MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

security: [feeds] Hide headers for non-site admin users

pull/7369/head
mokaddem 2021-04-23 12:07:01 +02:00
parent bcf128c442
commit bc2c58abe9
No known key found for this signature in database
GPG Key ID: 164C473F627A06FA
3 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
app/Controller/Component/ACLComponent.php
View File

@ -296,7 +296,10 @@ class ACLComponent extends Component
'perm_site_admin',
]],
'toggleSelected' => array('perm_site_admin'),
'view' => array('*'),
'view' => ['OR' => [
'host_org_user',
'perm_site_admin',
]],
),
'galaxies' => array(
'attachCluster' => array('perm_tagger'),

8
app/Controller/FeedsController.php
View File

@ -95,6 +95,11 @@ class FeedsController extends AppController
} else {
$data = $this->paginate();
}
foreach ($data as $i => $entry) {
if (!$this->_isSiteAdmin()) {
unset($data[$i]['Feed']['headers']);
}
}
$this->loadModel('Event');
foreach ($data as $key => $value) {
if ($value['Feed']['event_id'] != 0 && $value['Feed']['fixed_event']) {
@ -130,6 +135,9 @@ class FeedsController extends AppController
'recursive' => -1,
'contain' => array('Tag')
));
if (!$this->_isSiteAdmin()) {
unset($feed['Feed']['headers']);
}
$feed['Feed']['cached_elements'] = $this->Feed->getCachedElements($feed['Feed']['id']);
$feed['Feed']['coverage_by_other_feeds'] = $this->Feed->getFeedCoverage($feed['Feed']['id'], 'feed', 'all') . '%';
if ($this->_isRest()) {

3
app/View/Feeds/index.ctp
View File

@ -144,7 +144,8 @@
array(
'name' => __('Headers'),
'class' => 'shortish',
'data_path' => 'Feed.headers'
'data_path' => 'Feed.headers',
'requirement' => $isSiteAdmin
),
array(
'name' => __('Target'),