Graphite Dashboard

I have spent about 12 hours over the past two workdays building a graphite system based on CentOS 5.7. It took a long time because most of the default system packages had to be replaced for compatibility reasons, but that is understandable given the array of functionality involved. I finally was very happy with how I had it set up and I started poking around in the UI to take a look at the options. One of them was a Dashboard dropdown with a "Configure UI" option. When I toggled the "Navigation Bar" setting behind that option, my whole graphite install became unusable. When I log into the dashboard the page displays only the text "Drop To Merge" and nothing else. I can't undo the change because the page that stopped working was the page where I could make the change. I also had just told the intended users of the system that it was finally ready to go, so this is pretty frustrating. Also, I found someone else's random graphite dashboard online. I haven't tried changing the setting on that to see if this is really a reproducible bug, but if it is then this might qualify as a security issue since it would allow arbitrary internet users to break anyone's graphite system. Please feel free to downgrade this to "Not a security vulnerability" if I am wrong. Here is the list of sources I used to perform my install: apr-1.4.6 apr-util-1.5.1 cairo-1.10.2 carbon-0.9.10 db-5.3.21 Django-1.4.3 django-tagging-0.3.1 graphite-web-0.9.10 httpd-2.2.23 libevent-2.0.21-stable memcached-1.4.15 mod_wsgi-3.4 mysql-5.5.29 MySQL-python-1.2.4b4 openldap-2.4.33 pip-1.2.1 pixman-0.22.2 py2cairo-1.10.0 Python-2.7 python-ldap-2.4.10 python-memcached-1.48 python-txamqp-0.3 setuptools-0.6c11 Twisted-12.3.0 unixODBC-2.3.1 whisper-0.9.10 zope.interface-3.6.7 The page source of the "Drop To Merge" dashboard is: Graphite Dashboard

Drop To Merge

When	Who	Action	New State
2013-01-07	Nate Campbell	Comment	Open
2013-01-07	rowan	Answer	Answered
2013-01-07	Nate Campbell	Comment	Answered

Graphite

History of question #218547