From 9637e75f974512e0eed0956e6cc8680abc6d0d72 Mon Sep 17 00:00:00 2001 From: Eric Date: Wed, 13 Feb 2019 14:07:13 +0100 Subject: [PATCH 01/17] =?UTF-8?q?N=C2=B02011:=20Fix=20Issue=20with=20"Exec?= =?UTF-8?q?AsyncTask:=20async=5Ftask=5Fretries"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- core/asynctask.class.inc.php | 1 + 1 file changed, 1 insertion(+) diff --git a/core/asynctask.class.inc.php b/core/asynctask.class.inc.php index 5c7d8d2c6..6f3ea6bae 100644 --- a/core/asynctask.class.inc.php +++ b/core/asynctask.class.inc.php @@ -168,6 +168,7 @@ abstract class AsyncTask extends DBObject $aConfig = $aRetries[get_class($this)]; $iMaxRetries = $aConfig['max_retries']; } + return $iMaxRetries; } /** From 32f1e97bcd8f1fc5de1c3cf2988c20a6d83c5541 Mon Sep 17 00:00:00 2001 From: Stephen Abello Date: Mon, 11 Feb 2019 13:32:32 +0100 Subject: [PATCH 02/17] =?UTF-8?q?(retrofit=20from=20master)=20N=C2=B01148:?= =?UTF-8?q?=20Fix=20regression=20on=20export?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (cherry picked from commit 90e128f95141f0b68bd323fe89dd0dcc59b5e31c) --- webservices/export.php | 1 + 1 file changed, 1 insertion(+) diff --git a/webservices/export.php b/webservices/export.php index c2863ad40..0b0855cf0 100644 --- a/webservices/export.php +++ b/webservices/export.php @@ -164,6 +164,7 @@ if (!empty($sExpression)) } else if($oAttDef instanceof AttributeExternalField && $oAttDef->IsFriendlyName()) { + $sKeyAttCode = $oAttDef->GetKeyAttCode(); $aAliasToFields[$sClassAlias][] = $sKeyAttCode; } } From 545504c0deff522ce61f7a5a7b3fa8e78c5e6e1c Mon Sep 17 00:00:00 2001 From: Stephen Abello Date: Wed, 13 Feb 2019 14:42:39 +0100 Subject: [PATCH 03/17] =?UTF-8?q?(retrofit=20from=20master)=20N=C2=B01443?= =?UTF-8?q?=20:=20Add=20table=5Fid=20used=20by=20tables=20paging?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (cherry picked from commit 43b0747b83632da01e29f87fd4e771e35fbb00d0) --- application/datatable.class.inc.php | 4 ++-- js/jquery.tablesorter.pager.js | 4 +++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/application/datatable.class.inc.php b/application/datatable.class.inc.php index 185ccef42..f8f1f0134 100644 --- a/application/datatable.class.inc.php +++ b/application/datatable.class.inc.php @@ -431,7 +431,7 @@ EOF; } else { - $aRow['form::select'] = "iListId}\" name=\"selectObject[]\" value=\"".$aObjects[$sAlias]->GetKey()."\">"; + $aRow['form::select'] = "iListId}\" name=\"selectObject[]\" value=\"".$aObjects[$sAlias]->GetKey()."\">"; } } foreach($aColumns[$sAlias] as $sAttCode => $aData) @@ -565,7 +565,7 @@ EOF; <<iListId} table.listResults'); oTable.tableHover(); -oTable.tablesorter( { $sHeaders widgets: ['myZebra', 'truncatedList']} ).tablesorterPager({container: $('#pager{$this->iListId}'), totalRows:$iCount, size: $iPageSize, filter: '$sOQL', extra_params: '$sExtraParams', select_mode: '$sSelectModeJS', displayKey: $sDisplayKey, columns: $sJSColumns, class_aliases: $sJSClassAliases $sCssCount}); +oTable.tablesorter( { $sHeaders widgets: ['myZebra', 'truncatedList']} ).tablesorterPager({container: $('#pager{$this->iListId}'), totalRows:$iCount, size: $iPageSize, filter: '$sOQL', extra_params: '$sExtraParams', select_mode: '$sSelectModeJS', displayKey: $sDisplayKey, table_id: '{$this->iListId}', columns: $sJSColumns, class_aliases: $sJSClassAliases $sCssCount}); EOF ); if ($sFakeSortList != '') diff --git a/js/jquery.tablesorter.pager.js b/js/jquery.tablesorter.pager.js index ebe30949d..458594e1b 100644 --- a/js/jquery.tablesorter.pager.js +++ b/js/jquery.tablesorter.pager.js @@ -197,7 +197,8 @@ function sprintf(format, etc) { end: end, sort_col: s_col, sort_order: s_order, - select_mode: c.select_mode, + select_mode: c.select_mode, + list_id: c.table_id, display_key: c.displayKey, columns: c.columns, class_aliases: c.class_aliases @@ -443,6 +444,7 @@ function sprintf(format, etc) { filter: '', extra_params: '', select_mode: '', + table_id: 0, totalSelected: 0, selectionMode: 'positive', displayKey: true, From b8fb1fa78a2790ba13e3c2954f6808fa228a0eca Mon Sep 17 00:00:00 2001 From: Eric Date: Fri, 15 Feb 2019 17:28:55 +0100 Subject: [PATCH 04/17] =?UTF-8?q?N=C2=B01884=20-=20Admin=20Tools=20Manager?= =?UTF-8?q?=20no=20longer=20has=20access=20to=20'Schedule=20Backup'=20and?= =?UTF-8?q?=20'Configuration'=20menus?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit (cherry picked from commit 818b4d08dabae9cd5958ed76da0b8a9b13f07e0d) --- datamodels/2.x/itop-backup/datamodel.itop-backup.xml | 2 +- datamodels/2.x/itop-config/datamodel.itop-config.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/datamodels/2.x/itop-backup/datamodel.itop-backup.xml b/datamodels/2.x/itop-backup/datamodel.itop-backup.xml index 2a89ca50a..426c21e50 100644 --- a/datamodels/2.x/itop-backup/datamodel.itop-backup.xml +++ b/datamodels/2.x/itop-backup/datamodel.itop-backup.xml @@ -5,7 +5,7 @@ 15 AdminTools status.php - ResourceAdminMenu + 1 UR_ACTION_MODIFY diff --git a/datamodels/2.x/itop-config/datamodel.itop-config.xml b/datamodels/2.x/itop-config/datamodel.itop-config.xml index 3b3224180..9a3fff682 100644 --- a/datamodels/2.x/itop-config/datamodel.itop-config.xml +++ b/datamodels/2.x/itop-config/datamodel.itop-config.xml @@ -5,7 +5,7 @@ 50 AdminTools config.php - ResourceAdminMenu + 1 UR_ACTION_MODIFY From bf62b63173da67f10c72b3664493a2a941e5a972 Mon Sep 17 00:00:00 2001 From: Eric Date: Fri, 15 Feb 2019 17:28:55 +0100 Subject: [PATCH 05/17] =?UTF-8?q?N=C2=B01884=20-=20Admin=20Tools=20Manager?= =?UTF-8?q?=20no=20longer=20has=20access=20to=20'Schedule=20Backup'=20and?= =?UTF-8?q?=20'Configuration'=20menus?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- datamodels/2.x/itop-backup/datamodel.itop-backup.xml | 1 - datamodels/2.x/itop-config/datamodel.itop-config.xml | 1 - 2 files changed, 2 deletions(-) diff --git a/datamodels/2.x/itop-backup/datamodel.itop-backup.xml b/datamodels/2.x/itop-backup/datamodel.itop-backup.xml index 426c21e50..f9d22d798 100644 --- a/datamodels/2.x/itop-backup/datamodel.itop-backup.xml +++ b/datamodels/2.x/itop-backup/datamodel.itop-backup.xml @@ -6,7 +6,6 @@ AdminTools status.php 1 - UR_ACTION_MODIFY diff --git a/datamodels/2.x/itop-config/datamodel.itop-config.xml b/datamodels/2.x/itop-config/datamodel.itop-config.xml index 9a3fff682..009b1ee19 100644 --- a/datamodels/2.x/itop-config/datamodel.itop-config.xml +++ b/datamodels/2.x/itop-config/datamodel.itop-config.xml @@ -6,7 +6,6 @@ AdminTools config.php 1 - UR_ACTION_MODIFY From 6b5cc7ca4b8999324fbb1ed37570accaad0ea65a Mon Sep 17 00:00:00 2001 From: Stephen Abello Date: Mon, 18 Feb 2019 10:39:57 +0100 Subject: [PATCH 06/17] =?UTF-8?q?N=C2=B01877=20&=20N=C2=B02012:=20Fix=20re?= =?UTF-8?q?gression=20backup=20link=20on=20setup,=20security=20hardening?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- setup/ajax.dataloader.php | 6 ++++-- setup/setup.js | 11 ++++++----- setup/wizardsteps.class.inc.php | 29 +++++++++++++++++++++++------ 3 files changed, 33 insertions(+), 13 deletions(-) diff --git a/setup/ajax.dataloader.php b/setup/ajax.dataloader.php index 381a3dcc6..0d03fc365 100644 --- a/setup/ajax.dataloader.php +++ b/setup/ajax.dataloader.php @@ -121,9 +121,11 @@ header("Expires: Fri, 17 Jul 1970 05:00:00 GMT"); // Date in the past $sOperation = Utils::ReadParam('operation', ''); try { - if (is_file(utils::GetConfigFilePath()) && !is_writable(utils::GetConfigFilePath())) + $sAuthent = utils::ReadParam('authent', '', false, 'raw_data'); + if (!file_exists(APPROOT.'data/setup/authent') || $sAuthent !== file_get_contents(APPROOT.'data/setup/authent')) { - throw new Exception('Setup operations are not allowed outside of the setup'); + throw new SecurityException('Setup operations are not allowed outside of the setup'); + SetupPage::log_error("Setup operations are not allowed outside of the setup"); } switch($sOperation) diff --git a/setup/setup.js b/setup/setup.js index d81e013fe..1144936e9 100644 --- a/setup/setup.js +++ b/setup/setup.js @@ -2,8 +2,9 @@ function WizardAsyncAction(sActionCode, oParams, OnErrorFunction) { var sStepClass = $('#_class').val(); var sStepState = $('#_state').val(); + var sAuthent = $('#authent_token').val(); - var oMap = { operation: 'async_action', step_class: sStepClass, step_state: sStepState, code: sActionCode, params: oParams }; + var oMap = { operation: 'async_action', step_class: sStepClass, step_state: sStepState, code: sActionCode, authent : sAuthent, params: oParams }; var ErrorFn = OnErrorFunction; $(document).ajaxError(function(event, request, settings) { @@ -23,20 +24,20 @@ function WizardUpdateButtons() { if (CanMoveForward()) { - $("#btn_next").removeAttr("disabled"); + $("#btn_next").prop("disabled", false); } else { - $("#btn_next").attr("disabled", "disabled"); + $("#btn_next").prop("disabled", true); } if (CanMoveBackward()) { - $("#btn_back").removeAttr("disabled"); + $("#btn_back").prop("disabled", false); } else { - $("#btn_back").attr("disabled", "disabled"); + $("#btn_back").prop("disabled", true); } } diff --git a/setup/wizardsteps.class.inc.php b/setup/wizardsteps.class.inc.php index e2fb58cd6..cd75dfd6b 100644 --- a/setup/wizardsteps.class.inc.php +++ b/setup/wizardsteps.class.inc.php @@ -57,6 +57,13 @@ class WizStepWelcome extends WizardStep public function ProcessParams($bMoveForward = true) { + if (!file_exists(APPROOT.'data/setup')) + { + mkdir(APPROOT.'data/setup'); + } + $sUID = hash('sha256', rand()); + file_put_contents(APPROOT.'data/setup/authent', $sUID); + $this->oWizard->SetParameter('authent', $sUID); return array('class' => 'WizStepInstallOrUpgrade', 'state' => ''); } @@ -284,6 +291,8 @@ class WizStepInstallOrUpgrade extends WizardStep $oPage->add(''); $oPage->add($sMySQLDumpMessage.'
'.$sMessage.''); $oPage->add(''); + $sAuthentToken = $this->oWizard->GetParameter('authent', ''); + $oPage->add(''); //$oPage->add(''); $oPage->add_ready_script( <<add(''); SetupUtils::DisplayDBParameters($oPage, true, $sDBServer, $sDBUser, $sDBPwd, $sDBName, $sDBPrefix, $sTlsEnabled, $sTlsCA, $sNewDBName); + $sAuthentToken = $this->oWizard->GetParameter('authent', ''); + $oPage->add(''); $oPage->add('
'); $sCreateDB = $this->oWizard->GetParameter('create_db', 'yes'); if ($sCreateDB == 'no') { - $oPage->add_ready_script('$("#existing_db").attr("checked", "checked");'); + $oPage->add_ready_script('$("#existing_db").prop("checked", true);'); } else { - $oPage->add_ready_script('$("#create_db").attr("checked", "checked");'); + $oPage->add_ready_script('$("#create_db").prop("checked", true);'); } } @@ -984,6 +995,8 @@ class WizStepMiscParams extends WizardStep $sChecked = ($sSampleData == 'no') ? 'checked ' : ''; $oPage->p('