes; only
+            // the service states represent actual members.
+            if (is_host_state($sState)) {
+                continue;
+            }
+            foreach ($aSubstates as $iCount) {
+                $total += $iCount;
+            }
+        }
+        return $total;
+    }
+
     /**
      * Queues the state fetching to the backend.
      *


=====================================
share/server/core/classes/objects/NagVisMapObj.php
=====================================
@@ -357,24 +357,32 @@ class NagVisMapObj extends NagVisStatefulObject
         foreach ($this->getStateRelevantMembers() as $OBJ) {
             $sType = $OBJ->getType();
 
-            // Host- and servicegroups can contain thousands of members. To avoid
-            // exhausting the PHP memory limit their member details are not loaded
-            // on map load, but lazily on demand via the getObjectMembers endpoint
-            // when a hover menu is opened (see #437). Only the cheap aggregate
-            // state counts are queried here, which is enough for icon colouring
-            // and for reporting the correct num_members to the frontend.
-            $bLazyMembers = $sType === 'hostgroup' || $sType === 'servicegroup';
+            // Hosts (with their services) and host-/servicegroups can contain
+            // thousands of members. To avoid exhausting the PHP memory limit their
+            // member details are not loaded on map load, but lazily on demand via
+            // the getObjectMembers endpoint when a hover menu is opened (see #437).
+            // Only the cheap aggregate state counts are queried here, which is
+            // enough for icon colouring and for reporting the correct num_members
+            // to the frontend so it can trigger the lazy fetch.
+            //
+            // Hosts only expose a num_members fallback (and therefore only support
+            // lazy loading) when recognize_services is enabled, because that is the
+            // only case in which the aggregate service state counts are fetched.
+            // Without it, hosts keep loading their services eagerly.
+            $bLazyMembers = $sType === 'hostgroup'
+                || $sType === 'servicegroup'
+                || ($sType === 'host' && $OBJ->getRecognizeServices());
 
             // Gadgets render synchronously and read conf.members directly at
             // render time, so their member details must be loaded eagerly even
-            // for the otherwise lazily loaded group types.
+            // for the otherwise lazily loaded object types.
             $bGadget = $OBJ->get('view_type') === 'gadget';
 
             if ($bLazyMembers && !$bGadget) {
                 $OBJ->queueState(GET_STATE, DONT_GET_SINGLE_MEMBER_STATES);
             } elseif ($this->isView === true || $bGadget) {
-                // On a viewed map the hover menus of hosts, dyngroups, aggregates
-                // and submaps need their single member states right away. When the
+                // On a viewed map the hover menus of dyngroups, aggregates and
+                // submaps need their single member states right away. When the
                 // map object is only rendered as a summary icon (e.g. overview or
                 // multisite snapin) no hover menu is shown, so the details are not
                 // fetched.


=====================================
share/server/core/defines/global.php
=====================================
@@ -24,7 +24,7 @@
  *****************************************************************************/
 
 // NagVis Version
-const CONST_VERSION = '1.10.5';
+const CONST_VERSION = '1.10.6';
 
 // Set PHP error handling to standard level
 // Different levels for php versions below 5.1 because PHP 5.1 reports


=====================================
share/server/core/functions/html.php
=====================================
@@ -431,7 +431,10 @@ function textarea($name, $default = '', $class = '', $style = '')
 
     global $AUTHORISATION;
     if (!$AUTHORISATION->isPermitted('Map', 'editHtml', '*')) {
-        echo '<b>Cannot edit HTML. Please contact your administrator.</b>';
+        // No editHtml permission (CVE-2024-47090): hide the editor but keep the
+        // current value so the object can still be saved/moved unchanged.
+        hidden($name, $default);
+        echo '<b>' . l('Cannot edit HTML. Please contact your administrator') . '</b>';
         return;
     }
     // plain <textarea>



View it on GitLab: https://salsa.debian.org/nagios-team/nagvis/-/commit/d2d580ddde95e2c119e810eb329da766ba6bece1

-- 
View it on GitLab: https://salsa.debian.org/nagios-team/nagvis/-/commit/d2d580ddde95e2c119e810eb329da766ba6bece1
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-nagios-changes/attachments/20260723/52862579/attachment-0001.htm>


More information about the pkg-nagios-changes mailing list