Weathermap - Cacti 1.x compatible release available for testing

[nicolatron]

Can you add the following code

Code: Select all

header("Content-Security-Policy:script-src 'self' 'unsafe-inline' 'unsafe-eval';")

to the very top of the weathermap-cacti-plugin.php right after the <?php statement ?

It's not best practive and makes it unsafe, but it's an issue with the external overlib javascript library which makes extensive use of the eval function and needs a rewrite ...

Hi phalek, i have reverted back to 1.2.8, in a few days when I have the new server set up, i'll install 1.2.9 again to test this.
Thanks

[Rno]

Can you add the following code

Code: Select all

header("Content-Security-Policy:script-src 'self' 'unsafe-inline' 'unsafe-eval';")

to the very top of the weathermap-cacti-plugin.php right after the <?php statement ?

It's not best practive and makes it unsafe, but it's an issue with the external overlib javascript library which makes extensive use of the eval function and needs a rewrite ...

Oups doing so give a :
Sorry, we could not process your last action.
Error:
500 Internal Server Error
Reason:
The response to the last action was unexpected.

[Rno]

I can't delete it so my mistake

[Rno]

Having multiple map, I'm getting an error when I try to view it:
I can view the thumbnail, but when I try to go into one map it's giving me this error.
And always try to display the first map, even if i select the second one (on the map selector). But then if i select the second map and click go it give me the second one.

13/02/2020 15:35:53 - CMDPHP SQL Backtrace: (/plugins/weathermap/weathermap-cacti-plugin.php[263]:weathermap_singleview(), /plugins/weathermap/weathermap-cacti-plugin.php[375]:db_fetch_assoc(), /lib/database.php[473]:db_fetch_assoc_prepared(), /lib/database.php[487]:db_execute_prepared())
13/02/2020 15:35:53 - CMDPHP ERROR: A DB Row Failed!, Error: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'er_id='1' and user_auth_realm.realm_id='111'' at line 1
13/02/2020 15:35:53 - CMDPHP PHP ERROR NOTICE Backtrace: (/plugins/weathermap/weathermap-cacti-plugin.php[263]:weathermap_singleview(), /plugins/weathermap/weathermap-cacti-plugin.php[331]:CactiErrorHandler())
13/02/2020 15:35:53 - ERROR PHP NOTICE in Plugin 'weathermap': Trying to access array offset on value of type null in file: /usr/share/cacti/plugins/weathermap/weathermap-cacti-plugin.php on line: 331
13/02/2020 15:35:53 - CMDPHP PHP ERROR NOTICE Backtrace: (/plugins/weathermap/weathermap-cacti-plugin.php[263]:weathermap_singleview(), /plugins/weathermap/weathermap-cacti-plugin.php[331]:CactiErrorHandler())
13/02/2020 15:35:53 - ERROR PHP NOTICE in Plugin 'weathermap': Trying to access array offset on value of type bool in file: /usr/share/cacti/plugins/weathermap/weathermap-cacti-plugin.php on line: 331
13/02/2020 15:35:53 - CMDPHP PHP ERROR NOTICE Backtrace: (/plugins/weathermap/weathermap-cacti-plugin.php[263]:weathermap_singleview(), /plugins/weathermap/weathermap-cacti-plugin.php[330]:CactiErrorHandler())
13/02/2020 15:35:53 - ERROR PHP NOTICE in Plugin 'weathermap': Trying to access array offset on value of type null in file: /usr/share/cacti/plugins/weathermap/weathermap-cacti-plugin.php on line: 330
13/02/2020 15:35:53 - CMDPHP PHP ERROR NOTICE Backtrace: (/plugins/weathermap/weathermap-cacti-plugin.php[263]:weathermap_singleview(), /plugins/weathermap/weathermap-cacti-plugin.php[330]:CactiErrorHandler())
13/02/2020 15:35:53 - ERROR PHP NOTICE in Plugin 'weathermap': Trying to access array offset on value of type bool in file: /usr/share/cacti/plugins/weathermap/weathermap-cacti-plugin.php on line: 330
13/02/2020 15:35:53 - CMDPHP PHP ERROR NOTICE Backtrace: (/plugins/weathermap/weathermap-cacti-plugin.php[263]:weathermap_singleview(), /plugins/weathermap/weathermap-cacti-plugin.php[329]:CactiErrorHandler())
13/02/2020 15:35:53 - ERROR PHP NOTICE in Plugin 'weathermap': Trying to access array offset on value of type null in file: /usr/share/cacti/plugins/weathermap/weathermap-cacti-plugin.php on line: 329
13/02/2020 15:35:53 - CMDPHP PHP ERROR NOTICE Backtrace: (/plugins/weathermap/weathermap-cacti-plugin.php[263]:weathermap_singleview(), /plugins/weathermap/weathermap-cacti-plugin.php[329]:CactiErrorHandler())
13/02/2020 15:35:53 - ERROR PHP NOTICE in Plugin 'weathermap': Trying to access array offset on value of type bool in file: /usr/share/cacti/plugins/weathermap/weathermap-cacti-plugin.php on line: 329
13/02/2020 15:35:53 - CMDPHP PHP ERROR WARNING Backtrace: (/plugins/weathermap/weathermap-cacti-plugin.php[263]:weathermap_singleview(), /plugins/weathermap/weathermap-cacti-plugin.php[325]:CactiErrorHandler())
13/02/2020 15:35:53 - ERROR PHP WARNING in Plugin 'weathermap': sizeof(): Parameter must be an array or an object that implements Countable in file: /usr/share/cacti/plugins/weathermap/weathermap-cacti-plugin.php on line: 325
13/02/2020 15:35:53 - CMDPHP SQL Backtrace: (/plugins/weathermap/weathermap-cacti-plugin.php[263]:weathermap_singleview(), /plugins/weathermap/weathermap-cacti-plugin.php[322]:db_fetch_assoc(), /lib/database.php[473]:db_fetch_assoc_prepared(), /lib/database.php[487]:db_execute_prepared())
13/02/2020 15:35:53 - CMDPHP ERROR: A DB Row Failed!, Error: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' at line 1
13/02/2020 15:35:53 - CMDPHP PHP ERROR NOTICE Backtrace: (/plugins/weathermap/weathermap-cacti-plugin.php[255]:weathermap_translate_id(), /plugins/weathermap/weathermap-cacti-plugin.php[679]:CactiErrorHandler())
13/02/2020 15:35:53 - ERROR PHP NOTICE in Plugin 'weathermap': Trying to access array offset on value of type null in file: /usr/share/cacti/plugins/weathermap/weathermap-cacti-plugin.php on line: 679
13/02/2020 15:35:53 - CMDPHP PHP ERROR NOTICE Backtrace: (/plugins/weathermap/weathermap-cacti-plugin.php[255]:weathermap_translate_id(), /plugins/weathermap/weathermap-cacti-plugin.php[679]:CactiErrorHandler())
13/02/2020 15:35:53 - ERROR PHP NOTICE in Plugin 'weathermap': Undefined offset: 0 in file: /usr/share/cacti/plugins/weathermap/weathermap-cacti-plugin.php on line: 679

[Rno]

Ho ther is a " at the end of the url when you select a map:
http://server/cacti/plugins/weathermap/ ... c7112f1%22

[MrRat]

The overlib/hover does not work in chrome since upgrading cacti from 1.2.7 to 1.2.9. When using 1.2.7 cacti you had to hit f5/refresh for the hover to work but at least it worked. I cant get it to work in chrome with 1.2.9

[jamesbtate]

This plugin seems to work on RedHat 7.7 (CentOS 7.7) with Cacti installed from Yum (cacti-1.2.6-1.el7.noarch).

Installation instructions:

Code: Select all

cd /usr/share/cacti/plugins
sudo git clone https://github.com/thurban/plugin_weathermap/tree/develop
sudo mv plugin_weathermap weathermap
cd weathermap
sudo chown apache:apache output/ configs/
# In Cacti web UI, install and enable the plugin.

Suggested change: Disable the stand-alone editor by setting

Code: Select all

$ENABLED=false;

at the top of editor.php. This will prevent un-authenticated users from accessing the editor. Without this change, anyone with access to the server can just go to http://cacti.example.com/cacti/plugins/ ... editor.php and make changes.

[Howie]

Suggested change: Disable the stand-alone editor by setting

Code: Select all

$ENABLED=false;

at the top of editor.php. This will prevent un-authenticated users from accessing the editor. Without this change, anyone with access to the server can just go to http://cacti.example.com/cacti/plugins/ ... editor.php and make changes.

This was the default *sigh*

[Rno]

Anyone has a fix for the OVERLIBGRAPH function who is still not working ?

[intergalactic]

Anyone has a fix for the OVERLIBGRAPH function who is still not working ?

My 2 cents:
Add 'unsafe-eval' in lib/html.php and in include/global.php. Maybe changing html.php is enough.
The graphs are placed far from the cursor but at least are there.
Don't forget that this is quick and dirty/unsafe hack.

Code: Select all

include/global.php:     header("Content-Security-Policy: default-src *; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self';");
lib/html.php:   <meta http-equiv="Content-Security-Policy" content="default-src *; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval';">

[Osiris]

Unsafe-eval for what section?

[Rno]

I have this error when I try to overlib a data:
EvalError: call to eval() blocked by CSP overlib.js3
registerCommands http://cacti.lausanne.ch/cacti/plugins/ ... ib.js:1310
<anonyme> http://cacti.lausanne.ch/cacti/plugins/ ... rlib.js:32
Content Security Policy: Les paramètres de la page ont empêché le chargement d’une ressource à eval (« default-src »). overlib.js2
Content Security Policy: Les paramètres de la page ont empêché le chargement d’une ressource à eval (« script-src »). overlib.js2
ReferenceError: DELAY is not defined
weathermap-cacti-plugin.php:1:1
onmouseover http://cacti.lausanne.ch/cacti/plugins/ ... 1264915e:1
ReferenceError: DELAY is not defined
weathermap-cacti-plugin.php:1:1
onmouseover http://cacti.lausanne.ch/cacti/plugins/ ... 1264915e:1

​

[kklp90]

Anyone has a fix for the OVERLIBGRAPH function who is still not working ?

My 2 cents:
Add 'unsafe-eval' in lib/html.php and in include/global.php. Maybe changing html.php is enough.
The graphs are placed far from the cursor but at least are there.
Don't forget that this is quick and dirty/unsafe hack.

Code: Select all

include/global.php:     header("Content-Security-Policy: default-src *; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self';");
lib/html.php:   <meta http-equiv="Content-Security-Policy" content="default-src *; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval';">

Thank you so much, this way is working although it's unsafe

[kklp90]

Unsafe-eval for what section?

in 2 file:
cacti/include/global.php
cacti/lib/htmt.php

search the 2 line
- header("Content-Security-Policy
- <meta http-equiv="Content-Security-Policy

[Osiris]

It's actually already there. Did you remove it?