farol/farol: farol/vulnerability.py annotate

author	Benoît Allard <benoit.allard@greenbone.net>
date	Wed, 24 Sep 2014 10:07:49 +0200
parents
children	fbc413b8a46e

rev	line source
0 4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	1 # -- encoding: utf-8 --
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	2 # Description:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	3 # Web stuff related to the Vulnerabilities
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	4 #
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	5 # Authors:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	6 # Benoît Allard <benoit.allard@greenbone.net>
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	7 #
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	8 # Copyright:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	9 # Copyright (C) 2014 Greenbone Networks GmbH
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	10 #
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	11 # This program is free software; you can redistribute it and/or
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	12 # modify it under the terms of the GNU General Public License
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	13 # as published by the Free Software Foundation; either version 2
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	14 # of the License, or (at your option) any later version.
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	15 #
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	16 # This program is distributed in the hope that it will be useful,
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	17 # but WITHOUT ANY WARRANTY; without even the implied warranty of
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	18 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	19 # GNU General Public License for more details.
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	20 #
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	21 # You should have received a copy of the GNU General Public License
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	22 # along with this program; if not, write to the Free Software
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	23 # Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	24
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	25 from flask import (Blueprint, render_template, abort, redirect, request,
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	26 url_for)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	27
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	28 from farolluz.parsers.cvrf import parseDate
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	29 from farolluz.cvrf import (CVRFVulnerability, CVRFVulnerabilityID, CVRFNote,
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	30 CVRFReference, CVRFAcknowledgment, CVRFCWE, CVRFInvolvement, CVRFThreat,
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	31 CVRFProductStatus, CVRFCVSSSet, CVRFRemediation)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	32 from farolluz.renderer import utcnow
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	33
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	34 from .session import document_required, get_current
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	35
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	36
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	37 vulnerability = Blueprint('vulnerability', __name__)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	38
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	39 def get_vuln(ordinal):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	40 for vulnerability in get_current()._vulnerabilities:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	41 if vulnerability._ordinal != ordinal:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	42 continue
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	43 return vulnerability
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	44 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	45
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	46 def vuln_from_form(form, vuln=None):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	47 if vuln is None:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	48 vuln = CVRFVulnerability(int(form['ordinal']))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	49 else:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	50 vuln._ordinal = int(form['ordinal'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	51 vuln.setTitle(form['title'] or None)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	52 vuln_id = None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	53 if form['systemname'] or form['id_value']:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	54 vuln_id = CVRFVulnerabilityID(form['systemname'], form['id_value'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	55 vuln.setID(vuln_id)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	56 date = None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	57 if form['discoverydate']:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	58 date = parseDate(form['discoverydate'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	59 vuln.setDiscoveryDate(date)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	60 date = None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	61 if form['releasedate']:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	62 date = parseDate(form['releasedate'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	63 vuln.setReleaseDate(date)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	64 vuln.setCVE(request.form['cve'] or None)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	65 return vuln
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	66
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	67 def get_groups():
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	68 """ Return a list of tuple suitable for selectinput2 """
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	69 cvrf = get_current()
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	70 groups = []
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	71 if cvrf._producttree is not None:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	72 groups = [(g.getTitle(), g._groupid) for g in cvrf._producttree._groups]
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	73 return groups
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	74
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	75 @vulnerability.route('/<int:ordinal>')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	76 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	77 def view(ordinal):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	78 return render_template('vulnerability/view.j2', vulnerability=get_vuln(ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	79
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	80 @vulnerability.route('/<int:ordinal>/edit', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	81 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	82 def edit(ordinal):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	83 vuln = get_vuln(ordinal)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	84 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	85 return render_template('vulnerability/edit.j2', vulnerability=vuln, now=utcnow())
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	86
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	87 vuln_from_form(request.form, vuln)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	88 return redirect(url_for('.view', ordinal=vuln._ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	89
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	90 @vulnerability.route('/add', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	91 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	92 def add():
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	93 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	94 next_ordinal=1
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	95 vulns = get_current()._vulnerabilities
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	96 if vulns:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	97 next_ordinal = vulns[-1]._ordinal + 1
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	98 vuln = CVRFVulnerability(next_ordinal)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	99 return render_template('vulnerability/edit.j2', vulnerability=vuln, now=utcnow(), action='Add')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	100
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	101 vuln=vuln_from_form(request.form)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	102 get_current().addVulnerability(vuln)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	103 return redirect(url_for('.view', ordinal=vuln._ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	104
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	105 @vulnerability.route('/<int:ordinal>/note/<int:note_ordinal>')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	106 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	107 def view_note(ordinal, note_ordinal):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	108 for note in get_vuln(ordinal)._notes:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	109 if note._ordinal != note_ordinal:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	110 continue
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	111 return render_template('vulnerability/view_note.j2', note=note, ordinal=ordinal)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	112 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	113
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	114 @vulnerability.route('/<int:ordinal>/note/<int:note_ordinal>/edit', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	115 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	116 def edit_note(ordinal, note_ordinal):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	117 note = None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	118 for n in get_vuln(ordinal)._notes:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	119 if n._ordinal == note_ordinal:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	120 note = n
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	121 break
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	122 if note is None:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	123 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	124 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	125 return render_template('vulnerability/edit_note.j2', note=note, ordinal=ordinal, types=note.TYPES)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	126
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	127 note._type = request.form['type']
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	128 note._ordinal = int(request.form['ordinal'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	129 note._note = request.form['note']
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	130 note._title = request.form['title'] or None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	131 note._audience = request.form['audience'] or None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	132 return redirect(url_for('.view_note', ordinal=ordinal, note_ordinal=note._ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	133
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	134 @vulnerability.route('/<int:ordinal>/note/add', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	135 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	136 def add_note(ordinal):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	137 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	138 next_ordinal = 1
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	139 notes = get_vuln(ordinal)._notes
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	140 if notes:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	141 next_ordinal = notes[-1]._ordinal + 1
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	142 return render_template('vulnerability/edit_note.j2', ordinal=ordinal, note_ordinal=next_ordinal, types=CVRFNote.TYPES, action='Add')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	143
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	144 title = request.form['title'] or None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	145 audience = request.form['audience'] or None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	146
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	147 note = CVRFNote(request.form['type'], int(request.form['ordinal']), request.form['note'], title, audience)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	148 get_vuln(ordinal).addNote(note)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	149 return redirect(url_for('.view', ordinal=ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	150
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	151
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	152 @vulnerability.route('/<int:ordinal>/involvement/<int:index>')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	153 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	154 def view_involvement(ordinal, index):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	155 try:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	156 involvement = get_vuln(ordinal)._involvements[index]
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	157 except IndexError:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	158 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	159 return render_template('vulnerability/view_involvement.j2', involvement=involvement, ordinal=ordinal, index=index)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	160
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	161 @vulnerability.route('/<int:ordinal>/involvement/add', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	162 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	163 def add_involvement(ordinal):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	164 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	165 return render_template('vulnerability/edit_involvement.j2', ordinal=ordinal, parties=CVRFInvolvement.PARTIES, statuses=CVRFInvolvement.STATUSES, action='Add')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	166
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	167 inv = CVRFInvolvement(request.form['party'], request.form['status'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	168 inv._description = request.form['description'] or None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	169 get_vuln(ordinal).addInvolvement(inv)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	170 return redirect(url_for('.view', ordinal=ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	171
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	172
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	173 @vulnerability.route('/<int:ordinal>/involvement/<int:index>/edit', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	174 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	175 def edit_involvement(ordinal, index):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	176 try:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	177 involvement = get_vuln(ordinal)._involvements[index]
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	178 except IndexError:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	179 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	180 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	181 return render_template('vulnerability/edit_involvement.j2', ordinal=ordinal, index=index, party=involvement._party, status=involvement._status, description=involvement._description, parties=involvement.PARTIES, statuses=involvement.STATUSES)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	182
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	183 involvement._party = request.form['party']
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	184 involvement._status = request.form['status']
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	185 involvement._description = request.form['description'] or None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	186 return redirect(url_for('.view_involvement', ordinal=ordinal, index=index))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	187
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	188 @vulnerability.route('/<int:ordinal>/cwe/<int:index>/edit', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	189 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	190 def edit_cwe(ordinal, index):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	191 try:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	192 cwe = get_vuln(ordinal)._cwes[index]
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	193 except IndexError:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	194 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	195 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	196 return render_template('vulnerability/edit_cwe.j2', ordinal=ordinal, _id=cwe._id, description=cwe._value)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	197
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	198 cwe._id = request.form['id']
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	199 cwe._value = request.form['description']
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	200 return redirect(url_for('.view', ordinal=ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	201
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	202
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	203 @vulnerability.route('/<int:ordinal>/cwe/add', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	204 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	205 def add_cwe(ordinal):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	206 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	207 return render_template('vulnerability/edit_cwe.j2', ordinal=ordinal, action='Add')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	208
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	209 cwe = CVRFCWE(request.form['id'], request.form['description'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	210 get_vuln(ordinal).addCWE(cwe)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	211 return redirect(url_for('.view', ordinal=ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	212
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	213 @vulnerability.route('/<int:ordinal>/productstatus/<int:index>')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	214 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	215 def view_status(ordinal, index):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	216 try:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	217 status = get_vuln(ordinal)._productstatuses[index]
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	218 except IndexError:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	219 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	220 return render_template('vulnerability/view_productstatus.j2', ordinal=ordinal, index=index, status=status, cvrf=get_current())
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	221
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	222 @vulnerability.route('/<int:ordinal>/productstatus/add', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	223 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	224 def add_status(ordinal):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	225 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	226 return render_template('vulnerability/edit_productstatus.j2', ordinal=ordinal, statuses=CVRFProductStatus.TYPES, action='Add')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	227
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	228 status = CVRFProductStatus(request.form['status'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	229 for productid in request.form.getlist('products'):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	230 status.addProductID(productid)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	231 get_vuln(ordinal).addProductStatus(status)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	232 return redirect(url_for('.view', ordinal=ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	233
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	234
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	235 @vulnerability.route('/<int:ordinal>/productstatus/<int:index>/edit', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	236 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	237 def edit_status(ordinal, index):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	238 try:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	239 status = get_vuln(ordinal)._productstatuses[index]
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	240 except IndexError:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	241 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	242 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	243 return render_template('vulnerability/edit_productstatus.j2', ordinal=ordinal, index=index, status=status._type, productids=status._productids, statuses=status.TYPES)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	244
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	245 status._type = request.form['status']
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	246 status._productids = []
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	247 for productid in request.form.getlist('products'):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	248 status.addProductID(productid)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	249 return redirect(url_for('.view', ordinal=ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	250
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	251
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	252 @vulnerability.route('/<int:ordinal>/threat/<int:index>')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	253 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	254 def view_threat(ordinal, index):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	255 try:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	256 threat = get_vuln(ordinal)._threats[index]
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	257 except IndexError:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	258 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	259 return render_template('vulnerability/view_threat.j2', ordinal=ordinal, index=index, threat=threat, cvrf=get_current())
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	260
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	261 @vulnerability.route('/<int:ordinal>/threat/add', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	262 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	263 def add_threat(ordinal):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	264 cvrf = get_current()
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	265 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	266 return render_template('vulnerability/edit_threat.j2',
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	267 ordinal=ordinal,
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	268 types=CVRFThreat.TYPES, groups=get_groups(), now=utcnow(),
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	269 action='Add')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	270
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	271 threat = CVRFThreat(request.form['type'], request.form['description'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	272 if request.form['date']:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	273 threat.setDate(parseDate(request.form['date']))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	274 for productid in request.form.getlist('products'):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	275 threat.addProductID(productid)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	276 for groupid in request.form.getlist('groups'):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	277 threat.addGroupID(groupid)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	278 get_vuln(ordinal).addThreat(threat)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	279 return redirect(url_for('.view', ordinal=ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	280
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	281 @vulnerability.route('/<int:ordinal>/threat/<int:index>/edit', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	282 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	283 def edit_threat(ordinal, index):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	284 try:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	285 threat = get_vuln(ordinal)._threats[index]
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	286 except IndexError:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	287 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	288 cvrf = get_current()
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	289 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	290 return render_template('vulnerability/edit_threat.j2',
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	291 ordinal=ordinal, index=index,
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	292 type=threat._type, date=threat._date, description=threat._description, productids=threat._productids, groupids=threat._groupids,
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	293 types=threat.TYPES, groups=get_groups(), now=utcnow())
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	294
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	295 threat._type = request.form['type']
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	296 threat._description = request.form['description']
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	297 date = None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	298 if request.form['date']:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	299 date = parseDate(request.form['date'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	300 threat.setDate(date)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	301 threat._productids = []
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	302 threat._groupids = []
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	303 for productid in request.form.getlist('products'):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	304 threat.addProductID(productid)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	305 for groupid in request.form.getlist('groups'):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	306 threat.addGroupID(groupid)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	307 return redirect(url_for('.view', ordinal=ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	308
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	309
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	310 @vulnerability.route('/<int:ordinal>/cvss/<int:index>')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	311 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	312 def view_cvss(ordinal, index):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	313 try:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	314 cvss = get_vuln(ordinal)._cvsss[index]
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	315 except IndexError:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	316 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	317 return render_template('vulnerability/view_cvss.j2', ordinal=ordinal, index=index, cvss=cvss, cvrf=get_current())
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	318
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	319 @vulnerability.route('/<int:ordinal>/cvss/add', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	320 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	321 def add_cvss(ordinal):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	322 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	323 return render_template('vulnerability/edit_cvss.j2', ordinal=ordinal, action='Add')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	324
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	325 cvss = CVRFCVSSSet(float(request.form['basescore']))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	326 tscore = None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	327 if request.form['temporalscore']:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	328 tscore = float(request.form['temporalscore'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	329 cvss.setTemporalScore(tscore)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	330 escore = None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	331 if request.form['environmentalscore']:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	332 escore = float(request.form['environmentalscore'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	333 cvss.setEnvironmentalScore(escore)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	334 cvss.setVector(request.form['vector'] or None)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	335 get_vuln(ordinal).addCVSSSet(cvss)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	336 return redirect(url_for('.view', ordinal=ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	337
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	338
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	339 @vulnerability.route('/<int:ordinal>/cvss/<int:index>/edit', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	340 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	341 def edit_cvss(ordinal, index):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	342 try:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	343 cvss = get_vuln(ordinal)._cvsss[index]
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	344 except IndexError:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	345 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	346 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	347 return render_template('vulnerability/edit_cvss.j2',
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	348 ordinal=ordinal, index=index,
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	349 basescore=cvss._basescore, temporalscore=cvss._temporalscore, environmentalscore=cvss._environmentalscore, vector=cvss._vector)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	350
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	351 cvss._basescore = float(request.form['basescore'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	352 tscore = None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	353 if request.form['temporalscore']:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	354 tscore = float(request.form['temporalscore'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	355 cvss.setTemporalScore(tscore)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	356 escore = None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	357 if request.form['environmentalscore']:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	358 escore = float(request.form['environmentalscore'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	359 cvss.setEnvironmentalScore(escore)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	360 cvss.setVector(request.form['vector'] or None)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	361 return redirect(url_for('.view', ordinal=ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	362
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	363
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	364 @vulnerability.route('/<int:ordinal>/remediation/<int:index>')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	365 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	366 def view_remediation(ordinal, index):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	367 try:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	368 remediation = get_vuln(ordinal)._remediations[index]
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	369 except IndexError:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	370 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	371 return render_template('vulnerability/view_remediation.j2',
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	372 ordinal=ordinal, index=index,
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	373 remediation=remediation,
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	374 cvrf=get_current())
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	375
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	376 @vulnerability.route('/<int:ordinal>/remediation/add', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	377 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	378 def add_remediation(ordinal):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	379 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	380 return render_template('vulnerability/edit_remediation.j2',
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	381 ordinal=ordinal,
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	382 types=CVRFRemediation.TYPES, groups=get_groups(), now=utcnow(),
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	383 action='Add')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	384
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	385 remediation = CVRFRemediation(request.form['type'], request.form['description'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	386 if request.form['date']:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	387 remediation.setDate(parseDate(request.form['date']))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	388 if request.form['entitlement']:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	389 remediation.setEntitlement(request.form['entitlement'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	390 if request.form['url']:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	391 remediation.setURL(request.form['url'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	392 for productid in request.form.getlist('products'):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	393 remediation.addProductID(productid)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	394 for groupid in request.form.getlist('groups'):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	395 remediation.addGroupID(groupid)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	396 get_vuln(ordinal).addRemediation(remediation)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	397 return redirect(url_for('.view', ordinal=ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	398
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	399 @vulnerability.route('/<int:ordinal>/remediation/<int:index>/edit', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	400 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	401 def edit_remediation(ordinal, index):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	402 try:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	403 remediation = get_vuln(ordinal)._remediations[index]
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	404 except IndexError:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	405 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	406 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	407 return render_template('vulnerability/edit_remediation.j2',
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	408 ordinal=ordinal, index=index,
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	409 type=remediation._type, date=remediation._date, description=remediation._description, entitlement=remediation._entitlement, url=remediation._url, productids=remediation._productids, groupids=remediation._groupids,
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	410 types=remediation.TYPES, groups=get_groups(), now=utcnow())
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	411
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	412 remediation._type = request.form['type']
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	413 remediation._description = request.form['description']
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	414 date = None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	415 if request.form['date']:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	416 date = parseDate(request.form['date'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	417 remediation.setDate(date)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	418 remediation.setEntitlement(request.form['entitlement'] or None)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	419 remediation.setURL(request.form['url'] or None)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	420 remediation._productids = []
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	421 remediation._groupids = []
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	422 for productid in request.form.getlist('products'):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	423 remediation.addProductID(productid)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	424 for groupid in request.form.getlist('groups'):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	425 remediation.addGroupID(groupid)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	426 return redirect(url_for('.view', ordinal=ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	427
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	428
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	429 @vulnerability.route('/<int:ordinal>/reference/<int:index>/edit', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	430 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	431 def edit_reference(ordinal, index):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	432 try:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	433 reference = get_vuln(ordinal)._references[index]
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	434 except IndexError:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	435 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	436 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	437 return render_template('vulnerability/edit_reference.j2', ordinal=ordinal, _type=reference._type, url=reference._url, description=reference._description, types=('',) + reference.TYPES)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	438
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	439 reference._type = request.form['type'] or None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	440 reference._url = request.form['url']
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	441 reference._description = request.form['description']
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	442 return redirect(url_for('.view', ordinal=ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	443
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	444 @vulnerability.route('/<int:ordinal>/reference/add', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	445 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	446 def add_reference(ordinal):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	447 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	448 return render_template('vulnerability/edit_reference.j2', action='Add', ordinal=ordinal, types=('',) + CVRFReference.TYPES)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	449
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	450 ref = CVRFReference(request.form['url'], request.form['description'], request.form['type'] or None)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	451 get_vuln(ordinal).addReference(ref)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	452 return redirect(url_for('.view', ordinal=ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	453
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	454
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	455 @vulnerability.route('/<int:ordinal>/acknowledgment/<int:index>')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	456 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	457 def view_acknowledgment(ordinal, index):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	458 try:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	459 ack = get_vuln(ordinal)._acknowledgments[index]
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	460 except IndexError:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	461 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	462 return render_template('vulnerability/view_acknowledgment.j2', ordinal=ordinal, acknowledgment=ack, index=index, action='Update')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	463
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	464 @vulnerability.route('/<int:ordinal>/acknowledgment/<int:index>/edit', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	465 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	466 def edit_acknowledgment(ordinal, index):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	467 try:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	468 ack = get_vuln(ordinal)._acknowledgments[index]
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	469 except IndexError:
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	470 abort(404)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	471 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	472 return render_template('vulnerability/edit_acknowledgment.j2', ordinal=ordinal, name=ack._name, organization=ack._organization, description=ack._description, url=ack._url, action='Update')
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	473
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	474 ack._name = request.form['name'] or None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	475 ack._organization = request.form['organization'] or None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	476 ack._description = request.form['description'] or None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	477 ack._url = request.form['url'] or None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	478 return redirect(url_for('.view', ordinal=ordinal))
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	479
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	480 @vulnerability.route('/<int:ordinal>/acknowledgment/add', methods=['GET', 'POST'])
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	481 @document_required
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	482 def add_acknowledgment(ordinal):
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	483 if request.method != 'POST':
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	484 return render_template('vulnerability/edit_acknowledgment.j2', action='Add', ordinal=ordinal)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	485
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	486 ack = CVRFAcknowledgment()
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	487 ack._name = request.form['name'] or None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	488 ack._organization = request.form['organization'] or None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	489 ack._description = request.form['description'] or None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	490 ack._url = request.form['url'] or None
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	491 get_vuln(ordinal).addAcknowledgment(ack)
4a9f23230eba Initial Release Benoît Allard <benoit.allard@greenbone.net> parents: diff changeset	492 return redirect(url_for('.view', ordinal=ordinal))

0

4a9f23230eba Initial Release