Skip to content

Commit c90e514

Browse files
Merge pull request #192 from SEI-gstrom/version/3.0.28
Version 3.0.28
2 parents d7ccb8a + d4bf760 commit c90e514

File tree

11 files changed

+225
-101
lines changed

11 files changed

+225
-101
lines changed

.ebextensions/02_settings.config

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,3 @@ option_settings:
88
- namespace: aws:elasticbeanstalk:container:python
99
option_name: WSGIPath
1010
value: bigvince.wsgi:application
11-
12-

CHANGELOG.md

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,30 @@ VINCE Coordination platform code
77
## Description
88
VINCE Coordination platform code
99

10+
11+
Version 3.0.28 2025-11-04
12+
13+
* added code to fix issue in creation of XLS report (Internal-804)
14+
15+
16+
Version 3.0.27 2025-11-04
17+
18+
* updated links to CVD documentation, etc. (Internal-816)
19+
* modified structure of weekly XLS report in response to user request (Internal-804)
20+
* modified Triage view so that it also includes new tickets assigned to no-longer-active users (Internal-825)
21+
* disabled buggy hovering feature in VINCE Comm case page (Internal-826)
22+
23+
24+
Version 3.0.26 2025-10-02
25+
26+
* dependabot update recommendation: `Django` 4.2.24 to 4.2.25
27+
* fixed bug causing discrepency between two sources of info about vendors attached to a case (Internal-822)
28+
29+
Version 3.0.25 2025-09-10
30+
31+
* dependabot update recommendation: `Django` 4.2.22 to 4.2.24
32+
33+
1034
Version 3.0.24 2025-08-26
1135

1236
* adjusted code for generating spreadsheet used for detailed weekly reports (Intental-804)

bigvince/settings_.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@
5454
ROOT_DIR = environ.Path(__file__) - 3
5555

5656
# any change that requires database migrations is a minor release
57-
VERSION = "3.0.24"
57+
VERSION = "3.0.28"
5858

5959
# Quick-start development settings - unsuitable for production
6060
# See https://docs.djangoproject.com/en/2.1/howto/deployment/checklist/

requirements.txt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ cryptography==44.0.1
2424
cvelib==1.3.0
2525
Deprecated==1.2.13
2626
dictdiffer==0.9.0
27-
Django==4.2.22
27+
Django==4.2.25
2828
django-appconf==1.0.5
2929
django-countries==7.4.2
3030
django-environ==0.9.0

vince/static/vince/css/style.css

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1432,15 +1432,15 @@ div.homelink a {
14321432
background-color: #282829;
14331433
border-right: 1px solid #c2c2c2;
14341434
color: #f1f1f2;
1435-
padding-top:130px;
1435+
padding-top:195px;
14361436

14371437
}
14381438

14391439
#offCanvasLeft {
14401440
background-color: #f1f1f2;
14411441
border-right: 1px solid #c2c2c2;
14421442
color: #4d4d4f;
1443-
padding-top:150px;
1443+
padding-top:225px;
14441444
}
14451445

14461446
/*.position-left.reveal-for-medium ~ .off-canvas-content {

vince/views.py

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -672,7 +672,7 @@ def autocomplete_casevendors(request, pk):
672672
case = get_object_or_404(VulnerabilityCase, id=pk)
673673
page = int(request.GET.get("page", 1))
674674
size = int(request.GET.get("size", 0))
675-
vendors = VulnerableVendor.casevendors(case).order_by("vendor")
675+
vendors = VulnerableVendor.casevendors(case).select_related("contact").prefetch_related("contact__contacttag_set").order_by("vendor")
676676
user_filter = False
677677
logger.debug(f"in autocomplete_casevendors, request.GET is {request.GET}")
678678
for key in request.GET:
@@ -14918,7 +14918,6 @@ def get(self, request, *args, **kwargs):
1491814918
"Summary",
1491914919
"Initial Triage Actions",
1492014920
"Assigned Personnel/Team",
14921-
"Justification if Declined",
1492214921
"Coordinator"
1492314922
])
1492414923

@@ -14973,6 +14972,8 @@ def get(self, request, *args, **kwargs):
1497314972
resolution = ""
1497414973
try:
1497514974
resolution = ticket.resolution
14975+
if resolution is None:
14976+
resolution = "no resolution"
1497614977
except:
1497714978
resolution = "no resolution"
1497814979
try:
@@ -14991,10 +14992,9 @@ def get(self, request, *args, **kwargs):
1499114992
[
1499214993
f"{ticket.queue}-{ticket.id}",
1499314994
ticket.title,
14994-
resolution,
14995+
resolution + justification_if_declined,
1499514996
" ",
1499614997
assigned_team,
14997-
justification_if_declined,
1499814998
assignee_name,
1499914999
]
1500015000
)
@@ -16044,7 +16044,7 @@ def get_queryset(self):
1604416044
my_queues = get_rw_queues(self.request.user)
1604516045
return (
1604616046
Ticket.objects.filter(queue__in=my_queues, status__in=[Ticket.OPEN_STATUS, Ticket.REOPENED_STATUS])
16047-
.exclude(assigned_to__isnull=False)
16047+
.filter(Q(assigned_to__isnull=True) | Q(assigned_to__is_active=False))
1604816048
.order_by("-modified")
1604916049
)
1605016050

vincepub/templates/vincepub/index.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ <h3>Search</h3>
7474
<div class="large-8 medium-8 columns">
7575
<h3>Want to report a vulnerability?</h3>
7676
<p>The CERT Coordination Center (CERT/CC) prioritizes coordination efforts on vulnerabilities that affect multiple vendors or that impact safety, critical or internet infrastructure, or national security. We also prioritize reports that affect sectors that are new to vulnerability disclosure. We may be able to provide assistance for reports when the coordination process breaks down.</p>
77-
<p>Before reporting a vulnerability to us, we recommend reading our <a href="https://vuls.cert.org/confluence/display/Wiki/Vulnerability+Disclosure+Policy" target="_blank" rel="noopener">vulnerability disclosure policy</a> and <a href="{% url 'vincepub:discguidance' %}">guidance.</a>
77+
<p>Before reporting a vulnerability to us, we recommend reading our <a href="https://certcc.github.io/certcc_disclosure_policy/" target="_blank" rel="noopener">vulnerability disclosure policy</a> and <a href="{% url 'vincepub:discguidance' %}">guidance.</a>
7878
<p><a class="old-notes hollow button secondary large" href="{% url 'vincepub:initreport' %}">Report a Vulnerability</a></p>
7979
</div>
8080
<div class="large-4 medium-4 columns">

vincepub/templates/vincepub/report.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ <h2 class="subtitle"> Report a Vulnerability </h2>
2323
<!--<a href="{% url 'vincepub:vulcoordrequest' %}" class="link-cta">Request a CVE from MITRE </a>-->
2424

2525
<p class="lead-body">Before reporting any vulnerabilities to the CERT Coordination Center (CERT/CC) and making them public, try contacting the vendor directly. Some vendors offer bug bounty programs.</p>
26-
<p class="lead-body">We recommend reading our <a href="https://vuls.cert.org/confluence/display/Wiki/Vulnerability+Disclosure+Policy" target="_blank" rel="noopener">vulnerability disclosure policy</a> and <a href="{% url 'vincepub:discguidance' %}">guidance</a> before submitting a vulnerability report. We send information provided in vulnerability reports to affected vendors. </p>
26+
<p class="lead-body">We recommend reading our <a href="https://certcc.github.io/certcc_disclosure_policy/" target="_blank" rel="noopener">vulnerability disclosure policy</a> and <a href="{% url 'vincepub:discguidance' %}">guidance</a> before submitting a vulnerability report. We send information provided in vulnerability reports to affected vendors. </p>
2727

2828
<p class="lead-body">CERT/CC does not accept or respond to every report. We prioritize reports that affect multiple vendors or that impact safety, critical or internet infrastructure, or national security. We also prioritize reports that affect sectors that are new to vulnerability disclosure. We may be able to provide assistance for reports when the coordination process breaks down.</p>
2929
<a href="{% url 'vincepub:vulcoordrequest' %}" class="link-cta"> Begin a Report </a>

vinny/static/vinny/js/vinny.js

Lines changed: 92 additions & 86 deletions
Original file line numberDiff line numberDiff line change
@@ -30,24 +30,30 @@
3030

3131
function initTooltipster(element, umProfileStore, displayUserCard) {
3232
/*replaced to use standard jquery tooltip since plugin was failing */
33-
$(document).tooltip({
34-
items:'.user-mention, .vendor-participant',
35-
tooltipClass: 'tooltipster-default',
36-
content: function(callback) {
37-
var userUrl = $(this).attr('href')+"?quick=1";
38-
if(umProfileStore.hasOwnProperty(userUrl)){
39-
callback(umProfileStore[userUrl])
40-
//displayUserCard(instance, umProfileStore[userUrl]);
41-
// load from cache
42-
}
43-
else {
44-
$.get(userUrl, function(data) {
45-
umProfileStore[userUrl] = data;
46-
callback(data);
47-
});
48-
}
49-
}
50-
});
33+
34+
// Temporarily commenting out this code until we can figure out why the wrong user's
35+
// info is sometimes displayed when users hover over (for example) "@Fred" in posts on
36+
// the case page:
37+
38+
// $(document).tooltip({
39+
// items:'.user-mention, .vendor-participant',
40+
// tooltipClass: 'tooltipster-default',
41+
// content: function(callback) {
42+
// var userUrl = $(this).attr('href')+"?quick=1";
43+
// if(umProfileStore.hasOwnProperty(userUrl)){
44+
// callback(umProfileStore[userUrl])
45+
// //displayUserCard(instance, umProfileStore[userUrl]);
46+
// // load from cache
47+
// }
48+
// else {
49+
// $.get(userUrl, function(data) {
50+
// umProfileStore[userUrl] = data;
51+
// callback(data);
52+
// });
53+
// }
54+
// }
55+
// });
56+
5157
}
5258

5359
function onBeforeUnload(e) {
@@ -320,50 +326,50 @@ $(document).ready(function() {
320326
});
321327

322328
$(document).on("submit", "#postform", function(event) {
323-
// Get some values from elements on the page:
324-
event.preventDefault();
325-
var content = simplemde.value();
326-
console.log(content)
327-
if (content == "") {
328-
return false;
329-
}
330-
var paginate_by = $("#paginate_by").text();
331-
$('#sendbutton').prop('disabled', true);
332-
var $form = $( this );
333-
var url = $(this).attr( "action" );
334-
var csrftoken = getCookie('csrftoken');
335-
var data = {'content': content, 'csrfmiddlewaretoken': csrftoken, 'paginate_by': paginate_by};
336-
var reload_pinned = false;
337-
if ($("#reply_to").length) {
338-
data["reply_to"] = $("#reply_to").val();
339-
if ($("#reply_to").attr("name") == "reply_to_pinned") {
340-
reload_pinned = true;
341-
data["pinned"] = 1;
342-
}
343-
}
344-
// Send the data using post
345-
var posting = $.post( url, data );
346-
347-
// Put the results in a div
348-
posting.done(function( data ) {
349-
simplemde.value("");
350-
var reload_type = "#allposts";
351-
if (reload_pinned) {
352-
reload_type = "#pinnedposts";
353-
}
354-
$('#sendbutton').prop('disabled', false);
355-
$(reload_type).empty().append( data );
356-
$(reload_type).foundation();
357-
/* reload plugins */
358-
$('html, body').animate({scrollTop:$(reload_type).offset().bottom}, 'slow');
359-
initTooltipster(".user-mention:not(.tooltipstered)", umProfileStore, displayUserCard);
360-
/* remove reply if present */
361-
if (document.contains(document.getElementById("reply_to"))) {
362-
document.getElementById("reply_to").remove();
363-
}
364-
//$( "#post_reply" ).slideToggle( "slow", function() {
365-
//});
366-
});
329+
// Get some values from elements on the page:
330+
event.preventDefault();
331+
var content = simplemde.value();
332+
console.log(content)
333+
if (content == "") {
334+
return false;
335+
}
336+
var paginate_by = $("#paginate_by").text();
337+
$('#sendbutton').prop('disabled', true);
338+
var $form = $( this );
339+
var url = $(this).attr( "action" );
340+
var csrftoken = getCookie('csrftoken');
341+
var data = {'content': content, 'csrfmiddlewaretoken': csrftoken, 'paginate_by': paginate_by};
342+
var reload_pinned = false;
343+
if ($("#reply_to").length) {
344+
data["reply_to"] = $("#reply_to").val();
345+
if ($("#reply_to").attr("name") == "reply_to_pinned") {
346+
reload_pinned = true;
347+
data["pinned"] = 1;
348+
}
349+
}
350+
// Send the data using post
351+
var posting = $.post( url, data );
352+
353+
// Put the results in a div
354+
posting.done(function( data ) {
355+
simplemde.value("");
356+
var reload_type = "#allposts";
357+
if (reload_pinned) {
358+
reload_type = "#pinnedposts";
359+
}
360+
$('#sendbutton').prop('disabled', false);
361+
$(reload_type).empty().append( data );
362+
$(reload_type).foundation();
363+
/* reload plugins */
364+
$('html, body').animate({scrollTop:$(reload_type).offset().bottom}, 'slow');
365+
initTooltipster(".user-mention:not(.tooltipstered)", umProfileStore, displayUserCard);
366+
/* remove reply if present */
367+
if (document.contains(document.getElementById("reply_to"))) {
368+
document.getElementById("reply_to").remove();
369+
}
370+
//$( "#post_reply" ).slideToggle( "slow", function() {
371+
//});
372+
});
367373

368374
});
369375

@@ -445,30 +451,30 @@ $(document).ready(function() {
445451

446452

447453
$(document).on('click', '.reply-to-post', function() {
448-
var post = $(this).parent().parent().parent().find('.post_author');
449-
var lines = post.text().trim(); /*.split('\n');*/
450-
var post_id = $(this).attr("post_id");
451-
/*$("#post_reply").slideToggle( "slow", function() {});*/
452-
$('html, body').animate({scrollTop:$(document).height()}, 'slow');
453-
/*var newpost = lines.map(function(element) { return '> ' + element; });
454-
simplemde.value(newpost.join('\n'));*/
455-
if ($(this).hasClass("pinned")) {
456-
$('<input>', {
457-
type: 'hidden',
458-
id: 'reply_to',
459-
name: 'reply_to_pinned',
460-
value: post_id
461-
}).appendTo('#postform');
462-
463-
} else {
464-
$('<input>', {
465-
type: 'hidden',
466-
id: 'reply_to',
467-
name: 'reply_to',
468-
value: post_id
469-
}).appendTo('#postform');
470-
}
471-
simplemde.value('@'+lines);
454+
var post = $(this).parent().parent().parent().find('.post_author');
455+
var lines = post.text().trim(); /*.split('\n');*/
456+
var post_id = $(this).attr("post_id");
457+
/*$("#post_reply").slideToggle( "slow", function() {});*/
458+
$('html, body').animate({scrollTop:$(document).height()}, 'slow');
459+
/*var newpost = lines.map(function(element) { return '> ' + element; });
460+
simplemde.value(newpost.join('\n'));*/
461+
if ($(this).hasClass("pinned")) {
462+
$('<input>', {
463+
type: 'hidden',
464+
id: 'reply_to',
465+
name: 'reply_to_pinned',
466+
value: post_id
467+
}).appendTo('#postform');
468+
469+
} else {
470+
$('<input>', {
471+
type: 'hidden',
472+
id: 'reply_to',
473+
name: 'reply_to',
474+
value: post_id
475+
}).appendTo('#postform');
476+
}
477+
simplemde.value('@'+lines);
472478
});
473479

474480

vinny/urls.py

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,8 @@
174174
path("reports/pub/", views.AdminReportsView.as_view(), name="adminreports"),
175175
path("reports/", views.ReportsView.as_view(), name="reports"),
176176
path("api/vendor/", views.VendorInfoAPIView.as_view(), name="vendor_api"),
177+
# Make this endpoint go live when we complete Internal-821:
178+
# path("api/vulreport/", views.VulReportAPIView.as_view(), name="vul_report_api"),
177179
path("api/cases/", views.CasesAPIView.as_view(), name="cases_api"),
178180
re_path("api/case/(?P<vuid>\d+)/$", views.CaseAPIView.as_view({"get": "retrieve"}), name="case_api"),
179181
re_path("api/case/posts/(?P<vuid>\d+)/$", views.CasePostAPIView.as_view(), name="case_post_api"),

0 commit comments

Comments
 (0)