MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

Filter logic reworked 

- Affects org and info field

- terms have to be saparated by pipe (|) 

- terms can be terms that will be OR-d or excluded terms that will be
AND-ed

- to exclude a term use !

- A valid filter search for info would be: 'term1|term2|!term3'
-> this would result in all events with the info field containing term1
or term2 but not term3
pull/217/head
iglocska 2013-06-24 11:22:06 +02:00
parent 997dea0acf
commit f430176ddf
1 changed files with 20 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
app/Controller/EventsController.php
View File

@ -120,12 +120,28 @@ class EventsController extends AppController {
case 'org' :
if (!$v) continue 2;
// if the first character is '!', search for NOT LIKE the rest of the string (excluding the '!' itself of course)
if ($v[0] == '!') {
$this->paginate['conditions'][] = array('Event.orgc' . ' NOT LIKE' => '%' . substr($v, 1) . '%');
} else {
$this->paginate['conditions'][] = array('Event.orgc' . ' LIKE' => '%' . $v . '%');
$pieces = explode('|', $v);
foreach ($pieces as $piece) {
if ($piece[0] == '!') {
$this->paginate['conditions']['AND'][] = array('Event.orgc' . ' NOT LIKE' => '%' . substr($piece, 1) . '%');
} else {
$this->paginate['conditions']['AND']['OR'][] = array('Event.orgc' . ' LIKE' => '%' . $piece . '%');
}
}
break;
case 'info' :
if (!$v) continue 2;
// if the first character is '!', search for NOT LIKE the rest of the string (excluding the '!' itself of course)
$pieces = explode('|', $v);
foreach ($pieces as $piece) {
if ($piece[0] == '!') {
$this->paginate['conditions']['AND'][] = array('Event.info' . ' NOT LIKE' => '%' . substr($piece, 1) . '%');
} else {
$this->paginate['conditions']['AND']['OR'][] = array('Event.info' . ' LIKE' => '%' . $piece . '%');
}
}
break;
break;
default:
if (!$v) continue 2;
$this->paginate['conditions'][] = array('Event.' . substr($k, 6) . ' LIKE' => '%' . $v . '%');