[dev.icinga.com #6690] Support filter expressions for searching

[icinga-migration]

This issue has been migrated from Redmine: https://dev.icinga.com/issues/6690

Created by jmeyer on 2014-07-10 12:06:03 +00:00

Assignee: (none)
Status: New
Target Version: (none)
Last Update: 2015-11-09 10:18:18 +00:00 (in Redmine)

---

Attachments

• filtererroraftersearching.jpg jmeyer - 2014-07-10 12:05:08 +00:00

---

Parent Task: #9479

Relations:

• duplicates #6690

[icinga-migration]

Updated by elippmann on 2014-07-15 08:28:52 +00:00

• Category set to Framework
• Priority changed from Normal to Urgent

[icinga-migration]

Updated by tgelf on 2014-07-31 16:51:55 +00:00

• Status changed from New to Assigned
• Assigned to set to tgelf
• Priority changed from Urgent to Normal

No, it isn't. What happens here is that the search is treated as a filter expression. This is wrong, but not dangerous. In your example it treats the string on the right side of the pipe as a boolean column named " *". It checks whether the DataView has such and complains as it doesn't. Searching for ping|host=net would lead to success - but is still not exploitable in any way.

I'll fix this.

Best,
Thomas

[icinga-migration]

Updated by tgelf on 2014-07-31 17:01:58 +00:00

While thinking about it instead of "fixing it" we could consider this a feature. Who uses |, &, =, >, ( etc wants to type a filter expression, doesn't he? So why not allowing one to do so? If such operator is found, no *-magic should happen to get filters working as expected.

[icinga-migration]

Updated by elippmann on 2015-03-31 08:23:34 +00:00

• Tracker changed from Bug to Feature
• Subject changed from Non sanitized input used for database queries to Support filter expressions for searching
• Description updated
• Status changed from Assigned to New
• Assigned to deleted tgelf
• Target Version set to 2.0.0-rc1

[icinga-migration]

Updated by jmeyer on 2015-06-11 07:50:54 +00:00

• Target Version changed from 2.0.0-rc1 to 261

[icinga-migration]

Updated by elippmann on 2015-07-17 09:48:01 +00:00

• Target Version changed from 261 to 2.0.0

[icinga-migration]

Updated by elippmann on 2015-08-31 09:12:20 +00:00

• Target Version changed from 2.0.0 to 273

[icinga-migration]

Updated by elippmann on 2015-11-09 10:18:18 +00:00

• Target Version deleted 273
• Parent Id set to 9479

[icinga-migration]

Updated by jmeyer on 2016-11-03 10:14:24 +00:00

• Duplicated set to 10801

[RincewindsHat]

@nilmerg this looks fixed or at least changed? :-)

[nilmerg]

Not that I'm aware of. Note that this is about the global search.