[SOLVED] - CACTI 1.2.10 and Weathermap - Overlib graph supported ?

[anandks]

I have a new install of Cacti 1.2.10 and weathermap obtained from ( https://github.com/thurban/plugin_weathermap ), which indicates is a beta for 1.x.

I brought in my weathermap configs from 0.98, everything works except for overlay graphs. (infourl works)

any pointers is appreciated.

Thanks

[phalek]

Look at gthe below posts, the newest Cacti has implement some Content-Policy to make it more secure. Unfortunately, the overlib library hasn't been updated for a long time and does still use some unsave Javascript commands. The suggestions from the post will allow these unsave javascript commands so be aware that your cacti install will have a reduced security level then ( but overlib works afterwards )

viewtopic.php?f=16&t=60353&start=30#p281794

[Osiris]

There was an option placed into 1.2.11 to allow eval use for such plugins. Console > Configuration > Settings > General. Enable it.

[anandks]

Great - Thank you, adding 'unsafe_eval' to the two files did the job.

[phalek]

Would this be possible to enable for specific plugins only instead of a global setting ?

i.e. Weathermap has only one file (the one using overlin) that requires this. Enabling it globally seems to be just too much.

[TheWitness]

That was debated. I suggest you propose something via a pull request old friend.

[Rno]

It's look like the problem is back on 1.2.12!

beside changeing the file manually, have you any proposal on it ?

The change of the jascript eval didn't solve the issue!

[0815]

I have the same issue with Cacti 1.2.12. Hover is not working. I added unsafe-eval to the 2 files, but it did not solve it.

[anandks]

include/global.php
header("Content-Security-Policy: default-src *; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline' 'unsafe-eval'; script-src 'self' $script_policy 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'self'; worker-src 'self'");

lib/html.php
<meta http-equiv="Content-Security-Policy" content="default-src *; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline' 'unsafe-eval'; script-src 'self' <?php print $script_policy;?> 'unsafe-inline' 'unsafe-eval'; worker-src 'self'">


this is what I modified to, overlibgraph works on 1.2.12

[fatihylmz06]

Look at gthe below posts, the newest Cacti has implement some Content-Policy to make it more secure. Unfortunately, the overlib library hasn't been updated for a long time and does still use some unsave Javascript commands. The suggestions from the post will allow these unsave javascript commands so be aware that your cacti install will have a reduced security level then ( but overlib works afterwards )

viewtopic.php?f=16&t=60353&start=30#p281794

Hello. cacti 1x weathermap 098.a I'm using it. I looked at the whole forum but couldn't find it.
Can I connect to an html page with OVERLIBGRAPH and log in?

For example, I want to connect to the web interface of the camera. Even if you give a little tip. Thanks.

[jamesbtate]

I recently fixed this issue on my team's Cacti installtion with thurban's forked Weathermap plugin by fixing some of the many unsafe calls in overlib.js. I just submitted a pull request to thurban (https://github.com/thurban/plugin_weathermap/pull/9) with my fixes. This is tested and working on Cacti 1.2.10 on RedHat 7 (cacti-1.2.10-1.el7.noarch).