Skip to content
This repository was archived by the owner on Feb 12, 2022. It is now read-only.

Commit b6bb107

Browse files
author
Tim Bach
committed
Merge branch 'development' - version 3.0.3
2 parents 7841882 + 044f0de commit b6bb107

File tree

8 files changed

+689
-3
lines changed

8 files changed

+689
-3
lines changed

‎routes/admin.rb

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -783,6 +783,141 @@ class Vulnreport < Sinatra::Base
783783
redirect "/admin/vulntypes/"
784784
end
785785

786+
get '/admin/vulntypes/export/?' do
787+
vulnTypes = VulnType.all()
788+
789+
builder = Nokogiri::XML::Builder.new do |xml|
790+
xml.vulntypes{
791+
vulnTypes.each do |vt|
792+
xml.vulntype{
793+
xml.name vt.name
794+
xml.label vt.label
795+
xml.cwe vt.cwe_mapping
796+
xml.html vt.html
797+
xml.priority vt.priority
798+
xml.enabledSections vt.enabledSections
799+
}
800+
end
801+
}
802+
end
803+
804+
attachment "vulntypes.xml"
805+
return builder.to_xml
806+
end
807+
808+
get '/admin/vulntypes/import/?' do
809+
erb :admin_vt_import
810+
end
811+
812+
post '/admin/vulntypes/import/?' do
813+
data = params[:vt_import]
814+
815+
filesize = (File.size(data[:tempfile]).to_f)/1024
816+
if(filesize > 1024)
817+
@errstr = "XML File too large - Max 1MB"
818+
return erb :error
819+
end
820+
821+
file = File.open(data[:tempfile], "rb")
822+
doc = Nokogiri::XML(file)
823+
824+
@vts = Array.new
825+
doc.xpath("//vulntype").each do |vt|
826+
vtname = vt.at_xpath(".//name").children.first.text.to_s
827+
828+
vtlabel = vt.at_xpath(".//label").children
829+
if(!vtlabel.nil? && vtlabel.size > 0)
830+
vtlabel = vtlabel.first.text.to_s
831+
else
832+
vtlabel = nil
833+
end
834+
835+
vtcwe = vt.at_xpath(".//cwe").children
836+
if(!vtcwe.nil? && vtcwe.size > 0)
837+
vtcwe = vtcwe.first.text.to_i
838+
else
839+
vtcwe = nil
840+
end
841+
842+
vtpriority = vt.at_xpath(".//priority").children
843+
if(!vtpriority.nil? && vtpriority.size > 0)
844+
vtpriority = vtpriority.first.text.to_i
845+
else
846+
vtpriority = nil
847+
end
848+
849+
vtenabled = vt.at_xpath(".//enabledSections").children.first.text.gsub("[","").gsub("]","").split(",").map{|s| s.to_i}
850+
851+
vthtml = vt.at_xpath(".//html").children
852+
if(!vthtml.nil? && vthtml.size > 0)
853+
vthtml = vthtml.first.text.to_s
854+
else
855+
vthtml = nil
856+
end
857+
858+
newvt = {:name => vtname, :label =>vtlabel, :cwe => vtcwe, :priority => vtpriority, :enabled => vtenabled, :html => vthtml}
859+
@vts << newvt
860+
end
861+
862+
@appRecordTypes = RecordType.appRecordTypes()
863+
864+
erb :admin_vt_import_confirm
865+
end
866+
867+
post '/admin/vulntypes/doImport/?' do
868+
selected = params[:vt_confirms].map{|e| e.to_i}
869+
870+
newRts = Array.new
871+
if(!params[:rtms].nil?)
872+
params[:rtms].each do |rtid|
873+
newRts << rtid.to_i
874+
end
875+
end
876+
877+
selected.each do |idx|
878+
vtname = params["vt_name_#{idx}"].to_s
879+
880+
vtlabel = params["vt_label_#{idx}"]
881+
if(vtlabel.nil? || vtlabel.to_s.strip.empty?)
882+
vtlabel = nil
883+
else
884+
vtlabel = vtlabel.to_s
885+
end
886+
887+
vtcwe = params["vt_cwe_#{idx}"]
888+
if(vtcwe.nil? || vtcwe.to_s.strip.empty?)
889+
vtcwe = nil
890+
else
891+
vtcwe = vtcwe.to_i
892+
end
893+
894+
vtpriority = params["vt_priority_#{idx}"]
895+
if(vtpriority.nil? || vtpriority.to_s.strip.empty?)
896+
vtpriority = nil
897+
else
898+
vtpriority = vtpriority.to_i
899+
end
900+
901+
vtenabled = params["vt_enabled_#{idx}"]
902+
if(vtenabled.nil? || vtenabled.to_s.strip.empty?)
903+
vtenabled = []
904+
else
905+
vtenabled = vtenabled.to_s.gsub("[","").gsub("]","").split(",").map{|s| s.to_i}
906+
end
907+
908+
vthtml = params["vt_html_#{idx}"]
909+
if(vthtml.nil? || vthtml.to_s.strip.empty?)
910+
vthtml = nil
911+
else
912+
vthtml = vthtml.to_s
913+
end
914+
915+
vt = VulnType.create(:name => vtname, :label => vtlabel, :cwe_mapping => vtcwe, :priority => vtpriority, :html => vthtml, :enabled => true, :enabledRTs => newRts, :enabledSections => vtenabled)
916+
end
917+
918+
redirect "/admin/vulntypes/"
919+
end
920+
786921
get '/admin/vulntypes/:vtid/?' do
787922
@vt = VulnType.get(params[:vtid])
788923
if(@vt.nil?)

‎version.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ class Vulnreport
99
module VERSION
1010
MAJOR = 3
1111
MINOR = 0
12-
PATCH = 2
12+
PATCH = 3
1313
PRE = nil
1414

1515
STRING = [MAJOR,MINOR,PATCH,PRE].compact.join(".")

‎views/admin_types_nav_partial.erb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<div class="row" style="margin-top:-10px; margin-bottom:20px;">
22
<div class="col-lg-12">
33
<ul class="nav nav-tabs">
4-
<li role="presentation" <% if request.path_info == "/admin/vulntypes" %>class="active"<% end %>><a href="/admin/vulntypes"><i class="fa fa-wrench"></i> Vulntypes</a></li>
4+
<li role="presentation" <% if request.path_info.start_with?("/admin/vulntypes") %>class="active"<% end %>><a href="/admin/vulntypes"><i class="fa fa-wrench"></i> Vulntypes</a></li>
55
<li role="presentation" <% if request.path_info == "/admin/customVTs" %>class="active"<% end %>><a href="/admin/customVTs"><i class="fa fa-asterisk"></i> Custom Vulntypes</a></li>
66
<li role="presentation" <% if request.path_info == "/admin/recordTypes" %>class="active"<% end %>><a href="/admin/recordTypes"><i class="fa fa-cubes"></i> Record Types</a></li>
77
<li role="presentation" <% if request.path_info == "/admin/flags" %>class="active"<% end %>><a href="/admin/flags"><i class="fa fa-flag"></i> App Flags</a></li>

‎views/admin_vt_import.erb

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
<%= erb :header_partial %>
2+
3+
<div class="row">
4+
<div class="col-lg-12">
5+
<h1>VulnTypes <small>Administration</small></h1>
6+
<ol class="breadcrumb">
7+
<li><a href="/admin/settings"><i class="fa fa-cog"></i> Vulnreport Settings</a></li>
8+
<li><a href="/admin/vulntypes"><i class="fa fa-wrench"></i> VulnTypes</a></li>
9+
<li class="active"><i class="fa fa-wrench"></i> Import</li>
10+
</ol>
11+
</div>
12+
</div><!-- /.row -->
13+
14+
<%= erb :admin_types_nav_partial %>
15+
16+
<div class="row">
17+
<div class="col-lg-1"></div>
18+
<div class="col-lg-6">
19+
<p>
20+
To import Vulntypes (exported from another Vulnreport system or provided via the <a href="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/salesforce/vulnreport" target="_blank">Vulnreport GitHub repo</a>) select the XML file to upload below.
21+
</p>
22+
</div>
23+
</div>
24+
25+
<div class="row">
26+
<div class="col-lg-2"></div>
27+
<div class="col-lg-3" style="text-align:center;">
28+
<form action="/admin/vulntypes/import" method="POST" enctype="multipart/form-data">
29+
<%=csrf_tag%>
30+
<input type="file" class="form-control" name="vt_import" placeholder="Vulntypes XML File">
31+
<button type="submit" class="btn btn-default" style="margin-top:12px;">Import Vulntypes</button>
32+
</form>
33+
</div>
34+
</div>
35+
36+
<%= erb :footer_partial %>

‎views/admin_vt_import_confirm.erb

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
<%= erb :header_partial %>
2+
3+
<script type="text/javascript">
4+
$(function() {
5+
$("#rt-multiselect").multiSelect({
6+
selectableHeader: "<div class='msHeader'>Available RecordTypes</div>",
7+
selectionHeader: "<div class='msHeader'>Selected RecordTypes</div>",
8+
});
9+
});
10+
</script>
11+
12+
<div class="row">
13+
<div class="col-lg-12">
14+
<h1>VulnTypes <small>Administration</small></h1>
15+
<ol class="breadcrumb">
16+
<li><a href="/admin/settings"><i class="fa fa-cog"></i> Vulnreport Settings</a></li>
17+
<li><a href="/admin/vulntypes"><i class="fa fa-wrench"></i> VulnTypes</a></li>
18+
<li class="active"><i class="fa fa-wrench"></i> Import</li>
19+
</ol>
20+
</div>
21+
</div><!-- /.row -->
22+
23+
<%= erb :admin_types_nav_partial %>
24+
25+
<div class="row">
26+
<div class="col-lg-1"></div>
27+
<div class="col-lg-6">
28+
<p>
29+
Confirm which Vulntypes you'd like to import from the uploaded XML.
30+
</p>
31+
</div>
32+
</div>
33+
34+
<form action="/admin/vulntypes/doImport" method="POST">
35+
<%=csrf_tag%>
36+
<% @vts.each_with_index do |vt, idx| %>
37+
<div class="row" id="vt_<%=idx%>">
38+
<div class="col-lg-1"></div>
39+
<div class="col-lg-10">
40+
<input type="checkbox" name="vt_confirms[]" id="vt_confirm_<%=idx%>" value="<%=idx%>" checked> <%=h(vt[:name])%>
41+
<input type="hidden" name="vt_name_<%=idx%>" value="<%=h(vt[:name])%>" />
42+
<input type="hidden" name="vt_label_<%=idx%>" value="<%=h(vt[:label])%>" />
43+
<input type="hidden" name="vt_cwe_<%=idx%>" value="<%=h(vt[:cwe])%>" />
44+
<input type="hidden" name="vt_priority_<%=idx%>" value="<%=h(vt[:priority])%>" />
45+
<input type="hidden" name="vt_enabled_<%=idx%>" value="<%=h(vt[:enabled])%>" />
46+
<input type="hidden" name="vt_html_<%=idx%>" value="<%=h(vt[:html])%>" />
47+
</div>
48+
<div class="col-lg-1"></div>
49+
</div>
50+
<% end %>
51+
52+
<div class="row">
53+
<div class="col-lg-1"></div>
54+
<div class="col-lg-10">
55+
<hr />
56+
<h4 style="margin-top:-20px; margin-left:40px; margin-bottom:20px; color:#999;">
57+
App Record Types
58+
<small style="font-size:6pt;">Select which Record Types imported Vulntypes should be available on</small>
59+
</h4>
60+
61+
<div class="form-group">
62+
<div class="col-sm-2"></div>
63+
<div class="col-sm-6">
64+
<select multiple="multiple" id="rt-multiselect" name="rtms[]" rel="jqms">
65+
<% @appRecordTypes.each do |rt| %>
66+
<option value="<%=rt.id%>"><%=h(rt.name)%></option>
67+
<% end %>
68+
</select>
69+
</div>
70+
</div>
71+
</div>
72+
<div class="col-lg-1"></div>
73+
</div>
74+
75+
<div class="row">
76+
<div class="col-lg-4"></div>
77+
<div class="col-lg-7">
78+
<button type="submit" class="btn btn-success" style="margin:20px;">Import Vulntypes</button>
79+
</div>
80+
<div class="col-lg-1"></div>
81+
</div>
82+
</form>
83+
84+
<%= erb :footer_partial %>

‎views/admin_vts.erb

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,9 @@
1818
<div class="panel-heading">
1919
<span style="font-size:12pt;"><i class="fa fa-wrench"></i> VulnTypes</span>
2020
<span style="position:absolute;right:25px;">
21-
<a href="/admin/vulntypes/new" style="color:#FFF;"><i class="fa fa-plus"></i> New VulnType</a>
21+
<a href="/admin/vulntypes/new" style="color:#FFF;"><i class="fa fa-plus"></i> New Vulntype</a>
22+
<a href="/admin/vulntypes/export"><button type="button" class="btn btn-xs btn-info" style="margin-left:6px;">Export Vulntypes</button></a>
23+
<a href="/admin/vulntypes/import"><button type="button" class="btn btn-xs btn-info" style="margin-left:6px;">Import Vulntypes</button></a>
2224
</span>
2325
</div>
2426
<div class="panel-body">

0 commit comments

Comments
 (0)