Compare commits

...

18 Commits

Author SHA1 Message Date
Jakub Onderka e529024a52
Merge 34c85cfe7e into 3d3a207d4d 2024-04-26 13:20:35 +03:00
iglocska 3d3a207d4d
chg: [UI] clicking on your user name should bring up the user profile, fixes #9708 2024-04-26 10:41:03 +02:00
iglocska 947dbe1085
fix: [event add] default value of threat level ID correctly injected into the form, fixes #9714 2024-04-26 10:15:52 +02:00
iglocska 66532a095c
Merge branch '2.4' into develop 2024-04-26 08:47:04 +02:00
iglocska 14106b811a
fix: [freetext] ip-src/ip-dst meta-type didn't have a valid category list 2024-04-26 08:43:00 +02:00
iglocska ee196c1349
fix: [user registration] pgp key not saved from the registration 2024-04-26 08:32:39 +02:00
Sami Mokaddem 7416a9dd97
fix: [logs:index] Fixed UI pagination in application logs 2024-04-25 14:46:22 +02:00
iglocska 89a6cbdfe6
Merge branch 'develop' of github.com:MISP/MISP into develop 2024-04-23 15:12:30 +02:00
iglocska b6a8d43bbd
Merge branch 'browscap_default' into develop 2024-04-23 15:12:17 +02:00
Andras Iklody d629922a7f
Merge pull request #9697 from Wachizungu/add-orgc-filter-for-galaxy-clusters-index
fix: [galaxy_clusters] Add orgc filter option for index, set it as de…
2024-04-23 15:10:21 +02:00
iglocska 91e1c27746
Merge branch '2.4' into develop 2024-04-23 15:08:50 +02:00
iglocska cd25980da9
fix: [sql logs] captured when benchmarking is enabled but debug level is < 2 2024-04-23 15:03:22 +02:00
iglocska ed790e2ab7
Merge branch '2.4' into develop 2024-04-23 14:54:47 +02:00
iglocska 597977694d
fix: [security] stored XSS in the correlation top list
- if an attribute with an XSS payload as its value ends up being in the top list of correlations, then an administrator viewing the top correlations would execute the XSS

- as reported by Grzegorz Misiun
2024-04-23 14:51:58 +02:00
iglocska 4c75abbb70
new: [fast api auth] added
- added a new optional functionality to temporarily store hashed API keys in redis
  - The duration of the temporary storage is controllable by a setting (defaults to 3 minutes)
  - the hashing function used is an hmac sha-512 function, with the key being stored in a generated file on the instance
  - this cuts the query times of extremely fast endpoints down drastically on heavy repeated use (such as warninglists/checkValue)
2024-04-23 13:23:31 +02:00
Jakub Onderka 34c85cfe7e fix: [oidc] Fix issuer if not set 2024-04-22 16:57:06 +02:00
Jeroen Pinoy 2b3cd11142
fix: [galaxy_clusters] Add orgc filter option for index, set it as default for galaxy view 'My Clusters' 2024-04-22 00:03:58 +02:00
Bradley Logan ee986fc2fc
chg: Set BrowscapPHP logging from default DEBUG to INFO 2024-02-28 15:22:14 -08:00
13 changed files with 30 additions and 11 deletions

View File

@ -4142,7 +4142,13 @@ class EventsController extends AppController
}
}
$this->Event->Attribute->fetchRelated($this->Auth->user(), $resultArray);
$typeCategoryMapping = array();
$typeCategoryMapping = [
'ip-src/ip-dst' => [
'Network activity' => 'Network activity',
'Payload delivery' => 'Payload delivery',
'External analysis' => 'External analysis'
],
];
foreach ($this->Event->Attribute->categoryDefinitions as $k => $cat) {
foreach ($cat['types'] as $type) {
$typeCategoryMapping[$type][$k] = $k;

View File

@ -59,6 +59,8 @@ class GalaxyClustersController extends AppController
$contextConditions['GalaxyCluster.default'] = true;
} elseif ($filters['context'] == 'custom') {
$contextConditions['GalaxyCluster.default'] = false;
} elseif ($filters['context'] == 'orgc') {
$contextConditions['GalaxyCluster.orgc_id'] = $this->Auth->user('org_id');
} elseif ($filters['context'] == 'org') {
$contextConditions['GalaxyCluster.org_id'] = $this->Auth->user('org_id');
} elseif ($filters['context'] == 'deleted') {

View File

@ -117,6 +117,9 @@ class LogsController extends AppController
$this->paginate['conditions']['Log.action'] = $validFilters[$this->params['named']['filter']]['values'];
}
foreach ($filters as $key => $value) {
if ($key == 'page' || $key == 'limit') { // These should not be part of the condition parameter
continue;
}
if ($key === 'created') {
$key = 'created >=';
}

View File

@ -2603,6 +2603,7 @@ class UsersController extends AppController
'org_name',
'org_uuid',
'message',
'pgp',
'custom_perms',
'perm_sync',
'perm_publish',

View File

@ -15,9 +15,6 @@ class BenchmarkTool
/** @var retention */
private $retention = 0;
/** @var start_time */
public $start_timexxx;
const BENCHMARK_SCOPES = ['user', 'endpoint', 'user_agent'];
const BENCHMARK_FIELDS = ['time', 'sql_time', 'sql_queries', 'memory'];
const BENCHMARK_UNITS = [

View File

@ -152,7 +152,9 @@ class MysqlExtended extends Mysql
public function execute($sql, $options = [], $params = [])
{
$log = $options['log'] ?? $this->fullDebug;
if (Configure::read('Plugin.Benchmarking_enable')) {
$log = true;
}
if ($log) {
$t = microtime(true);
$this->_result = $this->_execute($sql, $params);

View File

@ -144,6 +144,9 @@ class MysqlObserverExtended extends Mysql
public function execute($sql, $options = [], $params = [])
{
$log = $options['log'] ?? $this->fullDebug;
if (Configure::read('Plugin.Benchmarking_enable')) {
$log = true;
}
$comment = sprintf(
'%s%s%s',
empty(Configure::read('CurrentUserId')) ? '' : sprintf(

View File

@ -46,6 +46,8 @@ class UserLoginProfile extends AppModel
private function browscapGetBrowser()
{
$logger = new \Monolog\Logger('name');
$streamHandler = new \Monolog\Handler\StreamHandler('php://stderr', \Monolog\Logger::INFO);
$logger->pushHandler($streamHandler);
if (function_exists('apcu_fetch')) {
App::uses('ApcuCacheTool', 'Tools');

View File

@ -302,7 +302,7 @@ class Oidc
$providerUrl = $this->getConfig('provider_url');
$clientId = $this->getConfig('client_id');
$clientSecret = $this->getConfig('client_secret');
$issuer = $this->getConfig('issuer', $providerUrl);
$issuer = $this->getConfig('issuer', null, false);
if (class_exists("\JakubOnderka\OpenIDConnectClient")) {
$oidc = new \JakubOnderka\OpenIDConnectClient($providerUrl, $clientId, $clientSecret, $issuer);
@ -503,13 +503,15 @@ class Oidc
/**
* @param string $config
* @param mixed|null $default
* @param bool $required When true and variable is not set, RuntimeException will be thrown
* @return mixed
* @throws RuntimeException when config option is not set
*/
private function getConfig($config, $default = null)
private function getConfig($config, $default = null, $required = true)
{
$value = Configure::read("OidcAuth.$config");
if ($value === null) {
if ($default === null) {
if ($default === null && $required) {
throw new RuntimeException("Config option `OidcAuth.$config` is not set.");
}
return $default;

View File

@ -57,5 +57,5 @@
'%s<a href="#" onclick="event.preventDefault(); %s">%s</a>',
$form,
$onclick,
$text
h($text)
);

View File

@ -540,7 +540,7 @@ if (!empty($me)) {
],
array(
'type' => 'root',
'url' => $baseurl . '/dashboards',
'url' => $baseurl . '/users/view/me',
'html' => sprintf(
'<span class="white" title="%s">%s%s&nbsp;&nbsp;&nbsp;%s</span>',
h($me['email']),

View File

@ -33,6 +33,7 @@
'field' => 'threat_level_id',
'class' => 'input',
'options' => $threatLevels,
'default' => Configure::check('MISP.default_event_threat_level') ? Configure::read('MISP.default_event_threat_level') : '4',
'label' => __("Threat Level"),
'stayInLine' => 1,
'type' => 'dropdown'

View File

@ -34,7 +34,7 @@
),
array(
'active' => $context === 'org',
'url' => sprintf('%s/galaxies/view/%s/context:org', $baseurl, $galaxy_id),
'url' => sprintf('%s/galaxies/view/%s/context:orgc', $baseurl, $galaxy_id),
'text' => __('My Clusters'),
),
array(