diff --git a/app/Controller/AttributesController.php b/app/Controller/AttributesController.php index 81f403d5c..f2cd2bbb9 100755 --- a/app/Controller/AttributesController.php +++ b/app/Controller/AttributesController.php @@ -878,6 +878,13 @@ class AttributesController extends AppController { } } else { $this->set('id', $id); + $attribute = $this->Attribute->find('first', array( + 'conditions' => array('id' => $id), + 'recursive' => -1, + 'fields' => array('id', 'event_id'), + )); + $this->set('event_id', $attribute['Attribute']['event_id']); + $this->render('ajax/attributeConfirmationForm'); } } else { if (!$this->request->is('post') && !$this->_isRest()) { diff --git a/app/Controller/ShadowAttributesController.php b/app/Controller/ShadowAttributesController.php index f7fa385ba..65905383e 100644 --- a/app/Controller/ShadowAttributesController.php +++ b/app/Controller/ShadowAttributesController.php @@ -197,30 +197,41 @@ class ShadowAttributesController extends AppController { */ // This method will discard a proposed change. Users that can delete the proposals are the publishing users of the org that created the event and of the ones that created the proposal - in addition to site admins of course public function discard($id = null) { - if (!$this->request->is('post') || !$this->request->is('ajax')) { + if (!$this->request->is('ajax')) { throw new MethodNotAllowedException(); } - $this->ShadowAttribute->id = $id; - $this->ShadowAttribute->read(); - $eventId = $this->ShadowAttribute->data['ShadowAttribute']['event_id']; - $this->loadModel('Event'); - $this->Event->Behaviors->detach('SysLogLogable.SysLogLogable'); - $this->Event->recursive = -1; - $this->Event->id = $eventId; - $this->Event->read(); - // Send those away that shouldn't be able to see this - if (!$this->_isSiteAdmin()) { - if ((($this->Event->data['Event']['orgc'] != $this->Auth->user('org')) && ($this->Auth->user('org') != $this->ShadowAttribute->data['ShadowAttribute']['org'])) || (!$this->userRole['perm_modify'])) { - $this->Session->setFlash('You don\'t have permission to do that'); - $this->redirect(array('controller' => 'events', 'action' => 'view', $eventId)); + if ($this->request->is('post')) { + $this->ShadowAttribute->id = $id; + $this->ShadowAttribute->read(); + $eventId = $this->ShadowAttribute->data['ShadowAttribute']['event_id']; + $this->loadModel('Event'); + $this->Event->Behaviors->detach('SysLogLogable.SysLogLogable'); + $this->Event->recursive = -1; + $this->Event->id = $eventId; + $this->Event->read(); + // Send those away that shouldn't be able to see this + if (!$this->_isSiteAdmin()) { + if ((($this->Event->data['Event']['orgc'] != $this->Auth->user('org')) && ($this->Auth->user('org') != $this->ShadowAttribute->data['ShadowAttribute']['org'])) || (!$this->userRole['perm_modify'])) { + $this->Session->setFlash('You don\'t have permission to do that'); + $this->redirect(array('controller' => 'events', 'action' => 'view', $eventId)); + } + } + if ($this->ShadowAttribute->delete($id, $cascade = false)) { + $this->_setProposalLock($eventId, false); + $this->autoRender = false; + return new CakeResponse(array('body'=> json_encode(array('saved' => true, 'success' => 'Proposal discarded.')),'status'=>200)); + } else { + return new CakeResponse(array('body'=> json_encode(array('false' => true, 'errors' => 'Could not discard proposal.')),'status'=>200)); } - } - if ($this->ShadowAttribute->delete($id, $cascade = false)) { - $this->_setProposalLock($eventId, false); - $this->autoRender = false; - return new CakeResponse(array('body'=> json_encode(array('saved' => true, 'success' => 'Proposal discarded.')),'status'=>200)); } else { - return new CakeResponse(array('body'=> json_encode(array('false' => true, 'errors' => 'Could not discard proposal.')),'status'=>200)); + $this->set('id', $id); + $shadowAttribute = $this->ShadowAttribute->find('first', array( + 'conditions' => array('id' => $id), + 'recursive' => -1, + 'fields' => array('id', 'event_id'), + )); + $this->set('event_id', $shadowAttribute['ShadowAttribute']['event_id']); + $this->render('ajax/shadowAttributeConfirmationForm'); } } diff --git a/app/View/Attributes/add.ctp b/app/View/Attributes/add.ctp index 6e3a98ef6..f0d993fdb 100755 --- a/app/View/Attributes/add.ctp +++ b/app/View/Attributes/add.ctp @@ -1,4 +1,3 @@ -Html->script('ajaxification');?>
Form->create('Attribute', array('id')); diff --git a/app/View/Attributes/ajax/attributeConfirmationForm.ctp b/app/View/Attributes/ajax/attributeConfirmationForm.ctp new file mode 100644 index 000000000..be51fe826 --- /dev/null +++ b/app/View/Attributes/ajax/attributeConfirmationForm.ctp @@ -0,0 +1,24 @@ +
+Form->create('Attribute', array('style' => 'margin:0px;', 'id' => 'PromptForm')); +?> +Attribute Deletion +
+

Are you sure you want to delete Attribute #?

+ + + + + + +
+ Yes + + + No +
+
+Form->end(); +?> +
\ No newline at end of file diff --git a/app/View/Elements/eventattributerow.ctp b/app/View/Elements/eventattributerow.ctp index 610292f26..d4c671b05 100644 --- a/app/View/Elements/eventattributerow.ctp +++ b/app/View/Elements/eventattributerow.ctp @@ -54,8 +54,43 @@ if ($object['objectType'] == 1) {
+ +
+
- + Html->link($filename, array('controller' => $t, 'action' => 'download', $object['id'])); + } else { + echo $this->Html->link($filenameHash[0], array('controller' => $t, 'action' => 'download', $object['id'])); + } + if (isset($filenameHash[1])) echo ' | ' . $filenameHash[1]; + } elseif (strpos($object['type'], '|') !== false) { + $filenameHash = explode('|', $object['value']); + echo h($filenameHash[0]); + if (isset($filenameHash[1])) echo ' | ' . $filenameHash[1]; + } elseif ('vulnerability' == $object['type']) { + if (! is_null(Configure::read('MISP.cveurl'))) { + $cveUrl = Configure::read('MISP.cveurl'); + } else { + $cveUrl = "http://www.google.com/search?q="; + } + echo $this->Html->link(h($sigDisplay), h($cveUrl) . h($sigDisplay), array('target' => '_blank')); + } elseif ('link' == $object['type']) { + echo $this->Html->link(h($sigDisplay), h($sigDisplay)); + } else { + $sigDisplay = str_replace("\r", '', $sigDisplay); + echo nl2br(h($sigDisplay)); + } + ?>
@@ -92,7 +127,7 @@ if ($object['objectType'] == 1) { ?>
- +
  @@ -105,7 +140,7 @@ if ($object['objectType'] == 1) { echo $this->Form->create('Attribute', array('class' => 'inline-delete', 'id' => $currentType . '_' . $object['id'] . '_delete', 'action' => 'delete')); ?> - + Form->end(); } else { @@ -123,7 +158,7 @@ if ($object['objectType'] == 1) { if (($event['Event']['orgc'] == $me['org'] && $mayModify) || $isSiteAdmin || ($object['org'] == $me['org'])) { echo $this->Form->create('ShadowAttribute', array('class' => 'inline-delete', 'style' => 'display:inline-block;', 'id' => 'ShadowAttribute_' . $object['id'] . '_delete', 'action' => 'delete')); ?> - + Form->end(); } diff --git a/app/View/Events/view.ctp b/app/View/Events/view.ctp index 2dd2699e2..003392600 100755 --- a/app/View/Events/view.ctp +++ b/app/View/Events/view.ctp @@ -159,6 +159,7 @@ $mayPublish = ($isAclPublish && $event['Event']['orgc'] == $me['org']); 1) echo $this->element('pivot'); ?>
+