Skip to content

Commit ebfc4e3

Browse files
MaffoochMaffooch
authored
Finding List Fixes + Finding Template Permission Fixes (DefectDojo#7997)
* Finding List Fixes + Finding Template Permission Fixes * Fix Flake8 + AccessLint * Correct accesslint * Add trans tags * Fix missing tag issue
1 parent 63a45f0 commit ebfc4e3

20 files changed

+2135
-1444
lines changed

‎dojo/authorization/roles_permissions.py‎

Lines changed: 79 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -134,79 +134,135 @@ def has_value(cls, value):
134134

135135
@classmethod
136136
def get_engagement_permissions(cls):
137-
return {Permissions.Engagement_View, Permissions.Engagement_Edit,
138-
Permissions.Engagement_Delete, Permissions.Risk_Acceptance,
139-
Permissions.Test_Add, Permissions.Import_Scan_Result, Permissions.Note_Add,
140-
Permissions.Note_Delete, Permissions.Note_Edit, Permissions.Note_View_History} \
137+
return {
138+
Permissions.Engagement_View,
139+
Permissions.Engagement_Edit,
140+
Permissions.Engagement_Delete,
141+
Permissions.Risk_Acceptance,
142+
Permissions.Test_Add,
143+
Permissions.Import_Scan_Result,
144+
Permissions.Note_Add,
145+
Permissions.Note_Delete,
146+
Permissions.Note_Edit,
147+
Permissions.Note_View_History} \
141148
.union(cls.get_test_permissions())
142149

143150
@classmethod
144151
def get_test_permissions(cls):
145-
return {Permissions.Test_View, Permissions.Test_Edit, Permissions.Test_Delete,
146-
Permissions.Finding_Add, Permissions.Import_Scan_Result, Permissions.Note_Add,
147-
Permissions.Note_Delete, Permissions.Note_Edit, Permissions.Note_View_History} \
152+
return {
153+
Permissions.Test_View,
154+
Permissions.Test_Edit,
155+
Permissions.Test_Delete,
156+
Permissions.Finding_Add,
157+
Permissions.Import_Scan_Result,
158+
Permissions.Note_Add,
159+
Permissions.Note_Delete,
160+
Permissions.Note_Edit,
161+
Permissions.Note_View_History} \
148162
.union(cls.get_finding_permissions())
149163

150164
@classmethod
151165
def get_finding_permissions(cls):
152-
return {Permissions.Finding_View, Permissions.Finding_Edit, Permissions.Import_Scan_Result,
153-
Permissions.Finding_Delete, Permissions.Risk_Acceptance, Permissions.Note_Add,
154-
Permissions.Note_Delete, Permissions.Note_Edit, Permissions.Note_View_History} \
166+
return {
167+
Permissions.Finding_View,
168+
Permissions.Finding_Edit,
169+
Permissions.Finding_Add,
170+
Permissions.Import_Scan_Result,
171+
Permissions.Finding_Delete,
172+
Permissions.Note_Add,
173+
Permissions.Risk_Acceptance,
174+
Permissions.Note_Delete,
175+
Permissions.Note_Edit,
176+
Permissions.Note_View_History} \
155177
.union(cls.get_finding_group_permissions())
156178

157179
@classmethod
158180
def get_finding_group_permissions(cls):
159-
return {Permissions.Finding_Group_View, Permissions.Finding_Group_Edit,
181+
return {
182+
Permissions.Finding_Group_View,
183+
Permissions.Finding_Group_Edit,
160184
Permissions.Finding_Group_Delete}
161185

162186
@classmethod
163187
def get_endpoint_permissions(cls):
164-
return {Permissions.Endpoint_View, Permissions.Endpoint_Edit, Permissions.Endpoint_Delete}
188+
return {
189+
Permissions.Endpoint_View,
190+
Permissions.Endpoint_Edit,
191+
Permissions.Endpoint_Delete}
165192

166193
@classmethod
167194
def get_product_member_permissions(cls):
168-
return {Permissions.Product_View, Permissions.Product_Manage_Members,
195+
return {
196+
Permissions.Product_View,
197+
Permissions.Product_Manage_Members,
169198
Permissions.Product_Member_Delete}
170199

171200
@classmethod
172201
def get_product_type_member_permissions(cls):
173-
return {Permissions.Product_Type_View, Permissions.Product_Type_Manage_Members,
202+
return {
203+
Permissions.Product_Type_View,
204+
Permissions.Product_Type_Manage_Members,
174205
Permissions.Product_Type_Member_Delete}
175206

176207
@classmethod
177208
def get_product_group_permissions(cls):
178-
return {Permissions.Product_Group_View, Permissions.Product_Group_Edit,
209+
return {
210+
Permissions.Product_Group_View,
211+
Permissions.Product_Group_Edit,
179212
Permissions.Product_Group_Delete}
180213

181214
@classmethod
182215
def get_product_type_group_permissions(cls):
183-
return {Permissions.Product_Type_Group_View, Permissions.Product_Type_Group_Edit,
216+
return {
217+
Permissions.Product_Type_Group_View,
218+
Permissions.Product_Type_Group_Edit,
184219
Permissions.Product_Type_Group_Delete}
185220

186221
@classmethod
187222
def get_group_permissions(cls):
188-
return {Permissions.Group_View, Permissions.Group_Member_Delete, Permissions.Group_Manage_Members,
189-
Permissions.Group_Add_Owner, Permissions.Group_Edit, Permissions.Group_Delete}
223+
return {
224+
Permissions.Group_View,
225+
Permissions.Group_Member_Delete,
226+
Permissions.Group_Manage_Members,
227+
Permissions.Group_Add_Owner,
228+
Permissions.Group_Edit,
229+
Permissions.Group_Delete}
190230

191231
@classmethod
192232
def get_group_member_permissions(cls):
193-
return {Permissions.Group_View, Permissions.Group_Manage_Members, Permissions.Group_Member_Delete}
233+
return {
234+
Permissions.Group_View,
235+
Permissions.Group_Manage_Members,
236+
Permissions.Group_Member_Delete}
194237

195238
@classmethod
196239
def get_language_permissions(cls):
197-
return {Permissions.Language_View, Permissions.Language_Edit, Permissions.Language_Delete}
240+
return {
241+
Permissions.Language_View,
242+
Permissions.Language_Edit,
243+
Permissions.Language_Delete}
198244

199245
@classmethod
200246
def get_technology_permissions(cls):
201-
return {Permissions.Technology_View, Permissions.Technology_Edit, Permissions.Technology_Delete}
247+
return {
248+
Permissions.Technology_View,
249+
Permissions.Technology_Edit,
250+
Permissions.Technology_Delete}
202251

203252
@classmethod
204253
def get_product_api_scan_configuration_permissions(cls):
205-
return {Permissions.Product_API_Scan_Configuration_View, Permissions.Product_API_Scan_Configuration_Edit, Permissions.Product_API_Scan_Configuration_Delete}
254+
return {
255+
Permissions.Product_API_Scan_Configuration_View,
256+
Permissions.Product_API_Scan_Configuration_Edit,
257+
Permissions.Product_API_Scan_Configuration_Delete}
206258

207259
@classmethod
208260
def get_credential_permissions(cls):
209-
return {Permissions.Credential_View, Permissions.Credential_Add, Permissions.Credential_Edit, Permissions.Credential_Delete}
261+
return {
262+
Permissions.Credential_View,
263+
Permissions.Credential_Add,
264+
Permissions.Credential_Edit,
265+
Permissions.Credential_Delete}
210266

211267

212268
def get_roles_with_permissions():

‎dojo/finding/views.py‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@
4646
import dojo.risk_acceptance.helper as ra_helper
4747
import dojo.finding.helper as finding_helper
4848
from dojo.authorization.authorization import user_has_permission_or_403
49-
from dojo.authorization.authorization_decorators import user_is_authorized, user_is_configuration_authorized
49+
from dojo.authorization.authorization_decorators import user_is_authorized, user_has_global_permission
5050
from dojo.authorization.roles_permissions import Permissions
5151
from dojo.finding.queries import get_authorized_findings
5252
from dojo.test.queries import get_authorized_tests
@@ -1127,7 +1127,7 @@ def clear_finding_review(request, fid):
11271127
})
11281128

11291129

1130-
@user_is_configuration_authorized('dojo.add_finding_template')
1130+
@user_has_global_permission(Permissions.Finding_Add)
11311131
def mktemplate(request, fid):
11321132
finding = get_object_or_404(Finding, id=fid)
11331133
templates = Finding_Template.objects.filter(title=finding.title)
@@ -1169,7 +1169,6 @@ def mktemplate(request, fid):
11691169

11701170

11711171
@user_is_authorized(Finding, Permissions.Finding_Edit, 'fid')
1172-
@user_is_configuration_authorized('dojo.view_finding_template')
11731172
def find_template_to_apply(request, fid):
11741173
finding = get_object_or_404(Finding, id=fid)
11751174
test = get_object_or_404(Test, id=finding.test.id)
@@ -1471,7 +1470,7 @@ def promote_to_finding(request, fid):
14711470
})
14721471

14731472

1474-
@user_is_configuration_authorized('dojo.view_finding_template')
1473+
@user_has_global_permission(Permissions.Finding_Edit)
14751474
def templates(request):
14761475
templates = Finding_Template.objects.all().order_by('cwe')
14771476
templates = TemplateFindingFilter(request.GET, queryset=templates)
@@ -1489,7 +1488,7 @@ def templates(request):
14891488
})
14901489

14911490

1492-
@user_is_configuration_authorized('dojo.view_finding_template')
1491+
@user_has_global_permission(Permissions.Finding_Edit)
14931492
def export_templates_to_json(request):
14941493
leads_as_json = serializers.serialize('json', Finding_Template.objects.all())
14951494
return HttpResponse(leads_as_json, content_type='json')
@@ -1540,7 +1539,7 @@ def apply_cwe_mitigation(apply_to_findings, template, update=True):
15401539
return count
15411540

15421541

1543-
@user_is_configuration_authorized('dojo.add_finding_template')
1542+
@user_has_global_permission(Permissions.Finding_Add)
15441543
def add_template(request):
15451544
form = FindingTemplateForm()
15461545
if request.method == 'POST':
@@ -1575,7 +1574,7 @@ def add_template(request):
15751574
})
15761575

15771576

1578-
@user_is_configuration_authorized('dojo.change_finding_template')
1577+
@user_has_global_permission(Permissions.Finding_Edit)
15791578
def edit_template(request, tid):
15801579
template = get_object_or_404(Finding_Template, id=tid)
15811580
form = FindingTemplateForm(
@@ -1621,7 +1620,7 @@ def edit_template(request, tid):
16211620
})
16221621

16231622

1624-
@user_is_configuration_authorized('dojo.delete_finding_template')
1623+
@user_has_global_permission(Permissions.Finding_Delete)
16251624
def delete_template(request, tid):
16261625
template = get_object_or_404(Finding_Template, id=tid)
16271626

‎dojo/templates/base.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -319,7 +319,7 @@
319319
{% trans "Risk Accepted Findings" %}
320320
</a>
321321
</li>
322-
{% if "dojo.view_finding_template"|has_configuration_permission:request %}
322+
{% if "Finding_View"|has_global_permission %}
323323
<li>
324324
<a href="{% url 'templates' %}">
325325
{% trans "Finding Templates" %}

‎dojo/templates/dojo/add_template.html‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
{% extends "base.html" %}
22
{% load static %}
3+
{% load authorization_tags %}
34
{% block add_css %}
45
{{ block.super }}
56

@@ -32,16 +33,18 @@ <h3> {{ name }} {{ template }}</h3>
3233
</div>
3334
</form>
3435
{% if template %}
35-
<form method="post" action="{% url 'delete_template' template.id %}"
36-
style="display: inline" class="form-horizontal">
37-
{% csrf_token %}
38-
<div class="form-group">
39-
<div class="col-sm-offset-2 col-sm-10">
40-
<input type="hidden" name="id" value="{{ template.id }}"/>
41-
<button type="submit" class="btn btn-danger template-delete">Delete Template</button>
36+
{% if "Finding_Delete"|has_global_permission %}
37+
<form method="post" action="{% url 'delete_template' template.id %}"
38+
style="display: inline" class="form-horizontal">
39+
{% csrf_token %}
40+
<div class="form-group">
41+
<div class="col-sm-offset-2 col-sm-10">
42+
<input type="hidden" name="id" value="{{ template.id }}"/>
43+
<button type="submit" class="btn btn-danger template-delete">Delete Template</button>
44+
</div>
4245
</div>
43-
</div>
44-
</form>
46+
</form>
47+
{% endif %}
4548
{% endif %}
4649
{% endblock %}
4750
{% block postscript %}

‎dojo/templates/dojo/dev_env.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ <h3 class="has-filters">
4141
class="tablesorter-bootstrap table table-bordered table-condensed table-striped">
4242
<thead>
4343
<tr>
44+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
4445
<th>{% dojo_sort request 'Environment' 'name' 'asc' %}</th>
4546
</tr>
4647
</thead>

‎dojo/templates/dojo/endpoints.html‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -77,11 +77,14 @@ <h3 class="has-filters">
7777
</th>
7878
{% endif %}
7979
{% if host_view %}
80+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
8081
<th>{% dojo_sort request 'Host' 'host' %}</th>
8182
{% else %}
83+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
8284
<th>{% dojo_sort request 'Endpoint' 'endpoint' %}</th>
8385
{% endif %}
8486
{% if not product_tab %}
87+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
8588
<th>{% dojo_sort request 'Product' 'product' 'asc' %}</th>
8689
{% endif %}
8790
<th class="text-center" nowrap="nowrap">Active Verified Findings</th>

‎dojo/templates/dojo/engagement.html‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,11 +50,16 @@ <h3 class="has-filters">
5050
class="tablesorter-bootstrap table table-condensed table-striped table-hover">
5151
<tr>
5252
<th></th>
53+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
5354
<th>{% dojo_sort request 'Engagement' 'name' 'asc' %}</th>
55+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
5456
<th>{% dojo_sort request 'Period' 'target_start' 'asc' %}</th>
5557
<th>Status</th>
58+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
5659
<th class="prod_name">{% dojo_sort request 'Product' 'product__name' 'asc' %}</th>
60+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
5761
<th class="prod_name">{% dojo_sort request 'Product Type' 'product__prod_type__name' %}</th>
62+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
5863
<th>{% dojo_sort request 'Lead' 'lead__first_name' %}</th>
5964
<th>Tests</th>
6065
{% if system_settings.enable_jira %}

‎dojo/templates/dojo/engineer_metrics.html‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,12 +27,19 @@ <h3 class="has-filters">
2727
<table id="users"
2828
class="tablesorter-bootstrap table table-condensed table-striped">
2929
<tr>
30+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
3031
<th class="nowrap">{% dojo_sort request 'First Name' 'first_name' %}</th>
32+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
3133
<th class="nowrap">{% dojo_sort request 'Last Name' 'last_name' %}</th>
34+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
3235
<th class="nowrap">{% dojo_sort request 'User Name' 'username' 'asc' %}</th>
36+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
3337
<th class="nowrap">{% dojo_sort request 'Email' 'email' %}</th>
38+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
3439
<th class="nowrap">{% dojo_sort request 'Last Login' 'last_login'%}</th>
40+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
3541
<th class="nowrap, text-center">{% dojo_sort request 'Active' 'is_active' %}</th>
42+
{% comment %} The display field is translated in the function. No need to translate here as well{% endcomment %}
3643
<th class="nowrap, text-center">{% dojo_sort request 'Superuser' 'is_superuser' %}</th>
3744
</tr>
3845
{% for u in users %}

0 commit comments

Comments
 (0)