From 898ea1d97c5aae2841450b1afc2fa7cb88f65277 Mon Sep 17 00:00:00 2001 From: Andreas Ziegler Date: Sat, 4 Jun 2016 01:08:16 +0200 Subject: [PATCH] remove whitespace (space/tab) from empty lines --- INSTALL/INSTALL.centos6.txt | 2 +- INSTALL/INSTALL.centos7.txt | 2 +- INSTALL/INSTALL.debian.txt | 4 +- INSTALL/INSTALL.ubuntu1404.txt | 4 +- INSTALL/Upgrade_21_to_22/UPGRADE.txt | 4 +- INSTALL/build/technical_design/TD-Audit.txt | 2 +- app/Config/Schema/schema.php | 2 +- app/Config/bootstrap.default.php | 2 +- app/Console/Command/AdminShell.php | 6 +- app/Console/Command/EventShell.php | 28 +-- app/Console/Command/PasswordShell.php | 2 +- app/Console/Command/ServerShell.php | 20 +- app/Console/Command/UserInitShell.php | 2 +- app/Controller/AppController.php | 46 ++--- app/Controller/AttributesController.php | 142 +++++++------- app/Controller/Component/ACLComponent.php | 12 +- .../Component/Auth/ApacheAuthenticate.php | 4 +- .../Component/BlackListComponent.php | 6 +- .../Component/IOCImportComponent.php | 10 +- app/Controller/EventBlacklistsController.php | 2 +- app/Controller/EventDelegationsController.php | 8 +- app/Controller/EventsController.php | 170 ++++++++-------- app/Controller/FavouriteTagsController.php | 4 +- app/Controller/FeedsController.php | 26 +-- app/Controller/JobsController.php | 14 +- app/Controller/LogsController.php | 18 +- app/Controller/NewsController.php | 6 +- app/Controller/OrgBlacklistsController.php | 2 +- app/Controller/OrganisationsController.php | 2 +- app/Controller/PostsController.php | 12 +- app/Controller/RegexpController.php | 2 +- app/Controller/ServersController.php | 100 +++++----- app/Controller/ShadowAttributesController.php | 58 +++--- app/Controller/SharingGroupsController.php | 17 +- app/Controller/SightingsController.php | 2 +- app/Controller/TagsController.php | 28 +-- app/Controller/TasksController.php | 18 +- app/Controller/TaxonomiesController.php | 12 +- app/Controller/TemplateElementsController.php | 22 +-- app/Controller/TemplatesController.php | 50 ++--- app/Controller/ThreadsController.php | 18 +- app/Controller/UsersController.php | 38 ++-- app/Controller/WarninglistsController.php | 10 +- app/Lib/Export/HidsExport.php | 2 +- app/Lib/Export/RPZExport.php | 28 +-- app/Lib/Tools/ColourPaletteTool.php | 10 +- app/Lib/Tools/ComplexTypeTool.php | 30 +-- app/Lib/Tools/CustomPaginationTool.php | 8 +- app/Lib/Tools/FinancialTool.php | 24 +-- app/Lib/Tools/JSONConverterTool.php | 12 +- app/Lib/Tools/PubSubTool.php | 18 +- app/Lib/Tools/SyncTool.php | 2 +- app/Lib/Tools/XMLConverterTool.php | 20 +- app/Model/AppModel.php | 58 +++--- app/Model/Attribute.php | 74 +++---- app/Model/Behavior/RegexpBehavior.php | 4 +- app/Model/Event.php | 184 +++++++++--------- app/Model/EventDelegation.php | 10 +- app/Model/EventTag.php | 8 +- app/Model/FavouriteTag.php | 4 +- app/Model/Feed.php | 38 ++-- app/Model/Job.php | 6 +- app/Model/Log.php | 10 +- app/Model/Module.php | 16 +- app/Model/News.php | 4 +- app/Model/Organisation.php | 18 +- app/Model/Post.php | 4 +- app/Model/Regexp.php | 4 +- app/Model/Role.php | 2 +- app/Model/Server.php | 172 ++++++++-------- app/Model/ShadowAttribute.php | 28 +-- app/Model/SharingGroup.php | 34 ++-- app/Model/SharingGroupElement.php | 4 +- app/Model/SharingGroupOrg.php | 10 +- app/Model/SharingGroupServer.php | 16 +- app/Model/Sighting.php | 16 +- app/Model/Tag.php | 24 +-- app/Model/Task.php | 8 +- app/Model/Taxonomy.php | 18 +- app/Model/TaxonomyEntry.php | 4 +- app/Model/TaxonomyPredicate.php | 2 +- app/Model/Template.php | 16 +- app/Model/TemplateElement.php | 2 +- app/Model/TemplateElementAttribute.php | 2 +- app/Model/TemplateElementFile.php | 2 +- app/Model/TemplateElementText.php | 2 +- app/Model/Thread.php | 2 +- app/Model/User.php | 38 ++-- app/Model/Warninglist.php | 28 +-- app/Model/WarninglistEntry.php | 4 +- app/Model/WarninglistType.php | 4 +- app/Model/Whitelist.php | 2 +- .../Model/Behavior/SysLogLogableBehavior.php | 10 +- .../UrlCache/Lib/Routing/UrlCacheManager.php | 20 +- app/View/Attributes/add.ctp | 6 +- app/View/Attributes/add_attachment.ctp | 10 +- .../Attributes/ajax/attributeEditMassForm.ctp | 4 +- .../Attributes/alternate_search_result.ctp | 2 +- app/View/Attributes/attribute_replace.ctp | 4 +- app/View/Attributes/edit.ctp | 8 +- app/View/Attributes/search.ctp | 2 +- app/View/Elements/eventattribute.ctp | 4 +- app/View/Elements/eventattributecreation.ctp | 16 +- app/View/Elements/eventdiscussion.ctp | 4 +- app/View/Elements/global_menu.ctp | 2 +- .../Elements/healthElements/diagnostics.ctp | 2 +- app/View/Elements/healthElements/files.ctp | 2 +- app/View/Elements/healthElements/workers.ctp | 4 +- app/View/Elements/histogram.ctp | 2 +- app/View/Elements/serverRuleElements/pull.ctp | 4 +- app/View/Elements/serverRuleElements/push.ctp | 4 +- app/View/Elements/side_menu.ctp | 24 +-- .../populateTemplateAttribute.ctp | 2 +- .../templateElements/templateRowAttribute.ctp | 12 +- .../templateElements/templateRowFile.ctp | 4 +- .../EventDelegations/ajax/delegate_event.ctp | 2 +- app/View/Events/add.ctp | 2 +- app/View/Events/ajax/enrichmentChoice.ctp | 2 +- app/View/Events/ajax/exportChoice.ctp | 2 +- app/View/Events/edit.ctp | 2 +- app/View/Events/export.ctp | 2 +- app/View/Events/filter_event_index.ctp | 6 +- app/View/Events/view.ctp | 2 +- app/View/Events/view_graph.ctp | 8 +- app/View/Events/xml/index.ctp | 1 - app/View/Feeds/preview_index.ctp | 2 +- app/View/Helper/AppHelper.php | 2 +- app/View/Helper/CommandHelper.php | 4 +- app/View/Helper/PivotHelper.php | 10 +- app/View/Jobs/index.ctp | 2 +- app/View/Logs/admin_index.ctp | 2 +- app/View/Organisations/ajax/merge.ctp | 2 +- app/View/Organisations/view.ctp | 4 +- app/View/Pages/doc/general.ctp | 2 +- app/View/Roles/view.ctp | 4 +- app/View/Servers/add.ctp | 2 +- app/View/Servers/edit.ctp | 2 +- app/View/Servers/index.ctp | 2 +- app/View/Servers/preview_index.ctp | 4 +- app/View/ShadowAttributes/add.ctp | 2 +- app/View/ShadowAttributes/add_attachment.ctp | 4 +- app/View/SharingGroups/add.ctp | 2 +- app/View/SharingGroups/edit.ctp | 6 +- app/View/Tags/ajax/select_tag.ctp | 2 +- app/View/Tags/ajax/taxonomy_choice.ctp | 2 +- app/View/Taxonomies/view.ctp | 2 +- .../ajax/template_element_add_attribute.ctp | 12 +- .../ajax/template_element_add_file.ctp | 6 +- .../ajax/template_element_add_text.ctp | 2 +- .../ajax/template_element_edit_attribute.ctp | 8 +- .../ajax/template_element_edit_file.ctp | 6 +- .../ajax/template_element_edit_text.ctp | 2 +- .../populate_event_from_template.ctp | 2 +- app/View/Users/admin_edit.ctp | 2 +- app/View/Users/admin_filter_user_index.ctp | 6 +- app/View/Users/ajax/fetchpgpkey.ctp | 2 +- app/View/Users/ajax/index.ctp | 4 +- app/View/Warninglists/view.ctp | 2 +- app/files/scripts/misp2cybox.py | 2 +- app/webroot/css/main.css | 16 +- app/webroot/css/tree.css | 20 +- app/webroot/js/jquery-toc.js | 4 +- app/webroot/js/misp2.4.46.js | 26 +-- tools/example-rest.py | 2 +- 164 files changed, 1171 insertions(+), 1173 deletions(-) diff --git a/INSTALL/INSTALL.centos6.txt b/INSTALL/INSTALL.centos6.txt index d2b668b21..8115e0266 100644 --- a/INSTALL/INSTALL.centos6.txt +++ b/INSTALL/INSTALL.centos6.txt @@ -186,7 +186,7 @@ cp -a bootstrap.default.php bootstrap.php cp -a database.default.php database.php cp -a core.default.php core.php cp -a config.default.php config.php - + # Configure the fields in the newly created files: # config.php : baseurl # database.php : login, port, password, database diff --git a/INSTALL/INSTALL.centos7.txt b/INSTALL/INSTALL.centos7.txt index 7a3f8db19..a43240b04 100644 --- a/INSTALL/INSTALL.centos7.txt +++ b/INSTALL/INSTALL.centos7.txt @@ -199,7 +199,7 @@ cp -a bootstrap.default.php bootstrap.php cp -a database.default.php database.php cp -a core.default.php core.php cp -a config.default.php config.php - + # Configure the fields in the newly created files: # config.php : baseurl # database.php : login, port, password, database diff --git a/INSTALL/INSTALL.debian.txt b/INSTALL/INSTALL.debian.txt index 2bcdae045..c41fc0818 100644 --- a/INSTALL/INSTALL.debian.txt +++ b/INSTALL/INSTALL.debian.txt @@ -123,7 +123,7 @@ cp /var/www/MISP/INSTALL/apache.misp.ubuntu /etc/apache2/sites-available/misp.co # Be aware that the configuration files for apache 2.4 and up have changed. # The configuration file has to have the .conf extension in the sites-available directory # For more information, visit http://httpd.apache.org/docs/2.4/upgrading.html - + a2dissite 000-default # 000-default can be called default based on distribution, in which case run a2dissite default a2ensite misp @@ -146,7 +146,7 @@ cp -a bootstrap.default.php bootstrap.php cp -a database.default.php database.php cp -a core.default.php core.php cp -a config.default.php config.php - + # Configure the fields in the newly created files: # database.php : login, port, password, database diff --git a/INSTALL/INSTALL.ubuntu1404.txt b/INSTALL/INSTALL.ubuntu1404.txt index 72739a638..271ec2b5e 100644 --- a/INSTALL/INSTALL.ubuntu1404.txt +++ b/INSTALL/INSTALL.ubuntu1404.txt @@ -116,7 +116,7 @@ cp /var/www/MISP/INSTALL/apache.misp.ubuntu /etc/apache2/sites-available/misp.co # Be aware that the configuration files for apache 2.4 and up have changed. # The configuration file has to have the .conf extension in the sites-available directory # For more information, visit http://httpd.apache.org/docs/2.4/upgrading.html - + a2dissite 000-default # 000-default can be called default based on distribution, in which case run a2dissite default a2ensite misp @@ -139,7 +139,7 @@ cp -a bootstrap.default.php bootstrap.php cp -a database.default.php database.php cp -a core.default.php core.php cp -a config.default.php config.php - + # Configure the fields in the newly created files: # database.php : login, port, password, database diff --git a/INSTALL/Upgrade_21_to_22/UPGRADE.txt b/INSTALL/Upgrade_21_to_22/UPGRADE.txt index 28ff07948..0252bae6a 100644 --- a/INSTALL/Upgrade_21_to_22/UPGRADE.txt +++ b/INSTALL/Upgrade_21_to_22/UPGRADE.txt @@ -6,7 +6,7 @@ Upgrade procedure from v2.1 to v2.2 - execute UPGRADE.SH in the MISP/INSTALL folder (this also includes the installation of Redis for CakeResque) - cd /var/www/MISP/INSTALL - ./UPGRADE.SH - + - Replace your current bootstrap.php file found in /MISP/app/Config/ with bootstrap.default.php and change set your instance up to your liking - Log in with the site admin credentials and execute the following commands by changing the url @@ -28,5 +28,5 @@ Enabling background jobs via CakeResque - cd /var/www/MISP/app/Console/worker/ - ./start.sh Make sure you configure your OS to start this script as boot time ! - + ================================================================================================================================================ \ No newline at end of file diff --git a/INSTALL/build/technical_design/TD-Audit.txt b/INSTALL/build/technical_design/TD-Audit.txt index ce19ea4b4..ed82f0153 100644 --- a/INSTALL/build/technical_design/TD-Audit.txt +++ b/INSTALL/build/technical_design/TD-Audit.txt @@ -6,7 +6,7 @@ to write to a log database table. https://github.com/eskil-saatvedt/CakePHP-Assets/blob/master/models/behaviors/LogableBehavior.php Adds the logable Model Behavior. - + http://bakery.cakephp.org/articles/rikdc/2010/06/07/syslog-component Adds the syslog capability. diff --git a/app/Config/Schema/schema.php b/app/Config/Schema/schema.php index 2aadf2e24..7b39cfd34 100644 --- a/app/Config/Schema/schema.php +++ b/app/Config/Schema/schema.php @@ -33,7 +33,7 @@ class AppSchema extends CakeSchema { 'username' => array('type' => 'string', 'null' => false, 'default' => null, 'collate' => 'utf8_bin', 'charset' => 'utf8'), 'expire' => array('type' => 'datetime', 'null' => false, 'default' => null), 'indexes' => array( - + ), 'tableParameters' => array('charset' => 'utf8', 'collate' => 'utf8_bin', 'engine' => 'MyISAM') ); diff --git a/app/Config/bootstrap.default.php b/app/Config/bootstrap.default.php index a469b04fb..640a55358 100644 --- a/app/Config/bootstrap.default.php +++ b/app/Config/bootstrap.default.php @@ -92,7 +92,7 @@ if (!$relativePaths) { if (isset($_SERVER['SERVER_NAME'])) $serverName = $_SERVER['SERVER_NAME']; else if (isset($_SERVER['HTTP_HOST'])) $serverName = $_SERVER['HTTP_HOST']; else if (isset($_SERVER['SERVER_ADDR'])) $serverName = $_SERVER['SERVER_ADDR']; - + if (!Configure::read('MISP.baseurl') && isset($serverName)) { if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || (isset($_SERVER['SERVER_PORT']) && $_SERVER['SERVER_PORT'] == 443)) { $protocol = 'https'; diff --git a/app/Console/Command/AdminShell.php b/app/Console/Command/AdminShell.php index 5ac0804fb..d81f8c1d8 100644 --- a/app/Console/Command/AdminShell.php +++ b/app/Console/Command/AdminShell.php @@ -3,7 +3,7 @@ App::uses('AppShell', 'Console/Command'); class AdminShell extends AppShell { public $uses = array('Event'); - + public function jobGenerateCorrelation() { $jobId = $this->args[0]; $this->loadModel('Job'); @@ -14,7 +14,7 @@ class AdminShell extends AppShell $this->Job->saveField('message', 'Job done.'); $this->Job->saveField('status', 4); } - + public function jobGenerateShadowAttributeCorrelation() { $jobId = $this->args[0]; $this->loadModel('Job'); @@ -22,7 +22,7 @@ class AdminShell extends AppShell $this->loadModel('ShadowAttribute'); $this->ShadowAttribute->generateCorrelation($jobId); } - + public function jobUpgrade24() { $jobId = $this->args[0]; $user_id = $this->args[1]; diff --git a/app/Console/Command/EventShell.php b/app/Console/Command/EventShell.php index 0cdedede1..77c8f6f1e 100644 --- a/app/Console/Command/EventShell.php +++ b/app/Console/Command/EventShell.php @@ -33,7 +33,7 @@ class EventShell extends AppShell $this->Job->saveField('status', 1); $this->Job->saveField('message', 'Job done.'); } - + public function cachexml() { $userId = $this->args[0]; $id = $this->args[1]; @@ -64,7 +64,7 @@ class EventShell extends AppShell $file->append('' . PHP_EOL); $file->close(); } - + private function __recursiveEcho($array) { $text = ""; foreach ($array as $k => $v) { @@ -87,7 +87,7 @@ class EventShell extends AppShell } return $text; } - + public function cachehids() { $userId = $this->args[0]; $user = $this->User->getAuthUser($userId); @@ -111,7 +111,7 @@ class EventShell extends AppShell $this->Job->saveField('progress', '100'); $this->Job->saveField('message', 'Job done.'); } - + public function cacherpz() { $userId = $this->args[0]; $user = $this->User->getAuthUser($userId); @@ -149,7 +149,7 @@ class EventShell extends AppShell $this->Job->saveField('progress', '100'); $this->Job->saveField('message', 'Job done.'); } - + public function cachecsv() { $userId = $this->args[0]; $user = $this->User->getAuthUser($userId); @@ -185,7 +185,7 @@ class EventShell extends AppShell $this->Job->saveField('progress', '100'); $this->Job->saveField('message', 'Job done.'); } - + public function cachetext() { $userId = $this->args[0]; $user = $this->User->getAuthUser($userId); @@ -211,7 +211,7 @@ class EventShell extends AppShell $this->Job->saveField('progress', 100); $this->Job->saveField('message', 'Job done.'); } - + public function cachenids() { $userId = $this->args[0]; $user = $this->User->getAuthUser($userId); @@ -244,7 +244,7 @@ class EventShell extends AppShell $this->Job->saveField('progress', '100'); $this->Job->saveField('message', 'Job done.'); } - + public function alertemail() { $userId = $this->args[0]; $processId = $this->args[1]; @@ -256,7 +256,7 @@ class EventShell extends AppShell $job['Job']['message'] = 'Emails sent.'; $this->Job->save($job); } - + public function contactemail() { $id = $this->args[0]; $message = $this->args[1]; @@ -284,11 +284,11 @@ class EventShell extends AppShell $job['Job']['message'] = 'Emails sent.'; $this->Job->save($job); } - + public function enqueueCaching() { $timestamp = $this->args[0]; $task = $this->Task->findByType('cache_exports'); - + // If the next execution time and the timestamp don't match, it means that this task is no longer valid as the time for the execution has since being scheduled // been updated. if ($task['Task']['next_execution_time'] != $timestamp) return; @@ -319,9 +319,9 @@ class EventShell extends AppShell 'fields' => array('User.org_id', 'User.id') )); $users[] = $site_admin; - + if ($task['Task']['timer'] > 0) $this->Task->reQueue($task, 'cache', 'EventShell', 'enqueueCaching', false, false); - + // Queue a set of exports for admins. This "ADMIN" organisation. The organisation of the admin users doesn't actually matter, it is only used to indentify // the special cache files containing all events $i = 0; @@ -334,7 +334,7 @@ class EventShell extends AppShell $this->Task->id = $task['Task']['id']; $this->Task->saveField('message', $i . ' job(s) started at ' . date('d/m/Y - H:i:s') . '.'); } - + public function publish() { $id = $this->args[0]; $passAlong = $this->args[1]; diff --git a/app/Console/Command/PasswordShell.php b/app/Console/Command/PasswordShell.php index 51a6f1210..7d8175cdd 100644 --- a/app/Console/Command/PasswordShell.php +++ b/app/Console/Command/PasswordShell.php @@ -17,7 +17,7 @@ class PasswordShell extends AppShell { $results['User']['password'] = $this->args[1]; $results['User']['confirm_password'] = $this->args[1]; $results['User']['change_pw'] = 1; - + if (!$this->User->save($results)) { echo 'Could not update account for User.id = ', $results['User']['id'], PHP_EOL; debug($this->User->validationErrors); diff --git a/app/Console/Command/ServerShell.php b/app/Console/Command/ServerShell.php index 3f73b4013..31b553a66 100644 --- a/app/Console/Command/ServerShell.php +++ b/app/Console/Command/ServerShell.php @@ -5,7 +5,7 @@ require_once 'AppShell.php'; class ServerShell extends AppShell { public $uses = array('Server', 'Task', 'Job', 'User', 'Feed'); - + public function pull() { $userId = $this->args[0]; $serverId = $this->args[1]; @@ -41,11 +41,11 @@ class ServerShell extends AppShell $this->Job->saveField('message', 'Invalid technique chosen.'); return; break; - + } } } - + public function push() { $serverId = $this->args[0]; $jobId = $this->args[2]; @@ -70,7 +70,7 @@ class ServerShell extends AppShell $this->Task->saveField('message', 'Job(s) started at ' . date('d/m/Y - H:i:s') . '.'); } } - + public function fetchFeed() { $userId = $this->args[0]; @@ -88,7 +88,7 @@ class ServerShell extends AppShell 'status' => 4 )); } - + public function enqueuePull() { $timestamp = $this->args[0]; $userId = $this->args[1]; @@ -115,9 +115,9 @@ class ServerShell extends AppShell ); $this->Job->save($data); $jobId = $this->Job->id; - + if ($task['Task']['timer'] > 0) $this->Task->reQueue($task, 'default', 'ServerShell', 'enqueuePull', $userId, $taskId); - + App::uses('SyncTool', 'Tools'); $syncTool = new SyncTool(); $result = $this->Server->pull($user, $server['Server']['id'], 'full', $server, $jobId); @@ -141,7 +141,7 @@ class ServerShell extends AppShell case '4' : $this->Job->saveField('message', 'Invalid technique chosen.'); break; - + } $failCount++; } @@ -149,7 +149,7 @@ class ServerShell extends AppShell $this->Task->id = $task['Task']['id']; $this->Task->saveField('message', count($servers) . ' job(s) completed at ' . date('d/m/Y - H:i:s') . '. Failed jobs: ' . $failCount . '/' . $count); } - + public function enqueuePush() { $timestamp = $this->args[0]; $taskId = $this->args[1]; @@ -160,7 +160,7 @@ class ServerShell extends AppShell return; } if ($task['Task']['timer'] > 0) $this->Task->reQueue($task, 'default', 'ServerShell', 'enqueuePush', $userId, $taskId); - + $this->User->recursive = -1; $user = $this->User->getAuthUser($userId); $servers = $this->Server->find('all', array('recursive' => -1, 'conditions' => array('push' => 1))); diff --git a/app/Console/Command/UserInitShell.php b/app/Console/Command/UserInitShell.php index 5b0e69228..b83c065ba 100644 --- a/app/Console/Command/UserInitShell.php +++ b/app/Console/Command/UserInitShell.php @@ -48,7 +48,7 @@ class UserInitShell extends AppShell { $org_id = $firstOrg['Organisation']['id']; } } - + // populate the DB with the first user if it's empty if ($this->User->find('count') == 0 ) { $authkey = $this->User->generateAuthKey(); diff --git a/app/Controller/AppController.php b/app/Controller/AppController.php index 3c2a274ff..48432d0d3 100755 --- a/app/Controller/AppController.php +++ b/app/Controller/AppController.php @@ -42,11 +42,11 @@ class AppController extends Controller { public $defaultModel = ''; public $debugMode = false; - + public $helpers = array('Utility'); - + private $__jsVersion = '2.4.46'; - + // Used for _isAutomation(), a check that returns true if the controller & action combo matches an action that is a non-xml and non-json automation method // This is used to allow authentication via headers for methods not covered by _isRest() - as that only checks for JSON and XML formats public $automationArray = array( @@ -75,7 +75,7 @@ class AppController extends Controller { 'Security', 'ACL' ); - + public function beforeFilter() { $this->set('jsVersion', $this->__jsVersion); $this->loadModel('User'); @@ -120,10 +120,10 @@ class AppController extends Controller { if (isset($_SERVER['HTTP_USER_AGENT'])) { if(preg_match('/(?i)msie [2-8]/',$_SERVER['HTTP_USER_AGENT']) && !strpos($_SERVER['HTTP_USER_AGENT'], 'Opera')) throw new MethodNotAllowedException('You are using an unsecure and outdated version of IE, please download Google Chrome, Mozilla Firefox or update to a newer version of IE. If you are running IE9 or newer and still receive this error message, please make sure that you are not running your browser in compatibility mode. If you still have issues accessing the site, get in touch with your administration team at ' . Configure::read('MISP.contact')); } - + $userLoggedIn = false; if (Configure::read('Plugin.CustomAuth_enable')) $userLoggedIn = $this->__customAuthentication($_SERVER); - + if (!$userLoggedIn) { // REST authentication if ($this->_isRest() || $this->_isAutomation()) { @@ -213,7 +213,7 @@ class AppController extends Controller { if ($base_dir == '/') { $base_dir = ''; } - + if ($this->Auth->user()) { // update script $this->{$this->modelClass}->runUpdates(); @@ -247,7 +247,7 @@ class AppController extends Controller { } else { if (!($this->params['controller'] === 'users' && $this->params['action'] === 'login')) $this->redirect(array('controller' => 'users', 'action' => 'login', 'admin' => false)); } - + // check if MISP is live if ($this->Auth->user() && !Configure::read('MISP.live')) { $role = $this->getActions(); @@ -324,7 +324,7 @@ class AppController extends Controller { $this->set('notifications', $notifications); $this->ACL->checkAccess($this->Auth->user(), Inflector::variable($this->request->params['controller']), $this->action); } - + public function queryACL($debugType='findMissingFunctionNames', $content = false) { $this->autoRender = false; $this->layout = false; @@ -335,7 +335,7 @@ class AppController extends Controller { $this->response->type('json'); $this->render('/Servers/json/simple'); } - + private function __convertEmailToName($email) { $name = explode('@', $email); $name = explode('.', $name[0]); @@ -348,7 +348,7 @@ class AppController extends Controller { if ($type === 'csrf') throw new BadRequestException(__d('cake_dev', $type)); throw new BadRequestException(__d('cake_dev', 'The request has been black-holed')); } - + public $userRole = null; protected function _isJson($data=false) { @@ -359,14 +359,14 @@ class AppController extends Controller { protected function _isRest() { return (isset($this->RequestHandler) && ($this->RequestHandler->isXml() || $this->_isJson())); } - + protected function _isAutomation() { foreach ($this->automationArray as $controllerName => $controllerActions) { if ($this->params['controller'] == $controllerName && in_array($this->params['action'], $controllerActions)) return true; } return false; } - + /** * Convert an array to the same array but with the values also as index instead of an interface_exists */ @@ -433,7 +433,7 @@ class AppController extends Controller { if ($user['Role']['perm_site_admin']) $user['siteadmin'] = true; return $user; } - + public function checkExternalAuthUser($authkey) { $this->loadModel('User'); $user = $this->User->getAuthUserByExternalAuth($authkey); @@ -461,7 +461,7 @@ class AppController extends Controller { $this->Session->setFlash(__('All done. attribute_count generated from scratch for ' . (isset($k) ? $k : 'no') . ' events.')); $this->redirect(array('controller' => 'pages', 'action' => 'display', 'administration')); } - + public function pruneDuplicateUUIDs() { if (!$this->_isSiteAdmin() || !$this->request->is('post')) throw new MethodNotAllowedException(); $this->loadModel('Attribute'); @@ -488,7 +488,7 @@ class AppController extends Controller { $this->Session->setFlash('Done. Assigned new UUIDs to ' . $counter . ' attribute(s).'); $this->redirect(array('controller' => 'pages', 'action' => 'display', 'administration')); } - + public function removeDuplicateEvents() { if (!$this->_isSiteAdmin() || !$this->request->is('post')) throw new MethodNotAllowedException(); $this->loadModel('Event'); @@ -498,10 +498,10 @@ class AppController extends Controller { 'group' => array('Event.uuid HAVING COUNT(*) > 1'), )); $counter = 0; - + // load this so we can remove the blacklist item that will be created, this is the one case when we do not want it. if (Configure::read('MISP.enableEventBlacklisting')) $this->EventBlacklist = ClassRegistry::init('EventBlacklist'); - + foreach ($duplicates as $duplicate) { $events = $this->Event->find('all', array( 'recursive' => -1, @@ -524,7 +524,7 @@ class AppController extends Controller { $this->Session->setFlash('Done. Removed ' . $counter . ' duplicate events.'); $this->redirect(array('controller' => 'pages', 'action' => 'display', 'administration')); } - + public function updateDatabase($command) { if (!$this->_isSiteAdmin() || !$this->request->is('post')) throw new MethodNotAllowedException(); $this->loadModel('Server'); @@ -532,7 +532,7 @@ class AppController extends Controller { $this->Session->setFlash('Done.'); $this->redirect(array('controller' => 'pages', 'action' => 'display', 'administration')); } - + public function upgrade2324() { if (!$this->_isSiteAdmin() || !$this->request->is('post')) throw new MethodNotAllowedException(); $this->loadModel('Server'); @@ -564,13 +564,13 @@ class AppController extends Controller { $this->redirect(array('controller' => 'pages', 'action' => 'display', 'administration')); } } - + private function __preAuthException($message) { $this->set('debugMode', (Configure::read('debug') > 1) ? 'debugOn' : 'debugOff'); $this->set('me', array()); throw new ForbiddenException($message); } - + private function __customAuthentication(&$server) { $result = false; if (Configure::read('Plugin.CustomAuth_enable')) { @@ -637,7 +637,7 @@ class AppController extends Controller { } return $result; } - + public function cleanModelCaches() { if (!$this->_isSiteAdmin() || !$this->request->is('post')) throw new MethodNotAllowedException(); $this->loadModel('Server'); diff --git a/app/Controller/AttributesController.php b/app/Controller/AttributesController.php index 7a4de7788..47c35dc5f 100644 --- a/app/Controller/AttributesController.php +++ b/app/Controller/AttributesController.php @@ -57,7 +57,7 @@ class AttributesController extends AppController { $this->paginate = Set::merge($this->paginate, array('conditions' => $this->Attribute->buildConditions($this->Auth->user()))); } } - + /** * index method * @@ -99,7 +99,7 @@ class AttributesController extends AppController { if ($this->request->is('ajax')) $this->autoRender = false; $this->loadModel('Event'); $date = new DateTime(); - + // remove the published flag from the event $this->Event->recursive = -1; if (isset($eventId)) { @@ -168,7 +168,7 @@ class AttributesController extends AppController { // list the ones that succeeded $this->Session->setFlash(__('The lines' . $successes . ' have been saved', true)); } - + $this->redirect(array('controller' => 'events', 'action' => 'view', $this->request->data['Attribute']['event_id'])); } } else { @@ -192,7 +192,7 @@ class AttributesController extends AppController { $this->request->data['Attribute']['timestamp'] = $date->getTimestamp(); } } - + if (isset($this->request->data['Attribute']['base64'])) $this->request->data['Attribute']['data'] = $this->request->data['Attribute']['base64']; // // single attribute @@ -261,11 +261,11 @@ class AttributesController extends AppController { $this->loadModel('SharingGroup'); $sgs = $this->SharingGroup->fetchAllAuthorised($this->Auth->user(), 'name', 1); $this->set('sharingGroups', $sgs); - + $distributionLevels = $this->Attribute->distributionLevels; if (empty($sgs)) unset ($distributionLevels[4]); $this->set('distributionLevels', $distributionLevels); - + $this->set('attrDescriptions', $this->Attribute->fieldDescriptions); $this->set('typeDefinitions', $this->Attribute->typeDefinitions); $this->set('categoryDefinitions', $this->Attribute->categoryDefinitions); @@ -327,9 +327,9 @@ class AttributesController extends AppController { $partialFails = array(); $fails = array(); $success = 0; - + foreach ($this->request->data['Attribute']['values'] as $k => $value) { - + // Check if there were problems with the file upload // only keep the last part of the filename, this should prevent directory attacks $filename = basename($value['name']); @@ -343,7 +343,7 @@ class AttributesController extends AppController { $fails[] = $filename; continue; } - + if ($this->request->data['Attribute']['malware']) { $result = $this->Event->Attribute->handleMaliciousBase64($this->request->data['Attribute']['event_id'], $filename, base64_encode($tmpfile->read()), array_keys($hashes)); if (!$result['success']) { @@ -397,7 +397,7 @@ class AttributesController extends AppController { else $success++; } } - + $message = 'The attachment(s) have been uploaded.'; if (!empty($partialFails)) $message .= ' Some of the hashes however could not be generated.'; if (!empty($fails)) $message = 'Some of the attachments failed to upload. The failed files were: ' . implode(', ', $fails) . ' - This can be caused by the attachments already existing in the event.'; @@ -413,7 +413,7 @@ class AttributesController extends AppController { // set the event_id in the form $this->request->data['Attribute']['event_id'] = $eventId; } - + // combobox for categories $categories = array_keys($this->Attribute->categoryDefinitions); // just get them with attachments.. @@ -432,29 +432,29 @@ class AttributesController extends AppController { } $categories = $this->_arrayToValuesIndexArray($selectedCategories); $this->set('categories',$categories); - + $this->set('attrDescriptions', $this->Attribute->fieldDescriptions); $this->set('typeDefinitions', $this->Attribute->typeDefinitions); $this->set('categoryDefinitions', $this->Attribute->categoryDefinitions); - + $this->set('zippedDefinitions', $this->Attribute->zippedDefinitions); $this->set('uploadDefinitions', $this->Attribute->uploadDefinitions); - + // combobox for distribution $this->loadModel('Event'); $this->set('distributionDescriptions', $this->Attribute->distributionDescriptions); $this->set('distributionLevels', $this->Event->Attribute->distributionLevels); - + $this->loadModel('SharingGroup'); $sgs = $this->SharingGroup->fetchAllAuthorised($this->Auth->user(), 'name', 1); $this->set('sharingGroups', $sgs); - + $events = $this->Event->findById($eventId); $this->set('currentDist', $events['Event']['distribution']); $this->set('published', $events['Event']['published']); } - - + + /** * Imports the CSV threatConnect file to multiple attributes * @param int $id The id of the event @@ -505,7 +505,7 @@ class AttributesController extends AppController { } // verify header of the file (first row) $required_headers = array('Type', 'Value', 'Confidence', 'Description', 'Source'); - + if (count(array_intersect($header, $required_headers)) != count($required_headers)) { $this->Session->setFlash('Incorrect ThreatConnect headers. The minimum required headers are: '.implode(',', $required_headers), 'default', array(), 'error'); $this->redirect(array('controller' => 'attributes', 'action' => 'add_threatconnect', $this->request->data['Attribute']['event_id'])); @@ -744,20 +744,20 @@ class AttributesController extends AppController { $this->set('currentDist', $this->Event->data['Event']['distribution']); // tooltip for distribution $this->set('distributionDescriptions', $this->Attribute->distributionDescriptions); - + $this->loadModel('SharingGroup'); $sgs = $this->SharingGroup->fetchAllAuthorised($this->Auth->user(), 'name', 1); $this->set('sharingGroups', $sgs); - + $distributionLevels = $this->Attribute->distributionLevels; if (empty($sgs)) unset ($distributionLevels[4]); $this->set('distributionLevels', $distributionLevels); - + $this->set('attrDescriptions', $this->Attribute->fieldDescriptions); $this->set('typeDefinitions', $this->Attribute->typeDefinitions); $this->set('categoryDefinitions', $this->Attribute->categoryDefinitions); } - + // ajax edit - post a single edited field and this method will attempt to save it and return a json with the validation errors if they occur. public function editField($id) { if ((!$this->request->is('post') && !$this->request->is('put')) || !$this->request->is('ajax')) throw new MethodNotAllowedException(); @@ -768,7 +768,7 @@ class AttributesController extends AppController { $this->Attribute->recursive = -1; $this->Attribute->contain('Event'); $attribute = $this->Attribute->read(); - + if (!$this->_isSiteAdmin()) { if ($this->Attribute->data['Event']['orgc_id'] == $this->Auth->user('org_id') && (($this->userRole['perm_modify'] && $this->Attribute->data['Event']['user_id'] != $this->Auth->user('id')) @@ -778,7 +778,7 @@ class AttributesController extends AppController { return new CakeResponse(array('body'=> json_encode(array('fail' => false, 'errors' => 'Invalid attribute')),'status'=>200)); } } - + foreach ($this->request->data['Attribute'] as $changedKey => $changedField) { if ($attribute['Attribute'][$changedKey] == $changedField) { $this->autoRender = false; @@ -907,7 +907,7 @@ class AttributesController extends AppController { } } - + /** * unification of the actual delete for the multi-select * @@ -931,7 +931,7 @@ class AttributesController extends AppController { )), )); if (empty($result)) throw new MethodNotAllowedException('Attribute not found or not authorised.'); - + // check for permissions if (!$this->_isSiteAdmin()) { if ($result['Event']['locked']) { @@ -957,7 +957,7 @@ class AttributesController extends AppController { // We have just deleted the attribute, let's also check if there are any shadow attributes that were attached to it and delete them $this->loadModel('ShadowAttribute'); $this->ShadowAttribute->deleteAll(array('ShadowAttribute.old_id' => $id), false); - + // remove the published flag from the event $result['Event']['timestamp'] = $date->getTimestamp(); $result['Event']['published'] = false; @@ -967,7 +967,7 @@ class AttributesController extends AppController { return false; } } - + public function deleteSelected($id) { if (!$this->request->is('post') || !$this->request->is('ajax')) { throw new MethodNotAllowedException(); @@ -1004,10 +1004,10 @@ class AttributesController extends AppController { return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => count($successes) . ' attribute' . (count($successes) != 1 ? 's' : '') . ' deleted, but ' . count($fails) . ' attribute' . (count($fails) != 1 ? 's' : '') . ' could not be deleted.')),'status'=>200)); } } - + public function editSelected($id) { if (!$this->request->is('ajax')) throw new MethodNotAllowedException('This method can only be accessed via AJAX.'); - + if ($this->request->is('post')) { $event = $this->Attribute->Event->find('first', array( 'conditions' => array('id' => $id), @@ -1027,12 +1027,12 @@ class AttributesController extends AppController { ), 'recursive' => -1, )); - + if ($this->request->data['Attribute']['to_ids'] == 2 && $this->request->data['Attribute']['distribution'] == 6 && $this->request->data['Attribute']['comment'] == null) { $this->autoRender = false; return new CakeResponse(array('body'=> json_encode(array('saved' => true)),'status' => 200)); } - + if ($this->request->data['Attribute']['to_ids'] != 2) { foreach ($attributes as &$attribute) { $attribute['Attribute']['to_ids'] = ($this->request->data['Attribute']['to_ids'] == 0 ? false : true); @@ -1053,19 +1053,19 @@ class AttributesController extends AppController { } } } - + if ($this->request->data['Attribute']['comment'] != null) { foreach ($attributes as &$attribute) { $attribute['Attribute']['comment'] = $this->request->data['Attribute']['comment']; } } - + $date = new DateTime(); $timestamp = $date->getTimestamp(); foreach ($attributes as &$attribute) { $attribute['Attribute']['timestamp'] = $timestamp; } - + if($this->Attribute->saveMany($attributes)) { $event['Event']['timestamp'] = $date->getTimestamp(); $event['Event']['published'] = 0; @@ -1364,7 +1364,7 @@ class AttributesController extends AppController { $this->loadModel('Whitelist'); $attributes = $this->Whitelist->removeWhitelistedFromArray($attributes, true); } - + foreach ($attributes as &$attribute) { $attributeIdList[] = $attribute['Attribute']['id']; if (!in_array($attribute['Attribute']['event_id'], $idList)) { @@ -1383,7 +1383,7 @@ class AttributesController extends AppController { $this->Session->write('paginate_conditions_category', $category); $this->Session->write('search_find_idlist', $idList); $this->Session->write('search_find_attributeidlist', $attributeIdList); - + // set the same view as the index page $this->render('index'); } @@ -1429,7 +1429,7 @@ class AttributesController extends AppController { $this->render('index'); } } - + // If the checkbox for the alternate search is ticked, then this method is called to return the data to be represented // This alternate view will show a list of events with matching search results and the percentage of those matched attributes being marked as to_ids // events are sorted based on relevance (as in the percentage of matches being flagged as indicators for IDS) @@ -1472,7 +1472,7 @@ class AttributesController extends AppController { if (!empty($events)) $events = $this->__subval_sort($events, 'relevance'); return $events; } - + // Sort the array of arrays based on a value of a sub-array private function __subval_sort($a,$subkey) { foreach($a as $k=>$v) { @@ -1538,7 +1538,7 @@ class AttributesController extends AppController { if ($from) $from = $this->Attribute->Event->dateFieldCheck($from); if ($to) $to = $this->Attribute->Event->dateFieldCheck($to); if ($last) $last = $this->Attribute->Event->resolveTimeDelta($last); - + if (!isset($this->request->params['ext']) || $this->request->params['ext'] !== 'json') { $this->response->type('xml'); // set the content type $this->layout = 'xml/default'; @@ -1602,7 +1602,7 @@ class AttributesController extends AppController { $subcondition = array(); } } - + // If we sent any tags along, load the associated tag names for each attribute if ($tags) { $args = $this->Attribute->dissectArgs($tags); @@ -1619,11 +1619,11 @@ class AttributesController extends AppController { } $conditions['AND'][] = $temp; } - + if ($from) $conditions['AND'][] = array('Event.date >=' => $from); if ($to) $conditions['AND'][] = array('Event.date <=' => $to); if ($last) $conditions['AND'][] = array('Event.publish_timestamp >=' => $last); - + // change the fields here for the attribute export!!!! Don't forget to check for the permissions, since you are not going through fetchevent. Maybe create fetchattribute? $params = array( 'conditions' => $conditions, @@ -1797,7 +1797,7 @@ class AttributesController extends AppController { $this->set('attributes', $attributes); $this->render('/Attributes/text'); } - + public function rpz($key='download', $tags=false, $eventId=false, $from=false, $to=false, $policy=false, $walled_garden = false, $ns = false, $email = false, $serial = false, $refresh = false, $retry = false, $expiry = false, $minimum_ttl = false, $ttl = false) { // request handler for POSTed queries. If the request is a post, the parameters (apart from the key) will be ignored and replaced by the terms defined in the posted json or xml object. // The correct format for both is a "request" root element, as shown by the examples below: @@ -1817,7 +1817,7 @@ class AttributesController extends AppController { else ${$p} = null; } } - + $simpleFalse = array('eventId', 'tags', 'from', 'to', 'policy', 'walled_garden', 'ns', 'email', 'serial', 'refresh', 'retry', 'expiry', 'minimum_ttl', 'ttl'); foreach ($simpleFalse as $sF) { if (!is_array(${$sF}) && (${$sF} === 'null' || ${$sF} == '0' || ${$sF} === false || strtolower(${$sF}) === 'false')) ${$sF} = false; @@ -1880,7 +1880,7 @@ class AttributesController extends AppController { if (!self::_isSiteAdmin()) throw new NotFoundException(); $this->set('result', $this->Attribute->reportValidationIssuesAttributes($eventId)); } - + public function generateCorrelation() { if (!self::_isSiteAdmin() || !$this->request->is('post')) throw new NotFoundException(); if (!Configure::read('MISP.background_jobs')) { @@ -1911,7 +1911,7 @@ class AttributesController extends AppController { $this->redirect(array('controller' => 'pages', 'action' => 'display', 'administration')); } } - + public function fetchViewValue($id, $field = null) { $validFields = array('value', 'comment', 'type', 'category', 'to_ids', 'distribution', 'timestamp'); if (!isset($field) || !in_array($field, $validFields)) throw new MethodNotAllowedException('Invalid field requested.'); @@ -1943,7 +1943,7 @@ class AttributesController extends AppController { $this->layout = 'ajax'; $this->render('ajax/attributeViewFieldForm'); } - + public function fetchEditForm($id, $field = null) { $validFields = array('value', 'comment', 'type', 'category', 'to_ids', 'distribution'); if (!isset($field) || !in_array($field, $validFields)) throw new MethodNotAllowedException('Invalid field requested.'); @@ -1999,7 +1999,7 @@ class AttributesController extends AppController { $fieldURL = ucfirst($field); $this->render('ajax/attributeEdit' . $fieldURL . 'Form'); } - + public function attributeReplace($id) { if (!$this->userRole['perm_add']) { @@ -2015,7 +2015,7 @@ class AttributesController extends AppController { if ($this->request->is('get')) { $this->layout = 'ajax'; $this->request->data['Attribute']['event_id'] = $id; - + // combobox for types $types = array_keys($this->Attribute->typeDefinitions); $types = $this->_arrayToValuesIndexArray($types); @@ -2030,14 +2030,14 @@ class AttributesController extends AppController { } if ($this->request->is('post')) { if (!$this->request->is('ajax')) throw new MethodNotAllowedException('This action can only be accessed via AJAX.'); - + $newValues = explode(PHP_EOL, $this->request->data['Attribute']['value']); $category = $this->request->data['Attribute']['category']; $type = $this->request->data['Attribute']['type']; $to_ids = $this->request->data['Attribute']['to_ids']; - + if (!$this->_isSiteAdmin() && $this->Auth->user('org_id') != $event['Event']['orgc_id'] && !$this->userRole['perm_add']) throw new MethodNotAllowedException('You are not authorised to do that.'); - + $oldAttributes = $this->Attribute->find('all', array( 'conditions' => array( 'event_id' => $id, @@ -2048,7 +2048,7 @@ class AttributesController extends AppController { 'recursive' => -1, )); $results = array('untouched' => count($oldAttributes), 'created' => 0, 'deleted' => 0, 'createdFail' => 0, 'deletedFail' => 0); - + foreach ($newValues as &$value) { $value = trim($value); $found = false; @@ -2074,7 +2074,7 @@ class AttributesController extends AppController { } } } - + foreach ($oldAttributes as &$old) { if (!in_array($old['Attribute']['value'], $newValues)) { if ($this->Attribute->delete($old['Attribute']['id'])) { @@ -2101,26 +2101,26 @@ class AttributesController extends AppController { $message .= 'Update completed with some errors.'; $success = false; } - + if ($results['created']) $message .= $results['created'] . ' attribute' . $this->__checkCountForOne($results['created']) . ' created. '; if ($results['createdFail']) $message .= $results['createdFail'] . ' attribute' . $this->__checkCountForOne($results['createdFail']) . ' could not be created. '; if ($results['deleted']) $message .= $results['deleted'] . ' attribute' . $this->__checkCountForOne($results['deleted']) . ' deleted.'; if ($results['deletedFail']) $message .= $results['deletedFail'] . ' attribute' . $this->__checkCountForOne($results['deletedFail']) . ' could not be deleted. '; $message .= $results['untouched'] . ' attributes left untouched. '; - + $this->autoRender = false; $this->layout = 'ajax'; if ($success) return new CakeResponse(array('body'=> json_encode(array('saved' => true, 'success' => $message)),'status'=>200)); else return new CakeResponse(array('body'=> json_encode(array('saved' => true, 'errors' => $message)),'status'=>200)); } } - + private function __checkCountForOne($number) { if ($number != 1) return 's'; return ''; } - + // download a sample by passing along an md5 public function downloadSample($hash=false, $allSamples=false, $eventID=false) { if (!$this->userRole['perm_auth']) throw new MethodNotAllowedException('This functionality requires API key access.'); @@ -2137,13 +2137,13 @@ class AttributesController extends AppController { if (!$eventID && isset($data['request']['eventID'])) $eventID = $data['request']['eventID']; if (!$eventID && !$hash) throw new MethodNotAllowedException('No hash or event ID received. You need to set at least one of the two.'); if (!$hash) $allSamples = true; - - + + $simpleFalse = array('hash', 'allSamples', 'eventID'); foreach ($simpleFalse as $sF) { if (!is_array(${$sF}) && (${$sF} === 'null' || ${$sF} == '0' || ${$sF} === false || strtolower(${$sF}) === 'false')) ${$sF} = false; } - + // valid combinations of settings are: // hash // eventID + all samples @@ -2191,9 +2191,9 @@ class AttributesController extends AppController { } } } - + if (!empty($eventID)) $searchConditions['AND'][] = array('Event.id' => $eventID); - + if (empty($error)) { $attributes = $this->Attribute->fetchAttributes( $this->Auth->user(), @@ -2209,7 +2209,7 @@ class AttributesController extends AppController { ) ); if (empty($attributes)) $error = 'No hits with the given parameters.'; - + $results = array(); foreach ($attributes as $attribute) { $found = false; @@ -2239,7 +2239,7 @@ class AttributesController extends AppController { $this->set('_serialize', array('message')); } } - + public function pruneOrphanedAttributes() { if (!$this->_isSiteAdmin() || !$this->request->is('post')) throw new MethodNotAllowedException('You are not authorised to do that.'); $events = array_keys($this->Attribute->Event->find('list')); @@ -2248,7 +2248,7 @@ class AttributesController extends AppController { $this->Session->setFlash('Removed ' . count($orphans) . ' attribute(s).'); $this->redirect('/pages/display/administration'); } - + public function updateAttributeValues($script) { if (!$this->_isSiteAdmin() || !$this->request->is('post')) throw new MethodNotAllowedException('You are not authorised to do that.'); switch ($script) { @@ -2283,7 +2283,7 @@ class AttributesController extends AppController { $this->Session->setFlash('Updated ' . $counter . ' attribute(s).'); $this->redirect('/pages/display/administration'); } - + public function hoverEnrichment($id) { $attribute = $this->Attribute->fetchAttributes($this->Auth->user(), array('conditions' => array('Attribute.id' => $id))); if (empty($attribute)) throw new NotFoundException('Invalid Attribute'); @@ -2342,7 +2342,7 @@ class AttributesController extends AppController { $this->layout = 'ajax'; $this->render('ajax/hover_enrichment'); } - + public function describeTypes() { $result = array(); $result['types'] = array_keys($this->Attribute->typeDefinitions); @@ -2353,7 +2353,7 @@ class AttributesController extends AppController { $this->set('result', $result); $this->set('_serialize', array('result')); } - + public function attributeStatistics($type = 'type', $percentage = false) { $validTypes = array('type', 'category'); if (!in_array($type, $validTypes)) throw new MethodNotAllowedException('Invalid type requested.'); diff --git a/app/Controller/Component/ACLComponent.php b/app/Controller/Component/ACLComponent.php index 4a710d8b1..c2a8e77c3 100644 --- a/app/Controller/Component/ACLComponent.php +++ b/app/Controller/Component/ACLComponent.php @@ -351,7 +351,7 @@ class ACLComponent extends Component { 'index' => array('*'), ) ); - + // The check works like this: // If the user is a site admin, return true // If the requested action has an OR-d list, iterate through the list. If any of the permissions are set for the user, return true @@ -374,7 +374,7 @@ class ACLComponent extends Component { } $this->__error(403, 'You do not have permission to use this functionality.'); } - + private function __error($code, $message) { switch ($code) { case 404: @@ -386,7 +386,7 @@ class ACLComponent extends Component { throw new InternalErrorException('Unknown error: ' . $message); } } - + private function __findAllFunctions() { $functionFinder = '/function[\s\n]+(\S+)[\s\n]*\(/'; $dir = new Folder(APP . 'Controller'); @@ -404,7 +404,7 @@ class ACLComponent extends Component { } return $results; } - + public function printAllFunctionNames($content = false) { $results = $this->__findAllFunctions(); ksort($results); @@ -423,7 +423,7 @@ class ACLComponent extends Component { } return $missing; } - + public function printRoleAccess($content = false) { $results = array(); $this->Role = ClassRegistry::init('Role'); @@ -440,7 +440,7 @@ class ACLComponent extends Component { } return $results; } - + private function __checkRoleAccess($role) { $result = array(); foreach ($this->__aclList as $controller => &$actions) { diff --git a/app/Controller/Component/Auth/ApacheAuthenticate.php b/app/Controller/Component/Auth/ApacheAuthenticate.php index d58b35dad..559056807 100644 --- a/app/Controller/Component/Auth/ApacheAuthenticate.php +++ b/app/Controller/Component/Auth/ApacheAuthenticate.php @@ -52,7 +52,7 @@ class ApacheAuthenticate extends BaseAuthenticate { $filter = '('.Configure::read('ApacheSecureAuth.ldapSearchAttribut').'=' . $_SERVER[$envvar] . ')'; // example: mail $getLdapUserInfo = Configure::read('ApacheSecureAuth.ldapFilter'); - + $result = ldap_search($ldapconn, $ldapdn, $filter, $getLdapUserInfo) or die("Error in LDAP search query: " . ldap_error($ldapconn)); @@ -90,7 +90,7 @@ class ApacheAuthenticate extends BaseAuthenticate { ); $org_id = $firstOrg['Organisation']['id']; } - + // create user $userData = array('User' => array( 'email' => $mispUsername, diff --git a/app/Controller/Component/BlackListComponent.php b/app/Controller/Component/BlackListComponent.php index 6a0c7a1cc..574e6f0e1 100644 --- a/app/Controller/Component/BlackListComponent.php +++ b/app/Controller/Component/BlackListComponent.php @@ -70,7 +70,7 @@ class BlackListComponent extends Component { } } } - + public function edit($rest = false, $id) { if (strlen($id) == 36) { $blockEntry = $this->controller->{$this->controller->defaultModel}->find('first', array('conditions' => array('uuid' => $id))); @@ -126,7 +126,7 @@ class BlackListComponent extends Component { if (!$this->controller->request->is('post') && !$rest) { throw new MethodNotAllowedException(); } - + $this->controller->{$this->controller->defaultModel}->id = $id; if (!$this->controller->{$this->controller->defaultModel}->exists()) { throw new NotFoundException(__('Invalid blacklist entry')); @@ -149,7 +149,7 @@ class BlackListComponent extends Component { public function startup(Controller $controller) { $this->controller = $controller; } - + public function __construct(ComponentCollection $collection, $settings = array()) { $this->settings = Set::merge($this->settings, $settings); parent::__construct($collection, $this->settings); diff --git a/app/Controller/Component/IOCImportComponent.php b/app/Controller/Component/IOCImportComponent.php index 66d9ffea1..58c923152 100644 --- a/app/Controller/Component/IOCImportComponent.php +++ b/app/Controller/Component/IOCImportComponent.php @@ -1,14 +1,14 @@ true, 'regkey|value' => true, ); - + // Set up the data that you would like to fetch from the ioc's root and add as comments. private $iocinfo = array('info', 'uuid', 'date', 'long_info'); @@ -123,7 +123,7 @@ class IOCImportComponent extends Component { // stores the graph that will be passed back along with the event and attributes private $graph = array(); - + private $filename = ""; public function readXML($data, $id, $dist, $filename) { @@ -587,7 +587,7 @@ class IOCImportComponent extends Component { $values[] = $temp['value']; $uuids[] = $temp['uuid']; } - + foreach ($this->attributeComposition as $composition) { if (count($composition['components']) != count($att)) continue; if ($keys === $composition['components']) { diff --git a/app/Controller/EventBlacklistsController.php b/app/Controller/EventBlacklistsController.php index c8074e7ed..81edc45c4 100644 --- a/app/Controller/EventBlacklistsController.php +++ b/app/Controller/EventBlacklistsController.php @@ -28,7 +28,7 @@ class EventBlacklistsController extends AppController { public function add() { $this->BlackList->add($this->_isRest()); } - + public function edit($id) { $this->BlackList->edit($this->_isRest(), $id); } diff --git a/app/Controller/EventDelegationsController.php b/app/Controller/EventDelegationsController.php index 95077831d..373dccab3 100644 --- a/app/Controller/EventDelegationsController.php +++ b/app/Controller/EventDelegationsController.php @@ -83,7 +83,7 @@ class EventDelegationsController extends AppController { $this->render('ajax/delegate_event'); } } - + public function acceptDelegation($id) { $delegation = $this->EventDelegation->find('first', array( 'conditions' => array('EventDelegation.id' => $id), @@ -128,7 +128,7 @@ class EventDelegationsController extends AppController { $this->render('ajax/accept_delegation'); } } - + public function deleteDelegation($id) { $delegation = $this->EventDelegation->find('first', array( 'conditions' => array('EventDelegation.id' => $id), @@ -145,6 +145,6 @@ class EventDelegationsController extends AppController { $this->render('ajax/delete_delegation'); } } - - + + } diff --git a/app/Controller/EventsController.php b/app/Controller/EventsController.php index 5886f6dc1..a3eb58ef9 100644 --- a/app/Controller/EventsController.php +++ b/app/Controller/EventsController.php @@ -36,7 +36,7 @@ class EventsController extends AppController { ); public $helpers = array('Js' => array('Jquery')); - + public $paginationFunctions = array('index', 'proposalEventIndex'); public function beforeFilter() { @@ -107,7 +107,7 @@ class EventsController extends AppController { $this->paginate = Set::merge($this->paginate,array('conditions' => $conditions)); } } - + private function __filterOnAttributeValue($value) { // dissect the value $pieces = explode('|', $value); @@ -135,13 +135,13 @@ class EventsController extends AppController { } $includeQuery['conditions']['AND'][] = array('Attribute.deleted' => false); $includeHits = $this->Event->Attribute->find('all', $includeQuery); - + // convert it into an array that uses the event ID as a key foreach ($includeHits as $iH) { $includeIDs[$iH['Attribute']['event_id']][] = array('attribute_id' => $iH['Attribute']['id'], 'distribution' => $iH['Attribute']['distribution']); } } - + if (!empty($exclude)) { // get all of the attributes that should be excluded $excludeQuery = array( @@ -155,7 +155,7 @@ class EventsController extends AppController { } $excludeQuery['conditions']['AND'][] = array('Attribute.deleted' => false); $excludeHits = $this->Event->Attribute->find('all', $excludeQuery); - + // convert it into an array that uses the event ID as a key foreach ($excludeHits as $eH) { $excludeIDs[$eH['Attribute']['event_id']][] = array('attribute_id' => $eH['Attribute']['id'], 'distribution' => $eH['Attribute']['distribution']); @@ -169,7 +169,7 @@ class EventsController extends AppController { } return array($includeIDs, $excludeIDs); } - + private function __quickFilter($value) { $result = array(); // get all of the attributes that have a hit on the search term, in either the value or the comment field @@ -193,18 +193,18 @@ class EventsController extends AppController { foreach ($attributeHits as $aH) { $eventsWithAttributeHits[$aH['Attribute']['event_id']][] = $aH['Attribute']; } - + // Using the keys from the previously obtained ordered array, let's fetch all of the events involved $events = $this->Event->find('all', array( 'recursive' => -1, 'fields' => array('id', 'distribution', 'org_id'), 'conditions' => array('id' => array_keys($eventsWithAttributeHits)), )); - + foreach ($events as $event) { $result[] = $event['Event']['id']; } - + // we now have a list of event IDs that match on an attribute level, and the user can see it. Let's also find all of the events that match on other criteria! // What is interesting here is that we no longer have to worry about the event's releasability. With attributes this was a different case, // because we might run into a situation where a user can see an event but not a specific attribute @@ -372,14 +372,14 @@ class EventsController extends AppController { 'fields' => array('id', 'name'), 'recursive' => -1, )); - + if (empty($tagName)) { if ($filterString != "") $filterString .= "|"; $filterString .= '!' . $piece; continue; } - - + + $block = $this->Event->EventTag->find('all', array( 'conditions' => array('EventTag.tag_id' => $tagName['Tag']['id']), 'fields' => 'event_id', @@ -397,13 +397,13 @@ class EventsController extends AppController { } else { $conditions = array('OR' => array('Tag.name' => $piece)); } - + $tagName = $this->Event->EventTag->Tag->find('first', array( 'conditions' => $conditions, 'fields' => array('id', 'name'), 'recursive' => -1, )); - + if (empty($tagName)) { if ($filterString != "") $filterString .= "|"; $filterString .= $piece; @@ -452,7 +452,7 @@ class EventsController extends AppController { if (!empty($users)) $test['OR'][] = array('Event.user_id' => array_keys($users)); } } - + if (!empty($test)) $this->paginate['conditions']['AND'][] = $test; break; case 'distribution' : @@ -552,7 +552,7 @@ class EventsController extends AppController { if (Configure::read('MISP.showCorrelationsOnIndex')) $this->Event->attachCorrelationCountToEvents($this->Auth->user(), $events); $this->set('events', $events); } - + if (!$this->Event->User->getPGP($this->Auth->user('id')) && Configure::read('GnuPG.onlyencrypted')) { // No GPG if (Configure::read('SMIME.enabled') && !$this->Event->User->getCertificate($this->Auth->user('id'))) { @@ -576,10 +576,10 @@ class EventsController extends AppController { $this->set('shortDist', $this->Event->shortDist); $this->set('ajax', $this->request->is('ajax')); } - + public function filterEventIndex() { $passedArgsArray = array(); - + $filtering = array( 'published' => 2, 'org' => array('OR' => array(), 'NOT' => array()), @@ -592,7 +592,7 @@ class EventsController extends AppController { 'analysis' => array('OR' => array(), 'NOT' => array()), 'attribute' => array('OR' => array(), 'NOT' => array()), ); - + if ($this->_isSiteAdmin()) $filtering['email'] = array('OR' => array(), 'NOT' => array()); foreach ($this->passedArgs as $k => $v) { @@ -667,7 +667,7 @@ class EventsController extends AppController { $this->set('baseurl', Configure::read('MISP.baseurl')); $this->layout = 'ajax'; } - + public function viewEventAttributes($id, $all = false) { $conditions = array('eventid' => $id); if (isset($this->params['named']['deleted']) && $this->params['named']['deleted']) { @@ -706,7 +706,7 @@ class EventsController extends AppController { $this->set('currentUri', $this->params->here); $this->render('/Elements/eventattribute'); } - + private function __viewUI($event, $continue, $fromEvent) { // set the data for the contributors / history field $org_ids = $this->Event->ShadowAttribute->getEventContributors($event['Event']['id']); @@ -737,7 +737,7 @@ class EventsController extends AppController { $this->__setDeletable($pivot, $event['Event']['id'], true); $this->set('allPivots', $this->Session->read('pivot_thread')); $this->set('pivot', $pivot); - + // set data for the view, the event is already set in view() $dataForView = array( 'Attribute' => array('attrDescriptions' => 'fieldDescriptions', 'distributionDescriptions' => 'distributionDescriptions', 'distributionLevels' => 'distributionLevels', 'shortDist' => 'shortDist'), @@ -758,7 +758,7 @@ class EventsController extends AppController { } } } - + foreach ($dataForView as $m => $variables) { if ($m === 'Event') { $currentModel = $this->Event; @@ -797,7 +797,7 @@ class EventsController extends AppController { 'recursive' => -1, 'contain' => array('Org', 'RequesterOrg')))); } - + if (Configure::read('Plugin.Enrichment_services_enable')) { $this->loadModel('Server'); $modules = $this->Server->getEnabledModules(); @@ -806,7 +806,7 @@ class EventsController extends AppController { $this->set('contributors', $contributors); $this->set('typeGroups', array_keys($this->Event->Attribute->typeGroupings)); } - + /** * view method * @@ -823,12 +823,12 @@ class EventsController extends AppController { if ($temp == null) throw new NotFoundException('Invalid event'); $id = $temp['Event']['id']; } - + $this->Event->id = $id; if(!$this->Event->exists()) { throw new NotFoundException(__('Invalid event.')); } - + $conditions = array('eventid' => $id); if (!$this->_isRest()) { $conditions['includeAllTags'] = true; @@ -847,7 +847,7 @@ class EventsController extends AppController { $this->set('deleted', isset($this->params['named']['deleted']) && $this->params['named']['deleted']); if (!$this->_isRest()) $this->__viewUI($event, $continue, $fromEvent); } - + private function __startPivoting($id, $info, $date){ $this->Session->write('pivot_thread', null); $initial_pivot = array('id' => $id, 'info' => $info, 'date' => $date, 'depth' => 0, 'height' => 0, 'children' => array(), 'deletable' => true); @@ -958,10 +958,10 @@ class EventsController extends AppController { $sgs = $this->Event->SharingGroup->fetchAllAuthorised($this->Auth->user(), 'name', 1); if ($this->request->is('post')) { if ($this->_isRest()) { - + // rearrange the response if the event came from an export if(isset($this->request->data['response'])) $this->request->data = $this->request->data['response']; - + // Distribution, reporter for the events pushed will be the owner of the authentication key $this->request->data['Event']['user_id'] = $this->Auth->user('id'); } @@ -1049,7 +1049,7 @@ class EventsController extends AppController { } $this->request->data['Event']['date'] = date('Y-m-d'); - + // combobox for distribution $distributions = array_keys($this->Event->distributionDescriptions); $distributions = $this->_arrayToValuesIndexArray($distributions); @@ -1232,11 +1232,11 @@ class EventsController extends AppController { // even if the SG is not local, we still want the option to select the currently assigned SG $sgs = $this->Event->SharingGroup->fetchAllAuthorised($this->Auth->user(), 'name', 1); $this->set('sharingGroups', $sgs); - + $distributionLevels = $this->Event->distributionLevels; if (empty($sgs)) unset ($distributionLevels[4]); $this->set('distributionLevels', $distributionLevels); - + // combobox for types $threat_levels = $this->Event->ThreatLevel->find('all'); $this->set('threatLevels', Set::combine($threat_levels, '{n}.ThreatLevel.id', '{n}.ThreatLevel.name')); @@ -1276,7 +1276,7 @@ class EventsController extends AppController { // find the uuid $result = $this->Event->findById($id); $this->Event->read(); - + if (!$this->_isSiteAdmin()) { if ($this->Event->data['Event']['orgc_id'] != $this->_checkOrg() || !$this->userRole['perm_modify']) { throw new MethodNotAllowedException(); @@ -1289,7 +1289,7 @@ class EventsController extends AppController { } else { // delete the event from remote servers $this->Session->setFlash(__('Event deleted')); - + // if coming from index, redirect to referer (to have the filter working) // else redirect to index if (strpos($this->referer(), '/view') !== FALSE) { @@ -1466,7 +1466,7 @@ class EventsController extends AppController { // Check if the background jobs are enabled - if not, fall back to old export page. if (Configure::read('MISP.background_jobs')) { $now = time(); - + // as a site admin we'll use the ADMIN identifier, not to overwrite the cached files of our own org with a file that includes too much data. if ($this->_isSiteAdmin()) { $useOrg = 'ADMIN'; @@ -1512,7 +1512,7 @@ class EventsController extends AppController { $this->Event->export_types[$k]['recommendation'] = 1; } } - + $this->Event->export_types[$k]['lastModified'] = $lastModified; if (!empty($job)) { $this->Event->export_types[$k]['job_id'] = $job['Job']['id']; @@ -1544,7 +1544,7 @@ class EventsController extends AppController { $path = 'tmp/cached_exports/' . $type . DS . 'misp.' . strtolower($this->Event->export_types[$type]['type']) . $extra . '.' . $org . $this->Event->export_types[$type]['extension']; $this->response->file($path, array('download' => true)); } - + private function __timeDifference($now, $then) { $periods = array("second", "minute", "hour", "day", "week", "month", "year"); $lengths = array("60","60","24","7","4.35","12"); @@ -1563,7 +1563,7 @@ class EventsController extends AppController { App::uses('XMLConverterTool', 'Tools'); $converter = new XMLConverterTool(); $this->loadModel('Whitelist'); - + // request handler for POSTed queries. If the request is a post, the parameters (apart from the key) will be ignored and replaced by the terms defined in the posted xml object. // The correct format for a posted xml is a "request" root element, as shown by the examples below: // For XML: 7.7.7.7&&1.1.1.1ip-src @@ -1582,7 +1582,7 @@ class EventsController extends AppController { } } } - + $simpleFalse = array('tags', 'eventid', 'withAttachment', 'from', 'to', 'last'); foreach ($simpleFalse as $sF) { if (!is_array(${$sF}) && (${$sF} === 'null' || ${$sF} == '0' || ${$sF} === false || strtolower(${$sF}) === 'false')) { @@ -1594,12 +1594,12 @@ class EventsController extends AppController { if ($tags) $tags = str_replace(';', ':', $tags); if ($last) $last = $this->Event->resolveTimeDelta($last); $eventIdArray = array(); - + if ($eventid) { if (!is_numeric($eventid)) throw new MethodNotAllowedException('Invalid Event ID.'); $eventIdArray[] = $eventid; } - + if ($key != 'download') { // check if the key is valid -> search for users based on key $user = $this->checkAuthUser($key); @@ -1612,7 +1612,7 @@ class EventsController extends AppController { } $user = $this->Auth->user(); } - + if ($eventid) { $final_filename='misp.event' . $eventid . '.export.xml'; } else { @@ -1663,7 +1663,7 @@ class EventsController extends AppController { ${$sF} = false; } } - + if ($from) $from = $this->Event->dateFieldCheck($from); if ($to) $to = $this->Event->dateFieldCheck($to); if ($tags) $tags = str_replace(';', ':', $tags); @@ -1729,7 +1729,7 @@ class EventsController extends AppController { $rules = $this->Attribute->hids($this->Auth->user(), $type, $tags, $from, $to, $last); $this->set('rules', $rules); } - + // csv function // Usage: csv($key, $eventid) - key can be a valid auth key or the string 'download'. Download requires the user to be logged in interactively and will generate a .csv file // $eventid can be one of 3 options: left empty it will get all the visible to_ids attributes, @@ -1915,7 +1915,7 @@ class EventsController extends AppController { // we've already stored these elsewhere, unset them so we can extract the event related data unset($event['Attribute']); unset($event['Fails']); - + // add the original openIOC file as an attachment $saveEvent['Attribute'][] = array( 'category' => 'External analysis', @@ -2008,7 +2008,7 @@ class EventsController extends AppController { $this->loadModel('Attribute'); $this->Event->recursive = -1; $this->Event->read(array('id', 'uuid', 'distribution'), $id); - + // import XML class App::uses('Xml', 'Utility'); // now parse it @@ -2025,7 +2025,7 @@ class EventsController extends AppController { } else { // TODO: need a default value for $dist or throw an exception } - + // Payload delivery -- malware-sample $results = $parsedXml->xpath('/analysis'); foreach ($results as $result) { @@ -2038,7 +2038,7 @@ class EventsController extends AppController { $rootDir = APP . "files" . DS . $id . DS; $malware = $rootDir . DS . 'sample'; $this->Event->Attribute->uploadAttachment($malware, $realFileName, true, $id, null, '', $this->Event->data['Event']['uuid'] . '-sample', $dist, true); - + // Network activity -- .pcap $realFileName = 'analysis.pcap'; $rootDir = APP . "files" . DS . $id . DS; @@ -2249,7 +2249,7 @@ class EventsController extends AppController { ${$sF} = false; } } - + if ($from) $from = $this->Event->dateFieldCheck($from); if ($to) $to = $this->Event->dateFieldCheck($to); if ($tags) $tags = str_replace(';', ':', $tags); @@ -2419,7 +2419,7 @@ class EventsController extends AppController { $final = $this->IOCExport->buildAll($this->Auth->user(), $event); $this->set('final', $final); } - + public function create_dummy_event() { if (!$this->_isSiteAdmin() || !$this->request->is('post')) throw new MethodNotAllowedException('You don\'t have the privileges to access this.'); $data['Event']['info'] = 'Test event showing every category-type combination'; @@ -2485,7 +2485,7 @@ class EventsController extends AppController { } $this->Event->_add($data, false, $this->Auth->user()); } - + // for load testing, it's slow, execution time is set at 1 hour maximum public function create_massive_dummy_events() { if (!$this->_isSiteAdmin() || !$this->request->is('post')) throw new MethodNotAllowedException('You don\'t have the privileges to access this.'); @@ -2531,7 +2531,7 @@ class EventsController extends AppController { $this->Event->saveAssociated($data, array('validate' => false)); } } - + public function proposalEventIndex() { $this->loadModel('ShadowAttribute'); $this->ShadowAttribute->recursive = -1; @@ -2581,7 +2581,7 @@ class EventsController extends AppController { $this->set('analysisLevels', $this->Event->analysisLevels); $this->set('distributionLevels', $this->Event->distributionLevels); } - + public function reportValidationIssuesEvents() { // search for validation problems in the events if (!self::_isSiteAdmin()) throw new NotFoundException(); @@ -2591,7 +2591,7 @@ class EventsController extends AppController { $this->set('result', $result); $this->set('count', $count); } - + public function addTag($id = false, $tag_id = false) { if (!$this->request->is('post')) { return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'You don\'t have permission to do that.')), 'status'=>200)); @@ -2614,7 +2614,7 @@ class EventsController extends AppController { } $this->Event->recurisve = -1; $event = $this->Event->read(array('id', 'org_id', 'orgc_id', 'distribution', 'sharing_group_id'), $id); - + if (!$this->_isSiteAdmin() && !$this->userRole['perm_sync']) { if (!$this->userRole['perm_tagger'] || ($this->Auth->user('org_id') !== $event['Event']['org_id'] && $this->Auth->user('org_id') !== $event['Event']['orgc_id'])) { return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'You don\'t have permission to do that.')), 'status'=>200)); @@ -2642,7 +2642,7 @@ class EventsController extends AppController { return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'Tag could not be added.')),'status'=>200)); } } - + public function removeTag($id = false, $tag_id = false) { if (!$this->request->is('post')) { return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'You don\'t have permission to do that. Only POST requests are accepted.')), 'status'=>200)); @@ -2685,7 +2685,7 @@ class EventsController extends AppController { return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'Tag could not be removed.')),'status'=>200)); } } - + public function freeTextImport($id) { if (!$this->userRole['perm_add']) { throw new MethodNotAllowedException('Event not found or you don\'t have permissions to create attributes'); @@ -2700,7 +2700,7 @@ class EventsController extends AppController { $this->layout = 'ajax'; $this->request->data['Attribute']['event_id'] = $id; } - + if ($this->request->is('post')) { App::uses('ComplexTypeTool', 'Tools'); $complexTypeTool = new ComplexTypeTool(); @@ -2712,7 +2712,7 @@ class EventsController extends AppController { } $r['types'] = $temp; } - + // remove all duplicates foreach ($resultArray as $k => $v) { for ($i = 0; $i < $k; $i++) { @@ -2744,7 +2744,7 @@ class EventsController extends AppController { $this->render('resolved_attributes'); } } - + public function saveFreeText($id) { if (!$this->userRole['perm_add']) { throw new MethodNotAllowedException('Event not found or you don\'t have permissions to create attributes'); @@ -2825,7 +2825,7 @@ class EventsController extends AppController { throw new MethodNotAllowedException(); } } - + public function stix($key, $id = false, $withAttachments = false, $tags = false, $from = false, $to = false, $last = false) { if ($key != 'download') { // check if the key is valid -> search for users based on key @@ -2838,7 +2838,7 @@ class EventsController extends AppController { throw new UnauthorizedException('You have to be logged in to do that.'); } } - + // request handler for POSTed queries. If the request is a post, the parameters (apart from the key) will be ignored and replaced by the terms defined in the posted xml object. // The correct format for a posted xml is a "request" root element, as shown by the examples below: // For XML: !3&!4OSINT @@ -2855,7 +2855,7 @@ class EventsController extends AppController { else ${$p} = null; } } - + $simpleFalse = array('id', 'withAttachments', 'tags', 'from', 'to', 'last'); foreach ($simpleFalse as $sF) { if (!is_array(${$sF}) && (${$sF} === 'null' || ${$sF} == '0' || ${$sF} === false || strtolower(${$sF}) === 'false')) { @@ -2865,7 +2865,7 @@ class EventsController extends AppController { if ($from) $from = $this->Event->dateFieldCheck($from); if ($to) $to = $this->Event->dateFieldCheck($to); if ($last) $last = $this->Event->resolveTimeDelta($last); - + // set null if a null string is passed $numeric = false; if (is_numeric($id)) $numeric = true; @@ -2917,7 +2917,7 @@ class EventsController extends AppController { $this->set('result', array_keys($incomingEvents)); } } - + public function checkuuid($uuid) { if (!$this->userRole['perm_sync']) throw new MethodNotAllowedException('You do not have the permission to do that.'); $events = $this->Event->find('first', array( @@ -2927,7 +2927,7 @@ class EventsController extends AppController { )); $this->set('result', array('result' => empty($events))); } - + public function pushProposals($uuid) { $message= ""; $success = true; @@ -2988,7 +2988,7 @@ class EventsController extends AppController { $this->set('_serialize', 'data'); } } - + public function exportChoice($id) { if (!is_numeric($id)) throw new MethodNotAllowedException('Invalid ID'); $event = $this->Event->fetchEvent($this->Auth->user(), array('eventid' => $id)); @@ -3085,7 +3085,7 @@ class EventsController extends AppController { $this->set('id', $id); $this->render('ajax/exportChoice'); } - + // API for pushing samples to MISP // Either send it to an existing event, or let MISP create a new one automatically public function upload_sample($event_id = null) { @@ -3117,9 +3117,9 @@ class EventsController extends AppController { } else { throw new BadRequestException('Please POST the samples as described on the automation page.'); } - + if (isset($data['request'])) $data = $data['request']; - + foreach ($parameter_options as $k => $v) { if (isset($data[$k])) { if (isset($v['valid_options']) && !in_array($data[$k], $v['valid_options'])) { @@ -3129,7 +3129,7 @@ class EventsController extends AppController { $data[$k] = $v['default']; } } - + if (isset($data['files'])) { foreach ($data['files'] as $k => $file) { if (!isset($file['filename']) || !isset($file['data'])) { @@ -3139,7 +3139,7 @@ class EventsController extends AppController { } } } - + if (empty($data['files'])) { throw new BadRequestException('No samples received, or samples not in the correct format. Please refer to the API documentation on the automation page.'); } @@ -3148,7 +3148,7 @@ class EventsController extends AppController { $this->Event->id = $data['event_id']; if(!$this->Event->exists()) throw new NotFoundException('Event not found'); } - + // check if the user has permission to create attributes for an event, if the event ID has been passed // If not, create an event if (isset($data['event_id']) && !empty($data['event_id']) && is_numeric($data['event_id'])) { @@ -3289,14 +3289,14 @@ class EventsController extends AppController { $this->view($data['event_id']); $this->render('view'); } - + public function viewGraph($id) { $event = $this->Event->fetchEvent($this->Auth->user(), array('eventid' => $id)); if (empty($event)) throw new MethodNotAllowedException('Invalid Event.'); $this->set('event', $event[0]); $this->set('id', $id); } - + public function updateGraph($id) { if ($this->request->is('post')) { $json = $this->__buildGraphJson($id, $this->request->data); @@ -3306,7 +3306,7 @@ class EventsController extends AppController { $this->set('json', $json); $this->set('_serialize', 'json'); } - + private function __buildGraphJson($id, $json = array()) { $event = $this->Event->fetchEvent($this->Auth->user(), array('eventid' => $id)); if (empty($event)) return $json; @@ -3392,7 +3392,7 @@ class EventsController extends AppController { } return $json; } - + private function __cleanLinks($json) { if (isset($json['nodes']) && isset($json['links'])) { $links = array(); @@ -3408,14 +3408,14 @@ class EventsController extends AppController { } return $json; } - + private function __orgImgExists($org) { if (file_exists(APP . 'webroot' . DS . 'img' . DS . 'orgs' . DS . $org . '.png')) { return true; } return false; } - + private function __graphJsonContains($type, $att, $json) { if (!isset($json['nodes'])) return false; foreach ($json['nodes'] as $k => $node) { @@ -3437,7 +3437,7 @@ class EventsController extends AppController { } return false; } - + public function delegation_index() { $this->loadModel('EventDelegation'); $delegatedEvents = $this->EventDelegation->find('list', array( @@ -3462,7 +3462,7 @@ class EventsController extends AppController { 'Orgc' => array('fields' => array('id', 'name')), 'SharingGroup' => array('fields' => array('id', 'name')), 'ThreatLevel' => array('fields' => array('ThreatLevel.name')) - + ), 'conditions' => array('Event.id' => $delegatedEvents), ); @@ -3473,7 +3473,7 @@ class EventsController extends AppController { $this->set('eventDescriptions', $this->Event->fieldDescriptions); $this->set('analysisLevels', $this->Event->analysisLevels); $this->set('distributionLevels', $this->Event->distributionLevels); - + $shortDist = array(0 => 'Organisation', 1 => 'Community', 2 => 'Connected', 3 => 'All', 4 => ' sharing Group'); $this->set('shortDist', $shortDist); $this->set('ajax', false); @@ -3487,7 +3487,7 @@ class EventsController extends AppController { $this->set('tags', $tagNames); $this->render('index'); } - + // expects an attribute ID and the module to be used public function queryEnrichment($attribute_id, $module = false) { if (!Configure::read('Plugin.Enrichment_services_enable')) throw new MethodNotAllowedException('Enrichment services are not enabled.'); @@ -3582,7 +3582,7 @@ class EventsController extends AppController { if (isset($r['data'])) $temp['data'] = $r['data']; $resultArray[] = $temp; } - + } $resultArray = array_merge($resultArray, $freetextResults); } diff --git a/app/Controller/FavouriteTagsController.php b/app/Controller/FavouriteTagsController.php index 0fbeac79e..e504bcbe4 100644 --- a/app/Controller/FavouriteTagsController.php +++ b/app/Controller/FavouriteTagsController.php @@ -15,7 +15,7 @@ class FavouriteTagsController extends AppController { 'FavouriteTag.id' => 'DESC' ), ); - + public function toggle() { if (!$this->request->is('post')) throw new MethodNotAllowedException('This action is only available via POST requests.'); if (!is_numeric($this->request->data['FavouriteTag']['data'])) throw new MethodNotAllowedException('Invalid tag ID.'); @@ -38,7 +38,7 @@ class FavouriteTagsController extends AppController { return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'fails' => $message . ' has failed.')), 'status'=>200)); } } - + public function getToggleField() { if (!$this->request->is('ajax')) throw new MethodNotAllowedException('This action is available via AJAX only.'); $this->layout = 'ajax'; diff --git a/app/Controller/FeedsController.php b/app/Controller/FeedsController.php index 2b63ecd7a..f048f0655 100644 --- a/app/Controller/FeedsController.php +++ b/app/Controller/FeedsController.php @@ -37,11 +37,11 @@ class FeedsController extends AppController { $this->loadModel('Event'); $this->set('distributionLevels', $this->Event->distributionLevels); } - + public function view($feedId) { $feed = $this->Feed->find('first', array('conditions' => array('Feed.id' => $feedId))); } - + public function add() { if ($this->request->is('post')) { if (isset($this->request->data['Feed']['pull_rules'])) $this->request->data['Feed']['rules'] = $this->request->data['Feed']['pull_rules']; @@ -65,7 +65,7 @@ class FeedsController extends AppController { $this->set('tags', $tags); } } - + public function edit($feedId) { $this->Feed->id = $feedId; if (!$this->Feed->exists()) throw new NotFoundException('Invalid feed.'); @@ -97,7 +97,7 @@ class FeedsController extends AppController { $this->set('tags', $tags); } } - + public function delete($feedId) { if (!$this->request->is('post')) throw new MethodNotAllowedException('This action requires a post request.'); $this->Feed->id = $feedId; @@ -106,7 +106,7 @@ class FeedsController extends AppController { else $this->Session->setFlash('Feed could not be deleted.'); $this->redirect(array('controller' => 'feeds', 'action' => 'index')); } - + public function fetchFromFeed($feedId) { $this->Feed->id = $feedId; if (!$this->Feed->exists()) throw new NotFoundException('Invalid feed.'); @@ -145,7 +145,7 @@ class FeedsController extends AppController { $this->Session->setFlash($message); $this->redirect(array('action' => 'index')); } - + public function getEvent($feedId, $eventUuid, $all = false) { $this->Feed->id = $feedId; if (!$this->Feed->exists()) throw new NotFoundException('Invalid feed.'); @@ -169,7 +169,7 @@ class FeedsController extends AppController { $this->Session->setFlash($message); $this->redirect(array('action' => 'previewIndex', $feedId)); } - + public function previewIndex($feedId) { $this->Feed->id = $feedId; if (!$this->Feed->exists()) throw new NotFoundException('Invalid feed.'); @@ -177,7 +177,7 @@ class FeedsController extends AppController { else $currentPage = 1; $urlparams = ''; $passedArgs = array(); - + App::uses('SyncTool', 'Tools'); $syncTool = new SyncTool(); $this->Feed->read(); @@ -191,7 +191,7 @@ class FeedsController extends AppController { $this->params->params['paging'] = array($this->modelClass => $params); if (is_array($events)) $customPagination->truncateByPagination($events, $params); else ($events = array()); - + $this->set('events', $events); $this->loadModel('Event'); $threat_levels = $this->Event->ThreatLevel->find('all'); @@ -207,7 +207,7 @@ class FeedsController extends AppController { $this->set('passedArgs', json_encode($passedArgs)); $this->set('passedArgsArray', $passedArgs); } - + public function previewEvent($feedId, $eventUuid, $all = false) { $this->Feed->id = $feedId; @@ -239,7 +239,7 @@ class FeedsController extends AppController { else throw new NotFoundException('Could not download the selected Event'); } } - + public function enable($id) { $result = $this->__toggleEnable($id, true); $this->set('name', $result['message']); @@ -252,7 +252,7 @@ class FeedsController extends AppController { $this->set('_serialize', array('name', 'message', 'url', 'errors')); } } - + public function disable($id) { $result = $this->__toggleEnable($id, false); $this->set('name', $result['message']); @@ -265,7 +265,7 @@ class FeedsController extends AppController { $this->set('_serialize', array('name', 'message', 'url', 'errors')); } } - + private function __toggleEnable($id, $enable = true) { if (!is_numeric($id)) throw new MethodNotAllowedException('Invalid Feed.'); $this->Feed->id = $id; diff --git a/app/Controller/JobsController.php b/app/Controller/JobsController.php index efcdc3e08..08b74d823 100644 --- a/app/Controller/JobsController.php +++ b/app/Controller/JobsController.php @@ -9,18 +9,18 @@ App::uses('AppController', 'Controller'); */ class JobsController extends AppController { public $components = array('Security' ,'RequestHandler', 'Session'); - + public $paginate = array( 'limit' => 20, 'order' => array( 'Job.id' => 'desc' ), ); - + public function beforeFilter() { parent::beforeFilter(); } - + public function index($queue = false) { if (!$this->_isSiteAdmin()) throw new MethodNotAllowedException(); if (!Configure::read('MISP.background_jobs')) throw new NotFoundException('Background jobs are not enabled on this instance.'); @@ -38,7 +38,7 @@ class JobsController extends AppController { $this->set('list', $jobs); $this->set('queue', $queue); } - + private function __jobStatusConverter($status) { switch ($status) { case 1: @@ -55,7 +55,7 @@ class JobsController extends AppController { break; } } - + public function getGenerateCorrelationProgress($id) { if (!self::_isSiteAdmin()) throw new NotFoundException(); $progress = $this->Job->findById($id); @@ -66,7 +66,7 @@ class JobsController extends AppController { } return new CakeResponse(array('body' => json_encode($progress))); } - + public function getProgress($type) { $org = $this->Auth->user('Organisation')['name']; if ($this->_isSiteAdmin()) $org = 'ADMIN'; @@ -85,7 +85,7 @@ class JobsController extends AppController { } return new CakeResponse(array('body' => json_encode($progress))); } - + public function cache($type) { if ($this->_isSiteAdmin()) { $target = 'All events.'; diff --git a/app/Controller/LogsController.php b/app/Controller/LogsController.php index cc9635c6c..25ab8331b 100644 --- a/app/Controller/LogsController.php +++ b/app/Controller/LogsController.php @@ -85,14 +85,14 @@ class LogsController extends AppController { } $this->set('published', $this->Event->data['Event']['published']); if ($mineOrAdmin && $this->userRole['perm_modify']) $mayModify = true; - + $conditions['OR'][] = array('AND' => array('Log.model LIKE' => 'Event', 'Log.model_id LIKE' => $id)); if ($org) $conditions['AND'][] = array('Log.org LIKE' => $org, 'Log.model LIKE' => 'ShadowAttribute'); // if we are not the owners of the event and we aren't site admins, then we should only see the entries for attributes that are not private // This means that we will not be able to see deleted attributes - since those could have been private if (!$mayModify) { $sgs = $this->Event->SharingGroup->fetchAllAuthorised($this->Auth->user()); - + // get a list of the attributes that belong to the event $this->loadModel('Attribute'); $this->Attribute->recursive = -1; @@ -149,7 +149,7 @@ class LogsController extends AppController { // reset the paginate_conditions $this->Session->write('paginate_conditions_log', array()); if ($this->request->is('post')) { // FIXME remove this crap check - + $filters['email'] = $this->request->data['Log']['email']; if (!$orgRestriction) { $filters['org'] = $this->request->data['Log']['org']; @@ -207,7 +207,7 @@ class LogsController extends AppController { $filters['title'] = $this->Session->read('paginate_conditions_log_title'); $filters['change'] = $this->Session->read('paginate_conditions_log_change'); if (Configure::read('MISP.log_client_ip')) $filters['ip'] = $this->Session->read('paginate_conditions_log_ip'); - + // for info on what was searched for $this->set('emailSearch', $filters['email']); $this->set('orgSearch', $filters['org']); @@ -218,7 +218,7 @@ class LogsController extends AppController { $this->set('changeSearch', $filters['change']); if (Configure::read('MISP.log_client_ip')) $this->set('ipSearch', $filters['ip']); $this->set('isSearch', 1); - + // re-get pagination $this->{$this->defaultModel}->recursive = 0; $this->paginate = $this->Session->read('paginate_conditions_log'); @@ -226,18 +226,18 @@ class LogsController extends AppController { $conditions = $this->__buildSearchConditions($filters); $this->paginate['conditions'] = $conditions; $this->set('list', $this->paginate()); - + // set the same view as the index page $this->render('admin_index'); } } else { // no search keyword is given, show the search form - + // combobox for actions $actions = array('' => array('ALL' => 'ALL'), 'actions' => array()); $actions['actions'] = array_merge($actions['actions'], $this->_arrayToValuesIndexArray($this->{$this->defaultModel}->validate['action']['rule'][1])); $this->set('actions', $actions); - + // combobox for models $models = array('Attribute', 'Event', 'EventBlacklist', 'EventTag', 'Organisation', 'Post', 'Regexp', 'Role', 'Server', 'ShadowAttribute', 'SharingGroup', 'Tag', 'Task', 'Taxonomy', 'Template', 'Thread', 'User', 'Whitelist'); $existing_models = $this->Log->find('list', array( @@ -281,7 +281,7 @@ class LogsController extends AppController { } return $conditions; } - + public function returnDates($org = 'all') { $data = $this->Log->returnDates($org); $this->set('data', $data); diff --git a/app/Controller/NewsController.php b/app/Controller/NewsController.php index 0d6b569b4..5ae852c99 100644 --- a/app/Controller/NewsController.php +++ b/app/Controller/NewsController.php @@ -34,7 +34,7 @@ class NewsController extends AppController { $this->User->saveField('newsread', time()); $this->set('newsItems', $newsItems); } - + public function add() { if ($this->request->is('post')) { $this->News->create(); @@ -47,7 +47,7 @@ class NewsController extends AppController { } else $this->Session->setFlash('The news item could not be added.'); } } - + public function edit($id) { $this->News->id = $id; if (!$this->News->exists()) throw new NotFoundException('Invalid news item.'); @@ -62,7 +62,7 @@ class NewsController extends AppController { $this->set('newsItem', $this->request->data); } } - + public function delete($id) { if (!$this->request->is('post')) throw new MethodNotAllowedException(); $this->News->id = $id; diff --git a/app/Controller/OrgBlacklistsController.php b/app/Controller/OrgBlacklistsController.php index eca6c8113..576c48056 100644 --- a/app/Controller/OrgBlacklistsController.php +++ b/app/Controller/OrgBlacklistsController.php @@ -28,7 +28,7 @@ class OrgBlacklistsController extends AppController { public function add() { $this->BlackList->add($this->_isRest()); } - + public function edit($id) { $this->BlackList->edit($this->_isRest(), $id); } diff --git a/app/Controller/OrganisationsController.php b/app/Controller/OrganisationsController.php index 43f630684..6cb2f6a98 100644 --- a/app/Controller/OrganisationsController.php +++ b/app/Controller/OrganisationsController.php @@ -204,7 +204,7 @@ class OrganisationsController extends AppController { } return new CakeResponse(array('body'=> json_encode($orgs))); } - + public function admin_merge($id) { if (!$this->_isSiteAdmin()) throw new MethodNotAllowedException('You are not authorised to do that.'); if ($this->request->is('Post')) { diff --git a/app/Controller/PostsController.php b/app/Controller/PostsController.php index 64761bcb0..a8e0a756c 100644 --- a/app/Controller/PostsController.php +++ b/app/Controller/PostsController.php @@ -15,7 +15,7 @@ class PostsController extends AppController { ); public $helpers = array('Js' => array('Jquery')); - + public $paginate = array( 'limit' => 60, ); @@ -23,7 +23,7 @@ class PostsController extends AppController { public function beforeFilter() { parent::beforeFilter(); } - + // Find the thread_id and post_id in advance. If a user clicks post comment on the event view, send the event's related thread's ID // Usage: // /posts/add : Creates new thread with the added post as the first post. Title set by user @@ -110,7 +110,7 @@ class PostsController extends AppController { if (empty($thread_id) && empty($target_type)) { $title = $this->request->data['Post']['title']; } - + if ($target_thread_id == null) { // We have a post that was posted in a new thread. This could also mean that someone created the first post related to an event! $this->Thread->create(); @@ -176,7 +176,7 @@ class PostsController extends AppController { } } } - + public function edit($post_id, $context = 'thread') { $post = $this->Post->find('first', array('conditions' => array('Post.id' => $post_id), 'recursive' => -1, 'contain' => array('Thread'))); if (empty($post)) throw new NotFoundException(__('Invalid post')); @@ -213,7 +213,7 @@ class PostsController extends AppController { $this->set('id', $post_id); $this->set('thread_id', $post['Post']['thread_id']); } - + public function delete($post_id, $context = 'thread') { if (!$this->request->is('post')) { throw new MethodNotAllowedException(); @@ -266,4 +266,4 @@ class PostsController extends AppController { } } ?> - + diff --git a/app/Controller/RegexpController.php b/app/Controller/RegexpController.php index ea1c2b309..35600be2c 100644 --- a/app/Controller/RegexpController.php +++ b/app/Controller/RegexpController.php @@ -220,7 +220,7 @@ class RegexpController extends AppController { $this->Session->setFlash(__('All done! Number of changed attributes: ' . $modifications . ' Number of deletions: ' . count($deletable))); $this->redirect(array('action' => 'index')); } - + public function cleanRegexModifiers() { if (!$this->_isSiteAdmin() || !$this->request->is('post')) throw new MethodNotAllowedException(); diff --git a/app/Controller/ServersController.php b/app/Controller/ServersController.php index d2d998029..758ab5b63 100644 --- a/app/Controller/ServersController.php +++ b/app/Controller/ServersController.php @@ -70,7 +70,7 @@ class ServersController extends AppController { $this->set('collection', $collection); } - + public function previewIndex($id) { if (isset($this->passedArgs['pages'])) $currentPage = $this->passedArgs['pages']; else $currentPage = 1; @@ -104,7 +104,7 @@ class ServersController extends AppController { $this->set('eventDescriptions', $this->Event->fieldDescriptions); $this->set('analysisLevels', $this->Event->analysisLevels); $this->set('distributionLevels', $this->Event->distributionLevels); - + $shortDist = array(0 => 'Organisation', 1 => 'Community', 2 => 'Connected', 3 => 'All', 4 => ' sharing Group'); $this->set('shortDist', $shortDist); $this->set('ajax', $this->request->is('ajax')); @@ -114,7 +114,7 @@ class ServersController extends AppController { $this->set('passedArgsArray', $passedArgs); $this->set('server', $server); } - + public function previewEvent($serverId, $eventId, $all = false) { if (!$this->_isSiteAdmin()) { throw new MethodNotAllowedException('You are not authorised to do that.'); @@ -145,7 +145,7 @@ class ServersController extends AppController { $threat_levels = $this->Event->ThreatLevel->find('all'); $this->set('threatLevels', Set::combine($threat_levels, '{n}.ThreatLevel.id', '{n}.ThreatLevel.name')); } - + public function filterEventIndex($id) { if (!$this->_isSiteAdmin()) { throw new MethodNotAllowedException('You are not authorised to do that.'); @@ -172,20 +172,20 @@ class ServersController extends AppController { if (!$this->_isSiteAdmin()) $this->redirect(array('controller' => 'servers', 'action' => 'index')); if ($this->request->is('post')) { $json = json_decode($this->request->data['Server']['json'], true); - + $fail = false; - + // test the filter fields if (!empty($this->request->data['Server']['pull_rules']) && !$this->Server->isJson($this->request->data['Server']['pull_rules'])) { $fail = true; $this->Session->setFlash(__('The pull filter rules must be in valid JSON format.')); } - + if (!$fail && !empty($this->request->data['Server']['push_rules']) && !$this->Server->isJson($this->request->data['Server']['push_rules'])) { $fail = true; $this->Session->setFlash(__('The push filter rules must be in valid JSON format.')); } - + if (!$fail) { // force check userid and orgname to be from yourself $this->request->data['Server']['org_id'] = $this->Auth->user('org_id'); @@ -200,7 +200,7 @@ class ServersController extends AppController { $fail = true; $this->Session->setFlash(__('That organisation could not be created as the uuid is in use already.')); } - + if (!$fail) { $this->Server->Organisation->create(); if (!$this->Server->Organisation->save(array( @@ -249,12 +249,12 @@ class ServersController extends AppController { $externalOrganisations[$o['Organisation']['id']] = $o['Organisation']['name']; $allOrgs[] = array('id' => $o['Organisation']['id'], 'name' => $o['Organisation']['name']); } - + $this->set('organisationOptions', $organisationOptions); $this->set('localOrganisations', $localOrganisations); $this->set('externalOrganisations', $externalOrganisations); $this->set('allOrganisations', $allOrgs); - + // list all tags for the rule picker $this->loadModel('Tag'); $temp = $this->Tag->find('all', array('recursive' => -1)); @@ -280,13 +280,13 @@ class ServersController extends AppController { if ($this->request->is('post') || $this->request->is('put')) { $json = json_decode($this->request->data['Server']['json'], true); $fail = false; - + // test the filter fields if (!empty($this->request->data['Server']['pull_rules']) && !$this->Server->isJson($this->request->data['Server']['pull_rules'])) { $fail = true; $this->Session->setFlash(__('The pull filter rules must be in valid JSON format.')); } - + if (!$fail && !empty($this->request->data['Server']['push_rules']) && !$this->Server->isJson($this->request->data['Server']['push_rules'])) { $fail = true; $this->Session->setFlash(__('The push filter rules must be in valid JSON format.')); @@ -307,7 +307,7 @@ class ServersController extends AppController { $fail = true; $this->Session->setFlash(__('That organisation could not be created as the uuid is in use already.')); } - + if (!$fail) { $this->Server->Organisation->create(); if (!$this->Server->Organisation->save(array( @@ -321,7 +321,7 @@ class ServersController extends AppController { } } } - + if (!$fail) { // Save the data if ($this->Server->save($this->request->data, true, $fieldList)) { @@ -366,7 +366,7 @@ class ServersController extends AppController { $oldRemoteSetting = 0; if (!$this->Server->data['RemoteOrg']['local']) $oldRemoteSetting = 1; - + $this->set('oldRemoteSetting', $oldRemoteSetting); $this->set('oldRemoteOrg', $this->Server->data['RemoteOrg']['id']); @@ -374,7 +374,7 @@ class ServersController extends AppController { $this->set('localOrganisations', $localOrganisations); $this->set('externalOrganisations', $externalOrganisations); $this->set('allOrganisations', $allOrgs); - + // list all tags for the rule picker $this->loadModel('Tag'); $temp = $this->Tag->find('all', array('recursive' => -1)); @@ -531,7 +531,7 @@ class ServersController extends AppController { $this->redirect(array('action' => 'index')); } } - + private function __saveCert($server, $id, $delete = false) { if (!$delete) { $ext = ''; @@ -559,7 +559,7 @@ class ServersController extends AppController { $this->Server->save($s); } } - + public function serverSettingsReloadSetting($setting, $id) { if (!$this->_isSiteAdmin()) throw new MethodNotAllowedException(); $pathToSetting = explode('.', $setting); @@ -579,7 +579,7 @@ class ServersController extends AppController { $this->layout = false; $this->render('/Elements/healthElements/settings_row'); } - + public function serverSettings($tab=false) { if (!$this->_isSiteAdmin()) throw new MethodNotAllowedException(); if ($this->request->is('Get')) { @@ -598,7 +598,7 @@ class ServersController extends AppController { $stixVersion = array(0 => 'Incorrect STIX version installed, found $current, expecting $expected', 1 => 'OK'); $cyboxVersion = array(0 => 'Incorrect CyBox version installed, found $current, expecting $expected', 1 => 'OK'); $sessionErrors = array(0 => 'OK', 1 => 'High', 2 => 'Alternative setting used', 3 => 'Test failed'); - + $finalSettings = $this->Server->serverSettingsRead(); $issues = array( 'errors' => array( @@ -671,41 +671,41 @@ class ServersController extends AppController { 'recommended' => 50, 'unit' => 'M' ) - + ); - + foreach ($phpSettings as $setting => &$settingArray) { $settingArray['value'] = ini_get($setting); if ($settingArray['unit']) $settingArray['value'] = intval(rtrim($settingArray['value'], $settingArray['unit'])); else $settingArray['value'] = intval($settingArray['value']); } $this->set('phpSettings', $phpSettings); - + if ($version && (!$version['upToDate'] || $version['upToDate'] == 'older')) $diagnostic_errors++; - + // check if the STIX and Cybox libraries are working and the correct version using the test script stixtest.py $stix = $this->Server->stixDiagnostics($diagnostic_errors, $stixVersion, $cyboxVersion); - + // if GPG is set up in the settings, try to encrypt a test message $gpgStatus = $this->Server->gpgDiagnostics($diagnostic_errors); - + // if the message queue pub/sub is enabled, check whether the extension works $zmqStatus = $this->Server->zmqDiagnostics($diagnostic_errors); - + // if Proxy is set up in the settings, try to connect to a test URL $proxyStatus = $this->Server->proxyDiagnostics($diagnostic_errors); - + // check the size of the session table $sessionCount = 0; $sessionStatus = $this->Server->sessionDiagnostics($diagnostic_errors, $sessionCount); $this->set('sessionCount', $sessionCount); - + $additionalViewVars = array('gpgStatus', 'sessionErrors', 'proxyStatus', 'sessionStatus', 'zmqStatus', 'stixVersion', 'cyboxVersion','gpgErrors', 'proxyErrors', 'zmqErrors', 'stixOperational', 'stix'); } // check whether the files are writeable $writeableDirs = $this->Server->writeableDirsDiagnostics($diagnostic_errors); $writeableFiles = $this->Server->writeableFilesDiagnostics($diagnostic_errors); - + $viewVars = array( 'diagnostic_errors', 'tabs', 'tab', 'issues', 'finalSettings', 'writeableErrors', 'writeableDirs', 'writeableFiles' ); @@ -729,7 +729,7 @@ class ServersController extends AppController { $this->response->download('MISP.report.json'); return $this->response; } - + $priorities = array(0 => 'Critical', 1 => 'Recommended', 2 => 'Optional', 3 => 'Deprecated'); $this->set('priorities', $priorities); $this->set('workerIssueCount', $workerIssueCount); @@ -748,13 +748,13 @@ class ServersController extends AppController { else shell_exec($prepend . APP . 'Console' . DS . 'cake ' . DS . 'CakeResque.CakeResque startscheduler -i 5 > /dev/null 2>&1 &'); $this->redirect('/servers/serverSettings/workers'); } - + public function stopWorker($pid) { if (!$this->_isSiteAdmin() || !$this->request->is('post')) throw new MethodNotAllowedException(); $this->Server->killWorker($pid, $this->Auth->user()); $this->redirect('/servers/serverSettings/workers'); } - + private function __checkVersion() { if (!$this->_isSiteAdmin()) throw new MethodNotAllowedException(); App::uses('SyncTool', 'Tools'); @@ -768,7 +768,7 @@ class ServersController extends AppController { } if ($response->isOK() && !empty($tags)) { $json_decoded_tags = json_decode($tags); - + // find the latest version tag in the v[major].[minor].[hotfix] format for ($i = 0; $i < count($json_decoded_tags); $i++) { if (preg_match('/^v[0-9]+\.[0-9]+\.[0-9]+$/', $json_decoded_tags[$i]->name)) break; @@ -838,7 +838,7 @@ class ServersController extends AppController { )); return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'app/Config.config.php is not writeable to the apache user.')),'status'=>200)); } - + if (isset($found['beforeHook'])) { $beforeResult = call_user_func_array(array($this->Server, $found['beforeHook']), array($setting, $this->request->data['Server']['value'])); if ($beforeResult !== true) { @@ -903,7 +903,7 @@ class ServersController extends AppController { } } } - + public function restartWorkers() { if (!$this->_isSiteAdmin() || !$this->request->is('post')) throw new MethodNotAllowedException(); $this->Server->workerRemoveDead($this->Auth->user()); @@ -917,13 +917,13 @@ class ServersController extends AppController { shell_exec($prepend . APP . 'Console' . DS . 'worker' . DS . 'start.sh > /dev/null 2>&1 &'); $this->redirect(array('controller' => 'servers', 'action' => 'serverSettings', 'workers')); } - + private function __manageFiles() { if (!$this->_isSiteAdmin()) throw new MethodNotAllowedException(); $files = $this->Server->grabFiles(); return $files; } - + public function deleteFile($type, $filename) { if (!$this->_isSiteAdmin()) throw new MethodNotAllowedException(); if ($this->request->is('post')) { @@ -944,11 +944,11 @@ class ServersController extends AppController { throw new MethodNotAllowedException('This action expects a POST request.'); } } - + public function uploadFile($type) { if (!$this->_isSiteAdmin() || !$this->request->is('post')) throw new MethodNotAllowedException(); $validItems = $this->Server->getFileRules(); - + // Check if there were problems with the file upload // only keep the last part of the filename, this should prevent directory attacks $filename = basename($this->request->data['Server']['file']['name']); @@ -960,7 +960,7 @@ class ServersController extends AppController { $this->Session->setFlash(__('Upload failed.', true), 'default', array(), 'error'); $this->redirect(array('controller' => 'servers', 'action' => 'serverSettings', 'files')); } - + // check if the file already exists App::uses('File', 'Utility'); $existingFile = new File($validItems[$type]['path'] . DS . $filename); @@ -968,7 +968,7 @@ class ServersController extends AppController { $this->Session->setFlash(__('File already exists. If you would like to replace it, remove the old one first.', true), 'default', array(), 'error'); $this->redirect(array('controller' => 'servers', 'action' => 'serverSettings', 'files')); } - + $result = move_uploaded_file($this->request->data['Server']['file']['tmp_name'], $validItems[$type]['path'] . DS . $filename); if ($result) { $this->Session->setFlash('File uploaded.'); @@ -977,7 +977,7 @@ class ServersController extends AppController { } $this->redirect(array('controller' => 'servers', 'action' => 'serverSettings', 'files')); } - + public function fetchServersForSG($idList = '{}') { $id_exclusion_list = json_decode($idList, true); $temp = $this->Server->find('all', array( @@ -996,7 +996,7 @@ class ServersController extends AppController { $this->set('servers', $servers); $this->render('ajax/fetch_servers_for_sg'); } - + public function testConnection($id = false) { if (!$this->Auth->user('Role')['perm_sync'] && !$this->Auth->user('Role')['perm_site_admin']) throw new MethodNotAllowedException('You don\'t have permission to do that.'); $this->Server->id = $id; @@ -1033,7 +1033,7 @@ class ServersController extends AppController { } return new CakeResponse(array('body'=> json_encode($result))); } - + public function startZeroMQServer() { if (!$this->_isSiteAdmin()) throw new MethodNotAllowedException(); App::uses('PubSubTool', 'Tools'); @@ -1042,7 +1042,7 @@ class ServersController extends AppController { if ($result === true) return new CakeResponse(array('body'=> json_encode(array('saved' => true, 'success' => 'ZeroMQ server successfully started.')),'status'=>200)); else return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => $result)),'status'=>200)); } - + public function stopZeroMQServer() { if (!$this->_isSiteAdmin()) throw new MethodNotAllowedException(); App::uses('PubSubTool', 'Tools'); @@ -1051,7 +1051,7 @@ class ServersController extends AppController { if ($result === true) return new CakeResponse(array('body'=> json_encode(array('saved' => true, 'success' => 'ZeroMQ server successfully killed.')),'status'=>200)); else return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'Could not kill the previous instance of the ZeroMQ script.')),'status'=>200)); } - + public function statusZeroMQServer() { if (!$this->_isSiteAdmin()) throw new MethodNotAllowedException(); App::uses('PubSubTool', 'Tools'); @@ -1064,7 +1064,7 @@ class ServersController extends AppController { } $this->render('ajax/zeromqstatus'); } - + public function purgeSessions() { if (!$this->_isSiteAdmin()) throw new MethodNotAllowedException(); if ($this->Server->updateDatabase('cleanSessionTable') == false) { @@ -1072,7 +1072,7 @@ class ServersController extends AppController { } $this->redirect('/servers/serverSettings/diagnostics'); } - + public function getVersion() { if (!$this->userRole['perm_auth']) throw new MethodNotAllowedException('This action requires API access.'); $versionArray = $this->Server->checkMISPVersion(); diff --git a/app/Controller/ShadowAttributesController.php b/app/Controller/ShadowAttributesController.php index 7839936d0..f22b8d1fb 100644 --- a/app/Controller/ShadowAttributesController.php +++ b/app/Controller/ShadowAttributesController.php @@ -81,7 +81,7 @@ class ShadowAttributesController extends AppController { // Find the live attribute by the shadow attribute's uuid, so we can begin editing it $this->Attribute->contain = 'Event'; $activeAttribute = $this->Attribute->findByUuid($shadow['uuid']); - + // Send those away that shouldn't be able to see this if (!$this->_isSiteAdmin()) { if ($activeAttribute['Event']['orgc_id'] != $this->Auth->user('org_id') || (!$this->userRole['perm_modify'])) { @@ -136,7 +136,7 @@ class ShadowAttributesController extends AppController { $this->Event->Behaviors->detach('SysLogLogable.SysLogLogable'); $this->Event->recursive = -1; $event = $this->Event->read(null, $shadow['event_id']); - + if (!$this->_isSiteAdmin()) { if (($event['Event']['orgc_id'] != $this->Auth->user('org_id')) || (!$this->userRole['perm_modify'])) { $this->Session->setFlash('You don\'t have permission to do that'); @@ -147,13 +147,13 @@ class ShadowAttributesController extends AppController { // Stuff that we won't use in its current form for the attribute unset($shadow['email'], $shadow['org_id'], $shadow['id'], $shadow['old_id']); $attribute = $shadow; - + // set the distribution equal to that of the event $attribute['distribution'] = 5; $this->Attribute->create(); $this->Attribute->save($attribute); $this->ShadowAttribute->setDeleted($toDeleteId); - + $fieldList = array('proposal_email_lock', 'id', 'info', 'published'); if ($this->Auth->user('org_id') == $event['Event']['orgc_id']) { $event['Event']['proposal_email_lock'] = 0; @@ -179,7 +179,7 @@ class ShadowAttributesController extends AppController { } } } - + /** * accept method * @@ -217,7 +217,7 @@ class ShadowAttributesController extends AppController { } } - + private function __discard($id) { $sa = $this->ShadowAttribute->find( 'first', @@ -260,7 +260,7 @@ class ShadowAttributesController extends AppController { } return false; } - + /** * discard method * @@ -480,7 +480,7 @@ class ShadowAttributesController extends AppController { if (!$this->ShadowAttribute->Event->checkIfAuthorised($this->Auth->user(), $sa['Event']['id'])) throw new UnauthorizedException('You do not have the permission to view this event.'); $this->__downloadAttachment($sa['ShadowAttribute']); } - + private function __downloadAttachment($shadowAttribute) { $path = "files" . DS . 'shadow' . DS . $shadowAttribute['event_id'] . DS; $file = $shadowAttribute['id']; @@ -510,7 +510,7 @@ class ShadowAttributesController extends AppController { $event = $this->ShadowAttribute->Event->fetchEvent($this->Auth->user(), array('eventid' => $eventId)); if (empty($event)) throw new NotFoundException('Invalid Event'); $event = $event[0]; - + if ($this->request->is('post')) { // Check if there were problems with the file upload // only keep the last part of the filename, this should prevent directory attacks @@ -526,7 +526,7 @@ class ShadowAttributesController extends AppController { $this->Session->setFlash(__('There was a problem to upload the file.', true), 'default', array(), 'error'); $this->redirect(array('controller' => 'events', 'action' => 'view', $this->request->data['ShadowAttribute']['event_id'])); } - + $fails = array(); $completeFail = false; @@ -644,7 +644,7 @@ class ShadowAttributesController extends AppController { )); if (empty($existingAttribute)) throw new MethodNotAllowedException('Invalid Attribute.'); $existingAttribute = $existingAttribute[0]; - + // Check if the attribute is an attachment, if yes, block the type and the value fields from being edited. if ('attachment' == $existingAttribute['Attribute']['type'] || 'malware-sample' == $existingAttribute['Attribute']['type'] ) { $this->set('attachment', true); @@ -737,7 +737,7 @@ class ShadowAttributesController extends AppController { $this->set('typeDefinitions', $this->ShadowAttribute->typeDefinitions); $this->set('categoryDefinitions', $this->ShadowAttribute->Event->Attribute->categoryDefinitions); } - + public function delete($id) { if (strlen($id) == 36) { $this->ShadowAttribute->Event->recursive = -1; @@ -755,7 +755,7 @@ class ShadowAttributesController extends AppController { ), 'contain' => array('Event' => array('fields' => array('Event.id', 'Event.uuid', 'Event.orgc_id'))) )); - + if ($this->request->is('post')) { if (empty($existingAttribute)) return new CakeResponse(array('body'=> json_encode(array('false' => true, 'errors' => 'Invalid Attribute.')),'status'=>200)); $this->ShadowAttribute->create(); @@ -787,7 +787,7 @@ class ShadowAttributesController extends AppController { $this->render('ajax/deletionProposalConfirmationForm'); } } - + public function view($id) { $distConditions = array(); if (!$this->_isSiteAdmin()) { @@ -822,7 +822,7 @@ class ShadowAttributesController extends AppController { $this->set('ShadowAttribute', $sa['ShadowAttribute']); $this->set('_serialize', array('ShadowAttribute')); } - + public function index($eventId = false) { $conditions = array(); if (!$this->_isSiteAdmin()) { @@ -869,7 +869,7 @@ class ShadowAttributesController extends AppController { $this->set('shadowAttributes', $this->paginate()); } } - + // takes a uuid and finds all proposals that belong to an event with the given uuid. These are then returned. public function getProposalsByUuid($uuid) { if (!$this->_isRest() || !$this->userRole['perm_sync']) { @@ -906,7 +906,7 @@ class ShadowAttributesController extends AppController { $this->render('get_proposals_by_uuid'); } } - + public function getProposalsByUuidList() { if (!$this->_isRest() || !$this->userRole['perm_sync']) { throw new MethodNotAllowedException(__('This feature is only available using the API to Sync users')); @@ -945,7 +945,7 @@ class ShadowAttributesController extends AppController { $this->render('get_proposals_by_uuid_list'); } } - + public function fetchEditForm($id, $field = null) { $validFields = array('value', 'comment', 'type', 'category', 'to_ids'); if (!isset($field) || !in_array($field, $validFields)) throw new MethodNotAllowedException('Invalid field requested.'); @@ -954,7 +954,7 @@ class ShadowAttributesController extends AppController { if (!$this->Attribute->exists()) { throw new NotFoundException(__('Invalid attribute')); } - + $fields = array('id', 'distribution', 'event_id'); if ($field == 'category' || $field == 'type') { $fields[] = 'type'; @@ -997,7 +997,7 @@ class ShadowAttributesController extends AppController { $fieldURL = ucfirst($field); $this->render('ajax/attributeEdit' . $fieldURL . 'Form'); } - + // ajax edit - post a single edited field and this method will attempt to create a proposal and return a json with the validation errors if they occur. public function editField($id) { if ((!$this->request->is('post') && !$this->request->is('put')) || !$this->request->is('ajax')) throw new MethodNotAllowedException(); @@ -1009,7 +1009,7 @@ class ShadowAttributesController extends AppController { $this->Attribute->recursive = -1; $this->Attribute->contain('Event'); $attribute = $this->Attribute->read(); - + if (!$this->_isSiteAdmin()) { if ($attribute['Event']['orgc_id'] != $this->Auth->user('org_id') && ($attribute['Event']['org_id'] == $this->Auth->user('org_id') || $attribute['Event']['distribution'] > 0)) { // Allow the edit @@ -1019,7 +1019,7 @@ class ShadowAttributesController extends AppController { } $keys = array_flip(array('uuid', 'event_id', 'value', 'type', 'category', 'to_ids')); - + $proposal = array_intersect_key($attribute['Attribute'], $keys); $proposal['email'] = $this->Auth->user('email'); $proposal['org_id'] = $this->Auth->user('org_id'); @@ -1033,7 +1033,7 @@ class ShadowAttributesController extends AppController { } $proposal[$changedKey] = $changedField; } - + if ($this->ShadowAttribute->save($proposal)) { $this->autoRender = false; return new CakeResponse(array('body'=> json_encode(array('saved' => true)),'status'=>200)); @@ -1042,7 +1042,7 @@ class ShadowAttributesController extends AppController { return new CakeResponse(array('body'=> json_encode(array('fail' => false, 'errors' => $this->ShadowAttribute->validationErrors)),'status'=>200)); } } - + public function discardSelected($id) { if (!$this->request->is('post') || !$this->request->is('ajax')) throw new MethodNotAllowedException(); @@ -1059,7 +1059,7 @@ class ShadowAttributesController extends AppController { return new CakeResponse(array('body'=> json_encode(array('false' => true, 'errors' => 'You don\'t have permission to do that.')),'status'=>200)); } } - + // find all attributes from the ID list that also match the provided event ID. $shadowAttributes = $this->ShadowAttribute->find('all', array( 'recursive' => -1, @@ -1078,10 +1078,10 @@ class ShadowAttributesController extends AppController { return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => count($successes) . ' proposal' . (count($successes) != 1 ? 's' : '') . ' deleted, but ' . count($fails) . ' proposal' . (count($fails) != 1 ? 's' : '') . ' could not be deleted.')),'status'=>200)); } } - + public function acceptSelected($id) { if (!$this->request->is('post') || !$this->request->is('ajax')) throw new MethodNotAllowedException(); - + // get a json object with a list of proposal IDs to be accepted // check each of them and return a json object with the successful accepts and the failed ones. $ids = json_decode($this->request->data['ShadowAttribute']['ids_accept']); @@ -1095,7 +1095,7 @@ class ShadowAttributesController extends AppController { return new CakeResponse(array('body'=> json_encode(array('false' => true, 'errors' => 'You don\'t have permission to do that.')),'status'=>200)); } } - + // find all attributes from the ID list that also match the provided event ID. $shadowAttributes = $this->ShadowAttribute->find('all', array( 'recursive' => -1, @@ -1115,7 +1115,7 @@ class ShadowAttributesController extends AppController { return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => count($successes) . ' proposal' . (count($successes) != 1 ? 's' : '') . ' accepted, but ' . count($fails) . ' proposal' . (count($fails) != 1 ? 's' : '') . ' could not be accepted.')),'status'=>200)); } } - + public function generateCorrelation() { if (!self::_isSiteAdmin() || !$this->request->is('post')) throw new NotFoundException(); if (!Configure::read('MISP.background_jobs')) { diff --git a/app/Controller/SharingGroupsController.php b/app/Controller/SharingGroupsController.php index 0c80c56f6..bd86774ba 100644 --- a/app/Controller/SharingGroupsController.php +++ b/app/Controller/SharingGroupsController.php @@ -3,14 +3,14 @@ App::uses('AppController', 'Controller'); class SharingGroupsController extends AppController { public $components = array('Session', 'RequestHandler'); - + public function beforeFilter() { parent::beforeFilter(); if(!empty($this->request->params['admin']) && !$this->_isSiteAdmin()) $this->redirect('/'); $sgs = $this->SharingGroup->fetchAllAuthorised($this->Auth->user()); $this->paginate = Set::merge($this->paginate,array('conditions' => array('SharingGroup.id' => $sgs))); } - + public $paginate = array( 'limit' => 60, 'maxLimit' => 9999, // LATER we will bump here on a problem once we have more than 9999 events <- no we won't, this is the max a user van view/page. @@ -33,7 +33,7 @@ class SharingGroupsController extends AppController { ) ), ); - + public function add() { if (!$this->userRole['perm_sharing_group']) throw new MethodNotAllowedException('You don\'t have the required privileges to do that.'); if($this->request->is('post')) { @@ -85,14 +85,14 @@ class SharingGroupsController extends AppController { // We just pass true and allow the user to edit, since he/she is just about to create the SG. This is needed to reuse the view for the edit $this->set('user', $this->Auth->user()); } - + public function edit($id) { if (!$this->userRole['perm_sharing_group']) throw new MethodNotAllowedException('You don\'t have the required privileges to do that.'); // add check for perm_sharing_group $this->SharingGroup->id = $id; if (!$this->SharingGroup->exists()) throw new NotFoundException('Invalid sharing group.'); if (!$this->_isSiteAdmin() && !$this->SharingGroup->checkIfAuthorisedExtend($this->Auth->user(), $id)) throw new MethodNotAllowedException('Action not allowed.'); - + // check if the user is eligible to edit the SG (original creator or extend) $sharingGroup = $this->SharingGroup->find('first', array( 'conditions' => array('SharingGroup.id' => $id), @@ -146,7 +146,7 @@ class SharingGroupsController extends AppController { // We just pass true and allow the user to edit, since he/she is just about to create the SG. This is needed to reuse the view for the edit $this->set('user', $this->Auth->user()); } - + public function delete($id) { if (!$this->userRole['perm_sharing_group']) throw new MethodNotAllowedException('You don\'t have the required privileges to do that.'); if (!$this->request->is('post')) throw new MethodNotAllowedException('Action not allowed, post request expected.'); @@ -162,7 +162,7 @@ class SharingGroupsController extends AppController { if ($deletedSg['SharingGroup']['active']) $this->redirect('/SharingGroups/index'); else $this->redirect('/SharingGroups/index/true'); } - + public function index($passive = false) { if ($passive === 'true') $passive = true; if ($passive === true) $this->paginate['conditions'][] = array('SharingGroup.active' => false); @@ -189,7 +189,7 @@ class SharingGroupsController extends AppController { $this->set('sharingGroups', $result); } } - + public function view($id) { if (!$this->SharingGroup->checkIfAuthorised($this->Auth->user(), $id)) throw new MethodNotAllowedException('Sharing group doesn\'t exist or you do not have permission to access it.'); $this->SharingGroup->id = $id; @@ -206,4 +206,3 @@ class SharingGroupsController extends AppController { $this->set('sg', $sg); } } - \ No newline at end of file diff --git a/app/Controller/SightingsController.php b/app/Controller/SightingsController.php index 7ffb1bc50..69c59130a 100644 --- a/app/Controller/SightingsController.php +++ b/app/Controller/SightingsController.php @@ -41,7 +41,7 @@ class SightingsController extends AppController { } if (!$error) $result = $this->Sighting->saveSightings($id, $values, $timestamp, $this->Auth->user()); if ($result == 0) $error = 'No valid attributes found that would match the sighting criteria.'; - + if ($this->request->is('ajax')) { if ($error) { $error_message = 'Could not add the Sighting. Reason: ' . $error; diff --git a/app/Controller/TagsController.php b/app/Controller/TagsController.php index d3708a14a..7c0283a84 100644 --- a/app/Controller/TagsController.php +++ b/app/Controller/TagsController.php @@ -17,13 +17,13 @@ class TagsController extends AppController { 'Tag.name' => 'asc' ) ); - + public $helpers = array('TextColour'); - + public function beforeFilter() { // TODO REMOVE parent::beforeFilter(); } - + public function index($favouritesOnly = false) { $this->loadModel('Event'); $this->loadModel('Taxonomy'); @@ -94,7 +94,7 @@ class TagsController extends AppController { } // send perm_tagger to view for action buttons } - + public function add() { if (!$this->_isSiteAdmin() && !$this->userRole['perm_tag_editor']) throw new NotFoundException('You don\'t have permission to do that.'); if ($this->request->is('post')) { @@ -116,7 +116,7 @@ class TagsController extends AppController { } } } - + public function quickAdd() { if ((!$this->_isSiteAdmin() && !$this->userRole['perm_tag_editor']) || !$this->request->is('post')) throw new NotFoundException('You don\'t have permission to do that.'); if (isset($this->request->data['Tag']['request'])) $this->request->data['Tag'] = $this->request->data['Tag']['request']; @@ -127,7 +127,7 @@ class TagsController extends AppController { } $this->redirect($this->referer()); } - + public function edit($id) { if (!$this->_isSiteAdmin() && !$this->userRole['perm_tag_editor']) { throw new NotFoundException('You don\'t have permission to do that.'); @@ -155,7 +155,7 @@ class TagsController extends AppController { } $this->request->data = $this->Tag->read(null, $id); } - + public function delete($id) { if (!$this->_isSiteAdmin() && !$this->userRole['perm_tag_editor']) { throw new NotFoundException('You don\'t have permission to do that.'); @@ -181,7 +181,7 @@ class TagsController extends AppController { } if (!$this->_isRest()) $this->redirect(array('action' => 'index')); } - + public function view($id) { if ($this->_isRest()) { $tag = $this->Tag->find('first', array( @@ -216,9 +216,9 @@ class TagsController extends AppController { $this->set('Tag', $tag['Tag']); $this->set('_serialize', 'Tag'); } else throw new MethodNotAllowedException('This action is only for REST users.'); - + } - + public function showEventTag($id) { $this->helpers[] = 'TextColour'; $this->loadModel('EventTag'); @@ -245,7 +245,7 @@ class TagsController extends AppController { $this->layout = 'ajax'; $this->render('/Events/ajax/ajaxTags'); } - + public function viewTag($id) { $tag = $this->Tag->find('first', array( 'conditions' => array( @@ -258,7 +258,7 @@ class TagsController extends AppController { $this->set('id', $id); $this->render('ajax/view_tag'); } - + public function selectTaxonomy($event_id) { if (!$this->_isSiteAdmin() && !$this->userRole['perm_tagger']) throw new NotFoundException('You don\'t have permission to do that.'); @@ -274,7 +274,7 @@ class TagsController extends AppController { $this->set('favourites', $favourites); $this->render('ajax/taxonomy_choice'); } - + public function selectTag($event_id, $taxonomy_id) { if (!$this->_isSiteAdmin() && !$this->userRole['perm_tagger']) throw new NotFoundException('You don\'t have permission to do that.'); $this->loadModel('Taxonomy'); @@ -308,7 +308,7 @@ class TagsController extends AppController { $this->set('custom', $taxonomy_id == 0 ? true : false); $this->render('ajax/select_tag'); } - + public function tagStatistics($percentage = false, $keysort = false) { $result = $this->Tag->EventTag->find('all', array( 'recursive' => -1, diff --git a/app/Controller/TasksController.php b/app/Controller/TasksController.php index 51c891bfb..9565be68b 100644 --- a/app/Controller/TasksController.php +++ b/app/Controller/TasksController.php @@ -9,18 +9,18 @@ App::uses('AppController', 'Controller'); */ class TasksController extends AppController { public $components = array('Security' ,'RequestHandler', 'Session'); - + public $paginate = array( 'limit' => 20, 'order' => array( 'Task.id' => 'desc' ) ); - + public function beforeFilter() { parent::beforeFilter(); } - + public function index() { if (!$this->_isSiteAdmin()) throw new MethodNotAllowedException(); if (!Configure::read('MISP.background_jobs')) throw new NotFoundException('Background jobs are not enabled on this instance.'); @@ -30,7 +30,7 @@ class TasksController extends AppController { $this->set('list', $tasks); $this->set('time', time()); } - + // checks if all the mandatory tasks exist, and if not, creates them // default tasks are: // 'cache_exports' @@ -43,7 +43,7 @@ class TasksController extends AppController { } } } - + public function setTask() { if (!$this->_isSiteAdmin()) { throw new MethodNotAllowedException('You are not authorised to do that.'); @@ -75,17 +75,17 @@ class TasksController extends AppController { $this->redirect(array('action' => 'index')); } } - + private function _getTodaysTimestamp() { return strtotime(date("d/m/Y") . ' 00:00:00'); } - + private function _jobScheduler($type, $timestamp, $id) { if ($type === 'cache_exports') $this->_cacheScheduler($timestamp, $id); if ($type === 'pull_all') $this->_pullScheduler($timestamp, $id); if ($type === 'push_all') $this->_pushScheduler($timestamp, $id); } - + private function _cacheScheduler($timestamp, $id) { CakeResque::enqueueAt( $timestamp, @@ -107,7 +107,7 @@ class TasksController extends AppController { $this->Task->id = $id; $this->Task->saveField('job_id', $process_id); } - + private function _pullScheduler($timestamp, $id) { $process_id = CakeResque::enqueueAt( $timestamp, diff --git a/app/Controller/TaxonomiesController.php b/app/Controller/TaxonomiesController.php index 1a0b6a8cd..6c4f035cd 100644 --- a/app/Controller/TaxonomiesController.php +++ b/app/Controller/TaxonomiesController.php @@ -37,7 +37,7 @@ class TaxonomiesController extends AppController { } $this->set('taxonomies', $taxonomies); } - + public function view($id) { if (isset($this->passedArgs['pages'])) { $currentPage = $this->passedArgs['pages']; @@ -64,7 +64,7 @@ class TaxonomiesController extends AppController { $this->set('taxonomy', $taxonomy['Taxonomy']); $this->set('id', $id); } - + public function enable($id) { if (!$this->_isSiteAdmin() || !$this->request->is('Post')) throw new MethodNotAllowedException('You don\'t have permission to do that.'); $taxonomy = $this->Taxonomy->find('first', array( @@ -88,7 +88,7 @@ class TaxonomiesController extends AppController { $this->Session->setFlash('Taxonomy enabled.'); $this->redirect($this->referer()); } - + public function disable($id) { if (!$this->_isSiteAdmin() || !$this->request->is('Post')) throw new MethodNotAllowedException('You don\'t have permission to do that.'); $taxonomy = $this->Taxonomy->find('first', array( @@ -112,7 +112,7 @@ class TaxonomiesController extends AppController { $this->Session->setFlash('Taxonomy disabled.'); $this->redirect($this->referer()); } - + public function update() { if (!$this->_isSiteAdmin()) throw new MethodNotAllowedException('You don\'t have permission to do that.'); $result = $this->Taxonomy->update(); @@ -176,7 +176,7 @@ class TaxonomiesController extends AppController { } $this->redirect(array('controller' => 'taxonomies', 'action' => 'index')); } - + public function addTag($taxonomy_id = false) { if ((!$this->_isSiteAdmin() && !$this->userRole['perm_tagger']) || !$this->request->is('post')) throw new NotFoundException('You don\'t have permission to do that.'); if ($taxonomy_id) { @@ -198,7 +198,7 @@ class TaxonomiesController extends AppController { } $this->redirect($this->referer()); } - + public function taxonomyMassConfirmation($id) { if (!$this->_isSiteAdmin() && !$this->userRole['perm_tagger']) throw new NotFoundException('You don\'t have permission to do that.'); $this->set('id', $id); diff --git a/app/Controller/TemplateElementsController.php b/app/Controller/TemplateElementsController.php index c138fb31f..e6a918591 100644 --- a/app/Controller/TemplateElementsController.php +++ b/app/Controller/TemplateElementsController.php @@ -17,13 +17,13 @@ class TemplateElementsController extends AppController { 'TemplateElement.position' => 'asc' ) ); - + public function index($id) { - + //check permissions $template = $this->TemplateElement->Template->checkAuthorisation($id, $this->Auth->user(), false); if (!$this->_isSiteAdmin() && !$template) throw new MethodNotAllowedException('No template with the provided ID exists, or you are not authorised to see it.'); - + $templateElements = $this->TemplateElement->find('all', array( 'conditions' => array( 'template_id' => $id, @@ -45,24 +45,24 @@ class TemplateElementsController extends AppController { $this->set('mayModify', $mayModify); $this->render('ajax/ajaxIndex'); } - + public function templateElementAddChoices($id) { if (!$this->_isSiteAdmin() && !$this->TemplateElement->Template->checkAuthorisation($id, $this->Auth->user(), true)) throw new MethodNotAllowedException('You are not authorised to do that.'); - + if (!$this->request->is('ajax')) Throw new MethodNotAllowedException('This action is for ajax requests only.'); $this->set('id', $id); $this->layout = 'ajax'; $this->render('ajax/template_element_add_choices'); } - + public function add($type, $id) { $ModelType = 'TemplateElement' . ucfirst($type); if (!$this->_isSiteAdmin() && !$this->TemplateElement->Template->checkAuthorisation($id, $this->Auth->user(), true)) return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'You are not authorised to do that.')), 'status' => 200)); - + if (!$this->request->is('ajax')) Throw new MethodNotAllowedException('This action is for ajax requests only.'); - + if ($this->request->is('get')) { $this->set('id', $id); if ($type == 'attribute') { @@ -137,7 +137,7 @@ class TemplateElementsController extends AppController { return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => $errorMessage)), 'status' => 200)); } } - + public function edit($type, $id) { $ModelType = 'TemplateElement' . ucfirst($type); $templateElement = $this->TemplateElement->find('first', array( @@ -146,7 +146,7 @@ class TemplateElementsController extends AppController { )); $this->set('template_id', $templateElement['Template']['id']); if (!$this->_isSiteAdmin() && !$this->TemplateElement->Template->checkAuthorisation($id, $this->Auth->user(), true)) return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'You are not authorised to do that.')), 'status' => 200)); - + if (!$this->request->is('ajax')) Throw new MethodNotAllowedException('This action is for ajax requests only.'); if ($this->request->is('get')) { $this->set('id', $id); @@ -213,7 +213,7 @@ class TemplateElementsController extends AppController { return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'The element could not be edited.')), 'status' => 200)); } } - + public function delete($id) { if (!$this->request->is('ajax')) Throw new MethodNotAllowedException('This action is for ajax requests only.'); $this->TemplateElement->read(null, $id); diff --git a/app/Controller/TemplatesController.php b/app/Controller/TemplatesController.php index 9b8734b90..1a88d90fa 100644 --- a/app/Controller/TemplatesController.php +++ b/app/Controller/TemplatesController.php @@ -24,8 +24,8 @@ class TemplatesController extends AppController { parent::beforeFilter(); $this->Security->unlockedActions = array('uploadFile', 'deleteTemporaryFile'); } - - + + public function index() { $conditions = array(); if (!$this->_isSiteAdmin()) { @@ -41,12 +41,12 @@ class TemplatesController extends AppController { } $this->set('list', $this->paginate()); } - + public function edit($id) { $template = $this->Template->checkAuthorisation($id, $this->Auth->user(), true); if (!$this->_isSiteAdmin() && !$template) throw new MethodNotAllowedException('No template with the provided ID exists, or you are not authorised to edit it.'); $this->set('mayModify', true); - + if ($this->request->is('post') || $this->request->is('put')) { $this->request->data['Template']['id'] = $id; unset($this->request->data['Template']['tagsPusher']); @@ -68,11 +68,11 @@ class TemplatesController extends AppController { 'recursive' => -1, 'conditions' => array('id' => $tagArray) )); - + foreach($oldTags as $k => $oT) { if (!in_array($oT['Tag'], $newTags)) $this->TemplateTag->delete($oT['TemplateTag']['id']); } - + foreach($newTags as $k => $nT) { if (!in_array($nT['Tag'], $oldTags)) { $this->TemplateTag->create(); @@ -93,7 +93,7 @@ class TemplatesController extends AppController { foreach ($tags as $tag) { $tagArray[$tag['Tags']['id']] = $tag['Tags']['name']; } - + //get all tags currently assigned to the event $currentTags = $this->Template->TemplateTag->find('all', array( 'recursive' => -1, @@ -106,7 +106,7 @@ class TemplatesController extends AppController { $this->set('tags', $tagArray); $this->set('tagInfo', $tags); } - + public function view($id) { if (!$this->_isSiteAdmin() && !$this->Template->checkAuthorisation($id, $this->Auth->user(), false)) throw new MethodNotAllowedException('No template with the provided ID exists, or you are not authorised to see it.'); if ($this->Template->checkAuthorisation($id, $this->Auth->user(), true)) $this->set('mayModify', true); @@ -130,7 +130,7 @@ class TemplatesController extends AppController { $this->set('id', $id); $this->set('template', $template); } - + public function add() { if (!$this->userRole['perm_template']) throw new MethodNotAllowedException('You are not authorised to do that.'); if ($this->request->is('post')) { @@ -167,7 +167,7 @@ class TemplatesController extends AppController { $this->set('tags', $tagArray); $this->set('tagInfo', $tags); } - + public function saveElementSorting() { // check if user can edit the template $this->autoRender = false; @@ -183,9 +183,9 @@ class TemplatesController extends AppController { 'recursive' => -1, 'fields' => array('id', 'template_id'), )); - + if (!$this->_isSiteAdmin() && !$this->Template->checkAuthorisation($template_id['TemplateElement']['template_id'], $this->Auth->user(), true)) return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'You are not authorised to do that.')), 'status' => 200)); - + $elements = $this->Template->TemplateElement->find('all', array( 'conditions' => array('template_id' => $template_id['TemplateElement']['template_id']), 'recursive' => -1, @@ -193,7 +193,7 @@ class TemplatesController extends AppController { if (empty($elements)) return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'Something went wrong, the supplied template elements don\'t exist, or you are not eligible to edit them.')),'status'=>200)); if (count($elements) != count($orderedElements)) return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'Incomplete template element list passed as argument. Expecting ' . count($elements) . ' elements, only received positions for ' . count($orderedElements) . '.')),'status'=>200)); $template_id = $elements[0]['TemplateElement']['template_id']; - + foreach ($elements as &$e) { if ($template_id !== $e['TemplateElement']['template_id']) return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'Cannot sort template elements belonging to separate templates. You should never see this message during legitimate use.')),'status'=>200)); foreach ($orderedElements as $k => $orderedElement) { @@ -205,7 +205,7 @@ class TemplatesController extends AppController { $this->Template->TemplateElement->saveMany($elements); return new CakeResponse(array('body'=> json_encode(array('saved' => true, 'success' => 'Elements repositioned.')),'status'=>200)); } - + public function delete($id) { $template = $this->Template->checkAuthorisation($id, $this->Auth->user(), true); if (!$this->request->is('post')) throw new MethodNotAllowedException('This action can only be invoked via a post request.'); @@ -218,7 +218,7 @@ class TemplatesController extends AppController { $this->redirect(array('action' => 'index')); } } - + public function templateChoices($id) { $this->loadModel('Event'); @@ -228,7 +228,7 @@ class TemplatesController extends AppController { 'fields' => array('orgc_id', 'id'), )); if (empty($event) || (!$this->_isSiteAdmin() && $event['Event']['orgc_id'] != $this->Auth->user('org_id'))) throw new NotFoundException('Event not found or you are not authorised to edit it.'); - + $conditions = array(); if (!$this->_isSiteAdmin) { $conditions['OR'] = array('Template.org' => $this->Auth->user('Organisation')['name'], 'Template.share' => true); @@ -241,7 +241,7 @@ class TemplatesController extends AppController { $this->set('id', $id); $this->render('ajax/template_choices'); } - + public function populateEventFromTemplate($template_id, $event_id) { $template = $this->Template->find('first', array( 'conditions' => array('Template.id' => $template_id), @@ -269,7 +269,7 @@ class TemplatesController extends AppController { if ($event['Event']['orgc_id'] != $this->Auth->user('org_id')) throw new MethodNotAllowedException('Event not found or you are not authorised to edit it.'); if ($template['Template']['org'] != $this->Auth->user('Organisation')['name'] && !$template['Template']['share']) throw new MethodNotAllowedException('Template not found or you are not authorised to use it.'); } - + $this->set('template_id', $template_id); $this->set('event_id', $event_id); if ($this->request->is('post')) { @@ -295,8 +295,8 @@ class TemplatesController extends AppController { $this->set('validTypeGroups', $this->Event->Attribute->validTypeGroups); } } - - + + // called when the user is finished populating a template and is has finished reviewing the resulting attributes at the last stage of the process public function submitEventPopulation($template_id, $event_id) { if ($this->request->is('post')) { @@ -318,7 +318,7 @@ class TemplatesController extends AppController { 'contain' => 'TemplateTag', 'fields' => 'id', )); - + foreach ($template['TemplateTag'] as $tag) { $exists = false; foreach ($event['EventTag'] as $eventTag) { @@ -329,7 +329,7 @@ class TemplatesController extends AppController { $this->Event->EventTag->save(array('event_id' => $event_id, 'tag_id' => $tag['tag_id'])); } } - + if (isset($this->request->data['Template']['attributes'])) { $attributes = json_decode($this->request->data['Template']['attributes'], true); $this->loadModel('Attribute'); @@ -363,7 +363,7 @@ class TemplatesController extends AppController { throw new MethodNotAllowedException(); } } - + public function uploadFile($elementId, $batch) { $this->layout = 'iframe'; $this->set('batch', $batch); @@ -397,13 +397,13 @@ class TemplatesController extends AppController { } else { $this->set('upload_error', false); } - + $this->set('result', $result); $this->set('filenames', $filenames); $this->set('fileArray', json_encode($fileArray)); } } - + private function __combineArrays($array, $array2) { foreach ($array2 as $element) { if (!in_array($element, $array)) { diff --git a/app/Controller/ThreadsController.php b/app/Controller/ThreadsController.php index 81d2402c0..d3971b3d5 100644 --- a/app/Controller/ThreadsController.php +++ b/app/Controller/ThreadsController.php @@ -13,9 +13,9 @@ class ThreadsController extends AppController { 'RequestHandler', 'Session', ); - + public $helpers = array('Js' => array('Jquery')); - + public $paginate = array( 'limit' => 60, ); @@ -23,7 +23,7 @@ class ThreadsController extends AppController { public function beforeFilter() { parent::beforeFilter(); } - + public function viewEvent($id) { $this->loadModel('Event'); $result = $this->Event->fetchEvent($this->Auth->user(), array('eventid' => $id)); @@ -84,8 +84,8 @@ class ThreadsController extends AppController { $this->layout = 'ajax'; $this->render('/Elements/eventdiscussion'); } - - + + public function view($thread_id, $eventView = false) { $post_id = false; if (isset($this->passedArgs['post_id'])) $post_id = $this->passedArgs['post_id']; @@ -113,13 +113,13 @@ class ThreadsController extends AppController { } else { $this->Thread->recursive = -1; $this->Thread->id = $thread_id; - + //If the thread doesn't exist, throw exception if (!$this->Thread->exists()) { throw new NotFoundException('Invalid thread.'); } $thread = $this->Thread->read(); - + // If the thread belongs to an event, we have to make sure that the event's distribution level hasn't changed. // This is also a good time to update the thread's distribution level if that did happen. if (!empty($thread['Thread']['event_id'])) { @@ -135,7 +135,7 @@ class ThreadsController extends AppController { } $this->set('event_id', $thread['Thread']['event_id']); } - + // If the user shouldn't be allowed to see the event send him away. if (!$this->_isSiteAdmin()) { if ($thread['Thread']['distribution'] == 0 && $thread['Thread']['org_id'] != $this->Auth->user('org_id')) { @@ -183,7 +183,7 @@ class ThreadsController extends AppController { $this->render('/Elements/eventdiscussion'); } } - + public function index() { $this->loadModel('Posts'); $this->loadModel('SharingGroup'); diff --git a/app/Controller/UsersController.php b/app/Controller/UsersController.php index 7d43a762d..daed24637 100644 --- a/app/Controller/UsersController.php +++ b/app/Controller/UsersController.php @@ -205,7 +205,7 @@ class UsersController extends AppController { $this->set('users', $this->paginate()); } } - + public function index($id) { $this->autoRender = false; $this->layout = false; @@ -260,7 +260,7 @@ class UsersController extends AppController { $this->set('simpleFilters', $textFields); $rules = array_merge($booleanFields, $textFields); $this->set('showorg', $showOrg); - + $filtering = array(); foreach ($booleanFields as $b) { $filtering[$b] = ''; @@ -268,7 +268,7 @@ class UsersController extends AppController { foreach ($textFields as $t) { $filtering[$t] = array('OR' => array(), 'NOT' => array()); } - + foreach ($this->passedArgs as $k => $v) { if (substr($k, 0, 6) === 'search') { $searchTerm = substr($k, 6); @@ -285,7 +285,7 @@ class UsersController extends AppController { } } $this->set('filtering', json_encode($filtering)); - + $roles = $this->User->Role->find('all', array('recursive' => -1)); $roleNames = array(); $roleJSON = array(); @@ -446,7 +446,7 @@ class UsersController extends AppController { } $roles = $this->User->Role->find('list', $params); $syncRoles = $this->User->Role->find('list', array('conditions' => array('perm_sync' => 1), 'recursive' => -1)); - + $this->set('currentId', $id); if ($this->request->is('post') || $this->request->is('put')) { if (!array_key_exists($this->request->data['User']['role_id'], $syncRoles)) $this->request->data['User']['server_id'] = 0; @@ -578,7 +578,7 @@ class UsersController extends AppController { $this->Session->setFlash(__('User was not deleted')); $this->redirect(array('action' => 'index')); } - + public function updateLoginTime() { if (!$this->request->is('post')) throw new MethodNotAllowedException('This feature is only accessible via POST requests'); $user = $this->User->find('first', array( @@ -657,7 +657,7 @@ class UsersController extends AppController { $org_id = $firstOrg['Organisation']['id']; } } - + // populate the DB with the first user if it's empty if ($this->User->find('count') == 0 ) { $admin = array('User' => array( @@ -694,7 +694,7 @@ class UsersController extends AppController { $this->Session->setFlash(__('Good-Bye')); $this->redirect($this->Auth->logout()); } - + public function resetauthkey($id = null) { if (!$this->_isAdmin() && Configure::read('MISP.disableUserSelfManagement')) { throw new MethodNotAllowedException('User self-management has been disabled on this instance.'); @@ -739,7 +739,7 @@ class UsersController extends AppController { $orgs = $this->User->find('all', $params); $this->set('orgs', $orgs); } - + public function histogram($selected = null) { if (!$this->request->is('ajax')) throw new MethodNotAllowedException('This function can only be accessed via AJAX.'); if ($selected == '[]') $selected = null; @@ -786,7 +786,7 @@ class UsersController extends AppController { $this->set('data', $data); $this->set('max', $max); $this->set('selectedTypes', $selectedTypes); - + // Nice graphical histogram $sigTypes = array_keys($this->Attribute->typeDefinitions); App::uses('ColourPaletteTool', 'Tools'); @@ -811,7 +811,7 @@ class UsersController extends AppController { } $this->set('termsaccepted', $this->Auth->user('termsaccepted')); } - + public function downloadTerms() { if (!Configure::read('MISP.terms_file')) { $termsFile = APP ."View/Users/terms"; @@ -975,7 +975,7 @@ class UsersController extends AppController { $this->render('ajax/passwordResetConfirmationForm'); } } - + // shows some statistics about the instance public function statistics() { // set all of the data up for the heatmaps @@ -995,24 +995,24 @@ class UsersController extends AppController { $stats[2] = $this->User->Event->Attribute->find('count', array('conditions' => array('Attribute.deleted' => false))); $stats[3] = $this->User->Event->Attribute->find('count', array('conditions' => array('Attribute.timestamp >' => $this_month, 'Attribute.deleted' => false))); - + $this->loadModel('Correlation'); $this->Correlation->recursive = -1; $stats[4] = $this->Correlation->find('count', null); $stats[4] = $stats[4] / 2; - + $stats[5] = $this->User->Event->ShadowAttribute->find('count', null); - + $stats[6] = $this->User->find('count', null); $stats[7] = count($orgs); - + $this->loadModel('Thread'); $stats[8] = $this->Thread->find('count', array('conditions' => array('Thread.post_count >' => 0))); $stats[9] = $this->Thread->find('count', array('conditions' => array('Thread.date_created >' => date("Y-m-d H:i:s",$this_month), 'Thread.post_count >' => 0))); $stats[10] = $this->Thread->Post->find('count', null); $stats[11] = $this->Thread->Post->find('count', array('conditions' => array('Post.date_created >' => date("Y-m-d H:i:s",$this_month)))); - + $this->set('stats', $stats); $this->set('orgs', $orgs); $this->set('start', strtotime(date('Y-m-d H:i:s') . ' -5 months')); @@ -1046,7 +1046,7 @@ class UsersController extends AppController { unset($newUser['Organisation'], $newUser['Role']); $this->Auth->login($newUser['User']); } - + public function fetchPGPKey($email) { if (!$this->_isAdmin()) throw new Exception('Administrators only.'); $keys = $this->User->fetchPGPKey($email); @@ -1058,7 +1058,7 @@ class UsersController extends AppController { $this->layout = false; $this->render('ajax/fetchpgpkey'); } - + public function dashboard() { $events = array(); // the last login in the session is not updated after the login - only in the db, so let's fetch it. diff --git a/app/Controller/WarninglistsController.php b/app/Controller/WarninglistsController.php index ddfa3ecd7..ca2be1c73 100644 --- a/app/Controller/WarninglistsController.php +++ b/app/Controller/WarninglistsController.php @@ -35,7 +35,7 @@ class WarninglistsController extends AppController { $this->set('warninglists', $warninglists); } } - + public function update() { if (!$this->request->is('post')) throw new MethodNotAllowedException('This action is only accessible via POST requests.'); $result = $this->Warninglist->update(); @@ -99,7 +99,7 @@ class WarninglistsController extends AppController { } $this->redirect(array('controller' => 'warninglists', 'action' => 'index')); } - + public function toggleEnable() { $id = $this->request->data['Warninglist']['data']; if (!is_numeric($id)) return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'Warninglist not found.')), 'status' => 200)); @@ -118,7 +118,7 @@ class WarninglistsController extends AppController { return new CakeResponse(array('body'=> json_encode(array('saved' => false, 'errors' => 'Warninglist could not be enabled.')), 'status' => 200)); } } - + public function enableWarninglist($id, $enable = false) { $this->Warninglist->id = $id; debug($id); @@ -127,13 +127,13 @@ class WarninglistsController extends AppController { $this->Session->setFlash('Warninglist enabled'); $this->redirect(array('controller' => 'warninglists', 'action' => 'view', $id)); } - + public function getToggleField() { if (!$this->request->is('ajax')) throw new MethodNotAllowedException('This action is available via AJAX only.'); $this->layout = 'ajax'; $this->render('ajax/getToggleField'); } - + public function view($id) { if (!is_numeric($id)) throw new NotFoundException('Invalid ID.'); $warninglist = $this->Warninglist->find('first', array('contain' => array('WarninglistEntry', 'WarninglistType'), 'conditions' => array('id' => $id))); diff --git a/app/Lib/Export/HidsExport.php b/app/Lib/Export/HidsExport.php index 2d4f39941..b211b6721 100644 --- a/app/Lib/Export/HidsExport.php +++ b/app/Lib/Export/HidsExport.php @@ -19,7 +19,7 @@ class HidsExport { if (!empty($items)) { foreach ($items as &$item) { $attribute = &$item['Attribute']; - + switch ($attribute['type']) { case 'md5': case 'sha1': diff --git a/app/Lib/Export/RPZExport.php b/app/Lib/Export/RPZExport.php index a45c618eb..c7b76c351 100644 --- a/app/Lib/Export/RPZExport.php +++ b/app/Lib/Export/RPZExport.php @@ -1,7 +1,7 @@ array( 'explanation' => 'returns the defined alternate location.', @@ -24,17 +24,17 @@ class RPZExport { 'setting_id' => 0, ), ); - + public function getPolicyById($id) { foreach ($this->__policies as $k => $v) { if ($id == $v['setting_id']) return $k; } } - + public function getIdByPolicy($policy) { return $this->__policies[$policy]['setting_id']; } - + public function explain($type, $policy) { $explanations = array( 'ip' => '; The following list of IP addresses will ', @@ -49,7 +49,7 @@ class RPZExport { ); return $explanations[$type] . $this->__policies[$policy]['explanation'] . PHP_EOL; } - + public function buildHeader($rpzSettings) { $rpzSettings['serial'] = str_replace('$date', date('Ymd'), $rpzSettings['serial']); $header = ''; @@ -58,13 +58,13 @@ class RPZExport { $header .= ' NS ' . $rpzSettings['ns'] . PHP_EOL . PHP_EOL; return $header; } - + public function export($items, $rpzSettings) { $result = $this->buildHeader($rpzSettings); $policy = $this->getPolicyById($rpzSettings['policy']); $action = $this->__policies[$policy]['action']; if ($policy == 'walled-garden') $action = str_replace('$walled_garden', $rpzSettings['walled_garden'], $action); - + if (isset($items['ip'])) { $result .= $this->explain('ip', $policy); foreach ($items['ip'] as $item) { @@ -72,7 +72,7 @@ class RPZExport { } $result .= PHP_EOL; } - + if (isset($items['domain'])) { $result .= $this->explain('domain', $policy); foreach ($items['domain'] as $item) { @@ -80,7 +80,7 @@ class RPZExport { } $result .= PHP_EOL; } - + if (isset($items['hostname'])) { $result .= $this->explain('hostname', $policy); foreach ($items['hostname'] as $item) { @@ -94,11 +94,11 @@ class RPZExport { private function __convertdomain($input, $action) { return $input . ' CNAME ' . $action . PHP_EOL . '*.' . $input . ' CNAME ' . $action . PHP_EOL; } - + private function __converthostname($input, $action) { return $input . ' CNAME ' . $action . PHP_EOL; } - + private function __convertip($input, $action) { $type = filter_var($input, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) ? 'ipv6' : 'ipv4'; if ($type == 'ipv6') $prefix = '128'; @@ -108,14 +108,14 @@ class RPZExport { } return $prefix . '.' . $this->{'__' . $type}($input) . '.rpz-ip CNAME ' . $action . PHP_EOL; } - + private function __ipv6($input) { return implode('.', array_reverse(preg_split('/:/', str_replace('::', ':zz:', $input), NULL, PREG_SPLIT_NO_EMPTY))); } - + private function __ipv4($input) { return implode('.', array_reverse(explode('.', $input))); - + } } diff --git a/app/Lib/Tools/ColourPaletteTool.php b/app/Lib/Tools/ColourPaletteTool.php index 452c2ed2e..fc9847768 100644 --- a/app/Lib/Tools/ColourPaletteTool.php +++ b/app/Lib/Tools/ColourPaletteTool.php @@ -1,6 +1,6 @@ convertToHex(array($R, $G, $B)); } - + function convertToHex($channels) { $colour = '#'; foreach ($channels as &$channel) { @@ -56,7 +56,7 @@ class ColourPaletteTool { } return $colour; } - + // pass the element's id from the list along to get a colour for a single item function generatePaletteFromString($string, $items, $onlySpecific = false) { $hue = $this->__stringToNumber($string); @@ -74,7 +74,7 @@ class ColourPaletteTool { } return $results; } - + private function __stringToNumber($string) { $string = mb_convert_encoding($string, 'ASCII'); $number = 0; diff --git a/app/Lib/Tools/ComplexTypeTool.php b/app/Lib/Tools/ComplexTypeTool.php index bcd85b865..c9a3a3c14 100644 --- a/app/Lib/Tools/ComplexTypeTool.php +++ b/app/Lib/Tools/ComplexTypeTool.php @@ -1,7 +1,7 @@ 'http', '/\[\.\]/' => '.', @@ -9,7 +9,7 @@ class ComplexTypeTool { '/\\\./' => '.', '/\.+/' => '.' ); - + public function checkComplexRouter($input, $type) { switch ($type) { case 'File': @@ -25,7 +25,7 @@ class ComplexTypeTool { return false; } } - + // checks if the passed input matches a valid file description attribute's pattern (filename, md5, sha1, sha256, filename|md5, filename|sha1, filename|sha256) public function checkComplexFile($input) { $original = $input; @@ -46,7 +46,7 @@ class ComplexTypeTool { if ($type == '') $type = 'other'; return array('type' => $type, 'value' => $original); } - + public function checkComplexCnC($input) { $type = ''; $toReturn = array(); @@ -62,21 +62,21 @@ class ComplexTypeTool { } return array('type' => 'domain', 'value' => $input); } - + if (!preg_match("#\n#", $input)) return array('type' => 'url', 'value' => $input); return array('type' => 'other', 'value' => $input); } - + private function __returnOddElements(&$array) { foreach ($array as $k => &$v) if ($k % 2 != 1) unset($array[$k]); return array_values($array); } - + public function checkFreeText($input) { $iocArray = preg_split("/\r\n|\n|\r|\s|\s+|,|;/", $input); $quotedText = explode('"', $input); $iocArray = array_merge($iocArray, $this->__returnOddElements($quotedText)); - + $resultArray = array(); if (!empty($iocArray)) { foreach ($iocArray as $ioc) { @@ -102,7 +102,7 @@ class ComplexTypeTool { 96 => array('single' => array('sha384'), 'composite' => array('filename|sha384')), 128 => array('single' => array('sha512'), 'composite' => array('filename|sha512')) ); - + private function __resolveType($input) { $result = array(); $input = trim($input); @@ -117,7 +117,7 @@ class ComplexTypeTool { } } } - + // check for hashes foreach ($this->__hexHashTypes as $k => &$v) { if (strlen($input) == $k && preg_match("#[0-9a-f]{" . $k . "}$#i", $input)) return array('types' => $v['single'], 'to_ids' => true, 'default_type' => $v['single'][0]); @@ -144,7 +144,7 @@ class ComplexTypeTool { if (filter_var($temp[0], FILTER_VALIDATE_IP) && is_numeric($temp[1])) return array('types' => array('ip-dst', 'ip-src', 'ip-src/ip-dst'), 'to_ids' => true, 'default_type' => 'ip-dst', 'comment' => $comment, 'value' => $inputRefangedNoPort); } } - + // check for domain name, hostname, filename if (strpos($inputRefanged, '.') !== false) { $temp = explode('.', $inputRefanged); @@ -167,7 +167,7 @@ class ComplexTypeTool { if ($this->__resolveFilename($input)) return array('types' => array('filename'), 'to_ids' => true, 'default_type' => 'filename'); } } - + if (strpos($input, '\\') !== false) { $temp = explode('\\', $input); if (strpos($temp[count($temp)-1], '.')) { @@ -176,13 +176,13 @@ class ComplexTypeTool { return array('types' => array('regkey'), 'to_ids' => false, 'default_type' => 'regkey'); } } - + // check for CVE if (preg_match("#^cve-[0-9]{4}-[0-9]{4,9}$#i", $input)) return array('types' => array('vulnerability'), 'category' => 'External analysis', 'to_ids' => false, 'default_type' => 'vulnerability'); - + return false; } - + private function __resolveFilename($input) { if ( strpos($input, '.') != 0 && diff --git a/app/Lib/Tools/CustomPaginationTool.php b/app/Lib/Tools/CustomPaginationTool.php index b161f49f6..e38ec843e 100644 --- a/app/Lib/Tools/CustomPaginationTool.php +++ b/app/Lib/Tools/CustomPaginationTool.php @@ -1,6 +1,6 @@ $model, @@ -37,12 +37,12 @@ class CustomPaginationTool { $params['pageCount'] = $maxPage; return $params; } - + function truncateByPagination(&$items, $params) { if (empty($items)) return; $items = array_slice($items, $params['current'] - 1, $params['current'] + $params['limit']); } - + function applyRulesOnArray(&$items, $options, $model, $sort = 'id') { $params = $this->createPaginationRules($items, $options, $model, $sort); $direction = 'asc'; @@ -54,7 +54,7 @@ class CustomPaginationTool { $this->truncateByPagination($items, $params); return $params; } - + function cmp($a, $b) { $multiplier = 1; if ($this->direction == 'desc') $multiplier = -1; diff --git a/app/Lib/Tools/FinancialTool.php b/app/Lib/Tools/FinancialTool.php index aa8832cae..cae8ec232 100644 --- a/app/Lib/Tools/FinancialTool.php +++ b/app/Lib/Tools/FinancialTool.php @@ -87,7 +87,7 @@ class FinancialTool { 'VG' => '24', 'XK' => '20' ); - + public function validateRouter($type, $value) { $validationRoutes = array( 'cc-number' => 'CC', @@ -99,7 +99,7 @@ class FinancialTool { if (in_array($type, array_keys($validationRoutes))) return $this->{'validate' . strtoupper($validationRoutes[$type])}($value); return true; } - + // validating using method described on wikipedia @ https://en.wikipedia.org/wiki/International_Bank_Account_Number#Algorithms public function validateIBAN($iban) { if (strlen($iban) < 15 || strlen($iban) > 32) return false; @@ -112,17 +112,17 @@ class FinancialTool { $temp = bcmod($temp2, 97); return intval($temp)===1 ? true : false; } - + public function validateBIC($bic) { if (preg_match('/^([A-Z]{4})([A-Z]){2}([0-9A-Z]){2}([0-9A-Z]{3})?$/i', $bic)) return true; return false; } - + public function validateBIN($bin) { if (is_numeric($bin) && strlen($bin) == 6) return true; return false; } - + // based on the explanation at www.freeformatter.com/credit-card-number-generator-validator.html#validate public function validateCC($cc) { if (is_numeric($cc) && strlen($cc) > 12 && strlen($cc) < 20) { @@ -143,26 +143,26 @@ class FinancialTool { } return false; } - + // based on the php implementation of the BTC address validation example from // http://rosettacode.org/wiki/Bitcoin/address_validation public function validateBTC($address){ if (strlen($address) < 26 || strlen($address) > 35) return false; $decoded = $this->__decodeBase58($address); if ($decoded === false) return false; - + $d1 = hash("sha256", substr($decoded,0,21), true); $d2 = hash("sha256", $d1, true); - + if(substr_compare($decoded, $d2, 21, 4)){ return false; } return true; } - + private function __decodeBase58($input) { $alphabet = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz"; - + $out = array_fill(0, 25, 0); for($i=0;$i $tag) { $event['Event']['Tag'][$k] = $tag['Tag']; } } - + if (isset($event['RelatedAttribute'])) $event['Event']['RelatedAttribute'] = $event['RelatedAttribute']; else $event['Event']['RelatedAttribute'] = array(); // @@ -36,7 +36,7 @@ class JSONConverterTool { unset($event['Event']['orgc']); unset($event['Event']['from']); } - + if (isset($event['Event']['Attribute'])) { // remove value1 and value2 from the output and remove invalid utf8 characters for the xml parser foreach ($event['Event']['Attribute'] as $key => $value) { @@ -65,7 +65,7 @@ class JSONConverterTool { if (isset($event['errors'])) $result = array_merge($result, array('errors' => $event['errors'])); return json_encode($result, JSON_PRETTY_PRINT); } - + public function arrayPrinter($array, $root = true) { if (is_array($array)) { $resultArray = array(); @@ -84,13 +84,13 @@ class JSONConverterTool { return $text; } else return $resultArray; } - + public function eventCollection2Format($events, $isSiteAdmin=false) { $results = array(); foreach ($events as &$event) $results[] = $this->event2JSON($event, $isSiteAdmin); return implode(',' . PHP_EOL, $results); } - + public function frameCollection($input, $mispVersion = false) { $result = '{"response":['; $result .= $input; diff --git a/app/Lib/Tools/PubSubTool.php b/app/Lib/Tools/PubSubTool.php index 91ea03787..0dd20d8bc 100644 --- a/app/Lib/Tools/PubSubTool.php +++ b/app/Lib/Tools/PubSubTool.php @@ -1,6 +1,6 @@ 'localhost', @@ -19,7 +19,7 @@ class PubSubTool { $settingsFile->close(); return $settings; } - + // read the pid file, if it exists, check if the process is actually running // if either the pid file doesn't exists or the process is not running return false // otherwise return the pid @@ -32,7 +32,7 @@ class PubSubTool { if (empty($result)) return false; return $pid; } - + public function statusCheck() { $redis = new Redis(); $settings = $this->__getSetSettings(); @@ -43,13 +43,13 @@ class PubSubTool { $response = trim($redis->lPop($settings['redis_namespace'] . ':status')); return json_decode($response, true); } - + public function checkIfPythonLibInstalled() { $result = trim(shell_exec('python ' . APP . 'files' . DS . 'scripts' . DS . 'mispzmq' . DS . 'mispzmqtest.py')); if ($result === "OK") return true; return false; } - + private function __setupPubServer() { App::uses('File', 'Utility'); $settings = $this->__getSetSettings(); @@ -58,7 +58,7 @@ class PubSubTool { } return $settings; } - + public function publishEvent($event) { $settings = $this->__setupPubServer(); App::uses('JSONConverterTool', 'Tools'); @@ -70,7 +70,7 @@ class PubSubTool { $redis->rPush($settings['redis_namespace'] . ':misp_json', $json); return true; } - + public function killService($settings = false) { $redis = new Redis(); if ($this->checkIfRunning()) { @@ -85,7 +85,7 @@ class PubSubTool { } return true; } - + // reload the server if it is running, if not, start it public function reloadServer() { if (!$this->checkIfRunning()) { @@ -100,7 +100,7 @@ class PubSubTool { if (!$this->checkIfRunning()) return 'Setting saved, but something is wrong with the ZeroMQ server. Please check the diagnostics page for more information.'; return true; } - + public function restartServer() { if (!$this->killService()) { return 'Could not kill the previous instance of the ZeroMQ script.'; diff --git a/app/Lib/Tools/SyncTool.php b/app/Lib/Tools/SyncTool.php index 6678d7d48..ab8a48179 100644 --- a/app/Lib/Tools/SyncTool.php +++ b/app/Lib/Tools/SyncTool.php @@ -15,7 +15,7 @@ class SyncTool { if (isset($proxy['host']) && !empty($proxy['host'])) $HttpSocket->configProxy($proxy['host'], $proxy['port'], $proxy['method'], $proxy['user'], $proxy['password']); return $HttpSocket; } - + public function setupHttpSocketFeed($feed = null) { App::uses('HttpSocket', 'Network/Http'); $HttpSocket = new HttpSocket(); diff --git a/app/Lib/Tools/XMLConverterTool.php b/app/Lib/Tools/XMLConverterTool.php index 47e669be3..7bc2060db 100644 --- a/app/Lib/Tools/XMLConverterTool.php +++ b/app/Lib/Tools/XMLConverterTool.php @@ -1,9 +1,9 @@ ", "\"", "'"); private $__escapeWith = array('&', '<', '>', '"', '''); - + public function recursiveEcho($array) { $text = ""; if (is_array($array)) foreach ($array as $k => $v) { @@ -26,7 +26,7 @@ class XMLConverterTool { } return $text; } - + public function event2xmlArray($event, $isSiteAdmin=false) { $event['Event']['Org'][0] = $event['Org']; $event['Event']['Orgc'][0] = $event['Orgc']; @@ -49,11 +49,11 @@ class XMLConverterTool { unset($event['ShadowAttribute']); } if (isset($event['RelatedEvent'])) if (isset($event['RelatedEvent'])) $event['Event']['RelatedEvent'] = $event['RelatedEvent']; - + // legacy unset($event['Event']['org']); unset($event['Event']['orgc']); - + if (isset($event['EventTag'])) { foreach ($event['EventTag'] as $k => $tag) { $event['Event']['Tag'][$k] = $tag['Tag']; @@ -79,7 +79,7 @@ class XMLConverterTool { if (!Configure::read('MISP.showorg') && !$isSiteAdmin) { unset($event['Event']['Org'], $event['Event']['Orgc'], $event['Event']['from']); } - + if (isset($event['Event']['Attribute'])) { // remove value1 and value2 from the output and remove invalid utf8 characters for the xml parser foreach ($event['Event']['Attribute'] as $key => $value) { @@ -148,25 +148,25 @@ class XMLConverterTool { if (isset($event['errors']) && !empty($event['errors'])) $result['errors'] = $event['errors']; return $result; } - + public function event2XML($event, $isSiteAdmin=false) { $xmlArray = $this->event2xmlArray($event, $isSiteAdmin); $result = array('Event' => array(0 => $xmlArray['Event'])); if (isset($xmlArray['errors']) && !empty($xmlArray['errors'])) $result['errors'] = array($xmlArray['errors']); return $this->recursiveEcho($result); } - + private function __sanitizeField(&$field) { $field = preg_replace ('/[^\x{0009}\x{000a}\x{000d}\x{0020}-\x{D7FF}\x{E000}-\x{FFFD}]+/u', ' ', $field); $field = str_replace($this->__toEscape, $this->__escapeWith, $field); } - + public function eventCollection2Format($events, $isSiteAdmin=false) { $result = ""; foreach ($events as $event) $result .= $this->event2XML($event) . PHP_EOL; return $result; } - + public function frameCollection($input, $mispVersion = false) { $result = '' . PHP_EOL . '' . PHP_EOL; $result .= $input; diff --git a/app/Model/AppModel.php b/app/Model/AppModel.php index 932586a15..9c570486e 100644 --- a/app/Model/AppModel.php +++ b/app/Model/AppModel.php @@ -45,14 +45,14 @@ class AppModel extends Model { $this->name = get_class($this); } - + // major -> minor -> hotfix -> requires_logout public $db_changes = array( 2 => array( 4 => array(18 => false, 19 => false, 20 => false, 25 => false, 27 => false, 32 => false, 33 => true, 38 => true, 39 => true, 40 => false, 42 => false, 44 => false, 45 => false) ) ); - + // Generic update script // add special cases where the upgrade does more than just update the DB // this could become useful in the future @@ -81,7 +81,7 @@ class AppModel extends Model { break; } } - + private function __addNewFeeds($feeds) { $this->Feed = ClassRegistry::init('Feed'); $this->Log = ClassRegistry::init('Log'); @@ -106,7 +106,7 @@ class AppModel extends Model { } $this->Log->save($entry); } - + // SQL scripts for updates public function updateDatabase($command) { $sql = ''; @@ -167,9 +167,9 @@ class AppModel extends Model { case '24betaupdates': $sqlArray = array(); $sqlArray[] = "ALTER TABLE `shadow_attributes` ADD `proposal_to_delete` tinyint(1) NOT NULL DEFAULT '0';"; - + $sqlArray[] = 'ALTER TABLE `logs` MODIFY `change` text COLLATE utf8_bin NOT NULL;'; - + $sqlArray[] = "CREATE TABLE IF NOT EXISTS `taxonomies` ( `id` int(11) NOT NULL AUTO_INCREMENT, `namespace` varchar(255) COLLATE utf8_bin NOT NULL, @@ -178,7 +178,7 @@ class AppModel extends Model { `enabled` tinyint(1) NOT NULL DEFAULT '0', PRIMARY KEY (`id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_bin ;"; - + $sqlArray[] = "CREATE TABLE IF NOT EXISTS `taxonomy_entries` ( `id` int(11) NOT NULL AUTO_INCREMENT, `taxonomy_predicate_id` int(11) NOT NULL, @@ -187,7 +187,7 @@ class AppModel extends Model { PRIMARY KEY (`id`), KEY `taxonomy_predicate_id` (`taxonomy_predicate_id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_bin;"; - + $sqlArray[] = "CREATE TABLE IF NOT EXISTS `taxonomy_predicates` ( `id` int(11) NOT NULL AUTO_INCREMENT, `taxonomy_id` int(11) NOT NULL, @@ -196,19 +196,19 @@ class AppModel extends Model { PRIMARY KEY (`id`), KEY `taxonomy_id` (`taxonomy_id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_bin;"; - + $sqlArray[] = 'ALTER TABLE `jobs` ADD `org` text COLLATE utf8_bin NOT NULL;'; - + $sqlArray[] = 'ALTER TABLE `servers` ADD `name` varchar(255) NOT NULL;'; - + $sqlArray[] = 'ALTER TABLE `sharing_groups` ADD `sync_user_id` INT( 11 ) NOT NULL DEFAULT \'0\' AFTER `org_id`;'; - + $sqlArray[] = 'ALTER TABLE `users` ADD `disabled` BOOLEAN NOT NULL;'; $sqlArray[] = 'ALTER TABLE `users` ADD `expiration` datetime DEFAULT NULL;'; - + $sqlArray[] = 'UPDATE `roles` SET `perm_template` = 1 WHERE `perm_site_admin` = 1 OR `perm_admin` = 1'; $sqlArray[] = 'UPDATE `roles` SET `perm_sharing_group` = 1 WHERE `perm_site_admin` = 1 OR `perm_sync` = 1'; - + //create indexes break; case 'indexTables': @@ -228,7 +228,7 @@ class AppModel extends Model { 'threads' => array(array('user_id', 'INDEX'), array('event_id', 'INDEX'), array('org_id', 'INDEX'), array('sharing_group_id', 'INDEX')), 'users' => array(array('org_id', 'INDEX'), array('server_id', 'INDEX'), array('email', 'INDEX')), ); - + $version = $this->query('select version();'); $version = $version[0][0]['version()']; $version = explode('.', $version); @@ -236,7 +236,7 @@ class AppModel extends Model { $version[1] = intval($version[1]); $downgrade = true; if ($version[0] > 5 || ($version[0] == 5 && $version[1] > 5)) $downgrade = false; - + // keep the fulltext for now, we can change it later to actually use it once we require MySQL 5.6 / or if we decide to move some tables to MyISAM foreach ($fieldsToIndex as $table => $fields) { @@ -433,7 +433,7 @@ class AppModel extends Model { if ($clean) $this->cleanCacheFiles(); return true; } - + private function __dropIndex($table, $field) { $this->Log = ClassRegistry::init('Log'); $indexCheck = "SELECT INDEX_NAME FROM INFORMATION_SCHEMA.STATISTICS WHERE table_schema=DATABASE() AND table_name='" . $table . "' AND index_name LIKE '" . $field . "%'"; @@ -459,7 +459,7 @@ class AppModel extends Model { )); } } - + public function cleanCacheFiles() { Cache::clear(); clearCache(); @@ -472,7 +472,7 @@ class AppModel extends Model { } } } - + public function checkMISPVersion() { App::uses('Folder', 'Utility'); $file = new File(ROOT . DS . 'VERSION.json', true); @@ -480,7 +480,7 @@ class AppModel extends Model { $file->close(); return $version_array; } - + // wrapper for UUID generation, compatible with cakephp <= 2.6 and cakephp and cakephp >= 2.7 public function generateUuid() { $version = Configure::version(); @@ -489,7 +489,7 @@ class AppModel extends Model { else $uuid = CakeText::uuid(); return $uuid; } - + // alternative to the build in notempty/notblank validation functions, compatible with cakephp <= 2.6 and cakephp and cakephp >= 2.7 public function valueNotEmpty($value) { $field = array_keys($value); @@ -498,7 +498,7 @@ class AppModel extends Model { if (!empty($value[$field])) return true; return ucfirst($field) . ' cannot be empty.'; } - + public function stringNotEmpty($value) { $field = array_keys($value); $field = $field[0]; @@ -506,7 +506,7 @@ class AppModel extends Model { if (!isset($value[$field]) || ($value[$field] == false && $value[$field] !== "0")) return ucfirst($field) . ' cannot be empty.'; return true; } - + public function runUpdates() { $this->AdminSetting = ClassRegistry::init('AdminSetting'); $db = ConnectionManager::getDataSource('default'); @@ -534,7 +534,7 @@ class AppModel extends Model { $this->updateDatabase('destroyAllSessions'); } } - + private function __queueCleanDB() { $this->AdminSetting = ClassRegistry::init('AdminSetting'); $cleanDB = $this->AdminSetting->find('first', array('conditions' => array('setting' => 'clean_db'))); @@ -546,7 +546,7 @@ class AppModel extends Model { } $this->AdminSetting->save($cleanDB); } - + private function __runCleanDB() { $this->AdminSetting = ClassRegistry::init('AdminSetting'); $cleanDB = $this->AdminSetting->find('first', array('conditions' => array('setting' => 'clean_db'))); @@ -561,7 +561,7 @@ class AppModel extends Model { $this->AdminSetting->save($cleanDB); } } - + private function __findUpgrades($db_version) { $version = explode('.', $db_version); $updates = array(); @@ -582,7 +582,7 @@ class AppModel extends Model { } return $updates; } - + public function populateNotifications($user) { $notifications = array(); @@ -598,7 +598,7 @@ class AppModel extends Model { } return $notifications; } - + private function _getProposalCount($user) { $this->ShadowAttribute = ClassRegistry::init('ShadowAttribute'); @@ -619,7 +619,7 @@ class AppModel extends Model { $results[1] = count($eventIds); return $results; } - + private function _getDelegationCount($user) { $this->EventDelegation = ClassRegistry::init('EventDelegation'); $delegations = $this->EventDelegation->find('count', array( diff --git a/app/Model/Attribute.php b/app/Model/Attribute.php index a32429296..c8bc3a309 100644 --- a/app/Model/Attribute.php +++ b/app/Model/Attribute.php @@ -67,7 +67,7 @@ class Attribute extends AppModel { public $distributionLevels = array( 0 => 'Your organisation only', 1 => 'This community only', 2 => 'Connected communities', 3 => 'All communities', 4 => 'Sharing group', 5 => 'Inherit event' ); - + public $shortDist = array(0 => 'Organisation', 1 => 'Community', 2 => 'Connected', 3 => 'All', 4 => ' sharing Group', 5 => 'Inherit'); // these are definitions of possible types + their descriptions and maybe later other behaviors @@ -82,7 +82,7 @@ class Attribute extends AppModel { public $uploadDefinitions = array( 'attachment' ); - + // skip Correlation for the following types public $nonCorrelatingTypes = array( 'vulnerability', @@ -246,7 +246,7 @@ class Attribute extends AppModel { 'types' => array('comment', 'text', 'other') ) ); - + public $defaultCategories = array( 'md5' => 'Payload delivery', 'sha1' => 'Payload delivery', @@ -276,7 +276,7 @@ class Attribute extends AppModel { 'attachment' => 'External analysis', 'malware-sample' => 'Payload delivery' ); - + // typeGroupings are a mapping to high level groups for attributes // for example, IP addresses, domain names, hostnames and e-mail addresses are network related attribute types // whilst filenames and hashes are file related attribute types @@ -375,7 +375,7 @@ class Attribute extends AppModel { //'on' => 'create', // Limit validation to 'create' or 'update' operations ), ); - + // automatic resolution of complex types // If the complex type "file" is chosen for example, then the system will try to categorise the values entered into a complex template field based // on the regular expression rules @@ -389,7 +389,7 @@ class Attribute extends AppModel { 'types' => array('url', 'domain', 'hostname', 'ip-dst'), ), ); - + public $typeGroupCategoryMapping = array( 'Payload delviery' => array('File', 'CnC'), 'Payload installation' => array('File'), @@ -423,7 +423,7 @@ class Attribute extends AppModel { 'foreignKey' => 'sharing_group_id' ) ); - + public $hashTypes = array( 'md5' => array( 'length' => 32, @@ -467,9 +467,9 @@ class Attribute extends AppModel { $this->data['Attribute']['value2'] = ''; } } - + if ($this->data['Attribute']['distribution'] != 4) $this->data['Attribute']['sharing_group_id'] = 0; - + // update correlation... (only needed here if there's an update) if ($this->id || !empty($this->data['Attribute']['id'])) { $this->__beforeSaveCorrelation($this->data['Attribute']); @@ -557,7 +557,7 @@ class Attribute extends AppModel { if (in_array($fields['category'], $validCategories)) return true; return false; } - + public function valueIsUnique ($fields) { if (isset($this->data['Attribute']['deleted']) && $this->data['Attribute']['deleted']) return true; $value = $fields['value']; @@ -600,7 +600,7 @@ class Attribute extends AppModel { $value = $fields['value']; return $this->runValidation($value, $this->data['Attribute']['type']); } - + private $__hexHashLengths = array( 'authentihash' => 64, 'md5' => 32, @@ -615,7 +615,7 @@ class Attribute extends AppModel { 'sha512/224' => 56, 'sha512/256' => 64, ); - + public function runValidation($value, $type) { $returnValue = false; // check data validation @@ -899,7 +899,7 @@ class Attribute extends AppModel { } return $returnValue; } - + // do some last second modifications before the validation public function modifyBeforeValidation($type, $value) { switch($type) { @@ -1253,7 +1253,7 @@ class Attribute extends AppModel { } return $fails; } - + public function hids($user, $type, $tags = '', $from = false, $to = false, $last = false) { if (empty($user)) throw new MethodNotAllowedException('Could not read user.'); @@ -1298,11 +1298,11 @@ class Attribute extends AppModel { return $rules; } - + public function nids($user, $format, $id = false, $continue = false, $tags = false, $from = false, $to = false, $last = false) { if (empty($user)) throw new MethodNotAllowedException('Could not read user.'); $eventIds = $this->Event->fetchEventIds($user, $from, $to, $last); - + // If we sent any tags along, load the associated tag names for each attribute if ($tags) { $tag = ClassRegistry::init('Tag'); @@ -1319,7 +1319,7 @@ class Attribute extends AppModel { } } } - + if ($id) { foreach ($eventIds as $k => $v) { if ($v['Event']['id'] !== $id) unset($eventIds[$k]); @@ -1328,13 +1328,13 @@ class Attribute extends AppModel { if ($format == 'suricata') App::uses('NidsSuricataExport', 'Export'); else App::uses('NidsSnortExport', 'Export'); - + $rules = array(); foreach ($eventIds as $event) { $conditions['AND'] = array('Attribute.to_ids' => 1, "Event.published" => 1, 'Attribute.event_id' => $event['Event']['id']); $valid_types = array('ip-dst', 'ip-src', 'email-src', 'email-dst', 'email-subject', 'email-attachment', 'domain', 'hostname', 'url', 'user-agent', 'snort'); $conditions['AND']['Attribute.type'] = $valid_types; - + $params = array( 'conditions' => $conditions, // array of conditions 'recursive' => -1, // int @@ -1396,7 +1396,7 @@ class Attribute extends AppModel { )))); return $attributes; } - + public function rpz($user, $tags = false, $eventId = false, $from = false, $to = false) { // we can group hostname and domain as well as ip-src and ip-dst in this case $conditions['AND'] = array('Attribute.to_ids' => 1, 'Event.published' => 1); @@ -1456,7 +1456,7 @@ class Attribute extends AppModel { } return $values; } - + public function generateCorrelation($jobId = false, $startPercentage = 0) { $this->Correlation = ClassRegistry::init('Correlation'); $this->Correlation->deleteAll(array('id !=' => 0), false); @@ -1488,11 +1488,11 @@ class Attribute extends AppModel { if ($jobId && Configure::read('MISP.background_jobs')) $this->Job->saveField('message', 'Job done.'); return $attributeCount; } - + public function reportValidationIssuesAttributes($eventId) { $conditions = array(); if ($eventId && is_numeric($eventId)) $conditions = array('event_id' => $eventId); - + // get all attributes.. $attributes = $this->find('all', array('recursive' => -1, 'fields' => array('id'), 'conditions' => $conditions)); // for all attributes.. @@ -1514,7 +1514,7 @@ class Attribute extends AppModel { } return $result; } - + // This method takes a string from an argument with several elements (separated by '&&' and negated by '!') and returns 2 arrays // array 1 will have all of the non negated terms and array 2 all the negated terms public function dissectArgs($args) { @@ -1537,7 +1537,7 @@ class Attribute extends AppModel { $result[1] = $reject; return $result; } - + public function checkForValidationIssues($attribute) { $this->set($attribute); if ($this->validates()) { @@ -1546,8 +1546,8 @@ class Attribute extends AppModel { return $this->validationErrors; } } - - + + public function checkTemplateAttributes($template, &$data, $event_id) { $result = array(); $errors = array(); @@ -1589,7 +1589,7 @@ class Attribute extends AppModel { } return array('attributes' => $attributes, 'errors' => $errors); } - + private function __resolveElementAttribute($element, $value) { $attributes = array(); @@ -1619,7 +1619,7 @@ class Attribute extends AppModel { } return array('attributes' => $results, 'errors' => $errors); } - + private function __resolveElementFile($element, $files) { $attributes = array(); $errors = null; @@ -1695,7 +1695,7 @@ class Attribute extends AppModel { } return $attribute; } - + public function buildConditions($user) { $conditions = array(); if (!$user['Role']['perm_site_admin']) { @@ -1727,7 +1727,7 @@ class Attribute extends AppModel { } return $conditions; } - + // Method that fetches all attributes for the various exports // very flexible, it's basically a replacement for find, with the addition that it restricts access based on user // options: @@ -1766,7 +1766,7 @@ class Attribute extends AppModel { } return $results; } - + // Method gets and converts the contents of a file passed along as a base64 encoded string with the original filename into a zip archive // The zip archive is then passed back as a base64 encoded string along with the md5 hash and a flag whether the transaction was successful // The archive is password protected using the "infected" password @@ -1798,7 +1798,7 @@ class Attribute extends AppModel { $contentsFile->delete(); return $result; } - + private function __hashRouter($hashType, $file) { $validHashes = array('md5', 'sha1', 'sha256'); if (!in_array($hashType, $validHashes)) return false; @@ -1811,7 +1811,7 @@ class Attribute extends AppModel { } return false; } - + public function generateRandomFileName() { $length = 12; $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'; @@ -1822,7 +1822,7 @@ class Attribute extends AppModel { } return $fn; } - + public function resolveHashType($hash) { $hashTypes = $this->hashTypes; $validTypes = array(); @@ -1833,7 +1833,7 @@ class Attribute extends AppModel { } return $validTypes; } - + public function validateAttribute($attribute, $context = true) { $this->set($attribute); if (!$context) { @@ -1845,7 +1845,7 @@ class Attribute extends AppModel { return $this->validationErrors; } } - + public function restore($id, $user) { $this->id = $id; if (!$this->exists()) return 'Attribute doesn\'t exist, or you lack the permission to edit it.'; diff --git a/app/Model/Behavior/RegexpBehavior.php b/app/Model/Behavior/RegexpBehavior.php index 72ab6eeea..d55bdc5a8 100644 --- a/app/Model/Behavior/RegexpBehavior.php +++ b/app/Model/Behavior/RegexpBehavior.php @@ -7,9 +7,9 @@ App::uses('Regexp', 'Model'); * */ class RegexpBehavior extends ModelBehavior { - + private $__allRegexp = array(); - + public function setup(Model $model, $config = null) { $regexp = new Regexp(); $this->__allRegexp = $regexp->find('all'); diff --git a/app/Model/Event.php b/app/Model/Event.php index 46afad313..a5deb6567 100644 --- a/app/Model/Event.php +++ b/app/Model/Event.php @@ -28,7 +28,7 @@ class Event extends AppModel { public $displayField = 'id'; public $virtualFields = array(); - + public $mispVersion = '2.4.0'; /** @@ -57,7 +57,7 @@ class Event extends AppModel { 2 => array('desc' => 'This field determines the current distribution of the event', 'formdesc' => "Users that are part of your MISP community will be able to see the event. This includes all organisations on this MISP server, all organisations on MISP servers synchronising with this server and the hosting organisations of servers that connect to those afore mentioned servers (so basically any server that is 2 hops away from this one). Any other organisations connected to linked servers that are 2 hops away from this will be restricted from seeing the event. Use this option if this server isn't the central MISP hub of the community but is connected to it."), 3 => array('desc' => 'This field determines the current distribution of the event', 'formdesc' => "This will share the event with all MISP communities, allowing the event to be freely propagated from one server to the next."), 4 => array('desc' => 'This field determines the current distribution of the event', 'formdesc' => "This distribution of this event will be handled by the selected sharing group."), - + ); public $analysisLevels = array( @@ -67,7 +67,7 @@ class Event extends AppModel { public $distributionLevels = array( 0 => 'Your organisation only', 1 => 'This community only', 2 => 'Connected communities', 3 => 'All communities', 4 => 'Sharing group' ); - + public $shortDist = array(0 => 'Organisation', 1 => 'Community', 2 => 'Connected', 3 => 'All', 4 => ' sharing Group'); public $export_types = array( @@ -117,7 +117,7 @@ class Event extends AppModel { 'description' => 'Click on one of the buttons below to download all the attributes with the matching type. This list can be used to feed forensic software when searching for susipicious files. Only published events and attributes marked as IDS Signature are exported.' ), ); - + public $csv_event_context_fields_to_fetch = array( 'event_info' => array('object' => false, 'var' => 'info'), 'event_member_org' => array('object' => 'Org', 'var' => 'name'), @@ -128,7 +128,7 @@ class Event extends AppModel { 'event_date' => array('object' => false, 'var' => 'date'), 'event_tag' => array('object' => 'Tag', 'var' => 'name') ); - + /** * Validation rules * @@ -177,14 +177,14 @@ class Event extends AppModel { //'on' => 'create', // Limit validation to 'create' or 'update' operations ) ), - + 'sharing_group_id' => array( 'rule' => array('sharingGroupRequired'), 'message' => 'If the distribution is set to "Sharing Group", a sharing group has to be selected.', //'required' => true, //'allowEmpty' => true ), - + 'analysis' => array( 'rule' => array('inList', array('0', '1', '2')), 'message' => 'Options : 0, 1, 2 (for Initial, Ongoing, Completed)', @@ -325,10 +325,10 @@ class Event extends AppModel { $orgc = $this->Orgc->find('first', array('conditions' => array('Orgc.id' => $this->data['Event']['orgc_id']), 'recursive' => -1, 'fields' => array('Orgc.name'))); $this->EventBlacklist->save(array('event_uuid' => $this->data['Event']['uuid'], 'event_info' => $this->data['Event']['info'], 'event_orgc' => $orgc['Orgc']['name'])); } - + // delete all of the event->tag combinations that involve the deleted event $this->EventTag->deleteAll(array('event_id' => $this->id)); - + // FIXME secure this filesystem access/delete by not allowing to change directories or go outside of the directory container. // only delete the file if it exists $filepath = APP . "files" . DS . $this->id; @@ -380,14 +380,14 @@ class Event extends AppModel { $date = new DateTime(); $this->data['Event']['timestamp'] = $date->getTimestamp(); } - + if (empty($this->data['Event']['date'])) { $this->data['Event']['date'] = date('Y-m-d'); } - + if (!isset($this->data['Event']['distribution']) || $this->data['Event']['distribution'] != 4) $this->data['Event']['sharing_group_id'] = 0; } - + public function afterSave($created, $options = array()) { if (!$created) { $this->Correlation = ClassRegistry::init('Correlation'); @@ -406,7 +406,7 @@ class Event extends AppModel { public function isOwnedByOrg($eventid, $org) { return $this->field('id', array('id' => $eventid, 'org_id' => $org)) === $eventid; } - + // gets the logged in user + an array of events, attaches the correlation count to each public function attachCorrelationCountToEvents($user, &$events) { $sgids = $this->SharingGroup->fetchAllAuthorised($user); @@ -423,7 +423,7 @@ class Event extends AppModel { $correlations = Hash::combine($correlations, '{n}.Correlation.1_event_id', '{n}.0.count'); foreach ($events as &$event) $event['Event']['correlation_count'] = (isset($correlations[$event['Event']['id']])) ? $correlations[$event['Event']['id']] : 0; } - + private function __buildEventConditionsCorrelation($user, $eventIds, $sgids) { if (!is_array($eventIds)) $eventIds = array($eventIds); if (!$user['Role']['perm_site_admin']) { @@ -526,7 +526,7 @@ class Event extends AppModel { ); return $relatedEvents; } - + public function getRelatedAttributes($user, $id = null, $sgids, $shadowAttribute = false) { $context = $shadowAttribute ? 'ShadowAttribute' : 'Attribute'; $settings = array( @@ -580,7 +580,7 @@ class Event extends AppModel { ), ) ) - + ) ); } else { @@ -634,7 +634,7 @@ class Event extends AppModel { } return $data; } - + private function __resolveErrorCode($code, &$event, &$server) { $error = false; switch ($code) { @@ -661,7 +661,7 @@ class Event extends AppModel { } return $error; } - + public function uploadEventToServer($event, $server, $HttpSocket = null) { $this->Server = ClassRegistry::init('Server'); $push = $this->Server->checkVersionCompatibility($server['Server']['id']); @@ -773,8 +773,8 @@ class Event extends AppModel { } return true; } - - + + /** * Uploads the event and the associated Attributes to another Server * TODO move this to a component @@ -863,7 +863,7 @@ class Event extends AppModel { } } } - + private function __updateEventForSync($event, $server) { $mangle = isset($event['mangle']); if (!$mangle) { @@ -875,13 +875,13 @@ class Event extends AppModel { unset($event[$o]); } } - + // cleanup the array from things we do not want to expose foreach (array('Org', 'org_id', 'orgc_id', 'proposal_email_lock', 'org', 'orgc') as $field) unset($event['Event'][$field]); foreach ($event['Event']['EventTag'] as $kt => $tag) { if (!$tag['Tag']['exportable']) unset($event['Event']['EventTag'][$kt]); } - + // Add the local server to the list of instances in the SG if (isset($event['Event']['SharingGroup']) && isset($event['Event']['SharingGroup']['SharingGroupServer'])) { foreach ($event['Event']['SharingGroup']['SharingGroupServer'] as &$s) { @@ -906,7 +906,7 @@ class Event extends AppModel { if ($attribute['distribution'] == 2) { $attribute['distribution'] = 1; } - + // If the attribute has a sharing group attached, make sure it can be transfered if ($attribute['distribution'] == 4) { if ($this->checkDistributionForPush(array('Attribute' => $attribute), $server, 'Attribute') === false) { @@ -922,7 +922,7 @@ class Event extends AppModel { } } } - + // remove value1 and value2 from the output unset($attribute['value1']); unset($attribute['value2']); @@ -938,7 +938,7 @@ class Event extends AppModel { unset($attribute['id']); } } - + if ($mangle) { $event['Event']['timestamp'] = $event['Event']['timestamp'] -1; if (isset($event['Attribute'])) { @@ -969,14 +969,14 @@ class Event extends AppModel { } } } - + // Downgrade the event from connected communities to community only if ($event['Event']['distribution'] == 2) { $event['Event']['distribution'] = 1; } return $event; } - + /** * Deletes the event and the associated Attributes from another Server @@ -1051,7 +1051,7 @@ class Event extends AppModel { return null; } } - + public function downloadProposalsFromServer($uuidList, $server, $HttpSocket = null) { $url = $server['Server']['url']; $authkey = $server['Server']['authkey']; @@ -1106,13 +1106,13 @@ class Event extends AppModel { ); } $fields = array('Event.id', 'Event.org_id', 'Event.distribution', 'Event.sharing_group_id'); - + if ($from) $conditions['AND'][] = array('Event.date >=' => $from); if ($to) $conditions['AND'][] = array('Event.date <=' => $to); if ($last) $conditions['AND'][] = array('Event.publish_timestamp >=' => $last); if ($timestamp) $conditions['AND'][] = array('Event.timestamp >=' => $timestamp); if ($publish_timestamp) $conditions['AND'][] = array('Event.publish_timestamp >=' => $publish_timestamp); - + if ($list) { $params = array( 'conditions' => $conditions, @@ -1154,7 +1154,7 @@ class Event extends AppModel { $isSiteAdmin = $user['Role']['perm_site_admin']; if (isset($options['disableSiteAdmin']) && $options['disableSiteAdmin']) $isSiteAdmin = false; $conditionsAttributes = array(); - + // restricting to non-private or same org if the user is not a site-admin. if (!$isSiteAdmin) { $sgids = $this->SharingGroup->fetchAllAuthorised($user); @@ -1187,7 +1187,7 @@ class Event extends AppModel { )); $conditions['AND']['OR']['Event.id'] = $delegatedEventIDs; } - + $conditionsAttributes['AND'][0]['OR'] = array( array('AND' => array( 'Attribute.distribution >' => 0, @@ -1206,7 +1206,7 @@ class Event extends AppModel { if ($options['to']) $conditions['AND'][] = array('Event.date <=' => $options['to']); if ($options['last']) $conditions['AND'][] = array('Event.publish_timestamp >=' => $options['last']); if ($options['event_uuid']) $conditions['AND'][] = array('Event.uuid' => $options['event_uuid']); - + if (isset($options['deleted']) && $options['deleted']) { if (!$user['Role']['perm_sync']) { $conditionsAttributes['AND'][] = array( @@ -1217,7 +1217,7 @@ class Event extends AppModel { ); } } else $conditionsAttributes['AND']['Attribute.deleted'] = false; - + if ($options['idList'] && !$options['tags']) { $conditions['AND'][] = array('Event.id' => $options['idList']); } @@ -1237,7 +1237,7 @@ class Event extends AppModel { } $conditions['AND'][] = $temp; } - + if ($options['to_ids']) { $conditionsAttributes['AND'][] = array('Attribute.to_ids' => 1); } @@ -1247,7 +1247,7 @@ class Event extends AppModel { // Same idea for the published. Just adjust the tools to check for this // TODO: It is important to make sure that this is documented // $conditions['AND'][] = array('Event.published =' => 1); - + // do not expose all the data ... $fields = array('Event.id', 'Event.orgc_id', 'Event.org_id', 'Event.date', 'Event.threat_level_id', 'Event.info', 'Event.published', 'Event.uuid', 'Event.attribute_count', 'Event.analysis', 'Event.timestamp', 'Event.distribution', 'Event.proposal_email_lock', 'Event.user_id', 'Event.locked', 'Event.publish_timestamp', 'Event.sharing_group_id'); $fieldsAtt = array('Attribute.id', 'Attribute.type', 'Attribute.category', 'Attribute.value', 'Attribute.to_ids', 'Attribute.uuid', 'Attribute.event_id', 'Attribute.distribution', 'Attribute.timestamp', 'Attribute.comment', 'Attribute.sharing_group_id', 'Attribute.deleted'); @@ -1269,7 +1269,7 @@ class Event extends AppModel { ); if (!$options['includeAllTags']) $tagConditions = array('exportable' => 1); else $tagConditions = array(); - + $params = array('conditions' => $conditions, 'recursive' => 0, 'fields' => $fields, @@ -1382,7 +1382,7 @@ class Event extends AppModel { if ($last) $conditions['AND'][] = array('Event.publish_timestamp >=' => $last); // This is for both single event downloads and for full downloads. Org has to be the same as the user's or distribution not org only - if the user is no siteadmin if ($ignore == false) $conditions['AND'][] = array('Event.published' => 1); - + // If we sent any tags along, load the associated tag names for each attribute if ($tags) { $tag = ClassRegistry::init('Tag'); @@ -1401,13 +1401,13 @@ class Event extends AppModel { } // if we're downloading a single event, set it as a condition if ($eventid) $conditions['AND'][] = array('Event.id' => $eventid); - + //restricting to non-private or same org if the user is not a site-admin. if (!$ignore) $conditions['AND'][] = array('Attribute.to_ids' => 1); if ($type) $conditions['AND'][] = array('Attribute.type' => $type); if ($category) $conditions['AND'][] = array('Attribute.category' => $category); } - + if ($eventid === 'search') { foreach ($attributeIDList as $aID) $conditions['AND']['OR'][] = array('Attribute.id' => $aID); } @@ -1416,7 +1416,7 @@ class Event extends AppModel { 'fields' => array('Attribute.event_id', 'Attribute.distribution', 'Attribute.category', 'Attribute.type', 'Attribute.value', 'Attribute.comment', 'Attribute.uuid', 'Attribute.to_ids', 'Attribute.timestamp', 'Attribute.id'), 'order' => array('Attribute.uuid ASC') ); - + if ($includeContext) { $params['contain'] = array( 'Event' => array( @@ -1458,7 +1458,7 @@ class Event extends AppModel { } return $attributes; } - + private function attachEventInfoToAttributes($attributes, $user) { $TLs = $this->ThreatLevel->find('list', array( 'recursive' => -1, @@ -1476,7 +1476,7 @@ class Event extends AppModel { $context_fields['orgc_id'] = 'event_org_id'; unset($context_fields['org_id']); } - + $events = $this->find('all', array( 'recursive' => -1, 'fields' => array_keys($context_fields), @@ -1507,7 +1507,7 @@ class Event extends AppModel { } return $attributes; } - + public function sendAlertEmailRouter($id, $user) { if (Configure::read('MISP.block_old_event_alert') && Configure::read('MISP.block_old_event_alert_age') && is_numeric(Configure::read('MISP.block_old_event_alert_age'))) { $oldest = time() - (Configure::read('MISP.block_old_event_alert_age') * 86400); @@ -1545,7 +1545,7 @@ class Event extends AppModel { return ($this->sendAlertEmail($id, $user)); } } - + public function sendAlertEmail($id, $senderUser, $processId = null) { $event = $this->fetchEvent($senderUser, array('eventid' => $id, 'includeAllTags' => true)); if (empty($event)) throw new MethodNotFoundException('Invalid Event.'); @@ -1571,7 +1571,7 @@ class Event extends AppModel { $subject = ''; } $subject = "[" . Configure::read('MISP.org') . " MISP] Event " . $id . " - " . $subject . $event[0]['ThreatLevel']['name'] . " - TLP Amber"; - + // Initialise the Job class if we have a background process ID // This will keep updating the process's progress bar if ($processId) { @@ -1596,7 +1596,7 @@ class Event extends AppModel { } return true; } - + private function __buildAlertEmailBody($event, $user, $sgModel) { $owner = false; if ($user['org_id'] == $event['Event']['orgc_id'] || $user['org_id'] == $event['Event']['org_id'] || $user['Role']['perm_site_admin']) $owner = true; @@ -1656,7 +1656,7 @@ class Event extends AppModel { elseif ('hostname' == $attribute['type'] or 'domain' == $attribute['type'] or 'ip-src' == $attribute['type'] or 'ip-dst' == $attribute['type']) { $line = str_replace(".","[.]", $line); } - + if ('other' == $attribute['type']) // append the 'other' attribute types to the bottom. $bodyTempOther .= $line; else $body .= $line; @@ -1669,7 +1669,7 @@ class Event extends AppModel { $body .= '==============================================' . "\n"; return $body; } - + public function sendContactEmail($id, $message, $creator_only, $user, $isSiteAdmin) { // fetch the event $event = $this->read(null, $id); @@ -1721,7 +1721,7 @@ class Event extends AppModel { $body .= "\n"; $body .= "\n"; $body .= "The event is the following: \n"; - + // print the event in mail-format // LATER place event-to-email-layout in a function $appendlen = 20; @@ -1734,17 +1734,17 @@ class Event extends AppModel { } $bodyevent .= 'Risk : ' . $event['ThreatLevel']['name'] . "\n"; $bodyevent .= 'Analysis : ' . $event['Event']['analysis'] . "\n"; - + $userModel = ClassRegistry::init('User'); $targetUser = $userModel->getAuthUser($orgMembers[0]['User']['id']); $sgModel = ClassRegistry::init('SharingGroup'); $sgs = $sgModel->fetchAllAuthorised($targetUser, false); - + $relatedEvents = $this->getRelatedEvents($targetUser, $id, $sgs); if (!empty($relatedEvents)) { foreach ($relatedEvents as &$relatedEvent) { $bodyevent .= 'Related to : ' . Configure::read('MISP.baseurl') . '/events/view/' . $relatedEvent['Event']['id'] . ' (' . $relatedEvent['Event']['date'] . ')' . "\n"; - + } } $bodyevent .= 'Info : ' . "\n"; @@ -1769,7 +1769,7 @@ class Event extends AppModel { } return $result; } - + // When we receive an event via REST, we might end up with organisations, sharing groups, tags that we do not know // or which we need to update. All of that is controller in this method. private function __captureObjects($data, $user) { @@ -1784,7 +1784,7 @@ class Event extends AppModel { if (isset($attribute['distribution']) && $attribute['distribution'] == 4 && !isset($sgs[$attribute['SharingGroup']['uuid']])) $sgs[$attribute['SharingGroup']['uuid']] = $attribute['SharingGroup']; } } - + if ($data['Event']['distribution'] == 4) { $sg = $this->SharingGroup->captureSG($data['Event']['SharingGroup'], $user); if ($sg===false){ @@ -1838,7 +1838,7 @@ class Event extends AppModel { } return $data; } - + /** * Low level function to add an Event based on an Event $data array * @@ -1946,7 +1946,7 @@ class Event extends AppModel { } } } - + if ($fromXml) $created_id = $this->id; if (!empty($data['Event']['published']) && 1 == $data['Event']['published']) { // do the necessary actions to publish the event (email, upload,...) @@ -1961,12 +1961,12 @@ class Event extends AppModel { return json_encode($this->validationErrors); } } - + public function _edit(&$data, $user, $id, $jobId = null) { $data = $this->cleanupEventArrayFromXML($data); unset($this->Attribute->validate['event_id']); unset($this->Attribute->validate['value']['unique']); // otherwise gives bugs because event_id is not set - + // reposition to get the event.id with given uuid if (isset($data['Event']['uuid'])) $existingEvent = $this->findByUuid($data['Event']['uuid']); else $existingEvent = $this->findById($id); @@ -2126,7 +2126,7 @@ class Event extends AppModel { return true; } return $this->validationErrors; } - + // format has to be: // array('Event' => array(), 'Attribute' => array('ShadowAttribute' => array()), 'EventTag' => array(), 'ShadowAttribute' => array()); public function savePreparedEvent($event) { @@ -2143,7 +2143,7 @@ class Event extends AppModel { } return $event['Event']['id']; } - + private function __savePreparedAttribute(&$attribute, &$event) { unset($attribute['id']); $attribute['event_id'] = $event['Event']['id']; @@ -2153,7 +2153,7 @@ class Event extends AppModel { $this->__savePreparedShadowAttribute($sa, $event, $this->Attribute->id); } } - + private function __savePreparedShadowAttribute($shadow_attribute, &$event, $old_id = 0) { unset($shadow_attribute['id']); $shadow_attribute['event_id'] = $event['Event']['id']; @@ -2161,21 +2161,21 @@ class Event extends AppModel { $this->ShadowAttribute->create(); $this->ShadowAttribute->save($shadow_attribute); } - + private function __savePreparedEventTag($event_tag, &$event) { unset($event_tag['id']); $event_tag['event_id'] = $event['Event']['id']; $this->EventTag->create(); $this->EventTag->save($event_tag); } - + private function __searchUuidInAttributeArray($uuid, &$attr_array) { foreach ($attr_array['Attribute'] as &$attr) { if ($attr['uuid'] == $uuid) return array('Attribute' => $attr); } return false; } - + // pass an event or an attribute together with the server id. // If the distribution of the object outright allows for it to be shared, return true // If the distribution is org only / comm only, return false @@ -2192,7 +2192,7 @@ class Event extends AppModel { } return true; } - + /** * Uploads this specific event to all remote servers * TODO move this to a component @@ -2255,7 +2255,7 @@ class Event extends AppModel { // iterate over the servers and upload the event if(empty($servers)) return true; - + $uploaded = true; $failedServers = array(); App::uses('SyncTool', 'Tools'); @@ -2309,7 +2309,7 @@ class Event extends AppModel { return $result; } } - + /** * Performs all the actions required to publish an event * @@ -2346,7 +2346,7 @@ class Event extends AppModel { } return $uploaded; } - + /** * @@ -2391,7 +2391,7 @@ class Event extends AppModel { return $result; } } - + public function generateLocked() { $this->User = ClassRegistry::init('User'); $this->User->recursive = -1; @@ -2430,7 +2430,7 @@ class Event extends AppModel { ); return $toBeUpdated; } - + public function reportValidationIssuesEvents() { $this->Behaviors->detach('Regexp'); // get all events.. @@ -2452,7 +2452,7 @@ class Event extends AppModel { } return array($result, $k); } - + public function generateThreatLevelFromRisk() { $risk = array('Undefined' => 4, 'Low' => 3, 'Medium' => 2, 'High' => 1); $events = $this->find('all', array('recursive' => -1)); @@ -2464,12 +2464,12 @@ class Event extends AppModel { } return $k; } - + // check two version strings. If version 1 is older than 2, return -1, if they are the same return 0, if version 2 is older return 1 public function compareVersions($version1, $version2) { $version1Array = explode('.', $version1); $version2Array = explode('.', $version2); - + if ($version1Array[0] != $version2Array[0]) { if ($version1Array[0] > $version2Array[0]) return 1; else return -1; @@ -2483,14 +2483,14 @@ class Event extends AppModel { else return -1; } } - + // main dispatch method for updating an incoming xmlArray - pass xmlArray to all of the appropriate transformation methods to make all the changes necessary to save the imported event public function updateXMLArray($xmlArray, $response = true) { if (isset($xmlArray['xml_version']) && $response) { $xmlArray['response']['xml_version'] = $xmlArray['xml_version']; unset($xmlArray['xml_version']); } - + if (!$response) { $xmlArray = array('response' => $xmlArray); } @@ -2502,11 +2502,11 @@ class Event extends AppModel { if ($version != 0) { // The xml is from an instance that is newer than the local instance, let the user know that the admin needs to upgrade before it could be imported if ($version == 1) throw new Exception('This XML file is from a MISP instance that is newer than the current instance. Please contact your administrator about upgrading this instance.'); - + // if the xml contains an event or events from an older MISP instance, let's try to upgrade it! // Let's manually set the version to something below 2.2.0 if there is no version set in the xml if (!isset($xmlArray['response']['xml_version'])) $xmlArray['response']['xml_version'] = '2.1.0'; - + // Upgrade from versions below 2.2.0 will need to replace the risk field with threat level id if ($this->compareVersions($xmlArray['response']['xml_version'], '2.2.0') < 0) { if ($response) $xmlArray['response'] = $this->__updateXMLArray220($xmlArray['response']); @@ -2534,13 +2534,13 @@ class Event extends AppModel { } return $xmlArray; } - + public function checkIfNewer($incomingEvent) { $localEvent = $this->find('first', array('conditions' => array('uuid' => $incomingEvent['uuid']), 'recursive' => -1, 'fields' => array('Event.uuid', 'Event.timestamp'))); if (empty($localEvent) || $incomingEvent['timestamp'] > $localEvent['Event']['timestamp']) return true; return false; } - + public function removeOlder(&$eventArray) { $uuidsToCheck = array(); foreach ($eventArray as $k => &$event) { @@ -2579,7 +2579,7 @@ class Event extends AppModel { // generate a randomised filename for the temporary file that will be passed to the python script $randomFileName = $this->generateRandomFileName(); $tempFile = new File(APP . "files" . DS . "scripts" . DS . "tmp" . DS . $randomFileName, true, 0644); - + // save the json_encoded event(s) to the temporary file $result = $tempFile->write(json_encode($events)); $scriptFile = APP . "files" . DS . "scripts" . DS . "misp2stix.py"; @@ -2593,7 +2593,7 @@ class Event extends AppModel { $result = array(); $result['success'] = $decoded->success; $result['message'] = $decoded->message; - + if ($result['success'] == 1) { $file = new File(APP . "files" . DS . "scripts" . DS . "tmp" . DS . $randomFileName . ".out"); $result['data'] = $file->read(); @@ -2603,10 +2603,10 @@ class Event extends AppModel { $file->delete(); return $result; } - + public function getAccessibleEventIds($include, $exclude, $includedTags, $excludedTags) { $conditions = array(); - + // get all of the event IDs based on include / exclude if (!empty($include)) $conditions['OR'] = array('id' => $include); if (!empty($exclude)) $conditions['NOT'] = array('id' => $exclude); @@ -2627,7 +2627,7 @@ class Event extends AppModel { } return $ids; } - + public function generateRandomFileName() { $length = 12; $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'; @@ -2638,7 +2638,7 @@ class Event extends AppModel { } return $fn; } - + public function sharingGroupRequired($field) { if ($this->data[$this->alias]['distribution'] == 4) { @@ -2646,7 +2646,7 @@ class Event extends AppModel { } return true; } - + // convenience method to check whther a user can see an event public function checkIfAuthorised($user, $id) { if (!isset($user['id'])) throw new MethodNotAllowedException('Invalid user.'); @@ -2670,7 +2670,7 @@ class Event extends AppModel { // regex check for from / to field by stevengoossensB return (preg_match('/^[0-9]{4}-(0[1-9]|1[012])-(0[1-9]|1[0-9]|2[0-9]|3[01])$/', $date)) ? $date : false; } - + public function resolveTimeDelta($delta) { $multiplierArray = array('d' => 86400, 'h' => 3600, 'm' => 60); $multiplier = $multiplierArray['d']; @@ -2682,7 +2682,7 @@ class Event extends AppModel { if (!is_numeric($delta)) return false; return time() - ($delta * $multiplier); } - + public function rearrangeEventForView(&$event, $passedArgs = array(), $all = false) { $fTool = new FinancialTool(); foreach ($event['Event'] as $k => $v) { @@ -2726,7 +2726,7 @@ class Event extends AppModel { $customPagination = new CustomPaginationTool(); if ($all) $passedArgs['page'] = 0; $eventArrayWithProposals = array(); - + foreach ($eventArray as $k => &$object) { if ($object['category'] === 'Financial fraud') { if (!$fTool->validateRouter($object['type'], $object['value'])) { @@ -2763,7 +2763,7 @@ class Event extends AppModel { $params = $customPagination->applyRulesOnArray($event['objects'], $passedArgs, 'events', 'category'); return $params; } - + // pass along a json from the server filter rules // returns a conditions set to be merged into pagination / event fetch / etc public function filterRulesToConditions($rules) { diff --git a/app/Model/EventDelegation.php b/app/Model/EventDelegation.php index 7fdc9bfe3..22eb21007 100644 --- a/app/Model/EventDelegation.php +++ b/app/Model/EventDelegation.php @@ -4,7 +4,7 @@ App::uses('AppModel', 'Model'); class EventDelegation extends AppModel { public $actsAs = array('Containable'); - + public $validate = array( 'event_id' => array( 'valueNotEmpty' => array( @@ -17,7 +17,7 @@ class EventDelegation extends AppModel { ), ) ); - + public $belongsTo = array( 'Event' => array( 'className' => 'Event', @@ -47,7 +47,7 @@ class EventDelegation extends AppModel { } return true; } - + public function transferEvent($delegation, $user) { $this->Event->Attribute->bindModel( array( @@ -82,7 +82,7 @@ class EventDelegation extends AppModel { $event_id = $this->Event->savePreparedEvent($event); return $event_id; } - + private function __prepareEvent(&$event) { $objects = array('Attribute', 'ShadowAttribute', 'EventTag'); $objects = array( @@ -102,7 +102,7 @@ class EventDelegation extends AppModel { $object['data'] = $encodedFile; } } - + // unset ID fields and relations foreach ($fields as $field) { unset($object[$field]); diff --git a/app/Model/EventTag.php b/app/Model/EventTag.php index c3cc6c10c..49d752848 100644 --- a/app/Model/EventTag.php +++ b/app/Model/EventTag.php @@ -4,7 +4,7 @@ App::uses('AppModel', 'Model'); class EventTag extends AppModel { public $actsAs = array('Containable'); - + public $validate = array( 'event_id' => array( 'valueNotEmpty' => array( @@ -17,7 +17,7 @@ class EventTag extends AppModel { ), ), ); - + public $belongsTo = array( 'Event' => array( 'className' => 'Event', @@ -26,7 +26,7 @@ class EventTag extends AppModel { 'className' => 'Tag', ), ); - + // take an array of tag names to be included and an array with tagnames to be excluded and find all event IDs that fit the criteria public function getEventIDsFromTags($includedTags, $excludedTags) { $conditions = array(); @@ -52,7 +52,7 @@ class EventTag extends AppModel { $eventIDs = array_unique($eventIDs); return $eventIDs; } - + public function attachTagToEvent($event_id, $tag_id) { $existingAssociation = $this->find('first', array( 'recursive' => -1, diff --git a/app/Model/FavouriteTag.php b/app/Model/FavouriteTag.php index 29b7ae24b..977c28547 100644 --- a/app/Model/FavouriteTag.php +++ b/app/Model/FavouriteTag.php @@ -4,7 +4,7 @@ App::uses('AppModel', 'Model'); class FavouriteTag extends AppModel { public $actsAs = array('Containable'); - + public $validate = array( 'user_id' => array( 'valueNotEmpty' => array( @@ -17,6 +17,6 @@ class FavouriteTag extends AppModel { ), ), ); - + public $belongsTo = array('Tag', 'User'); } \ No newline at end of file diff --git a/app/Model/Feed.php b/app/Model/Feed.php index 1acd32e7b..58aecb202 100644 --- a/app/Model/Feed.php +++ b/app/Model/Feed.php @@ -9,7 +9,7 @@ class Feed extends AppModel { 'Trim', 'Containable' ); - + public $belongsTo = array( 'SharingGroup' => array( 'className' => 'SharingGroup', @@ -20,7 +20,7 @@ class Feed extends AppModel { 'foreignKey' => 'tag_id', ) ); - + /** * Validation rules * @@ -42,7 +42,7 @@ class Feed extends AppModel { ), ), ); - + // gets the event UUIDs from the feed by ID // returns an array with the UUIDs of events that are new or that need updating public function getNewEventUuids($feed, $HttpSocket) { @@ -68,8 +68,8 @@ class Feed extends AppModel { $result['add'] = array_keys($manifest); return $result; } - - + + public function getManifest($feed, $HttpSocket) { $result = array(); $request = $this->__createFeedRequest(); @@ -83,7 +83,7 @@ class Feed extends AppModel { $events = $this->__filterEventsIndex($events, $feed); return $events; } - + public function downloadFromFeed($actions, $feed, $HttpSocket, $user, $jobId = false) { if ($jobId) { $job = ClassRegistry::init('Job'); @@ -134,7 +134,7 @@ class Feed extends AppModel { } return $results; } - + private function __createFeedRequest() { $version = $this->checkMISPVersion(); $version = implode('.', $version); @@ -146,7 +146,7 @@ class Feed extends AppModel { ) ); } - + private function __checkIfEventBlockedByFilter($event, $filterRules) { $fields = array('tags' => 'Tag', 'orgs' => 'Orgc'); $prefixes = array('OR', 'NOT'); @@ -170,7 +170,7 @@ class Feed extends AppModel { if (!$filterRules) return true; return true; } - + private function __filterEventsIndex($events, $feed) { $filterRules = array(); if (isset($feed['Feed']['rules']) && !empty($feed['Feed']['rules'])) { @@ -212,13 +212,13 @@ class Feed extends AppModel { } return $events; } - + public function downloadAndSaveEventFromFeed($feed, $uuid, $user) { $event = $this->downloadEventFromFeed($feed, $uuid, $user); if (!is_array($event) || isset($event['code'])) return false; return $this->__saveEvent($event, $user); } - + public function downloadEventFromFeed($feed, $uuid, $user) { $HttpSocket = $this->__setupHttpSocket($feed); $request = $this->__createFeedRequest(); @@ -230,7 +230,7 @@ class Feed extends AppModel { return $this->__prepareEvent($response->body, $feed); } } - + private function __saveEvent($event, $user) { $this->Event = ClassRegistry::init('Event'); $existingEvent = $this->Event->find('first', array( @@ -250,7 +250,7 @@ class Feed extends AppModel { } return $result; } - + private function __prepareEvent($body, $feed) { $filterRules = $this->__prepareFilterRules($feed); $event = json_decode($body, true); @@ -289,19 +289,19 @@ class Feed extends AppModel { if (!$this->__checkIfEventBlockedByFilter($event, $filterRules)) return 'blocked'; return $event; } - + private function __prepareFilterRules($feed) { $filterRules = false; if (isset($feed['Feed']['rules']) && !empty($feed['Feed']['rules'])) $filterRules = json_decode($feed['Feed']['rules'], true); return $filterRules; } - + private function __setupHttpSocket($feed) { App::uses('SyncTool', 'Tools'); $syncTool = new SyncTool(); return ($syncTool->setupHttpSocketFeed($feed)); } - + private function __addEventFromFeed($HttpSocket, $feed, $uuid, $user, $filterRules) { $request = $this->__createFeedRequest(); $uri = $feed['Feed']['url'] . '/' . $uuid . '.json'; @@ -316,7 +316,7 @@ class Feed extends AppModel { } else return $event; } } - + private function __updateEventFromFeed($HttpSocket, $feed, $uuid, $eventId, $user, $filterRules) { $request = $this->__createFeedRequest(); $uri = $feed['Feed']['url'] . '/' . $uuid . '.json'; @@ -329,7 +329,7 @@ class Feed extends AppModel { return $this->Event->_edit($event, $user, $uuid, $jobId = null); } } - + public function addDefaultFeeds($newFeeds) { foreach ($newFeeds as $newFeed) { $existingFeed = $this->find('list', array('conditions' => array('Feed.url' => $newFeed['url']))); @@ -351,7 +351,7 @@ class Feed extends AppModel { } return $success; } - + public function downloadFromFeedInitiator($feedId, $user, $jobId = false) { $this->id = $feedId; App::uses('SyncTool', 'Tools'); diff --git a/app/Model/Job.php b/app/Model/Job.php index 9feec92d3..54abc9113 100644 --- a/app/Model/Job.php +++ b/app/Model/Job.php @@ -6,7 +6,7 @@ App::uses('AppModel', 'Model'); * @property Job $Job */ class Job extends AppModel { - + public $belongsTo = array( 'Org' => array( 'className' => 'Organisation', @@ -15,7 +15,7 @@ class Job extends AppModel { 'fields' => array('id', 'name', 'uuid') ), ); - + public function beforeValidate($options = array()) { parent::beforeValidate(); $date = date('Y-m-d H:i:s'); @@ -26,7 +26,7 @@ class Job extends AppModel { $this->data['Job']['date_modified'] = $date; } } - + public function cache($type, $user, $target, $jobOrg = null) { $extra = null; $extra2 = null; diff --git a/app/Model/Log.php b/app/Model/Log.php index 356462106..5b85aea1b 100644 --- a/app/Model/Log.php +++ b/app/Model/Log.php @@ -60,19 +60,19 @@ class Log extends AppModel { 'delete' => array('desc' => 'Delete action', 'formdesc' => "Delete action"), 'publish' => array('desc' => "Publish action", 'formdesc' => "Publish action") ); - + public $logMeta = array( 'email' => array('values' => array('email'), 'name' => 'Emails'), 'auth_issues' => array('values' => array('login_fail', 'auth_fail'), 'name' => 'Authentication issues') ); - + public $logMetaAdmin = array( 'update' => array('values' => array('update_database'), 'name' => 'MISP Update results'), 'settings' => array('values' => array('serverSettingsEdit', 'remove_dead_workers'), 'name' => 'Setting changes'), 'errors' => array('values' => array('warning', 'errors', 'version_warning'), 'name' => 'Warnings and errors'), 'email' => array('values' => array('admin_email')) ); - + public function beforeSave($options = array()) { if (Configure::read('MISP.log_client_ip') && isset($_SERVER['REMOTE_ADDR'])) $this->data['Log']['ip'] = $_SERVER['REMOTE_ADDR']; $setEmpty = array('title' => '', 'model' => '', 'model_id' => 0, 'action' => '', 'user_id' => 0, 'change' => '', 'email' => '', 'org' => '', 'description' => ''); @@ -82,7 +82,7 @@ class Log extends AppModel { if (!isset($this->data['Log']['created'])) $this->data['Log']['created'] = time(); return true; } - + public function returnDates($org = 'all') { $conditions = array(); $this->Organisation = ClassRegistry::init('Organisation'); @@ -104,7 +104,7 @@ class Log extends AppModel { } return $data; } - + public function createLogEntry($user = array('Organisation' => array('name' => 'SYSTEM'), 'email' => 'SYSTEM', 'id' => 0), $action, $model, $model_id = 0, $title = '', $change = '') { $this->create(); $this->save(array( diff --git a/app/Model/Module.php b/app/Model/Module.php index fc739bda0..3396ce0cd 100644 --- a/app/Model/Module.php +++ b/app/Model/Module.php @@ -3,7 +3,7 @@ App::uses('AppModel', 'Model'); class Module extends AppModel { public $useTable = false; - + public function getEnrichmentModules() { if (!Configure::read('Plugin.Enrichment_services_enable')) return 'Enrichment service not enabled.'; @@ -28,7 +28,7 @@ class Module extends AppModel { return $result; } else return 'The enrichment service reports that it found no enrichment modules.'; } - + public function getEnabledModules() { $modules = $this->getEnrichmentModules(); if (is_array($modules)) { @@ -53,16 +53,16 @@ class Module extends AppModel { $modules['hover_type'] = $hover_types; return $modules; } - + public function sendRequest() { - + } - + public function queryModule() { - + } - + private function queryModule() { - + } } \ No newline at end of file diff --git a/app/Model/News.php b/app/Model/News.php index f6b08d2c1..98c0e6cf9 100644 --- a/app/Model/News.php +++ b/app/Model/News.php @@ -4,7 +4,7 @@ App::uses('AppModel', 'Model'); class News extends AppModel { public $actsAs = array('Containable'); - + public $validate = array( 'message' => array( 'valueNotEmpty' => array( @@ -17,7 +17,7 @@ class News extends AppModel { ), ) ); - + public $belongsTo = array( 'User' => array( 'className' => 'User', diff --git a/app/Model/Organisation.php b/app/Model/Organisation.php index 790714d6f..e305d373f 100644 --- a/app/Model/Organisation.php +++ b/app/Model/Organisation.php @@ -57,9 +57,9 @@ class Organisation extends AppModel{ 'foreignKey' => 'org_id', ), ); - + public $countries = array('Not specified', 'International', 'Afghanistan', 'Albania', 'Algeria', 'Andorra', 'Angola', 'Antigua & Deps', 'Argentina', 'Armenia', 'Australia', 'Austria', 'Azerbaijan', 'Bahamas', 'Bahrain', 'Bangladesh', 'Barbados', 'Belarus', 'Belgium', 'Belize', 'Benin', 'Bhutan', 'Bolivia', 'Bosnia Herzegovina', 'Botswana', 'Brazil', 'Brunei', 'Bulgaria', 'Burkina', 'Burundi', 'Cambodia', 'Cameroon', 'Canada', 'Cape Verde', 'Central African Rep', 'Chad', 'Chile', 'China', 'Colombia', 'Comoros', 'Congo', 'Congo {Democratic Rep}', 'Costa Rica', 'Croatia', 'Cuba', 'Cyprus', 'Czech Republic', 'Denmark', 'Djibouti', 'Dominica', 'Dominican Republic', 'East Timor', 'Ecuador', 'Egypt', 'El Salvador', 'Equatorial Guinea', 'Eritrea', 'Estonia', 'Ethiopia', 'Fiji', 'Finland', 'France', 'Gabon', 'Gambia', 'Georgia', 'Germany', 'Ghana', 'Greece', 'Grenada', 'Guatemala', 'Guinea', 'Guinea-Bissau', 'Guyana', 'Haiti', 'Honduras', 'Hungary', 'Iceland', 'India', 'Indonesia', 'Iran', 'Iraq', 'Ireland {Republic}', 'Israel', 'Italy', 'Ivory Coast', 'Jamaica', 'Japan', 'Jordan', 'Kazakhstan', 'Kenya', 'Kiribati', 'Korea North', 'Korea South', 'Kosovo', 'Kuwait', 'Kyrgyzstan', 'Laos', 'Latvia', 'Lebanon', 'Lesotho', 'Liberia', 'Libya', 'Liechtenstein', 'Lithuania', 'Luxembourg', 'Macedonia', 'Madagascar', 'Malawi', 'Malaysia', 'Maldives', 'Mali', 'Malta', 'Marshall Islands', 'Mauritania', 'Mauritius', 'Mexico', 'Micronesia', 'Moldova', 'Monaco', 'Mongolia', 'Montenegro', 'Morocco', 'Mozambique', 'Myanmar, {Burma}', 'Namibia', 'Nauru', 'Nepal', 'Netherlands', 'New Zealand', 'Nicaragua', 'Niger', 'Nigeria', 'Norway', 'Oman', 'Pakistan', 'Palau', 'Panama', 'Papua New Guinea', 'Paraguay', 'Peru', 'Philippines', 'Poland', 'Portugal', 'Qatar', 'Romania', 'Russian Federation', 'Rwanda', 'St Kitts & Nevis', 'St Lucia', 'Saint Vincent & the Grenadines', 'Samoa', 'San Marino', 'Sao Tome & Principe', 'Saudi Arabia', 'Senegal', 'Serbia', 'Seychelles', 'Sierra Leone', 'Singapore', 'Slovakia', 'Slovenia', 'Solomon Islands', 'Somalia', 'South Africa', 'South Sudan', 'Spain', 'Sri Lanka', 'Sudan', 'Suriname', 'Swaziland', 'Sweden', 'Switzerland', 'Syria', 'Taiwan', 'Tajikistan', 'Tanzania', 'Thailand', 'Togo', 'Tonga', 'Trinidad & Tobago', 'Tunisia', 'Turkey', 'Turkmenistan', 'Tuvalu', 'Uganda', 'Ukraine', 'United Arab Emirates', 'United Kingdom', 'United States', 'Uruguay', 'Uzbekistan', 'Vanuatu', 'Vatican City', 'Venezuela', 'Vietnam', 'Yemen', 'Zambia', 'Zimbabwe'); - + public $organisationAssociations = array( 'Correlation' => array('table' => 'correlations', 'fields' => array('org_id')), 'Event' => array('table' => 'events', 'fields' => array('org_id', 'orgc_id')), @@ -71,7 +71,7 @@ class Organisation extends AppModel{ 'Thread' => array('table' => 'threads', 'fields' => array('org_id')), 'User' => array('table' => 'users', 'fields' => array('org_id')) ); - + /* public $hasAndBelongsToMany = array( 'SharingGroup' => array( @@ -82,7 +82,7 @@ class Organisation extends AppModel{ ) ); */ - + public function beforeValidate($options = array()) { parent::beforeValidate(); if (empty($this->data['Organisation']['uuid']) && (isset($this->data['Organisation']['local']) && $this->data['Organisation']['local'])) { @@ -94,13 +94,13 @@ class Organisation extends AppModel{ if (!isset($this->data['Organisation']['nationality']) || empty($this->data['Organisation']['nationality'])) $this->data['Organisation']['nationality'] = 'Not specified'; return true; } - + public function beforeDelete($cascade = false){ if ($this->User->find('count', array('conditions' => array('User.org_id' => $this->id))) != 0) return false; if ($this->Event->find('count', array('conditions' => array('OR' => array('Event.org_id' => $this->id, 'Event.orgc_id' => $this->id)))) != 0) return false; return true; } - + public function captureOrg($org, $user, $force = false) { if (is_array($org)) { if (isset($org['uuid']) && !empty($org['uuid'])) { @@ -115,7 +115,7 @@ class Organisation extends AppModel{ $conditions = array('name' => $org); $name = $org; } - + $existingOrg = $this->find('first', array( 'recursive' => -1, 'conditions' => $conditions, @@ -151,7 +151,7 @@ class Organisation extends AppModel{ } return $existingOrg[$this->alias]['id']; } - + public function createOrgFromName($name, $user_id, $local) { $existingOrg = $this->find('first', array( 'recursive' => -1, @@ -170,7 +170,7 @@ class Organisation extends AppModel{ } return $existingOrg[$this->alias]['id']; } - + public function orgMerge($id, $request, $user) { $currentOrg = $this->find('first', array('recursive' => -1, 'conditions' => array('Organisation.id' => $id))); $targetOrgId = $request['Organisation']['targetType'] == 0 ? $request['Organisation']['orgsLocal'] : $request['Organisation']['orgsExternal']; diff --git a/app/Model/Post.php b/app/Model/Post.php index e3de87835..9b264bc9e 100644 --- a/app/Model/Post.php +++ b/app/Model/Post.php @@ -16,7 +16,7 @@ class Post extends AppModel { 'change' => 'full' ), ); - + public $belongsTo = array( 'Thread', 'User' @@ -116,7 +116,7 @@ class Post extends AppModel { $this->User->sendEmail($recipient, $bodyDetail, $body, $subject); } } - + public function findPageNr($id, $context = 'thread', &$post_id = false) { // find the current post and its position in the thread if ($context == 'event') $conditions = array('Thread.event_id' => $id); diff --git a/app/Model/Regexp.php b/app/Model/Regexp.php index 6933cbc9a..08ce347b3 100644 --- a/app/Model/Regexp.php +++ b/app/Model/Regexp.php @@ -33,7 +33,7 @@ class Regexp extends AppModel { public function beforeValidate($options = array()) { $this->sanitizeModifiers($this->data['Regexp']['regexp']); } - + public function sanitizeModifiers(&$regex) { preg_match('/[a-zA-Z]*$/i', $regex, $modifiers); if (!empty($modifiers[0])) { @@ -43,7 +43,7 @@ class Regexp extends AppModel { $regex .= $modifiers[0]; } } - + public function checkRegexp() { if (@preg_replace($this->data['Regexp']['regexp'], 'success', $this->data['Regexp']['regexp']) != null) return true; return false; diff --git a/app/Model/Role.php b/app/Model/Role.php index 335c1f5f2..13e7db3ab 100644 --- a/app/Model/Role.php +++ b/app/Model/Role.php @@ -75,7 +75,7 @@ class Role extends AppModel { 'perm_template' => array('id' => 'RolePermTemplate', 'text' => 'Template Editor'), 'perm_sharing_group' => array('id' => 'RolePermSharingGroup', 'text' => 'Sharing Group Editor'), ); - + public $premissionLevelName = array('Read Only', 'Manage Own Events', 'Manage Organisation Events', 'Manage and Publish Organisation Events'); public function beforeSave($options = array()) { diff --git a/app/Model/Server.php b/app/Model/Server.php index 8cc330700..5806600bf 100644 --- a/app/Model/Server.php +++ b/app/Model/Server.php @@ -16,7 +16,7 @@ class Server extends AppModel { 'Trim', 'Containable' ); - + public $belongsTo = array( 'Organisation' => array( 'className' => 'Organisation', @@ -27,7 +27,7 @@ class Server extends AppModel { 'foreignKey' => 'remote_org_id', ) ); - + public $hasMany = array( 'SharingGroupServer' => array( 'className' => 'SharingGroupServer', @@ -124,7 +124,7 @@ class Server extends AppModel { ), ), ); - + public $serverSettings = array( 'MISP' => array( 'branch' => 1, @@ -571,7 +571,7 @@ class Server extends AppModel { 'test' => 'testBool', 'type' => 'boolean', 'null' => false, - + ), 'block_old_event_alert' => array( 'level' => 1, @@ -1089,7 +1089,7 @@ class Server extends AppModel { 'type' => 'boolean', ), ); - + private $__settingTabMergeRules = array( 'GnuPG' => 'Encryption', 'SMIME' => 'Encryption', @@ -1098,16 +1098,16 @@ class Server extends AppModel { ); public $validEventIndexFilters = array('searchall', 'searchpublished', 'searchorg', 'searchtag', 'searcheventid', 'searchdate', 'searcheventinfo', 'searchthreatlevel', 'searchdistribution', 'searchanalysis', 'searchattribute'); - + public function isOwnedByOrg($serverid, $org) { return $this->field('id', array('id' => $serverid, 'org' => $org)) === $serverid; } - + public function beforeSave($options = array()) { $this->data['Server']['url'] = rtrim($this->data['Server']['url'], '/'); return true; } - + public function pull($user, $id = null, $technique=false, $server, $jobId = false, $percent = 100, $current = 0) { if ($jobId) { $job = ClassRegistry::init('Job'); @@ -1129,7 +1129,7 @@ class Server extends AppModel { } else if (is_string($eventIds)) { return array(2, $eventIds); } - + // reverse array of events, to first get the old ones, and then the new ones if (!empty($eventIds)) { $eventIds = array_reverse($eventIds); @@ -1339,7 +1339,7 @@ class Server extends AppModel { if (!isset($proposal['deleted']) || !$proposal['deleted']) { if ($shadowAttribute->save($proposal)) $shadowAttribute->sendProposalAlertEmail($eid); } - + } } } @@ -1373,7 +1373,7 @@ class Server extends AppModel { if (!isset($lastpulledid)) $lastpulledid = 0; return array($successes, $fails, $pulledProposals, $lastpulledid); } - + public function filterRuleToParameter($filter_rules) { $final = array(); if (empty($filter_rules)) return $final; @@ -1393,7 +1393,7 @@ class Server extends AppModel { } return $final; } - + /** * Get an array of event_ids that are present on the remote server @@ -1464,7 +1464,7 @@ class Server extends AppModel { // error, so return error message, since that is handled and everything is expecting an array return "Error: got response code " . $response->code; } - + public function push($id = null, $technique=false, $jobId = false, $HttpSocket, $user) { if ($jobId) { $job = ClassRegistry::init('Job'); @@ -1495,7 +1495,7 @@ class Server extends AppModel { } else { $this->redirect(array('action' => 'index')); } - + if ($push !== 'mangle') { $sgs = $this->Event->SharingGroup->find('all', array( 'recursive' => -1, @@ -1577,9 +1577,9 @@ class Server extends AppModel { $this->save($this->data); } } - + $this->syncProposals($HttpSocket, $this->data, null, null, $this->Event); - + if (!isset($successes)) $successes = null; if (!isset($fails)) $fails = null; $this->Log = ClassRegistry::init('Log'); @@ -1604,7 +1604,7 @@ class Server extends AppModel { return array($successes, $fails); } } - + public function getEventIdsForPush($id, $HttpSocket, $eventIds, $user) { $server = $this->read(null, $id); $this->Event = ClassRegistry::init('Event'); @@ -1638,7 +1638,7 @@ class Server extends AppModel { } return $uuidList; } - + public function syncProposals($HttpSocket, $server, $sa_id = null, $event_id = null, $eventModel) { $saModel = ClassRegistry::init('ShadowAttribute'); if (null == $HttpSocket) { @@ -1675,7 +1675,7 @@ class Server extends AppModel { unset($sa['value1']); unset($sa['value2']); } - + $data = json_encode($event['ShadowAttribute']); $request = array( 'header' => array( @@ -1717,7 +1717,7 @@ class Server extends AppModel { } return true; } - + private function __getEnrichmentSettings() { $modules = $this->getEnrichmentModules(); $result = array(); @@ -1733,7 +1733,7 @@ class Server extends AppModel { } return $result; } - + public function getCurrentServerSettings() { $serverSettings = $this->serverSettings; $results = array(); @@ -1760,7 +1760,7 @@ class Server extends AppModel { } return $serverSettings; } - + public function serverSettingsRead($unsorted = false) { $serverSettings = $this->getCurrentServerSettings(); $results = array(); @@ -1824,14 +1824,14 @@ class Server extends AppModel { } return $finalSettings; } - + public function serverSettingReadSingle($settingObject, $settingName, $leafKey) { $setting = Configure::read($settingName); $result = $this->__evaluateLeaf($settingObject, $leafKey, $setting); $result['setting'] = $settingName; return $result; } - + private function __evaluateLeaf($leafValue, $leafKey, $setting) { if (isset($setting)) { $result = $this->{$leafValue['test']}($setting); @@ -1848,112 +1848,112 @@ class Server extends AppModel { } return $leafValue; } - + public function testForNumeric($value) { if (!is_numeric($value)) return 'This setting has to be a number.'; return true; } - + public function testForEmpty($value) { if ($value === '') return 'Value not set.'; return true; } - + public function testForPath($value) { if ($value === '') return true; if (preg_match('/^[a-z0-9\-\_\:\/]+$/i', $value)) return true; return 'Invalid characters in the path.'; } - + public function testDebug($value) { if ($this->testForEmpty($value) !== true) return $this->testForEmpty($value); if ($this->testForNumeric($value) !== true) return 'This setting has to be a number between 0 and 2, with 0 disabling debug mode.'; if ($value === 0) return true; return 'This setting has to be set to 0 on production systems. Ignore this warning if this is not the case.'; } - + public function testDebugAdmin($value) { if ($this->testForEmpty($value) !== true) return $this->testForEmpty($value); if ($this->testBool($value) !== true) return 'This setting has to be either true or false.'; if (!$value) return true; return 'Enabling debug is not recommended. Turn this on temporarily if you need to see a stack trace to debug an issue, but make sure this is not left on.'; } - + public function testDate($date) { if ($this->testForEmpty($value) !== true) return $this->testForEmpty($value); if (!strtotime($date)) return 'The date that you have entered is invalid. Expected: yyyy-mm-dd'; return true; } - + public function testBaseURL($value) { if ($this->testForEmpty($value) !== true) return $this->testForEmpty($value); $protocol = ((!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || $_SERVER['SERVER_PORT'] == 443) === true ? 'HTTPS' : 'HTTP'; if ($value != strtolower($protocol) . '://' . $_SERVER['HTTP_HOST']) return false; return true; } - + public function testMangle($value) { if ($this->testBool($value) !== true) return $this->testBool($value); if ($value) return 'Enabled, expect issues.'; return true; } - + public function testDisableEmail($value) { if (isset($value) && $value) return 'E-mailing is blocked.'; return true; } - + public function testLive($value) { if ($this->testBool($value) !== true) return $this->testBool($value); if (!$value) return 'MISP disabled.'; return true; } - + public function testBool($value) { if ($this->testForEmpty($value) !== true) return $this->testForEmpty($value); if ($value !== true && $value !== false) return 'Value is not a boolean, make sure that you convert \'true\' to true for example.'; return true; } - + public function testSalt($value) { if ($this->testForEmpty($value) !== true) return $this->testForEmpty($value); if (strlen($value) < 32) return 'The salt has to be an at least 32 byte long string.'; if ($value == "Rooraenietu8Eeyo__testForFile($value, APP . 'files' . DS . 'terms'); } - + public function testForCustomImage($value) { return $this->__testForFile($value, APP . 'webroot' . DS . 'img' . DS . 'custom'); } - + public function testPasswordLength($value) { $numeric = $this->testForNumeric($value); if ($numeric !== true) return $numeric; if ($value < 0) return 'Length cannot be negative, set a positive integer or 0 (to choose the default option).'; return true; } - + public function testForPortNumber($value) { $numeric = $this->testForNumeric($value); if ($numeric !== true) return $numeric; if ($value < 49152 || $value > 65535) return 'It is recommended that you pick a port number in the dynamic range (49152-65535). However, if you have a valid reason to use a different port, ignore this message.'; return true; } - + public function testPasswordRegex($value) { if (!empty($value) && @preg_match($value, 'test') === false) return 'Invalid regex.'; return true; } - + public function testPasswordResetText($value) { if (strpos($value, '$password') === false || strpos($value, '$username') === false || strpos($value, '$misp') === false) return 'The text served to the users must include the following replacement strings: "$username", "$password", "$misp"'; return true; } - + public function testForGPGBinary($value) { if (empty($value)) $value = $this->serverSettings['GnuPG']['binary']['value']; if (file_exists($value)) return true; @@ -1967,40 +1967,40 @@ class Server extends AppModel { return 'Negative seconds found. The following formats are accepted: seconds (positive integer), or duration (positive integer) followed by a letter denoting scale (such as m, h, d, w for minutes, hours, days, weeks)'; } } - + public function testForRPZBehaviour($value) { $numeric = $this->testforNumeric($value); if ($numeric !== true) return $numeric; if ($value < 0 || $value > 3) return 'Invalid setting, valid range is 0-3 (0 = DROP, 1 = NXDOMAIN, 2 = NODATA, 3 = walled garden.'; return true; } - + public function testForSightingVisibility($value) { $numeric = $this->testforNumeric($value); if ($numeric !== true) return $numeric; if ($value < 0 || $value > 2) return 'Invalid setting, valid range is 0-2 (0 = Event owner, 1 = Sighting reporters, 2 = Everyone.'; return true; } - + public function sightingsBeforeHook($setting, $value) { if ($value == true) { $this->updateDatabase('addSightings'); } return true; } - + public function testForRPZSerial($value) { if ($this->testForEmpty($value) !== true) return $this->testForEmpty($value); if (!preg_match('/^((\$date(\d*)|\d*))$/', $value)) return 'Invalid format.'; return true; } - + public function testForRPZNS($value) { if ($this->testForEmpty($value) !== true) return $this->testForEmpty($value); if (!preg_match('/^\w+(\.\w+)*(\.?) \w+(\.\w+)*$/', $value)) return 'Invalid format.'; return true; } - + public function zmqAfterHook($setting, $value) { App::uses('PubSubTool', 'Tools'); $pubSubTool = new PubSubTool(); @@ -2017,7 +2017,7 @@ class Server extends AppModel { $pubSubTool->reloadServer(); return true; } - + public function ipLogBeforeHook($setting, $value) { if ($setting == 'MISP.log_client_ip') { if ($value == true) { @@ -2026,7 +2026,7 @@ class Server extends AppModel { } return true; } - + public function eventBlacklistingBeforeHook($setting, $value) { $this->cleanCacheFiles(); if ($value) { @@ -2046,7 +2046,7 @@ class Server extends AppModel { $this->cleanCacheFiles(); return true; } - + public function orgBlacklistingBeforeHook($setting, $value) { $this->cleanCacheFiles(); if ($value) { @@ -2059,8 +2059,8 @@ class Server extends AppModel { } return true; } - - + + // never come here directly, always go through a secondary check like testForTermsFile in order to also pass along the expected file path private function __testForFile($value, $path) { if ($this->testForEmpty($value) !== true) return $this->testForEmpty($value); @@ -2069,12 +2069,12 @@ class Server extends AppModel { if (!file_exists($file)) return 'Could not find the specified file. Make sure that it is uploaded into the following directory: ' . $path; return true; } - + public function serverSettingsSaveValue($setting, $value) { Configure::write($setting, $value); Configure::dump('config.php', 'default', array('MISP', 'GnuPG', 'SMIME', 'Proxy', 'SecureAuth', 'Security', 'debug', 'site_admin_debug', 'Plugin')); } - + public function checkVersion($newest) { $version_array = $this->checkMISPVersion(); $current = 'v' . $version_array['major'] . '.' . $version_array['minor'] . '.' . $version_array['hotfix']; @@ -2082,12 +2082,12 @@ class Server extends AppModel { $upToDate = $this->__compareVersions(array($version_array['major'], $version_array['minor'], $version_array['hotfix']), $newest_array, 0); return array ('current' => $current, 'newest' => $newest, 'upToDate' => $upToDate); } - + private function __dissectVersion($version) { $version = substr($version, 1); return explode('.', $version); } - + private function __compareVersions($current, $newest, $i) { if ($current[$i] == $newest[$i]) { if ($i < 2) { @@ -2101,7 +2101,7 @@ class Server extends AppModel { return 'newer'; } } - + public function getFileRules() { $validItems = array( 'orgs' => array( @@ -2132,7 +2132,7 @@ class Server extends AppModel { ); return $validItems; } - + public function grabFiles() { $validItems = $this->getFileRules(); App::uses('Folder', 'Utility'); @@ -2147,7 +2147,7 @@ class Server extends AppModel { } return $validItems; } - + public function runConnectionTest($id) { $server = $this->find('first', array('conditions' => array('Server.id' => $id))); App::uses('SyncTool', 'Tools'); @@ -2193,7 +2193,7 @@ class Server extends AppModel { return array('status' => 3); } } - + public function checkVersionCompatibility($id, $user = array(), $HttpSocket = false) { // for event publishing when we don't have a user. if (empty($user)) $user = array('Organisation' => array('name' => 'SYSTEM'), 'email' => 'SYSTEM', 'id' => 0); @@ -2201,7 +2201,7 @@ class Server extends AppModel { $file = new File(ROOT . DS . 'VERSION.json', true); $localVersion = json_decode($file->read(), true); $file->close(); - + $server = $this->find('first', array('conditions' => array('Server.id' => $id))); if (!$HttpSocket) { App::uses('SyncTool', 'Tools'); @@ -2262,7 +2262,7 @@ class Server extends AppModel { $response = "Sync to Server ('" . $id . "') aborted. The remote instance is at least a full minor version ahead - make sure you update your MISP instance!"; $canPush = true; } - + // if we haven't set a message yet, we're good to go. We are only behind by a hotfix version if ($response === false) { $success = true; @@ -2271,12 +2271,12 @@ class Server extends AppModel { else $issueLevel = "error"; if ($response === false && $localVersion['hotfix'] > $remoteVersion[2]) $response = "Sync to Server ('" . $id . "') initiated, but the remote instance is a few hotfixes behind."; if ($response === false && $localVersion['hotfix'] < $remoteVersion[2]) $response = "Sync to Server ('" . $id . "') initiated, but the remote instance is a few hotfixes ahead. Make sure you keep your instance up to date!"; - + if (Configure::read('MISP.ManglePushTo23') && !$canPush) { $canPush = 'mangle'; $response = "Sync to Server ('" . $id . "') should have been blocked, but mangle sync override is enabled. A downgraded synchronisation is highly advised again, please upgrade your instance as soon as possible."; } - + if ($response !== false) { $this->Log = ClassRegistry::init('Log'); $this->Log->create(); @@ -2292,11 +2292,11 @@ class Server extends AppModel { } return array('success' => $success, 'response' => $response, 'canPush' => $canPush, 'version' => $remoteVersion); } - + public function isJson($string) { return (json_last_error() == JSON_ERROR_NONE); } - + public function captureServer($server, $user) { if (isset($server[0])) $server = $server[0]; if ($server['url'] == Configure::read('MISP.baseurl')) return 0; @@ -2342,7 +2342,7 @@ class Server extends AppModel { } return $writeableDirs; } - + public function writeableFilesDiagnostics(&$diagnostic_errors) { $writeableFiles = array( 'Config' . DS . 'config.php' => 0, @@ -2359,7 +2359,7 @@ class Server extends AppModel { } return $writeableFiles; } - + public function stixDiagnostics(&$diagnostic_errors, &$stixVersion, &$cyboxVersion) { $result = array(); $expected = array('stix' => '1.1.1.4', 'cybox' => '2.1.0.12'); @@ -2386,7 +2386,7 @@ class Server extends AppModel { } return $result; } - + public function gpgDiagnostics(&$diagnostic_errors) { $gpgStatus = 0; if (Configure::read('GnuPG.email') && Configure::read('GnuPG.homedir')) { @@ -2420,7 +2420,7 @@ class Server extends AppModel { if ($gpgStatus != 0) $diagnostic_errors++; return $gpgStatus; } - + public function zmqDiagnostics(&$diagnostic_errors) { if (!Configure::read('Plugin.ZeroMQ_enable')) return 1; App::uses('PubSubTool', 'Tools'); @@ -2433,7 +2433,7 @@ class Server extends AppModel { $diagnostic_errors++; return 3; } - + public function proxyDiagnostics(&$diagnostic_errors) { $proxyStatus = 0; $proxy = Configure::read('Proxy'); @@ -2455,7 +2455,7 @@ class Server extends AppModel { if ($proxyStatus > 1) $diagnostic_errors++; return $proxyStatus; } - + public function sessionDiagnostics(&$diagnostic_errors, &$sessionCount) { if (Configure::read('Session.defaults') !== 'database') { $sessionCount = 'N/A'; @@ -2475,7 +2475,7 @@ class Server extends AppModel { } return $sessionStatus; } - + public function workerDiagnostics(&$workerIssueCount) { $this->ResqueStatus = new ResqueStatus\ResqueStatus(Resque::redis()); $workers = $this->ResqueStatus->getWorkers(); @@ -2519,7 +2519,7 @@ class Server extends AppModel { $worker_array['proc_accessible'] = $procAccessible; return $worker_array; } - + public function retrieveCurrentSettings($branch, $subString) { $settings = array(); foreach ($this->serverSettings[$branch] as $settingName => $setting) { @@ -2531,7 +2531,7 @@ class Server extends AppModel { } return $settings; } - + public function killWorker($pid, $user) { if (!is_numeric($pid)) throw new MethodNotAllowedException('Non numeric PID found!'); $this->ResqueStatus = new ResqueStatus\ResqueStatus(Resque::redis()); @@ -2569,7 +2569,7 @@ class Server extends AppModel { $this->ResqueStatus->removeWorker($pid); } } - + public function workerRemoveDead($user) { $this->ResqueStatus = new ResqueStatus\ResqueStatus(Resque::redis()); $workers = $this->ResqueStatus->getWorkers(); @@ -2597,7 +2597,7 @@ class Server extends AppModel { } } } - + private function __dropIndex($table, $field) { $this->Log = ClassRegistry::init('Log'); $indexCheck = "SELECT INDEX_NAME FROM INFORMATION_SCHEMA.STATISTICS WHERE table_schema=DATABASE() AND table_name='" . $table . "' AND index_name LIKE '" . $field . "%'"; @@ -2623,7 +2623,7 @@ class Server extends AppModel { )); } } - + public function upgrade2324($user_id, $jobId = false) { $this->cleanCacheFiles(); if (Configure::read('MISP.background_jobs') && $jobId) { @@ -2769,8 +2769,8 @@ class Server extends AppModel { $this->Job->saveField('message', 'Upgrade complete.'); } } - - + + /* returns an array with the events * error codes: * 1: received non json response @@ -2815,7 +2815,7 @@ class Server extends AppModel { } return 2; } - + /* returns an array with the events * error codes: * 1: received non-json response @@ -2853,7 +2853,7 @@ class Server extends AppModel { } return 2; } - + // Loops through all servers and checks which servers' push rules don't conflict with the given event. // returns the server objects that would allow the event to be pushed public function eventFilterPushableServers($event, $servers) { @@ -2880,7 +2880,7 @@ class Server extends AppModel { } return $validServers; } - + public function getEnrichmentModules() { if (!Configure::read('Plugin.Enrichment_services_enable')) return 'Enrichment service not enabled.'; $url = Configure::read('Plugin.Enrichment_services_url') ? Configure::read('Plugin.Enrichment_services_url') : $this->serverSettings['Plugin']['Enrichment_services_url']['value']; @@ -2904,7 +2904,7 @@ class Server extends AppModel { return $result; } else return 'The enrichment service reports that it found no enrichment modules.'; } - + public function getEnabledModules() { $modules = $this->getEnrichmentModules(); if (is_array($modules)) { diff --git a/app/Model/ShadowAttribute.php b/app/Model/ShadowAttribute.php index 06e15a382..5cabfec5b 100644 --- a/app/Model/ShadowAttribute.php +++ b/app/Model/ShadowAttribute.php @@ -167,7 +167,7 @@ class ShadowAttribute extends AppModel { } // The Associations below have been created with all possible keys, those that are not needed can be removed - + /** * beforeSave * @@ -204,7 +204,7 @@ class ShadowAttribute extends AppModel { $this->ShadowAttributeCorrelation = ClassRegistry::init('ShadowAttributeCorrelation'); $this->ShadowAttributeCorrelation->deleteAll(array('ShadowAttributeCorrelation.1_shadow_attribute_id' => $temp['id'])); } - + private function __afterSaveCorrelation(&$sa) { $temp = $sa; if (isset($temp['ShadowAttribute'])) $temp = $temp['ShadowAttribute']; @@ -255,7 +255,7 @@ class ShadowAttribute extends AppModel { } if (!empty($shadow_attribute_correlations)) $this->ShadowAttributeCorrelation->saveMany($shadow_attribute_correlations); } - + public function afterSave($created, $options = array()) { $result = true; // if the 'data' field is set on the $this->data then save the data to the correct file @@ -311,7 +311,7 @@ class ShadowAttribute extends AppModel { if (!isset($this->data['ShadowAttribute']['type'])) { return false; } - + if (empty($this->data['ShadowAttribute']['timestamp'])) { $date = new DateTime(); $this->data['ShadowAttribute']['timestamp'] = $date->getTimestamp(); @@ -336,7 +336,7 @@ class ShadowAttribute extends AppModel { } return false; } - + public function validCategory($fields) { return $this->Event->Attribute->validCategory($fields); } @@ -477,7 +477,7 @@ class ShadowAttribute extends AppModel { } return $fails; } - + public function setDeleted($id) { $this->Behaviors->detach('SysLogLogable.SysLogLogable'); $sa = $this->find('first', array('conditions' => array('ShadowAttribute.id' => $id), 'recusive' => -1)); @@ -488,7 +488,7 @@ class ShadowAttribute extends AppModel { $this->save($sa); return true; } - + public function findOldProposal($sa) { $oldsa = $this->find('first', array( 'conditions' => array( @@ -503,7 +503,7 @@ class ShadowAttribute extends AppModel { if (empty($oldsa)) return false; else return $oldsa['ShadowAttribute']; } - + public function getEventContributors($id) { $orgs = $this->find('all', array('fields' => array('DISTINCT(org_id)'), 'conditions' => array('event_id' => $id), 'order' => false)); $org_ids = array(); @@ -512,12 +512,12 @@ class ShadowAttribute extends AppModel { } return $org_ids; } - + public function sendProposalAlertEmail($id) { $this->Event->recursive = -1; $event = $this->Event->read(null, $id); - + // If the event has an e-mail lock, return if ($event['Event']['proposal_email_lock'] == 1) { return; @@ -534,7 +534,7 @@ class ShadowAttribute extends AppModel { ), 'fields' => array('email', 'gpgkey', 'certif_public', 'contactalert', 'id') )); - + $body = "Hello, \n\n"; $body .= "A user of another organisation has proposed a change to an event created by you or your organisation. \n\n"; $body .= 'To view the event in question, follow this link: ' . Configure::read('MISP.baseurl') . '/events/view/' . $id . "\n"; @@ -545,7 +545,7 @@ class ShadowAttribute extends AppModel { } return $result; } - + public function setProposalLock($id, $lock = true) { $this->Event->recursive = -1; @@ -558,7 +558,7 @@ class ShadowAttribute extends AppModel { $fieldList = array('proposal_email_lock', 'id', 'info'); $this->Event->save($event, array('fieldList' => $fieldList)); } - + public function generateCorrelation($jobId = false) { $this->ShadowAttributeCorrelation = ClassRegistry::init('ShadowAttributeCorrelation'); $this->ShadowAttributeCorrelation->deleteAll(array('id !=' => 0), false); @@ -584,7 +584,7 @@ class ShadowAttribute extends AppModel { } return $proposalCount; } - + public function upgradeToProposalCorrelation() { $this->Log = ClassRegistry::init('Log'); if (!Configure::read('MISP.background_jobs')) { diff --git a/app/Model/SharingGroup.php b/app/Model/SharingGroup.php index 219a7adb9..1efcfa316 100644 --- a/app/Model/SharingGroup.php +++ b/app/Model/SharingGroup.php @@ -2,7 +2,7 @@ App::uses('AppModel', 'Model'); class SharingGroup extends AppModel { - + public $actsAs = array( 'Containable', 'SysLogLogable.SysLogLogable' => array( // TODO Audit, logable @@ -43,7 +43,7 @@ class SharingGroup extends AppModel { 'Attribute', 'Thread' ); - + public $belongsTo = array( 'Organisation' => array( 'className' => 'Organisation', @@ -62,7 +62,7 @@ class SharingGroup extends AppModel { $this->data['SharingGroup']['date_created'] = $date; } $this->data['SharingGroup']['date_modified'] = $date; - + $sameNameSG = $this->find('first', array( 'conditions' => array('SharingGroup.name' => $this->data['SharingGroup']['name']), 'recursive' => -1, @@ -73,7 +73,7 @@ class SharingGroup extends AppModel { } return true; } - + public function beforeDelete($cascade = false){ $countEvent = $this->Event->find('count', array( 'recursive' => -1, @@ -90,7 +90,7 @@ class SharingGroup extends AppModel { if (($countEvent + $countThread + $countAttribute) == 0) return true; return false; } - + public function fetchAllAuthorisedForServer($server) { $conditions = array(); $ids = array(); @@ -98,7 +98,7 @@ class SharingGroup extends AppModel { $sgs = array_merge($sgs, $this->SharingGroupServer->fetchAllSGsForServer($server['Server']['id'])); return $sgs; } - + // returns a list of all sharing groups that the user is allowed to see // scope can be: // full: Entire SG object with all organisations and servers attached @@ -145,7 +145,7 @@ class SharingGroup extends AppModel { return $ids; } } - + // Who can create a new sharing group with the elements pre-defined (via REST for example)? // 1. site admins // 2. Sharing group enabled users @@ -153,7 +153,7 @@ class SharingGroup extends AppModel { // 3. Sync users // a. as long as they are at least users of the SG (they can circumvent the extend rule to // avoid situations where no one can create / edit an SG on an instance after a push) - + public function checkIfAuthorisedToSave($user, $sg) { if (isset($sg[0])) $sg = $sg[0]; if ($user['Role']['perm_site_admin']) return true; @@ -190,7 +190,7 @@ class SharingGroup extends AppModel { } return false; } - + // Who is authorised to extend a sharing group? // 1. Site admins // 2. Sharing group permission enabled users that: @@ -226,7 +226,7 @@ class SharingGroup extends AppModel { if (empty($sgo)) return false; else return true; } - + // returns true if the SG exists and the user is allowed to see it public function checkIfAuthorised($user, $id) { if (!isset($user['id'])) throw new MethodNotAllowedException('Invalid user.'); @@ -235,7 +235,7 @@ class SharingGroup extends AppModel { if ($user['Role']['perm_site_admin'] || $this->SharingGroupServer->checkIfAuthorised($id) || $this->SharingGroupOrg->checkIfAuthorised($id, $user['org_id'])) return true; return false; } - + public function checkIfOwner($user, $id) { if (!isset($user['id'])) throw new MethodNotAllowedException('Invalid user.'); $this->id = $id; @@ -248,7 +248,7 @@ class SharingGroup extends AppModel { )); return ($sg['SharingGroup']['org_id'] == $user['org_id']); } - + // Get all organisation ids that can see a SG public function getOrgsWithAccess($id) { $sg = $this->find('first', array( @@ -274,7 +274,7 @@ class SharingGroup extends AppModel { } return $orgs; } - + public function checkIfServerInSG($sg, $server) { $results = array( 'rule' => false, @@ -292,7 +292,7 @@ class SharingGroup extends AppModel { foreach ($sg['SharingGroupOrg'] as $org) if (isset($org['Organisation']) && $org['Organisation']['uuid'] === $server['RemoteOrg']['uuid']) return true; return false; } - + public function getSGSyncRules($sg) { $results = array( 'conditional' => array(), @@ -316,7 +316,7 @@ class SharingGroup extends AppModel { } return $results; } - + public function captureSG($sg, $user) { $existingSG = !isset($sg['uuid']) ? null : $this->find('first', array( 'recursive' => -1, @@ -372,7 +372,7 @@ class SharingGroup extends AppModel { } } unset ($sg['Organisation']); - + if (isset($sg['SharingGroupOrg']['id'])) { $temp = $sg['SharingGroupOrg']; unset($sg['SharingGroupOrg']); @@ -405,7 +405,7 @@ class SharingGroup extends AppModel { $this->SharingGroupOrg->save(array('sharing_group_id' => $sgids, 'org_id' => $sg['SharingGroupOrg'][$k]['org_id'], 'extend' => $org['extend'])); } } - + if (isset($sg['SharingGroupServer']['id'])) { $temp = $sg['SharingGroupServer']; unset($sg['SharingGroupServer']); diff --git a/app/Model/SharingGroupElement.php b/app/Model/SharingGroupElement.php index 55eafad21..7b05e0f33 100644 --- a/app/Model/SharingGroupElement.php +++ b/app/Model/SharingGroupElement.php @@ -3,9 +3,9 @@ App::uses('AppModel', 'Model'); class SharingGroupElement extends AppModel { public $actsAs = array('Containable'); public $validate = array( - + ); - + public $belongsTo = array( 'SharingGroup' => array( 'className' => 'SharingGroup', diff --git a/app/Model/SharingGroupOrg.php b/app/Model/SharingGroupOrg.php index fc3a642be..5a93ae4da 100644 --- a/app/Model/SharingGroupOrg.php +++ b/app/Model/SharingGroupOrg.php @@ -3,9 +3,9 @@ App::uses('AppModel', 'Model'); class SharingGroupOrg extends AppModel { public $actsAs = array('Containable'); public $validate = array( - + ); - + public $belongsTo = array( 'SharingGroup' => array( 'className' => 'SharingGroup', @@ -21,7 +21,7 @@ class SharingGroupOrg extends AppModel { public function beforeValidate($options = array()) { parent::beforeValidate(); } - + public function updateOrgsForSG($id, $new_orgs, $old_orgs, $user) { $log = ClassRegistry::init('Log'); // Loop through all of the organisations we want to add. @@ -64,7 +64,7 @@ class SharingGroupOrg extends AppModel { } } } - + public function fetchAllAuthorised($org_id) { $sgs = $this->find('all', array( 'conditions' => array('org_id' => $org_id), @@ -75,7 +75,7 @@ class SharingGroupOrg extends AppModel { foreach ($sgs as $sg) $ids[] = $sg['SharingGroupOrg']['sharing_group_id']; return $ids; } - + // pass a sharing group ID and an organisation ID, returns true if it has a matching attached organisation object public function checkIfAuthorised($id, $org_id) { $sg = $this->find('first', array( diff --git a/app/Model/SharingGroupServer.php b/app/Model/SharingGroupServer.php index 50735c16b..e4f9bad80 100644 --- a/app/Model/SharingGroupServer.php +++ b/app/Model/SharingGroupServer.php @@ -3,9 +3,9 @@ App::uses('AppModel', 'Model'); class SharingGroupServer extends AppModel { public $actsAs = array('Containable'); public $validate = array( - + ); - + public $belongsTo = array( 'SharingGroup' => array( 'className' => 'SharingGroup', @@ -21,7 +21,7 @@ class SharingGroupServer extends AppModel { public function beforeValidate($options = array()) { parent::beforeValidate(); } - + public function updateServersForSG($id, $new_servers, $old_servers, $limitServers, $user) { $log = ClassRegistry::init('Log'); @@ -35,7 +35,7 @@ class SharingGroupServer extends AppModel { ); $server_name = 'server (' . $server['id'] . ')'; if ($server['id'] == 0) $server_name = 'the local server'; - + $found = false; // If there is a match between a new server and an old server, keep the server in $found and unset it in the old server array. foreach ($old_servers as $k => $old_server) { @@ -45,7 +45,7 @@ class SharingGroupServer extends AppModel { break; } } - + // If we have not found the server previously, create a new sharing group server object. // Otherwise, if we have found it check whether the extended field has been altered, if not just continue without saving if (!$found) { @@ -74,7 +74,7 @@ class SharingGroupServer extends AppModel { $this->deleteAll(array('sharing_group_id' => $id), false); } } - + // returns all sharing group IDs that have the local server (server_id = 0) as a server object with all orgs turned to 1 // This basically lists all SGs that allow everyone on the instance to see events tagged with it public function fetchAllAuthorised() { @@ -87,7 +87,7 @@ class SharingGroupServer extends AppModel { foreach ($sgs as $sg) $ids[] = $sg['SharingGroupServer']['sharing_group_id']; return $ids; } - + // pass a sharing group ID, returns true if it has an attached server object with "all_orgs" ticked public function checkIfAuthorised($id) { $sg = $this->find('first', array( @@ -98,7 +98,7 @@ class SharingGroupServer extends AppModel { if (!empty($sg)) return true; return false; } - + public function fetchAllSGsForServer($server_id) { $sgs = $this->find('all', array( 'recursive' => -1, diff --git a/app/Model/Sighting.php b/app/Model/Sighting.php index 767a8223c..c78e4fbac 100644 --- a/app/Model/Sighting.php +++ b/app/Model/Sighting.php @@ -13,7 +13,7 @@ class Sighting extends AppModel{ 'org_id' => 'numeric', 'date_sighting' => 'numeric' ); - + public $belongsTo = array( 'Attribute' => array( 'className' => 'Attribute', @@ -35,7 +35,7 @@ class Sighting extends AppModel{ } return true; } - + public function attachToEvent(&$event, &$user, $eventOnly = false) { $ownEvent = false; if ($user['Role']['perm_site_admin'] || $event['Event']['org_id'] == $user['org_id']) $ownEvent = true; @@ -47,7 +47,7 @@ class Sighting extends AppModel{ if (Configure::read('MISP.showorg')) { $contain['Organisation'] = array('fields' => array('Organisation.id', 'Organisation.uuid', 'Organisation.name')); } - + // Sighting reporters setting // If the event has any sightings for the user's org, then the user is a sighting reporter for the event too. // This means that he /she has access to the sightings data contained within @@ -55,7 +55,7 @@ class Sighting extends AppModel{ $temp = $this->find('first', array('recursive' => -1, 'conditions' => array('Sighting.event_id' => $event['Event']['id'], 'Sighting.org_id' => $user['org_id']))); if (empty($temp)) return array(); } - + $sightings = $this->find('all', array( 'conditions' => $conditions, 'recursive' => -1, @@ -79,7 +79,7 @@ class Sighting extends AppModel{ } return $sightings; } - + public function saveSightings($id, $values, $timestamp, $user) { $conditions = array(); if ($id && $id !== 'stix') { @@ -110,11 +110,11 @@ class Sighting extends AppModel{ } return $sightingsAdded; } - + public function handleStixSighting($data) { $randomFileName = $this->generateRandomFileName(); $tempFile = new File(APP . "files" . DS . "scripts" . DS . "tmp" . DS . $randomFileName, true, 0644); - + // save the json_encoded event(s) to the temporary file if (!$tempFile->write($data)) return array('success' => 0, 'message' => 'Could not write the Sightings file to disk.'); $tempFile->close(); @@ -134,7 +134,7 @@ class Sighting extends AppModel{ $tempFile->delete(); return $result; } - + public function generateRandomFileName() { $length = 12; $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'; diff --git a/app/Model/Tag.php b/app/Model/Tag.php index c8be10b03..34043beb1 100644 --- a/app/Model/Tag.php +++ b/app/Model/Tag.php @@ -29,7 +29,7 @@ class Tag extends AppModel { ), 'Containable' ); - + public $validate = array( 'name' => array( 'valueNotEmpty' => array( @@ -50,7 +50,7 @@ class Tag extends AppModel { ), ), ); - + public $hasMany = array( 'EventTag' => array( 'className' => 'EventTag', @@ -60,17 +60,17 @@ class Tag extends AppModel { 'dependent' => true ) ); - - + + public function beforeDelete($cascade = true) { $this->EventTag->deleteAll(array('EventTag.tag_id' => $this->id)); } - + public function validateColour($fields) { if (!preg_match('/^#[0-9a-f]{6}$/i', $fields['colour'])) return false; return true; } - + // find all of the event Ids that belong to the accepted tags and the rejected tags public function fetchEventTagIds($accept=array(), $reject=array()) { $acceptIds = array(); @@ -84,7 +84,7 @@ class Tag extends AppModel { } return array($acceptIds, $rejectIds); } - + // find all of the event Ids that belong to tags with certain names public function findTags($array) { $ids = array(); @@ -105,7 +105,7 @@ class Tag extends AppModel { } return $ids; } - + public function captureTag($tag, $user) { $existingTag = $this->find('first', array( 'recursive' => -1, @@ -143,13 +143,13 @@ class Tag extends AppModel { } return $tags; } - + public function random_color() { $colour = '#'; for ($i = 0; $i < 3; $i++) $colour .= str_pad(dechex(mt_rand(0,255)), 2, '0', STR_PAD_LEFT); return $colour; } - + public function quickAdd($name, $colour = false) { $this->create(); if ($colour === false) $colour = $this->random_color(); @@ -160,7 +160,7 @@ class Tag extends AppModel { ); return ($this->save($data)); } - + public function quickEdit($tag, $name, $colour) { if ($tag['Tag']['colour'] !== $colour || $tag['Tag']['name'] !== $name) { $tag['Tag']['name'] = $name; @@ -169,7 +169,7 @@ class Tag extends AppModel { } return true; } - + public function getTagsForNamespace($namespace) { $tags_temp = $this->find('all', array( 'recursive' => -1, diff --git a/app/Model/Task.php b/app/Model/Task.php index 4fb8d16e7..8ca235682 100644 --- a/app/Model/Task.php +++ b/app/Model/Task.php @@ -15,7 +15,7 @@ class Task extends AppModel { 'description' => 'Generates export caches for every export type and for every organisation. This process is heavy, schedule so it might be a good idea to schedule this outside of working hours and before your daily automatic imports on connected services are scheduled.', 'next_execution_time' => 1391601600, 'message' => 'Not scheduled yet.' - + ), 'pull_all' => array( 'type' => 'pull_all', @@ -37,7 +37,7 @@ class Task extends AppModel { 'message' => 'Not scheduled yet.' ) ); - + // takes a time in the 24h format (13:49) and an integer representing the number of hours // by which it needs to be incremeneted. Returns a string in the first parameters format public function breakTime($time, $timeToAdd) { @@ -47,7 +47,7 @@ class Task extends AppModel { if ($temp[0] > 23) $temp[0] = $temp[0] - 24; return $temp[0] . ':' . $temp[1]; } - + public function reQueue($task, $worker, $shell, $action, $userId, $taskId) { $time = time(); // Keep adding the timer's time interval until we get a date that is in the future! We don't want to keep queuing tasks in the past since they will execute until it catches up. @@ -56,7 +56,7 @@ class Task extends AppModel { } $task['Task']['scheduled_time'] = $this->breakTime($task['Task']['scheduled_time'], $task['Task']['timer']); $task['Task']['scheduled_time'] = date('H:i', $task['Task']['next_execution_time']); - + // Now that we have figured out when the next execution should happen, it's time to enqueue it. $process_id = CakeResque::enqueueAt( $task['Task']['next_execution_time'], diff --git a/app/Model/Taxonomy.php b/app/Model/Taxonomy.php index 896611c80..407f85c96 100644 --- a/app/Model/Taxonomy.php +++ b/app/Model/Taxonomy.php @@ -18,7 +18,7 @@ class Taxonomy extends AppModel{ 'rule' => array('numeric'), ) ); - + public $hasMany = array( 'TaxonomyPredicate' => array( 'dependent' => true @@ -29,7 +29,7 @@ class Taxonomy extends AppModel{ parent::beforeValidate(); return true; } - + public function update() { $directories = glob(APP . 'files' . DS . 'taxonomies' . DS . '*', GLOB_ONLYDIR); foreach ($directories as $k => &$dir) { @@ -59,7 +59,7 @@ class Taxonomy extends AppModel{ } return $updated; } - + private function __updateVocab(&$vocab, &$current, $skipUpdateFields = array()) { $enabled = false; $taxonomy = array(); @@ -87,7 +87,7 @@ class Taxonomy extends AppModel{ } return $this->validationErrors; } - + private function __getTaxonomy($id, $options = array('full' => false, 'filter' => false)) { $recursive = -1; if ($options['full']) $recursive = 2; @@ -122,7 +122,7 @@ class Taxonomy extends AppModel{ $taxonomy['entries'] = $entries; return $taxonomy; } - + // returns all tags associated to a taxonomy // returns all tags not associated to a taxonomy if $inverse is true public function getAllTaxonomyTags($inverse = false) { @@ -140,7 +140,7 @@ class Taxonomy extends AppModel{ } return $allTags; } - + public function getTaxonomyTags($id, $uc = false, $existingOnly = false) { $taxonomy = $this->__getTaxonomy($id, array('full' => true, 'filter' => false)); if ($existingOnly) { @@ -163,7 +163,7 @@ class Taxonomy extends AppModel{ } return $entries; } - + public function getTaxonomy($id, $options = array('full' => true)) { $this->Tag = ClassRegistry::init('Tag'); $taxonomy = $this->__getTaxonomy($id, $options); @@ -178,7 +178,7 @@ class Taxonomy extends AppModel{ } return $taxonomy; } - + private function __updateTags($id, $skipUpdateFields = array()) { $this->Tag = ClassRegistry::init('Tag'); App::uses('ColourPaletteTool', 'Tools'); @@ -198,7 +198,7 @@ class Taxonomy extends AppModel{ } } } - + public function addTags($id, $tagList = false) { if ($tagList && !is_array($tagList)) $tagList = array($tagList); $this->Tag = ClassRegistry::init('Tag'); diff --git a/app/Model/TaxonomyEntry.php b/app/Model/TaxonomyEntry.php index f5c79a6cd..a46d192b8 100644 --- a/app/Model/TaxonomyEntry.php +++ b/app/Model/TaxonomyEntry.php @@ -15,11 +15,11 @@ class TaxonomyEntry extends AppModel{ 'rule' => array('stringNotEmpty'), ), ); - + public $belongsTo = array( 'TaxonomyPredicate' ); - + public function beforeValidate($options = array()) { parent::beforeValidate(); return true; diff --git a/app/Model/TaxonomyPredicate.php b/app/Model/TaxonomyPredicate.php index 1a8f3fd2f..188c8be85 100644 --- a/app/Model/TaxonomyPredicate.php +++ b/app/Model/TaxonomyPredicate.php @@ -21,7 +21,7 @@ class TaxonomyPredicate extends AppModel{ 'dependent' => true ) ); - + public function beforeValidate($options = array()) { parent::beforeValidate(); return true; diff --git a/app/Model/Template.php b/app/Model/Template.php index 6eb4fba10..20a070be4 100644 --- a/app/Model/Template.php +++ b/app/Model/Template.php @@ -17,14 +17,14 @@ class Template extends AppModel { 'dependent' => true, ) ); - + public function trimElementPositions($id) { // permissions $this->id = $id; if (!$this->exists()) { throw new NotFoundException(__('Invalid template.')); } - + $template = $this->find('first', array( 'conditions' => array('id' => $id), 'recursive' => -1, @@ -38,32 +38,32 @@ class Template extends AppModel { } $this->saveAll($template); } - + public function checkAuthorisation($id, $user, $write) { // fetch the bare template $template = $this->find('first', array( 'conditions' => array('id' => $id), 'recursive' => -1, )); - + // if not found return false if (empty($template)) return false; - + //if the user is a site admin, return the template withoug question if ($user['Role']['perm_site_admin']) return $template; - + if ($write) { // if write access is requested, check if template belongs to user's org and whether the user is authorised to edit templates if ($user['Organisation']['name'] == $template['Template']['org'] && $user['Role']['perm_template']) return $template; return false; } else { - + // if read access is requested, check if the template belongs to the user's org or alternatively whether the template is shareable if ($user['Organisation']['name'] == $template['Template']['org'] || $template['Template']['share']) return $template; return false; } } - + public function generateRandomFileName() { $length = 12; $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'; diff --git a/app/Model/TemplateElement.php b/app/Model/TemplateElement.php index 7fa77a635..81e4343b3 100644 --- a/app/Model/TemplateElement.php +++ b/app/Model/TemplateElement.php @@ -20,7 +20,7 @@ class TemplateElement extends AppModel { ) ); public $belongsTo = array('Template'); - + public function lastPosition($template_id) { $result = $this->find('first', array( 'fields' => array('MAX(position) AS pos', 'id', 'template_id'), diff --git a/app/Model/TemplateElementAttribute.php b/app/Model/TemplateElementAttribute.php index 14ff65eb1..2473d3c94 100644 --- a/app/Model/TemplateElementAttribute.php +++ b/app/Model/TemplateElementAttribute.php @@ -9,7 +9,7 @@ App::uses('AppModel', 'Model'); class TemplateElementAttribute extends AppModel { public $actsAs = array('Containable'); public $belongsTo = array('TemplateElement'); - + public $validate = array( 'name' => array( 'valueNotEmpty' => array( diff --git a/app/Model/TemplateElementFile.php b/app/Model/TemplateElementFile.php index 711e16b95..10a8d6463 100644 --- a/app/Model/TemplateElementFile.php +++ b/app/Model/TemplateElementFile.php @@ -9,7 +9,7 @@ App::uses('AppModel', 'Model'); class TemplateElementFile extends AppModel { public $actsAs = array('Containable'); public $belongsTo = array('TemplateElement'); - + public $validate = array( 'name' => array( 'rule' => array('valueNotEmpty'), diff --git a/app/Model/TemplateElementText.php b/app/Model/TemplateElementText.php index feced763a..8dc4dff51 100644 --- a/app/Model/TemplateElementText.php +++ b/app/Model/TemplateElementText.php @@ -9,7 +9,7 @@ App::uses('AppModel', 'Model'); class TemplateElementText extends AppModel { public $actsAs = array('Containable'); public $belongsTo = array('TemplateElement'); - + public $validate = array( 'name' => array( 'rule' => array('valueNotEmpty'), diff --git a/app/Model/Thread.php b/app/Model/Thread.php index 244e2ac8b..175e43734 100644 --- a/app/Model/Thread.php +++ b/app/Model/Thread.php @@ -24,7 +24,7 @@ class Thread extends AppModel { ), 'SharingGroup' ); - + public function updateAfterPostChange($thread, $add = false) { $count = count($thread['Post']); // If we have 0 posts left, delete the thread! diff --git a/app/Model/User.php b/app/Model/User.php index d0064d420..d7b34c3b6 100644 --- a/app/Model/User.php +++ b/app/Model/User.php @@ -16,10 +16,10 @@ class User extends AppModel { * @var string */ public $displayField = 'email'; - + public $orgField = array('Organisation', 'name'); // TODO Audit, LogableBehaviour + org - + /** * Validation rules * @@ -242,7 +242,7 @@ class User extends AppModel { 'Trim', 'Containable' ); - + private function __generatePassword() { $groups = array( '0123456789', @@ -261,7 +261,7 @@ class User extends AppModel { } return $pw; } - + public function beforeValidate($options = array()) { if (!isset($this->data['User']['id'])) { if (isset($this->data['User']['enable_password']) && (!$this->data['User']['enable_password'] || (empty($this->data['User']['password']) && empty($this->data['User']['confirm_password'])))) { @@ -328,9 +328,9 @@ class User extends AppModel { if (empty($check['certif_public'])) { return true; } - + // certif_public is entered - + // Check if $check is a x509 certificate if (openssl_x509_read($check['certif_public'])){ try { @@ -383,7 +383,7 @@ class User extends AppModel { if (strlen($value) < $length) return false; return true; } - + public function complexPassword($check) { /* default password: @@ -451,7 +451,7 @@ class User extends AppModel { } return $fails; } - + public function getOrgs() { $orgs = $this->Organisation->find('list', array( 'recursive' => -1, @@ -459,14 +459,14 @@ class User extends AppModel { )); return $orgs; } - + public function getOrgMemberCount($org) { return $this->find('count', array( 'conditions' => array( 'org =' => $org, ))); } - + public function verifyGPG($id = false) { require_once 'Crypt/GPG.php'; $this->Behaviors->detach('Trim'); @@ -597,7 +597,7 @@ class User extends AppModel { unset($user['Organisation'], $user['Role'], $user['Server']); return $user['User']; } - + // get the current user and rearrange it to be in the same format as in the auth component public function getAuthUserByUuid($id) { $conditions = array('User.authkey' => $id); @@ -610,7 +610,7 @@ class User extends AppModel { unset($user['Organisation'], $user['Role'], $user['Server']); return $user['User']; } - + public function getAuthUserByExternalAuth($id) { $conditions = array('User.external_auth_key' => $id, 'User.external_auth_required' => true); $user = $this->find('first', array('conditions' => $conditions, 'recursive' => -1,'contain' => array('Organisation', 'Role', 'Server'))); @@ -622,7 +622,7 @@ class User extends AppModel { unset($user['Organisation'], $user['Role'], $user['Server']); return $user['User']; } - + // Fetch all users that have access to an event / discussion for e-mailing (or maybe something else in the future. // parameters are an array of org IDs that are owners (for an event this would be orgc and org) public function getUsersWithAccess($owners = array(), $distribution, $sharing_group_id = 0, $userConditions = array()) { @@ -636,7 +636,7 @@ class User extends AppModel { $all = false; $validOrgs = $owners; } - + // add all orgs to the conditions that can see the SG if ($distribution == 4) { $sgOrgs = $sgModel->getOrgsWithAccess($sharing_group_id); @@ -699,7 +699,7 @@ class User extends AppModel { if (isset($user['User']['gpgkey']) && !empty($user['User']['gpgkey'])) $canEncryptGPG = true; $canEncryptSMIME = false; if (isset($user['User']['certif_public']) && !empty($user['User']['certif_public']) && Configure::read('SMIME.enabled')) $canEncryptSMIME = true; - + // If bodyonlencrypted is enabled and the user has no encryption key, use the alternate body (if it exists) if (Configure::read('GnuPG.bodyonlyencrypted') && !$canEncryptSMIME && !$canEncryptGPG && $bodyNoEnc) { $body = $bodyNoEnc; @@ -863,7 +863,7 @@ class User extends AppModel { } return false; } - + public function adminMessageResolve($message) { $resolveVars = array('$contact' => 'MISP.contact', '$org' => 'MISP.org', '$misp' => 'MISP.baseurl'); foreach ($resolveVars as $k => $v) { @@ -872,7 +872,7 @@ class User extends AppModel { } return $message; } - + public function fetchPGPKey($email) { App::uses('SyncTool', 'Tools'); $syncTool = new SyncTool(); @@ -884,7 +884,7 @@ class User extends AppModel { $results = $this->__extractPGPInfo($matches[1]); return $results; } - + private function __extractPGPInfo($lines) { $extractionRules = array( 'key_id' => array('regex' => '/\">(.*?)<\/a>/', 'all' => false, 'alternate' => false), @@ -910,7 +910,7 @@ class User extends AppModel { } return $final; } - + public function describeAuthFields() { $fields = array(); $fields = array_merge($fields, array_keys($this->getColumnTypes())); diff --git a/app/Model/Warninglist.php b/app/Model/Warninglist.php index 40f354249..68d6c21d8 100644 --- a/app/Model/Warninglist.php +++ b/app/Model/Warninglist.php @@ -18,7 +18,7 @@ class Warninglist extends AppModel{ 'rule' => array('numeric'), ), ); - + public $hasMany = array( 'WarninglistEntry' => array( 'dependent' => true @@ -32,11 +32,11 @@ class Warninglist extends AppModel{ parent::beforeValidate(); return true; } - + public function checkValidTypeJSON($check) { return true; } - + public function update() { $directories = glob(APP . 'files' . DS . 'warninglists' . DS . 'lists' . DS . '*', GLOB_ONLYDIR); $updated = array(); @@ -67,7 +67,7 @@ class Warninglist extends AppModel{ } return $updated; } - + private function __updateList($list, $current) { $list['enabled'] = false; $warninglist = array(); @@ -86,7 +86,7 @@ class Warninglist extends AppModel{ $data[] = array('value' => $value, 'warninglist_id' => $this->id); } $this->WarninglistEntry->saveMany($data); - + if (!empty($list['matching_attributes'])) { $data = array(); foreach ($list['matching_attributes'] as $type) { @@ -102,7 +102,7 @@ class Warninglist extends AppModel{ return $this->validationErrors; } } - + public function fetchForEventView() { $warninglists = $this->find('all', array('contain' => array('WarninglistType'), 'conditions' => array('enabled' => true))); if (empty($warninglists)) return array(); @@ -120,7 +120,7 @@ class Warninglist extends AppModel{ } return $warninglists; } - + public function setWarnings(&$event, &$warninglists) { if (empty($event['objects'])) return $event; $eventWarnings = array(); @@ -142,7 +142,7 @@ class Warninglist extends AppModel{ $event['Event']['warnings'] = $eventWarnings; return $event; } - + private function __checkValue(&$listValues, $value, $type, $listType) { if (strpos($type, '|')) $value = explode('|', $value); else $value = array($value); @@ -158,7 +158,7 @@ class Warninglist extends AppModel{ } return false; } - + // This requires an IP type attribute in a non CIDR notation format // For the future we can expand this to look for CIDR overlaps? private function __evalCIDRList(&$listValues, $value) { @@ -182,7 +182,7 @@ class Warninglist extends AppModel{ return false; } - + private function __evalCIDR($value, &$listValues, $function) { $found = false; foreach ($listValues as $lv) { @@ -191,7 +191,7 @@ class Warninglist extends AppModel{ if ($found) return true; return false; } - + // using Alnitak's solution from http://stackoverflow.com/questions/594112/matching-an-ip-to-a-cidr-mask-in-php5 private function __ipv4InCidr($ip, $cidr) { list ($subnet, $bits) = explode('/', $cidr); @@ -201,7 +201,7 @@ class Warninglist extends AppModel{ $subnet &= $mask; # nb: in case the supplied subnet wasn't correctly aligned return ($ip & $mask) == $subnet; } - + // using Snifff's solution from http://stackoverflow.com/questions/7951061/matching-ipv6-address-to-a-cidr-subnet private function __ipv6InCidr($ip, $cidr) { $ip = inet_pton($ip); @@ -213,7 +213,7 @@ class Warninglist extends AppModel{ $net_bits = substr($binarynet, 0, $maskbits); return ($ip_net_bits === $net_bits); } - + // converts inet_pton output to string with bits private function __inet_to_bits($inet) { $unpacked = unpack('A16', $inet); @@ -224,7 +224,7 @@ class Warninglist extends AppModel{ } return $binaryip; } - + private function __evalString(&$listValues, $value) { if (in_array($value, $listValues)) return true; return false; diff --git a/app/Model/WarninglistEntry.php b/app/Model/WarninglistEntry.php index 3681d1383..03b00e9c4 100644 --- a/app/Model/WarninglistEntry.php +++ b/app/Model/WarninglistEntry.php @@ -12,7 +12,7 @@ class WarninglistEntry extends AppModel{ 'rule' => array('valueNotEmpty'), ) ); - + public $belongsTo = array( 'Warninglist' => array( 'className' => 'Warninglist', @@ -20,7 +20,7 @@ class WarninglistEntry extends AppModel{ 'counterCache' => true ) ); - + public function beforeValidate($options = array()) { parent::beforeValidate(); return true; diff --git a/app/Model/WarninglistType.php b/app/Model/WarninglistType.php index a763ccdc1..5eae73bb1 100644 --- a/app/Model/WarninglistType.php +++ b/app/Model/WarninglistType.php @@ -12,11 +12,11 @@ class WarninglistType extends AppModel{ 'rule' => array('valueNotEmpty'), ) ); - + public $belongsTo = array( 'Warninglist' ); - + public function beforeValidate($options = array()) { parent::beforeValidate(); return true; diff --git a/app/Model/Whitelist.php b/app/Model/Whitelist.php index 18adb2162..b596c00e8 100644 --- a/app/Model/Whitelist.php +++ b/app/Model/Whitelist.php @@ -121,7 +121,7 @@ class Whitelist extends AppModel { } return $data; } - + // A simplified whitelist removal, for when we just want to throw values against the list instead of attributes / events public function removeWhitelistedValuesFromArray($data) { $whitelists = $this->getBlockedValues(); diff --git a/app/Plugin/SysLogLogable/Model/Behavior/SysLogLogableBehavior.php b/app/Plugin/SysLogLogable/Model/Behavior/SysLogLogableBehavior.php index 35ff9b01f..eca247a12 100644 --- a/app/Plugin/SysLogLogable/Model/Behavior/SysLogLogableBehavior.php +++ b/app/Plugin/SysLogLogable/Model/Behavior/SysLogLogableBehavior.php @@ -138,7 +138,7 @@ class SysLogLogableBehavior extends LogableBehavior { $logData['Log']['version_id'] = $Model->version_id; unset($Model->version_id); } - + if (isset($this->schema[$this->settings[$Model->alias]['userKey']]) && $this->user) { $logData['Log'][$this->settings[$Model->alias]['userKey']] = $this->user[$this->UserModel->alias][$this->UserModel->primaryKey]; } @@ -248,7 +248,7 @@ class SysLogLogableBehavior extends LogableBehavior { $this->Log->create($logData); $this->Log->save(null, array( 'validate' => false)); - + // write to syslogd as well $syslog = new SysLog(); if (isset($logData['Log']['change'])) { @@ -257,15 +257,15 @@ class SysLogLogableBehavior extends LogableBehavior { $syslog->write('notice', $logData['Log']['description']); } } - + function setup(Model $Model, $config = array()) { - + if (!is_array($config)) { $config = array(); } $this->settings[$Model->alias] = array_merge($this->defaults, $config); $this->settings[$Model->alias]['ignore'][] = $Model->primaryKey; - + $this->Log = ClassRegistry::init('Log'); if ($this->settings[$Model->alias]['userModel'] != $Model->alias) { $this->UserModel = ClassRegistry::init($this->settings[$Model->alias]['userModel']); diff --git a/app/Plugin/UrlCache/Lib/Routing/UrlCacheManager.php b/app/Plugin/UrlCache/Lib/Routing/UrlCacheManager.php index d78260c9f..6932000f4 100644 --- a/app/Plugin/UrlCache/Lib/Routing/UrlCacheManager.php +++ b/app/Plugin/UrlCache/Lib/Routing/UrlCacheManager.php @@ -12,40 +12,40 @@ * 2012-02-13 ms */ class UrlCacheManager { - + /** * Holds all generated urls so far by the application indexed by a custom hash * */ public static $cache = array(); - + /** * Holds all generated urls so far by the application indexed by a custom hash * */ public static $cachePage = array(); - + /** * Holds all generated urls so far by the application indexed by a custom hash * */ public static $extras = array(); - + /** * type for the current set (triggered by last get) */ public static $type = 'cache'; - + /** * key for current get/set */ public static $key = null; - + /** * cache key for pageFiles */ public static $cacheKey = 'url_map'; - + /** * cache key for pageFiles */ @@ -80,7 +80,7 @@ class UrlCacheManager { self::$cachePage = Cache::read(self::$cachePageKey, '_cake_core_'); } self::$cache = Cache::read(self::$cacheKey, '_cake_core_'); - + # still old "prefix true/false" syntax? if (Configure::read('UrlCache.verbosePrefixes')) { unset(self::$paramFields[3]); @@ -93,7 +93,7 @@ class UrlCacheManager { } self::$extras = array_merge($defaults, self::$extras); } - + /** * should be called in afterLayout() * @@ -154,5 +154,5 @@ class UrlCacheManager { self::$cache[self::$key] = $data; } } - + } \ No newline at end of file diff --git a/app/View/Attributes/add.ctp b/app/View/Attributes/add.ctp index 6192e39b4..a36d7da22 100644 --- a/app/View/Attributes/add.ctp +++ b/app/View/Attributes/add.ctp @@ -23,11 +23,11 @@ $initialDistribution = Configure::read('MISP.default_attribute_distribution'); } } - + ?>
Form->input('distribution', array( 'options' => array($distributionLevels), 'label' => 'Distribution', @@ -195,7 +195,7 @@ $(document).ready(function() { }).popover('show'); // $('#'+e.currentTarget.id).on('mouseleave', $('#'+e.currentTarget.id).popover('destroy'); //$('#'+e.currentTarget.id).on('mouseout', $('#'+e.currentTarget.id).popover('destroy')); - + }); // workaround for browsers like IE and Chrome that do now have an onmouseover on the 'options' of a select. diff --git a/app/View/Attributes/add_attachment.ctp b/app/View/Attributes/add_attachment.ctp index 2e8db28f2..f7f0947e4 100644 --- a/app/View/Attributes/add_attachment.ctp +++ b/app/View/Attributes/add_attachment.ctp @@ -129,7 +129,7 @@ $(document).ready(function() { if ($('#AttributeDistribution').val() == 4) $('#SGContainer').show(); else $('#SGContainer').hide(); }); - + $("#AttributeCategory, #AttributeDistribution").on('mouseover', function(e) { var $e = $(e.target); if ($e.is('option')) { @@ -141,11 +141,11 @@ $(document).ready(function() { }).popover('show'); } }); - + $("input, label").on('mouseleave', function(e) { $('#'+e.currentTarget.id).popover('destroy'); }); - + $("input, label").on('mouseover', function(e) { var $e = $(e.target); $('#'+e.currentTarget.id).popover('destroy'); @@ -154,7 +154,7 @@ $(document).ready(function() { placement: 'right', }).popover('show'); }); - + // workaround for browsers like IE and Chrome that do now have an onmouseover on the 'options' of a select. // disadvangate is that user needs to click on the item to see the tooltip. // no solutions exist, except to generate the select completely using html. @@ -168,7 +168,7 @@ $(document).ready(function() { }).popover('show'); }); }); - + function malwareCheckboxSetter(id) { idDiv = id+'Div'; var value = $(id).val(); // get the selected value diff --git a/app/View/Attributes/ajax/attributeEditMassForm.ctp b/app/View/Attributes/ajax/attributeEditMassForm.ctp index f8b38b1a4..ad793edf2 100644 --- a/app/View/Attributes/ajax/attributeEditMassForm.ctp +++ b/app/View/Attributes/ajax/attributeEditMassForm.ctp @@ -85,9 +85,9 @@ $(document).ready(function() { if ($('#AttributeDistribution').val() == 4) $('#SGContainer').show(); else $('#SGContainer').hide(); }); - + $('#AttributeAttributeIds').attr('value', getSelected()); - + $("#Attribute, #AttributeDistribution").on('mouseover', function(e) { var $e = $(e.target); if ($e.is('option')) { diff --git a/app/View/Attributes/alternate_search_result.ctp b/app/View/Attributes/alternate_search_result.ctp index 10c104840..dcfac9a95 100644 --- a/app/View/Attributes/alternate_search_result.ctp +++ b/app/View/Attributes/alternate_search_result.ctp @@ -12,7 +12,7 @@ Attribute Count - + diff --git a/app/View/Attributes/attribute_replace.ctp b/app/View/Attributes/attribute_replace.ctp index 83b6af3b7..607d20cf4 100644 --- a/app/View/Attributes/attribute_replace.ctp +++ b/app/View/Attributes/attribute_replace.ctp @@ -94,7 +94,7 @@ foreach ($categoryDefinitions as $category => $def) { echo "formInfoValues['" . addslashes($category) . "'] = \"" . addslashes($info) . "\";\n"; // as we output JS code we need to add slashes } ?> - + $(document).ready(function() { $("#AttributeType, #AttributeCategory").on('mouseover', function(e) { var $e = $(e.target); @@ -144,7 +144,7 @@ $(document).ready(function() { content: formInfoValues[$e.val()], }).popover('show'); }); - + $('#cancel_attribute_add').click(function() { cancelPopoverForm(); }); diff --git a/app/View/Attributes/edit.ctp b/app/View/Attributes/edit.ctp index 0bd3b5121..805960174 100644 --- a/app/View/Attributes/edit.ctp +++ b/app/View/Attributes/edit.ctp @@ -10,11 +10,11 @@ echo $this->Form->input('type', array( 'empty' => '(first choose category)' )); - + ?>
Form->input('distribution', array( 'options' => array($distributionLevels), 'label' => 'Distribution', @@ -121,12 +121,12 @@ foreach ($distributionDescriptions as $type => $def) { ?> $(document).ready(function() { - + $('#AttributeDistribution').change(function() { if ($('#AttributeDistribution').val() == 4) $('#SGContainer').show(); else $('#SGContainer').hide(); }); - + $("#AttributeType, #AttributeCategory, #Attribute, #AttributeDistribution").on('mouseover', function(e) { var $e = $(e.target); if ($e.is('option')) { diff --git a/app/View/Attributes/search.ctp b/app/View/Attributes/search.ctp index a42943db5..977af76bb 100644 --- a/app/View/Attributes/search.ctp +++ b/app/View/Attributes/search.ctp @@ -7,7 +7,7 @@ echo $this->Form->input('keyword', array('type' => 'textarea', 'label' => 'Containing the following expressions', 'div' => 'clear', 'class' => 'input-xxlarge')); echo $this->Form->input('keyword2', array('type' => 'textarea', 'label' => 'Being attributes of the following event IDs or event UUIDs', 'div' => 'clear', 'class' => 'input-xxlarge')); echo $this->Form->input('tags', array('type' => 'textarea', 'label' => 'Being an attribute of an event matching the following tags', 'div' => 'clear', 'class' => 'input-xxlarge')); - + ?> - + $(document).ready(function() { - + $("#AttributeType, #AttributeCategory, #Attribute, #AttributeDistribution").on('mouseover', function(e) { var $e = $(e.target); if ($e.is('option')) { @@ -158,11 +158,11 @@ }).popover('show'); } }); - + $("input, label").on('mouseleave', function(e) { $('#'+e.currentTarget.id).popover('destroy'); }); - + $("input, label").on('mouseover', function(e) { var $e = $(e.target); $('#'+e.currentTarget.id).popover('destroy'); @@ -173,9 +173,9 @@ }).popover('show'); // $('#'+e.currentTarget.id).on('mouseleave', $('#'+e.currentTarget.id).popover('destroy'); //$('#'+e.currentTarget.id).on('mouseout', $('#'+e.currentTarget.id).popover('destroy')); - + }); - + // workaround for browsers like IE and Chrome that do now have an onmouseover on the 'options' of a select. // disadvangate is that user needs to click on the item to see the tooltip. // no solutions exist, except to generate the select completely using html. diff --git a/app/View/Elements/eventdiscussion.ctp b/app/View/Elements/eventdiscussion.ctp index 39f07f9b0..e175c0cf7 100644 --- a/app/View/Elements/eventdiscussion.ctp +++ b/app/View/Elements/eventdiscussion.ctp @@ -11,7 +11,7 @@ 'before' => '$(".loading").show()', 'complete' => '$(".loading").hide()', )); - + echo $this->Paginator->prev('« ' . __('previous'), array('tag' => 'li', 'escape' => false), null, array('tag' => 'li', 'class' => 'prev disabled', 'escape' => false, 'disabledTag' => 'span')); echo $this->Paginator->numbers(array('modulus' => 10, 'separator' => '', 'tag' => 'li', 'currentClass' => 'red', 'currentTag' => 'span')); echo $this->Paginator->next(__('next') . ' »', array('tag' => 'li', 'escape' => false), null, array('tag' => 'li', 'class' => 'next disabled', 'escape' => false, 'disabledTag' => 'span')); @@ -101,7 +101,7 @@ ?> diff --git a/app/View/Elements/global_menu.ctp b/app/View/Elements/global_menu.ctp index 8d0972a3f..eec226b15 100644 --- a/app/View/Elements/global_menu.ctp +++ b/app/View/Elements/global_menu.ctp @@ -216,7 +216,7 @@ window.onresize = resizeLogo; function resizeLogo() { var testElem = document.getElementById('fullLogo'); var topBar = document.getElementById('topBar'); - + if (testElem != null) { if ($(window).width() < 1400) { document.getElementById('fullLogo').style.display='none'; diff --git a/app/View/Elements/healthElements/diagnostics.ctp b/app/View/Elements/healthElements/diagnostics.ctp index d15ce8e95..edbeda6ba 100644 --- a/app/View/Elements/healthElements/diagnostics.ctp +++ b/app/View/Elements/healthElements/diagnostics.ctp @@ -4,7 +4,7 @@
Currently installed version..... Form->end(); endforeach; ?> - +
\ No newline at end of file diff --git a/app/View/Elements/healthElements/workers.ctp b/app/View/Elements/healthElements/workers.ctp index 34c9f9c09..3920c0610 100644 --- a/app/View/Elements/healthElements/workers.ctp +++ b/app/View/Elements/healthElements/workers.ctp @@ -80,7 +80,7 @@ $style = "color:white;background-color:red;"; $icon_modifier = ' icon-white'; } - + $status = 'OK'; ?> @@ -105,7 +105,7 @@ echo $this->Form->end(); endforeach; ?> - + Form->create('Server', array('url' => '/servers/restartWorkers')); diff --git a/app/View/Elements/histogram.ctp b/app/View/Elements/histogram.ctp index 8f2664d75..aa509adc0 100644 --- a/app/View/Elements/histogram.ctp +++ b/app/View/Elements/histogram.ctp @@ -19,7 +19,7 @@ - + diff --git a/app/View/Elements/serverRuleElements/pull.ctp b/app/View/Elements/serverRuleElements/pull.ctp index 1ad245ec1..da6a22de6 100644 --- a/app/View/Elements/serverRuleElements/pull.ctp +++ b/app/View/Elements/serverRuleElements/pull.ctp @@ -54,8 +54,8 @@ - - + +
diff --git a/app/View/Elements/serverRuleElements/push.ctp b/app/View/Elements/serverRuleElements/push.ctp index 2e87cd91f..a70780db8 100644 --- a/app/View/Elements/serverRuleElements/push.ctp +++ b/app/View/Elements/serverRuleElements/push.ctp @@ -58,8 +58,8 @@
- - + + - +   diff --git a/app/files/scripts/misp2cybox.py b/app/files/scripts/misp2cybox.py index d92206aba..e4844fecf 100644 --- a/app/files/scripts/misp2cybox.py +++ b/app/files/scripts/misp2cybox.py @@ -247,7 +247,7 @@ def resolvePatternObservable(indicator, attribute): # elif attribute["type"] == "pattern-in-memory": # elif attribute["type"] == "pattern-in-traffic": return new_object - + # create an artifact object for the malware-sample type. def createArtifactObject(indicator, attribute): artifact = Artifact(data = attribute["data"]) diff --git a/app/webroot/css/main.css b/app/webroot/css/main.css index a3de52058..9e9f2128c 100644 --- a/app/webroot/css/main.css +++ b/app/webroot/css/main.css @@ -33,7 +33,7 @@ h3{ } pre { font-size: 11px; - + } .nav-list { padding-right: 5px; @@ -263,13 +263,13 @@ td.highlight1 { td.highlight2 { background-color: #747170 !important; color: #ffffff !important; - + } td.highlight3 { background-color: red !important; color: #ffffff !important; - + } tr.highlightBlueSides { @@ -334,7 +334,7 @@ td.action-links { } .showspaces { - + } /** Scaffold View **/ @@ -408,7 +408,7 @@ dd { .cake-sql-log td { padding: 4px 8px; text-align: left; - + } .cake-sql-log caption { color:#fff; @@ -575,7 +575,7 @@ dd { top: 0; padding: 4px; } - + .loading { display: none; text-color: #0088cc; @@ -928,7 +928,7 @@ a.proposal_link_red:hover { } .inline-form { - + margin-bottom:0px !important; } @@ -1311,7 +1311,7 @@ a.proposal_link_red:hover { inset 0 10px rgba(255,255,255,0.1), inset 0 10px 20px rgba(255,255,255,0.3), inset 0 -15px 30px rgba(0,0,0,0.3); - + } .addTemplateElement { diff --git a/app/webroot/css/tree.css b/app/webroot/css/tree.css index 95eb4d68d..97f9c88ba 100644 --- a/app/webroot/css/tree.css +++ b/app/webroot/css/tree.css @@ -18,47 +18,47 @@ top: -35px; height: 50px; } - + .distance2::before { top: -85px; height: 100px; } - + .distance3::before { top: -135px; height: 150px; } - + .distance4::before { top: -185px; height: 200px; } - + .distance5::before { top: -235px; height: 250px; } - + .distance6::before { top: -285px; height: 300px; } - + .distance7::before { top: -335px; height: 350px; } - + .distance8::before { top: -385px; height: 400px; } - + .distance9::before { top: -435px; height: 450px; } - + .distance10::before { top: -485px; height: 500px; @@ -93,7 +93,7 @@ padding-top:4px; padding-bottom:2px; width: 105px; - + display: inline-block; border-radius: 7px; -webkit-border-radius: 7px; diff --git a/app/webroot/js/jquery-toc.js b/app/webroot/js/jquery-toc.js index 35e59332a..e7bb98caa 100644 --- a/app/webroot/js/jquery-toc.js +++ b/app/webroot/js/jquery-toc.js @@ -15,7 +15,7 @@ window.onload = function () { $(".toc").append("
    ") // find the new list var TOC = $("ol#toc"); - + // loop over every h2 element on the page // jQuery allows you to use the multiple selector (replace $('h2') // with $('h2,h3')) if you want to loop muliple headings instead. @@ -34,7 +34,7 @@ window.onload = function () { $(".toc").prepend("

    Table of Contents

    ") } /* Copyright (c) 2012 Chris Curran - + Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. diff --git a/app/webroot/js/misp2.4.46.js b/app/webroot/js/misp2.4.46.js index edfb518fd..9cb08e8e5 100644 --- a/app/webroot/js/misp2.4.46.js +++ b/app/webroot/js/misp2.4.46.js @@ -278,7 +278,7 @@ function postActivationScripts(name, type, id, field, event) { submitForm(type, id, field, event); return false; }); - + $(name + '_form').bind("focusout", function() { inputFieldButtonPassive(name + '_field'); }); @@ -286,7 +286,7 @@ function postActivationScripts(name, type, id, field, event) { $(name + '_form').bind("focusin", function(){ inputFieldButtonActive(name + '_field'); }); - + $(name + '_form').bind("keydown", function(e) { if (e.ctrlKey && (e.keyCode == 13 || e.keyCode == 10)) { submitForm(type, id, field, event); @@ -295,7 +295,7 @@ function postActivationScripts(name, type, id, field, event) { $(name + '_field').closest('.inline-input-container').children('.inline-input-accept').bind('click', function() { submitForm(type, id, field, event); }); - + $(name + '_field').closest('.inline-input-container').children('.inline-input-decline').bind('click', function() { resetForms(); }); @@ -556,7 +556,7 @@ function addSelectedTaxonomies(taxonomy) { function submitMassTaxonomyTag() { $('#PromptForm').submit(); - + } function getSelected() { @@ -679,7 +679,7 @@ function submitPopoverForm(context_id, referer, update_context_id) { url = "/attributes/attributeReplace/" + context_id; break; } - + if (url !== null) { $.ajax({ beforeSend: function (XMLHttpRequest) { @@ -1134,7 +1134,7 @@ function templateDeleteFileBubble(filename, tmp_name, element_id, context, batch } $(".loading").hide(); } - + function templateFileUploadTriggerBrowse(id) { $('#upload_' + id + '_file').click(); } @@ -1228,7 +1228,7 @@ function remoteIndexApplyFilters() { var url = actionUrl + '/' + $("#EventFilter").val(); window.location.href = url; } - + function indexApplyFilters() { var url = indexCreateFilters(); window.location.href = url; @@ -1384,7 +1384,7 @@ function indexRuleChange() { if (simpleFilters.indexOf(rule) != -1) { $('#' + context + 'Searchbool').show(); } else $('#' + context + 'Searchbool').hide(); - + $('#addRuleButton').show(); $('#addRuleButton').unbind("click"); $('#addRuleButton').click({param1: rule}, indexAddRule); @@ -1429,7 +1429,7 @@ function restrictEventViewPagination() { start = page-5; end = page+5; } - + if (start > 2) { $("#apage" + start).parent().before("
  1. ...
    2. "); $("#aExpandLeft").click(function() {expandPagination(0, 0); return false;}); @@ -1443,7 +1443,7 @@ function restrictEventViewPagination() { $("#bpage" + end).parent().after("
  2. ...
    3. "); $("#bExpandRight").click(function() {expandPagination(1, 1); return false;}) } - + for (i = 1; i < (count+1); i++) { if (i != 1 && i != count && (i < start || i > end)) { $("#apage" + i).hide(); @@ -1510,7 +1510,7 @@ function serverSettingsPostActivationScripts(name, setting, id) { serverSettingSubmitForm(name, setting, id); return false; }); - + $(name + '_form').bind("focusout", function() { inputFieldButtonPassive(name + '_field'); }); @@ -1518,7 +1518,7 @@ function serverSettingsPostActivationScripts(name, setting, id) { $(name + '_form').bind("focusin", function(){ inputFieldButtonActive(name + '_field'); }); - + $(name + '_form').bind("keydown", function(e) { if (e.ctrlKey && (e.keyCode == 13 || e.keyCode == 10)) { serverSettingSubmitForm(name, setting, id); @@ -1979,7 +1979,7 @@ function serverSubmitForm(action) { }; break; } - + $('#ServerJson').val(JSON.stringify(ajax)); var formName = "#Server" + action + "Form"; $(formName).submit(); diff --git a/tools/example-rest.py b/tools/example-rest.py index 310b2d15f..4a4b752d1 100755 --- a/tools/example-rest.py +++ b/tools/example-rest.py @@ -177,7 +177,7 @@ def index(model) : } ) return response, content - + # Get the content of a specific model entry def view(model, entry_id) : url = base_url + '/'+model+'s/view/'+str(entry_id)
diff --git a/app/View/Elements/side_menu.ctp b/app/View/Elements/side_menu.ctp index 601ba8383..70e3c5c0d 100644 --- a/app/View/Elements/side_menu.ctp +++ b/app/View/Elements/side_menu.ctp @@ -98,7 +98,7 @@
  • Automation
  • Html->link('List Regexp', array('admin' => $isSiteAdmin, 'action' => 'index'));?>
    • @@ -130,7 +130,7 @@
  • Html->link(__('Edit User', true), array('action' => 'edit', $user['User']['id'])); ?>
    • @@ -159,7 +159,7 @@
  • Statistics
  • Html->link('Explore Remote Event', array('controller' => 'servers', 'action' => 'previewEvent', h($server['Server']['id']), h($event['Event']['id']))); ?>
    • @@ -180,7 +180,7 @@
  • Html->link('View User', array('controller' => 'users', 'action' => 'view', 'admin' => true, h($id))); ?>
    • @@ -236,15 +236,15 @@
  • Html->link('List Logs', array('admin' => true, 'action' => 'index'));?>
  • Html->link('Search Logs', array('admin' => true, 'action' => 'search'));?>
  • Html->link('View Thread', array('controller' => 'threads', 'action' => 'view', h($thread_id)));?>
    • @@ -264,7 +264,7 @@
  • New Thread
  • Html->link('List Favourite Tags', array('action' => 'index', true));?>
  • Html->link('List Tags', array('action' => 'index'));?>
    • @@ -278,7 +278,7 @@
  • List Taxonomies
    • @@ -291,7 +291,7 @@
  • List Templates
    • @@ -307,7 +307,7 @@ endif; endif; break; - + case 'feeds': ?>
  • List Feeds
  • Add Feed
    • @@ -319,7 +319,7 @@
  • PreviewEvent
  • View News

    • Description:

    - +
    Type:
     
    - +
    Description @@ -24,7 +24,7 @@  
    - +
    Category @@ -33,7 +33,7 @@  
    - +
    Types @@ -53,7 +53,7 @@ ?> 
    - +
    Mandatory @@ -76,7 +76,7 @@ ?> 
    - +
    IDS @@ -88,7 +88,7 @@ ?> 
    - +
    Actions diff --git a/app/View/Elements/templateElements/templateRowFile.ctp b/app/View/Elements/templateElements/templateRowFile.ctp index 484eb17eb..6698056b6 100644 --- a/app/View/Elements/templateElements/templateRowFile.ctp +++ b/app/View/Elements/templateElements/templateRowFile.ctp @@ -15,7 +15,7 @@  
    - +
    Description @@ -24,7 +24,7 @@  
    - +
    Category diff --git a/app/View/EventDelegations/ajax/delegate_event.ctp b/app/View/EventDelegations/ajax/delegate_event.ctp index 644169ce0..cab754a73 100644 --- a/app/View/EventDelegations/ajax/delegate_event.ctp +++ b/app/View/EventDelegations/ajax/delegate_event.ctp @@ -43,7 +43,7 @@ ?>
    Js->writeBuffer(); // Write cached scripts - + diff --git a/app/View/SharingGroups/add.ctp b/app/View/SharingGroups/add.ctp index b325a56e1..d918f1c47 100644 --- a/app/View/SharingGroups/add.ctp +++ b/app/View/SharingGroups/add.ctp @@ -110,5 +110,5 @@ $('#serverList').hide(); } }); - + diff --git a/app/View/SharingGroups/edit.ctp b/app/View/SharingGroups/edit.ctp index 09a783c63..dbe86cb21 100644 --- a/app/View/SharingGroups/edit.ctp +++ b/app/View/SharingGroups/edit.ctp @@ -105,7 +105,7 @@ var serverids = [0]; serverids.push(); @@ -152,7 +152,7 @@ - + $(function() { if ($('#SharingGroupJson').val()) sharingGroupPopulateFromJson(); sharingGroupPopulateOrganisations(); @@ -165,5 +165,5 @@ $('#serverList').hide(); } }); - + diff --git a/app/View/Tags/ajax/select_tag.ctp b/app/View/Tags/ajax/select_tag.ctp index 365515e16..9ba5cb6a2 100644 --- a/app/View/Tags/ajax/select_tag.ctp +++ b/app/View/Tags/ajax/select_tag.ctp @@ -25,7 +25,7 @@ $(document).ready(function() { resizePopoverBody(); }); - + $(window).resize(function() { resizePopoverBody(); }); diff --git a/app/View/Tags/ajax/taxonomy_choice.ctp b/app/View/Tags/ajax/taxonomy_choice.ctp index 8d46a2b4b..c9f0079f8 100644 --- a/app/View/Tags/ajax/taxonomy_choice.ctp +++ b/app/View/Tags/ajax/taxonomy_choice.ctp @@ -23,7 +23,7 @@ $(document).ready(function() { resizePopoverBody(); }); - + $(window).resize(function() { resizePopoverBody(); }); diff --git a/app/View/Taxonomies/view.ctp b/app/View/Taxonomies/view.ctp index 8e3d68d8d..a3f33c2ec 100644 --- a/app/View/Taxonomies/view.ctp +++ b/app/View/Taxonomies/view.ctp @@ -32,7 +32,7 @@ } } ?> - +   diff --git a/app/View/TemplateElements/ajax/template_element_add_attribute.ctp b/app/View/TemplateElements/ajax/template_element_add_attribute.ctp index 61867bb09..d68fa5084 100644 --- a/app/View/TemplateElements/ajax/template_element_add_attribute.ctp +++ b/app/View/TemplateElements/ajax/template_element_add_attribute.ctp @@ -13,7 +13,7 @@ 'div' => 'input clear', 'class' => 'input-xxlarge' )); - + echo $this->Form->input('description', array( 'type' => 'textarea', 'error' => array('escape' => false), @@ -36,7 +36,7 @@ 'label' => 'Type', 'empty' => 'Select Type' )); - + ?>
    @@ -46,7 +46,7 @@ 'checked' => false, 'label' => 'Use complex types', )); - + ?>
    @@ -109,7 +109,7 @@ var complexTypes = ; var currentTypes = new Array(); var fieldsArray = new Array('TemplateElementAttributeName', 'TemplateElementAttributeDescription', 'TemplateElementAttributeCategory', 'TemplateElementAttributeToIds', 'TemplateElementAttributeMandatory', 'TemplateElementAttributeBatch', 'TemplateElementAttributeType', 'TemplateElementAttributeComplex'); - + $(document).ready(function() { $cat) { @@ -120,7 +120,7 @@ } echo '];'; } - + foreach ($typeGroupCategoryMapping as $k => $mapping) { echo 'typeGroupCategoryMapping["' . $k . '"] = ['; foreach ($mapping as $l => $map) { @@ -131,7 +131,7 @@ } ?> }); - + $("#TemplateElementAttributeCategory").change(function() { var category = $(this).val(); templateElementAttributeCategoryChange(category); diff --git a/app/View/TemplateElements/ajax/template_element_add_file.ctp b/app/View/TemplateElements/ajax/template_element_add_file.ctp index a3fd0cb97..c2921edaf 100644 --- a/app/View/TemplateElements/ajax/template_element_add_file.ctp +++ b/app/View/TemplateElements/ajax/template_element_add_file.ctp @@ -13,7 +13,7 @@ 'div' => 'input clear', 'class' => 'input-xxlarge' )); - + echo $this->Form->input('description', array( 'type' => 'textarea', 'error' => array('escape' => false), @@ -37,7 +37,7 @@ 'checked' => false, 'label' => 'Malware', )); - + ?>
    @@ -96,7 +96,7 @@ ?> templateElementFileCategoryChange($("#TemplateElementFileCategory").val()); }); - + $("#TemplateElementFileCategory").change(function() { var category = $("#TemplateElementFileCategory").val(); templateElementFileCategoryChange(category); diff --git a/app/View/TemplateElements/ajax/template_element_add_text.ctp b/app/View/TemplateElements/ajax/template_element_add_text.ctp index d0377e607..d1d92e554 100644 --- a/app/View/TemplateElements/ajax/template_element_add_text.ctp +++ b/app/View/TemplateElements/ajax/template_element_add_text.ctp @@ -12,7 +12,7 @@ 'div' => 'input clear', 'class' => 'input-xxlarge' )); - + echo $this->Form->input('text', array( 'type' => 'textarea', 'error' => array('escape' => false), diff --git a/app/View/TemplateElements/ajax/template_element_edit_attribute.ctp b/app/View/TemplateElements/ajax/template_element_edit_attribute.ctp index 282411d5f..2ee4f67e4 100644 --- a/app/View/TemplateElements/ajax/template_element_edit_attribute.ctp +++ b/app/View/TemplateElements/ajax/template_element_edit_attribute.ctp @@ -13,7 +13,7 @@ 'div' => 'input clear', 'class' => 'input-xxlarge' )); - + echo $this->Form->input('description', array( 'type' => 'textarea', 'error' => array('escape' => false), @@ -107,7 +107,7 @@ currentTypes = complexTypes[""]['types']; } var fieldsArray = new Array('TemplateElementAttributeName', 'TemplateElementAttributeDescription', 'TemplateElementAttributeCategory', 'TemplateElementAttributeToIds', 'TemplateElementAttributeMandatory', 'TemplateElementAttributeBatch', 'TemplateElementAttributeType', 'TemplateElementAttributeComplex'); - + $(document).ready(function() { $cat) { @@ -118,7 +118,7 @@ } echo '];'; } - + foreach ($typeGroupCategoryMapping as $k => $mapping) { echo 'typeGroupCategoryMapping["' . $k . '"] = ['; foreach ($mapping as $l => $map) { @@ -130,7 +130,7 @@ ?> templateUpdateAvailableTypes(); }); - + $("#TemplateElementAttributeCategory").change(function() { var category = $(this).val(); templateElementAttributeCategoryChange(category); diff --git a/app/View/TemplateElements/ajax/template_element_edit_file.ctp b/app/View/TemplateElements/ajax/template_element_edit_file.ctp index 7a7ae13a7..e4f7707e7 100644 --- a/app/View/TemplateElements/ajax/template_element_edit_file.ctp +++ b/app/View/TemplateElements/ajax/template_element_edit_file.ctp @@ -13,7 +13,7 @@ 'div' => 'input clear', 'class' => 'input-xxlarge' )); - + echo $this->Form->input('description', array( 'type' => 'textarea', 'error' => array('escape' => false), @@ -37,7 +37,7 @@ 'checked' => false, 'label' => 'Malware', )); - + ?>
    @@ -96,7 +96,7 @@ ?> templateElementFileCategoryChange($("#TemplateElementFileCategory").val()); }); - + $("#TemplateElementFileCategory").change(function() { var category = $("#TemplateElementFileCategory").val(); templateElementFileCategoryChange(category); diff --git a/app/View/TemplateElements/ajax/template_element_edit_text.ctp b/app/View/TemplateElements/ajax/template_element_edit_text.ctp index b5ed8d8de..ea6adf032 100644 --- a/app/View/TemplateElements/ajax/template_element_edit_text.ctp +++ b/app/View/TemplateElements/ajax/template_element_edit_text.ctp @@ -12,7 +12,7 @@ 'div' => 'input clear', 'class' => 'input-xxlarge' )); - + echo $this->Form->input('text', array( 'type' => 'textarea', 'error' => array('escape' => false), diff --git a/app/View/Templates/populate_event_from_template.ctp b/app/View/Templates/populate_event_from_template.ctp index 362cb5fc4..1f2b91c0d 100644 --- a/app/View/Templates/populate_event_from_template.ctp +++ b/app/View/Templates/populate_event_from_template.ctp @@ -10,7 +10,7 @@ $first = true; foreach ($templateData['TemplateElement'] as $k => $element) { if ($k != 0 && (($k == count($templateData['TemplateElement'])) || !$first && $element['element_definition'] == 'text')): - + ?> Form->input('disabled', array('label' => 'Disable this user account')); - + ?> 'display:none;width:62px;margin-right:3px', 'div' => false )); - + foreach($differentFilters as $b) { echo $this->Form->input('search' . $b, array( 'options' => array('' => 'Any', '0' => 'No', '1' => 'Yes'), @@ -31,7 +31,7 @@ 'div' => false )); } - + foreach($simpleFilters as $t) { if ($t == 'role') { echo $this->Form->input('search' . $t, array( @@ -133,7 +133,7 @@ var orgs = var allFields = simpleFilters.concat(differentFilters); var baseurl = ""; - + $(document).ready(function() { indexRuleChange(); indexSetTableVisibility(); diff --git a/app/View/Users/ajax/fetchpgpkey.ctp b/app/View/Users/ajax/fetchpgpkey.ctp index a32391798..3266aa77b 100644 --- a/app/View/Users/ajax/fetchpgpkey.ctp +++ b/app/View/Users/ajax/fetchpgpkey.ctp @@ -22,7 +22,7 @@ $(document).ready(function() { resizePopoverBody(); }); - + $(window).resize(function() { resizePopoverBody(); }); diff --git a/app/View/Users/ajax/index.ctp b/app/View/Users/ajax/index.ctp index b3286a6d5..e9aadadd8 100644 --- a/app/View/Users/ajax/index.ctp +++ b/app/View/Users/ajax/index.ctp @@ -42,7 +42,7 @@
    ' class = "icon-list-alt" title = "View"> - +