Commit Graph

81 Commits (d9a01197accfe097f2cc9f2a49211fbd283ec3e4)

Author SHA1 Message Date
iglocska d9a01197ac More updates to the migration 2013-03-12 11:10:40 +01:00
iglocska 723d87f20d Slight change to generating the ArosAcos
- permission field is not set when roles are read during the ArosAcos
  generation script - needed for generateACL. Fixed.
2013-03-12 10:23:12 +01:00
iglocska eb4283ea9c Highlighting in log searches
- new helper that can be used for highlighting

- highlighting of the search terms in the log search result - index view.
2013-03-11 13:12:48 +01:00
Andras Iklody 32dc28adb9 Update to the admin privileges
- Changed the requirement for a lot of functions to be site admin as
  opposed to admin.
2013-03-05 15:19:58 +01:00
Andras Iklody 01649046c0 Several things (search, migration)
- Changes to the default setting for non private events after migration

- search attribute update to be able to exclude events
2013-02-27 17:15:09 +01:00
Andras Iklody a735822ca1 Updated the migration script (SQL)
- Script updated based on the issues during testing

- Changed the file upload/downoad mechanism.
2013-02-27 15:24:38 +01:00
Andras Iklody 341814a1d4 Some updates to the migration script
- Getting it up to date
2013-02-22 14:42:22 +01:00
Andras Iklody fad8e809ad Minor changes
- some changes to the access control

- re-renabled regexp and blacklists, will need a closer look though

- editing a role should update ACL

- some other minor things
2013-02-21 17:24:41 +01:00
Andras Iklody 0f947085cb Reworked the sync / release control
- Fixed issues with the sync
	- Secondary publishes on remote servers failed
	- Introduced new fields in events to stop backward traverse of
	  edit information that lead to low performance and eroneous
	  distribution information updates when more than 2 servers were
	  linked
	- Deletion of an attribute now deletes on remote servers

- Changes to the event ownership
	- Original creator org now noted in the event itself
	- Only original creator org can change distribution
	- Events will show up with the original creator org for users
	  (admins can see both that and the owner of the event on the
	  local instance)
	- Server.organization now used in junction with the connecting
	  user's org and the instance's org (from the bootstrap) to
	  determine distribution flow control and access rights

- Lots of minor changes
2013-02-19 15:37:35 +01:00
Andras Iklody e88a3a9cf7 Updates to security
- perm_auth new toggle, can disable auth key usage for a role

- prevents sync / rest with a perm_auth == false key

- some changes to sync to provide better feedback on why it failed

- rewording of distribution options
2013-02-06 17:45:43 +01:00
Andras Iklody e976242878 Reworked aros_acos creation
- moved and fixed the aros_acos creation on the new role creation

- new method in appController that sets all the aros_acos from scratch
  (for example for a new instance, or a changed acos / aros table)

- some minor changes, redirects to the terms page on invalid events
  removed, etc.
2013-02-05 17:22:37 +01:00
Andras Iklody 7f6f166838 Fixes to access rights, some sanitization, etc
- Admins cannot manually change anyone's authkey, they need to generate a
  new one via the reset link

- Some pages could be accessed by changing the url - fixed (though needs
  further testing)

- Edited a change in the manual that may have been confusing

- Some changes to the way ACL is set up - still needs more work
2013-02-04 17:55:35 +01:00
Noud de Brouwer 01c0dc0e71 RBAC
org admin and RBAC admin.
2013-01-24 10:35:59 +00:00
Noud de Brouwer a9a1bc91a1 AdminCrud and coding standard
more AdminCrud and coding standard clean up.
2013-01-04 15:48:46 +00:00
Noud de Brouwer 547a80ba7d Sanitize
Sanitize countermeasures.
2012-12-19 15:28:31 +00:00
Noud de Brouwer 534948efad Sanitize
Sanitize countermeasures.
2012-12-19 12:56:42 +00:00
Noud de Brouwer 95158d2ef3 Sanitize
Sanitize countermeasures.
2012-12-19 12:42:38 +00:00
Charlie Root e474b8e189 generateAllFor<FieldName>
conflicts with CAKE/Model/Model::_call() so no findBy<FieldName>.
(and various very minor other things.)
2012-12-19 10:30:10 +00:00
Noud de Brouwer d89ab91dee coding standards
Coding Standards.
2012-12-18 16:44:07 +00:00
Noud de Brouwer 8864ee78f7 generateAllFor<FieldName>
so we can use an URL like:
http://localhost/<TableName>/generateAllFor<FieldName>/newValue/oldValue
for example:
http://localhost/events/generateAllForAnalysis/0/null
http://localhost/users/generateAllForInvitedBy/1/0
http://localhost/users/generateAllForRoleId/1/0
2012-12-18 03:50:52 +00:00
Andras Iklody 1ceadab700 Added features from branch analysis_levels
-Analaysis levels setable for events as per milestone item 94
-Password change forced as per milestone item 109
-Added feedback on entered search terms for search attributes
-fixed the authentication issue
-some minor fixes
2012-12-17 15:51:30 +01:00
noud 26c8ad57ee Role
renamed everything group to role (i.s.o. renaming just the visable).
2012-12-12 16:15:01 +01:00
noud 52a7625a9d Source Code Review
sanitize everything displayed from the db.
(and some small coding standard whitespaces)
2012-12-12 14:01:00 +01:00
noud 8119d26d35 RBAC and Roles
did add Acl Admin and Audit.
2012-12-11 17:40:57 +01:00
noud 75dfba2ae1 sync
have sync option in role.
and only display the Sync Actions when sync option or admin.
(still has to be disabled if role is below manage org events.
2012-12-07 15:00:40 +01:00
noud 1bd14256e0 coding standards
correction conform conding standards.
2012-12-04 09:07:33 +01:00
noud c6bdf794c1 db
spit generatePrivate into attr and event part (given long runtime).
2012-11-29 15:10:18 +01:00
noud d2ab860ff2 distibution
generatePrivate conform new distribution.
2012-11-28 16:34:36 +01:00
noud 889492629e distibution
add generateHop to migratemisp11to2.
(generatePrivate should still be looked at.)
2012-11-28 14:30:29 +01:00
noud 324d58d532 distribution
generate hop count.
2012-11-28 13:19:20 +01:00
noud 80571386ad audit log & terms
do not handle a timed out user log.
and
better check on login and termsaccepted.
2012-11-26 10:50:23 +01:00
noud 7c878af986 terms
slight better formulated AppController::beforeFilter()
2012-11-20 08:42:32 +01:00
noud 7a0068936a terms
slight better formulated AppController::beforeFilter()
2012-11-19 15:40:26 +01:00
noud fdd999ef35 correlation
fixed correlations being double accounted.
2012-11-15 15:53:07 +01:00
noud 4f234d1d46 terms
take 2, for a user must accept terms.
2012-11-15 13:50:20 +01:00
noud 8d2e665ceb terms
reverted just done commit
(Can't use method return value in write context ).
2012-11-15 13:24:34 +01:00
noud 8125c0c938 terms
check for user logged in (if not a server looks total stalled).
2012-11-15 13:23:08 +01:00
noud ea0ab59e4f code standards
corrections toward code standards.
2012-11-14 17:16:36 +01:00
noud 6b06ba7ff6 count & GFI Sandbox
count # attributes in events index.
plus various fixes for distribution in correlation of a GFI Sandbox
upload.
2012-11-14 16:14:04 +01:00
noud c599c2c23e GFI Sandbox
files having size 0 are not md5 summed in CakePHP.
2012-11-14 15:12:19 +01:00
noud 3a84ffb59f terms
user must accept terms.
2012-11-14 10:52:53 +01:00
noud 723ef6c3d1 correlation
respect distribution Org in correlations.
(for this
add correlations.1_private conform MYSQL.correlaton.sql
and
AppController::generateCorrelation() must be run)
2012-11-13 14:13:38 +01:00
noud 4cc6b8055f RBAC
now should be okay on the checkGroup.
(mind, we have a PHP 5.3.10 (dev) and 5.2.10 (f.a.) difference.
for CakePHP should be php > 5.2.8, pear > 1.9.0 and phpunit 3.5.0)
2012-11-08 15:28:21 +01:00
noud c722205ddf RBAC
check if $user exists, if no, not logged in.
2012-11-08 15:12:20 +01:00
noud 91f96427db RBAC
//$user =
ClassRegistry::init('User')->findById($this->Auth->user('id'));
$this->loadModel('User');
$user = $this->User->findById($this->Auth->user('id'));
2012-11-08 14:36:27 +01:00
noud a2bc237bcd RBAC
should now respect Manage, so also edit, own and org events.‏
2012-11-08 14:09:52 +01:00
noud f56cb25bed Merge branch 'master' into develop 2012-10-25 15:23:22 +02:00
noud 05085533de blackhole
full out-commented.
2012-10-25 15:16:19 +02:00
noud fa86316747 blackhole
revert the commit, this screws CSRF
(thanks to Christophe for noticing)
2012-10-24 17:16:12 +02:00
noud eae89d95cd Private.
Add "Pull only" as a sharing state where,
everybody does see an event, is pullable,
but will never be pushed.

Has a generatePrivate for db conversion now.
2012-10-18 11:40:12 +02:00