fleet/server/service/global_schedule.go
Lucas Manuel Rodriguez da171d3b8d
Merge pull request from GHSA-pr2g-j78h-84cr
* Fix access control issues with users

* Fix access control issues with packs

* Fix access control issues with software

* Changes suggested by Martin

* All users can access the global schedule

* Restrict access to activities

* Add explicit test for team admin escalation vuln

* All global users should be able to read all software

* Handbook editor pass - Security - GitHub Security (#5108)

* Update security.md

All edits are recorded by line:

395 replaced “open-source” with “open source”
411 replaced “open-source” with “open source”
439 added “the” before “comment”; replaced “repositories,” with “repositories”
445 deleted “being” before “located”
458 added “and” after “PR”
489 replaced “on” with “in”
493 replaced “open-source” with “open source”; Replaced “privileges,” with “privileges”

* Update security.md

line 479

* Update security.md

added (static analysis tools used to identify problems in code) to line 479

* Fix UI

* Fix UI

* revert api v1 to latest in documentation (#5149)

* revert api v1 to latest in documentation

* Update fleetctl doc page

Co-authored-by: Noah Talerman <noahtal@umich.edu>

* Add team admin team policy automation; fix e2e

* Update to company page of the handbook (#5164)

Updated "Why do we use a wireframe-first approach?" section of company.md

* removed extra data on smaller screens (#5154)

* Update for team automations; e2e

* Jira Integration: Cypress e2e tests only (#5055)

* Update company.md (#5170)

This is to update the formatting under "empathy" and to fix the spelling of "help text."
This was done as per @mikermcneil .
This is related to #https://github.com/fleetdm/fleet/pull/4941 and https://github.com/fleetdm/fleet/issues/4902

* fix update updated_at for aggregated_stats (#5112)

Update the updated_at column when using ON DUPLICATE UPDATE so that
the counts_updated_at is up to date

* basic sql formatting in code ie whitespace around operators

* Fix e2e test

* Fix tests in server/authz

Co-authored-by: gillespi314 <73313222+gillespi314@users.noreply.github.com>
Co-authored-by: Desmi-Dizney <99777687+Desmi-Dizney@users.noreply.github.com>
Co-authored-by: Michal Nicpon <39177923+michalnicp@users.noreply.github.com>
Co-authored-by: Noah Talerman <noahtal@umich.edu>
Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Co-authored-by: Martavis Parker <47053705+martavis@users.noreply.github.com>
Co-authored-by: RachelElysia <71795832+RachelElysia@users.noreply.github.com>
2022-04-18 10:27:30 -07:00

200 lines
5.6 KiB
Go

package service
import (
"context"
"fmt"
"github.com/fleetdm/fleet/v4/server/fleet"
"github.com/fleetdm/fleet/v4/server/ptr"
)
////////////////////////////////////////////////////////////////////////////////
// Get Global Schedule
////////////////////////////////////////////////////////////////////////////////
type getGlobalScheduleRequest struct {
ListOptions fleet.ListOptions `url:"list_options"`
}
type getGlobalScheduleResponse struct {
GlobalSchedule []*fleet.ScheduledQuery `json:"global_schedule"`
Err error `json:"error,omitempty"`
}
func (r getGlobalScheduleResponse) error() error { return r.Err }
func getGlobalScheduleEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (interface{}, error) {
req := request.(*getGlobalScheduleRequest)
gp, err := svc.GetGlobalScheduledQueries(ctx, req.ListOptions)
if err != nil {
return getGlobalScheduleResponse{Err: err}, nil
}
return getGlobalScheduleResponse{
GlobalSchedule: gp,
}, nil
}
func (svc *Service) GetGlobalScheduledQueries(ctx context.Context, opts fleet.ListOptions) ([]*fleet.ScheduledQuery, error) {
if err := svc.authz.Authorize(ctx, &fleet.Pack{
Type: ptr.String("global"),
}, fleet.ActionRead); err != nil {
return nil, err
}
gp, err := svc.ds.EnsureGlobalPack(ctx)
if err != nil {
return nil, err
}
return svc.ds.ListScheduledQueriesInPackWithStats(ctx, gp.ID, opts)
}
////////////////////////////////////////////////////////////////////////////////
// Global Schedule Query
////////////////////////////////////////////////////////////////////////////////
type globalScheduleQueryRequest struct {
QueryID uint `json:"query_id"`
Interval uint `json:"interval"`
Snapshot *bool `json:"snapshot"`
Removed *bool `json:"removed"`
Platform *string `json:"platform"`
Version *string `json:"version"`
Shard *uint `json:"shard"`
}
type globalScheduleQueryResponse struct {
Scheduled *fleet.ScheduledQuery `json:"scheduled,omitempty"`
Err error `json:"error,omitempty"`
}
func (r globalScheduleQueryResponse) error() error { return r.Err }
func globalScheduleQueryEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (interface{}, error) {
req := request.(*globalScheduleQueryRequest)
scheduled, err := svc.GlobalScheduleQuery(ctx, &fleet.ScheduledQuery{
QueryID: req.QueryID,
Interval: req.Interval,
Snapshot: req.Snapshot,
Removed: req.Removed,
Platform: req.Platform,
Version: req.Version,
Shard: req.Shard,
})
if err != nil {
return globalScheduleQueryResponse{Err: err}, nil
}
return globalScheduleQueryResponse{Scheduled: scheduled}, nil
}
func (svc *Service) GlobalScheduleQuery(ctx context.Context, sq *fleet.ScheduledQuery) (*fleet.ScheduledQuery, error) {
if err := svc.authz.Authorize(ctx, &fleet.Pack{
Type: ptr.String("global"),
}, fleet.ActionRead); err != nil {
return nil, err
}
gp, err := svc.ds.EnsureGlobalPack(ctx)
if err != nil {
return nil, err
}
sq.PackID = gp.ID
return svc.ScheduleQuery(ctx, sq)
}
////////////////////////////////////////////////////////////////////////////////
// Modify Global Schedule
////////////////////////////////////////////////////////////////////////////////
type modifyGlobalScheduleRequest struct {
ID uint `json:"-" url:"id"`
fleet.ScheduledQueryPayload
}
type modifyGlobalScheduleResponse struct {
Scheduled *fleet.ScheduledQuery `json:"scheduled,omitempty"`
Err error `json:"error,omitempty"`
}
func (r modifyGlobalScheduleResponse) error() error { return r.Err }
func modifyGlobalScheduleEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (interface{}, error) {
req := request.(*modifyGlobalScheduleRequest)
sq, err := svc.ModifyGlobalScheduledQueries(ctx, req.ID, req.ScheduledQueryPayload)
if err != nil {
return modifyGlobalScheduleResponse{Err: err}, nil
}
return modifyGlobalScheduleResponse{
Scheduled: sq,
}, nil
}
func (svc *Service) ModifyGlobalScheduledQueries(ctx context.Context, id uint, query fleet.ScheduledQueryPayload) (*fleet.ScheduledQuery, error) {
if err := svc.authz.Authorize(ctx, &fleet.Pack{
Type: ptr.String("global"),
}, fleet.ActionWrite); err != nil {
return nil, err
}
gp, err := svc.ds.EnsureGlobalPack(ctx)
if err != nil {
return nil, err
}
query.PackID = ptr.Uint(gp.ID)
return svc.ModifyScheduledQuery(ctx, id, query)
}
////////////////////////////////////////////////////////////////////////////////
// Delete Global Schedule
////////////////////////////////////////////////////////////////////////////////
type deleteGlobalScheduleRequest struct {
ID uint `url:"id"`
}
type deleteGlobalScheduleResponse struct {
Err error `json:"error,omitempty"`
}
func (r deleteGlobalScheduleResponse) error() error { return r.Err }
func deleteGlobalScheduleEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (interface{}, error) {
req := request.(*deleteGlobalScheduleRequest)
err := svc.DeleteGlobalScheduledQueries(ctx, req.ID)
if err != nil {
return deleteGlobalScheduleResponse{Err: err}, nil
}
return deleteGlobalScheduleResponse{}, nil
}
func (svc *Service) DeleteGlobalScheduledQueries(ctx context.Context, id uint) error {
if err := svc.authz.Authorize(ctx, &fleet.Pack{
Type: ptr.String("global"),
}, fleet.ActionWrite); err != nil {
return err
}
globalPack, err := svc.ds.EnsureGlobalPack(ctx)
if err != nil {
return err
}
scheduledQuery, err := svc.ds.ScheduledQuery(ctx, id)
if err != nil {
return err
}
if scheduledQuery.PackID != globalPack.ID {
return fmt.Errorf("scheduled query %d is not global", id)
}
return svc.DeleteScheduledQuery(ctx, id)
}