MISP
/
MISP
mirror of https://github.com/MISP/MISP
2
2
Fork 0
Code Issues Releases Wiki Activity

new: [event:index] Added support of ANDed tag filtering in the backend 

In addition of the OR filtering using searchtag:1|2, /events/index now supports AND filtering with searchtag:1&2.
The UI has not been updated yet.
pull/9677/head
Sami Mokaddem 2024-04-08 15:38:29 +02:00
parent c4c395af31
commit fc92291092
No known key found for this signature in database
GPG Key ID: 164C473F627A06FA
1 changed files with 18 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
app/Controller/EventsController.php
View File

@ -497,6 +497,11 @@ class EventsController extends AppController
continue 2; continue 2;
} }
$pieces = is_array($v) ? $v : explode('|', $v); $pieces = is_array($v) ? $v : explode('|', $v);
$isANDed = false;
if (count($pieces) == 1 && strpos($pieces[0], '&') !== -1) {
$pieces = explode('&', $v);
$isANDed = count($pieces) > 1;
}
$filterString = ""; $filterString = "";
$expectOR = false; $expectOR = false;
$tagRules = []; $tagRules = [];
@ -563,10 +568,19 @@ class EventsController extends AppController
} }
if (!empty($tagRules['include'])) { if (!empty($tagRules['include'])) {
if ($isANDed) {
$include = $this->Event->EventTag->find('column', array(
'conditions' => ['EventTag.tag_id' => $tagRules['include']],
'fields' => ['EventTag.event_id'],
'group' => ['EventTag.event_id'],
'having' => ['COUNT(*) =' => count($tagRules['include'])],
));
} else {
$include = $this->Event->EventTag->find('column', array( $include = $this->Event->EventTag->find('column', array(
'conditions' => array('EventTag.tag_id' => $tagRules['include']), 'conditions' => array('EventTag.tag_id' => $tagRules['include']),
'fields' => ['EventTag.event_id'], 'fields' => ['EventTag.event_id'],
)); ));
}
if (!empty($include)) { if (!empty($include)) {
$this->paginate['conditions']['AND'][] = 'Event.id IN (' . implode(",", $include) . ')'; $this->paginate['conditions']['AND'][] = 'Event.id IN (' . implode(",", $include) . ')';
} else { } else {