From e1aff40d78fbae6feafb0923fc72f98984877eee Mon Sep 17 00:00:00 2001 From: Martin Wilke Date: Mon, 23 Mar 2009 15:06:19 +0000 Subject: - Fix zabbix -- php frontend multiple vulnerabilities Note: Input appended to and passed via the "extlang" parameter to the "calc_exp2()" function in include/validate.inc.php is not properly sanitised before being used. This can be exploited to inject and execute arbitrary PHP code. The application allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to e.g. create users by enticing a logged in administrator to visit a malicious web page. Input passed to the "srclang" parameter in locales.php (when "next" is set to a non-NULL value) is not properly verified before being used to include files. This can be exploited to include arbitrary files from local resources via directory traversal attacks and URL-encoded NULL bytes. - Bump PORTREVISION PR: 132944 Submitted by: Eygene Ryabinkin (many thanks!) Approved by: maintainer timeout (security 1 day) Security: http://www.vuxml.org/freebsd/03140526-1250-11de-a964-0030843d3802.html --- net-mgmt/zabbix/files/patch-USH-162.2 | 2622 +++++++++++++++++++++++++++++++++ 1 file changed, 2622 insertions(+) create mode 100644 net-mgmt/zabbix/files/patch-USH-162.2 (limited to 'net-mgmt/zabbix/files/patch-USH-162.2') diff --git a/net-mgmt/zabbix/files/patch-USH-162.2 b/net-mgmt/zabbix/files/patch-USH-162.2 new file mode 100644 index 000000000000..22d5d1112dca --- /dev/null +++ b/net-mgmt/zabbix/files/patch-USH-162.2 @@ -0,0 +1,2622 @@ +Index: frontends/php/include/perm.inc.php +=================================================================== +--- frontends/php/include/perm.inc.php (revision 6620) ++++ frontends/php/include/perm.inc.php (revision 6621) +@@ -44,7 +44,7 @@ + $USER_DETAILS = NULL; + $login = FALSE; + +- $sessionid = get_cookie('zbx_sessionid'); ++ $sessionid = get_request('sessionid',get_cookie('zbx_sessionid')); + + if(!is_null($sessionid)){ + $sql = 'SELECT u.*,s.* '. +Index: frontends/php/include/validate.inc.php +=================================================================== +--- frontends/php/include/validate.inc.php (revision 6620) ++++ frontends/php/include/validate.inc.php (revision 6621) +@@ -428,8 +429,12 @@ + } + } + else if($opt == O_OPT){ +- if(!isset($_REQUEST[$field])) ++ if(!isset($_REQUEST[$field])){ + return ZBX_VALID_OK; ++ } ++ else if(($flags&P_ACT) && !isset($_REQUEST['zbx_form'])){ ++ return ZBX_VALID_ERROR; ++ } + } + + check_trim($_REQUEST[$field]); +@@ -458,17 +463,21 @@ + return ZBX_VALID_OK; + } + +-// VAR TYPE OPTIONAL FLAGS VALIDATION EXCEPTION ++// VAR TYPE OPTIONAL FLAGS VALIDATION EXCEPTION + $system_fields=array( +- "sessionid"=> array(T_ZBX_STR, O_OPT, P_SYS, HEX(),NULL), +- "switch_node"=> array(T_ZBX_INT, O_OPT, P_SYS, DB_ID,NULL), +- "triggers_hash"=> array(T_ZBX_STR, O_OPT, P_SYS, NOT_EMPTY,NULL), +- 'print'=> array(T_ZBX_INT, O_OPT, P_SYS, IN("1"),NULL), ++ 'sessionid'=> array(T_ZBX_STR, O_OPT, P_SYS, HEX(), 'isset({zbx_form})'), ++ 'zbx_form'=> array(T_ZBX_STR, O_OPT, P_SYS, NOT_EMPTY, NULL), ++// ++ 'switch_node'=> array(T_ZBX_INT, O_OPT, P_SYS, DB_ID,NULL), ++ 'triggers_hash'=> array(T_ZBX_STR, O_OPT, P_SYS, NOT_EMPTY,NULL), ++ 'print'=> array(T_ZBX_INT, O_OPT, P_SYS, IN('1'),NULL), ++ ++// table sorting + 'sort'=> array(T_ZBX_STR, O_OPT, P_SYS, NULL,NULL), + 'sortorder'=> array(T_ZBX_STR, O_OPT, P_SYS, NULL,NULL) + ); + +- function invalid_url(){ ++ function invalid_url(){ + include_once "include/page_header.php"; + unset_all(); + show_error_message(S_INVALID_URL); +Index: frontends/php/include/classes/cform.inc.php +=================================================================== +--- frontends/php/include/classes/cform.inc.php (revision 6620) ++++ frontends/php/include/classes/cform.inc.php (revision 6621) +@@ -22,46 +22,44 @@ + class CForm extends CTag{ + /* public */ + function CForm($action=NULL, $method='post', $enctype=NULL){ +- parent::CTag("form","yes"); +- $this->SetMethod($method); +- $this->SetAction($action); +- $this->SetEnctype($enctype); ++ parent::CTag('form','yes'); ++ $this->setMethod($method); ++ $this->setAction($action); ++ $this->setEnctype($enctype); ++ ++ $this->addVar('zbx_form', 'action'); ++ $this->addVar('sessionid', $_COOKIE['zbx_sessionid']); + } + +- function SetMethod($value='post'){ ++ function setMethod($value='post'){ + return $this->options['method'] = $value; + } + +- function SetAction($value){ ++ function setAction($value){ + global $page; + + if(is_null($value)){ +- if(isset($page['file'])){ +- $value = $page['file']; +- } +- else{ +- $value = "#"; +- } ++ $value = isset($page['file'])?$page['file']:'#'; + } + + return $this->options['action'] = $value; + } + +- function SetEnctype($value=NULL){ ++ function setEnctype($value=NULL){ + if(is_null($value)){ +- return $this->DelOption("enctype"); ++ return $this->DelOption('enctype'); + } + else if(!is_string($value)){ + return $this->error("Incorrect value for SetEnctype [$value]"); + } + +- return $this->AddOption("enctype",$value); ++ return $this->addOption('enctype',$value); + } + +- function AddVar($name, $value){ ++ function addVar($name, $value){ + if(empty($value) && $value != 0) return $value; + +- return $this->AddItem(new CVar($name, $value)); ++ return $this->addItem(new CVar($name, $value)); + } + } + ?> +Index: frontends/php/include/classes/cformtable.inc.php +=================================================================== +--- frontends/php/include/classes/cformtable.inc.php (revision 6620) ++++ frontends/php/include/classes/cformtable.inc.php (revision 6621) +@@ -46,48 +46,48 @@ + } + + parent::CForm($action,$method,$enctype); +- $this->SetTitle($title); +- $this->SetAlign('center'); +- $this->SetHelp(); ++ $this->setTitle($title); ++ $this->setAlign('center'); ++ $this->setHelp(); + + // $frm_link = new CLink(); +-// $frm_link->SetName("formtable"); +-// $this->AddItemToTopRow($frm_link); ++// $frm_link->setName("formtable"); ++// $this->addItemToTopRow($frm_link); + +- $this->AddVar($form_variable, get_request($form_variable, 1)); +- $this->AddVar('form_refresh',get_request('form_refresh',0)+1); ++ $this->addVar($form_variable, get_request($form_variable, 1)); ++ $this->addVar('form_refresh',get_request('form_refresh',0)+1); + + $this->bottom_items = new CCol(SPACE,'form_row_last'); +- $this->bottom_items->SetColSpan(2); ++ $this->bottom_items->setColSpan(2); + } + +- function SetAction($value){ ++ function setAction($value){ + + if(is_string($value)) +- return parent::SetAction($value); ++ return parent::setAction($value); + elseif(is_null($value)) +- return parent::SetAction($value); ++ return parent::setAction($value); + else + return $this->error("Incorrect value for SetAction [$value]"); + } + +- function SetName($value){ ++ function setName($value){ + if(!is_string($value)){ + return $this->error("Incorrect value for SetAlign [$value]"); + } +- $this->AddOption('name',$value); +- $this->AddOption('id',$value); ++ $this->addOption('name',$value); ++ $this->addOption('id',$value); + return true; + } + +- function SetAlign($value){ ++ function setAlign($value){ + if(!is_string($value)){ + return $this->error("Incorrect value for SetAlign [$value]"); + } + return $this->align = $value; + } + +- function SetTitle($value=NULL){ ++ function setTitle($value=NULL){ + if(is_null($value)){ + unset($this->title); + return 0; +@@ -101,7 +101,7 @@ + $this->title = unpack_object($value); + } + +- function SetHelp($value=NULL){ ++ function setHelp($value=NULL){ + if(is_null($value)) { + $this->help = new CHelp(); + } +@@ -110,8 +110,8 @@ + } + else if(is_string($value)) { + $this->help = new CHelp($value); +- if($this->GetName()==NULL) +- $this->SetName($value); ++ if($this->getName()==NULL) ++ $this->setName($value); + } + else { + return $this->error("Incorrect value for SetHelp [$value]"); +@@ -119,21 +119,21 @@ + return 0; + } + +- function AddVar($name, $value){ +- $this->AddItemToTopRow(new CVar($name, $value)); ++ function addVar($name, $value){ ++ $this->addItemToTopRow(new CVar($name, $value)); + } + +- function AddItemToTopRow($value){ ++ function addItemToTopRow($value){ + array_push($this->top_items, $value); + } + +- function AddRow($item1, $item2=NULL, $class=NULL){ ++ function addRow($item1, $item2=NULL, $class=NULL){ + if(strtolower(get_class($item1)) == 'crow'){ + + } + else if(strtolower(get_class($item1)) == 'ctable'){ + $td = new CCol($item1,'form_row_c'); +- $td->SetColSpan(2); ++ $td->setColSpan(2); + + $item1 = new CRow($td); + } +@@ -157,7 +157,7 @@ + array_push($this->center_items, $item1); + } + +- function AddSpanRow($value, $class=NULL){ ++ function addSpanRow($value, $class=NULL){ + if(is_string($value)) + $item1=nbsp($value); + +@@ -165,16 +165,16 @@ + if(is_null($class)) $class = 'form_row_c'; + + $col = new CCol($value,$class); +- $col->SetColSpan(2); ++ $col->setColSpan(2); + array_push($this->center_items,new CRow($col)); + } + + +- function AddItemToBottomRow($value){ +- $this->bottom_items->AddItem($value); ++ function addItemToBottomRow($value){ ++ $this->bottom_items->addItem($value); + } + +- function SetTableClass($class){ ++ function setTableClass($class){ + if(is_string($class)){ + $this->tableclass = $class; + } +@@ -186,25 +186,25 @@ + + $tbl = new CTable(NULL,$this->tableclass); + +- $tbl->SetOddRowClass('form_odd_row'); +- $tbl->SetEvenRowClass('form_even_row'); +- $tbl->SetCellSpacing(0); +- $tbl->SetCellPadding(1); +- $tbl->SetAlign($this->align); ++ $tbl->setOddRowClass('form_odd_row'); ++ $tbl->setEvenRowClass('form_even_row'); ++ $tbl->setCellSpacing(0); ++ $tbl->setCellPadding(1); ++ $tbl->setAlign($this->align); + # add first row + $col = new CCol(NULL,'form_row_first'); +- $col->SetColSpan(2); ++ $col->setColSpan(2); + +- if(isset($this->help)) $col->AddItem($this->help); +- if(isset($this->title)) $col->AddItem($this->title); +- foreach($this->top_items as $item) $col->AddItem($item); ++ if(isset($this->help)) $col->addItem($this->help); ++ if(isset($this->title)) $col->addItem($this->title); ++ foreach($this->top_items as $item) $col->addItem($item); + +- $tbl->SetHeader($col); ++ $tbl->setHeader($col); + # add last row +- $tbl->SetFooter($this->bottom_items); ++ $tbl->setFooter($this->bottom_items); + # add center rows + foreach($this->center_items as $item){ +- $tbl->AddRow($item); ++ $tbl->addRow($item); + } + return $tbl->ToString(); + } + +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +Obtained from svn://svn.zabbix.com/branches/1.6/frontends/php/ + +This hunk adds session identifier transmission during Ajax requests. +It also reshuffles some JavaScript functions and adds many whitespace +changes. + +Index: frontends/php/js/cookies.js +=================================================================== +--- frontends/php/js/cookies.js (revision 6622) ++++ frontends/php/js/cookies.js (revision 6623) +@@ -1,78 +0,0 @@ +-//Javascript document +-/* +-** ZABBIX +-** Copyright (C) 2000-2005 SIA Zabbix +-** +-** This program is free software; you can redistribute it and/or modify +-** it under the terms of the GNU General Public License as published by +-** the Free Software Foundation; either version 2 of the License, or +-** (at your option) any later version. +-** +-** This program is distributed in the hope that it will be useful, +-** but WITHOUT ANY WARRANTY; without even the implied warranty of +-** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +-** GNU General Public License for more details. +-** +-** You should have received a copy of the GNU General Public License +-** along with this program; if not, write to the Free Software +-** Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +-**/ +-// Title: cookies class +-// Description: to manipulate cookies on client side +-// Author: Aly +- +-var cookie ={ +-cookies: new Array(), +- +-init: function () { +- var allCookies = document.cookie.split('; '); +- for (var i=0;i=0)?this.url.substring(this.url.indexOf('?')+1):''; +- if(this.query.indexOf('#')>=0) this.query=this.query.substring(0,this.query.indexOf('#')); +- +- var protocolSepIndex=this.url.indexOf('://'); +- if(protocolSepIndex>=0){ +- this.protocol=this.url.substring(0,protocolSepIndex).toLowerCase(); +- this.host=this.url.substring(protocolSepIndex+3); +- if(this.host.indexOf('/')>=0) this.host=this.host.substring(0,this.host.indexOf('/')); +- var atIndex=this.host.indexOf('@'); +- if(atIndex>=0){ +- var credentials=this.host.substring(0,atIndex); +- var colonIndex=credentials.indexOf(':'); +- if(colonIndex>=0){ +- this.username=credentials.substring(0,colonIndex); +- this.password=credentials.substring(colonIndex); +- }else{ +- this.username=credentials; +- } +- this.host=this.host.substring(atIndex+1); +- } +- +- var host_ipv6 = this.host.indexOf(']'); +- if(host_ipv6>=0){ +- if(host_ipv6 < (this.host.length-1)){ +- host_ipv6++; +- var host_less = this.host.substring(host_ipv6); +- +- var portColonIndex=host_less.indexOf(':'); +- if(portColonIndex>=0){ +- this.port=host_less.substring(portColonIndex+1); +- this.host=this.host.substring(0,host_ipv6); +- } +- } +- } +- else{ +- var portColonIndex=this.host.indexOf(':'); +- if(portColonIndex>=0){ +- this.port=this.host.substring(portColonIndex+1); +- this.host=this.host.substring(0,portColonIndex); +- } +- } +- this.file=this.url.substring(protocolSepIndex+3); +- this.file=this.file.substring(this.file.indexOf('/')); +- }else{ +- this.file=this.url; +- } +- if(this.file.indexOf('?')>=0) this.file=this.file.substring(0, this.file.indexOf('?')); +- +- var refSepIndex=url.indexOf('#'); +- if(refSepIndex>=0){ +- this.file=this.file.substring(0,refSepIndex); +- this.reference=this.url.substring(this.url.indexOf('#')); +- } +- this.path=this.file; +- if(this.query.length>0) this.file+='?'+this.query; +- if(this.reference.length>0) this.file+='#'+this.reference; +- if(this.query.length > 0) this.getArguments(); +-}, +- +-getArguments: function(){ +- var args=this.query.split('&'); +- var keyval=''; +- +- if(args.length<1) return; +- +- for(i=0;i 0)?(this.protocol+'://'):''; +- uri += encodeURI((this.username.length > 0)?(this.username):''); +- uri += encodeURI((this.password.length > 0)?(':'+this.password):''); +- uri += (this.host.length > 0)?(this.host):''; +- uri += (this.port.length > 0)?(':'+this.port):''; +- uri += encodeURI((this.path.length > 0)?(this.path):''); +- uri += encodeURI((this.query.length > 0)?('?'+this.query):''); +- uri += encodeURI((this.reference.length > 0)?('#'+this.reference):''); +-// alert(uri.getProtocol()+' : '+uri.getHost()+' : '+uri.getPort()+' : '+uri.getPath()+' : '+uri.getQuery()); +-return uri; +-}, +- +-setArgument: function(key,value){ +- +- var valueisset = false; +- if(typeof(key) == 'undefined') throw 'Invalid argument past for setArgument'; +- +- value =('undefined' != typeof(value))?value:''; +- +- for(i=0; i < this.arguments.length; i++){ +- if(this.arguments[i][0] == key){ +- valueisset = true; +- this.arguments[i][1] = value; +- } +- } +- if(!valueisset) this.arguments[this.arguments.length] = new Array(key,value); +- this.formatQuery(); +-}, +- +-formatQuery: function(){ +- if(this.arguments.lenght < 1) return; +- +- var query = ''; +- for(i=0; i < this.arguments.length; i++){ +- query+=this.arguments[i][0]+'='+this.arguments[i][1]+'&'; +- } +- this.query = query.substring(0,query.length-1); +-}, +- +-getPort: function(){ +- return this.port; +-}, +- +-setPort: function(port){ +- this.port = port; +-}, +- +-getQuery: function(){ +- return this.query; +-}, +- +-setQuery: function(query){ +- this.query = query; +- this.getArgumentValues(); +- this.formatQuery(); +-}, +- +-/* Returns the protocol of this URL, i.e. 'http' in the url 'http://server/' */ +-getProtocol: function(){ +- return this.protocol; +-}, +- +-setProtocol: function(protocol){ +- this.protocol = protocol; +-}, +-/* Returns the host name of this URL, i.e. 'server.com' in the url 'http://server.com/' */ +-getHost: function(){ +- return this.host; +-}, +- +-setHost: function(set){ +- this.host = host; +-}, +- +-/* Returns the user name part of this URL, i.e. 'joe' in the url 'http://joe@server.com/' */ +-getUserName: function(){ +- return this.username; +-}, +- +-setUserName: function(username){ +- this.username = username; +-}, +- +-/* Returns the password part of this url, i.e. 'secret' in the url 'http://joe:secret@server.com/' */ +-getPassword: function(){ +- return this.password; +-}, +- +-setPassword: function(password){ +- this.password = password; +-}, +- +-/* Returns the file part of this url, i.e. everything after the host name. */ +-getFile: function(){ +- return this.file = file; +-}, +- +-setFile: function(file){ +- this.file = file; +-}, +- +-/* Returns the reference of this url, i.e. 'bookmark' in the url 'http://server/file.html#bookmark' */ +-getReference: function(){ +- return this.reference; +-}, +- +-setReference: function(reference){ +- this.reference = reference; +-}, +- +-/* Returns the file path of this url, i.e. '/dir/file.html' in the url 'http://server/dir/file.html' */ +-getPath: function(){ +- return this.path; +-}, +- +-setPath: function(path){ +- this.path = path; +-} +- +-} +\ No newline at end of file +Index: frontends/php/js/updater.js +=================================================================== +--- frontends/php/js/updater.js (revision 6622) ++++ frontends/php/js/updater.js (revision 6623) +@@ -27,7 +27,7 @@ + + setObj4Update: function(id,frequency,url,params){ + var obj = document.getElementById(id); +- if((typeof(obj) == 'undefined')) return false; ++ if(typeof(obj) == 'undefined') return false; + + var obj4update = { + 'id': id, +@@ -65,7 +65,9 @@ + obj4update.ready = false; + + var uri = new url(obj4update.url); +- new Ajax.Updater(obj4update.id, obj4update.url, ++ uri.setArgument('sessionid', cookie.read('zbx_sessionid')); ++ ++ new Ajax.Updater(obj4update.id, uri.getUrl(),//obj4update.url, + { + method: 'post', + 'parameters': obj4update.params, +Index: frontends/php/js/gpc.js +=================================================================== +--- frontends/php/js/gpc.js (revision 0) ++++ frontends/php/js/gpc.js (revision 6623) +@@ -0,0 +1,315 @@ ++//Javascript document ++/* ++** ZABBIX ++** Copyright (C) 2000-2009 SIA Zabbix ++** ++** This program is free software; you can redistribute it and/or modify ++** it under the terms of the GNU General Public License as published by ++** the Free Software Foundation; either version 2 of the License, or ++** (at your option) any later version. ++** ++** This program is distributed in the hope that it will be useful, ++** but WITHOUT ANY WARRANTY; without even the implied warranty of ++** MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++** GNU General Public License for more details. ++** ++** You should have received a copy of the GNU General Public License ++** along with this program; if not, write to the Free Software ++** Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. ++**/ ++ ++// Title: cookies class ++// Description: to manipulate cookies on client side ++// Author: Aly ++var cookie ={ ++cookies: new Array(), ++ ++init: function () { ++ var allCookies = document.cookie.split('; '); ++ for (var i=0;i=0)?this.url.substring(this.url.indexOf('?')+1):''; ++ if(this.query.indexOf('#')>=0) this.query=this.query.substring(0,this.query.indexOf('#')); ++ ++ var protocolSepIndex=this.url.indexOf('://'); ++ if(protocolSepIndex>=0){ ++ this.protocol=this.url.substring(0,protocolSepIndex).toLowerCase(); ++ this.host=this.url.substring(protocolSepIndex+3); ++ if(this.host.indexOf('/')>=0) this.host=this.host.substring(0,this.host.indexOf('/')); ++ var atIndex=this.host.indexOf('@'); ++ if(atIndex>=0){ ++ var credentials=this.host.substring(0,atIndex); ++ var colonIndex=credentials.indexOf(':'); ++ if(colonIndex>=0){ ++ this.username=credentials.substring(0,colonIndex); ++ this.password=credentials.substring(colonIndex); ++ }else{ ++ this.username=credentials; ++ } ++ this.host=this.host.substring(atIndex+1); ++ } ++ ++ var host_ipv6 = this.host.indexOf(']'); ++ if(host_ipv6>=0){ ++ if(host_ipv6 < (this.host.length-1)){ ++ host_ipv6++; ++ var host_less = this.host.substring(host_ipv6); ++ ++ var portColonIndex=host_less.indexOf(':'); ++ if(portColonIndex>=0){ ++ this.port=host_less.substring(portColonIndex+1); ++ this.host=this.host.substring(0,host_ipv6); ++ } ++ } ++ } ++ else{ ++ var portColonIndex=this.host.indexOf(':'); ++ if(portColonIndex>=0){ ++ this.port=this.host.substring(portColonIndex+1); ++ this.host=this.host.substring(0,portColonIndex); ++ } ++ } ++ this.file=this.url.substring(protocolSepIndex+3); ++ this.file=this.file.substring(this.file.indexOf('/')); ++ }else{ ++ this.file=this.url; ++ } ++ if(this.file.indexOf('?')>=0) this.file=this.file.substring(0, this.file.indexOf('?')); ++ ++ var refSepIndex=url.indexOf('#'); ++ if(refSepIndex>=0){ ++ this.file=this.file.substring(0,refSepIndex); ++ this.reference=this.url.substring(this.url.indexOf('#')); ++ } ++ this.path=this.file; ++ if(this.query.length>0) this.file+='?'+this.query; ++ if(this.reference.length>0) this.file+='#'+this.reference; ++ if(this.query.length > 0) this.getArguments(); ++}, ++ ++getArguments: function(){ ++ var args=this.query.split('&'); ++ var keyval=''; ++ ++ if(args.length<1) return; ++ ++ for(i=0;i 0)?(this.protocol+'://'):''; ++ uri += encodeURI((this.username.length > 0)?(this.username):''); ++ uri += encodeURI((this.password.length > 0)?(':'+this.password):''); ++ uri += (this.host.length > 0)?(this.host):''; ++ uri += (this.port.length > 0)?(':'+this.port):''; ++ uri += encodeURI((this.path.length > 0)?(this.path):''); ++ uri += encodeURI((this.query.length > 0)?('?'+this.query):''); ++ uri += encodeURI((this.reference.length > 0)?('#'+this.reference):''); ++// alert(uri.getProtocol()+' : '+uri.getHost()+' : '+uri.getPort()+' : '+uri.getPath()+' : '+uri.getQuery()); ++return uri; ++}, ++ ++setArgument: function(key,value){ ++ ++ var valueisset = false; ++ if(typeof(key) == 'undefined') throw 'Invalid argument past for setArgument'; ++ ++ value =('undefined' != typeof(value))?value:''; ++ ++ for(i=0; i < this.arguments.length; i++){ ++ if(this.arguments[i][0] == key){ ++ valueisset = true; ++ this.arguments[i][1] = value; ++ } ++ } ++ if(!valueisset) this.arguments[this.arguments.length] = new Array(key,value); ++ this.formatQuery(); ++}, ++ ++formatQuery: function(){ ++ if(this.arguments.lenght < 1) return; ++ ++ var query = ''; ++ for(i=0; i < this.arguments.length; i++){ ++ query+=this.arguments[i][0]+'='+this.arguments[i][1]+'&'; ++ } ++ this.query = query.substring(0,query.length-1); ++}, ++ ++getPort: function(){ ++ return this.port; ++}, ++ ++setPort: function(port){ ++ this.port = port; ++}, ++ ++getQuery: function(){ ++ return this.query; ++}, ++ ++setQuery: function(query){ ++ this.query = query; ++ this.getArgumentValues(); ++ this.formatQuery(); ++}, ++ ++/* Returns the protocol of this URL, i.e. 'http' in the url 'http://server/' */ ++getProtocol: function(){ ++ return this.protocol; ++}, ++ ++setProtocol: function(protocol){ ++ this.protocol = protocol; ++}, ++/* Returns the host name of this URL, i.e. 'server.com' in the url 'http://server.com/' */ ++getHost: function(){ ++ return this.host; ++}, ++ ++setHost: function(set){ ++ this.host = host; ++}, ++ ++/* Returns the user name part of this URL, i.e. 'joe' in the url 'http://joe@server.com/' */ ++getUserName: function(){ ++ return this.username; ++}, ++ ++setUserName: function(username){ ++ this.username = username; ++}, ++ ++/* Returns the password part of this url, i.e. 'secret' in the url 'http://joe:secret@server.com/' */ ++getPassword: function(){ ++ return this.password; ++}, ++ ++setPassword: function(password){ ++ this.password = password; ++}, ++ ++/* Returns the file part of this url, i.e. everything after the host name. */ ++getFile: function(){ ++ return this.file = file; ++}, ++ ++setFile: function(file){ ++ this.file = file; ++}, ++ ++/* Returns the reference of this url, i.e. 'bookmark' in the url 'http://server/file.html#bookmark' */ ++getReference: function(){ ++ return this.reference; ++}, ++ ++setReference: function(reference){ ++ this.reference = reference; ++}, ++ ++/* Returns the file path of this url, i.e. '/dir/file.html' in the url 'http://server/dir/file.html' */ ++getPath: function(){ ++ return this.path; ++}, ++ ++setPath: function(path){ ++ this.path = path; ++} ++} +\ No newline at end of file +Index: frontends/php/js/ajax_req.js +=================================================================== +--- frontends/php/js/ajax_req.js (revision 6622) ++++ frontends/php/js/ajax_req.js (revision 6623) +@@ -19,6 +19,8 @@ + **/ + + function send_params(params){ ++ if(typeof(params) == 'undefined') var params = new Array(); ++ params['sessionid'] = cookie.read('zbx_sessionid'); + + var uri = new url(location.href); + new Ajax.Request(uri.getPath()+"?output=ajax", +Index: frontends/php/dashboard.php +=================================================================== +--- frontends/php/dashboard.php (revision 6622) ++++ frontends/php/dashboard.php (revision 6623) +@@ -42,8 +42,8 @@ + 'view_style'=> array(T_ZBX_INT, O_OPT, P_SYS, IN('0,1'), NULL), + 'type'=> array(T_ZBX_INT, O_OPT, P_SYS, IN('0,1'), NULL), + +- 'output'=> array(T_ZBX_STR, O_OPT, P_ACT, NULL, NULL), +- 'jsscriptid'=> array(T_ZBX_STR, O_OPT, P_ACT, NULL, NULL), ++ 'output'=> array(T_ZBX_STR, O_OPT, P_SYS, NULL, NULL), ++ 'jsscriptid'=> array(T_ZBX_STR, O_OPT, P_SYS, NULL, NULL), + 'fullscreen'=> array(T_ZBX_INT, O_OPT, P_SYS, IN('0,1'), NULL), + + //ajax +@@ -56,7 +56,7 @@ + ); + + check_fields($fields); +- ++ + $available_hosts = get_accessible_hosts_by_user($USER_DETAILS,PERM_READ_ONLY, PERM_RES_IDS_ARRAY); + // ACTION ///////////////////////////////////////////////////////////////////////////// + if(isset($_REQUEST['favobj'])){ +Index: frontends/php/include/page_header.php +=================================================================== +--- frontends/php/include/page_header.php (revision 6622) ++++ frontends/php/include/page_header.php (revision 6623) +@@ -428,8 +428,8 @@ + + + ++ + +- + + array(T_ZBX_STR, O_OPT, P_SYS, HEX(), 'isset({zbx_form})'), +- 'zbx_form'=> array(T_ZBX_STR, O_OPT, P_SYS, NOT_EMPTY, NULL), ++ 'sessionid'=> array(T_ZBX_STR, O_OPT, P_SYS, HEX(), NULL), + // + 'switch_node'=> array(T_ZBX_INT, O_OPT, P_SYS, DB_ID,NULL), + 'triggers_hash'=> array(T_ZBX_STR, O_OPT, P_SYS, NOT_EMPTY,NULL), +Index: frontends/php/include/classes/ctree.inc.php +=================================================================== +--- frontends/php/include/classes/ctree.inc.php (revision 6622) ++++ frontends/php/include/classes/ctree.inc.php (revision 6623) +@@ -214,7 +214,6 @@ + global $page; + $js = ' + +- +