[Pkg-nagios-devel] Bug#769132: icinga-web: wheezy icinga-web 1.7 breaks with wheezy-security php 5.4.34 upgrade

[Tero Marttila]

Package: icinga-web
Version: 1.7.1+dfsg2-6
Severity: important

After the recent wheezy-security php5 upgrade to 5.4.34-0+deb7u1, the icinga-web UI no long functions,
giving 500 ISE errors for the Ajax requests:

	Uncaught AppKitPHPError thrown:
	PHP Error Trying to get property of non-object (/usr/share/icinga-web/app/modules/Cronks/lib/template/CronkGridTemplateXmlParser.class.php:291)
	Stacktrace:
	#0 /usr/share/icinga-web/app/modules/Cronks/lib/template/CronkGridTemplateXmlParser.class.php(291): AppKitExceptionHandler::phpErrorException(8, 'Trying to get p...', '/usr/share/icin...', 291, Array)
	#1 /usr/share/icinga-web/app/modules/Cronks/lib/template/CronkGridTemplateXmlParser.class.php(205): CronkGridTemplateXmlParser->domRoot()
	#2 /usr/share/icinga-web/app/modules/Cronks/views/System/ViewProc/MetaInformationSuccessView.class.php(36): CronkGridTemplateXmlParser->parseTemplate()
	#3 /var/cache/icinga-web/config/compile.xml_production__d41bc4e7416d79a2859fb497054ab4f5308e2df1.php(1672): Cronks_System_ViewProc_MetaInformationSuccessView->executeJson(Object(AgaviWebRequestDataHolder))
	#4 /var/cache/icinga-web/config/compile.xml_production__d41bc4e7416d79a2859fb497054ab4f5308e2df1.php(1533): AgaviExecutionFilter->executeView(Object(AgaviExecutionContainer))
	#5 /var/cache/icinga-web/config/compile.xml_production__d41bc4e7416d79a2859fb497054ab4f5308e2df1.php(1255): AgaviExecutionFilter->execute(Object(AgaviFilterChain), Object(AgaviExecutionContainer))
	#6 /var/cache/icinga-web/config/compile.xml_production__d41bc4e7416d79a2859fb497054ab4f5308e2df1.php(1700): AgaviFilter->executeOnce(Object(AgaviFilterChain), Object(AgaviExecutionContainer))
	#7 /usr/share/icinga-web/lib/agavi/src/filter/AgaviSecurityFilter.class.php(73): AgaviFilterChain->execute(Object(AgaviExecutionContainer))
	#8 /var/cache/icinga-web/config/compile.xml_production__d41bc4e7416d79a2859fb497054ab4f5308e2df1.php(1255): AgaviSecurityFilter->execute(Object(AgaviFilterChain), Object(AgaviExecutionContainer))
	#9 /var/cache/icinga-web/config/compile.xml_production__d41bc4e7416d79a2859fb497054ab4f5308e2df1.php(1700): AgaviFilter->executeOnce(Object(AgaviFilterChain), Object(AgaviExecutionContainer))
	#10 /var/cache/icinga-web/config/compile.xml_production__d41bc4e7416d79a2859fb497054ab4f5308e2df1.php(870): AgaviFilterChain->execute(Object(AgaviExecutionContainer))
	#11 /var/cache/icinga-web/config/compile.xml_production__d41bc4e7416d79a2859fb497054ab4f5308e2df1.php(1266): AgaviExecutionContainer->execute()
	#12 /var/cache/icinga-web/config/compile.xml_production__d41bc4e7416d79a2859fb497054ab4f5308e2df1.php(1255): AgaviDispatchFilter->execute(Object(AgaviFilterChain), Object(AgaviExecutionContainer))
	#13 /var/cache/icinga-web/config/compile.xml_production__d41bc4e7416d79a2859fb497054ab4f5308e2df1.php(1700): AgaviFilter->executeOnce(Object(AgaviFilterChain), Object(AgaviExecutionContainer))
	#14 /usr/share/icinga-web/lib/agavi/src/filter/AgaviFormPopulationFilter.class.php(78): AgaviFilterChain->execute(Object(AgaviExecutionContainer))
	#15 /var/cache/icinga-web/config/compile.xml_production__d41bc4e7416d79a2859fb497054ab4f5308e2df1.php(1700): AgaviFormPopulationFilter->executeOnce(Object(AgaviFilterChain), Object(AgaviExecutionContainer))
	#16 /var/cache/icinga-web/config/compile.xml_production__d41bc4e7416d79a2859fb497054ab4f5308e2df1.php(579): AgaviFilterChain->execute(Object(AgaviExecutionContainer))
	#17 /usr/share/icinga-web/pub/index.php(49): AgaviController->dispatch()
	#18 {main}

Tracking this upstream, this appears to be https://dev.icinga.org/issues/3751
and I can verify that the related patch to class Cronks_System_ViewProc_MetaInformationSuccessView
fixes the issue for icinga-web 1.7.1+dfsg2-6:

	--- a/app/modules/Cronks/views/System/ViewProc/MetaInformationSuccessView.class.php
	+++ b/app/modules/Cronks/views/System/ViewProc/MetaInformationSuccessView.class.php
	@@ -42,7 +42,7 @@ class Cronks_System_ViewProc_MetaInformationSuccessView extends CronksBaseView {
              if($file === null)
                 $file = AppKitFileUtil::getAlternateFilename(AgaviConfig::get('modules.cronks.xml.path.grid'), $rd->getParameter('template'), '.xml');
-            $template = new CronkGridTemplateXmlParser($file);
+            $template = new CronkGridTemplateXmlParser($file->getRealPath());
             $template->parseTemplate();
             $user = $this->getContext()->getUser()->getNsmUser();
             $data = $template->getTemplateData();

Could this regression be fixed in the wheezy icinga-web?

 -- Tero Marttila

-- System Information:
Debian Release: 7.7
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-4-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages icinga-web depends on:
ii  dbconfig-common        1.8.47+nmu1
ii  debconf [debconf-2.0]  1.5.49
ii  icinga-core            1.7.1-7
ii  icinga-idoutils        1.7.1-7
ii  php5                   5.4.34-0+deb7u1
ii  php5-cli               5.4.34-0+deb7u1
ii  php5-gd                5.4.34-0+deb7u1
ii  php5-mysql             5.4.34-0+deb7u1
ii  php5-xsl               5.4.34-0+deb7u1
ii  ucf                    3.0025+nmu3

Versions of packages icinga-web recommends:
ii  apache2-mpm-worker [httpd]       2.2.22-13+deb7u3
ii  mysql-client-5.5 [mysql-client]  5.5.40-0+wheezy1

icinga-web suggests no packages.

-- Configuration Files:
/etc/icinga-web/conf.d/auth.xml changed [not included]
/etc/icinga-web/conf.d/databases.xml [Errno 13] Permission denied: u'/etc/icinga-web/conf.d/databases.xml'
/etc/icinga-web/conf.d/logging.xml changed [not included]
/etc/icinga-web/conf.d/module_reporting.xml [Errno 13] Permission denied: u'/etc/icinga-web/conf.d/module_reporting.xml'

-- debconf information excluded