You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
TheWitness
changed the title
Cacti allows you to disable the currently logged in administrator disabling the user
Cacti allows you to disable or delete the currently logged in administrator disabling the user
Feb 27, 2022
#4578, #4574
-security#4576: Stored XSS Issue in Cacti Device, Graph, Graph Template, and Graph Items callbacks
-security#4579: Cacti account lockout policies are not properly applied to LDAP and Domain Users
-issue#4573: The Cacti permission system does not scale to very large installations
-issue#4575: When you delete a user, their 'remember me' cookie data is not automatically removed
-issue#4576: Stored XSS Issue in Cacti Device, Graph, Graph Template, and Graph Items callbacks
-issue#4577: Cacti allows you to disable the currently logged in administrator disabling the user
-issue#4578: The Cacti login algorithm is complicated to understand due to too much strait line code
-feature#4574: Cacti needs some additional permission methods for larger installations
This change properly documents the file lib/auth.php using phpDocument format, and performed multiple sanity and readability changes such as the renaming of variables commonly used in multiple functions.
The the restructuring of the three authentication files:
- auth_login.php
- include/auth.php
- lib/auth.php
Makes the code more readable, it's not a complete solution, however, it is much easier to follow now.
Shouldn't this go further and block editing of your own user for most things ?
netniV
changed the title
Cacti allows you to disable or delete the currently logged in administrator disabling the user
When editing current user, last administrator may be removed
Apr 3, 2022
Describe the bug
Cacti allows you to disable the currently logged in user, thus kicking your out of Cacti.
Expected behavior
Less Cacti bugs.
The text was updated successfully, but these errors were encountered: