Mercurial > farol > farol
annotate farol/vulnerability.py @ 95:0b64dc3f50eb
Add deletion of Remediations
| author | Benoît Allard <benoit.allard@greenbone.net> |
|---|---|
| date | Thu, 09 Oct 2014 16:26:55 +0200 |
| parents | 1ca989387aeb |
| children | 3848faa88cd5 |
| rev | line source |
|---|---|
| 0 | 1 # -*- encoding: utf-8 -*- |
| 2 # Description: | |
| 3 # Web stuff related to the Vulnerabilities | |
| 4 # | |
| 5 # Authors: | |
| 6 # Benoît Allard <benoit.allard@greenbone.net> | |
| 7 # | |
| 8 # Copyright: | |
| 9 # Copyright (C) 2014 Greenbone Networks GmbH | |
| 10 # | |
| 11 # This program is free software; you can redistribute it and/or | |
| 12 # modify it under the terms of the GNU General Public License | |
| 13 # as published by the Free Software Foundation; either version 2 | |
| 14 # of the License, or (at your option) any later version. | |
| 15 # | |
| 16 # This program is distributed in the hope that it will be useful, | |
| 17 # but WITHOUT ANY WARRANTY; without even the implied warranty of | |
| 18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
| 19 # GNU General Public License for more details. | |
| 20 # | |
| 21 # You should have received a copy of the GNU General Public License | |
| 22 # along with this program; if not, write to the Free Software | |
| 23 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. | |
| 24 | |
| 25 from flask import (Blueprint, render_template, abort, redirect, request, | |
| 26 url_for) | |
| 27 | |
| 28 from farolluz.parsers.cvrf import parseDate | |
| 29 from farolluz.cvrf import (CVRFVulnerability, CVRFVulnerabilityID, CVRFNote, | |
|
62
ce49bd1512dd
Make pyflafes a happier
Benoît Allard <benoit.allard@greenbone.net>
parents:
61
diff
changeset
|
30 CVRFReference, CVRFCWE, CVRFInvolvement, CVRFThreat, CVRFProductStatus, |
|
ce49bd1512dd
Make pyflafes a happier
Benoît Allard <benoit.allard@greenbone.net>
parents:
61
diff
changeset
|
31 CVRFCVSSSet, CVRFRemediation) |
| 0 | 32 from farolluz.renderer import utcnow |
| 33 | |
|
60
c6e7175ff28c
Unify acknowledgments update/creation from forms
Benoît Allard <benoit.allard@greenbone.net>
parents:
59
diff
changeset
|
34 from .controller import (update_note_from_request, create_note_from_request, |
|
61
55b72057b066
Unify reference update/creation from forms
Benoît Allard <benoit.allard@greenbone.net>
parents:
60
diff
changeset
|
35 update_reference_from_request, create_reference_from_request, |
|
60
c6e7175ff28c
Unify acknowledgments update/creation from forms
Benoît Allard <benoit.allard@greenbone.net>
parents:
59
diff
changeset
|
36 update_acknowledgment_from_request, create_acknowledgment_from_request) |
| 0 | 37 from .session import document_required, get_current |
| 38 | |
| 39 | |
| 40 vulnerability = Blueprint('vulnerability', __name__) | |
| 41 | |
| 42 def get_vuln(ordinal): | |
| 43 for vulnerability in get_current()._vulnerabilities: | |
| 44 if vulnerability._ordinal != ordinal: | |
| 45 continue | |
| 46 return vulnerability | |
| 47 abort(404) | |
| 48 | |
| 49 def vuln_from_form(form, vuln=None): | |
| 50 if vuln is None: | |
| 51 vuln = CVRFVulnerability(int(form['ordinal'])) | |
| 52 else: | |
| 53 vuln._ordinal = int(form['ordinal']) | |
| 54 vuln.setTitle(form['title'] or None) | |
| 55 vuln_id = None | |
| 56 if form['systemname'] or form['id_value']: | |
| 57 vuln_id = CVRFVulnerabilityID(form['systemname'], form['id_value']) | |
| 58 vuln.setID(vuln_id) | |
| 59 date = None | |
| 60 if form['discoverydate']: | |
| 61 date = parseDate(form['discoverydate']) | |
| 62 vuln.setDiscoveryDate(date) | |
| 63 date = None | |
| 64 if form['releasedate']: | |
| 65 date = parseDate(form['releasedate']) | |
| 66 vuln.setReleaseDate(date) | |
| 67 vuln.setCVE(request.form['cve'] or None) | |
| 68 return vuln | |
| 69 | |
| 70 def get_groups(): | |
| 71 """ Return a list of tuple suitable for selectinput2 """ | |
| 72 cvrf = get_current() | |
| 73 groups = [] | |
| 74 if cvrf._producttree is not None: | |
| 75 groups = [(g.getTitle(), g._groupid) for g in cvrf._producttree._groups] | |
| 76 return groups | |
| 77 | |
| 78 @vulnerability.route('/<int:ordinal>') | |
| 79 @document_required | |
| 80 def view(ordinal): | |
| 81 return render_template('vulnerability/view.j2', vulnerability=get_vuln(ordinal)) | |
| 82 | |
| 83 @vulnerability.route('/<int:ordinal>/edit', methods=['GET', 'POST']) | |
| 84 @document_required | |
| 85 def edit(ordinal): | |
| 86 vuln = get_vuln(ordinal) | |
| 87 if request.method != 'POST': | |
| 88 return render_template('vulnerability/edit.j2', vulnerability=vuln, now=utcnow()) | |
| 89 | |
| 90 vuln_from_form(request.form, vuln) | |
| 91 return redirect(url_for('.view', ordinal=vuln._ordinal)) | |
| 92 | |
| 93 @vulnerability.route('/add', methods=['GET', 'POST']) | |
| 94 @document_required | |
| 95 def add(): | |
| 96 if request.method != 'POST': | |
| 97 next_ordinal=1 | |
| 98 vulns = get_current()._vulnerabilities | |
| 99 if vulns: | |
| 100 next_ordinal = vulns[-1]._ordinal + 1 | |
| 101 vuln = CVRFVulnerability(next_ordinal) | |
| 102 return render_template('vulnerability/edit.j2', vulnerability=vuln, now=utcnow(), action='Add') | |
| 103 | |
| 104 vuln=vuln_from_form(request.form) | |
| 105 get_current().addVulnerability(vuln) | |
| 106 return redirect(url_for('.view', ordinal=vuln._ordinal)) | |
| 107 | |
| 108 @vulnerability.route('/<int:ordinal>/note/<int:note_ordinal>') | |
| 109 @document_required | |
| 110 def view_note(ordinal, note_ordinal): | |
|
59
64403f1b424e
Make use of the new getNote methods on CVRFVulnerability
Benoît Allard <benoit.allard@greenbone.net>
parents:
58
diff
changeset
|
111 note = get_vuln(ordinal).getNote(note_ordinal) |
|
64403f1b424e
Make use of the new getNote methods on CVRFVulnerability
Benoît Allard <benoit.allard@greenbone.net>
parents:
58
diff
changeset
|
112 if note is None: |
|
64403f1b424e
Make use of the new getNote methods on CVRFVulnerability
Benoît Allard <benoit.allard@greenbone.net>
parents:
58
diff
changeset
|
113 abort(404) |
|
64403f1b424e
Make use of the new getNote methods on CVRFVulnerability
Benoît Allard <benoit.allard@greenbone.net>
parents:
58
diff
changeset
|
114 return render_template('vulnerability/view_note.j2', note=note, ordinal=ordinal) |
| 0 | 115 |
| 116 @vulnerability.route('/<int:ordinal>/note/<int:note_ordinal>/edit', methods=['GET', 'POST']) | |
| 117 @document_required | |
| 118 def edit_note(ordinal, note_ordinal): | |
|
59
64403f1b424e
Make use of the new getNote methods on CVRFVulnerability
Benoît Allard <benoit.allard@greenbone.net>
parents:
58
diff
changeset
|
119 note = get_vuln(ordinal).getNote(note_ordinal) |
| 0 | 120 if note is None: |
| 121 abort(404) | |
| 122 if request.method != 'POST': | |
| 123 return render_template('vulnerability/edit_note.j2', note=note, ordinal=ordinal, types=note.TYPES) | |
| 124 | |
|
58
fbc413b8a46e
Unify note update/creation from forms
Benoît Allard <benoit.allard@greenbone.net>
parents:
0
diff
changeset
|
125 update_note_from_request(note) |
| 0 | 126 return redirect(url_for('.view_note', ordinal=ordinal, note_ordinal=note._ordinal)) |
| 127 | |
| 128 @vulnerability.route('/<int:ordinal>/note/add', methods=['GET', 'POST']) | |
| 129 @document_required | |
| 130 def add_note(ordinal): | |
| 131 if request.method != 'POST': | |
| 132 next_ordinal = 1 | |
| 133 notes = get_vuln(ordinal)._notes | |
| 134 if notes: | |
| 135 next_ordinal = notes[-1]._ordinal + 1 | |
| 136 return render_template('vulnerability/edit_note.j2', ordinal=ordinal, note_ordinal=next_ordinal, types=CVRFNote.TYPES, action='Add') | |
| 137 | |
|
58
fbc413b8a46e
Unify note update/creation from forms
Benoît Allard <benoit.allard@greenbone.net>
parents:
0
diff
changeset
|
138 note = create_note_from_request() |
| 0 | 139 get_vuln(ordinal).addNote(note) |
| 140 return redirect(url_for('.view', ordinal=ordinal)) | |
| 141 | |
|
89
e558238cfdb2
Add deletion of Vulnerabilities'Notes
Benoît Allard <benoit.allard@greenbone.net>
parents:
64
diff
changeset
|
142 @vulnerability.route('/<int:ordinal>/note/<int:note_ordinal>/del', methods=['POST']) |
|
e558238cfdb2
Add deletion of Vulnerabilities'Notes
Benoît Allard <benoit.allard@greenbone.net>
parents:
64
diff
changeset
|
143 @document_required |
|
e558238cfdb2
Add deletion of Vulnerabilities'Notes
Benoît Allard <benoit.allard@greenbone.net>
parents:
64
diff
changeset
|
144 def del_note(ordinal, note_ordinal): |
|
e558238cfdb2
Add deletion of Vulnerabilities'Notes
Benoît Allard <benoit.allard@greenbone.net>
parents:
64
diff
changeset
|
145 vuln = get_vuln(ordinal) |
|
e558238cfdb2
Add deletion of Vulnerabilities'Notes
Benoît Allard <benoit.allard@greenbone.net>
parents:
64
diff
changeset
|
146 note = vuln.getNote(ordinal) |
|
e558238cfdb2
Add deletion of Vulnerabilities'Notes
Benoît Allard <benoit.allard@greenbone.net>
parents:
64
diff
changeset
|
147 if note is None: |
|
e558238cfdb2
Add deletion of Vulnerabilities'Notes
Benoît Allard <benoit.allard@greenbone.net>
parents:
64
diff
changeset
|
148 flash('Note not found', 'danger') |
|
e558238cfdb2
Add deletion of Vulnerabilities'Notes
Benoît Allard <benoit.allard@greenbone.net>
parents:
64
diff
changeset
|
149 abort(404) |
|
e558238cfdb2
Add deletion of Vulnerabilities'Notes
Benoît Allard <benoit.allard@greenbone.net>
parents:
64
diff
changeset
|
150 vuln._notes.remove(note) |
|
e558238cfdb2
Add deletion of Vulnerabilities'Notes
Benoît Allard <benoit.allard@greenbone.net>
parents:
64
diff
changeset
|
151 return redirect(url_for('.view', ordinal=ordinal)) |
|
e558238cfdb2
Add deletion of Vulnerabilities'Notes
Benoît Allard <benoit.allard@greenbone.net>
parents:
64
diff
changeset
|
152 |
| 0 | 153 |
| 154 @vulnerability.route('/<int:ordinal>/involvement/<int:index>') | |
| 155 @document_required | |
| 156 def view_involvement(ordinal, index): | |
| 157 try: | |
| 158 involvement = get_vuln(ordinal)._involvements[index] | |
| 159 except IndexError: | |
| 160 abort(404) | |
| 161 return render_template('vulnerability/view_involvement.j2', involvement=involvement, ordinal=ordinal, index=index) | |
| 162 | |
| 163 @vulnerability.route('/<int:ordinal>/involvement/add', methods=['GET', 'POST']) | |
| 164 @document_required | |
| 165 def add_involvement(ordinal): | |
| 166 if request.method != 'POST': | |
| 167 return render_template('vulnerability/edit_involvement.j2', ordinal=ordinal, parties=CVRFInvolvement.PARTIES, statuses=CVRFInvolvement.STATUSES, action='Add') | |
| 168 | |
| 169 inv = CVRFInvolvement(request.form['party'], request.form['status']) | |
| 170 inv._description = request.form['description'] or None | |
| 171 get_vuln(ordinal).addInvolvement(inv) | |
| 172 return redirect(url_for('.view', ordinal=ordinal)) | |
| 173 | |
| 174 @vulnerability.route('/<int:ordinal>/involvement/<int:index>/edit', methods=['GET', 'POST']) | |
| 175 @document_required | |
| 176 def edit_involvement(ordinal, index): | |
| 177 try: | |
| 178 involvement = get_vuln(ordinal)._involvements[index] | |
| 179 except IndexError: | |
| 180 abort(404) | |
| 181 if request.method != 'POST': | |
| 182 return render_template('vulnerability/edit_involvement.j2', ordinal=ordinal, index=index, party=involvement._party, status=involvement._status, description=involvement._description, parties=involvement.PARTIES, statuses=involvement.STATUSES) | |
| 183 | |
| 184 involvement._party = request.form['party'] | |
| 185 involvement._status = request.form['status'] | |
| 186 involvement._description = request.form['description'] or None | |
| 187 return redirect(url_for('.view_involvement', ordinal=ordinal, index=index)) | |
| 188 | |
|
90
2201d0ea0bf3
Add deletion of Involvements
Benoît Allard <benoit.allard@greenbone.net>
parents:
89
diff
changeset
|
189 @vulnerability.route('/<int:ordinal>/involvement/<int:index>/del', methods=['POST']) |
|
2201d0ea0bf3
Add deletion of Involvements
Benoît Allard <benoit.allard@greenbone.net>
parents:
89
diff
changeset
|
190 @document_required |
|
2201d0ea0bf3
Add deletion of Involvements
Benoît Allard <benoit.allard@greenbone.net>
parents:
89
diff
changeset
|
191 def del_involvement(ordinal, index): |
|
2201d0ea0bf3
Add deletion of Involvements
Benoît Allard <benoit.allard@greenbone.net>
parents:
89
diff
changeset
|
192 invls = get_vuln(ordinal)._involvements |
|
2201d0ea0bf3
Add deletion of Involvements
Benoît Allard <benoit.allard@greenbone.net>
parents:
89
diff
changeset
|
193 if not ( 0 <= index < len(invls)): |
|
2201d0ea0bf3
Add deletion of Involvements
Benoît Allard <benoit.allard@greenbone.net>
parents:
89
diff
changeset
|
194 flash('Involvement not found', 'danger') |
|
2201d0ea0bf3
Add deletion of Involvements
Benoît Allard <benoit.allard@greenbone.net>
parents:
89
diff
changeset
|
195 abort(404) |
|
2201d0ea0bf3
Add deletion of Involvements
Benoît Allard <benoit.allard@greenbone.net>
parents:
89
diff
changeset
|
196 |
|
2201d0ea0bf3
Add deletion of Involvements
Benoît Allard <benoit.allard@greenbone.net>
parents:
89
diff
changeset
|
197 del invls[index] |
|
2201d0ea0bf3
Add deletion of Involvements
Benoît Allard <benoit.allard@greenbone.net>
parents:
89
diff
changeset
|
198 return redirect(url_for('.view', ordinal=ordinal)) |
|
2201d0ea0bf3
Add deletion of Involvements
Benoît Allard <benoit.allard@greenbone.net>
parents:
89
diff
changeset
|
199 |
|
2201d0ea0bf3
Add deletion of Involvements
Benoît Allard <benoit.allard@greenbone.net>
parents:
89
diff
changeset
|
200 |
| 0 | 201 @vulnerability.route('/<int:ordinal>/cwe/<int:index>/edit', methods=['GET', 'POST']) |
| 202 @document_required | |
| 203 def edit_cwe(ordinal, index): | |
| 204 try: | |
| 205 cwe = get_vuln(ordinal)._cwes[index] | |
| 206 except IndexError: | |
| 207 abort(404) | |
| 208 if request.method != 'POST': | |
| 209 return render_template('vulnerability/edit_cwe.j2', ordinal=ordinal, _id=cwe._id, description=cwe._value) | |
| 210 | |
| 211 cwe._id = request.form['id'] | |
| 212 cwe._value = request.form['description'] | |
| 213 return redirect(url_for('.view', ordinal=ordinal)) | |
| 214 | |
| 215 @vulnerability.route('/<int:ordinal>/cwe/add', methods=['GET', 'POST']) | |
| 216 @document_required | |
| 217 def add_cwe(ordinal): | |
| 218 if request.method != 'POST': | |
| 219 return render_template('vulnerability/edit_cwe.j2', ordinal=ordinal, action='Add') | |
| 220 | |
| 221 cwe = CVRFCWE(request.form['id'], request.form['description']) | |
| 222 get_vuln(ordinal).addCWE(cwe) | |
| 223 return redirect(url_for('.view', ordinal=ordinal)) | |
| 224 | |
|
91
6a61c02f2156
Add deletion of CWEs
Benoît Allard <benoit.allard@greenbone.net>
parents:
90
diff
changeset
|
225 @vulnerability.route('/<int:ordinal>/cwe/<int:index>/del', methods=['POST']) |
|
6a61c02f2156
Add deletion of CWEs
Benoît Allard <benoit.allard@greenbone.net>
parents:
90
diff
changeset
|
226 @document_required |
|
6a61c02f2156
Add deletion of CWEs
Benoît Allard <benoit.allard@greenbone.net>
parents:
90
diff
changeset
|
227 def del_cwe(ordinal, index): |
|
6a61c02f2156
Add deletion of CWEs
Benoît Allard <benoit.allard@greenbone.net>
parents:
90
diff
changeset
|
228 cwes = get_vuln(ordinal)._cwes |
|
6a61c02f2156
Add deletion of CWEs
Benoît Allard <benoit.allard@greenbone.net>
parents:
90
diff
changeset
|
229 if not ( 0 <= index < len(cwes)): |
|
6a61c02f2156
Add deletion of CWEs
Benoît Allard <benoit.allard@greenbone.net>
parents:
90
diff
changeset
|
230 flash('CWE not found', 'danger') |
|
6a61c02f2156
Add deletion of CWEs
Benoît Allard <benoit.allard@greenbone.net>
parents:
90
diff
changeset
|
231 abort(404) |
|
6a61c02f2156
Add deletion of CWEs
Benoît Allard <benoit.allard@greenbone.net>
parents:
90
diff
changeset
|
232 del cwes[index] |
|
6a61c02f2156
Add deletion of CWEs
Benoît Allard <benoit.allard@greenbone.net>
parents:
90
diff
changeset
|
233 return redirect(url_for('.view', ordinal=ordinal)) |
|
6a61c02f2156
Add deletion of CWEs
Benoît Allard <benoit.allard@greenbone.net>
parents:
90
diff
changeset
|
234 |
|
6a61c02f2156
Add deletion of CWEs
Benoît Allard <benoit.allard@greenbone.net>
parents:
90
diff
changeset
|
235 |
| 0 | 236 @vulnerability.route('/<int:ordinal>/productstatus/<int:index>') |
| 237 @document_required | |
| 238 def view_status(ordinal, index): | |
| 239 try: | |
| 240 status = get_vuln(ordinal)._productstatuses[index] | |
| 241 except IndexError: | |
| 242 abort(404) | |
| 243 return render_template('vulnerability/view_productstatus.j2', ordinal=ordinal, index=index, status=status, cvrf=get_current()) | |
| 244 | |
| 245 @vulnerability.route('/<int:ordinal>/productstatus/add', methods=['GET', 'POST']) | |
| 246 @document_required | |
| 247 def add_status(ordinal): | |
| 248 if request.method != 'POST': | |
| 249 return render_template('vulnerability/edit_productstatus.j2', ordinal=ordinal, statuses=CVRFProductStatus.TYPES, action='Add') | |
| 250 | |
| 251 status = CVRFProductStatus(request.form['status']) | |
| 252 for productid in request.form.getlist('products'): | |
| 253 status.addProductID(productid) | |
| 254 get_vuln(ordinal).addProductStatus(status) | |
| 255 return redirect(url_for('.view', ordinal=ordinal)) | |
| 256 | |
| 257 @vulnerability.route('/<int:ordinal>/productstatus/<int:index>/edit', methods=['GET', 'POST']) | |
| 258 @document_required | |
| 259 def edit_status(ordinal, index): | |
| 260 try: | |
| 261 status = get_vuln(ordinal)._productstatuses[index] | |
| 262 except IndexError: | |
| 263 abort(404) | |
| 264 if request.method != 'POST': | |
| 265 return render_template('vulnerability/edit_productstatus.j2', ordinal=ordinal, index=index, status=status._type, productids=status._productids, statuses=status.TYPES) | |
| 266 | |
| 267 status._type = request.form['status'] | |
| 268 status._productids = [] | |
| 269 for productid in request.form.getlist('products'): | |
| 270 status.addProductID(productid) | |
| 271 return redirect(url_for('.view', ordinal=ordinal)) | |
| 272 | |
|
92
33d6fd9a5e12
Add deletion of Product Statuses
Benoît Allard <benoit.allard@greenbone.net>
parents:
91
diff
changeset
|
273 @vulnerability.route('/<int:ordinal>/productstatus/<int:index>/del', methods=['POST']) |
|
33d6fd9a5e12
Add deletion of Product Statuses
Benoît Allard <benoit.allard@greenbone.net>
parents:
91
diff
changeset
|
274 @document_required |
|
33d6fd9a5e12
Add deletion of Product Statuses
Benoît Allard <benoit.allard@greenbone.net>
parents:
91
diff
changeset
|
275 def del_status(ordinal, index): |
|
33d6fd9a5e12
Add deletion of Product Statuses
Benoît Allard <benoit.allard@greenbone.net>
parents:
91
diff
changeset
|
276 statuses = get_vuln(ordinal)._productstatuses |
|
33d6fd9a5e12
Add deletion of Product Statuses
Benoît Allard <benoit.allard@greenbone.net>
parents:
91
diff
changeset
|
277 if not ( 0 <= index < len(statuses)): |
|
33d6fd9a5e12
Add deletion of Product Statuses
Benoît Allard <benoit.allard@greenbone.net>
parents:
91
diff
changeset
|
278 flash('Product Status not found', 'danger') |
|
33d6fd9a5e12
Add deletion of Product Statuses
Benoît Allard <benoit.allard@greenbone.net>
parents:
91
diff
changeset
|
279 abort(404) |
|
33d6fd9a5e12
Add deletion of Product Statuses
Benoît Allard <benoit.allard@greenbone.net>
parents:
91
diff
changeset
|
280 |
|
33d6fd9a5e12
Add deletion of Product Statuses
Benoît Allard <benoit.allard@greenbone.net>
parents:
91
diff
changeset
|
281 del statuses[index] |
|
33d6fd9a5e12
Add deletion of Product Statuses
Benoît Allard <benoit.allard@greenbone.net>
parents:
91
diff
changeset
|
282 return redirect(url_for('.view', ordinal=ordinal)) |
|
33d6fd9a5e12
Add deletion of Product Statuses
Benoît Allard <benoit.allard@greenbone.net>
parents:
91
diff
changeset
|
283 |
| 0 | 284 |
| 285 @vulnerability.route('/<int:ordinal>/threat/<int:index>') | |
| 286 @document_required | |
| 287 def view_threat(ordinal, index): | |
| 288 try: | |
| 289 threat = get_vuln(ordinal)._threats[index] | |
| 290 except IndexError: | |
| 291 abort(404) | |
| 292 return render_template('vulnerability/view_threat.j2', ordinal=ordinal, index=index, threat=threat, cvrf=get_current()) | |
| 293 | |
| 294 @vulnerability.route('/<int:ordinal>/threat/add', methods=['GET', 'POST']) | |
| 295 @document_required | |
| 296 def add_threat(ordinal): | |
| 297 if request.method != 'POST': | |
| 298 return render_template('vulnerability/edit_threat.j2', | |
| 299 ordinal=ordinal, | |
| 300 types=CVRFThreat.TYPES, groups=get_groups(), now=utcnow(), | |
| 301 action='Add') | |
| 302 | |
| 303 threat = CVRFThreat(request.form['type'], request.form['description']) | |
| 304 if request.form['date']: | |
| 305 threat.setDate(parseDate(request.form['date'])) | |
| 306 for productid in request.form.getlist('products'): | |
| 307 threat.addProductID(productid) | |
| 308 for groupid in request.form.getlist('groups'): | |
| 309 threat.addGroupID(groupid) | |
| 310 get_vuln(ordinal).addThreat(threat) | |
| 311 return redirect(url_for('.view', ordinal=ordinal)) | |
| 312 | |
| 313 @vulnerability.route('/<int:ordinal>/threat/<int:index>/edit', methods=['GET', 'POST']) | |
| 314 @document_required | |
| 315 def edit_threat(ordinal, index): | |
| 316 try: | |
| 317 threat = get_vuln(ordinal)._threats[index] | |
| 318 except IndexError: | |
| 319 abort(404) | |
| 320 if request.method != 'POST': | |
| 321 return render_template('vulnerability/edit_threat.j2', | |
| 322 ordinal=ordinal, index=index, | |
| 323 type=threat._type, date=threat._date, description=threat._description, productids=threat._productids, groupids=threat._groupids, | |
| 324 types=threat.TYPES, groups=get_groups(), now=utcnow()) | |
| 325 | |
| 326 threat._type = request.form['type'] | |
| 327 threat._description = request.form['description'] | |
| 328 date = None | |
| 329 if request.form['date']: | |
| 330 date = parseDate(request.form['date']) | |
| 331 threat.setDate(date) | |
| 332 threat._productids = [] | |
| 333 threat._groupids = [] | |
| 334 for productid in request.form.getlist('products'): | |
| 335 threat.addProductID(productid) | |
| 336 for groupid in request.form.getlist('groups'): | |
| 337 threat.addGroupID(groupid) | |
| 338 return redirect(url_for('.view', ordinal=ordinal)) | |
| 339 | |
|
93
8e72f31d7392
Add deletion of Threats
Benoît Allard <benoit.allard@greenbone.net>
parents:
92
diff
changeset
|
340 @vulnerability.route('/<int:ordinal>/threat/<int:index>/del', methods=['POST']) |
|
8e72f31d7392
Add deletion of Threats
Benoît Allard <benoit.allard@greenbone.net>
parents:
92
diff
changeset
|
341 @document_required |
|
8e72f31d7392
Add deletion of Threats
Benoît Allard <benoit.allard@greenbone.net>
parents:
92
diff
changeset
|
342 def del_threat(ordinal, index): |
|
8e72f31d7392
Add deletion of Threats
Benoît Allard <benoit.allard@greenbone.net>
parents:
92
diff
changeset
|
343 threats = get_vuln(ordinal)._threats |
|
8e72f31d7392
Add deletion of Threats
Benoît Allard <benoit.allard@greenbone.net>
parents:
92
diff
changeset
|
344 if not (0 <= index < len(threats)): |
|
8e72f31d7392
Add deletion of Threats
Benoît Allard <benoit.allard@greenbone.net>
parents:
92
diff
changeset
|
345 flash('Threat not found', 'danger') |
|
8e72f31d7392
Add deletion of Threats
Benoît Allard <benoit.allard@greenbone.net>
parents:
92
diff
changeset
|
346 abort(404) |
|
8e72f31d7392
Add deletion of Threats
Benoît Allard <benoit.allard@greenbone.net>
parents:
92
diff
changeset
|
347 |
|
8e72f31d7392
Add deletion of Threats
Benoît Allard <benoit.allard@greenbone.net>
parents:
92
diff
changeset
|
348 del threats[index] |
|
8e72f31d7392
Add deletion of Threats
Benoît Allard <benoit.allard@greenbone.net>
parents:
92
diff
changeset
|
349 return redirect(url_for('.view', ordinal=ordinal)) |
|
8e72f31d7392
Add deletion of Threats
Benoît Allard <benoit.allard@greenbone.net>
parents:
92
diff
changeset
|
350 |
| 0 | 351 |
| 352 @vulnerability.route('/<int:ordinal>/cvss/<int:index>') | |
| 353 @document_required | |
| 354 def view_cvss(ordinal, index): | |
| 355 try: | |
| 356 cvss = get_vuln(ordinal)._cvsss[index] | |
| 357 except IndexError: | |
| 358 abort(404) | |
| 359 return render_template('vulnerability/view_cvss.j2', ordinal=ordinal, index=index, cvss=cvss, cvrf=get_current()) | |
| 360 | |
| 361 @vulnerability.route('/<int:ordinal>/cvss/add', methods=['GET', 'POST']) | |
| 362 @document_required | |
| 363 def add_cvss(ordinal): | |
| 364 if request.method != 'POST': | |
| 365 return render_template('vulnerability/edit_cvss.j2', ordinal=ordinal, action='Add') | |
| 366 | |
| 367 cvss = CVRFCVSSSet(float(request.form['basescore'])) | |
| 368 tscore = None | |
| 369 if request.form['temporalscore']: | |
| 370 tscore = float(request.form['temporalscore']) | |
| 371 cvss.setTemporalScore(tscore) | |
| 372 escore = None | |
| 373 if request.form['environmentalscore']: | |
| 374 escore = float(request.form['environmentalscore']) | |
| 375 cvss.setEnvironmentalScore(escore) | |
| 376 cvss.setVector(request.form['vector'] or None) | |
| 377 get_vuln(ordinal).addCVSSSet(cvss) | |
| 378 return redirect(url_for('.view', ordinal=ordinal)) | |
| 379 | |
| 380 @vulnerability.route('/<int:ordinal>/cvss/<int:index>/edit', methods=['GET', 'POST']) | |
| 381 @document_required | |
| 382 def edit_cvss(ordinal, index): | |
| 383 try: | |
| 384 cvss = get_vuln(ordinal)._cvsss[index] | |
| 385 except IndexError: | |
| 386 abort(404) | |
| 387 if request.method != 'POST': | |
| 388 return render_template('vulnerability/edit_cvss.j2', | |
| 389 ordinal=ordinal, index=index, | |
| 390 basescore=cvss._basescore, temporalscore=cvss._temporalscore, environmentalscore=cvss._environmentalscore, vector=cvss._vector) | |
| 391 | |
| 392 cvss._basescore = float(request.form['basescore']) | |
| 393 tscore = None | |
| 394 if request.form['temporalscore']: | |
| 395 tscore = float(request.form['temporalscore']) | |
| 396 cvss.setTemporalScore(tscore) | |
| 397 escore = None | |
| 398 if request.form['environmentalscore']: | |
| 399 escore = float(request.form['environmentalscore']) | |
| 400 cvss.setEnvironmentalScore(escore) | |
| 401 cvss.setVector(request.form['vector'] or None) | |
| 402 return redirect(url_for('.view', ordinal=ordinal)) | |
| 403 | |
|
94
1ca989387aeb
Add deletion of CVSS
Benoît Allard <benoit.allard@greenbone.net>
parents:
93
diff
changeset
|
404 @vulnerability.route('/<int:ordinal>/cvss/<int:index>/del', methods=['POST']) |
|
1ca989387aeb
Add deletion of CVSS
Benoît Allard <benoit.allard@greenbone.net>
parents:
93
diff
changeset
|
405 @document_required |
|
1ca989387aeb
Add deletion of CVSS
Benoît Allard <benoit.allard@greenbone.net>
parents:
93
diff
changeset
|
406 def del_cvss(ordinal, index): |
|
1ca989387aeb
Add deletion of CVSS
Benoît Allard <benoit.allard@greenbone.net>
parents:
93
diff
changeset
|
407 cvsss = get_vuln(ordinal)._cvsss |
|
1ca989387aeb
Add deletion of CVSS
Benoît Allard <benoit.allard@greenbone.net>
parents:
93
diff
changeset
|
408 if not ( 0 <= index < len(cvsss)): |
|
1ca989387aeb
Add deletion of CVSS
Benoît Allard <benoit.allard@greenbone.net>
parents:
93
diff
changeset
|
409 flash('CVSS not found', 'danger') |
|
1ca989387aeb
Add deletion of CVSS
Benoît Allard <benoit.allard@greenbone.net>
parents:
93
diff
changeset
|
410 abort(404) |
|
1ca989387aeb
Add deletion of CVSS
Benoît Allard <benoit.allard@greenbone.net>
parents:
93
diff
changeset
|
411 |
|
1ca989387aeb
Add deletion of CVSS
Benoît Allard <benoit.allard@greenbone.net>
parents:
93
diff
changeset
|
412 del cvsss[index] |
|
1ca989387aeb
Add deletion of CVSS
Benoît Allard <benoit.allard@greenbone.net>
parents:
93
diff
changeset
|
413 return redirect(url_for('.view', ordinal=ordinal)) |
|
1ca989387aeb
Add deletion of CVSS
Benoît Allard <benoit.allard@greenbone.net>
parents:
93
diff
changeset
|
414 |
| 0 | 415 |
| 416 @vulnerability.route('/<int:ordinal>/remediation/<int:index>') | |
| 417 @document_required | |
| 418 def view_remediation(ordinal, index): | |
| 419 try: | |
| 420 remediation = get_vuln(ordinal)._remediations[index] | |
| 421 except IndexError: | |
| 422 abort(404) | |
| 423 return render_template('vulnerability/view_remediation.j2', | |
| 424 ordinal=ordinal, index=index, | |
| 425 remediation=remediation, | |
| 426 cvrf=get_current()) | |
| 427 | |
| 428 @vulnerability.route('/<int:ordinal>/remediation/add', methods=['GET', 'POST']) | |
| 429 @document_required | |
| 430 def add_remediation(ordinal): | |
| 431 if request.method != 'POST': | |
| 432 return render_template('vulnerability/edit_remediation.j2', | |
| 433 ordinal=ordinal, | |
| 434 types=CVRFRemediation.TYPES, groups=get_groups(), now=utcnow(), | |
| 435 action='Add') | |
| 436 | |
| 437 remediation = CVRFRemediation(request.form['type'], request.form['description']) | |
| 438 if request.form['date']: | |
| 439 remediation.setDate(parseDate(request.form['date'])) | |
| 440 if request.form['entitlement']: | |
| 441 remediation.setEntitlement(request.form['entitlement']) | |
| 442 if request.form['url']: | |
| 443 remediation.setURL(request.form['url']) | |
| 444 for productid in request.form.getlist('products'): | |
| 445 remediation.addProductID(productid) | |
| 446 for groupid in request.form.getlist('groups'): | |
| 447 remediation.addGroupID(groupid) | |
| 448 get_vuln(ordinal).addRemediation(remediation) | |
| 449 return redirect(url_for('.view', ordinal=ordinal)) | |
| 450 | |
| 451 @vulnerability.route('/<int:ordinal>/remediation/<int:index>/edit', methods=['GET', 'POST']) | |
| 452 @document_required | |
| 453 def edit_remediation(ordinal, index): | |
| 454 try: | |
| 455 remediation = get_vuln(ordinal)._remediations[index] | |
| 456 except IndexError: | |
| 457 abort(404) | |
| 458 if request.method != 'POST': | |
| 459 return render_template('vulnerability/edit_remediation.j2', | |
| 460 ordinal=ordinal, index=index, | |
| 461 type=remediation._type, date=remediation._date, description=remediation._description, entitlement=remediation._entitlement, url=remediation._url, productids=remediation._productids, groupids=remediation._groupids, | |
| 462 types=remediation.TYPES, groups=get_groups(), now=utcnow()) | |
| 463 | |
| 464 remediation._type = request.form['type'] | |
| 465 remediation._description = request.form['description'] | |
| 466 date = None | |
| 467 if request.form['date']: | |
| 468 date = parseDate(request.form['date']) | |
| 469 remediation.setDate(date) | |
| 470 remediation.setEntitlement(request.form['entitlement'] or None) | |
| 471 remediation.setURL(request.form['url'] or None) | |
| 472 remediation._productids = [] | |
| 473 remediation._groupids = [] | |
| 474 for productid in request.form.getlist('products'): | |
| 475 remediation.addProductID(productid) | |
| 476 for groupid in request.form.getlist('groups'): | |
| 477 remediation.addGroupID(groupid) | |
| 478 return redirect(url_for('.view', ordinal=ordinal)) | |
| 479 | |
|
95
0b64dc3f50eb
Add deletion of Remediations
Benoît Allard <benoit.allard@greenbone.net>
parents:
94
diff
changeset
|
480 @vulnerability.route('/<int:ordinal>/remediation/<int:index>/del', methods=['POST']) |
|
0b64dc3f50eb
Add deletion of Remediations
Benoît Allard <benoit.allard@greenbone.net>
parents:
94
diff
changeset
|
481 @document_required |
|
0b64dc3f50eb
Add deletion of Remediations
Benoît Allard <benoit.allard@greenbone.net>
parents:
94
diff
changeset
|
482 def del_remediation(ordinal, index): |
|
0b64dc3f50eb
Add deletion of Remediations
Benoît Allard <benoit.allard@greenbone.net>
parents:
94
diff
changeset
|
483 rems = get_vuln(ordinal)._remediations |
|
0b64dc3f50eb
Add deletion of Remediations
Benoît Allard <benoit.allard@greenbone.net>
parents:
94
diff
changeset
|
484 if not ( 0 <= index < len(rems)): |
|
0b64dc3f50eb
Add deletion of Remediations
Benoît Allard <benoit.allard@greenbone.net>
parents:
94
diff
changeset
|
485 flash('Remediation not found', 'danger') |
|
0b64dc3f50eb
Add deletion of Remediations
Benoît Allard <benoit.allard@greenbone.net>
parents:
94
diff
changeset
|
486 abort(404) |
|
0b64dc3f50eb
Add deletion of Remediations
Benoît Allard <benoit.allard@greenbone.net>
parents:
94
diff
changeset
|
487 |
|
0b64dc3f50eb
Add deletion of Remediations
Benoît Allard <benoit.allard@greenbone.net>
parents:
94
diff
changeset
|
488 del rems[index] |
|
0b64dc3f50eb
Add deletion of Remediations
Benoît Allard <benoit.allard@greenbone.net>
parents:
94
diff
changeset
|
489 return redirect(url_for('.view', ordinal=ordinal)) |
|
0b64dc3f50eb
Add deletion of Remediations
Benoît Allard <benoit.allard@greenbone.net>
parents:
94
diff
changeset
|
490 |
| 0 | 491 |
| 492 @vulnerability.route('/<int:ordinal>/reference/<int:index>/edit', methods=['GET', 'POST']) | |
| 493 @document_required | |
| 494 def edit_reference(ordinal, index): | |
| 495 try: | |
| 496 reference = get_vuln(ordinal)._references[index] | |
| 497 except IndexError: | |
| 498 abort(404) | |
| 499 if request.method != 'POST': | |
| 500 return render_template('vulnerability/edit_reference.j2', ordinal=ordinal, _type=reference._type, url=reference._url, description=reference._description, types=('',) + reference.TYPES) | |
| 501 | |
|
61
55b72057b066
Unify reference update/creation from forms
Benoît Allard <benoit.allard@greenbone.net>
parents:
60
diff
changeset
|
502 update_reference_from_request(reference) |
| 0 | 503 return redirect(url_for('.view', ordinal=ordinal)) |
| 504 | |
| 505 @vulnerability.route('/<int:ordinal>/reference/add', methods=['GET', 'POST']) | |
| 506 @document_required | |
| 507 def add_reference(ordinal): | |
| 508 if request.method != 'POST': | |
| 509 return render_template('vulnerability/edit_reference.j2', action='Add', ordinal=ordinal, types=('',) + CVRFReference.TYPES) | |
| 510 | |
|
61
55b72057b066
Unify reference update/creation from forms
Benoît Allard <benoit.allard@greenbone.net>
parents:
60
diff
changeset
|
511 ref = create_reference_from_request() |
| 0 | 512 get_vuln(ordinal).addReference(ref) |
| 513 return redirect(url_for('.view', ordinal=ordinal)) | |
| 514 | |
| 515 | |
| 516 @vulnerability.route('/<int:ordinal>/acknowledgment/<int:index>') | |
| 517 @document_required | |
| 518 def view_acknowledgment(ordinal, index): | |
| 519 try: | |
| 520 ack = get_vuln(ordinal)._acknowledgments[index] | |
| 521 except IndexError: | |
| 522 abort(404) | |
|
64
aad7db3f93b6
Add support for Acknowledgments with multiple names and organizations
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
523 return render_template('vulnerability/view_acknowledgment.j2', |
|
aad7db3f93b6
Add support for Acknowledgments with multiple names and organizations
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
524 ordinal=ordinal, |
|
aad7db3f93b6
Add support for Acknowledgments with multiple names and organizations
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
525 acknowledgment=ack, index=index, |
|
aad7db3f93b6
Add support for Acknowledgments with multiple names and organizations
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
526 action='Update') |
| 0 | 527 |
| 528 @vulnerability.route('/<int:ordinal>/acknowledgment/<int:index>/edit', methods=['GET', 'POST']) | |
| 529 @document_required | |
| 530 def edit_acknowledgment(ordinal, index): | |
| 531 try: | |
| 532 ack = get_vuln(ordinal)._acknowledgments[index] | |
| 533 except IndexError: | |
| 534 abort(404) | |
| 535 if request.method != 'POST': | |
|
64
aad7db3f93b6
Add support for Acknowledgments with multiple names and organizations
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
536 return render_template('vulnerability/edit_acknowledgment.j2', |
|
aad7db3f93b6
Add support for Acknowledgments with multiple names and organizations
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
537 ordinal=ordinal, |
|
aad7db3f93b6
Add support for Acknowledgments with multiple names and organizations
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
538 names=ack._names, organizations=ack._organizations, |
|
aad7db3f93b6
Add support for Acknowledgments with multiple names and organizations
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
539 description=ack._description, url=ack._url, |
|
aad7db3f93b6
Add support for Acknowledgments with multiple names and organizations
Benoît Allard <benoit.allard@greenbone.net>
parents:
62
diff
changeset
|
540 action='Update') |
| 0 | 541 |
|
60
c6e7175ff28c
Unify acknowledgments update/creation from forms
Benoît Allard <benoit.allard@greenbone.net>
parents:
59
diff
changeset
|
542 update_acknowledgment_from_request(ack) |
| 0 | 543 return redirect(url_for('.view', ordinal=ordinal)) |
| 544 | |
| 545 @vulnerability.route('/<int:ordinal>/acknowledgment/add', methods=['GET', 'POST']) | |
| 546 @document_required | |
| 547 def add_acknowledgment(ordinal): | |
| 548 if request.method != 'POST': | |
| 549 return render_template('vulnerability/edit_acknowledgment.j2', action='Add', ordinal=ordinal) | |
| 550 | |
|
60
c6e7175ff28c
Unify acknowledgments update/creation from forms
Benoît Allard <benoit.allard@greenbone.net>
parents:
59
diff
changeset
|
551 ack = create_acknowledgment_from_request() |
| 0 | 552 get_vuln(ordinal).addAcknowledgment(ack) |
| 553 return redirect(url_for('.view', ordinal=ordinal)) |