Broken links in the View Trends and the View Histogram menu

[Tim Lourey]

[Impact]
The links for the following are broken in the Service Information or the Host Information menus for the following links:

View Trends For This Service
View Alert Histogram For This Service
View Trends For This Host
View Alert Histogram For This Host

[Test Plan]
See deployment steps in comment #15.
Just access those links in: Current status / Hosts and Current status / Services and choosing a host or a service
Test all other links following the menu/pages for no broken links / regressions.

[Where problems could occur]
The URLs for all cgi scripts are modified. I tested extensively but there may be some section of the web UI that might get affected by this change. Also installed nagios from source and the URLs are the same as the ones in this package after the change so if something breaks it's probable that it is also broken upstream.

[Other Info]
The patch consists in changing the with-cgiurl to /nagios4/cgi-bin as, per limitations on the Nagios code, the html files (on /nagios4) should be one folder level below cgi-bin. This is because sometimes Nagios tries to reach html files as ../file.html while the base url is pointing to the cgi-bin folder.
This new value is in fact very close to the upstream default for this parameter which is /nagios/cgi-bin (while the default for html files is /nagios). Thus, installations from upstream source are not affected as long as these are not modified. The bug occurs because this default value is changed in the deb packaging.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Stefan Hattrell (stefan-hattrell)]

Is there any chance this will get addressed?

[Jorge Merlino (jorge-merlino)]

Patch for Noble, Mantic and Jammy

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "lp1953572_jammy_noble.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Jorge Merlino (jorge-merlino)]

Patch for focal

[Jorge Merlino (jorge-merlino)]

Update patch for Noble, Mantic and Jammy

[Heitor Alves de Siqueira (halves)]

Thanks for the debdiff, Jorge! A few comments:

Even though the fix is the same for J/M/N, we'll need separate debdiffs and versions for each. We'll need to keep the upgrade path working between each release, so I'd suggest something like below (according to [0]):
- 4.4.6-4ubuntu0.22.04.1 for Jammy
- 4.4.6-4ubuntu0.23.10.1 for Mantic
- 4.4.6-4ubuntu0.24.04.1 or 4.4.6-4ubuntu1 for Noble (depending on whether O will need fixing as well)

And it's great that you ran the update-maintainer script as well. Would you be able to add a mention of this in the changelog entries, too?

Finally, I'd really appreciate it if we had any mention of the fix on the SRU template. Maybe a short section explaining why we're changing the --with-cgiurl flag, and where that fix came from?

[0] https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Update_the_packaging

[Jorge Merlino (jorge-merlino)]

New patch for focal

[Jorge Merlino (jorge-merlino)]

New patch for jammy

[Jorge Merlino (jorge-merlino)]

New patch for mantic

[Jorge Merlino (jorge-merlino)]

New patch for noble

[Jorge Merlino (jorge-merlino)]

patch for Oracular

[Mauricio Faria de Oliveira (mfo)]

Hi Jorge,

Thanks for your work on the analysis and SRU bug template!

I checked this per your request, and we talked about it today.
So, just some notes for documentation purposes and next steps.

The proposed changed to `--with-cgiurl=` just works around the
issue, that is the links are broken due to hard-coded relative
paths, when accessed from different paths, as you mentioned in
'Other Info'.

Other than that, this might be problematic in stable releases,
as users may use the existing URLs in bookmarks and automation
(even if unlikely), that would break if the cgi-bin URL change.

The actual solution to the problem (and the minimal chage from
an SRU perspective) is identifying how to write the links that
always land in the HTML root.

Fortunately, this seems to be simple: change to absolute paths.

I have tested that on our Oracular package and Upstream, which
seems to work, and submitted a PR upstream. If that is approved,
we can go with that, instead:

https://github.com/NagiosEnterprises/nagioscore/pull/969

Let's see how it goes. Marking bug tasks as 'Incomplete' for now.

[Mauricio Faria de Oliveira (mfo)]

Test Steps:
---

lxc launch ubuntu-daily:oracular nagios4-oracular
lxc exec nagios4-oracular -- su - ubuntu

sudo apt update
sudo apt install nagios4 apache2 --yes --no-install-recommends

sudo a2dismod mpm_event
sudo a2dismod mpm_worker
sudo a2enmod mpm_prefork
sudo a2enmod php8.3

sudo a2enmod cgi
sudo a2enmod cgid
sudo a2enconf serve-cgi-bin

sudo a2enmod auth_digest # for AuthDigestDomain in nagios4-cgi.conf
sudo a2enmod authz_groupfile # for AuthGroupFile in nagios4-cgi.conf

sudo a2enconf nagios4-cgi

sudo systemctl restart apache2

<LXD>$ ip -4 a l type veth | grep inet
    inet 10.191.59.205/24 metric 100 brd 10.191.59.255 scope global dynamic eth0

<HOST>$ $BROWSER http://10.191.59.205/nagios4/

1) Menu > Current Status > Hosts
2) Click 'localhost' under 'Host'
3) Click 'View Trends For This Host' or 'View Alert Histogram For This Host'
4) Check 'Not Found / The requested URL was not found on this server.' page
   (or is it found?)

1) Menu > Current Status > Services
2) Click 'Current Load' under 'Service' for 'localhost'
3) Click 'View Trends For This Service' and 'View Alert Histogram For This Service'
4) Check 'Not Found / The requested URL was not found on this server.' page
   (or is it found?)