def update_site(site_id): new_site = request.json # Verify incoming site. It must exist, groups must exist, plans must exist. site = sites.find_one({"id": site_id}) if not site: return jsonify(success=False, reason="no-such-site") site["groups"] = _find_groups_for_site(site["url"]) for group in new_site.get("groups", []): if not _check_group_exists(group): return jsonify(success=False, reason="unknown-group") for plan_name in new_site.get("plans", []): if not _check_plan_exists(plan_name): return jsonify(success=False, reason="unknown-plan") if "groups" in new_site: # Add new groups for group_name in new_site.get("groups", []): if group_name not in site["groups"]: groups.update({"name": group_name}, {"$addToSet": {"sites": site["url"]}}) # Remove old groups for group_name in site["groups"]: if group_name not in new_site.get("groups", []): groups.update({"name": group_name}, {"$pull": {"sites": site["url"]}}) if "plans" in new_site: # Update the site. At this point we can only update plans. sites.update({"id": site_id}, {"$set": {"plans": new_site.get("plans")}}) # Return the updated site site = sites.find_one({"id": site_id}) if not site: return jsonify(success=False, reason="no-such-site") site["groups"] = _find_groups_for_site(site["url"]) return jsonify(success=True, site=sanitize_site(site))
def update_site(site_id): new_site = request.json # Verify incoming site. It must exist, groups must exist, plans must exist. site = sites.find_one({'id': site_id}) if not site: return jsonify(success=False, reason='no-such-site') site['groups'] = _find_groups_for_site(site['url']) for group in new_site.get('groups', []): if not _check_group_exists(group): return jsonify(success=False, reason='unknown-group') for plan_name in new_site.get('plans', []): if not _check_plan_exists(plan_name): return jsonify(success=False, reason='unknown-plan') if 'groups' in new_site: # Add new groups for group_name in new_site.get('groups', []): if group_name not in site['groups']: groups.update({'name':group_name},{'$addToSet': {'sites': site['url']}}) # Remove old groups for group_name in site['groups']: if group_name not in new_site.get('groups', []): groups.update({'name':group_name},{'$pull': {'sites': site['url']}}) if 'plans' in new_site: # Update the site. At this point we can only update plans. sites.update({'id': site_id}, {'$set': {'plans': new_site.get('plans')}}) # Return the updated site site = sites.find_one({'id': site_id}) if not site: return jsonify(success=False, reason='no-such-site') site['groups'] = _find_groups_for_site(site['url']) return jsonify(success=True, site=sanitize_site(site))
def update_site(site_id): new_site = request.json # Verify incoming site. It must exist, groups must exist, plans must exist. site = sites.find_one({'id': site_id}) if not site: return jsonify(success=False, reason='no-such-site') site['groups'] = _find_groups_for_site(site['url']) for group in new_site.get('groups', []): if not _check_group_exists(group): return jsonify(success=False, reason='unknown-group') for plan_name in new_site.get('plans', []): if not _check_plan_exists(plan_name): return jsonify(success=False, reason='unknown-plan') if 'groups' in new_site: # Add new groups for group_name in new_site.get('groups', []): if group_name not in site['groups']: groups.update({'name': group_name}, {'$addToSet': { 'sites': site['url'] }}) # Remove old groups for group_name in site['groups']: if group_name not in new_site.get('groups', []): groups.update({'name': group_name}, {'$pull': { 'sites': site['url'] }}) if 'plans' in new_site: # Update the site. At this point we can only update plans. sites.update({'id': site_id}, {'$set': { 'plans': new_site.get('plans') }}) new_verification = new_site['verification'] old_verification = site.get('verification') # if site doesn't have 'verification', do us a favor, update the document as it is outdated! if not old_verification or old_verification['enabled'] != new_verification[ 'enabled']: # to make logic simpler, even if the new request wants to # disable verification, generate a new value anyway. sites.update({'id': site_id}, { '$set': { 'verification': { 'enabled': new_verification['enabled'], 'value': str(uuid.uuid4()) } } }) # Return the updated site site = sites.find_one({'id': site_id}) if not site: return jsonify(success=False, reason='no-such-site') site['groups'] = _find_groups_for_site(site['url']) return jsonify(success=True, site=sanitize_site(site))
def create_group(): group = request.json # perform validations on incoming data; issue#132 if not group.get("name"): return jsonify(success=False, reason="name-field-is-required") userz = group.get("users") sitez = group.get("sites") if userz: for user in userz: if not users.find_one({"email": user}): return jsonify(success=False, reason="user %s does not exist" % user) if sitez: for site in sitez: if not sites.find_one({"name": site}): return jsonify(success=False, reason="site %s does not exist" % site) if groups.find_one({"name": group["name"]}) is not None: return jsonify(success=False, reason="group-already-exists") # post-validation new_group = { "id": str(uuid.uuid4()), "name": group["name"], "description": group.get("description", ""), "sites": group.get("sites", []), "users": group.get("users", []), "created": datetime.datetime.utcnow(), } groups.insert(new_group) return jsonify(success=True, group=sanitize_group(new_group))
def get_reports_sites(): result = [] group_name = request.args.get('group_name') user_email = request.args.get('user') if user_email is not None: # User specified, so return recent scans for each site/plan that the user can see user = users.find_one({'email': user_email}) if user is None: return jsonify(success=False, reason='no-such-user') if group_name: site_list = _find_sites_for_user_by_group_name(user_email, group_name) else: site_list = _find_sites_for_user(user_email) for site_url in sorted(site_list): site = sites.find_one({'url': site_url}) if site is not None: for plan_name in site['plans']: schedule = scanschedules.find_one({'site':site_url, 'plan':plan_name}) crontab = None scheduleEnabled = False if schedule is not None: crontab = schedule['crontab'] scheduleEnabled = schedule['enabled'] l = list(scans.find({'configuration.target':site['url'], 'plan.name': plan_name}).sort("created", -1).limit(1)) if len(l) == 1: scan = summarize_scan(sanitize_scan(l[0])) s = {v: scan.get(v) for v in ('id', 'created', 'state', 'issues')} result.append({'target': site_url, 'plan': plan_name, 'scan': scan, 'crontab': crontab, 'scheduleEnabled': scheduleEnabled}) else: result.append({'target': site_url, 'plan': plan_name, 'scan': None, 'crontab': crontab, 'scheduleEnabled': scheduleEnabled}) return jsonify(success=True, report=result)
def get_reports_issues(): result = [] group_name = request.args.get('group_name') user_email = request.args.get('user') if user_email is not None: # User specified, so return recent scans for each site/plan that the user can see user = users.find_one({'email': user_email}) if user is None: return jsonify(success=False, reason='no-such-user') if group_name: site_list = _find_sites_for_user_by_group_name(user_email, group_name) else: site_list = _find_sites_for_user(user_email) for site_url in sorted(site_list): r = {'target': site_url, 'issues': []} site = sites.find_one({'url': site_url}) if site is not None: for plan_name in site['plans']: for s in scans.find({'configuration.target':site['url'], 'plan.name': plan_name}).sort("created", -1).limit(1): for session in s['sessions']: for issue in session['issues']: r['issues'].append({'severity': issue['Severity'], 'summary': issue['Summary'], 'scan': { 'id': s['id'] }, 'id': issue['Id']}) result.append(r) return jsonify(success=True, report=result)
def create_site(): site = request.json # Verify incoming site: url must be valid, groups must exist, plans must exist if not _check_site_url(site.get("url")): return jsonify(success=False, reason="invalid-url") if not _check_required_fields(site, ["url"]): return jsonify(success=False, reason="missing-required-field") for group in site.get("groups", []): if not _check_group_exists(group): return jsonify(success=False, reason="unknown-group") for plan_name in site.get("plans", []): if not _check_plan_exists(plan_name): return jsonify(success=False, reason="unknown-plan") if sites.find_one({"url": site["url"]}) is not None: return jsonify(success=False, reason="site-already-exists") # Create the site new_site = { "id": str(uuid.uuid4()), "url": site["url"], "plans": site.get("plans", []), "created": datetime.datetime.utcnow(), } sites.insert(new_site) # Add the site to the groups - group membership is stored in the group object, not in the site for group_name in site.get("groups", []): # No need to check if the site is already in the group as we just added the site groups.update({"name": group_name}, {"$addToSet": {"sites": site["url"]}}) new_site["groups"] = site.get("groups", []) # Return the new site return jsonify(success=True, site=sanitize_site(new_site))
def create_site(): site = request.json # Verify incoming site: url must be valid, groups must exist, plans must exist if not _check_site_url(site.get('url')): return jsonify(success=False, reason='invalid-url') if not _check_required_fields(site, ['url']): return jsonify(success=False, reason='missing-required-field') for group in site.get('groups', []): if not _check_group_exists(group): return jsonify(success=False, reason='unknown-group') for plan_name in site.get('plans', []): if not _check_plan_exists(plan_name): return jsonify(success=False, reason='unknown-plan') if sites.find_one({'url': site['url']}) is not None: return jsonify(success=False, reason='site-already-exists') # Create the site new_site = { 'id': str(uuid.uuid4()), 'url': site['url'], 'plans': site.get('plans', []), 'created': datetime.datetime.utcnow() } sites.insert(new_site) # Add the site to the groups - group membership is stored in the group object, not in the site for group_name in site.get('groups', []): # No need to check if the site is already in the group as we just added the site groups.update({'name':group_name},{'$addToSet': {'sites': site['url']}}) new_site['groups'] = site.get('groups', []) # Return the new site return jsonify(success=True, site=sanitize_site(new_site))
def create_group(): group = request.json # perform validations on incoming data; issue#132 if not group.get('name'): return jsonify(success=False, reason='name-field-is-required') userz = group.get('users') sitez = group.get('sites') if userz: for user in userz: if not users.find_one({'email': user}): return jsonify(success=False, reason='user %s does not exist' % user) if sitez: for site in sitez: if not sites.find_one({'url': site}): return jsonify(success=False, reason='site %s does not exist' % site) if groups.find_one({'name': group['name']}) is not None: return jsonify(success=False, reason='group-already-exists') # post-validation new_group = { 'id': str(uuid.uuid4()), 'name': group['name'], 'description': group.get('description', ""), 'sites': group.get('sites', []), 'users': group.get('users', []), 'created': datetime.datetime.utcnow() } groups.insert(new_group) return jsonify(success=True, group=sanitize_group(new_group))
def create_group(): group = request.json # perform validations on incoming data; issue#132 if not group.get('name'): return jsonify(success=False, reason='name-field-is-required') userz = group.get('users') sitez = group.get('sites') if userz: for user in userz: if not users.find_one({'email': user}): return jsonify(success=False, reason='user %s does not exist'%user) if sitez: for site in sitez: if not sites.find_one({'name': site}): return jsonify(success=False, reason='site %s does not exist'%site) if groups.find_one({'name': group['name']}) is not None: return jsonify(success=False, reason='group-already-exists') # post-validation new_group = { 'id': str(uuid.uuid4()), 'name': group['name'], 'description': group.get('description', ""), 'sites': group.get('sites', []), 'users': group.get('users', []), 'created': datetime.datetime.utcnow() } groups.insert(new_group) return jsonify(success=True, group=sanitize_group(new_group))
def update_site(site_id): new_site = request.json # Verify incoming site. It must exist, groups must exist, plans must exist. site = sites.find_one({'id': site_id}) if not site: return jsonify(success=False, reason='no-such-site') site['groups'] = _find_groups_for_site(site['url']) for group in new_site.get('groups', []): if not _check_group_exists(group): return jsonify(success=False, reason='unknown-group') for plan_name in new_site.get('plans', []): if not _check_plan_exists(plan_name): return jsonify(success=False, reason='unknown-plan') if 'groups' in new_site: # Add new groups for group_name in new_site.get('groups', []): if group_name not in site['groups']: groups.update({'name':group_name},{'$addToSet': {'sites': site['url']}}) # Remove old groups for group_name in site['groups']: if group_name not in new_site.get('groups', []): groups.update({'name':group_name},{'$pull': {'sites': site['url']}}) if 'plans' in new_site: # Update the site. At this point we can only update plans. sites.update({'id': site_id}, {'$set': {'plans': new_site.get('plans')}}) new_verification = new_site['verification'] old_verification = site.get('verification') # if site doesn't have 'verification', do us a favor, update the document as it is outdated! if not old_verification or old_verification['enabled'] != new_verification['enabled']: # to make logic simpler, even if the new request wants to # disable verification, generate a new value anyway. sites.update({'id': site_id}, {'$set': { 'verification': { 'enabled': new_verification['enabled'], 'value': str(uuid.uuid4())}}}) # Return the updated site site = sites.find_one({'id': site_id}) if not site: return jsonify(success=False, reason='no-such-site') site['groups'] = _find_groups_for_site(site['url']) return jsonify(success=True, site=sanitize_site(site))
def get_scans(): limit = request.args.get('limit', 3) if limit: limit = int(limit) site = sites.find_one({'id': request.args.get('site_id')}) if not site: return jsonify(success=False, reason='no-such-site') scanz = scans.find({"plan.name": request.args.get("plan_name"), "configuration.target": site['url']}).sort("created", -1).limit(limit) return jsonify(success=True, scans=[summarize_scan(sanitize_scan(s)) for s in scanz])
def get_reports_sites(): result = [] group_name = request.args.get('group_name') user_email = request.args.get('user') if user_email is not None: # User specified, so return recent scans for each site/plan that the user can see user = users.find_one({'email': user_email}) if user is None: return jsonify(success=False, reason='no-such-user') if group_name: site_list = _find_sites_for_user_by_group_name( user_email, group_name) else: site_list = _find_sites_for_user(user_email) for site_url in sorted(site_list): site = sites.find_one({'url': site_url}) if site is not None: for plan_name in site['plans']: schedule = scanschedules.find_one({ 'site': site_url, 'plan': plan_name }) crontab = None scheduleEnabled = False if schedule is not None: crontab = schedule['crontab'] scheduleEnabled = schedule['enabled'] l = list( scans.find({ 'configuration.target': site['url'], 'plan.name': plan_name }).sort("created", -1).limit(1)) if len(l) == 1: scan = summarize_scan(sanitize_scan(l[0])) s = { v: scan.get(v) for v in ('id', 'created', 'state', 'issues') } result.append({ 'target': site_url, 'plan': plan_name, 'scan': scan, 'crontab': crontab, 'scheduleEnabled': scheduleEnabled }) else: result.append({ 'target': site_url, 'plan': plan_name, 'scan': None, 'crontab': crontab, 'scheduleEnabled': scheduleEnabled }) return jsonify(success=True, report=result)
def get_scans(): limit = request.args.get('limit', 3) if limit: limit = int(limit) site = sites.find_one({'id': request.args.get('site_id')}) if not site: return jsonify(success=False, reason='no-such-site') scanz = scans.find({ "plan.name": request.args.get("plan_name"), "configuration.target": site['url'] }).sort("created", -1).limit(limit) return jsonify(success=True, scans=[summarize_scan(sanitize_scan(s)) for s in scanz])
def get_scans(): limit = request.args.get("limit", 3) if limit: limit = int(limit) site = sites.find_one({"id": request.args.get("site_id")}) if not site: return jsonify(success=False, reason="no-such-site") scanz = ( scans.find({"plan.name": request.args.get("plan_name"), "configuration.target": site["url"]}) .sort("created", -1) .limit(limit) ) return jsonify(success=True, scans=[summarize_scan(sanitize_scan(s)) for s in scanz])
def get_sites(): query_url = request.args.get('url') if query_url: site = sites.find_one({'url': query_url}) if site: site['groups'] = _find_groups_for_site(site['url']) return jsonify(success=True, site=sanitize_site(site)) else: jsonify(success=True, site=[]) else: sitez = [sanitize_site(site) for site in sites.find()] for site in sitez: site['groups'] = _find_groups_for_site(site['url']) return jsonify(success=True, sites=sitez)
def create_site(): site = request.json # Verify incoming site: url must be valid, groups must exist, plans must exist if not _check_site_url(site.get('url')): return jsonify(success=False, reason='invalid-url') if not _check_required_fields(site, ['url']): return jsonify(success=False, reason='missing-required-field') for group in site.get('groups', []): if not _check_group_exists(group): return jsonify(success=False, reason='unknown-group') for plan_name in site.get('plans', []): if not _check_plan_exists(plan_name): return jsonify(success=False, reason='unknown-plan') if sites.find_one({'url': site['url']}) is not None: return jsonify(success=False, reason='site-already-exists') # Create the site new_site = { 'id': str(uuid.uuid4()), 'url': site['url'], 'plans': site.get('plans', []), 'created': datetime.datetime.utcnow() } if site.get('verification', {}).get('enabled', False): new_site['verification'] = { 'enabled': True, 'value': str(uuid.uuid4()) } else: new_site['verification'] = {'enabled': False, 'value': None} sites.insert(new_site) # Add the site to the groups - group membership is stored in the group object, not in the site for group_name in site.get('groups', []): # No need to check if the site is already in the group as we just added the site groups.update({'name': group_name}, {'$addToSet': { 'sites': site['url'] }}) new_site['groups'] = site.get('groups', []) # Return the new site return jsonify(success=True, site=sanitize_site(new_site))
def get_reports_sites(): result = [] user_email = request.args.get('user') if user_email is not None: # User specified, so return recent scans for each site/plan that the user can see user = users.find_one({'email': user_email}) if user is None: return jsonify(success=False, reason='no-such-user') for site_url in sorted(_find_sites_for_user(user_email)): site = sites.find_one({'url': site_url}) if site is not None: for plan_name in site['plans']: l = list(scans.find({'configuration.target':site['url'], 'plan.name': plan_name}).sort("created", -1).limit(1)) if len(l) == 1: scan = summarize_scan(sanitize_scan(l[0])) s = {v: scan.get(v) for v in ('id', 'created', 'state', 'issues')} result.append({'target': site_url, 'plan': plan_name, 'scan': scan}) else: result.append({'target': site_url, 'plan': plan_name, 'scan': None}) return jsonify(success=True, report=result)
def get_reports_issues(): result = [] group_name = request.args.get('group_name') user_email = request.args.get('user') if user_email is not None: # User specified, so return recent scans for each site/plan that the user can see user = users.find_one({'email': user_email}) if user is None: return jsonify(success=False, reason='no-such-user') if group_name: site_list = _find_sites_for_user_by_group_name( user_email, group_name) else: site_list = _find_sites_for_user(user_email) for site_url in sorted(site_list): r = {'target': site_url, 'issues': []} site = sites.find_one({'url': site_url}) if site is not None: for plan_name in site['plans']: for s in scans.find({ 'configuration.target': site['url'], 'plan.name': plan_name }).sort("created", -1).limit(1): for session in s['sessions']: for issue in session['issues']: r['issues'].append({ 'severity': issue['Severity'], 'summary': issue['Summary'], 'scan': { 'id': s['id'] }, 'id': issue['Id'] }) result.append(r) return jsonify(success=True, report=result)
def get_site(site_id): site = sites.find_one({'id': site_id}) if not site: return jsonify(success=False, reason='no-such-site') site['groups'] = _find_groups_for_site(site['url']) return jsonify(success=True, site=sanitize_site(site))
def get_site(site_id): site = sites.find_one({"id": site_id}) if not site: return jsonify(success=False, reason="no-such-site") site["groups"] = _find_groups_for_site(site["url"]) return jsonify(success=True, site=sanitize_site(site))