Commit Graph

92 Commits (8e6a8d1adc6053383a52758dfddd5a0629f820e2)

Author SHA1 Message Date
iglocska 11b1ff6926 Changes to uploading a ca file for a server link
- create folder if it doesn't exist
- correctly save file if edited
2014-02-17 11:40:44 +01:00
iglocska 722f17f38d Deprecated flag used to check it sync is enabled
- fixed, now correctly looking for MISP.sync
2014-02-14 10:27:09 +01:00
iglocska 70c7f650f6 Changes to the logging and scheduling
- Scheduled tasks for pull / push now working as intended
- Rescheduling of all tasks fixed
- protection against the rescheduled task ending up in the past

- further event history fixes
- fixed lots of erroneous logging
- performance improvement with logging (no longer loading controllers for no reason)
- logging extra actions that weren't logged before (proposal accept / discard, server pull / push)
2014-01-29 15:52:09 +01:00
iglocska 467408d9f7 Org admins should be able to delete / edit their own server links 2014-01-24 10:43:07 +01:00
iglocska fb7f084e70 Permission issue with delete servers
- fixed a bug that prevented the deletion of sync links
2014-01-24 10:40:46 +01:00
iglocska a9d945ff19 Changes to the sync action pages
- fixed access control
- any admin can now encode new servers. Org admins can pull/push for their own instances.

- Upload certificates during an edit
2014-01-21 16:41:32 +01:00
iglocska c10d3e9b95 SSL certificate changes
- you can now upload a certificate file and allow a server link to use a provided self signed certificate. This should solve the issues that some organisations are having when trying to connect their instances
2014-01-16 08:47:25 +01:00
iglocska cbcd7ac625 Some small fixes
- Corrected some weak notifications on background jobs
- Changed the view slightly to view background jobs
- fixed an issue where editing a sync server setting would cause an error due to the id not being passed to the logging plugin
2014-01-07 11:08:21 +01:00
iglocska c6fd29fb29 Several features
- Sync for background jobs (pull + push)
- more e-mailing delegated to background jobs
- A bunch of bug fixes and minor changes
2014-01-06 05:15:47 +01:00
iglocska a380ab444a Work on the background job and the proposals
- Proposals now get synced on pull
- several bug fixes
- new startup script for the background workers
2014-01-05 21:30:39 +01:00
iglocska 2b11a78e22 Merge branch 'feature/roleChanges' into feature/XML_and_UI
Conflicts:
	app/Controller/UsersController.php
	app/View/Regexp/admin_add.ctp
	app/View/Regexp/admin_edit.ctp
	app/View/Regexp/admin_index.ctp
	app/View/Roles/admin_add.ctp
	app/View/Servers/add.ctp
	app/View/Servers/edit.ctp
	app/View/Servers/index.ctp
	app/View/Servers/pull.ctp
	app/View/Servers/push.ctp
2013-10-25 10:39:18 +02:00
iglocska 3c58e0071a Further work on the UI
- reworked almost all of the side menues to be centralised

- Some fixes for the IOC export not handling two new-ish types correctly

- Some changes to the menues (including a few options that didn't exist before)

- rework of the popovers in some forms
2013-10-24 16:41:42 +02:00
iglocska d27ddee207 First rework of the siteadmin role
- ADMIN org removed.

- Siteadmins are now identified by the perm_site_admin flag

- Siteadmins can now be of any organisation

- editing the regexp / whitelist rules can now be done by a special user with the perm_regexp_access in his/her role

- Executing a mass replace of attribute values based on the regexp rules cannot be initiated by a regexp/whitelist user, only by a site admin

- If the login page is reached without any users / roles defined they are automatically created (perviously it was only the user that was created)

- Org admins are restricted from assigning perm_site_admin, perm_sync and perm_regexp_access roles to users. This can only be done by a site admin.
2013-10-03 11:45:27 +02:00
iglocska a5c100309b Fixes to the Shadow attribute e-mailing
- E-mail locks are now correctly reset by discarding / accepting a proposal

- Also, new index page to see the list of proposals that a user can accept
2013-09-03 15:29:44 +02:00
iglocska 932f5b89df Introduced a typo in the previous commit. 2013-08-12 17:31:45 +02:00
iglocska 285ff481a5 Further updates to the sync 2013-08-12 17:23:32 +02:00
Christophe Vandeplas 8e8f41ab13 Fixes in server push 2013-07-17 14:27:51 +02:00
Christophe Vandeplas 2424cbbf26 Server push lower memory footprint solving OoM problem.
Enabled per-id push like pull
2013-07-17 14:06:24 +02:00
Christophe Vandeplas e13c2e883c fixing problems in pull with distribution data validation 2013-07-16 15:28:04 +02:00
Christophe Vandeplas 66ce874b99 do not change 'info' field upon pull (was: Imported from $url) 2013-07-12 10:34:59 +02:00
iglocska 3e9a967188 Removal of some references to the old private flag 2013-07-11 17:25:47 +02:00
iglocska 5948a7c329 Several copy paste failures fixed in the previous commit
- /facepalm
2013-06-27 17:57:33 +02:00
iglocska 8cdf97ff66 ACL checks changed
- until now checkAction was used to check permissions of a user

- but since all of the role permissions are checked beforefilter in
appcontroller and saved into a public array, doing a lookup of the
array saves an SQL call for each permission check.
2013-06-27 17:53:36 +02:00
Christophe Vandeplas 8fe83c333f micro cleanup of servers index 2013-06-19 14:58:48 +02:00
Christophe Vandeplas da3580de35 little bit more details about sync errors 2013-06-19 12:13:45 +02:00
Christophe Vandeplas dbf1065b3b sync pull backwards compatibility with MISPv2 2013-06-18 11:19:43 +02:00
Christophe Vandeplas 3b28d6f1e8 (workaround) better error message when HTTP problem with Server Pull 2013-06-18 09:12:09 +02:00
Iglocska 1635d99d8f Pull can not edit events / attributes
- added the _edit method in EventsController
2013-06-11 00:41:43 +02:00
Iglocska 040227d66a Some more fixes to the sync 2013-06-10 23:34:47 +02:00
Iglocska f8f290375e Further changes to the degradation of the distribution 2013-06-10 23:00:45 +02:00
iglocska cb3ac8be15 Changes to the event filtering
- there was a bug that pushed the data entered into the "published"
filter field to the date fields -> fixed

- Also a bug in the serverscontroller, pulling threw an undefined
warning from the log controller because a single saveField was used and
the logController couldn't save the url data for the action
2013-06-06 10:24:27 +02:00
Christophe Vandeplas 0614db919e fixes information leakage vulnerability on REST XML outputs 2013-05-22 10:52:03 +02:00
Christophe Vandeplas 62a3da46f2 removed useless hop_count 2013-05-22 08:18:34 +02:00
Andras Iklody 0eec208b45 Further changes to the authorisation 2013-04-26 15:46:39 +02:00
Andras Iklody eeaa071024 Removal of the remains of the old authorization / adding new ones where
needed
2013-04-26 14:43:44 +02:00
Christophe Vandeplas 5c0fc36b79 fix sanitization in Servers #96 2013-04-24 12:23:03 +02:00
Andras Iklody 3e89c80d09 Removed some obsolete code
- getName functions removed

- Fixed a reference to it in the logable behaviour
2013-04-18 08:49:59 +02:00
Andras Iklody 9a6733acfd Removal of deprecated code
- The flag private is deprecated, removed together with the code that was
  affected by it
2013-04-17 11:13:09 +02:00
Andras Iklody 32dc28adb9 Update to the admin privileges
- Changed the requirement for a lot of functions to be site admin as
  opposed to admin.
2013-03-05 15:19:58 +01:00
Andras Iklody fad8e809ad Minor changes
- some changes to the access control

- re-renabled regexp and blacklists, will need a closer look though

- editing a role should update ACL

- some other minor things
2013-02-21 17:24:41 +01:00
Andras Iklody 0f947085cb Reworked the sync / release control
- Fixed issues with the sync
	- Secondary publishes on remote servers failed
	- Introduced new fields in events to stop backward traverse of
	  edit information that lead to low performance and eroneous
	  distribution information updates when more than 2 servers were
	  linked
	- Deletion of an attribute now deletes on remote servers

- Changes to the event ownership
	- Original creator org now noted in the event itself
	- Only original creator org can change distribution
	- Events will show up with the original creator org for users
	  (admins can see both that and the owner of the event on the
	  local instance)
	- Server.organization now used in junction with the connecting
	  user's org and the instance's org (from the bootstrap) to
	  determine distribution flow control and access rights

- Lots of minor changes
2013-02-19 15:37:35 +01:00
Andras Iklody e88a3a9cf7 Updates to security
- perm_auth new toggle, can disable auth key usage for a role

- prevents sync / rest with a perm_auth == false key

- some changes to sync to provide better feedback on why it failed

- rewording of distribution options
2013-02-06 17:45:43 +01:00
Andras Iklody 5706fe183f Redirect for ServersController
Added redirect for index in case of non sync users
2013-02-06 08:34:41 +01:00
Andras Iklody 4d0fe60347 Corrected a typo preventing the sync from working 2013-01-30 14:02:36 +01:00
Andras Iklody 97f56a2275 Further changes to org admins
org admins can manage their own server connections
org admins cannot see other orgs' users in the users list
2013-01-29 08:56:38 +01:00
Andras 8d88bcb2b5 Fix for the synchronisation
An error in the pull fix broke the push/publish feature. Fixed.
2013-01-27 21:27:58 +01:00
Noud de Brouwer 3d40095547 coding standards
Coding Standards.
2013-01-25 07:51:20 +00:00
Andras Iklody 24b10579ad Pull fixed
Fixed the issues with pull, should work fine now
2013-01-24 17:32:57 +01:00
Noud de Brouwer d89ab91dee coding standards
Coding Standards.
2012-12-18 16:44:07 +00:00
noud 52a7625a9d Source Code Review
sanitize everything displayed from the db.
(and some small coding standard whitespaces)
2012-12-12 14:01:00 +01:00