Commit Graph

155 Commits (4fea371c4b417e6eac5cdefe0baf77840f5752a1)

Author SHA1 Message Date
iglocska d0b441132b Fix to the capitalisation in the user index filter and fix to the scripts tmp folder not being created on git clone 2014-10-24 14:17:58 +02:00
iglocska b7da6019f1 Further work on the manual, fix to the user filter 2014-10-23 14:09:50 +02:00
iglocska 08b2db6895 Small permission change 2014-08-20 10:10:31 +02:00
iglocska 0fd92e6f50 Index filtering made more generic, added to users 2014-08-20 10:06:43 +02:00
iglocska 90a5832638 Performance 2014-08-06 13:40:23 +02:00
iglocska 14976bd7bb Ajaxification of the event page done also, replaced histogram in memberslist
- AJAX requests now also respond with a small message at the bottom of the page, notifying the user of the result
- The following actions work now on the event page via ajax:

1. Add / remove tags
2. quick edit any attribute field if eligible
3. quickly create a proposal of any attribute field if not eligible to edit
4. popover attribute creation (also works with batch add)
5. popover proposal creation (also works with batch add)
6. delete attributes
7. accept/discard proposals
8. mass edit / delete attributes

Also, replaced the old memberslist, with a small lightweight css/js based one.
2014-05-02 14:29:15 +02:00
iglocska 19302aca4f Thread count now correctly displayed in the statistics
- Viewing an event without a discussion thread creates an empty thread in preparation of future posts - these empty threads should not count as active threads though.
2014-02-14 10:19:57 +01:00
iglocska 16f1072120 Statistics changes
- remove actions such as login, logout, changepw
- fixed range so that a addinga a massive event doesn't make every other day seem less active
2014-02-12 17:17:15 +01:00
iglocska 3b8f9b9e2b Removal of obsolete stuff
- taking out the trash
2014-02-11 17:39:16 +01:00
iglocska 07c4536932 Fixed various things
- logging of event publishing enabled for background jobs
- disabled a gpg debug mode that was enabled by accident
- better feedback for publishing
2014-02-10 00:29:46 +01:00
iglocska 6bf1063a66 Small fixes 2014-02-06 09:59:41 +01:00
iglocska 22c8105f58 Mass replace replace of the old CyDefSig name to MISP - fixes #82 2014-02-05 15:01:26 +01:00
iglocska f51d61f8f9 Various changes
- contributors shown on the event view (list of the organisation logos of users that have contributed through proposals)
- these link to the event history containing only entries from their organisation

- changes to the activity heatmap
- heatmap now dynamically changes the range on the graph based on the obtained values
- performance improved
- buttons to move back or forward in time on the calendar

- Attributes:
- warning for the user if he/she has selected the attribute category "targeting-data" or "attribution" as these could contain classified information
- UI improvements across most attribute and shadowattribute input views

- Updated cal-heatmap to the newest version
2014-02-05 13:45:18 +01:00
iglocska 7545de6a6c Changes to the admin methods
- cleaned up the methods, they all now return results without debug mode enabled
- Added a verification method for all user GPG keys (as an expired key for example would send out empty messages)
2014-01-21 11:28:18 +01:00
iglocska 65753a096a Some minor changes
- Statistics page has gotten a lot of extra information
- Removed some old junk files
- Made the size of the graph in the memberslist larger to fit all the new attribute types
2014-01-09 17:13:07 +01:00
iglocska ba4e136ace First version of the new statistics page
- shows a heatmap of user activity based on the logs
- can show it for all users or for users of a specific org
2014-01-09 10:04:53 +01:00
iglocska d54793ffe6 Most of the export caching done
- also a fair bit of refactoring of the code, fatter models, thinner controllers, component moved to Lib
2013-11-15 15:39:34 +01:00
iglocska 1c3425fc91 Merge branch 'develop' into feature/CakeResque
- develop and the first CakeResque implementation merged

Conflicts:
	app/View/Layouts/default.ctp
2013-11-06 11:02:23 +01:00
iglocska 0f80145c6d :q 2013-11-06 10:52:18 +01:00
iglocska 0591db2a67 Small changes after merging the two feature branches
- Update to the representation of the new permission flags

- some small issues with the merge resolved
2013-10-25 11:31:35 +02:00
iglocska 2b11a78e22 Merge branch 'feature/roleChanges' into feature/XML_and_UI
Conflicts:
	app/Controller/UsersController.php
	app/View/Regexp/admin_add.ctp
	app/View/Regexp/admin_edit.ctp
	app/View/Regexp/admin_index.ctp
	app/View/Roles/admin_add.ctp
	app/View/Servers/add.ctp
	app/View/Servers/edit.ctp
	app/View/Servers/index.ctp
	app/View/Servers/pull.ctp
	app/View/Servers/push.ctp
2013-10-25 10:39:18 +02:00
iglocska 3c58e0071a Further work on the UI
- reworked almost all of the side menues to be centralised

- Some fixes for the IOC export not handling two new-ish types correctly

- Some changes to the menues (including a few options that didn't exist before)

- rework of the popovers in some forms
2013-10-24 16:41:42 +02:00
iglocska d27ddee207 First rework of the siteadmin role
- ADMIN org removed.

- Siteadmins are now identified by the perm_site_admin flag

- Siteadmins can now be of any organisation

- editing the regexp / whitelist rules can now be done by a special user with the perm_regexp_access in his/her role

- Executing a mass replace of attribute values based on the regexp rules cannot be initiated by a regexp/whitelist user, only by a site admin

- If the login page is reached without any users / roles defined they are automatically created (perviously it was only the user that was created)

- Org admins are restricted from assigning perm_site_admin, perm_sync and perm_regexp_access roles to users. This can only be done by a site admin.
2013-10-03 11:45:27 +02:00
iglocska 4056e163c1 Users weren't able to change the contactalert field 2013-08-20 11:26:24 +02:00
iglocska 8bf54e7c01 Removed password creation for new users through the contact users menu 2013-07-25 17:23:52 +02:00
iglocska 96170dae29 Fixed an issue with siteadmin contact e-mails resetting passwords of non existing users
- a site admin could issue a password reset to a non-existing user
2013-07-25 14:45:34 +02:00
Christophe Vandeplas bd61f73bd2 fixed a newly created bug in memberslist 2013-07-18 12:18:10 +02:00
iglocska 7486f478e0 Merge branch 'develop' of https://github.com/MISP/MISP into develop 2013-07-18 11:33:11 +02:00
iglocska 7fb1e6f70e Some bugs fixed
- Resetting the auth key for a user that doesn't exist created an empty
user 

- change_pw showed an admin menu on the side

- rerouting after an incorrect auth request fixed (users/index doesn't
exist)

- temporarily disabled the redirect after login
2013-07-18 11:32:26 +02:00
Christophe Vandeplas 4bca5b9e30 memberslist based on orgc, is more logic to reflect the contributions 2013-07-18 11:14:11 +02:00
iglocska 1f5aa5420f Security issue fixed with UsersController
- users could view other user profiles

- users could view other user profiles through edit user
2013-07-15 16:46:44 +02:00
Christophe Vandeplas ff2f08f60d fixes bug in previous commit. 2013-07-11 14:28:12 +02:00
Christophe Vandeplas 7949181fbc improved password generation algorithm in reset password 2013-07-11 14:26:28 +02:00
iglocska 17b570ec1f Typo in UsersController fixed 2013-06-11 10:37:56 +02:00
Christophe Vandeplas 213290961b force passwd change for admin user on creation 2013-06-04 13:22:05 +02:00
Christophe Vandeplas 38897d9af3 create default admin user automatically 2013-06-04 13:06:57 +02:00
Christophe Vandeplas 69251490ef Merge branch 'feature/gui' of https://github.com/MISP/MISP into
feature/gui

Conflicts:
	app/View/Logs/admin_index.ctp
	app/View/Logs/admin_search.ctp
	app/View/Users/memberslist.ctp
2013-05-31 17:50:00 +02:00
Iglocska 254936b28c Date issue when adding a user
- the date for a new user was not set and defaulted to 0000-00-00 - this
caused an issue when the user was edited and the admin was either
prompted to change the date manually or the date was set to 2033. 

- date for newsread is now initially set to 2000-01-01
2013-05-13 15:37:42 +02:00
Andras Iklody eeaa071024 Removal of the remains of the old authorization / adding new ones where
needed
2013-04-26 14:43:44 +02:00
Andras Iklody 4396cec8ea Integrated ownership, ACL and minor fixes
- Orgs can propose new attributes or changes to existing attributes for
  events that they do not own

- publishing users of the owner organisation can see, accept or discard
  them

- Reworked the access control

- minor fixes
2013-04-25 14:04:08 +02:00
Christophe Vandeplas d11422831e fix sanitization in Users #96 2013-04-24 13:06:35 +02:00
iglocska e7a7ea8824 Small error 2013-03-25 17:12:10 +01:00
iglocska 745581d38e Small bug
- Messages left empty for all but the first user in a mass custom e-mail
- fixed.
2013-03-25 17:07:56 +01:00
iglocska 4aa2bf748b Small message notifying the admin that the e-mail was sent
- flash message after e-mail sent
2013-03-25 16:52:59 +01:00
iglocska b28e884eb0 Debug exception left in
- removed
2013-03-25 16:50:26 +01:00
iglocska 0a06ceed3b E-mailing system for site-admins
- site admins able to contact users by e-mail from within the system
- PGP encrypted where available
- Password reset with automatic temporary key generation
- all of the above options have a mass-email version where every user is
  contacted at once
- Potential new users can be contacted too (GPG key can be supplied)
2013-03-25 16:38:56 +01:00
Andras Iklody afed0f2046 Changes to link validation and minor fixes
- Links get validated now to filter malicios code

- removed a double edit button in the case of an admin editing himself

- fixed an error with adding new attributes
2013-02-11 11:26:34 +01:00
Andras Iklody e88a3a9cf7 Updates to security
- perm_auth new toggle, can disable auth key usage for a role

- prevents sync / rest with a perm_auth == false key

- some changes to sync to provide better feedback on why it failed

- rewording of distribution options
2013-02-06 17:45:43 +01:00
Andras Iklody 6ef3ea7050 Missing file from the last commit
Missed a file from the package
2013-02-05 09:21:29 +01:00
Andras Iklody 66b9969d29 Security for UsersController
org admins could edit users of other orgs by accessing the edit page
through the URL. Fixed.
2013-01-29 10:51:18 +01:00
Andras Iklody 97f56a2275 Further changes to org admins
org admins can manage their own server connections
org admins cannot see other orgs' users in the users list
2013-01-29 08:56:38 +01:00
Noud de Brouwer 4c83ad3cfe coding standards
Coding Standards.
2013-01-28 08:42:20 +00:00
Noud de Brouwer a6371f5ad8 coding standards
Coding Standards.
2013-01-28 08:32:01 +00:00
Andras Iklody 9739cd1e35 Fix for the org admin privileges
Editing / creating users and the organisation permissions for org admins
2013-01-25 12:22:55 +01:00
Noud de Brouwer d6adb11f52 RBAC
only create users within own organisation.
2013-01-25 07:52:32 +00:00
deresz b1b47bc56f Better fix to Sanitize::clean() problem
'escape' option was removed.
2013-01-24 10:38:51 +01:00
Noud de Brouwer f8b9d85c62 Sanitize
Sanitize can not be used in PGP key.
2013-01-24 08:19:47 +00:00
Noud de Brouwer 48ad60eb61 GPG
start of check/correct.
2013-01-23 15:22:21 +00:00
Noud de Brouwer 8bf8ef17ca RBAC
so role is editable.
(i will not commit/push during after hours ;) )
2013-01-22 18:37:30 +00:00
Noud de Brouwer 7e5c34770e RBAC
role editable on user page (by admin).
2013-01-22 15:25:08 +00:00
Noud de Brouwer d89ab91dee coding standards
Coding Standards.
2012-12-18 16:44:07 +00:00
Noud de Brouwer 8864ee78f7 generateAllFor<FieldName>
so we can use an URL like:
http://localhost/<TableName>/generateAllFor<FieldName>/newValue/oldValue
for example:
http://localhost/events/generateAllForAnalysis/0/null
http://localhost/users/generateAllForInvitedBy/1/0
http://localhost/users/generateAllForRoleId/1/0
2012-12-18 03:50:52 +00:00
Andras Iklody 1ceadab700 Added features from branch analysis_levels
-Analaysis levels setable for events as per milestone item 94
-Password change forced as per milestone item 109
-Added feedback on entered search terms for search attributes
-fixed the authentication issue
-some minor fixes
2012-12-17 15:51:30 +01:00
noud 26c8ad57ee Role
renamed everything group to role (i.s.o. renaming just the visable).
2012-12-12 16:15:01 +01:00
noud 52a7625a9d Source Code Review
sanitize everything displayed from the db.
(and some small coding standard whitespaces)
2012-12-12 14:01:00 +01:00
noud 1bd14256e0 coding standards
correction conform conding standards.
2012-12-04 09:07:33 +01:00
Andras Iklody 1bf1e6f2a8 Slight change to the histogram
Data for types that had "|" or "-" in the name (such as ip-src)
were omitted - should be fixed now
2012-11-29 16:13:31 +01:00
noud 80571386ad audit log & terms
do not handle a timed out user log.
and
better check on login and termsaccepted.
2012-11-26 10:50:23 +01:00
noud b3a6a656d4 users
show the correct Org during edit.
2012-11-22 11:57:26 +01:00
noud 6495787023 Audit log
Following events are now being logged: 
1. Adding a new user.
2. Deleting a user.
2012-10-31 15:34:43 +01:00
noud 1c3ca8909b Users
invited by filled.
2012-10-31 10:00:01 +01:00
noud 2b24b36639 (internationalization)
setFlash using __(), so transletable lateron.
2012-10-30 09:13:35 +01:00
noud 503d5bcb0e Audit log.
Edit user (now?) needs an extra check on the second password.
2012-09-26 17:13:19 +02:00
noud 8f3d624c1a Merge branch 'master' into develop
Conflicts:
	app/Controller/AppController.php
	app/Controller/AttributesController.php
	app/Controller/EventsController.php
	app/Controller/ServersController.php
	app/Controller/UsersController.php
	app/Model/Attribute.php
	app/Model/Event.php
	app/Model/Server.php
	app/Model/User.php
	app/View/Attributes/edit.ctp
	app/View/Attributes/index.ctp
	app/View/Elements/actions_menu.ctp
	app/View/Events/add.ctp
	app/View/Events/index.ctp
	app/View/Events/view.ctp
	app/View/Events/xml/view.ctp
	app/View/Servers/index.ctp
	app/View/Users/admin_index.ctp
2012-09-24 16:02:01 +02:00
noud 1d04652476 CakePHP Coding Standards
changed to camel caps format where needed.
2012-09-19 11:05:10 +02:00
noud 94a367c2f5 CakePHP Coding Standards
http://book.cakephp.org/2.0/en/contributing/cakephp-coding-conventions.html

Eclipse:
Window->Preferences
	General->Editors->Text Editors
		Displayed tab width:	4
		Insert spaces for tabs	NOT
	PHP->Code Style->Formatter
		Tab policy:	Tabs
File->Convert Line Delimeters To->Unix [default]

http://mark-story.com/posts/view/static-analysis-tools-for-php
for instance:
phpcs --standard=CakePHP app/Model/

Not yet done is all camel caps format.
2012-09-18 15:30:32 +02:00
noud 2459bca386 (Audit) logs.
The writing of the log in User was done by me using calls to the PHP db
driver (during my second or third day). Very wrong given that is driver
and db dependant. Now use CakePHPs calls to have abstraction.
2012-08-23 10:25:14 +02:00
noud cf40a908d4 SysLog.SysLog lib import. 2012-08-22 14:05:39 +02:00
Andrzej Dereszowski 3ff180e898 Merge branch 'develop_0.2.2-0.2.3' into develop
Conflicts:
	app/Config/Schema/schema_0.2.2.php
	app/Config/routes.php
	app/Controller/AppController.php
	app/Controller/UsersController.php
	app/Model/User.php
	app/README.txt
2012-07-24 16:09:48 +02:00
Andrzej Dereszowski bf98f2db3c Merge branch 'develop_0.2.2_fixes' into develop
Conflicts:
	app/Model/Attribute.php
2012-07-11 16:15:27 +02:00
noud e67d9ebdec Fix to authError getting displayed before login. 2012-07-11 10:19:57 +02:00
noud a08842e7d4 Fix to New User, some validation error then authkey not defined. 2012-07-10 15:38:10 +02:00
noud 66c5312ea6 DataBase migrate, Audit and Access Control granulation. 2012-06-28 17:24:12 +02:00
root b4558887ce Revert "Audit and ACL first cut."
This reverts commit 5818231f48.
2012-06-26 09:40:52 +02:00
noud 5818231f48 Audit and ACL first cut. 2012-06-25 15:54:52 +02:00
Christophe Vandeplas 1f52ab82fe fixing bug created in commit 957e4f232b 2012-06-13 14:42:42 +02:00
Christophe Vandeplas 957e4f232b minor memory usage improvements by referencing in foreach ($array as
&$value) loop
2012-06-11 11:40:31 +02:00
Christophe Vandeplas 2d335f5dbe cleanup of comments and todos
minor memory performance improvement
2012-06-11 11:01:58 +02:00
Christophe Vandeplas 39fb9bca1d Attribute types validation is now a separate function that uses the
Attribute->type_definitions variable
2012-05-31 17:12:26 +02:00
Christophe Vandeplas fb958eaacc Logging in for REST using Authorized HTTP header field. 2012-04-06 16:32:33 +02:00
Christophe Vandeplas 5b49318164 moved security to see profile to isAuthorized to keep consistency 2012-04-04 18:32:44 +02:00
Andrzej Dereszowski 9e04311622 minor changes:
- when admin adds a user, auth key is automatically suggested
- auth refresh is performed after user edition
2012-04-02 23:00:41 +02:00
Andrzej Dereszowski 0374c1c9b6 Bug fixes in the admin view
- password changing for other users
- corrected admin_view
2012-04-02 17:21:17 +02:00
Andrzej Dereszowski 17950b965e minor correction:
- login page does not display "invalid user" when first time presented to the user
- "Log Off" button removed from the print view
2012-04-02 11:37:32 +02:00
Christophe Vandeplas 20cddd07db changed alerted -> published
other minor fixes
2012-03-27 14:49:31 +02:00
Christophe Vandeplas 98402c0faa Fix admin routing 2012-03-27 09:31:41 +02:00
Christophe Vandeplas 7c4394682d Renamed Signature to Attribute 2012-03-26 19:56:44 +02:00
Christophe Vandeplas 86b760cd54 Print Cascading Stylesheets and minor layout fixes 2012-03-25 15:02:15 +02:00
Christophe Vandeplas da48ad4769 Confirm password functionality (thanks to Andrzej) 2012-03-22 10:06:33 +01:00
Christophe Vandeplas 5907c86520 whatever 2012-03-21 10:57:59 +01:00