Skins for winbox too?!?

russman · Tue Apr 18, 2023 7:31 pm

https://help.mikrotik.com/docs/display/ ... Dyour_skin

To use skins you have to assign skin to the group. When that is done users of that group will automatically use the selected skin as their default when logging into WebFig or Winbox.

This would be amazing but doesn't appear to be true. Is this on the roadmap to allow skins created to apply to both the web interface and winbox? I have industrial clients that are electricians using mikrotik as a cheaper more feature rich option to what they were using, however, I'd love to trim back the interface to just what they need while still allowing them to use winbox for discovery, MAC access, and improved GUI that has easy use copy rule functions.

BrianHiggins · Tue Apr 18, 2023 9:18 pm

it does work in v7, though I haven't tested enough to actually allow anyone to actually access winbox with a skin as the function/security limiting function (though I do with webfig). It's on my product roadmap to test for later this year.

russman · Tue Apr 18, 2023 10:09 pm

it does work in v7, though I haven't tested enough to actually allow anyone to actually access winbox with a skin as the function/security limiting function (though I do with webfig). It's on my product roadmap to test for later this year.

You haven't tested it, but I have on 7.8, it doesn't work. The same account logging into web GUI worked great but logging into winbox everything is there.

BrianHiggins · Tue Apr 18, 2023 10:21 pm

it does work in v7, though I haven't tested enough to actually allow anyone to actually access winbox with a skin as the function/security limiting function (though I do with webfig). It's on my product roadmap to test for later this year.
You haven't tested it, but I have on 7.8, it doesn't work. The same account logging into web GUI worked great but logging into winbox everything is there.

I actually did just 20 minutes before writing that have a v7.7 skin apply to my login... You are correct that I have not tested v7.8, but it does work on v7.7. If it's not working for you I'd say check webfig and see if the skin works there or not. You might be trying to apply a broken skin, I've seen them be very temperamental when editing / making the skins where they get corrupted sometimes.

russman · Wed Apr 19, 2023 4:33 pm

...The same account logging into web GUI worked great but logging into winbox everything is there.

I can delete and recreate and see what happens.

BrianHiggins · Wed Apr 19, 2023 9:03 pm

FYI, I forgot that if you're loading the skin via branding maker, there's a bug where it writes the skin as a hidden file and can't be seen/accessed, so from my testing you need to also load it as a custom file in branding maker, which allows it to work for webfib, but not winbox. Winbox requires the skin visible in the skins folder, which cannot be achieved entirely through branding maker at the moment.

i.e. branding maker & skins are a bit of a cluster right now. I've submitted support info but was told they couldn't reproduce any problems and that it was all me, despite them clearly NOT reproducing the steps I provided them.

If you can reproduce the issue, please submit a ticket as well and note this thread, hopefully they'll fix it.

But if you get it all correct, it does work.

winbox skin.JPG

edited to add picture I forgot.

russman · Wed Apr 19, 2023 11:59 pm

I'm not currently using branding on this. Its just broken, going to delete the skin and try again.

rextended · Thu Apr 20, 2023 12:01 am

It is not enough to create a skin (with the supported version of RouterOS and WinBox),
it must also be set on the Users / Groups of the system, to be used.

russman · Thu Apr 20, 2023 4:08 am

It is not enough to create a skin (with the supported version of RouterOS and WinBox),
it must also be set on the Users / Groups of the system, to be used.

Come on man, I linked the reference article on setting it up which includes that info and provided twice in short order that "The same account logging into web GUI worked great but logging into winbox everything is there.". This implies I applied the skin to the group/user as instructed and it works in the web GUI but not in winbox... I'll include a picture, people like pictures.

russman · Thu Apr 20, 2023 4:19 am

ROS 7.8 and 7.9rc3 tested, winbox ver 3.37 in both 64 and 32 bit tested.

russman · Thu Apr 20, 2023 4:23 am

It is not enough to create a skin (with the supported version of RouterOS and WinBox),
it must also be set on the Users / Groups of the system, to be used.

Besides I think you meant:

Thu Apr 20, 2023 7:01 pm

some days ago i tried Winbox Skin on a remote device and not worked, but reading this topic i tested on local device using 7.6 and worked OK, if i find why does not worked in my remote device i will post it

russman · Thu Apr 20, 2023 7:32 pm

some days ago i tried Winbox Skin on a remote device and not worked, but reading this topic i tested on local device using 7.6 and worked OK, if i find why does not worked in my remote device i will post it

The reoccurring theme I'm hearing and seeing is it worked in pre-7.8.

russman · Thu Apr 20, 2023 8:51 pm

So I just deleted the skin, downgraded to 7.6, recreated a more basic skin, and applied it to an account. It worked for trimming out options in web, it still doesn't for winbox.

Fri Apr 21, 2023 2:51 pm

Good morning

Winbox has skins for a long time already.
There is no known bug, just do as above meme suggests and apply it to a group.

russman · Fri Apr 21, 2023 4:08 pm

Good morning
Winbox has skins for a long time already.
There is no known bug, just do as above meme suggests and apply it to a group.

Correct, as I've said 3+ times in this thread I did that, even provided pictures and its not working.

Fri Apr 21, 2023 4:10 pm

MAC connection. Try IP. MAC is only for emergency access.

russman · Fri Apr 21, 2023 7:46 pm

MAC connection. Try IP. MAC is only for emergency access.

I did both in testing on 7.8 because I was curious if it made a difference, same result. I didn't test both MAC and IP on ver. 7.6 though.

RiFF · Mon Apr 24, 2023 7:54 pm

@normis I also confirm this issue. I checked it on CHR and wAP R. Custom skin works only on WebFig, Winbox shows all tabs (downgrade from 7.8 to 7.7 - 7.6 nothing changes)

russman · Mon Apr 24, 2023 11:24 pm

@normis I also confirm this issue. I checked it on CHR and wAP R. Custom skin works only on WebFig, Winbox shows all tabs (downgrade from 7.8 to 7.7 - 7.6 nothing changes)

Tested on a fresh box again today, out of the box I upgraded to 7.8 OS and RB firmware, factory defaulted, loaded a config file and skin, setup a new group and associated the skin file, created a new user under that group. Then I logged in for the first time with that user on winbox and everything is there, login on web and only what I want is there.

russman · Mon Apr 24, 2023 11:31 pm

@normis It looks like we have 3 people in this thread that have confirmed its no longer working so far.

rextended · Mon Apr 24, 2023 11:40 pm

Work on IP, work by RoMON, (work by WebFig), but not tested directly by MAC...................
None of you provide any relevant detail, like root structure, where the file is placed and how is named, and file content, and related group configuration

one_image_to_rule_them_all.png

BrianHiggins · Tue Apr 25, 2023 12:18 am

I'm not currently using branding on this. Its just broken, going to delete the skin and try again.

I've seen on v7 loading a skin doesn't always make it available to select until after you reboot the router, worth a shot if you haven't tried a simple reboot yet, can't hurt.

rextended · Tue Apr 25, 2023 12:30 am

(on my example I do not reboot, I just put the file in the right folder, and obviously close and reopen winbox)

russman · Tue Apr 25, 2023 12:57 am

Work on IP, work by RoMON, (work by WebFig), but not tested directly by MAC...................
None of you provide any relevant detail, like root structure, where the file is placed and how is named, and file content, and related group configuration

one_image_to_rule_them_all.png

Call me crazy but I would think its a very relevant detail indicating that the skin file is in the right folder and named in such a way that is compatible if it works when logging into web but not in winbox. Do you know some secret sauce or are in possession of a magic decoder ring needed to unlock skin winbox functionality? So far I have named the skin and the group electricians, also used QuickCFG. Tried too many options/variations/simple to complex skins/etc to list them all but none of it worked. MAC vs IP connecting has been discussed too, Connecting from a fresh PC after downloading the latest winbox in both 32/64bit, rebooting configured router, closing all winbox trying again, etc. none of it made a difference. For your review though.

rextended · Tue Apr 25, 2023 1:45 am

Did you really disable everything???

skin code

{
    "Quick Set": 0,
    "Terminal": 0,
    "CAPsMAN": 0,
    "Wireless": 0,
    "Interfaces": 0,
    "WireGuard": 0,
    "PPP": 0,
    "Bridge": 0,
    "Switch": 0,
    "Mesh": 0,
[…]
    "Make Supout.rif": 0,
    "Undo": 0,
    "Redo": 0,
    "Hide Passwords": 0,
    "Safe Mode": 0,
    "WinBox": 0,
    "Graphs": 0,
    "License": 0
}

Are you trying to hack someone by disabling everything if they try the skin?

Why do you have double quotes " instead of single quotes ' ? (yeah, that's not exactly "quotes"...)
Did you edit the file by hand?

The file must have ' and is produced by skin design with ', why do you have " ???
Don't use json editor to edit the file.

one_detail_to_rule_them_all.png

russman · Tue Apr 25, 2023 5:29 am

Did you really disable everything???
skin code
{
    "Quick Set": 0,
    "Terminal": 0,
    "CAPsMAN": 0,
    "Wireless": 0,
    "Interfaces": 0,
    "WireGuard": 0,
    "PPP": 0,
    "Bridge": 0,
    "Switch": 0,
    "Mesh": 0,
[…]
    "Make Supout.rif": 0,
    "Undo": 0,
    "Redo": 0,
    "Hide Passwords": 0,
    "Safe Mode": 0,
    "WinBox": 0,
    "Graphs": 0,
    "License": 0
}
Are you trying to hack someone by disabling everything if they try the skin?

Why do you have double quotes " instead of single quotes ' ? (yeah, that's not exactly "quotes"...)
Did you edit the file by hand?

The file must have ' and is produced by skin design with ', why do you have " ???
Don't use json editor to edit the file.

one_detail_to_rule_them_all.png

You're making a lot of big assumptions here. I'm sure you didn't read the application information I've been providing, trying to keep it as simple as possible for some industrial electrician's that don't really know what a subnet or gateway does. I'm giving them instructions with lots of screen shots

All of the "editing" was done in webfig skin designer or whatever, not that its very technical, but that's all mikrotik generated. In the testing I was doing I also tried just disabling one top level menu item to see if it was some issue with the complexity of it when I disabled lots of stuff including submenu items, it didn't work with just one top level item disabled ether. Are you finding in something you have working that winbox works with .json's that use single quotes or whatever? If I don't hear back I'll manually edit the file to be done like that and try it out, I don't care if that breaks the skin in web because I'm disabling that anyway.

Update: Changing all the " to ' didn't fix it for winbox... had me excited for a moment. I rebooted the router and closed out of winbox and reopened, interesting enough the web skin still worked with its syntax file edited from what it produced to what you suggested.

rextended · Tue Apr 25, 2023 11:08 am

On your image: Feb/17/2016... 2016???
Try to netinstall 7.7+ and see if the problem is the old FS structure.

Amm0 · Tue Apr 25, 2023 4:07 pm

I don't think you ever want to use the double-quoted style. I recall winbox not liking double-quoted string sometimes (maybe always, cannot recall). Even if webfig accepts.

My need was to programmatically modify the skin file, so I can assure you regular JSON will give you trouble. One tip here is the JSON5 parser seems to deal with parsing normal JSON into the single-quoted style. https://github.com/json5/json5 (requires nodejs being installed)
There is a command line tool, json5, that will convert a double-quote to the "single-quoted JSON" wanted by winbox. I can't say whether Mikrotik actually use JSON5...but this parser has always worked to generated skin files that work in winbox.

russman · Tue Apr 25, 2023 7:29 pm

I don't think you ever want to use the double-quoted style. I recall winbox not liking double-quoted string sometimes (maybe always, cannot recall). Even if webfig accepts.

My need was to programmatically modify the skin file, so I can assure you regular JSON will give you trouble. One tip here is the JSON5 parser seems to deal with parsing normal JSON into the single-quoted style. https://github.com/json5/json5 (requires nodejs being installed)
There is a command line tool, json5, that will convert a double-quote to the "single-quoted JSON" wanted by winbox. I can't say whether Mikrotik actually use JSON5...but this parser has always worked to generated skin files that work in winbox.

The json I provided was created by the router without any file editing, mikrotik is generating the json with " double quotes in ver 7.8. I was just trying the ' single quote edit that was suggested, they both work for web.

russman · Wed Apr 26, 2023 3:11 am

On your image: Feb/17/2016... 2016???
Try to netinstall 7.7+ and see if the problem is the old FS structure.

I spent a half hour trying to get netinstall to recognize the router I was working with. Don't know if its a windows 11 issue or what but that was a joke. Used two PCs, one a 11 laptop with USB ethernet, next a PC with PCI-express intel nic. Disabled windows firewall and all interfaces but the one connected to the mikrotik, port 1 on mikrotik (no port labeled boot), all instructions followed, no dice getting it to see the router. Don't know why went this route, boot interrupt TFTP is about what every other device I've worked with does for forced firmware updates, never had issues with that.

rextended · Wed Apr 26, 2023 3:16 am

I don't know what your problem is, from a forum it's difficult to understand it,
but know that netinstall never gives me problems, unless I've made some configuration errors on the PC.
It's hard to prove, and I certainly don't want to boast in vain: I wouldn't gain anything.

Amm0 · Wed Apr 26, 2023 3:50 am

Re double-quotes... yeah I can't say I've tested v7.8 with skins. In past versions, I swear you needed single quotes for winbox skins to work – but glad it seems Mikrotik is trying to fix that since the non-standard JSON (e.g. single quotes aren't really valid JSON) is annoying (e.g. using 3rd party library JSON5 to generate)

unless I've made some configuration errors on the PC.

Make sure to disable all other interface other than one needed for netinstall. Mikrotik's directions should be right, but one forgotten item and netinstall won't work. Also it's important to hold the reset while powering for a long time.

If you have a Linux box someplace to run netinstall (or VM with Linux bridged to a physical port) that's often easier than mucking with all the windows firewall, etc.

russman · Wed Apr 26, 2023 5:43 am

So more testing. Found a 750hex still on 7.1, upgraded it to 7.6, factory reset no default config, added DHCP client to get an IP, logged into web and built a skin from scratch, created a user and group etc, connected to it via IP from winbox using the skin configured user, have access to everything, login to web gui with the same user and its menus are limited as configured in the skin. All my testing has been with mmips hex750's, for anyone thats had this working recently, what platform/model router are you using?

rextended · Wed Apr 26, 2023 10:37 am

Why the file you post is still have .txt at the end?
Is for upload the file on forum?

I'm doing some tests on hEX, I report it later.

rextended · Wed Apr 26, 2023 11:28 am

Test done with:
Windows 10 (64) 22H2 with latest updates
netinstall 64 bit version 7.8 with options "Keep old configuration" and "Apply default config" both not selected and without "Configure script", all blank except (obviously) "Key"
routeros-7.8-mmips
hEX RB750Gr3 batch 204 release r4 with factory firmware (mt7621L) 6.47.10 and current 7.8 (powered by 24V PoE from CRS112-8P-4S-IN)
(256.0 MiB RAM, 16.0 MiB FLASH, MIPS 1004Kc V2.15, factory software 6.46.3)
Winbox 64 bit 3.37
Browser used: Firefox 64 bit 112.0.2

exported config code

# jan/02/1970 00:10:36 by RouterOS 7.8
# software id = Z0U8-SZ0C
#
# model = RB750Gr3
# serial number = CCR10FD35DDC
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/port
set 0 name=serial0
/ip address
add address=192.168.88.1/24 interface=ether1 network=192.168.88.0
/tool romon
set enabled=yes

Simply on WebFig: "Design Skin", unselect "Quick Set" and "Save".
Exit from "Design Skin", logout from WebFig.

this is the generated default.json

{
    "Quick Set": 0
}

Open WinBox: THE SKIN DO NOT WORK

Edited the file, replacing " with ' and re-uploaded to overwrite the previous file:

Open WinBox: SKIN WORK AS EXPECTED

Replaced again the ' with " for exclude a file drag & drop that solve the problem:

Open WinBox: THE SKIN DO NOT WORK AGAIN

NOTE: Same tests, same result using WinBox by MAC, IP or RoMON (this last from the CRS112-8P-4S-IN).

Same test on 7.7, work all correctly as expected.

Just the Staff do the same basic 5min test that I do...

P.S.:
Editing the file and save it as .json.txt do not solve anything if have .txt as extension...... understand?

russman · Wed Apr 26, 2023 5:02 pm

Why the file you post is still have .txt at the end?
Is for upload the file on forum?

I'm doing some tests on hEX, I report it later.

Yes, .json isn't a supported file time to upload as an attachment on the forum. I can try only disabling quickset and editing the file made my mikrotik to ' instead of " again.

russman · Wed Apr 26, 2023 5:52 pm

Well the madness continues. I got netinstall to work and loaded 7.8, made a bridge for two ports and set a dhcp client on it, designed a skin in mikrotik and setup the group/user and basic skin, logged in via IP to winbox with that user and the skin didn't work. Downloaded the skin and manually edited the two lines containing " to ' saved uploaded and rebooted it, tried connecting again and it still didn't work.

Update: Updated the config file.

rextended · Wed Apr 26, 2023 5:56 pm

I don't know what to tell you, it sure works for me with ' I tried it myself, as you read.

Do just the basic test I do, without touch anything first....

Wed Apr 26, 2023 5:57 pm

Can you send your supout.rif file and used skin to support@mikrotik.com ? We will try to reproduce

rextended · Wed Apr 26, 2023 5:59 pm

Can you send your supout.rif file and used skin to support@mikrotik.com ? We will try to reproduce

@normis, I leave nothing to chance, you know, I confirm the bug and my previous post can be used to perfectly reproduce the problem beyond any reasonable doubt.

viewtopic.php?p=998572#p998421

Amm0 · Wed Apr 26, 2023 6:10 pm

It would be nice if real JSON (e.g. always double-quoted field names) worked. @rexetnded tests match exactly what I've seen – it needs single-quoted field name (and allows unquoted fieldnames if there is no spaces in name )

russman · Wed Apr 26, 2023 6:20 pm

It would be nice if real JSON (e.g. always double-quoted field names) worked. @rexetnded tests match exactly what I've seen – it needs single-quoted field name (and allows unquoted fieldnames if there is no spaces in name )

So you have this working on 7.8 with single quotes? No matter what it only works in web for me. 7.8OS and Firmware. Just had another tech try it from linux and windows 10 with same results, works in web but not in winbox using the settings from my last post.

Update: So far I've tested this on 3 different RB750Gr3 and just now on a RB3011UiAS, same result, works in web but not in winbox. On the RB3011 I used the same basic setup file, skin, and setup a user to use that group with skin.

russman · Wed Apr 26, 2023 6:24 pm

Can you send your supout.rif file and used skin to support@mikrotik.com ? We will try to reproduce

Just sent .rsc, .json, and supout.rif in a zip with a link to this thread to support.

rextended · Wed Apr 26, 2023 6:32 pm

I found another bug, thanks to @russman

BUG #2

DO NOT WORK if the user have the <READ> right and <NOT SENSITIVE> right at the same time

/user group
add name=test policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,\
    winbox,password,web,sniff,api,romon,rest-api,!sensitive"

All other tested read/sensitive combo works (also the useless for example not read and not sensitive).

So...
If the user have at THE SAME TIME <READ> and <NOT SENSTIVE> flag, skin not work on winbox..............

Hard to find with various combination.

Wed Apr 26, 2023 6:34 pm

Chiming in here from sideline ...

@Rex
How SHOULD that user definition be then ?

PS and don't shout please ...

rextended · Wed Apr 26, 2023 6:36 pm

Chiming in here from sideline ...

@Rex
How SHOULD that user definition be then ?

PS and don't shout please ...

I don't know, not matter, I'm not criticizing the intended configuration, but pointing out the bug....

P.S.: For underline the relevant parts, not for shout, sorry.......

Amm0 · Wed Apr 26, 2023 6:43 pm

And FWIW in v7.9rc1 on RB1100, single quotes works.

I use them for a read for a "dumb admin" to remove at least some stuff that is not going be used, but here is the specific skin I tested:

WORKS...

{
    'Quick Set': 1,
    WebFig: { name: 'Configuration' },
    Interfaces: {
        'IP Tunnel': 0,
        'GRE Tunnel': 0,
        VXLAN: 0,
        Bonding: 0,
        VRF: 0,
        'EoIP Tunnel': 0,
        Interface: { name: 'All Interfaces' },
        'Interface List': 0,
        'LTE Cell Monitor': 0,
        'LTE Scanner': 0,
        Modem: 0,
        Ethernet: { name: 'Ethernet Ports' },
        VLAN: { name: 'Virtual LAN (VLANS)' },
        VRRP: { name: 'Virtual Routers (VRRP)' }
    },
    WireGuard: 0,
    PPP: 0,
    Bridge: {
        'Port Extensions': 0,
        VLANs: 0,
        MSTIs: 0,
        'Port MST Overrides': 0,
        MDB: 0
    },
    Mesh: 0,
    IP: {
        'DHCP Relay': 0,
        Hotspot: 0,
        Packing: 0,
        SMB: 0,
        Socks: 0,
        'Traffic Flow': 0,
        VRF: 0,
        'Web Proxy': 0,
        'Kid Control': 0,
        TFTP: 0,
        'DHCP Client': {
            'DHCP Client': {
                '&': { remove: 0 }
            },
            'DHCP Client Options': 0
        },
        'DHCP Server': {
            'DHCP Config': 0,
            'DHCP Setup': 0,
            Options: 0,
            'Option Sets': 0,
            'Vendor Classes': 0
        },
        SNMP: 0,
        SSH: 0
    },
    MPLS: 0,
    'IPv6': {
        'DHCP Client': 0,
        'DHCP Relay': 0,
        'DHCP Server': 0,
        Firewall: 0,
        Pool: 0
    },
    Routing: {
        BGP: 0,
        OSPF: 0,
        RPKI: 0,
        Filters: 0,
        'IGMP Proxy': 0,
        'PIM SM': 0,
        RIP: 0
    },
    System: {
        'Auto Upgrade': 0,
        Disks: 0,
        LEDs: 0,
        License: 0,
        'NTP Client': 0,
        'NTP Server': 0,
        'Reset Configuration': 0,
        'Special Login': 0,
        GPS: {
            GPS: {
                Channel: 0,
                'Init Channel': 0,
                'Init String': 0,
                'Set System Time': 0
            }
        },
        Certificates: {
            'SCEP Servers': 0,
            'SCEP RA': 0,
            Requests: 0,
            OTP: 0,
            CRL: 0
        }
    },
    'Dot1X': 0,
    RADIUS: 0,
    Partition: 0,
    Undo: 0,
    Redo: 0,
    'Safe Mode': 0,
    License: 0,
    Status: {
        Status: {
            '4': { alias: 'Interfaces:LTE:*7:General:Type', tab: 'LTE Status' },
            '5': { alias: 'Interfaces:LTE:*7:Cellular:Current Operator' },
            '6': { alias: 'Interfaces:LTE:*7:Cellular:RSRP' },
            '7': { alias: 'Interfaces:LTE:*7:Cellular:RSRQ' },
            '8': { alias: 'Interfaces:LTE:*7:Cellular:Primary Band' },
            '9': { alias: 'Interfaces:LTE:*7:Cellular:CA Band' },
            '10': { alias: 'Interfaces:LTE:*7:Cellular:RSSI' },
            '11': { alias: 'Interfaces:LTE:*7:Cellular:SINR' },
            '12': { alias: 'Interfaces:LTE:*7:Cellular:CQI' },
            '13': { alias: 'Interfaces:LTE:*7:Traffic:Tx/Rx Rate' },
            '14': { alias: 'Interfaces:LTE:*7:Traffic:Byte Graph' },
            '15': { alias: 'Interfaces:LTE:*7:Traffic:Packet Graph' },
            '16': { alias: 'Interfaces:VLAN:*B:General:Name', tab: 'Hardline Internet' },
            '18': { alias: 'Interfaces:VLAN:*B:General:VLAN ID' },
            '19': { alias: 'Interfaces:VLAN:*B:Traffic:Tx/Rx Rate' },
            '20': { alias: 'Interfaces:VLAN:*B:Traffic:Byte Graph' },
            '21': { alias: 'IP:DHCP Client:DHCP Client:*2:Status:IP Address' },
            '22': { alias: 'IP:DHCP Client:DHCP Client:*2:Status:Gateway' },
            '27': { alias: 'Tools:Netwatch:Netwatch:*0:Host:Status' }
        }
    },
    CAPsMAN: 0,
    Wireless: {
        CAP: 0,
        'WPS Client': 0,
        Alignment: 0,
        Align: 0,
        'W60G Station': 0,
        'Nstreme Dual': 0,
        'Security Profiles': 0,
        Channels: 0,
        'Interworking Profiles': 0
    },
    Tools: { 'Flood Ping': 0, Graphing: 0 },
    IoT: { Bluetooth: 0, Modbus: 0 },
    'Hide Passwords': 0,
    ZeroTier: { Instance: 0, name: 'ZeroTier VPN' }
}

If I convert that to valid JSON using double-quotes, skin is ignored by winbox. And all UI is shown...

DOES NOT WORK

{
  "Quick Set": 1,
  "WebFig": { "name": "Configuration" },
  "Interfaces": {
    "IP Tunnel": 0,
    "GRE Tunnel": 0,
    "VXLAN": 0,
    "Bonding": 0,
    "VRF": 0,
    "EoIP Tunnel": 0,
    "Interface": { "name": "All Interfaces" },
    "Interface List": 0,
    "LTE Cell Monitor": 0,
    "LTE Scanner": 0,
    "Modem": 0,
    "Ethernet": { "name": "Ethernet Ports" },
    "VLAN": { "name": "Virtual LAN (VLANS)" },
    "VRRP": { "name": "Virtual Routers (VRRP)" }
  },
  "WireGuard": 0,
  "PPP": 0,
  "Bridge": {
    "Port Extensions": 0,
    "VLANs": 0,
    "MSTIs": 0,
    "Port MST Overrides": 0,
    "MDB": 0
  },
  "Mesh": 0,
  "IP": {
    "DHCP Relay": 0,
    "Hotspot": 0,
    "Packing": 0,
    "SMB": 0,
    "Socks": 0,
    "Traffic Flow": 0,
    "VRF": 0,
    "Web Proxy": 0,
    "Kid Control": 0,
    "TFTP": 0,
    "DHCP Client": {
      "DHCP Client": { "&": { "remove": 0 } },
      "DHCP Client Options": 0
    },
    "DHCP Server": {
      "DHCP Config": 0,
      "DHCP Setup": 0,
      "Options": 0,
      "Option Sets": 0,
      "Vendor Classes": 0
    },
    "SNMP": 0,
    "SSH": 0
  },
  "MPLS": 0,
  "IPv6": {
    "DHCP Client": 0,
    "DHCP Relay": 0,
    "DHCP Server": 0,
    "Firewall": 0,
    "Pool": 0
  },
  "Routing": {
    "BGP": 0,
    "OSPF": 0,
    "RPKI": 0,
    "Filters": 0,
    "IGMP Proxy": 0,
    "PIM SM": 0,
    "RIP": 0
  },
  "System": {
    "Auto Upgrade": 0,
    "Disks": 0,
    "LEDs": 0,
    "License": 0,
    "NTP Client": 0,
    "NTP Server": 0,
    "Reset Configuration": 0,
    "Special Login": 0,
    "GPS": {
      "GPS": {
        "Channel": 0,
        "Init Channel": 0,
        "Init String": 0,
        "Set System Time": 0
      }
    },
    "Certificates": {
      "SCEP Servers": 0,
      "SCEP RA": 0,
      "Requests": 0,
      "OTP": 0,
      "CRL": 0
    }
  },
  "Dot1X": 0,
  "RADIUS": 0,
  "Partition": 0,
  "Undo": 0,
  "Redo": 0,
  "Safe Mode": 0,
  "License": 0,
  "Status": {
    "Status": {
      "4": { "alias": "Interfaces:LTE:*7:General:Type", "tab": "LTE Status" },
      "5": { "alias": "Interfaces:LTE:*7:Cellular:Current Operator" },
      "6": { "alias": "Interfaces:LTE:*7:Cellular:RSRP" },
      "7": { "alias": "Interfaces:LTE:*7:Cellular:RSRQ" },
      "8": { "alias": "Interfaces:LTE:*7:Cellular:Primary Band" },
      "9": { "alias": "Interfaces:LTE:*7:Cellular:CA Band" },
      "10": { "alias": "Interfaces:LTE:*7:Cellular:RSSI" },
      "11": { "alias": "Interfaces:LTE:*7:Cellular:SINR" },
      "12": { "alias": "Interfaces:LTE:*7:Cellular:CQI" },
      "13": { "alias": "Interfaces:LTE:*7:Traffic:Tx/Rx Rate" },
      "14": { "alias": "Interfaces:LTE:*7:Traffic:Byte Graph" },
      "15": { "alias": "Interfaces:LTE:*7:Traffic:Packet Graph" },
      "16": {
        "alias": "Interfaces:VLAN:*B:General:Name",
        "tab": "Hardline Internet"
      },
      "18": { "alias": "Interfaces:VLAN:*B:General:VLAN ID" },
      "19": { "alias": "Interfaces:VLAN:*B:Traffic:Tx/Rx Rate" },
      "20": { "alias": "Interfaces:VLAN:*B:Traffic:Byte Graph" },
      "21": { "alias": "IP:DHCP Client:DHCP Client:*2:Status:IP Address" },
      "22": { "alias": "IP:DHCP Client:DHCP Client:*2:Status:Gateway" },
      "27": { "alias": "Tools:Netwatch:Netwatch:*0:Host:Status" }
    }
  },
  "CAPsMAN": 0,
  "Wireless": {
    "CAP": 0,
    "WPS Client": 0,
    "Alignment": 0,
    "Align": 0,
    "W60G Station": 0,
    "Nstreme Dual": 0,
    "Security Profiles": 0,
    "Channels": 0,
    "Interworking Profiles": 0
  },
  "Tools": { "Flood Ping": 0, "Graphing": 0 },
  "IoT": { "Bluetooth": 0, "Modbus": 0 },
  "Hide Passwords": 0,
  "ZeroTier": { "Instance": 0, "name": "ZeroTier VPN" }
}

Note: It the "Status" page (that only shows in webfig) is why I know... since if you want to make a status page, it needs the RouterOS .id field (e.g. *01) but those can vary between devices, so I have script that can look them up... I tried for a bit a while back to use double-quotes (since JavaScript etc expects "real" JSON)....but found this same problem that winbox really wants the single quotes. I now just use a different branding package per device, so I don't have to use a script to generate them, but the single quotes are needed AFAIK

russman · Wed Apr 26, 2023 6:52 pm

@russman: The problem is that you do not follow the instructions....

But I found another bug, is not your problem:

BUG #2

DO NOT WORK if the user have the <READ> right and <NOT SENSITIVE> right at the same time
Code: Select all
/user group
add name=test policy="local,telnet,ssh,ftp,reboot,read,write,policy,test,\
    winbox,password,web,sniff,api,romon,rest-api,!sensitive"
All other tested read/sensitive combo works (also the useless for example not read and not sensitive).

So...
If the user do not have at THE SAME TIME <READ> and <NOT SENSTIVE> flag, skin not work on winbox..............

Hard to find with various combination.

Well just an FYI the instructions have no reference to what the sensitive flag does, but that fixed it so thank you!

https://help.mikrotik.com/docs/display/ ... Dyour_skin The only place sensitive is referenced on this page is in read only saying you can make sensitive fields read only. I did test lots of options in this area but didn't use sensitive yet!

PS: I'd give you an answer flag if you remove I didn't follow instructions

Amm0 · Wed Apr 26, 2023 6:53 pm

In my tests, I just set the default "read" group to use the skins above. And the single-quoted one worked fine, at least in v7.9rc1.

BUT the default includes "sensitive"... If I remove the "sensitive" policy... @rextended is right, skins does NOT work in winbox... with the same skin that worked with "sensitive" set. Never run into that one before, but does seem like a bug.

rextended · Wed Apr 26, 2023 7:10 pm

PS: I'd give you an answer flag if you remove I didn't follow instructions

Done.

Sorry for my bad English...
What I meant: If you followed the instructions with the default configuration without adding "electricans" and other parts, the skin with ' works.
But thanks to your insistence

I discovered another bug...

russman · Wed Apr 26, 2023 7:27 pm

So now I'm back on the config I was working with at the beginning. Still other issues with it not fully working.

BrianHiggins · Wed Apr 26, 2023 7:33 pm

In my tests, I just set the default "read" group to use the skins above. And the single-quoted one worked fine, at least in v7.9rc1.

BUT the default includes "sensitive"... If I remove the "sensitive" policy... @rextended is right, skins does NOT work in winbox... with the same skin that worked with "sensitive" set. Never run into that one before, but does seem like a bug.

I had forgotten about this, There was an old issue about this back pre v6.46.2, this was supposed to have been fixed in 6.46.2+ where both ftp and sensitive permissions were needed to get the skin to correctly apply, though it only applied to webfig at the time since winbox didn't support any skins back then.

edit I just saw out current deployment scripts still have a note in them mentioning this exact issue with the sensitive & ftp permission & saying that the permissions should be removed once the fix is verified...

russman · Wed Apr 26, 2023 7:45 pm

In my tests, I just set the default "read" group to use the skins above. And the single-quoted one worked fine, at least in v7.9rc1.

BUT the default includes "sensitive"... If I remove the "sensitive" policy... @rextended is right, skins does NOT work in winbox... with the same skin that worked with "sensitive" set. Never run into that one before, but does seem like a bug.
I had forgotten about this, There was an old issue about this back pre v6.46.2, this was supposed to have been fixed in 6.46.2+ where both ftp and sensitive permissions were needed to get the skin to correctly apply, though it only applied to webfig at the time since winbox didn't support any skins back then.

edit I just saw out current deployment scripts still have a note in them mentioning this exact issue with the sensitive & ftp permission & saying that the permissions should be removed once the fix is verified...

Just tried checking FTP, still didn't correctly hide everything in winbox that it does in web. Still not hiding is IPv6, MPLS, Routing, Terminal, Undo, Redo, Safemode, and Winbox (in my config).

Wed Apr 26, 2023 7:47 pm

i think You have hit the nail

i have a remote location where skin does not work on winbox and is with a limited user with only the following permisions in his respective user-group:

read, write, web, winbox

rextended · Wed Apr 26, 2023 7:48 pm

i think You have hit the nail

Yes, is missing sensitive...

So now I'm back on the config I was working with at the beginning. Still other issues with it not fully working.

I've found enough bugs for today, let's have someone check them out at the Staff

This time open a ticket

russman · Wed Apr 26, 2023 7:50 pm

MAC connection. Try IP. MAC is only for emergency access.

Just FYI, it does work as best it can via MAC, however, some things just won't hide ether by IP or MAC.

russman · Wed Apr 26, 2023 7:52 pm

So now I'm back on the config I was working with at the beginning. Still other issues with it not fully working.

I've found enough bugs for today, let's have someone check them out at the Staff

This time open a ticket

[/quote]

viewtopic.php?p=998604#p998580, also done awhile back in this thread

Amm0 · Wed Apr 26, 2023 7:56 pm

There is no known bug, just do as above meme suggests and apply it to a group.

Well... I'm not sure about that. It's fair that it works...but seems awfully picky on what's valid. I use skins in our configs, but as noted above, it's seems pretty specific to the device/packages/etc.

And needing "sensitive" for it to work, certainly seems like a bug...

Did someone report it already? I can but no need for dups...

russman · Wed Apr 26, 2023 8:06 pm

There is no known bug, just do as above meme suggests and apply it to a group.
Well... I'm not sure about that. It's fair that it works...but seems awfully picky on what's valid. I use skins in our configs, but as noted above, it's seems pretty specific to the device/packages/etc.

And needing "sensitive" for it to work, certainly seems like a bug...

Did someone report it already? I can but no need for dups...

Click the link in my reply before this one of yours

russman · Thu Apr 27, 2023 5:12 pm

Ticket Response:

Hello,

Thank you for contacting MikroTik Support.

Thank you for the report.
We were able to reproduce your issue in our labs.
Our developers have already considered this issue and it will be fixed in future releases, but unfortunately, I cannot share any ETA yet.

To resolve the issue in the meantime, you should add "sensitive" permissions to this group.

Best regards
Serhii Treml

rextended · Thu Apr 27, 2023 5:23 pm

OOOOOOOOOKKKK!!!!!

Amm0 · Thu Apr 27, 2023 5:27 pm

Depends on use cases, but for me sensitive is okay for a skin. I use them for a read-only account to show "status" to an end-user, but one of things folks want to see is the Wi-Fi password, so sensitive is needed to read that. Since you can't read other user's passwords even with sensitive (AFAIK), it should not be possible to use sensitive for previllege escalation with "read" group. But that why I never noticed this before.

russman · Tue May 02, 2023 11:43 pm

What's new in Winbox v3.38:
*) fix quickset Connect to wifi without password
*) fix datetime field with enum values (userman)
*) fix snumbar view (no users yet)
*) fix new skin file parse (real json)

Making progress already it seems!

BrianHiggins · Wed May 03, 2023 12:58 am

confirming that this bug requiring sensitive is still present in winbox 3.38 and v7.9 stable, and skins files created in webfig that works perfectly in webfig can still cause winbox to crash. ticket SUP-115140

russman · Wed May 03, 2023 3:30 pm

confirming that this bug requiring sensitive is still present in winbox 3.38 and v7.9 stable, and skins files created in webfig that works perfectly in webfig can still cause winbox to crash. ticket SUP-115140

Ya they wanted to close my ticket pretty quickly after saying they release this winbox json parsing fix. I tried to stress there is more to address here but we'll see. Other entire menu structures you hide in the skin editor are simply ignored by winbox but adhered to in webfig still too.

BrianHiggins · Wed May 03, 2023 5:38 pm

confirming that this bug requiring sensitive is still present in winbox 3.38 and v7.9 stable, and skins files created in webfig that works perfectly in webfig can still cause winbox to crash. ticket SUP-115140
Ya they wanted to close my ticket pretty quickly after saying they release this winbox json parsing fix. I tried to stress there is more to address here but we'll see. Other entire menu structures you hide in the skin editor are simply ignored by winbox but adhered to in webfig still too.

I had an open ticket for another webfig issue opened when 7.8 stable was released that only got the reply that they couldn't reproduce it, yet the issue is still there in 7.9. This time I opened a new support ticket with multiple issues outlined including this above and another skins related issue, a bunch of attached files, several screenshots showing the issue, and also referenced the old support ticket showing that this isn't new. I also submitted a bug ticket (I had forgotten you can submit different ticket types when opening the ticket online instead of by email) with a reference to the support ticket. Overnight they closed the old support ticket and the new bug ticket but have not yet responded to the new support ticket.

The frustrating part is the lack of attention they seem to give to fixing skins & branding maker issues. I truly don't think Normis & team believe that these features are necessary business requirements for deploying MikroTik routers in industrial and enterprise environments. Cable companies have limited web UI's for their DOCSIS modems that customers can log into and get some status information, Phone companies still using DSL also have limited UIs for customer login. We use the branding maker and skins to perform the exact same function because our business requirements are very similar to cable & phone companies and also need to provide a customer login to their CPE equipment, and we use MikroTik in the same way they use the cable modems. No one thinks DLink is giving end users the full configuration interface to the carrier supplied combo router & docsis modems that are popular around here. There is one interface for the end user, another for the installer, and a 3rd (probably command line) for the more senior engineers that get called in to fix issues the installers cannot. MikroTik doesn't seem to realize that this is important to ISPs.

infabo · Fri Jul 28, 2023 12:44 pm

to all who have configured a skin in webfig but it does not work in winbox: you have to click "save" to have the customizations written to the JSON file.

infabo · Fri Jul 28, 2023 12:49 pm

PS:

Winbox Skin Bug: Can't disable/hide MPLS item.

{
    "Mesh": 0,
    "MPLS": 0,
    "Dot1X": 0,
    "RADIUS": 0,
    "CAPsMAN": 0,
    "Wireless": {
        "W60G Station": 0,
        "Nstreme Dual": 0,
        "Channels": 0,
        "Interworking Profiles": 0
    },
    "PPP": {
        "L2TP Ethernet": 0,
        "PPP Scanner": 0,
        "PPTP Server": 0,
        "SSTP Server": 0,
        "OVPN Server": 0,
        "Import .ovpn": 0,
        "PPPoE Scan": 0,
        "PPPoE Servers": 0,
        "Secrets": 0,
        "Profiles": 0,
        "L2TP Secrets": 0
    },
    "Partition": 0,
    "Make Supout.rif": 0
}

flynno · Wed Aug 07, 2024 3:14 pm

RBD53iG-5HacD2HnD
Firmware 7.15.3

{
    "Safe Mode": 0,
    "Undo": 0,
    "Redo": 0,
    "Quick Set": 0,
    "WebFig": 0,
    "Terminal": 0,
    "Hide Passwords": 0,
    "Manual": 0,
    "WinBox": 0,
    "Graphs": 0,
    "License": 0,
    "About": 0,
    "WiFi": 0,
    "Wireless": 0,
    "Interfaces": 0,
    "WireGuard": 0,
    "PPP": 0,
    "Bridge": 0,
    "Switch": 0,
    "Mesh": 0,
    "IP": 0,
    "IPv6": 0,
    "MPLS": 0,
    "Routing": 0,
    "System": {
        "Auto Upgrade": 0,
        "Certificates": 0,
        "Clock": 0,
        "Console": 0,
        "Disks": 0,
        "History": 0,
        "Identity": 0,
        "LEDs": 0,
        "License": 0,
        "Logging": 0,
        "NTP Client": 0,
        "NTP Server": 0,
        "Note": 0,
        "Packages": 0,
        "Ports": 0,
        "Reset Configuration": 0,
        "RouterBOARD": {
            "RouterBOARD": {
                "Upgrade": 0
            },
            "Settings": 0,
            "USB Power Reset": 0,
            "Mode Button": 0,
            "Reset Button": 0
        },
        "Scheduler": 0,
        "Scripts": 0,
        "Shutdown": 0,
        "Special Login": 0,
        "Users": 0,
        "Watchdog": 0,
        "Resources": {
            "PCI": 0,
            "USB": 0,
            "CPU": 0,
            "IRQ": 0
        }
    },
    "Queues": 0,
    "Dot1X": 0,
    "Files": 0,
    "Log": 0,
    "RADIUS": 0,
    "Tools": 0,
    "Partition": 0,
    "Make Supout.rif": 0
}

Works on webfig but not on winbox

skin code

skin code

exported config code

Who is online