mirror of
https://github.com/empayre/fleet.git
synced 2024-11-06 17:05:18 +00:00
da171d3b8d
* Fix access control issues with users * Fix access control issues with packs * Fix access control issues with software * Changes suggested by Martin * All users can access the global schedule * Restrict access to activities * Add explicit test for team admin escalation vuln * All global users should be able to read all software * Handbook editor pass - Security - GitHub Security (#5108) * Update security.md All edits are recorded by line: 395 replaced “open-source” with “open source” 411 replaced “open-source” with “open source” 439 added “the” before “comment”; replaced “repositories,” with “repositories” 445 deleted “being” before “located” 458 added “and” after “PR” 489 replaced “on” with “in” 493 replaced “open-source” with “open source”; Replaced “privileges,” with “privileges” * Update security.md line 479 * Update security.md added (static analysis tools used to identify problems in code) to line 479 * Fix UI * Fix UI * revert api v1 to latest in documentation (#5149) * revert api v1 to latest in documentation * Update fleetctl doc page Co-authored-by: Noah Talerman <noahtal@umich.edu> * Add team admin team policy automation; fix e2e * Update to company page of the handbook (#5164) Updated "Why do we use a wireframe-first approach?" section of company.md * removed extra data on smaller screens (#5154) * Update for team automations; e2e * Jira Integration: Cypress e2e tests only (#5055) * Update company.md (#5170) This is to update the formatting under "empathy" and to fix the spelling of "help text." This was done as per @mikermcneil . This is related to #https://github.com/fleetdm/fleet/pull/4941 and https://github.com/fleetdm/fleet/issues/4902 * fix update updated_at for aggregated_stats (#5112) Update the updated_at column when using ON DUPLICATE UPDATE so that the counts_updated_at is up to date * basic sql formatting in code ie whitespace around operators * Fix e2e test * Fix tests in server/authz Co-authored-by: gillespi314 <73313222+gillespi314@users.noreply.github.com> Co-authored-by: Desmi-Dizney <99777687+Desmi-Dizney@users.noreply.github.com> Co-authored-by: Michal Nicpon <39177923+michalnicp@users.noreply.github.com> Co-authored-by: Noah Talerman <noahtal@umich.edu> Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com> Co-authored-by: Martavis Parker <47053705+martavis@users.noreply.github.com> Co-authored-by: RachelElysia <71795832+RachelElysia@users.noreply.github.com>
200 lines
5.6 KiB
Go
200 lines
5.6 KiB
Go
package service
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
"github.com/fleetdm/fleet/v4/server/fleet"
|
|
"github.com/fleetdm/fleet/v4/server/ptr"
|
|
)
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
// Get Global Schedule
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
|
type getGlobalScheduleRequest struct {
|
|
ListOptions fleet.ListOptions `url:"list_options"`
|
|
}
|
|
|
|
type getGlobalScheduleResponse struct {
|
|
GlobalSchedule []*fleet.ScheduledQuery `json:"global_schedule"`
|
|
Err error `json:"error,omitempty"`
|
|
}
|
|
|
|
func (r getGlobalScheduleResponse) error() error { return r.Err }
|
|
|
|
func getGlobalScheduleEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (interface{}, error) {
|
|
req := request.(*getGlobalScheduleRequest)
|
|
|
|
gp, err := svc.GetGlobalScheduledQueries(ctx, req.ListOptions)
|
|
if err != nil {
|
|
return getGlobalScheduleResponse{Err: err}, nil
|
|
}
|
|
|
|
return getGlobalScheduleResponse{
|
|
GlobalSchedule: gp,
|
|
}, nil
|
|
}
|
|
|
|
func (svc *Service) GetGlobalScheduledQueries(ctx context.Context, opts fleet.ListOptions) ([]*fleet.ScheduledQuery, error) {
|
|
if err := svc.authz.Authorize(ctx, &fleet.Pack{
|
|
Type: ptr.String("global"),
|
|
}, fleet.ActionRead); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
gp, err := svc.ds.EnsureGlobalPack(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
return svc.ds.ListScheduledQueriesInPackWithStats(ctx, gp.ID, opts)
|
|
}
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
// Global Schedule Query
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
|
type globalScheduleQueryRequest struct {
|
|
QueryID uint `json:"query_id"`
|
|
Interval uint `json:"interval"`
|
|
Snapshot *bool `json:"snapshot"`
|
|
Removed *bool `json:"removed"`
|
|
Platform *string `json:"platform"`
|
|
Version *string `json:"version"`
|
|
Shard *uint `json:"shard"`
|
|
}
|
|
|
|
type globalScheduleQueryResponse struct {
|
|
Scheduled *fleet.ScheduledQuery `json:"scheduled,omitempty"`
|
|
Err error `json:"error,omitempty"`
|
|
}
|
|
|
|
func (r globalScheduleQueryResponse) error() error { return r.Err }
|
|
|
|
func globalScheduleQueryEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (interface{}, error) {
|
|
req := request.(*globalScheduleQueryRequest)
|
|
|
|
scheduled, err := svc.GlobalScheduleQuery(ctx, &fleet.ScheduledQuery{
|
|
QueryID: req.QueryID,
|
|
Interval: req.Interval,
|
|
Snapshot: req.Snapshot,
|
|
Removed: req.Removed,
|
|
Platform: req.Platform,
|
|
Version: req.Version,
|
|
Shard: req.Shard,
|
|
})
|
|
if err != nil {
|
|
return globalScheduleQueryResponse{Err: err}, nil
|
|
}
|
|
return globalScheduleQueryResponse{Scheduled: scheduled}, nil
|
|
}
|
|
|
|
func (svc *Service) GlobalScheduleQuery(ctx context.Context, sq *fleet.ScheduledQuery) (*fleet.ScheduledQuery, error) {
|
|
if err := svc.authz.Authorize(ctx, &fleet.Pack{
|
|
Type: ptr.String("global"),
|
|
}, fleet.ActionRead); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
gp, err := svc.ds.EnsureGlobalPack(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
sq.PackID = gp.ID
|
|
|
|
return svc.ScheduleQuery(ctx, sq)
|
|
}
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
// Modify Global Schedule
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
|
type modifyGlobalScheduleRequest struct {
|
|
ID uint `json:"-" url:"id"`
|
|
fleet.ScheduledQueryPayload
|
|
}
|
|
|
|
type modifyGlobalScheduleResponse struct {
|
|
Scheduled *fleet.ScheduledQuery `json:"scheduled,omitempty"`
|
|
Err error `json:"error,omitempty"`
|
|
}
|
|
|
|
func (r modifyGlobalScheduleResponse) error() error { return r.Err }
|
|
|
|
func modifyGlobalScheduleEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (interface{}, error) {
|
|
req := request.(*modifyGlobalScheduleRequest)
|
|
|
|
sq, err := svc.ModifyGlobalScheduledQueries(ctx, req.ID, req.ScheduledQueryPayload)
|
|
if err != nil {
|
|
return modifyGlobalScheduleResponse{Err: err}, nil
|
|
}
|
|
|
|
return modifyGlobalScheduleResponse{
|
|
Scheduled: sq,
|
|
}, nil
|
|
}
|
|
|
|
func (svc *Service) ModifyGlobalScheduledQueries(ctx context.Context, id uint, query fleet.ScheduledQueryPayload) (*fleet.ScheduledQuery, error) {
|
|
if err := svc.authz.Authorize(ctx, &fleet.Pack{
|
|
Type: ptr.String("global"),
|
|
}, fleet.ActionWrite); err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
gp, err := svc.ds.EnsureGlobalPack(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
query.PackID = ptr.Uint(gp.ID)
|
|
|
|
return svc.ModifyScheduledQuery(ctx, id, query)
|
|
}
|
|
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
// Delete Global Schedule
|
|
////////////////////////////////////////////////////////////////////////////////
|
|
|
|
type deleteGlobalScheduleRequest struct {
|
|
ID uint `url:"id"`
|
|
}
|
|
|
|
type deleteGlobalScheduleResponse struct {
|
|
Err error `json:"error,omitempty"`
|
|
}
|
|
|
|
func (r deleteGlobalScheduleResponse) error() error { return r.Err }
|
|
|
|
func deleteGlobalScheduleEndpoint(ctx context.Context, request interface{}, svc fleet.Service) (interface{}, error) {
|
|
req := request.(*deleteGlobalScheduleRequest)
|
|
err := svc.DeleteGlobalScheduledQueries(ctx, req.ID)
|
|
if err != nil {
|
|
return deleteGlobalScheduleResponse{Err: err}, nil
|
|
}
|
|
|
|
return deleteGlobalScheduleResponse{}, nil
|
|
}
|
|
|
|
func (svc *Service) DeleteGlobalScheduledQueries(ctx context.Context, id uint) error {
|
|
if err := svc.authz.Authorize(ctx, &fleet.Pack{
|
|
Type: ptr.String("global"),
|
|
}, fleet.ActionWrite); err != nil {
|
|
return err
|
|
}
|
|
|
|
globalPack, err := svc.ds.EnsureGlobalPack(ctx)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
scheduledQuery, err := svc.ds.ScheduledQuery(ctx, id)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
if scheduledQuery.PackID != globalPack.ID {
|
|
return fmt.Errorf("scheduled query %d is not global", id)
|
|
}
|
|
|
|
return svc.DeleteScheduledQuery(ctx, id)
|
|
}
|