Subject: [Pkg-cacti-maint] Bug#809260: cacti: Latest Squeeze LTS update of Cacti breaks graph viewing (graph preview still works)

From: Bart Champagne <[email-masked]>
Date: Mon, 28 Dec 2015 21:56:15 +0100

Package: cacti
Version: 0.8.7g-1+squeeze9+deb6u11
Severity: grave
Tags: squeeze
Justification: renders package unusable

-- System Information:
Debian Release: 6.0.10
   APT prefers squeeze-lts
   APT policy: (500, 'squeeze-lts'), (500, 'oldoldstable-updates'), 
(500, 'oldoldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.32-5-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages cacti depends on:
ii  apache2            2.2.16-6+squeeze15    Apache HTTP Server metapackage
ii  apache2-mpm-prefor 2.2.16-6+squeeze15    Apache HTTP Server - traditional n
ii  dbconfig-common    1.8.46+squeeze.0      common framework for packaging dat
ii  debconf [debconf-2 1.5.36.1              Debian configuration management sy
ii  libapache2-mod-php 5.3.3.1-7+squeeze28   server-side, HTML-embedded scripti
ii  libphp-adodb       5.10-1                The ADOdb database abstraction lay
ii  mysql-client-5.1 [ 5.1.73-1+deb6u1       MySQL database client binaries
ii  php5-cli           5.3.3.1-7+squeeze28   command-line interpreter for the p
ii  php5-mysql         5.3.3.1-7+squeeze28   MySQL module for php5
ii  php5-snmp          5.3.3.1-7+squeeze28   SNMP module for php5
ii  rrdtool            1.4.3-1               time-series data storage and displ
ii  snmp               5.4.3~dfsg-2+squeeze1 SNMP (Simple Network Management Pr
ii  ucf                3.0025+nmu1           Update Configuration File: preserv

Versions of packages cacti recommends:
ii  iputils-ping             3:20100418-3    Tools to test the reachability of
ii  logrotate                3.7.8-6         Log rotation utility
ii  mysql-server             5.5.46-0+deb6u1 MySQL database server (metapackage
ii  mysql-server-5.1 [mysql- 5.1.73-1+deb6u1 MySQL database server binaries and

Versions of packages cacti suggests:
pn  php5-ldap                     <none>     (no description available)

-- debconf information:
   cacti/password-confirm: (password omitted)
   cacti/app-password-confirm: (password omitted)
   cacti/mysql/admin-pass: (password omitted)
   cacti/mysql/app-pass: (password omitted)
   cacti/purge: false
   cacti/db/app-user: cacti
   cacti/passwords-do-not-match:
   cacti/dbconfig-remove:
   cacti/mysql/admin-user: root
* cacti/dbconfig-install: true
   cacti/upgrade-backup: true
   cacti/missing-db-package-error: abort
   cacti/install-error: abort
* cacti/webserver: Apache2
   cacti/internal/reconfiguring: false
   cacti/mysql/method: unix socket
   cacti/database-type: mysql
   cacti/remote/host:
   cacti/remove-error: abort
   cacti/db/dbname: cacti
   cacti/remote/port:
   cacti/dbconfig-reinstall: false
   cacti/upgrade-error: abort
   cacti/dbconfig-upgrade: true
   cacti/internal/skip-preseed: false
   cacti/remote/newhost:

Graph preview that still works : 
http://server/cacti/graph_view.php?action=tree&tree_id=1&leaf_id=14
Graph URL that doesn't work : 
http://server/cacti/graph.php?action=view&rra_id=all&local_graph_id=115

---

From: Chris Lamb <[email-masked]>
Date: Mon, 28 Dec 2015 23:02:13 +0000

> http://server/cacti/graph.php?action=view&rra_id=all&local_graph_id=115

Could you visit this URL directly and let us know the output? 

Regards,

-- 
      ,''`.
     : :'  :     Chris Lamb
     `. `'`      [email-masked] / chris-lamb.co.uk
       `-

---

From: Bart Champagne <[email-masked]>
Date: Tue, 29 Dec 2015 00:21:51 +0100

Blank page. Doesn't even ask for a login (it should).

Apache's error.log says this :
PHP Fatal error:  Call to undefined function input_validate_input_regex() in
/usr/share/cacti/site/graph.php on line 31

-----Original Message-----
From: Chris Lamb [mailto:[email-masked]] 
Sent: dinsdag 29 december 2015 0:02
To: Bart Champagne <[email-masked]>
Cc: [email-masked]
Subject: Re: cacti: Latest Squeeze LTS update of Cacti breaks graph viewing
(graph preview still works)

Regards,

---
This email has been checked for viruses by Avast antivirus software.
https://www.avast.com/antivirus

---

From: Chris Lamb <[email-masked]>
Date: Wed, 30 Dec 2015 16:36:14 +0000

> /usr/share/cacti/site/graph.php on line 31

I believe I have found the problem. Please could you replace your graph.php with:

 https://gist.githubusercontent.com/lamby/11d27db09c8701dfaed7/raw/775a4279af0cf07267ec7c485497eda39515a675/graph.php

Regards,

---

From: Bart Champagne <[email-masked]>
Date: Wed, 30 Dec 2015 22:45:09 +0100

That appears to fix it !

I really should upgrade away from Squeeze, but in the meanwhile thanks for
the fix !
Bart

-----Original Message-----
From: Chris Lamb [mailto:[email-masked]] 
Sent: woensdag 30 december 2015 17:36
To: Bart Champagne <[email-masked]>
Cc: [email-masked]
Subject: Re: cacti: Latest Squeeze LTS update of Cacti breaks graph viewing

> PHP Fatal error:  Call to undefined function 
> input_validate_input_regex() in /usr/share/cacti/site/graph.php on 
> line 31

I believe I have found the problem. Please could you replace your graph.php
with:

https://gist.githubusercontent.com/lamby/11d27db09c8701dfaed7/raw/775a4279af
0cf07267ec7c485497eda39515a675/graph.php

Regards,

---

---

From: [email-masked] (Debian Bug Tracking System)
Date: Wed, 30 Dec 2015 22:21:08 +0000

Your message dated Wed, 30 Dec 2015 22:18:53 +0000
with message-id <[email-masked]>
and subject line Bug#809260: fixed in cacti 0.8.7g-1+squeeze9+deb6u12
has caused the Debian Bug report #809260,
regarding cacti: Latest Squeeze LTS update of Cacti breaks graph viewing  (graph preview still works)
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email-masked]
immediately.)

-- 
809260: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=809260
Debian Bug Tracking System
Contact [email-masked] with problems

Subject: cacti: Latest Squeeze LTS update of Cacti breaks graph viewing (graph preview still works)
From: Bart Champagne <[email-masked]>
To: Debian Bug Tracking System <[email-masked]>
Date: Mon, 28 Dec 2015 21:56:15 +0100

Package: cacti

-- System Information:
Debian Release: 6.0.10
   APT prefers squeeze-lts

-- debconf information:

Subject: Bug#809260: fixed in cacti 0.8.7g-1+squeeze9+deb6u12
From: Chris Lamb <[email-masked]>
To: [email-masked]
Date: Wed, 30 Dec 2015 22:18:53 +0000

Source: cacti
Source-Version: 0.8.7g-1+squeeze9+deb6u12

We believe that the bug you reported is fixed in the latest version of
cacti, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to [email-masked],
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Chris Lamb <[email-masked]> (supplier of updated cacti package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email-masked])

Format: 1.8
Date: Wed, 30 Dec 2015 17:40:37 +0100
Source: cacti
Binary: cacti
Architecture: source all
Version: 0.8.7g-1+squeeze9+deb6u12
Distribution: squeeze-lts
Urgency: high
Maintainer: Sean Finney <[email-masked]>
Changed-By: Chris Lamb <[email-masked]>
Description: 
 cacti      - Frontend to rrdtool for monitoring systems and services
Closes: 809260
Changes: 
 cacti (0.8.7g-1+squeeze9+deb6u12) squeeze-lts; urgency=high
 .
   * Correct regression in patch for CVE-2015-8369 introduced in
     0.8.7g-1+squeeze9+deb6u12. (Closes: #809260)
Checksums-Sha1: 
 c1c4c3cf07722664c4e93de8d591cfc21d80482e 1804 cacti_0.8.7g-1+squeeze9+deb6u12.dsc
 a5a710653e158b1bc950de0a1e2c60ee364bf782 2236916 cacti_0.8.7g.orig.tar.gz
 194ebfe0af1252a7987c0ef69d3926ab10049e22 73998 cacti_0.8.7g-1+squeeze9+deb6u12.diff.gz
 ed51b7d0bf9ba64a4929b102a93306160834912f 2103096 cacti_0.8.7g-1+squeeze9+deb6u12_all.deb
Checksums-Sha256: 
 f5e89371371b35d06572d214861238be29df094325a53129cbf6575d3d5196d4 1804 cacti_0.8.7g-1+squeeze9+deb6u12.dsc
 d09b3bf54f51bd42b2db0a62521cf6e408716978f75d6509ec56027c49c44585 2236916 cacti_0.8.7g.orig.tar.gz
 4b89f34d546dd4bd18bdc5da2ed9aecefe185bfa90f17bcd32d7a66c8f71102f 73998 cacti_0.8.7g-1+squeeze9+deb6u12.diff.gz
 80d74a4f3c1c80eed4a306a1fe2d3a26bc1ef55712b4feab0b9a4ec8ef035e90 2103096 cacti_0.8.7g-1+squeeze9+deb6u12_all.deb
Files: 
 3c6a5567acfc9042a7a018e1a4a5aecd 1804 web extra cacti_0.8.7g-1+squeeze9+deb6u12.dsc
 268421cb1a58d3444f7ecbddb4c4b016 2236916 web extra cacti_0.8.7g.orig.tar.gz
 1f8a3f6d956b6cd6d3c3553de34a5273 73998 web extra cacti_0.8.7g-1+squeeze9+deb6u12.diff.gz
 103a89e5a40bb49c0a017180669a952b 2103096 web extra cacti_0.8.7g-1+squeeze9+deb6u12_all.deb

---

From: [email-masked] (Debian Bug Tracking System)
Date: Mon, 04 Jan 2016 12:24:07 +0000

Your message dated Mon, 04 Jan 2016 12:20:25 +0000
with message-id <[email-masked]>
and subject line Bug#809260: fixed in cacti 0.8.7g-1+squeeze9+deb6u13
has caused the Debian Bug report #809260,
regarding cacti: Latest Squeeze LTS update of Cacti breaks graph viewing  (graph preview still works)
to be marked as done.

Package: cacti

-- System Information:
Debian Release: 6.0.10
   APT prefers squeeze-lts

-- debconf information:

Subject: Bug#809260: fixed in cacti 0.8.7g-1+squeeze9+deb6u13
From: Chris Lamb <[email-masked]>
To: [email-masked]
Date: Mon, 04 Jan 2016 12:20:25 +0000

Source: cacti
Source-Version: 0.8.7g-1+squeeze9+deb6u13

Format: 1.8
Date: Mon, 04 Jan 2016 11:37:24 +0000
Source: cacti
Binary: cacti
Architecture: source all
Version: 0.8.7g-1+squeeze9+deb6u13
Distribution: squeeze-lts
Urgency: high
Maintainer: Sean Finney <[email-masked]>
Changed-By: Chris Lamb <[email-masked]>
Description: 
 cacti      - Frontend to rrdtool for monitoring systems and services
Closes: 807599 809260
Changes: 
 cacti (0.8.7g-1+squeeze9+deb6u13) squeeze-lts; urgency=high
 .
   * Correct yet another regression in patch for CVE-2015-8369, introduced in
     0.8.7g-1+squeeze9+deb6u12. Thanks to Marcel Meckel <[email-masked]>
     (Closes: #809260, #807599)
Checksums-Sha1: 
 75b63fbf05d95ebe971234ab996c3bdf883252c0 1804 cacti_0.8.7g-1+squeeze9+deb6u13.dsc
 a5a710653e158b1bc950de0a1e2c60ee364bf782 2236916 cacti_0.8.7g.orig.tar.gz
 80caa2da964794c63c779602f0b84d2162cc667a 74415 cacti_0.8.7g-1+squeeze9+deb6u13.diff.gz
 5acda7659b545c46706c9b4fff5b647bd84edc30 2103244 cacti_0.8.7g-1+squeeze9+deb6u13_all.deb
Checksums-Sha256: 
 eca202ea78a2a2091d21ec4cf319a975d74b7d84a4c4f3cd8af9976f3d1982e3 1804 cacti_0.8.7g-1+squeeze9+deb6u13.dsc
 d09b3bf54f51bd42b2db0a62521cf6e408716978f75d6509ec56027c49c44585 2236916 cacti_0.8.7g.orig.tar.gz
 bd241b2f55c8763f86181ffdd030294485539ec90b846fba7868efb772a9f251 74415 cacti_0.8.7g-1+squeeze9+deb6u13.diff.gz
 06dc316f3deac06429d5563fc6dc102ea4bd1ea973c9f978bf5e40e87f97cc0e 2103244 cacti_0.8.7g-1+squeeze9+deb6u13_all.deb
Files: 
 196e9b4a676e0f1a141de77b7d926b1d 1804 web extra cacti_0.8.7g-1+squeeze9+deb6u13.dsc
 268421cb1a58d3444f7ecbddb4c4b016 2236916 web extra cacti_0.8.7g.orig.tar.gz
 6554863c748a7110700c7d5f5da9ff1d 74415 web extra cacti_0.8.7g-1+squeeze9+deb6u13.diff.gz
 45da56084a03c03c70fef375b66edf0f 2103244 web extra cacti_0.8.7g-1+squeeze9+deb6u13_all.deb