From 74579bb1fe8d20f2f15872864f8fe21ea7dce2bc Mon Sep 17 00:00:00 2001 From: iglocska Date: Fri, 22 Mar 2024 15:24:05 +0100 Subject: [PATCH] fix: [attribute search] enforce unpublishedprivate directive --- app/Model/Attribute.php | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/app/Model/Attribute.php b/app/Model/Attribute.php index cfc196a7f..454e0f5d4 100644 --- a/app/Model/Attribute.php +++ b/app/Model/Attribute.php @@ -1553,13 +1553,22 @@ 'fields' => ['id'] ]; $subQuery2 = [ - 'conditions' => ['distribution IN' => [1, 2, 3]], + 'conditions' => [ + 'distribution IN' => [1, 2, 3] + ], 'fields' => ['id'] ]; $subQuery3 = [ - 'conditions' => ['Event.distribution' => 4, 'Event.sharing_group_id IN' => $sgids], + 'conditions' => [ + 'Event.distribution' => 4, + 'Event.sharing_group_id IN' => $sgids + ], 'fields' => ['id'] ]; + if (Configure::read('MISP.unpublishedprivate')) { + $subQuery2['conditions']['Event.published'] = 1; + $subQuery3['conditions']['Event.published'] = 1; + } $conditions = [ 'OR' => [ $this->subQueryGenerator($this->Event, $subQuery1, 'Attribute.event_id'),