MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

fix: [security] Make cluster's elements adhere to ACL

pull/6624/head
mokaddem 2020-11-24 12:15:42 +01:00
parent 83ce94ac70
commit 423750573d
No known key found for this signature in database
GPG Key ID: 164C473F627A06FA
2 changed files with 37 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
app/Controller/GalaxyElementsController.php
View File

@ -14,9 +14,11 @@ class GalaxyElementsController extends AppController
)
);
public function index($id)
public function index($clusterId)
{
$this->paginate['conditions'] = array('GalaxyElement.galaxy_cluster_id' => $id);
$aclConditions = $this->GalaxyElement->buildClusterConditions($this->Auth->user(), $clusterId);
$this->paginate['conditions'] = [$aclConditions];
$this->paginate['contain'] = ['GalaxyCluster' => ['fields' => ['id', 'distribution', 'org_id']]];
$clusters = $this->paginate();
$this->set('list', $clusters);
if ($this->request->is('ajax')) {

33
app/Model/GalaxyElement.php
View File

@ -95,4 +95,37 @@ class GalaxyElement extends AppModel
}
$this->saveMany($tempElements);
}
public function buildACLConditions($user)
{
$conditions = [];
if (!$user['Role']['perm_site_admin']) {
$conditions = $this->GalaxyCluster->buildConditions($user);
}
return $conditions;
}
public function buildClusterConditions($user, $clusterId)
{
return [
$this->buildACLConditions($user),
'GalaxyCluster.id' => $clusterId
];
}
public function fetchElements(array $user, $clusterId)
{
$params = array(
'conditions' => $this->buildClusterConditions($user, $clusterId),
'contain' => ['GalaxyCluster' => ['fields' => ['id', 'distribution', 'org_id']]],
'recursive' => -1
);
$elements = $this->find('all', $params);
foreach ($elements as $i => $element) {
$elements[$i] = $elements[$i]['GalaxyElement'];
unset($elements[$i]['GalaxyCluster']);
unset($elements[$i]['GalaxyElement']);
}
return $elements;
}
}