Wrong redirect for editing thresholds for limited users

[EmmaTinten]

Expected Behavior

Users with limited permissions who are allowed to override thresholds should be able to change the values directly by using "Edit" of the host / service entry.

Current Behavior

As a user limited by role access with the granted permission to modify values of services the link presented by the "Edit" Link of a host or service forwards the user to a read only view. Users granted all permissions are correctly presented the form to change the values of a check.

The user can navigate via Icinga Director -> Hosts -> select host -> Services -> select service to get the form where the values can be changed.

Possible Solution

Fix the link presented by edit for users with limited permissions.

Steps to Reproduce (for bugs)

1. Assign a user with limited access, here the list of granted permissions:

module/director,director/hosts,director/notifications,director/services,director/servicesets,director/monitoring/services-ro,module/monitoring

2. Create a service set, include some services with thresholds which should be overriden
3. Limit the role's access with hostgroup filters
4. Login as the user and try to override the thresholds by searching the service (not using the Icinga Director menu)

Your Environment

• Director version (System - About): 1.8.1
• Icinga Web 2 version and modules (System - About): 2.9.5
• Icinga 2 version (icinga2 --version): r2.13.2-1
• Operating System and version: Debian 10
• Webserver, PHP versions: Apache2, PHP 7.3.31-1

[Thomas-Gelf]

Please remove director/monitoring/services-ro, if you do not want readonly (ro) services

[EmmaTinten]

Without that endpoint the user is not able to see the service set. He is presented with a message that the permission has been denied.

[EmmaTinten]

I'll paste some screenshots:

Using the edit link as limited user results in the permission error:

Granting the user the services-ro right allows him to see the services. But theres no option to edit the thresholds from here (as a non limited user can!):

Important is, that the user is able to modify the thresholds navigating using the director menu.

[Thomas-Gelf]

I tried to reproduce this, there is something going wrong. As a workaround, please open HostController.php, go to isServicesReadOnlyAction() and comment/remove both findservice and invalidservice:

     protected function isServicesReadOnlyAction()
     {
         return in_array($this->getRequest()->getActionName(), [
             'servicesro',
-            'findservice',
-            'invalidservice',
         ]);
     }

This will break director/monitoring/services-ro, so I'll need find a different final fix for this. monitoring/ro is a very special permission that should not be combined with other/wider permissions. Please also remove director/services and director/servicesets from your permission list - it should then work as expected.