From 9c5bc7ead9e4895183ee2500277c69a49961055c Mon Sep 17 00:00:00 2001
From: Jakub Onderka <jakub.onderka@gmail.com>
Date: Tue, 14 Sep 2021 13:20:05 +0200
Subject: [PATCH] chg: [UI] Disable correlation checkbox for non correlating
 types

---
 app/Controller/AttributesController.php       | 12 ++--
 app/View/Attributes/add.ctp                   | 56 ++++++++++---------
 .../Elements/Events/View/row_attribute.ctp    | 10 +++-
 .../IndexTable/Fields/correlate.ctp           | 17 +++---
 app/webroot/js/misp.js                        | 22 ++++++--
 5 files changed, 70 insertions(+), 47 deletions(-)

diff --git a/app/Controller/AttributesController.php b/app/Controller/AttributesController.php
index e3366be79..248357328 100644
--- a/app/Controller/AttributesController.php
+++ b/app/Controller/AttributesController.php
@@ -270,10 +270,6 @@ class AttributesController extends AppController
         $categories = array_keys($this->Attribute->categoryDefinitions);
         $categories = $this->_arrayToValuesIndexArray($categories);
         $this->set('categories', $categories);
-
-        $this->loadModel('Noticelist');
-        $notice_list_triggers = $this->Noticelist->getTriggerData();
-        $this->set('notice_list_triggers', json_encode($notice_list_triggers));
         $this->__common();
         $this->set('title_for_layout', __('Add attribute'));
         $this->set('typeDefinitions', $this->Attribute->typeDefinitions);
@@ -483,6 +479,11 @@ class AttributesController extends AppController
         $this->set('distributionLevels', $distributionData['levels']);
         $this->set('initialDistribution', $distributionData['initial']);
         $this->set('fieldDesc', $this->__fieldDesc());
+        $this->set('nonCorrelatingTypes', Attribute::NON_CORRELATING_TYPES);
+
+        $this->loadModel('Noticelist');
+        $notice_list_triggers = $this->Noticelist->getTriggerData();
+        $this->set('notice_list_triggers', json_encode($notice_list_triggers));
     }
 
     /**
@@ -870,9 +871,6 @@ class AttributesController extends AppController
         $this->set('categories', $categories);
         $this->set('categoryDefinitions', $categoryDefinitions);
         $this->set('action', $this->action);
-        $this->loadModel('Noticelist');
-        $notice_list_triggers = $this->Noticelist->getTriggerData();
-        $this->set('notice_list_triggers', json_encode($notice_list_triggers));
         $this->render('add');
     }
 
diff --git a/app/View/Attributes/add.ctp b/app/View/Attributes/add.ctp
index f6cf8e80e..288dd0387 100644
--- a/app/View/Attributes/add.ctp
+++ b/app/View/Attributes/add.ctp
@@ -97,30 +97,13 @@
         echo $this->element('/genericElements/SideMenu/side_menu', array('menuList' => 'event', 'menuItem' => 'addAttribute', 'event' => $event));
     }
 ?>
-
-<script type="text/javascript">
+<script>
+    var non_correlating_types = <?= json_encode($nonCorrelatingTypes) ?>;
     var notice_list_triggers = <?php echo $notice_list_triggers; ?>;
     var category_type_mapping = <?= json_encode(array_map(function(array $value) {
         return $value['types'];
     }, $categoryDefinitions)); ?>;
 
-    $('#AttributeDistribution').change(function() {
-        checkSharingGroup('Attribute');
-    });
-
-    $('#AttributeCategory').change(function() {
-        formCategoryChanged('Attribute');
-        $('#AttributeType').chosen('destroy').chosen();
-        if ($(this).val() === 'Internal reference') {
-            $("#AttributeDistribution").val('0');
-            checkSharingGroup('Attribute');
-        }
-    });
-
-    $("#AttributeCategory, #AttributeType").change(function() {
-        checkNoticeList('attribute');
-    });
-
     $(function() {
         <?php
             if ($action == 'edit'):
@@ -131,8 +114,31 @@
         ?>
         checkSharingGroup('Attribute');
 
-        $('#AttributeType').closest('form').submit(function( event ) {
-            if ($('#AttributeType').val() === 'datetime') {
+        var $attributeType = $('#AttributeType');
+        var $attributeCategory = $('#AttributeCategory');
+
+        $('#AttributeDistribution').change(function() {
+            checkSharingGroup('Attribute');
+        });
+
+        $attributeCategory.change(function() {
+            formCategoryChanged('Attribute');
+            $attributeType.trigger('chosen:updated');
+            if ($(this).val() === 'Internal reference') {
+                $("#AttributeDistribution").val('0');
+                checkSharingGroup('Attribute');
+            }
+            checkNoticeList('attribute');
+        });
+
+        $attributeType.change(function () {
+            formTypeChanged('Attribute');
+            checkNoticeList('attribute');
+        });
+        formTypeChanged('Attribute');
+
+        $attributeType.closest('form').submit(function( event ) {
+            if ($attributeType.val() === 'datetime') {
                 // add timezone of the browser if not set
                 var allowLocalTZ = true;
                 var $valueInput = $('#AttributeValue')
@@ -157,12 +163,12 @@
         });
 
         <?php if (!$ajax): ?>
-            $('#AttributeType').chosen();
-            $('#AttributeCategory').chosen();
+            $attributeType.chosen();
+            $attributeCategory.chosen();
         <?php else: ?>
             $('#genericModal').on('shown', function() {
-                $('#AttributeType').chosen();
-                $('#AttributeCategory').chosen();
+                $attributeType.chosen();
+                $attributeCategory.chosen();
             })
         <?php endif; ?>
     });
diff --git a/app/View/Elements/Events/View/row_attribute.ctp b/app/View/Elements/Events/View/row_attribute.ctp
index 7dc2cbf47..177678146 100644
--- a/app/View/Elements/Events/View/row_attribute.ctp
+++ b/app/View/Elements/Events/View/row_attribute.ctp
@@ -33,6 +33,12 @@ if (!empty($k)) {
 
 $objectId = (int) $object['id'];
 
+$isNonCorrelatingType = in_array($object['type'], Attribute::NON_CORRELATING_TYPES, true);
+$correlationDisabled = $object['disable_correlation'] || $isNonCorrelatingType;
+$correlationButtonEnabled = $mayChangeCorrelation &&
+    empty($event['Event']['disable_correlation']) &&
+    !$isNonCorrelatingType;
+
 $quickEdit = function($fieldName) use ($mayModify, $object) {
     if (!$mayModify) {
         return ''; // currently it is not supported to create proposals trough quick edit
@@ -173,8 +179,8 @@ $quickEdit = function($fieldName) use ($mayModify, $object) {
         title="<?php echo __('Toggle correlation');?>"
         type="checkbox"
         <?php
-          echo $object['disable_correlation'] ? '' : ' checked';
-          echo ($mayChangeCorrelation && empty($event['Event']['disable_correlation'])) ? '' : ' disabled';
+          echo $correlationDisabled ? '' : ' checked';
+          echo $correlationButtonEnabled ? '' : ' disabled';
         ?>
       >
     </td>
diff --git a/app/View/Elements/genericElements/IndexTable/Fields/correlate.ctp b/app/View/Elements/genericElements/IndexTable/Fields/correlate.ctp
index 640c34b85..076204be9 100644
--- a/app/View/Elements/genericElements/IndexTable/Fields/correlate.ctp
+++ b/app/View/Elements/genericElements/IndexTable/Fields/correlate.ctp
@@ -1,22 +1,25 @@
 <?php
 
 $object = Hash::extract($row, $field['data']['object']['value_path']);
-$event = Hash::extract($row, 'Event');
+$event = $row['Event'];
 $mayModify = ($isSiteAdmin || ($isAclModify && $event['user_id'] == $me['id'] && $event['orgc_id'] == $me['org_id']) || ($isAclModifyOrg && $event['orgc_id'] == $me['org_id']));
 $mayChangeCorrelation = !Configure::read('MISP.completely_disable_correlation') && ($isSiteAdmin || ($mayModify && Configure::read('MISP.allow_disabling_correlation')));
-$objectId = h($object['id']);
+$objectId = intval($object['id']);
 
+$isNonCorrelatingType = in_array($object['type'], Attribute::NON_CORRELATING_TYPES, true);
+$correlationDisabled = $object['disable_correlation'] || $isNonCorrelatingType;
+$correlationButtonEnabled = $mayChangeCorrelation &&
+    empty($event['disable_correlation']) &&
+    !$isNonCorrelatingType;
 ?>
-
 <input
     id="correlation_toggle_<?= $objectId ?>"
     class="correlation-toggle"
     aria-label="<?php echo __('Toggle correlation');?>"
     title="<?php echo __('Toggle correlation');?>"
     type="checkbox"
-    data-attribute-id="<?= $objectId ?>"
     <?php
-        echo $object['disable_correlation'] ? '' : ' checked';
-        echo ($mayChangeCorrelation && empty($event['disable_correlation'])) ? '' : ' disabled';
+        echo $correlationDisabled ? '' : ' checked';
+        echo $correlationButtonEnabled ? '' : ' disabled';
     ?>
-/>
\ No newline at end of file
+>
diff --git a/app/webroot/js/misp.js b/app/webroot/js/misp.js
index 15c66a033..bba0df6ea 100644
--- a/app/webroot/js/misp.js
+++ b/app/webroot/js/misp.js
@@ -4035,7 +4035,8 @@ function formCategoryChanged(id) {
     if (selectedCategory === "") { // if no category is selected, insert all attribute types
         optionsToPush = {};
         for (var category in category_type_mapping) {
-            for (var type in category_type_mapping[category]) {
+            for (var index in category_type_mapping[category]) {
+                var type = category_type_mapping[category][index];
                 optionsToPush[type] = type;
             }
         }
@@ -4054,6 +4055,15 @@ function formCategoryChanged(id) {
     $type.prop('disabled', false);
 }
 
+function formTypeChanged(idPrefix) {
+    var $type = $('#' + idPrefix + 'Type');
+    var currentType = $type.val();
+
+    // Check if current type is correlatable and disable checkbox if yes
+    var nonCorrelatingType = non_correlating_types.indexOf(currentType) !== -1;
+    $('#' + idPrefix + 'DisableCorrelation').prop('disabled', nonCorrelatingType);
+}
+
 function malwareCheckboxSetter(context) {
     var value = $("#" + context + "Category").val();  // get the selected value
     // set the malware checkbox if the category is in the zip types
@@ -4559,16 +4569,16 @@ function checkNoticeList(type) {
     var fields_to_check = {
         "attribute": ["category", "type"]
     }
-    var warnings = [];
-    $('#notice_message').html('<h4>Notices:</h4>');
-    $('#notice_message').hide();
+    var $noticeMessage = $('#notice_message');
+    $noticeMessage.html('<h4>Notices:</h4>');
+    $noticeMessage.hide();
     fields_to_check[type].forEach(function(field_name) {
         if (field_name in notice_list_triggers) {
             var field_value = $('#' + type.ucfirst() + field_name.ucfirst()).val();
             if (field_value in notice_list_triggers[field_name]) {
                 notice_list_triggers[field_name][field_value].forEach(function(notice) {
-                    $('#notice_message').show();
-                    $('#notice_message').append(
+                    $noticeMessage.show();
+                    $noticeMessage.append(
                         $('<div/>')
                             .append($('<span/>').text('['))
                             .append($('<a/>', {href: baseurl + '/noticelists/view/' + notice['list_id'], class:'bold'}).text(notice['list_name']))