MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

fix: [correlations] Invalid orgc loaded in the attribute level correlations, fixes #3948

pull/3966/head
iglocska 2018-12-18 10:24:11 +01:00
parent 5e8392ae3f
commit 1b358f730e
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
app/Model/Event.php
View File

@ -818,14 +818,29 @@ class Event extends AppModel
'limit' => $max_correlations
));
$relatedAttributes = array();
$orgc_ids = array();
foreach ($correlations as $k => $correlation) {
if (empty($orgc_ids[$correlation[$settings[$context]['correlationModel']]['event_id']])) {
$temp = $this->find('first', array(
'recursive' => -1,
'conditions' => array('Event.id' => $correlation[$settings[$context]['correlationModel']]['event_id']),
'fields' => array('Event.orgc_id')
));
if (!empty($temp)) {
$orgc_ids[$correlation[$settings[$context]['correlationModel']]['event_id']] = $temp['Event']['orgc_id'];
}
}
$current = array(
'id' => $correlation[$settings[$context]['correlationModel']]['event_id'],
'attribute_id' => $correlation[$settings[$context]['correlationModel']]['attribute_id'],
'org_id' => $correlation[$settings[$context]['correlationModel']]['org_id'],
'info' => $correlation[$settings[$context]['correlationModel']]['info'],
'value' => $correlation[$settings[$context]['correlationModel']]['value'],
);
if (!empty($orgc_ids[$correlation[$settings[$context]['correlationModel']]['event_id']])) {
$current['org_id'] = $orgc_ids[$correlation[$settings[$context]['correlationModel']]['event_id']];
} else {
$current['org_id'] = 'unknown';
}
if (empty($relatedAttributes[$correlation[$settings[$context]['correlationModel']][$settings[$context]['parentIdField']]]) || !in_array($current, $relatedAttributes[$correlation[$settings[$context]['correlationModel']][$settings[$context]['parentIdField']]])) {
$relatedAttributes[$correlation[$settings[$context]['correlationModel']][$settings[$context]['parentIdField']]][] = $current;
}