[DEV BRANCH] Blank page and 500 response code when trying to create a new snapin

[sniff122]

When attempting to create a new snapin from the snapin management page, upon clicking the Create New Snapin the page is blank and in the dev console the server responds with a 500 error.

To Reproduce

1. Go to the Snapin Management page from the top menu
2. Click Create New Snapin
3. A blank page is displayed with a 500 error being logged in the browser's dev console
4. The following error is logged in /var/log/apache2/error.log:

   [Tue Feb 07 09:40:37.522670 2023] [proxy_fcgi:error] [pid 122256] [client 192.168.1.210:50330] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to a member function isValid() on null in /var/www/html/fog/status/getfiles.php:27\nStack trace:\n#0 {main}\n  thrown in /var/www/html/fog/status/getfiles.php on line 27'
   [Tue Feb 07 09:40:37.524139 2023] [proxy_fcgi:error] [pid 122258] [client 192.168.1.157:33764] AH01071: Got error 'PHP message: PHP Fatal error:  Uncaught TypeError: preg_grep(): Argument #2 ($array) must be of type array, null given in /var/www/html/fog/lib/fog/storagenode.class.php:233\nStack trace:\n#0 /var/www/html/fog/lib/fog/storagenode.class.php(233): preg_grep()\n#1 /var/www/html/fog/lib/fog/storagenode.class.php(243): StorageNode->_getData()\n#2 /var/www/html/fog/lib/fog/storagenode.class.php(129): StorageNode->getSnapinfiles()\n#3 /var/www/html/fog/lib/pages/snapinmanagementpage.class.php(466): StorageNode->get()\n#4 /var/www/html/fog/lib/fog/fogpagemanager.class.php(220): SnapinManagementPage->add()\n#5 /var/www/html/fog/management/index.php(58): FOGPageManager->render()\n#6 {main}\n  thrown in /var/www/html/fog/lib/fog/storagenode.class.php on line 233', referer: http://192.168.1.210/fog/management/index.php?node=snapin

Expected behavior The create new snapin page is displayed, allowing you to create a new snapin

Screenshots See screen recording: https://user-images.githubusercontent.com/8513053/217208581-24e2c446-3b1c-4601-8502-ddcb023ab0b7.mp4

Software (please complete the following information):

• FOG version 1.5.9.239
• FOS kernel 1.19.145
• OS: Ubuntu 22.04

Additional context Fresh install of FOG with no changes to configuration. Latest pull from the dev branch

[osiktech]

Same here

[osiktech]

I did some debugging, and it seems to be this commit: 68d73740d7d40aee77cfda3fb8199d58bf04f48b

I commented line 25 to 34 in /var/www/html/fog/status/getfiles.php and voila creating snapins is working again.

[sniff122]

interesting, thanks for digging into that, i would if i knew PHP

[osiktech]

I get the idea why it was introduced because otherwise you would be able to enumarate files/directories in a path (e.g.) http://your-fog-server/fog/status/getfiles.php?path=%2Ftmp%2F will list the content of /tmp.

The real problem seems to be !$currentUser->isValid() which results in

Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to a member function isValid() on null in /var/www/html/fog/status/getfiles.php:27\nStack trace:\n#0 {main}\n  thrown in /var/www/html/fog/status/getfiles.php on line 27'

maybe @0x41c could elaborate a little more what this is about.

[sniff122]

Yeah it's definitely a needed thing

[Sebastian-Roth]

@sniff122 Thanks for bringing this up and also thanks to @osiktech for digging up why this is failing.

I've had a look as well. Although the request should be authenticated it's not. This is caused by a special case in the databasemanager code ref which will cause the initialization of $currentUser to be skipped code ref.

@mastacontrola From what I can see this is the only place status/getfiles.php is being called. Though the caller function _getData() is used to retrieve names of Logfiles, Snapins and Images. Do you know if all those calls are authenticated (called by a logged in user) or otherwise called from one of the services?

[0x41c]

I get the idea why it was introduced because otherwise you would be able to enumarate files/directories in a path (e.g.) http://your-fog-server/fog/status/getfiles.php?path=%2Ftmp%2F will list the content of /tmp.

The real problem seems to be !$currentUser->isValid() which results in

Got error 'PHP message: PHP Fatal error:  Uncaught Error: Call to a member function isValid() on null in /var/www/html/fog/status/getfiles.php:27\nStack trace:\n#0 {main}\n  thrown in /var/www/html/fog/status/getfiles.php on line 27'

maybe @0x41c could elaborate a little more what this is about.

I made a change in a #540 that deals with this exact thing. It's not a solution, but a workaround for this issue where it will instead return Unauthenticated until a resolve is met. I came across this issue and I think the solution would be to repurpose authentication to be more use agnostic. Currently authentication is only used for database and management access which is why when determining whether the user needs database access the global authenticity is invalidated (because it presumes there's no use for it).

I can make a PR soon that addresses this issue separately. From there I can re-submit #540 without the workaround

[Sebastian-Roth]

@sniff122 @osiktech Sorry for the delay. We've somehow lost track of this issue. I just pushed a fix to make snapin creation work again. Please update.

[sniff122]

No worries! I'll test it tomorrow

[sniff122]

Just tested and it appears to be working!

[Sebastian-Roth]

@sniff122 Thanks for testing. Closing as fixed.