Skip to content

Commit 22894ec

Browse files
devEricAdevEricA
committed
ad_hoc_finding Start
1 parent 6dd57e0 commit 22894ec

File tree

4 files changed

+140
-4
lines changed

4 files changed

+140
-4
lines changed

‎dojo/forms.py‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -621,6 +621,46 @@ class Meta:
621621
'review_requested_by')
622622

623623

624+
class AdHocFindingForm(forms.ModelForm):
625+
title = forms.CharField(max_length=1000)
626+
date = forms.DateField(required=True,
627+
widget=forms.TextInput(attrs={'class':
628+
'datepicker'}))
629+
cwe = forms.IntegerField(required=False)
630+
severity_options = (('Low', 'Low'), ('Medium', 'Medium'),
631+
('High', 'High'), ('Critical', 'Critical'))
632+
description = forms.CharField(widget=forms.Textarea)
633+
severity = forms.ChoiceField(
634+
choices=severity_options,
635+
error_messages={
636+
'required': 'Select valid choice: In Progress, On Hold, Completed',
637+
'invalid_choice': 'Select valid choice: Critical,High,Medium,Low'})
638+
mitigation = forms.CharField(widget=forms.Textarea)
639+
impact = forms.CharField(widget=forms.Textarea)
640+
endpoints = forms.ModelMultipleChoiceField(Endpoint.objects, required=False, label='Systems / Endpoints',
641+
widget=MultipleSelectWithPopPlusMinus(attrs={'size': '11'}))
642+
references = forms.CharField(widget=forms.Textarea, required=False)
643+
is_template = forms.BooleanField(label="Create Template?", required=False,
644+
help_text="A new finding template will be created from this finding.")
645+
646+
def clean(self):
647+
# self.fields['endpoints'].queryset = Endpoint.objects.all()
648+
cleaned_data = super(AddFindingForm, self).clean()
649+
if ((cleaned_data['active'] or cleaned_data['verified'])
650+
and cleaned_data['duplicate']):
651+
raise forms.ValidationError('Duplicate findings cannot be'
652+
' verified or active')
653+
if cleaned_data['false_p'] and cleaned_data['verified']:
654+
raise forms.ValidationError('False positive findings cannot '
655+
'be verified.')
656+
return cleaned_data
657+
658+
class Meta:
659+
model = Finding
660+
order = ('title', 'severity', 'endpoints', 'description', 'impact')
661+
exclude = ('reporter', 'url', 'numerical_severity', 'endpoint', 'images', 'under_review', 'reviewers',
662+
'review_requested_by')
663+
624664
class PromoteFindingForm(forms.ModelForm):
625665
title = forms.CharField(max_length=1000)
626666
date = forms.DateField(required=True,

‎dojo/product/urls.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,4 +20,6 @@
2020
name='add_meta_data'),
2121
url(r'^product/(?P<pid>\d+)/edit_meta_data', views.edit_meta_data,
2222
name='edit_meta_data'),
23+
url(r'^product/(?P<pid>\d+)/ad_hoc_finding', views.ad_hoc_finding,
24+
name='ad_hoc_finding'),
2325
]

‎dojo/product/views.py‎

Lines changed: 91 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,12 @@
1818
from pytz import timezone
1919

2020
from dojo.filters import ProductFilter, ProductFindingFilter
21-
from dojo.forms import ProductForm, EngForm, DeleteProductForm, ProductMetaDataForm, JIRAPKeyForm, JIRAFindingForm
21+
from dojo.forms import ProductForm, EngForm, DeleteProductForm, ProductMetaDataForm, JIRAPKeyForm, JIRAFindingForm, AdHocFindingForm
2222
from dojo.models import Product_Type, Finding, Product, Engagement, ScanSettings, Risk_Acceptance, Test, JIRA_PKey, \
23-
Tool_Product_Settings, Cred_User, Cred_Mapping
23+
Tool_Product_Settings, Cred_User, Cred_Mapping, Finding_Template, Endpoint
2424
from dojo.utils import get_page_items, add_breadcrumb, get_punchcard_data
2525
from custom_field.models import CustomFieldValue, CustomField
26-
from dojo.tasks import add_epic_task
26+
from dojo.tasks import add_epic_task, add_issue_task
2727
from tagging.models import Tag
2828
from tagging.utils import get_tag_list
2929
from tagging.views import TaggedItem
@@ -384,7 +384,7 @@ def delete_product(request, pid):
384384
product = get_object_or_404(Product, pk=pid)
385385
form = DeleteProductForm(instance=product)
386386

387-
from django.contrib.admin.util import NestedObjects
387+
from django.contrib.admin.utils import NestedObjects
388388
from django.db import DEFAULT_DB_ALIAS
389389

390390
collector = NestedObjects(using=DEFAULT_DB_ALIAS)
@@ -565,3 +565,90 @@ def edit_meta_data(request, pid):
565565
{'product': prod,
566566
'product_metadata': product_metadata,
567567
})
568+
569+
570+
@user_passes_test(lambda u: u.is_staff)
571+
def ad_hoc_finding(request, pid):
572+
eng=Engagement()
573+
test = Test()
574+
form_error = False
575+
enabled = False
576+
jform = None
577+
form = AdHocFindingForm(initial={'date': datetime.now(tz=localtz).date()})
578+
if hasattr(settings, 'ENABLE_JIRA'):
579+
if settings.ENABLE_JIRA:
580+
if JIRA_PKey.objects.filter(product=test.engagement.product).count() != 0:
581+
enabled = JIRA_PKey.objects.get(product=test.engagement.product).push_all_issues
582+
jform = JIRAFindingForm(enabled=enabled, prefix='jiraform')
583+
else:
584+
jform = None
585+
if request.method == 'POST':
586+
form = AdHocFindingForm(request.POST)
587+
if form.is_valid():
588+
new_finding = form.save(commit=False)
589+
new_finding.test = test
590+
new_finding.reporter = request.user
591+
new_finding.numerical_severity = Finding.get_numerical_severity(
592+
new_finding.severity)
593+
if new_finding.false_p or new_finding.active is False:
594+
new_finding.mitigated = datetime.now(tz=localtz)
595+
new_finding.mitigated_by = request.user
596+
create_template = new_finding.is_template
597+
# always false now since this will be deprecated soon in favor of new Finding_Template model
598+
new_finding.is_template = False
599+
new_finding.save()
600+
new_finding.endpoints = form.cleaned_data['endpoints']
601+
new_finding.save()
602+
if 'jiraform-push_to_jira' in request.POST:
603+
jform = JIRAFindingForm(request.POST, prefix='jiraform', enabled=enabled)
604+
if jform.is_valid():
605+
add_issue_task.delay(new_finding, jform.cleaned_data.get('push_to_jira'))
606+
messages.add_message(request,
607+
messages.SUCCESS,
608+
'Finding added successfully.',
609+
extra_tags='alert-success')
610+
if create_template:
611+
templates = Finding_Template.objects.filter(title=new_finding.title)
612+
if len(templates) > 0:
613+
messages.add_message(request,
614+
messages.ERROR,
615+
'A finding template was not created. A template with this title already '
616+
'exists.',
617+
extra_tags='alert-danger')
618+
else:
619+
template = Finding_Template(title=new_finding.title,
620+
cwe=new_finding.cwe,
621+
severity=new_finding.severity,
622+
description=new_finding.description,
623+
mitigation=new_finding.mitigation,
624+
impact=new_finding.impact,
625+
references=new_finding.references,
626+
numerical_severity=new_finding.numerical_severity)
627+
template.save()
628+
messages.add_message(request,
629+
messages.SUCCESS,
630+
'A finding template was also created.',
631+
extra_tags='alert-success')
632+
if '_Finished' in request.POST:
633+
return HttpResponseRedirect(reverse('view_test', args=(test.id,)))
634+
else:
635+
return HttpResponseRedirect(reverse('add_findings', args=(test.id,)))
636+
else:
637+
if 'endpoints' in form.cleaned_data:
638+
form.fields['endpoints'].queryset = form.cleaned_data['endpoints']
639+
else:
640+
form.fields['endpoints'].queryset = Endpoint.objects.none()
641+
form_error = True
642+
messages.add_message(request,
643+
messages.ERROR,
644+
'The form has errors, please correct them below.',
645+
extra_tags='alert-danger')
646+
add_breadcrumb(parent=test, title="Add Finding", top_level=False, request=request)
647+
return render(request, 'dojo/add_findings.html',
648+
{'form': form,
649+
'temp': False,
650+
'tid': tid,
651+
'form_error': form_error,
652+
'jform': jform,
653+
})
654+

‎dojo/templates/dojo/view_product.html‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,13 @@ <h3 class="pull-left">
4545
</a>
4646
</li>
4747
{% endif %}
48+
{% if user.is_staff %}
49+
<li role="presentation">
50+
<a class="" href="{% url 'ad_hoc_finding' prod.id %}">
51+
<i class="fa fa-list-alt"></i> Add Finding
52+
</a>
53+
</li>
54+
{% endif %}
4855
{% if user.is_staff %}
4956
<li role="presentation">
5057
<a class="" href="{% url 'add_meta_data' prod.id %}">

0 commit comments

Comments
 (0)