serjoscha87 / cockpit_groups Goto Github PK

Hey there!

I'd like to report a security issue but cannot find contact instructions on your repository.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

It is possible to set permissions regarding collection entries.

However, for singletons, setting permissions do not grant any rights to the user group...

I have recently just installed the addon to a fairly new Cockpit instance that's using MongoDB and I cannot save a group. I'm using the addon successfully in a different instance (older version of Cockpit and Addon).

Steps to reproduce:

• Install the plugin;
• Go to Groups page;
• Configure the group with the needed details;
• Press "Save";
• Notice that nothing happens.

Looking into the console, there is a 500 Error on /groups/save with the following details:

error: "invalid document for insert: keys cannot contain ".": "finder.path""
file: "/var/www/html/lib/vendor/mongodb/mongodb/src/Operation/InsertOne.php"
line: 112

Cockpit version: 0.10.0

Does anyone have any suggestions about this? Thanks in advance.

assets.path doesn't exist anywhere in the cockpit code. Was it in a previous version or did you add it by mistake?

'finder.allowed_uploads' => 10, looks like a placeholder. The default could be a list with "save" file types, like: pdf, png, jpg, jpeg, svg, gif

Hi,

Thanks for this plugin. Can you add this feature and fix these bugs ?

1/ Could you add an option to block access to the Assets module ?

2/ When I connect to an account created with the plugin... I can't use the Finder module, although the module is active in the plugin. I have a error message : "Something went wrong".

3/ The URI of the plugin icon is not correct.

Change this :

<li class="uk-grid-margin">
    <a class="uk-display-block uk-panel-card-hover uk-panel-box uk-panel-space " href="/groups">
        <div class="uk-svg-adjust">
            <img class="uk-margin-small-right inherit-color" data-uk-svg="" alt="assets" src="/assets/app/media/icons/accounts.svg" width="40" height="40">
        </div>
        <div class="uk-text-truncate uk-text-small uk-margin-small-top">Groups</div>
    </a>
</li>

By this (src="../assets/app/media/icons/accounts.svg" instead of src="/assets/app/media/icons/accounts.svg") :

<li class="uk-grid-margin">
    <a class="uk-display-block uk-panel-card-hover uk-panel-box uk-panel-space " href="/groups">
        <div class="uk-svg-adjust">
            <img class="uk-margin-small-right inherit-color" data-uk-svg="" alt="assets" src="../assets/app/media/icons/accounts.svg" width="40" height="40">
        </div>
        <div class="uk-text-truncate uk-text-small uk-margin-small-top">Groups</div>
    </a>
</li>

Thanks in advance.

Hi,

Thanks for creating this awesome plugin, it is very useful for me and my co-workers. In my company we will use Cockpit CMS, and we would like to use this plugin also. I have a question about licence therefore, because I can not find it in repository. 

Can we use this plugin with the same licence as the main project? Cockpit CMS is distributed on MIT licence.

Thanks from advance for reply and have a nice day! :)

Hello. I've put Groups folder into /cockpit/addons directory as is said in Installation paragraph but nothing has changed.
I can't see box "Group" in Setting. Should I change something in code?

When I load my cockpit from localhost/cockpit, groups.css and groups.js have wrong paths (localhost/addons/Groups...).

$app->path('groups', 'addons/Groups/');

I found three ways to solve it, but I tested it only on localhost.

$app->path('groups', '/addons/Groups/'); // with slash before addons
$app->path('groups', $app['base_route'].'addons/Groups/'); // adds 'cockpit/'
$app->path('groups', __DIR__); // current path

I prefer the one with __DIR__. This way the addon still works if I don't rename it from 'cockpit_GROUPS' to 'Groups'.

I didn't test this, but it's possible to define a custom module dir in config (loadmodules: dirnames). The version with __DIR__ should work there, too.

Hi @serjoscha87

I've installed a clean version of cockpit on a wampserver, php 7.3.12 and then installed Groups from the zip download

Creating a group looks fine, but editing the group is throwing an error. Not sure where to look.

Any thoughts?
Many thanks

php_error.log

[05-Dec-2019 13:57:00 UTC] PHP Stack trace:
[05-Dec-2019 13:57:00 UTC] PHP   1. {main}() C:\wamp64\cockpit\index.php:0
[05-Dec-2019 13:57:00 UTC] PHP   2. LimeExtra\App->run() C:\wamp64\cockpit\index.php:48
[05-Dec-2019 13:57:00 UTC] PHP   3. LimeExtra\App->dispatch() C:\wamp64\cockpit\lib\Lime\App.php:983
[05-Dec-2019 13:57:00 UTC] PHP   4. LimeExtra\App->render_route() C:\wamp64\cockpit\lib\Lime\App.php:1036
[05-Dec-2019 13:57:00 UTC] PHP   5. LimeExtra\App->Lime\{closure:C:\wamp64\cockpit\lib\Lime\App.php:893-900}() C:\wamp64\cockpit\lib\Lime\App.php:1090
[05-Dec-2019 13:57:00 UTC] PHP   6. LimeExtra\App->invoke() C:\wamp64\cockpit\lib\Lime\App.php:899
[05-Dec-2019 13:57:00 UTC] PHP   7. Cockpit\Controller\Groups->group() C:\wamp64\cockpit\lib\Lime\App.php:1114
[05-Dec-2019 13:57:00 UTC] PHP   8. Cockpit\Controller\Groups->render() C:\wamp64\cockpit\addons\Groups\Controller\Groups.php:41
[05-Dec-2019 13:57:00 UTC] PHP   9. LimeExtra\App->view() C:\wamp64\cockpit\lib\LimeExtra\Controller.php:51
[05-Dec-2019 13:57:00 UTC] PHP  10. Lexy->file() C:\wamp64\cockpit\lib\LimeExtra\App.php:123
[05-Dec-2019 13:57:00 UTC] PHP  11. lexy_include_with_params() C:\wamp64\cockpit\lib\Lexy.php:132
[05-Dec-2019 13:57:00 UTC] PHP  12. include() C:\wamp64\cockpit\lib\Lexy.php:443 ```

Hi,

Thank you for this great addon. I'm wondering if it's possible to limit visibility of some collections. i.e lets say I want "statistics collection" to be visible to managers but hidden for content providers.

If you think this will make your addon too complicated or it's not a wanted feature for your addon you can just close the issue.

Thanks,
Yusuf

I tried adding support for permissions concerning singletons via:

$acls_filtered = [
       'cockpit' => @$row['cockpit'],
       'collections' => @$row['collections'],
       'singletons' => @$row['singletons'],
       'regions' => @$row['regions'],
       'forms' => @$row['forms']
   ];

I also added the form fields required like so:

<div class="uk-form-row">
            <strong class="uk-text-uppercase">singletons</strong>
            <div class="uk-margin-small-top">
                <field-boolean bind="group.singletons.create" label="@lang('Create')"></field-boolean>
            </div>
            <div class="uk-margin-small-top">
                <field-boolean bind="group.singletons.delete" label="@lang('Delete')"></field-boolean>
            </div>
            <div class="uk-margin-small-top">
                <field-boolean bind="group.singletons.manage" label="@lang('Manage')"></field-boolean>
            </div>
        </div>

When I now log in using a user in a group which is allowed to manage singletons, the singleton-link isn't even shown anymore.

Any idea, what I missed?

When I try to create a new group, I receive the following error from the backend:

error: "invalid document for insert: keys cannot contain ".": "finder.path""
file: "/var/www/html/lib/vendor/mongodb/mongodb/src/Operation/InsertOne.php"
line: 112

Some googling suggestes that the error might be connected with having a mongodb adapter that restricts the usage of "." in keys.

I have tried multiple combinations of creating groups thrugh the addon, but in everycase the user is unable to upload anything .even just selecting select assets, a warning pops up unauthorized

Seems that the plugin is intended to work with sqlite since in mongo you cannot have a key that contains a dot symbol.

Do you plan to support Mongo?

Thanks!

Cannot see existing collections for non admin groups, how to make them show for all groups/selected groups?

as title reads, when I adjust permissions settings in a collection for a group I've created with this addon, the changes will not save and a returned error of "saving failed"

How do you fully remove this add on from the system. I deleted the folder but I believe it leaves files behind in the storage?
I'm getting this error after installing on the login page:

file_put_contents(/var/w...admin/storage/tmp/4cc5a0d2487ec7f4c75b0cc9115bf601.js): failed to open stream: Permission denied in
/var/www.../admin/lib/LimeExtra/Helper/Filesystem.php
on line
108

I cannot install / use the addon. Readme says to create a subfolder "addons" in the Cockpit root (/usr/share/cockpit on Ubuntu 18.04) and copy the Groups folder into it. But I cannot see it anywhere in the interface.

Cockpit version is 215.