From 67214986ccd6b35776dd5bbd8b1d84b3e91e6c6e Mon Sep 17 00:00:00 2001 From: Nabil Adouani Date: Wed, 8 Jul 2020 13:45:28 +0200 Subject: [PATCH] #1423 Add permission check in case and observable bulk actions --- .../scripts/controllers/case/CaseListCtrl.js | 13 ++- .../controllers/case/CaseObservablesCtrl.js | 43 +++------- .../app/views/partials/case/case.export.html | 79 ------------------- .../app/views/partials/case/case.list.html | 15 ++-- .../views/partials/case/case.observables.html | 6 -- .../observables/list/observables.html | 2 +- .../observables/list/run-analyzers.html | 30 ------- 7 files changed, 28 insertions(+), 160 deletions(-) delete mode 100644 frontend/app/views/partials/case/case.export.html delete mode 100644 frontend/app/views/partials/observables/list/run-analyzers.html diff --git a/frontend/app/scripts/controllers/case/CaseListCtrl.js b/frontend/app/scripts/controllers/case/CaseListCtrl.js index 497187bb59..3eef804ab9 100644 --- a/frontend/app/scripts/controllers/case/CaseListCtrl.js +++ b/frontend/app/scripts/controllers/case/CaseListCtrl.js @@ -3,7 +3,7 @@ angular.module('theHiveControllers') .controller('CaseListCtrl', CaseListCtrl); - function CaseListCtrl($scope, $q, $state, $window, $uibModal, FilteringSrv, StreamStatSrv, PaginatedQuerySrv, EntitySrv, CaseSrv, UserSrv, AuthenticationSrv, CaseResolutionStatus, NotificationSrv, Severity, Tlp, CortexSrv) { + function CaseListCtrl($scope, $q, $state, $window, $uibModal, FilteringSrv, SecuritySrv, StreamStatSrv, PaginatedQuerySrv, EntitySrv, CaseSrv, UserSrv, AuthenticationSrv, CaseResolutionStatus, NotificationSrv, Severity, Tlp, CortexSrv) { var self = this; this.openEntity = EntitySrv.open; @@ -72,7 +72,7 @@ operations: [ {'_name': 'listCase'} ], - extraData: ["observableStats", "taskStats", "isOwner", "shareCount"], + extraData: ["observableStats", "taskStats", "isOwner", "shareCount", "permissions"], onUpdate: function() { self.resetSelection(); } @@ -102,12 +102,17 @@ self.selectAll = function() { var selected = self.menu.selectAll; + _.each(self.list.values, function(item) { - item.selected = selected; + if(SecuritySrv.checkPermissions(['manageCase'], item.extraData.permissions)) { + item.selected = selected; + } }); if (selected) { - self.selection = self.list.values; + self.selection = _.filter(self.list.values, function(item) { + return !!item.selected; + }); } else { self.selection = []; } diff --git a/frontend/app/scripts/controllers/case/CaseObservablesCtrl.js b/frontend/app/scripts/controllers/case/CaseObservablesCtrl.js index d22769879f..478754f156 100644 --- a/frontend/app/scripts/controllers/case/CaseObservablesCtrl.js +++ b/frontend/app/scripts/controllers/case/CaseObservablesCtrl.js @@ -1,7 +1,7 @@ (function () { 'use strict'; angular.module('theHiveControllers').controller('CaseObservablesCtrl', - function ($scope, $q, $state, $stateParams, $filter, $uibModal, ModalUtilsSrv, FilteringSrv, StreamSrv, CaseTabsSrv, PaginatedQuerySrv, CaseArtifactSrv, NotificationSrv, AnalyzerSrv, CortexSrv, VersionSrv) { + function ($scope, $q, $state, $stateParams, $filter, $uibModal, SecuritySrv, ModalUtilsSrv, FilteringSrv, StreamSrv, CaseTabsSrv, PaginatedQuerySrv, CaseArtifactSrv, NotificationSrv, AnalyzerSrv, CortexSrv, VersionSrv) { CaseTabsSrv.activateTab($state.current.data.tab); @@ -33,7 +33,6 @@ .then(function() { $scope.load(); - $scope.initSelection($scope.selection); $scope.initAnalyzersList(); // Add a listener to refresh observables list on job finish @@ -74,9 +73,9 @@ sort: $scope.filtering.context.sort, pageSize: $scope.filtering.context.pageSize, filter: $scope.filtering.buildQuery(), - extraData: ['seen'], + extraData: ['seen', 'permissions'], operations: [ - {'_name': 'getCase', "idOrName": $scope.caseId}, + {'_name': 'getCase', 'idOrName': $scope.caseId}, {'_name': 'observables'} ], onUpdate: function() { @@ -171,26 +170,11 @@ // // init lists // - $scope.initSelection = function (selection) { - selection.all = false; - selection.list = {}; - selection.Action = 'main'; - }; - $scope.initAnalyzersList = function () { if($scope.analysisEnabled) { AnalyzerSrv.query() .then(function (analyzers) { $scope.analyzersList.analyzers = analyzers; - $scope.analyzersList.active = {}; - $scope.analyzersList.datatypes = {}; - angular.forEach($scope.analyzersList.analyzers, function (analyzer) { - $scope.analyzersList.active[analyzer.name] = false; - }); - $scope.analyzersList.selected = {}; - angular.forEach($scope.analyzersList.analyzers, function (analyzer) { - $scope.analyzersList.selected[analyzer.name] = false; - }); }); } }; @@ -198,19 +182,20 @@ // select all artifacts : add all artifacts in selection or delete selection $scope.selectAll = function () { var selected = $scope.menu.selectAll; + _.each($scope.artifacts.values, function(item) { - item.selected = selected; + if(SecuritySrv.checkPermissions(['manageObservable'], item.extraData.permissions)) { + item.selected = selected; + } }); if (selected) { - $scope.selection.artifacts = $scope.artifacts.values; + $scope.selection.artifacts = _.filter($scope.artifacts.values, function(item) { + return !!item.selected; + }); } else { $scope.selection.artifacts = []; - - $scope.initAnalyzersList(); } - - }; // select or unselect an artifact @@ -222,8 +207,6 @@ return item._id === artifact._id; }); } - - }; // actions on artifacts @@ -313,7 +296,6 @@ $scope.hideExport = function() { $scope.showExportPanel = false; - $scope.initSelection($scope.selection); }; $scope.removeObservables = function () { @@ -335,8 +317,6 @@ }).catch(function(/*err*/) { //NotificationSrv.error('Observable deletion', response.data, response.status); }); - - $scope.initSelection($scope.selection); }; // run selected analyzers on selected artifacts @@ -374,9 +354,6 @@ }, function() { }); - - $scope.initAnalyzersList(); - $scope.initSelection($scope.selection); }; $scope.openArtifact = function (artifact) { diff --git a/frontend/app/views/partials/case/case.export.html b/frontend/app/views/partials/case/case.export.html deleted file mode 100644 index 21267a5e1b..0000000000 --- a/frontend/app/views/partials/case/case.export.html +++ /dev/null @@ -1,79 +0,0 @@ -
-
-
No records.
-
-
- - -
-
- - - -
-
- - -
-
- - -
-
- -
- -
- - - - - - - - - - - - - - - - - - - - - - - - - - -
- - TypeData/FilenameTagsMISP CategoryMISP Type 
- - - - {{(artifact.data | fang) || (artifact.attachment.name | fang)}} - - - - - - - Not specified - Not specified - - Not specified - Not specified - - - -
- -
-
diff --git a/frontend/app/views/partials/case/case.list.html b/frontend/app/views/partials/case/case.list.html index 0f6330b532..3581c70c20 100644 --- a/frontend/app/views/partials/case/case.list.html +++ b/frontend/app/views/partials/case/case.list.html @@ -38,10 +38,10 @@

List of cases ({{$vm.list.total || 0}} of {{$vm.caseStats. + - @@ -49,16 +49,17 @@

List of cases ({{$vm.list.total || 0}} of {{$vm.caseStats.

- + - + -
Title SeverityObservables Assignee DateActionsActions
- - + +
List of cases ({{$vm.list.total || 0}} of {{$vm.caseStats.
+ - +
diff --git a/frontend/app/views/partials/observables/list/observables.html b/frontend/app/views/partials/observables/list/observables.html index 0f87116200..9de845ee31 100644 --- a/frontend/app/views/partials/observables/list/observables.html +++ b/frontend/app/views/partials/observables/list/observables.html @@ -62,7 +62,7 @@

- + diff --git a/frontend/app/views/partials/observables/list/run-analyzers.html b/frontend/app/views/partials/observables/list/run-analyzers.html deleted file mode 100644 index b061ad9a53..0000000000 --- a/frontend/app/views/partials/observables/list/run-analyzers.html +++ /dev/null @@ -1,30 +0,0 @@ -
- -
-
- Sorry, there are currently no analyzers for the selected observable type(s) -
-
- Cancel -
-
- -
-
- Only a subset of the selected observables can be analyzed ({{analyzersList.activeDataTypes.join(', ')}}) and the remaining observables will be ignored -
-
- Select AllDeselect All -
-
    -
  • - - -
    • -
-
- Run selected analyzers - Cancel -
-
-