{"action":"created","issue":{"url":"https://api.github.com/repos/centreon/centreon/issues/4668","repository_url":"https://api.github.com/repos/centreon/centreon","labels_url":"https://api.github.com/repos/centreon/centreon/issues/4668/labels{/name}","comments_url":"https://api.github.com/repos/centreon/centreon/issues/4668/comments","events_url":"https://api.github.com/repos/centreon/centreon/issues/4668/events","html_url":"https://github.com/centreon/centreon/issues/4668","id":173990693,"number":4668,"title":"Bug: Autologin with any Token at display poller","user":{"login":"itsul","id":12328177,"avatar_url":"https://avatars.githubusercontent.com/u/12328177?v=3","gravatar_id":"","url":"https://api.github.com/users/itsul","html_url":"https://github.com/itsul","followers_url":"https://api.github.com/users/itsul/followers","following_url":"https://api.github.com/users/itsul/following{/other_user}","gists_url":"https://api.github.com/users/itsul/gists{/gist_id}","starred_url":"https://api.github.com/users/itsul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/itsul/subscriptions","organizations_url":"https://api.github.com/users/itsul/orgs","repos_url":"https://api.github.com/users/itsul/repos","events_url":"https://api.github.com/users/itsul/events{/privacy}","received_events_url":"https://api.github.com/users/itsul/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/centreon/centreon/labels/Kind/Bug","name":"Kind/Bug","color":"fc2929"},{"url":"https://api.github.com/repos/centreon/centreon/labels/Status/Implemented","name":"Status/Implemented","color":"009800"},{"url":"https://api.github.com/repos/centreon/centreon/labels/Status/In%20backlog","name":"Status/In backlog","color":"006b75"}],"state":"closed","locked":false,"assignee":{"login":"lpinsivy","id":3351916,"avatar_url":"https://avatars.githubusercontent.com/u/3351916?v=3","gravatar_id":"","url":"https://api.github.com/users/lpinsivy","html_url":"https://github.com/lpinsivy","followers_url":"https://api.github.com/users/lpinsivy/followers","following_url":"https://api.github.com/users/lpinsivy/following{/other_user}","gists_url":"https://api.github.com/users/lpinsivy/gists{/gist_id}","starred_url":"https://api.github.com/users/lpinsivy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lpinsivy/subscriptions","organizations_url":"https://api.github.com/users/lpinsivy/orgs","repos_url":"https://api.github.com/users/lpinsivy/repos","events_url":"https://api.github.com/users/lpinsivy/events{/privacy}","received_events_url":"https://api.github.com/users/lpinsivy/received_events","type":"User","site_admin":false},"assignees":[{"login":"lpinsivy","id":3351916,"avatar_url":"https://avatars.githubusercontent.com/u/3351916?v=3","gravatar_id":"","url":"https://api.github.com/users/lpinsivy","html_url":"https://github.com/lpinsivy","followers_url":"https://api.github.com/users/lpinsivy/followers","following_url":"https://api.github.com/users/lpinsivy/following{/other_user}","gists_url":"https://api.github.com/users/lpinsivy/gists{/gist_id}","starred_url":"https://api.github.com/users/lpinsivy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lpinsivy/subscriptions","organizations_url":"https://api.github.com/users/lpinsivy/orgs","repos_url":"https://api.github.com/users/lpinsivy/repos","events_url":"https://api.github.com/users/lpinsivy/events{/privacy}","received_events_url":"https://api.github.com/users/lpinsivy/received_events","type":"User","site_admin":false},{"login":"kduret","id":11978823,"avatar_url":"https://avatars.githubusercontent.com/u/11978823?v=3","gravatar_id":"","url":"https://api.github.com/users/kduret","html_url":"https://github.com/kduret","followers_url":"https://api.github.com/users/kduret/followers","following_url":"https://api.github.com/users/kduret/following{/other_user}","gists_url":"https://api.github.com/users/kduret/gists{/gist_id}","starred_url":"https://api.github.com/users/kduret/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kduret/subscriptions","organizations_url":"https://api.github.com/users/kduret/orgs","repos_url":"https://api.github.com/users/kduret/repos","events_url":"https://api.github.com/users/kduret/events{/privacy}","received_events_url":"https://api.github.com/users/kduret/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/centreon/centreon/milestones/53","html_url":"https://github.com/centreon/centreon/milestones/2.8.0","labels_url":"https://api.github.com/repos/centreon/centreon/milestones/53/labels","id":1223686,"number":53,"title":"2.8.0","description":"","creator":{"login":"centreon","id":1890152,"avatar_url":"https://avatars.githubusercontent.com/u/1890152?v=3","gravatar_id":"","url":"https://api.github.com/users/centreon","html_url":"https://github.com/centreon","followers_url":"https://api.github.com/users/centreon/followers","following_url":"https://api.github.com/users/centreon/following{/other_user}","gists_url":"https://api.github.com/users/centreon/gists{/gist_id}","starred_url":"https://api.github.com/users/centreon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/centreon/subscriptions","organizations_url":"https://api.github.com/users/centreon/orgs","repos_url":"https://api.github.com/users/centreon/repos","events_url":"https://api.github.com/users/centreon/events{/privacy}","received_events_url":"https://api.github.com/users/centreon/received_events","type":"Organization","site_admin":false},"open_issues":22,"closed_issues":183,"state":"open","created_at":"2015-07-24T08:37:37Z","updated_at":"2016-09-13T14:38:24Z","due_on":"2016-09-14T22:00:00Z","closed_at":null},"comments":5,"created_at":"2016-08-30T11:05:30Z","updated_at":"2016-09-14T10:41:10Z","closed_at":"2016-09-08T12:47:26Z","body":"---------------------------------------------------\r\nBUG REPORT INFORMATION\r\n---------------------------------------------------\r\n\r\nCentreon/OS Information:\r\nOS: CES Image\r\nrpm -qa | grep centreon\r\ncentreon-syslog-server-1.2.5-6.el6.noarch\r\ncentreon-common-2.7.6-4.el6.noarch\r\ncentreon-base-config-centreon-engine-2.7.6-4.el6.noarch\r\ncentreon-widget-service-monitoring-1.4.2-1.el6.noarch\r\ncentreon-clib-1.4.2-1.el6.x86_64\r\ncentreon-widget-hostgroup-monitoring-1.3.0-4.el6.noarch\r\ncentreon-connector-1.1.2-1.el6.x86_64\r\ncentreon-perl-libs-2.7.6-4.el6.noarch\r\ncentreon-web-2.7.6-4.el6.noarch\r\ncentreon-engine-daemon-1.5.1-3.el6.x86_64\r\ncentreon-engine-1.5.1-3.el6.x86_64\r\ncentreon-widget-httploader-1.0.0-2.el6.noarch\r\ncentreon-poller-display-1.5.2-2.el6.noarch\r\ncentreon-widget-live-top10-cpu-usage-1.0.0-7.el6.noarch\r\ncentreon-widget-grid-map-1.0.0-8.el6.noarch\r\ncentreon-widget-engine-status-1.0.1-5.el6.noarch\r\ncentreon-broker-storage-2.11.5-2.el6.x86_64\r\ncentreon-broker-cbd-2.11.5-2.el6.x86_64\r\ncentreon-plugins-2.7.6-4.el6.noarch\r\ncentreon-trap-2.7.6-4.el6.noarch\r\ncentreon-2.7.6-4.el6.noarch\r\ncentreon-connector-perl-1.1.2-1.el6.x86_64\r\ncentreon-engine-extcommands-1.5.1-3.el6.x86_64\r\ncentreon-widget-tactical-overview-1.0.1-2.el6.noarch\r\ncentreon-broker-core-2.11.5-2.el6.x86_64\r\ncentreon-broker-cbmod-2.11.5-2.el6.x86_64\r\ncentreon-widget-servicegroup-monitoring-1.3.1-1.el6.noarch\r\ncentreon-widget-live-top10-memory-usage-1.0.2-1.el6.noarch\r\ncentreon-syslog-frontend-1.5.3-5.el6.el6.noarch\r\ncentreon-connector-ssh-1.1.2-1.el6.x86_64\r\ncentreon-plugin-meta-2.7.6-4.el6.noarch\r\ncentreon-widget-host-monitoring-1.4.2-1.el6.noarch\r\ncentreon-broker-2.11.5-2.el6.x86_64\r\ncentreon-widget-graph-monitoring-1.3.0-3.el6.noarch\r\n\r\n\r\n**Steps to reproduce the issue:**\r\n1. Create a user on the satellit-poller (configured as display poller) with a autologin key\r\n2. http://centreon/centreon/main.php?p=1&autologin=1&useralias=%myuser%&token=%anytoken%\r\n3. Any token is valid for a login (except an empty token-GET Parameter an empty token in the user config valid)\r\n\r\nUser config has no autologin key set so there are two cases:\r\nhttp://centreon/centreon/main.php?p=1&autologin=1&useralias=%myuser%&token= => not valid\r\nhttp://centreon/centreon/main.php?p=1&autologin=1&useralias=%myuser%&token=123 => valid/logged in\r\n\r\n\r\n**Describe the results you received:**\r\nUser is logged in with any token\r\n\r\n**Describe the results you expected:**\r\nUser should be logged in only with the correct token\r\n\r\n**Additional information you think important (e.g. issue happens only occasionally):**\r\nThis bug is only on the display poller, on the central the function is working as expected. We already tried to delete the user and create a new one. If there is not any token set to a user, you can also login with any token!"},"comment":{"url":"https://api.github.com/repos/centreon/centreon/issues/comments/246973641","html_url":"https://github.com/centreon/centreon/issues/4668#issuecomment-246973641","issue_url":"https://api.github.com/repos/centreon/centreon/issues/4668","id":246973641,"user":{"login":"itsul","id":12328177,"avatar_url":"https://avatars.githubusercontent.com/u/12328177?v=3","gravatar_id":"","url":"https://api.github.com/users/itsul","html_url":"https://github.com/itsul","followers_url":"https://api.github.com/users/itsul/followers","following_url":"https://api.github.com/users/itsul/following{/other_user}","gists_url":"https://api.github.com/users/itsul/gists{/gist_id}","starred_url":"https://api.github.com/users/itsul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/itsul/subscriptions","organizations_url":"https://api.github.com/users/itsul/orgs","repos_url":"https://api.github.com/users/itsul/repos","events_url":"https://api.github.com/users/itsul/events{/privacy}","received_events_url":"https://api.github.com/users/itsul/received_events","type":"User","site_admin":false},"created_at":"2016-09-14T10:41:10Z","updated_at":"2016-09-14T10:41:10Z","body":"Hi @lpinsivy  ,\r\n\r\nunfortunately your last security update has not solved the bug. If i look at ref #4668 which is linked from you, there is only the \"!empty\" added.\r\n\r\nThe problem is: every token is valid vor login.\r\n\r\nFurthermore i think you should add the fix to the other sections/auth. methodes such as local users (at the moment the \"fix\" is only made at ldap auth.)"}}
{"actor":{"display_login":"itsul"}}