Updated
- Updated NRDP to version 2.0.2 to fix XML parsing causing passive check failures and no last check time -JO
Fixed
- Fixed nagiosxi-deps to properly upgrade even if the install is from a version prior to XI 5 -SW
- Fixed SLA dashlet not updating once sent to dashboard [TPS#14349] -SAW
Updated
- Updated NRDP to version 2.0.0 -JO
Fixed
- Fixed issue with Bulk Modifications Tool where host/service templates would output SQL error when logging to audit log -JO
- Fixed issue with Manage MIBs where duplicate MIBs would cause SQL error [TPS#14312] -SAW
- Fixed Misc info section in services not populating hostname and service description macros properly [TPS#14296] -JO
- Fixed Metrics component NCPA checks state status in the Summary and Gauges tabs [TPS14293] -JO
- Fixed BPI sync issue when hostgroup and servicegroup have the same name [TPS#14291] -JO
- Fixed API edit contact command not updating and not running the proper update function [TPS#14304] -JO
- Fixed issue in API where editing services using PUT commands with / in their description doesn’t work [TPS#14311] -JO
- Fixed issue with multiple commands in inbound email responses not scheduling downtime properly [TPS#14313] -JO
- Fixed ramdisk issue with CentOS 6 installs and npcd not starting on restart [TPS#14318] -JO
- Fixed restart_nagios_with_export.sh script lock file location to be the var directory instead of scripts -JO
- Fixed issue with HTML in comments when sending HTML emails into the inbound email response system -JO
- Fixed older postgres systems upgrading to newer versions having problems setting permissions on upgrade -SAW
Component Updates
Core Config Manager (CCM) 3.0.3
- Fixed CCM database error when writing configs when a hostgroup of * for a service is selected [TPS#14334] -JO
Security
- Updated PHPMailer to version 5.2.27 for security fixes -JO
Fixed
- Fixed sumoselect dropdowns to allow larger names in the selection boxes [TPS#14232] -JO
- Fixed reset_config_perms.sh setting permissions for components folder in scripts directory -JO
- Fixed Schedule Downtime services page not showing services when a user has a host and some unrelated services assigned [TPS#14253] -JO
- Fixed upgrade error in ndoutils upgrade on old systems with non-standard MySQL port specified in config.inc.php -JO
- Fixed an issue where imported SNMP Traps would not be associated with their parent MIB [TPS#14260] -SAW
- Fixed issue with php upgrades on certain rhel systems not finding the proper php package name [TPS#14259] -JO
- Fixed Custom Includes component folder permissions on upgrade [TPS#14266] -JO
- Fixed issue with autotls being turned on by default in PHPMailer [TPS#14270] -JO
- Fixed Graph Explorer icon permissions for hosts when a user does not have access to the host -JO
- Fixed issue with Inbound Email Settings where selecting POP3 would not change the connection type -JO
- Fixed usernames not syncing properly with the cgi.cfg and htpasswd.users files with uppercase characters [TPS#14273] -JO
- Fixed scheduleddowntime API endpoint to accept passing multiple services with services[][] -JO
- Fixed permissions on autodiscovery job folder from permissions changes to main autodiscovery script -JO
- Fixed wording for STARTTLS encryption in LDAP/AD Integration component -JO
- Fixed issue where session was not recorded in the database but wouldn’t be added until re-login -JO
Component Updates
Core Config Manager (CCM) 3.0.2
- Fixed CCM database error when specifying database port number in the config.inc.php for nagiosql [TPS#14263] -JO
- Fixed limited CCM users permissions not properly applying until after a new cached permissions call is made [TPS#14276] -JO
Fixed
- Fixed an issue where HTML e-mails were not handled correctly by the Inbound E-mail Processor [TPS#14205] -SAW
- Fixed an issue where the Manage MIBs page would fail to load on Debian/Ubuntu -SAW
- Fixed authenticator error message in cleaner.log when using Inbound E-mail Processor -TG,JO
- Fixed alert screen checkbox in User Account Settings not set to checked by default -JO
- Fixed issue with logrotate error from root:nagios var directory ownership -JO
- Fixed enterprise features trial buttons on SLA and Capacity Planning report pages -JO
- Fixed nxti.php script issues with SNMP Trap Interface on Debian systems -SAW
- Fixed Scheduled Backups FTP backup limit deletion issue with PHP versions less than 5.6 -SS
Component Updates
Core Config Manager (CCM) 3.0.1
- Fixed issue with default page limits and session page limits being set [TPS#14215] -JO
- Fixed demo mode message and static directory location in Static Config Editor -JO
- Fixed user language and translations not being applied for some variations of CCM user access types -JO
- Fixed issue with Manage Users no result message and not allowing pagination or limiting -JO
- Fixed config output of semicolon in check_command for config files to be escaped instead of url encoded [TPS#14225] -JO
Fixed
- Fixed style issue in Modern Dark theme re-configure notifications tab select boxes [TPS#14156] -JO
- Fixed ownership permissions on folders and scripts and locations of sudo related scripts -JO
- Fixed issue where newer NCPA versions checks were not showing up in metrics component [TPS#14032] -CN
- Fixed issue where Validate SSL certificate checkbox in Inbound Email Settings would not allow being saved as unchecked -JO
- Fixed FTP backup connection not using rawurlencode() for passwords causing connection problems -SS
- Fixed error emails for inbound check commands to send out an error email when an email with no valid command is parsed -JO
- Fixed upgrade issue where deps package would stop upgrade on systems without it [TPS#14184] -JO
- Fixed issue with event_handler.php where the lock file would not be overwritten and stopped notifications being sent [TPS#14180] -JO
Security
- Added the config option in system settings > security to set the rapid response URL -JO
Updated
- Moved Legacy Network Status Map link into Legacy Reports section in the Reports tab -JO
- Fixed wording in deadpool emails to no longer say deleted if objects are to be deactivated -JO
Added
- Added ability to acknowledge problems via email response [TPS#885] -JO
- Added proper display name and alias resolution on host and service status and status detail pages -JO
- Added Scheduling Queue page in Monitoring Process section [TPS#9566] -JO
- Added a new Modern Dark theme which is the same as the current Modern theme but dark -JO
- Added User Sessions page to show who is logged in, where they are, and IP address of logged in user [TPS#8732] -JO
- Added higher page limits for Scheduled Downtime page and other pages including no limit [TPS#13530] -JO
- Added ability to set host/services to inactive instead of deleting them with the Deadpool reaper [TPS#11390] -JO
- Added more default checks on initial install [TPS#11013] -JO
- Added Unconfigured Objects API endpoint (objects/unconfigured) [TPS#12181] -JO
- Added scheduled downtime for child hosts as option for hosts in recurring downtime [TPS#13598] -JF,JO
- Added configurable sql limit for the event_handler cron job -BH
- Added ability for recurring scheduled downtime to update with host/service and hostgroup/servicegroup name changes [TPS#8060] -JO
- Added callbacks: NOTIFICATION_EMAIL_SENT and NOTIFICATION_SMS_SENT and updated existing NOTIFICATION callback arguments -BH
- Added performance data graphs to notification emails [TPS#12650] -BH
- Added the ability to add/remove free variables in Bulk Modifications Tool [TPS#11775] -SAW
- Added a configuration wizard and plugin for capacity planning [TPS#2173] – SAW
- Added ability to show customvars in objects/host, objects/service, and objects/contact by sending customvars=1 in API request [TPS#12420] -JO
- Added ability to schedule all hosts and/or services for hostgroups and servicegroups in Schedule Downtime page [TPS#10043] -JO
- Added focus the first field of every page in the config wizards [TPS#11259] -SW
- Added saving tactical overview configuration settings as a per-user setting. [TPS#6923] -SW
- Added [datetime] macro to scheduled reports [TPS#9635] -SW
- Added confirmation dialog when clicking the X on dashlets to confirm you want to delete the dashlet [TPS#7377] -SW
- Added ability to edit alias and display_name on reconfigure host page and display_name on reconfigure service page [TPS#8724] -SW
- Added better searching from host/service detail page to filter the displayed results instead of taking you back to the top level [TPS#13810] -SW
- Added timestamp to filenames of downloaded and emailed PDFs, CSVs and JPGs [TPS#10680] -SW
- Added ability to specify custom ports to scan in auto discovery [TPS#12383] -SW
- Added downtime icons to Hostgroup Overview, Hostgroup Grid, Servicegroup Overview, Servicegroup Grid [TPS#10200] -SW
- Added setting for trimming of Max Comment Age in Admin -> Performance Settings -> Databases [TPS#12313] -SW
- Added /usr/share/snmp/ & /etc/snmp/ & /home/nagios to backup and restore scripts [TPS#10202] -SW
- Added more time period options to Graph Explorer time period dropdown [TPS#13378] -JO
- Added the ability to enable/disable the web GUI terminal [TPS#13690] -CN
- Added notes, notes url, actions url in a Misc section on Host and Service details pages [TPS#13997] -JO
- Added object type and states to Top Alert Producers as filter dropdowns like other reports -SS
- Added ability to use config_name in api/config/services to update services with multiple hosts or hostgroups [TPS#13605] -JO
- Added copying of all template and information linked to services when using Add Service in Bulk Modification Tool [TPS#13585] -JO
- Added objects/timeperiod to the Objects API to show what time periods are available [TPS#13425] -JO
- Added ability to set new user account information email text and subject in System Settings > User Accounts [TPS#11830] -JO
- Added user’s API key allowing auth to Nagios Core JSON API endpoints via components/nagioscore/ui/(objectjson.php,statusjson.php,archivejson.php) [TPS#12717] -JO
- Added “Create as Monitoring Contact” checkbox in Users edit page when applicable [TPS#14046] -SAW
- Added new features to the Manage MIBs page [TPS#13946, TPS#4810] -SAW
- Added ability for deleting multiple objects via the config API commands [TSP#10435] -JO
- Added is_volatile to the list of single config options that can be changed in the Bulk Modifications Tool [TPS#14105] -JO
- Added api/config options such as the PUT edit endpoints and added hostgroups and servicegroups [TPS#13425] -JO
- Added right-hand alignment on system statistic dashlets (thanks Steve B) -JO
- Added ability to select the default system theme on install -JO
Fixed
- Fixed auto discovery status to no longer show throbber if it is waiting for it’s first scheduled run [TPS#7097] -SW
- Fixed large systems with lots of limited users receiving duplicate key SQL error text in UI after apply config -JO
- Fixed issue in Custom URL dashlet where it would not properly load certain pages when dashboard is exported as PDF -JO
- Fixed re-configure “Edit in CCM” button when two services with the same name but have a different case -JO
- Fixed Restart Nagios Core button in User Macros component not working properly -JO
- Fixed Object Does Not Exist message on large systems when ndoutils database is loading with new adjustable performance setting [TPS#14108] -JO
- Fixed scheduledowntime API endpoint not allowing author paramter to be set [TPS#14141] -SW,JO
- Fixed issue in basic auth where username/user id would not be populated correctly (Thanks Mickey) -SAW
Component Updates
Core Config Manager (CCM) 3.0.0
- Added deletion of services with host if services do not have hostgroups or other hosts attached [TPS#13537] -JO
- Added proper audit logging to all the sections/actions that are performed [TPS#13495] -JO
- Added ability to edit free variables instead of having to remove and re-add them [TPS#12054] -JO
- Added Manage Service Groups and Manage Dependent Service Groups buttons to service dependency objects [TPS#9066] -JO
- Added ability to import excluded hosts/hostgroups [TPS#14113] -JO
- Added checkboxes for Host Groups and Service Groups in the CCM limited access permissions panel in user edit -JO
- Added Service Groups to Service Escalation Objects [TPS#14136] -SAW
- Added renaming of perfdata when a service or host is renamed [TPS#14143] -JO
- Fixed issue where host/services applied to service groups would not show as Unknown for limited CCM users -JO
Security
- Fixed command injection security vulnerability in Autodiscovery script (CVE-2019-9164) (thanks Paolo Giai of Shielder) -JO
- Fixed issue with permissions on config.inc.php and import_xiconfig.php allowing users to write to files (CVE-2019-9166) (thanks Paolo Giai of Shielder) -JO
- Fixed an XSS vulnerability that can be passed in using the xiwindow parameter (CVE-2019-9167) (thanks Paolo Giai of Shielder) -JO
- Fixed SQL injection when using Fuse Key and certain parameters (CVE-2019-9165) (thanks Paolo Giai of Shielder) -JO
Security
- Updated ADODB library to version 5.20.14 to fix bugs and XSS security vulnerability -JO
Updated
- Updated Host and Service Status pages to hide dashlets by passing hidedashlets=1 in the URL -JO
- Updated Japanese translation files -JO
- Updated Graph Explorer fields to be searchable like other selectable dropdowns [TPS#13975] -SW,JO
Removed
- Removed technicians’ diagnostic tool from SNMP Trap Interface -SAW
Fixed
- Fixed CCM “Changes detected!” message now checks against each section, instead of specific config files [TPS#13970] -SAW
- Fixed issues with Capacity Planning backend in preparation for configuration wizard and plugin [TPS#13817] -SAW
- Fixed issue where parts of the SNMP Trap Interface would fail when using the XI 2014 theme [TPS#14024] -SAW
- Fixed Object Does Not Exist error on Service Details page when using + in the service description [TPS#14003] -JO
- Fixed services in Service Group which have the same beginning of a name on the same host not showing in config [TPS#14007] -JO
- Fixed Unconfigured Objects not properly parsing host status check results [TPS#14009] -JO
- Fixed Unconfigured Objects auto import host/service template selections not saving -SS
- Fixed issue where the flash message bar would be underneath the help icon when help system is enabled -JO
- Fixed URL links in PDF generated reports to properly use the external/internal URLs for links [TPS#14026] -JO
- Fixed issue where enterprise restrictions weren’t activated properly in the SNMP Trap Interface [TPS#14025] -SAW
- Fixed initial file permissions for auditlog.log when it is initially generated [TPS#14038] -JO
- Fixed MySQL nagiosql errors in cmdsubsys.log for regular users with limited CCM access [TPS#14045] -JO
Fixed
- Fixed issue with Event Log decoding HTML elements improperly -JO
- Fixed CCM imported service templates defaulting 0 for max_check_attempts, check_interval, retry_interval [TPS#13954] -JO
- Fixed descriptions and raw data can be removed when editing a trap definition in SNMP Trap Interface [TPS#13971] -SAW
- Fixed windows DOS line endings from user-inputted raw data in SNMP Trap Interface [TPS#13989] -SAW
- Fixed an issue where table records would not load correctly in the SNMP Trap Interface using PostgreSQL -SAW
- Fixed an issue in the SNMP Trap Interface where Trap Definitions could not be edited on systems using PostgreSQL [TPS#13968] -SAW
- Fixed exporting perfdata when in two-column mode only rendering half of the graph [TPS#13979] -JO
Security
- Fixed XSS security vulnerabilities in rss_dashlet -JO
- Fixed issue with nmap multiple IP addresses causing problems running because of security fix -JO,SS
Fixed
- Fixed tmp directory for exporting RRD performance data -JO
- Fixed UTF-8 characters in host/service names not allowing for external commands from the GUI to be processed [TPS#13833] -JO
- Fixed upgrading Config Wizards due to wizards with the same directory name [TPS#13857] -JO
- Fixed an issue where importing configuration from files/API would sometimes cause duplicate service definitions [TPS#13871] – SAW, JO
- Fixed Availability dashlet to work like a normal dashlet and lookback period is properly set based on the report it’s created from [TPS#13841] -JO
- Fixed lock file permissions for Core 4.2.4 (if users are using mod_gearman or had to downgrade to XI’s old version of Core) -JO
Component Updates
Core Config Manager (CCM) 2.7.4
- Added icon to relationship popup for host/services that are inactive [TPS#13852] -JO
- Fixed missing hosts/service from relationships popup when applied to groups that are set as inactive [TPS#13852] -JO
Security
- Fixed privilege escalation security vulnerability in MRTG graphing component by running as nagios user/group (thanks Daniel Sayk of Telekom Security) [TPS#13778] -JO
- Fixed security vulnerability with API key regeneration function allowing non-admins to regenerate other user’s API keys (thanks Chris Lyne of Tenable) [TPS#13780] -JO
- Fixed security vulnerability in BPI’s api_tool.php where the script could be accessed through the web server (thanks Chris Lyne of Tenable) [TPS#13780] -JO
- Fixed security vulnerability in command subsystem with some commands not being escaped properly (thanks Chris Lyne of Tenable) [TPS#13780] -JO
- Fixed security vulnerability in Auto Discovery component where some commands not being escaped properly (thanks Chris Lyne of Tenable) [TPS#13780] -JO
- Fixed XSS security vulnerabilities in the interface (thanks Chris Lyne of Tenable) [TPS#13780] -JO
Fixed
- Fixed old lock file location in snapshots by restoring lock file setting on snapshot restore [TPS#13795] -JO
- Fixed Notes and Actions URL button links URL encoding in Host/Service Status pages [TPS#13802] -JO
- Fixed Core issue (#572) causing service recovery emails to be sent when a initial notification wasn’t sent. [TPS#13805] -SW
- Fixed Core issue (#575) where soft recovery states did not apply for services -JO
- Fixed issue in API where hostgroup/servicegroup scheduled downtime would not schedule service downtimes [TPS#13818] -JO
- Fixed BPI service group sync to not add empty service groups that cause an error on the screen [TPS#13777] -JO
- Fixed BPI issue with the processing of subgroups applied to multiple groups failing to set proper status [TPS#13816] -JO
Component Updates
Core Config Manager (CCM) 2.7.3
- Fixed issue with free variable escaping on CCM importing configuration files [TPS#13794] -JO
Security
- Updated PHPMailer to version 5.2.26 for security/bug fixes -JO
Added
- Added documentation link to Deadpool Settings [TPS#11295] -SW
Fixed
- Fixed Capacity Planning report issues with UTF-8 characters in host/service names -JO
- Fixed auth/session checks in Capacity Planning API calls -JO
- Fixed inconsistency with Hostgroup/Servicegroup members being pulled from the API causing dashlet issues in Fusion [TPS#13650] -SW
- Fixed creating performance graph dashlet on host/service status pages causing page to scroll to top [TPS#13671] -JO
- Fixed service config for ndoutils causing issues sometimes with starting when lock/sock exist -JO,BO
- Fixed sorting of MIBS to be case in-sensitive [TPS#10281] -SW
- Fixed default NRDP token to be set in config file on first visit to Admin -> Inbound Transfers [TPS#12198] -SW
- Fixed Gauge Bug where gauge would not display of the value was just 0 [TPS#13757] -SW
- Fixed Capacity Planning PDFs to have warning/critical lines when set to display automatically [TPS#13772] -JO
Component Updates
Core Config Manager (CCM) 2.7.2
- Fixed not saving * selection for hostgroups and saving of negated hosts/hostgroups on services [TPS#13664] -JO
- Fixed slow loading of objects (hosts/services/etc) on large systems due to no limits on main SQL query [TPS#13692] -JO
- Fixed hosts and services menus go to the first page after a config is deleted or cloned [TPS#13766] -SW
Fixed
- Fixed adding new user creating a message that says current user should update their API key if they haven’t yet -JO
- Fixed login link on rapid response URL when a ticket does not exist or has expired -JO
- Fixed status check for NDO in BPI component API tool so that it properly sleeps after each call -JO
- Fixed audit log max age value undefined default to 180 instead of 30 and added to performance settings -JO
- Fixed an issue where notification settings would sometimes display incorrectly [TPS#13613] -SAW
- Fixed an issue where hosts/services with forward-slashes (“/”) in their names would not reconfigure correctly [TPS#13607] -SAW
- Fixed various PHP notices in error log -JO
- Fixed issue with SLA report links not going to external (or program url if external is empty) when PDF is generated [TPS#13619] -JO
- Fixed logging scheduled reporting pdf generation to wkhtmltox.log -JO
- Fixed issue with reports/pages missing data in PDFs [TPS#13628] -JO
- Fixed user permissions on non-active objects causing large/slow SQL queries on some systems -JO
Security
- Updated jQuery library to 3.3.1 due to security vulnerabilities with older jQuery versions [TPS#13541] -JO
- Fixed XSS in auto login admin management page (Thanks Nathan Jones) -JO
Updated
- Updated config.inc.php config value (set $cfg[‘old_browser_compat’] = 1;) to set jQuery to older version for IE 8 -JO
Fixed
- Fixed cron for deadpool using old script that was not available on new installs -SW
- Fixed misspelling in NXTI component when editing a defined trap [TPS#13558] -JO
- Fixed issue with Recurring Downtime wildcards not working [TPS#13562] -JO
- Fixed BPI output displayed when in problem state to not have HTML because output is too long [TPS#13552] -JO
- Fixed malformed combined availability reports [TPS#13573] -CN
- Fixed issue with configuraiton snapshot page permissions (Thanks Nathan Jones) -JO
- Fixed issue with Nagios Core notifications during downtime -SW
Fixed
- Fixed nom script that runs automated config backups to use full nagios config check instead of nagios init script -JO
- Fixed local backups not getting pruned [TPS#13474] -SW
- Fixed issue with deadpool cron job not being able to delete host/services due to script changes -JO
- Fixed SNMP Trap Interface issue with deleting defined traps on Postgres upgraded systems [TPS#13480] -JO
- Fixed SLA report to have show/hide details links in hostgroup/servicegroup SLA reports [TPS#13479] -JO
- Fixed SNMP Trap Interface issue where timestamps would sometimes show all zeroes [TPS#13508] – SAW
- Fixed Manage MIBs “Process All Traps” button to use the same MIB conversion rules as the “Add to SNMPTT” option – SAW
- Fixed SNMP Trap Interface issue where Show Test File Contents/Show Unknown Trap Log could freeze the browser – SAW
Fixed
- Fixed missing comments on hover for host/services on service detail page [TPS#13423] -JO
- Fixed Scheduled Downtime page scheduling using full name not username like other places in GUI [TPS#13426] -JO
- Fixed issue where scheduling some pages would cause PDF to have session timeout error [TPS#13427] -JO
- Fixed dashboard background not working and background color selector in some browsers not showing shading [TPS#13432] -JO
- Fixed performance graph title url link not working properly if service has url encoded name [TPS#13431] -JO
- Fixed recurring downtime not able to read the recurring downtime configuration from older systems [TPS#13440] -JO
- Fixed recurring downtime not properly scheduling services if host had any related downtimes [TPS#13441] -JO
- Fixed issue in Nagios Core where scheduled flexible downtimes would not trigger downtime start -JO
- Fixed bulk modifications tool to only shop the inheritance options when the configuration type allows them [TPS#13455] -JO
Updated
- Updated host and service details pages to show notes_url and actions_url links -JO
- Updated notes_url and actions_url in host and service status/details pages to support some basic macro expansion [TPS#13387] -JO
- Updated options in the BPI config settings to turn off automatic sync and object removal -JO
Fixed
- Fixed issue in Schedule Downtime page where services won’t show if user is not a contact on the host [TPS#13374] -JO
- Fixed missing fields in Audit Log for certain commands in cmdsubsys [TPS#13382] -JO
- Fixed issue with Trial Extensions not applying if they weren’t a certain length [TPS#13379] -JO
- Fixed auth token generation and login issue on upgraded PostgresQL systems -JO
- Fixed SSL errors causing broken PDF reports on some systems configured for SSL -JO
- Fixed issue where Nagios Core UI proxy would ask for authentication [TPS#13395] -JO
- Fixed fix check_interval and retry_interval bug in Core 4.4.1 (Core Patch) -SW,JO
- Fixed passive checks sending recovery email when host was previously UP (Core Patch) -SW
- Fixed check_http causing certificate checks to fail if location was forbidden or had an error after check (Plugin Patch) -SW
- Fixed metrics component to work with new NCPA wizard command names [TPS#13409] -JO
- Fixed scheduled backups so that the proper amount of backups are retained in FTP/SSH backups -JO
- Fixed tables for SNMP Trap Interface for upgraded systems -JO
- Fixed sync and auto removing to run in BPI to their own cmdsubsys command that also checks if NDO is loaded [TPS#13407] -JO
- Fixed display names on host and service status pages [TPS#13415] -SW,JO
Component Updates
Core Config Manager (CCM) 2.7.1
- Fixed permissions not updating properly when a non-admin user creates a host/service object [TPS#13397] -JO
Security
- Added session timeout and keepalive settings to security tab in Admin > System Settings section [TPS#9938] -JO
- Added insecure login security setting to allow old backend ticket-based auth on per-user basis -JO
- Fixed minor XSS vulnerabilities [TPS#13211,13213] -JO
Updated
- Updated backend for re-configure and apply configuration (reconfigure_nagios.sh) to no longer use wget [TPS#9908] -JO
- Updated backend helper and deletion scripts (ccm_delete_objects.php) to no longer use wget [TPS#9908] -JO
- Updated layout of profile.zip file and added timestamp to profile folder -JO
- Updated Nagios Plugins to version 2.2.1 [TPS#11685] -JO
- Updated NRPE to version 3.2.1 [TPS#11687] -JO
- Updated NRDP to version 1.5.2 -JO
- Updated NagVis version to 1.9.8 with auto-login Nagios modules -JO
- Updated host and service detail menu links to say status instead, in line with the actual page titles [TPS#12059] -JO
- Updated host and service SMS (text) message subject fields to be able to be blank [TPS#7099] -JO
- Updated nagiosxi database username field to allow for 255 character long usernames [TPS#11608] -JO
- Updated user passwords to a more secure algorithm/process [TPS#12158] -JO
- Updated wording for display host/service aliases (to accurately reflect that they display the display name) [TPS#7112] -BH
- Updated PDF and JPG report exports to use localhost/local url instead of internal url -JO
- Updated permissions for sudo-ran scripts in fullinstall and reset_config_perms.sh [TPS#12730] -JO
- Updated layout for Capacity Planning report to utilize the full screen size -JO
- Updated API objects backend to use json_encode() instead of xml2json for PHP version consistency which also removed “list” from API output -JO
Added
- Added mobile phone verification to be able to receive text message notifications (on upgrade, already entered numbers will be set to verified) [TPS#12042] -JO
- Added the host and service notes_url and action_url icons/links to the host/service status pages in XI [TPS#7893] -JO
- Added versions for Nagios Core, Nagios-Plugins, SSH Terminal, NRPE, NSCA, PNP, etc in profile [TPS#1456] -JO
- Added installed components, wizards, and dashlets version numbers in profile [TPS#1456] -JO
- Added ipcs command to profile [TPS#9108] -BH
- Added audit logging for CCM -> Write Config Files [TPS#7954] -BH
- Added ability to click username to edit user in Manage Users admin page [TPS#6186] -JO
- Added state filtering into state history report [TPS#5970] -JO
- Added removal of user’s scheduled reports from the apache cron tab when deleting a user [TPS#8239] -JO
- Added SSH key authentication as a scheduled backup SSH authentication method [TPS#4689] -JO
- Added encryption to the passwords that are stored from scheduled backups FTP and SSH auths [TPS#4689] -JO
- Added number of checkpoints held as an option in performance settings under “Snapshots” [TPS#8345] -JO
- Added new Manage Reports page to the Reports tab for admins to manage users scheduled reports [TPS#11609] -JO
- Added checkbox in user’s Account settings section under Notification Methods to have emails send as plain text only [TPS#10895] -JO
- Added two factor authentication for users by verifying the user received an email token [TPS#12189] -JO
- Added setting for two factor authentication to remember a user and browser to skip two factor auth [TPS#12189] -JO
- Added shellinabox as a replacement for Ajaxterm which has been removed for SSH Terminal enterprise feature [TPS#12202] -JO
- Added setting in system settings > password & accounts to not allow old passwords to be used again when changing passwords [TPS#12132] -JO
- Added allow SSL/HTTPS-only option on install [TPS#12073] -JO
- Added table sorting to the downtime scheduling page [TPS#9194] -JO
- Added auto configuration/import of unknown incoming passive checks if enabled in unconfigured objects page [TPS#2231] -JO
- Added ability to select week format (week starts on Sunday or Monday) [TPS#8082] -JO
- Added new datetimepicker to reports to easily be able to select times including hours, mins, and seconds [TPS#12048] -JO
- Added commands (core), scheduleddowntime, auth servers into system API backend -JO
- Added raw import, commands, into config API backend -JO
- Added auth tokens for single-use login and ability to authenticate to an API endpoint -JO
- Added automatic BPI sync (and remove missing hosts/service) on Apply Configuration in the CCM [TPS#6127] -JO
- Added ability to activate product from inside the GUI without having to manually get activation code -JO
- Added setting in system settings to disable renewal reminders for non-admin users -JO
- Added a help document with instructions for updating and creating translations [TPS#12830] -JO
- Added links to the host/service details pages for hostgroups and servicegroups [TPS#12055] -JO
Fixed
- Fixed issue with host and service template filter search box in bulk modification tool [TPS#13163] -JO
- Fixed links in notification report when host or service has an alias defined [TPS#13251] -JO
Component Updates
Core Config Manager (CCM) 2.7.0
- Added CCM limited and full access via session for regular users (CCM ‘limited’ user) [TPS#13227] -JO
- Added contact alias next to contact name in contact overlay when an alias exists [TPS#10049] -JO
- Added services applied to hostgroups to the host services list on service groups [TPS#13158] -JO
- Updated copying a service change the service name and not the config name [TPS#12270] -JO
- Updated writing configs to no longer rely on pear library HTML_Template_IT [TPS#12386] -JO
- Updated importing config search to be case-insensitive -JO
- Fixed importing services with multiple objects finding the proper config name [TPS#13303] -JO
Security
- Fixed XSS vulnerability in views page -JO
- Fixed RCE vulnerability in component download page (Thanks Bjoern Brixner at Telekom Security) -TM
- Fixed vulnerability in NagiosQL (Thanks @iotennui, @BennyHusted, @0xC413 on twitter) [CVE-2018-8733,CVE-2018-8734,CVE-2018-8735,CVE-2018-8736] -JO,TM
Added
- Added notification alteration callbacks -JO
- Added notification template callbacks, updated documentation -BH
Fixed
- Fixed NPCD not showing as running in systemctl on EL7 systems even though it is running [TPS#12924] -JO
- Fixed command subsystem to only try to package and download components/dashlets/configwizards that exist -JO
- Fixed enterprise only banner for sending single report emails [TPS#13025] -JO
- Fixed permalink URL generation to use the proper location when sending xiwindow url [TPS#13036] -JO
- Fixed scheduled report subject field to not append generic text when subject is set [TPS#13062] -JO
- Fixed deadpool not running properly on it’s cron [TPS#13075] -SW
- Fixed BPI calculation to use round() properly so groups > 1000 objects shows proper statuses [TPS#13078] -JO
- Fixed dashboards disappearing with non-UTF8 names/titles (can use config.inc.php option $cfg[‘db_conn_utf8’] = 0; in some cases) [TPS#13051] -JO
Component Updates
Core Config Manager (CCM) 2.6.11
- Fixed u option in service dependencies for execution_failure_criteria & notification_failure_criteria to reak Unknown instead of Unreachable -SW
- Fixed hostgroup excludes on service management page [TPS#12952] -JO
- Fixed CCM importing config name value in service definitions -JO
Security
- Fixed double percents (%%) in performance graph legends [TPS#12701] -JO
Fixed
- Fixed url encoding in outbound NRDP checks [TPS#12742] -SAW
- Fixed MRTG cron job arguments for lock file for EL7 in rpms [TPS#12865] -JO
- Fixed flexible downtime duration setting in scheduled downtime page [TPS#12890] -JO
- Fixed downtime duration column to show proper duration for fixed and fledible in scheduled downtime page [TPS#12890] -JO
- Fixed install script not recognizing IP address on llipv6-only machines [TPS#8588] – SAW
- Fixed upgrade from GUI where upgrade textarea would stop updating even though upgrade finishes [TPS#12571] -JO
- Fixed htmlentities in SLA report breaking UTF-8 characters [TPS#12905] -JO
Fixed
- Fixed ampersand encoding in URLs on the views page [TPS#12526] -JO
- Fixed perfdata graphs legend data units of measurement when first unit has none specified [TPS#12504] -JO
- Fixed the acknowledgment/handled state icon in BPI -JO
- Fixed issue where some groups would not get proper status checks (due to recursion) in BPI [TPS#12488] -JO
- Fixed issue with utf8 character encoding with MySQL connections in Bulk Renaming Tool and elsewhere [TPS#12537] -JO
- Fixed time stamp in eventqueue [TPS#12597] -SAW
- Fixed issue with graph explorer dashify not checking NSP [TPS#12562] -SAW
- Fixed Recurring Scheduled Downtime service descriptions with * in them not showing up in list [TPS#12616] -JO
- Fixed alert histogram link in Nagios Core UI from host/service advanced section [TPS#12655] -JO
- Fixed issue where XML for BPI was being read from cache only on API calls -JO,CN
- Fixed issue where manually running a check command would display the value of potentially sensitive user macros [TPS#12673] -CN
Component Updates
Core Config Manager (CCM) 2.6.10
- Fixed flap detection options values not showing properly in the CCM as selected [TPS#12654] -JO
Fixed
- Fixed recurring downtime services tab for users to correctly show downtimes they have created if they have service perms [TPS#12434] -JO
- Fixed LDAP multiple naming contexts if context has no dc= in the name [TPS#12435] -JO
- Fixed issue with IPv6 addresses not redirecting properly [TPS#12461] -JO
Component Updates
Core Config Manager (CCM) 2.6.9
- Fixed new MySQLi database connection charset to be UTF8 [TPS#12441] -JO
Security
- Fixed XSS security vulnerabilities (Thanks Björn Brixner at Telekom Security, Sobolev Eugene, itpsl.org, H_D, PenGenKiddy, and RO421) [TPS#12285,TPS#12374] -JO
Updated
- Updated Japanese language translations (thanks Suzuki) -JO
Fixed
- Fixed language settings for user not showing up as translated -JO,SB
- Fixed schedule downtime (and others) requirement check to trim data before doing field required checks [TPS#12303] -JO
- Fixed some pages admin-only permissions -JO
- Fixed AD/LDAP import when password complexity requirements are enabled [TPS#12334] -JO
- Fixed unconfigured objects for host-only results [TPS#12361] -JO
- Fixed installation on systems with non-standard CentOS/RHEL suoders file by trying to fix issues if possible [TPS#12380] -JO
Security
- Fixed XSS security vulnerability (thanks Olvieira Lima) -JO
Fixed
- Fixed inconsistency with different object types in the API help examples for configs [TPS#12162] -JO
- Fixed perfdata graph links for services with spaces in them [TPS#12170] -JO
- Fixed host comment and acknowledgment icons not linking to the details page like the service ones [TPS#12184] -JO
- Fixed some text inconsistencies in the bulk modifications tool [TPS#12172] -JO
- Fixed auto-login button on main page not doing an auto login [TPS#12203] -JO
- Fixed issue with SLA dashlet/report where certain custom time frames wouldn’t show up properly [TSP#12248] -JO
Component Updates
Core Config Manager (CCM) 2.6.8
- Fixed issue when cloning timeperiods that have a ‘name’ value set (templates) [TPS#12159] -JO
- Fixed the free variable number to update after closing the free variable box [TPS#12176] -JO
- Fixed issue with importing host and service names with + in them [TPS#12161] -JO
Security
- Fixed various minor security issues [TPS#12112,12113,12117,12120] -JO
Updated
- Updated encrypted files to work with PHP 7.0.x and 7.1.x -JO,SW
Fixed
- Fixed issue with SLA report SLA Target value being set to an int [TPS#12079] -JO
- Fixed issue in secured rapid response where URL was not passing proper parameters when users are redirected after login [TPS#12098] -JO
- Fixed popup view of recent snapshots view action on the CCM splash page [TPS#12083] -JO
- Fixed executive summary PDF and JPG download option not working [TPS#12105] -SS,JO
- Fixed PDF generation missing some fonts on EL7 full installs [TPS#12104] -JO
- Fixed get_xml_comments() in host and service ajax helpers to limit comment query down to only the objects that are visible [TPS#12064] -JO
Full changelog as Markdown
