From 8c5a57d4b73ad3ac74fd2ae3120c15d8fe0d03f9 Mon Sep 17 00:00:00 2001
From: Lukas Lengler <lukas.lengler@checkmk.com>
Date: Thu, 9 Jul 2026 17:50:10 +0200
Subject: [PATCH] FIX: Restore map editing for non-admin roles

The editHtml permission check (CVE-2024-47090) was applied to every map
modification, blocking roles like Managers from editing maps at all.
Scope it to changes of HTML fields (textbox text), and keep the current
value as a hidden field so objects can still be saved/moved unchanged.

Fixes #452
---
 changelog.d/fix-edithtml-map-editing.md        |  1 +
 share/server/core/classes/ViewMapAddModify.php | 17 ++++++++++++++++-
 share/server/core/functions/html.php           |  5 ++++-
 3 files changed, 21 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/fix-edithtml-map-editing.md

diff --git a/changelog.d/fix-edithtml-map-editing.md b/changelog.d/fix-edithtml-map-editing.md
new file mode 100644
index 000000000..827986f89
--- /dev/null
+++ b/changelog.d/fix-edithtml-map-editing.md
@@ -0,0 +1 @@
+FIX: Non-admin roles (e.g. Managers) can edit maps again - the editHtml permission is now only required to change HTML content, not for every map modification (#452)
diff --git a/share/server/core/classes/ViewMapAddModify.php b/share/server/core/classes/ViewMapAddModify.php
index 47cf220a7..928ee556b 100644
--- a/share/server/core/classes/ViewMapAddModify.php
+++ b/share/server/core/classes/ViewMapAddModify.php
@@ -160,9 +160,24 @@ private function handleAddModify()
         $perm_user = get_checkbox('perm_user');
         $show_dialog = false;
 
+        // Only block when an HTML field (e.g. textbox "text") is actually
+        // changed, so regular map editing works without editHtml (CVE-2024-47090).
         global $AUTHORISATION;
         if (!$AUTHORISATION->isPermitted('Map', 'editHtml', '*')) {
-            throw new NagVisException(l('Cannot edit HTML. Please contact your administrator'));
+            $attrDefs = $this->MAPCFG->getValidObjectType($this->object_type);
+            foreach ($this->attrs as $key => $val) {
+                if (!isset($attrDefs[$key]['field_type']) || $attrDefs[$key]['field_type'] !== 'textarea') {
+                    continue;
+                }
+
+                $current = ($this->object_id !== null && $this->MAPCFG->objExists($this->object_id))
+                    ? $this->MAPCFG->getValue($this->object_id, $key, true)
+                    : null;
+
+                if ($val !== $current) {
+                    throw new NagVisException(l('Cannot edit HTML. Please contact your administrator'));
+                }
+            }
         }
 
         // Modification/Creation?
diff --git a/share/server/core/functions/html.php b/share/server/core/functions/html.php
index 38998f5b8..29e2a95ae 100644
--- a/share/server/core/functions/html.php
+++ b/share/server/core/functions/html.php
@@ -431,7 +431,10 @@ function textarea($name, $default = '', $class = '', $style = '')
 
     global $AUTHORISATION;
     if (!$AUTHORISATION->isPermitted('Map', 'editHtml', '*')) {
-        echo '<b>Cannot edit HTML. Please contact your administrator.</b>';
+        // No editHtml permission (CVE-2024-47090): hide the editor but keep the
+        // current value so the object can still be saved/moved unchanged.
+        hidden($name, $default);
+        echo '<b>' . l('Cannot edit HTML. Please contact your administrator') . '</b>';
         return;
     }
     // plain <textarea>