Reports Tab always shows 'Administration' despite a users permissions

[TheWitness]

Describe the bug

For some reason, despite taking away a users access to Reports Administration, they still include that permission after login and logging back on again.

Expected behavior

Cacti permissions should work as expected. I don't know the source of this issue, but it's easy to reproduce.

[netniV]

I created a brand new user, with no permissions but Graphs. Only graphs was seen.

However, if you give them Report Creation, they can then add reports (and it shows Administrator Level) next to the Reports title.

If you switch this for Reports Administration, the reporting tab can go into an endless loop

[netniV]

reports_user.php is realm 21 ('Reports Administration')
reports_admin.php is realm 22 ('Reports Creation')

Something is broken with permission caching though because according to my debugging, is_realm_allowed said that 22 was allowed, yet the database permissions for the user_auth_realm are just 7 and 21. The group query also returns no entries.

I did switch between the two, in order to see what appeared. Once I logged out and back in again, realm 22 was no longer a viable selection and the reporting tab became report_user.php not report_admin.php

[TheWitness]

Yea, likely one of those algo's that I put into my head, and my head was convinced that the algo was right, only to find that I was asleep the whole time, and that I spilled my coffee on the keyboard.

[TheWitness]

Going to research how this happened. Maybe when we implemented Roles.

[TheWitness]

I conducted a study on this permission issues. It's been broken since January 2, 2019. So, over 3 years. I suggest we leave this change as is and add a note indicating that we resolved the scalability issues with the plugin and fixed a permission problem.

[TheWitness]

Proposing something to the order.

Since Cacti 1.2.0, the Reports permission system has been broken. Therefore, any Cacti user who had access to the Reports User view was actually presented the administrative view. We have fixed this issue. So, if you have users who were previously using the Administrative feature to take ownership of a report, they will no longer be able to do so.

Additionally, we made significant performance improvements to the Report Item user interface including:

1. Fixing Drag and Drop,
2. Creating support for a Device type Report Item,
3. Fix Graph Item Sequence issues,
4. Making the Graph and Device filters on the Report Item interface,
5. Added Report documentation to the Cacti documentation,
6. Allowing the Report HTML to be 100% controlled by the Format File CSS

I think this will be enough.

[cigamit]

Looks good to me

[netniV]

There is still a bug here where if the permission is switched between Report Creation and Administration, the user is left with permission denied messages and the wrong tab still shows.

[TheWitness]

Yea, let me check on that. The real thing we need is a callback response that tells Cacti's loadPageNoHeader() to do a document.location = blah; as once the permission is changed, cacti knows where to go, but the user menu is still wrong until you do a refresh.