Username/Password for zabbix credentials available for everyone who can see dashboard

• [ x] Bug report

For bug report please include this information:

• What Grafana version are you using? 4.2.0
• What Zabbix version are you using? 2.4
• What zabbix plugin version are you using? 3.3.0
• What OS are you running grafana on? Debian 4.6-6 (2016-07-26)
• What did you do? When I open any zabbix dashboard I see ajax requests with zabbix user & password inside: https://host/api/datasources/proxy/23 {jsonrpc: "2.0", method: "user.login", params: {user: "XXX", password: "XXXXXXXXX"}, id: 1}
• What was the expected result? User & password allready stored in datasource. There is no reason show it to any user viewing dashboard.
• What happened instead? Every user can see zabbix user/password if has access to view dashboard

[alexanderzobnin]

@eertul I can suggest a temporary solution for this. My idea is to use small and simple proxy running on grafana or zabbix server which will handle API requests. Proxy should parse request params and if method is user.login, it should replace username and password by values stored in its config. Datasource in grafana can use any fake credentials. Since user authorized, proxy will store auth token and add it into every request. Please, let me know if you are interested in this. I can write and share this proxy. In the future, it should be included in the backend part of plugin.

[tammytankian]

hello @alexanderzobnin, any news about this issue?

This is dangerous! this client reported the error to us, but I don’t know how many times this happened and was not reported (with our clients, and with other users). 😕