Merge branch 'master' into feature/sg

Conflicts:
	VERSION.json
	app/Model/Tag.php
	app/files/scripts/misp2stix.py

app/Controller/EventsController.php

@@ -3233,6 +3233,7 @@ class EventsController extends AppController {
 	}
 	
 	public function exportChoice($id) {
+		if (!is_numeric($id)) throw new MethodNotAllowedException('Invalid ID');
 		$event = $this->Event->find('first' ,array(
 				'conditions' => array('id' => $id),
 				'recursive' => -1,

app/Model/Event.php

@@ -2245,6 +2245,11 @@ class Event extends AppModel {
 				}
 			}
 		}
+                if (Configure::read('MISP.tagging')) {
+			foreach ($events as &$event) {
+				$event['Tag'] = $this->EventTag->Tag->findEventTags($event['Event']['id']);
+                        }
+                }
 		// generate a randomised filename for the temporary file that will be passed to the python script
 		$randomFileName = $this->generateRandomFileName();
 		$tempFile = new File (APP . "files" . DS . "scripts" . DS . "tmp" . DS . $randomFileName, true, 0644);

app/Model/Tag.php

@@ -84,6 +84,7 @@ class Tag extends AppModel {
 		return array($acceptIds, $rejectIds);
 	}
 	
+	// find all of the event Ids that belong to tags with certain names
 	public function findTags($array) {
 		$ids = array();
 		foreach ($array as $a) {
@@ -121,4 +122,22 @@ class Tag extends AppModel {
 		}
 		return $existingTag['Tag']['id'];
 	}
-}
+
+	// find all tags that belong to a given eventId
+	public function findEventTags($eventId) {
+		$tags = array();
+		$params = array(
+				'recursive' => 1,
+				'contain' => 'EventTag',
+		);
+		$result = $this->find('all', $params);
+		foreach ($result as $tag) {
+			foreach ($tag['EventTag'] as $eventTag) {
+				if ($eventTag['event_id'] == $eventId) {
+					$tags[] = $tag['Tag'];
+				}
+			}
+		}
+		return $tags;
+	}
+}

app/View/Events/ajax/exportChoice.ctp

@@ -4,13 +4,13 @@
 		<table style="width:100%;">
 		<?php foreach ($exports as $k => $export): ?>
 			<tr style="border-bottom:1px solid black;" class="templateChoiceButton">
-				<td style="padding-left:10px; text-align:left;width:50%;" onClick="exportChoiceSelect('<?php echo $export['url']; ?>', '<?php echo $k; ?>', '<?php echo $export['checkbox']; ?>')"><?php echo $export['text']; ?></td>
+				<td style="padding-left:10px; text-align:left;width:50%;" onClick="exportChoiceSelect('<?php echo h($export['url']); ?>', '<?php echo h($k); ?>', '<?php echo h($export['checkbox']); ?>')"><?php echo h($export['text']); ?></td>
 				<td style="padding-right:10px; width:50%;text-align:right;">
 					<?php if ($export['checkbox']): 
-						echo $export['checkbox_text'];
+						echo h($export['checkbox_text']);
 					?>
-						<input id = "<?php echo $k . '_toggle';?>" type="checkbox" style="align;vertical-align:top;margin-top:8px;">
-						<span id ="<?php echo $k?>_set" style="display:none;"><?php echo h($export['checkbox_set']); ?></span>
+						<input id = "<?php echo h($k) . '_toggle';?>" type="checkbox" style="align;vertical-align:top;margin-top:8px;">
+						<span id ="<?php echo h($k);?>_set" style="display:none;"><?php echo h($export['checkbox_set']); ?></span>
 					<?php else: ?>
 						&nbsp;
 					<?php endif; ?>

app/View/Events/automation.ctp

@@ -359,10 +359,10 @@ The event ID is optional. MISP will accept either a JSON or an XML object posted
 <h3>Add or remove tags from events</h3>
 <p>You can add or remove an existing tag from an event in the following way:</p>
 <pre>
-<?php echo Configure::read('MISP.baseurl').'/attributes/addTag'; ?>
+<?php echo Configure::read('MISP.baseurl').'/events/addTag'; ?>
 </pre>
 <pre>
-<?php  echo Configure::read('MISP.baseurl').'/attributes/removeTag'; ?>
+<?php  echo Configure::read('MISP.baseurl').'/events/removeTag'; ?>
 </pre>
 <p>Just POST a json object in the following format (to the appropriate API depending on whether you want to add or delete a tag from an event):</p>
 <code>{"request": {"Event": {"id": "228", "tag": "8"}}}</code><br /><br />

app/files/scripts/misp2stix.py

@@ -157,6 +157,7 @@ def generateSTIXObjects(event):
         incident.status = IncidentStatus(incident_status_name)
     setTLP(incident, event["Event"]["distribution"])
     setOrg(incident, event["Org"]["name"])
+    setTag(incident, event["Tag"])
     resolveAttributes(incident, ttps, event["Attribute"])
     return [incident, ttps]
 
@@ -307,6 +308,11 @@ def setOrg(target, org):
     information_source = InformationSource(identity = ident)
     target.information_source = information_source
 
+# takes an object and adds the passed tags as journal entries to it. 
+def setTag(target, tags):
+    for tag in tags:
+        addJournalEntry(target, "MISP Tag: " + tag["name"])
+
 def addReference(target, reference):
     if hasattr(target.information_source, "references"):
         target.information_source.add_reference(reference)