#1643 Prevent creating a file observable if it already exist in the case

TheHive-Project · Nov 12, 2020 · 8846067 · 8846067
1 parent 389901f
commit 8846067
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 8 deletions.
diff --git a/thehive/app/org/thp/thehive/controllers/v0/ObservableCtrl.scala b/thehive/app/org/thp/thehive/controllers/v0/ObservableCtrl.scala
@@ -81,7 +81,10 @@ class ObservableCtrl @Inject() (
                         .fold(
                           e =>
                             successes -> (failures :+ errorHandler.toErrorResult(e)._2 ++ Json
-                              .obj("object" -> Json.obj("attachment" -> Json.obj("name" -> attachment.filename)))),
+                              .obj(
+                                "object" -> Json
+                                  .obj("data" -> s"file:${attachment.filename}", "attachment" -> Json.obj("name" -> attachment.filename))
+                              )),
                           s => (successes :+ s) -> failures
                         )
                     }

diff --git a/thehive/app/org/thp/thehive/services/CaseSrv.scala b/thehive/app/org/thp/thehive/services/CaseSrv.scala
@@ -175,13 +175,20 @@ class CaseSrv @Inject() (
       graph: Graph,
       authContext: AuthContext
   ): Try[Unit] = {
-    val alreadyExistInThatCase = observableSrv
-      .get(richObservable.observable)
-      .filteredSimilar
-      .visible
-      .`case`
-      .hasId(`case`._id)
-      .exists || get(`case`).observables.filter(_.hasId(richObservable.observable._id)).exists // FIXME
+    val alreadyExistInThatCase = richObservable
+      .dataOrAttachment
+      .fold(
+        _ =>
+          observableSrv
+            .get(richObservable.observable)
+            .filteredSimilar
+            .visible
+            .`case`
+            .hasId(`case`._id)
+            .exists,
+        attachment => get(`case`).share.observables.attachments.has(_.attachmentId, attachment.attachmentId).exists
+      ) || get(`case`).observables.filter(_.hasId(richObservable.observable._id)).exists
+
     if (alreadyExistInThatCase)
       Failure(CreateError("Observable already exists"))
     else