<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>Hi,</p>
<p><br>
</p>
<p>Im using xymon to monitoring my clients servers.</p>
<p><br>
</p>
<p>The clients access the xymon on the URL like above:</p>
<p><br>
</p>
<p><a href="http://host.com/client1" id="LPlnk648823">http://host.com/client1</a></p>
<br>
<p><a href="http://host.com/client1" id="LPlnk435884">http://host.com/client</a>2<br>
<br>
</p>
<p><a href="http://host.com/client1" id="LPlnk427262">http://host.com/client</a>3<br>
<br>
</p>
<p><br>
</p>
<p>Every client has his own directory for all servers.</p>
<p>When the client access the directory client1 for example, i use a .htpasswd to authenticate the user. The user only has access to his directory</p>
<p>I notice that there is a security problem for a specific item link like above:</p>
<p><a href="http://host.com/cgi/svcstatus.sh?HOST=server1.client1.com&SERVICE=files" id="LPlnk833989" title="http://host.com/cgi/svcstatus.sh?HOST=server1.client1.com&SERVICE=files
Ctrl+Clique ou toque para seguir o link">http://host.com/cgi/svcstatus.sh?HOST=server1.client1.com&SERVICE=files</a><br>
<br>
</p>
<p>If im logged with user client1 i can see the item correctly, but if i manually change the url for another client, like somenting:</p>
<p><a href="http://host.com/cgi/svcstatus.sh?HOST=server2.client2.com&SERVICE=files" id="LPlnk17063">http://host.com/cgi/svcstatus.sh?HOST=server2.client2.com&SERVICE=files</a><br>
<br>
</p>
<p>I can see the content of another client.</p>
<p><br>
</p>
<p>There is a way to restrict or block the access from users that dont have permission?</p>
<p><br>
</p>
<p>Att</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<div id="Signature">
<div name="divtagdefaultwrapper" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:; margin:0">
<img style="-webkit-user-select: none;" src="http://www.redix.com.br/email/2014/assinaturadigital2014_bruno.jpg"></div>
</div>
</div>
</body>
</html>