Merge branch 'develop' of github.com:MISP/MISP into develop

PyMISP

@@ -1 +1 @@
-Subproject commit cd4b5d533b68de19b714be7f83f231640404f0bf
+Subproject commit 962b296f0c2de3366deaf69ce3484187f255f5e0

app/Console/Command/WorkflowShell.php

@@ -59,7 +59,7 @@ class WorkflowShell extends AppShell {
             $for_path,
             $roamingData,
             $concurrentErrors,
-            $walkResult,
+            $walkResult
         );
         $job = $this->Job->read(null, $jobId);
         $job['Job']['progress'] = 100;

app/Controller/AppController.php

@@ -36,7 +36,7 @@ class AppController extends Controller
     public $helpers = array('OrgImg', 'FontAwesome', 'UserName');
 
     private $__queryVersion = '143';
-    public $pyMispVersion = '2.4.159';
+    public $pyMispVersion = '2.4.160';
     public $phpmin = '7.2';
     public $phprec = '7.4';
     public $phptoonew = '8.0';

app/Controller/Component/ACLComponent.php

@@ -99,7 +99,9 @@ class ACLComponent extends Component
             'correlations' => [
                 'generateTopCorrelations' => [],
                 'overCorrelations' => [],
-                'top' => []
+                'switchEngine' => [],
+                'top' => [],
+                'truncate' => []
             ],
             'cryptographicKeys' => [
                 'add' => ['perm_add'],

app/Model/AppModel.php

@@ -137,8 +137,9 @@ class AppModel extends Model
         switch ($command) {
             case '2.4.20':
                 $dbUpdateSuccess = $this->updateDatabase($command);
-                $this->ShadowAttribute = ClassRegistry::init('ShadowAttribute');
-                $this->ShadowAttribute->upgradeToProposalCorrelation();
+                //deprecated
+                //$this->ShadowAttribute = ClassRegistry::init('ShadowAttribute');
+                //$this->ShadowAttribute->upgradeToProposalCorrelation();
                 break;
             case '2.4.25':
                 $dbUpdateSuccess = $this->updateDatabase($command);

app/Model/CorrelationValue.php

@@ -25,8 +25,17 @@ class CorrelationValue extends AppModel
         ]);
         if (empty($existingValue)) {
             $this->create();
-            if ($this->save(['value' => $value])) {
+            try {
+                $this->save(['value' => $value]);
                 return $this->id;
+            } catch (Exception $e) {
+                $existingValue = $this->find('first', [
+                    'recursive' => -1,
+                    'conditions' => [
+                        'value' => $value
+                    ]
+                ]);
+                return $existingValue['ExistingValue']['id'];
             }
         } else {
             return $existingValue['CorrelationValue']['id'];

app/Model/MispObject.php

@@ -304,7 +304,7 @@ class MispObject extends AppModel
             $object = $this->data['Object'];
             $this->Attribute->Correlation->updateContainedCorrelations($object, 'object');
         }
-        if ($this->data['Object']['deleted']) {
+        if (!empty($this->data['Object']['deleted']) && !$created) {
             $attributes_to_delete = $this->Attribute->find('all', [
                 'recursive' => -1,
                 'conditions' => [

app/Model/ShadowAttribute.php

@@ -190,7 +190,8 @@ class ShadowAttribute extends AppModel
             $this->data['ShadowAttribute']['deleted'] = 0;
         }
         if ($this->data['ShadowAttribute']['deleted']) {
-            $this->__beforeDeleteCorrelation($this->data['ShadowAttribute']);
+            // correlations for proposals are deprecated.
+            //$this->__beforeDeleteCorrelation($this->data['ShadowAttribute']);
         }
 
         // convert into utc and micro sec
@@ -277,12 +278,15 @@ class ShadowAttribute extends AppModel
                 $result = $result && $this->saveBase64EncodedAttachment($this->data['ShadowAttribute']);
             }
         }
+        /*
+         * correlations are deprecated for proposals
         if ((isset($this->data['ShadowAttribute']['deleted']) && $this->data['ShadowAttribute']['deleted']) || (isset($this->data['ShadowAttribute']['proposal_to_delete']) && $this->data['ShadowAttribute']['proposal_to_delete'])) {
             // this is a deletion
             // Could be a proposal to delete or flagging a proposal that it was discarded / accepted - either way, we don't want to correlate here for now
         } else {
             $this->__afterSaveCorrelation($this->data['ShadowAttribute']);
         }
+        */
         if (empty($this->data['ShadowAttribute']['deleted'])) {
             $action = $created ? 'add' : 'edit';
             $this->publishKafkaNotification('shadow_attribute', $this->data, $action);

app/View/Workflows/index.ctp

@@ -27,7 +27,7 @@
             'function' => function ($row) use ($baseurl) {
                 return implode('<br />', array_map(function($trigger) use ($baseurl) {
                         return sprintf('<a href="%s/workflows/moduleView/%s" %s><i class="fa-fw %s"></i> %s</a>',
-                            $baseurl,
+                            h($baseurl),
                             h($trigger['id']),
                             !empty($trigger['disabled']) ? sprintf('class="%s" style="%s" title="%s"', 'muted', 'text-decoration: line-through;', __('Trigger disabled')) : '',
                             $this->FontAwesome->getClass($trigger['icon']),

app/View/Workflows/module_index.ctp

@@ -81,7 +81,7 @@
         echo sprintf('<div class="alert alert-error"><strong>%s</strong> %s<div>%s</div></div>',
             __('MISP Modules Action Services is not reachable!'),
             __('Some modules will not be available.'),
-            __('Make sure the %s %s is enabled and the action service is reachable.', sprintf('<a href="%s">%s</a>', $baseurl . '/servers/serverSettings/Plugin',  __('setting')), sprintf('<code>%s</code>', 'Plugin.Action_services_enable')),
+            __('Make sure the %s %s is enabled and the action service is reachable.', sprintf('<a href="%s">%s</a>', $baseurl . '/servers/serverSettings/Plugin',  __('setting')), sprintf('<code>%s</code>', 'Plugin.Action_services_enable'))
         );
     }
     if (!empty($errorWhileLoading)) {