ATTENTION: VINCE web interface and API interfaces will be down for maintenance from 1200 EDT on Tuesday, March 19, 2024, until no later than 0900 EDT Wednesday, March 20, 2024.
+
diff --git a/vincepub/views.py b/vincepub/views.py
index cee581a..4c76545 100644
--- a/vincepub/views.py
+++ b/vincepub/views.py
@@ -44,7 +44,7 @@
from django.contrib.postgres.search import SearchVector, SearchRank
from django.urls import reverse
from django.utils import timezone
-from django.utils.encoding import force_text
+from django.utils.encoding import force_str as force_text
from django.core.paginator import Paginator
from django.db import connection
from django.db.models import Q
diff --git a/vinceworker/urls.py b/vinceworker/urls.py
index 64dc53f..1b02500 100644
--- a/vinceworker/urls.py
+++ b/vinceworker/urls.py
@@ -41,12 +41,12 @@
1. Import the include() function: from django.conf.urls import url, include
2. Add a URL to urlpatterns: url(r'^blog/', include('blog.urls'))
"""
-from django.conf.urls import url
+from django.urls import include, re_path
from vinceworker.views import ingest_vulreport, send_daily_digest, generate_reminders, send_weekly_report
urlpatterns = [
- url(r'^ingest-vulreport/$', ingest_vulreport, name='ingest_vulreport'),
- url(r'^daily/$', send_daily_digest, name='daily_digest'),
- url(r'^reminder/$', generate_reminders, name="reminders"),
- url(r'^weeklyreport/$', send_weekly_report, name='weeklyreport'),
+ re_path(r"^ingest-vulreport/$", ingest_vulreport, name="ingest_vulreport"),
+ re_path(r"^daily/$", send_daily_digest, name="daily_digest"),
+ re_path(r"^reminder/$", generate_reminders, name="reminders"),
+ re_path(r"^weeklyreport/$", send_weekly_report, name="weeklyreport"),
]
diff --git a/vinny/__init__.py b/vinny/__init__.py
index 2aad82d..72a81e8 100644
--- a/vinny/__init__.py
+++ b/vinny/__init__.py
@@ -27,6 +27,7 @@
# DM21-1126
########################################################################
from __future__ import absolute_import, unicode_literals
+import django
-default_app_config = 'vinny.apps.VinceCommConfig'
-
+if django.VERSION < (3, 2):
+ default_app_config = "vinny.apps.VinceCommConfig"
diff --git a/vinny/forms.py b/vinny/forms.py
index 2fe7bc4..3bf6ca8 100644
--- a/vinny/forms.py
+++ b/vinny/forms.py
@@ -41,7 +41,7 @@
from django.core.exceptions import ValidationError
import mimetypes
import os
-from django.utils.encoding import smart_text
+from django.utils.encoding import smart_str as smart_text
from vinny.settings import DEFAULT_USER_SETTINGS
from django.urls import reverse, reverse_lazy
import base64
diff --git a/vinny/models.py b/vinny/models.py
index eb14c79..7a7c1e5 100644
--- a/vinny/models.py
+++ b/vinny/models.py
@@ -27,8 +27,9 @@
# DM21-1126
########################################################################
from django.db import models, transaction
+
# Create your models here.
-from django.utils.translation import ugettext, gettext_lazy as _
+from django.utils.translation import gettext, gettext_lazy as _
from django.contrib.auth.models import User, Group
from django.conf import settings
from django.contrib.postgres.indexes import GinIndex
@@ -40,12 +41,13 @@
from django.urls import reverse
from django.contrib.auth.hashers import make_password
import logging
-#from .signals import message_sent
+
+# from .signals import message_sent
from .utils import cached_attribute
from django.utils.functional import cached_property
from vinny.mailer import send_newmessage_mail
from bigvince.storage_backends import PrivateMediaStorage, SharedMediaStorage
-from django.utils.encoding import smart_text
+from django.utils.encoding import smart_str as smart_text
from lib.vince.m2crypto_encrypt_decrypt import ED
import base64
import os
@@ -61,44 +63,43 @@
from lib.vince import utils as vinceutils
from django.db.models import JSONField
+
class OldJSONField(JSONField):
- """ This was due to legacy support in Django 2.2. from_db_value
- should be explicitily sepcified when extending JSONField """
+ """This was due to legacy support in Django 2.2. from_db_value
+ should be explicitily sepcified when extending JSONField"""
def db_type(self, connection):
- return 'json'
+ return "json"
def from_db_value(self, value, expression, connection):
return value
+
logger = logging.getLogger(__name__)
logger.setLevel(logging.DEBUG)
-message_sent = Signal(providing_args=["message", "thread", "reply"])
+message_sent = Signal()
+# providing_args=["message", "thread", "reply"])
+
def random_logo_color():
- return "#"+''.join([random.choice('0123456789ABCDEF') for j in range(6)])
+ return "#" + "".join([random.choice("0123456789ABCDEF") for j in range(6)])
+
def generate_uuid():
return uuid.uuid1()
+
class VinceAPIToken(models.Model):
"""
The default authorization token model
"""
- key = models.CharField(
- _("Key"),
- max_length=250,
- primary_key=True)
-
- user = models.OneToOneField(
- settings.AUTH_USER_MODEL,
- related_name="auth_token",
- on_delete=models.CASCADE)
- created = models.DateTimeField(
- _("Created"),
- auto_now_add=True)
+ key = models.CharField(_("Key"), max_length=250, primary_key=True)
+
+ user = models.OneToOneField(settings.AUTH_USER_MODEL, related_name="auth_token", on_delete=models.CASCADE)
+
+ created = models.DateTimeField(_("Created"), auto_now_add=True)
class Meta:
verbose_name = _("Token")
@@ -120,30 +121,31 @@ def __str__(self):
class VinceProfile(models.Model):
- user = models.OneToOneField(settings.AUTH_USER_MODEL,
- related_name="vinceprofile",
- on_delete=models.CASCADE)
+ user = models.OneToOneField(settings.AUTH_USER_MODEL, related_name="vinceprofile", on_delete=models.CASCADE)
org = models.CharField(max_length=250, blank=True, null=True)
preferred_username = models.CharField(max_length=250, blank=True, null=True)
country = CountryField(blank=True, null=True, default="US")
email_verified = models.BooleanField(default=False)
title = models.CharField(max_length=200, blank=True, null=True)
logocolor = models.CharField(max_length=10, default=random_logo_color)
- #if we don't know this user, the user must go into pending mode before they can login
+ # if we don't know this user, the user must go into pending mode before they can login
api_key = models.CharField(max_length=256, blank=True, null=True)
pending = models.BooleanField(default=True)
ignored = models.BooleanField(default=False)
service = models.BooleanField(default=False)
multifactor = models.BooleanField(default=False)
- timezone = models.CharField(default='UTC', max_length=100)
+ timezone = models.CharField(default="UTC", max_length=100)
settings_pickled = models.TextField(
- _('Settings Dictionary'),
- help_text=_('This is a base64-encoded representation of a '
- 'pickled Python dictionary.'
- 'Do not change this field via the admin.'),
+ _("Settings Dictionary"),
+ help_text=_(
+ "This is a base64-encoded representation of a "
+ "pickled Python dictionary."
+ "Do not change this field via the admin."
+ ),
blank=True,
- null=True,
+ null=True,
)
+
def _get_username(self):
if self.preferred_username:
return self.preferred_username
@@ -153,21 +155,21 @@ def _get_username(self):
vince_username = property(_get_username)
def _get_track_access(self):
- return self.user.groups.filter(name='vincetrack').exists()
+ return self.user.groups.filter(name="vincetrack").exists()
is_track = property(_get_track_access)
-
+
def _get_url(self):
ed = ED(base64.b64encode(settings.SECRET_KEY.encode()))
euid = ed.encrypt(str(self.user.pk))
return reverse("vinny:usercard", args=[euid])
url = property(_get_url)
-
+
def _get_logo(self):
groups = self.user.groups.exclude(groupcontact__isnull=True)
if len(groups) >= 1:
- logo_groups = groups.exclude(Q(groupcontact__logo='')|Q(groupcontact__logo=None))
+ logo_groups = groups.exclude(Q(groupcontact__logo="") | Q(groupcontact__logo=None))
if len(logo_groups) >= 1:
return logo_groups[0].groupcontact.get_logo()
return None
@@ -175,7 +177,9 @@ def _get_logo(self):
logo = property(_get_logo)
def _get_vendor_status(self):
- groups = self.user.groups.filter(groupcontact__contact__active=True).exclude(groupcontact__contact__isnull=True)
+ groups = self.user.groups.filter(groupcontact__contact__active=True).exclude(
+ groupcontact__contact__isnull=True
+ )
if len(groups) >= 1:
vendor_groups = groups.exclude(groupcontact__contact__vendor_type__in=["Contact", "User"])
if len(vendor_groups) >= 1:
@@ -185,13 +189,15 @@ def _get_vendor_status(self):
is_vendor = property(_get_vendor_status)
def _get_admin_status(self):
- admin = VinceCommGroupAdmin.objects.filter(email__email=self.user.email, contact__active=True, contact__vendor_type__in=["Coordinator", "Vendor"])
+ admin = VinceCommGroupAdmin.objects.filter(
+ email__email=self.user.email, contact__active=True, contact__vendor_type__in=["Coordinator", "Vendor"]
+ )
if admin:
return True
return False
is_vendor_admin = property(_get_admin_status)
-
+
def __str__(self):
if self.preferred_username:
return self.preferred_username
@@ -199,7 +205,7 @@ def __str__(self):
return self.user.get_full_name()
name = property(__str__)
-
+
def _first_initial(self):
if self.preferred_username:
return self.preferred_username[0]
@@ -209,7 +215,7 @@ def _first_initial(self):
return "?"
initial = property(_first_initial)
-
+
def _get_association(self):
if self.real_org:
return self.real_org
@@ -228,10 +234,10 @@ def _get_modified(self):
return timezone.now()
modified = property(_get_modified)
-
+
def _set_settings(self, data):
# data should always be a Python dictionary.
- if not isinstance(data,dict):
+ if not isinstance(data, dict):
print("Non dictionary item sent to pickle %s" % str(data))
logger.warn("Non dictionary item sent to pickle %s" % str(data))
data = {}
@@ -240,34 +246,37 @@ def _set_settings(self, data):
except ImportError:
import cPickle as pickle
from base64 import encodebytes as b64encode
+
self.settings_pickled = b64encode(pickle.dumps(data)).decode()
-
+
def _get_settings(self):
# return a python dictionary representing the pickled data.
try:
import pickle
except ImportError:
import cPickle as pickle
+
class RestrictedUnpickler(pickle.Unpickler):
def find_class(self, module, name):
- """ If find_class gets called then return error """
- raise pickle.UnpicklingError("global '%s.%s' is forbidden" %
- (module, name))
+ """If find_class gets called then return error"""
+ raise pickle.UnpicklingError("global '%s.%s' is forbidden" % (module, name))
+
try:
from base64 import decodebytes as b64decode
+
if self.settings_pickled:
- s = b64decode(self.settings_pickled.encode('utf-8'))
- #replacement for pickle.loads()
+ s = b64decode(self.settings_pickled.encode("utf-8"))
+ # replacement for pickle.loads()
return RestrictedUnpickler(io.BytesIO(s)).load()
else:
return {}
except (pickle.UnpicklingError, AttributeError) as e:
- print("Error when trying to unpickle data %s " %(str(e)))
- logger.warn("Error when trying to unpickle data %s " %(str(e)))
+ print("Error when trying to unpickle data %s " % (str(e)))
+ logger.warn("Error when trying to unpickle data %s " % (str(e)))
return {}
except Exception as e:
- print("Generic error when trying to unpickle data %s " %(str(e)))
- logger.warn("Generic error when trying to unpickle data %s " %(str(e)))
+ print("Generic error when trying to unpickle data %s " % (str(e)))
+ logger.warn("Generic error when trying to unpickle data %s " % (str(e)))
return {}
settings = property(_get_settings, _set_settings)
@@ -275,14 +284,15 @@ def find_class(self, module, name):
@property
@cached_attribute
def real_org(self):
- groups = self.user.groups.filter(groupcontact__contact__vendor_type="Vendor").exclude(groupcontact__isnull=True)
+ groups = self.user.groups.filter(groupcontact__contact__vendor_type="Vendor").exclude(
+ groupcontact__isnull=True
+ )
my_groups = []
for ug in groups:
my_groups.append(ug.groupcontact.contact.vendor_name)
return ", ".join(my_groups)
-
"""
def get_username(self):
if self.vinceprofile.preferred_username:
@@ -293,18 +303,16 @@ def get_username(self):
User.add_to_class("__str__", get_username)
"""
+
class VinceCommContact(models.Model):
VENDOR_TYPE = (
- ('Contact', 'Contact'),
- ('Vendor', 'Vendor'),
- ('User', 'User'),
- ('Coordinator', 'Coordinator'),
+ ("Contact", "Contact"),
+ ("Vendor", "Vendor"),
+ ("User", "User"),
+ ("Coordinator", "Coordinator"),
)
- LOCATION_CHOICES=(
- ('Domestic', 'Domestic'),
- ('International', 'International')
- )
+ LOCATION_CHOICES = (("Domestic", "Domestic"), ("International", "International"))
vendor_id = models.IntegerField()
vendor_name = models.CharField(max_length=100)
@@ -314,20 +322,25 @@ class VinceCommContact(models.Model):
location = models.CharField(max_length=15, choices=LOCATION_CHOICES, default="domestic")
version = models.IntegerField(default=0)
uuid = models.UUIDField(blank=True, null=True, editable=False)
-
+
def __str__(self):
return self.vendor_name
def get_absolute_url(self):
from django.urls import reverse
- return reverse('vinny:contact', args=(self.id,))
+
+ return reverse("vinny:contact", args=(self.id,))
def get_emails(self):
- email_contact = VinceCommEmail.objects.filter(contact=self, status=True).values_list('email', flat=True)
+ email_contact = VinceCommEmail.objects.filter(contact=self, status=True).values_list("email", flat=True)
return list(email_contact)
def get_list_email(self):
- email_list = VinceCommEmail.objects.filter(contact=self, email_list=True, status=True, public=True).exclude(name__icontains='service').first()
+ email_list = (
+ VinceCommEmail.objects.filter(contact=self, email_list=True, status=True, public=True)
+ .exclude(name__icontains="service")
+ .first()
+ )
if email_list:
return email_list.email
else:
@@ -340,17 +353,18 @@ def get_phone_number(self):
else:
return ""
+
class VinceCommPostal(models.Model):
ADDRESS_TYPE = (
- ('Home', 'Home'),
- ('Work', 'Work'),
- ('Other', 'Other'),
- ('School', 'School'),
+ ("Home", "Home"),
+ ("Work", "Work"),
+ ("Other", "Other"),
+ ("School", "School"),
)
contact = models.ForeignKey(VinceCommContact, on_delete=models.CASCADE)
country = CountryField(blank=True, null=True, default="US")
primary = models.BooleanField(default=True)
- address_type = models.CharField(max_length=20, choices=ADDRESS_TYPE, default='Work')
+ address_type = models.CharField(max_length=20, choices=ADDRESS_TYPE, default="Work")
street = models.CharField(max_length=150)
street2 = models.CharField(max_length=150, blank=True, null=True)
city = models.CharField(max_length=50)
@@ -365,16 +379,16 @@ def __str__(self):
class VinceCommPhone(models.Model):
PHONE_TYPE = (
- ('Fax', 'Fax'),
- ('Home', 'Home'),
- ('Hotline', 'Hotline'),
- ('Office', 'Office'),
- ('Mobile', 'Mobile'),
+ ("Fax", "Fax"),
+ ("Home", "Home"),
+ ("Hotline", "Hotline"),
+ ("Office", "Office"),
+ ("Mobile", "Mobile"),
)
contact = models.ForeignKey(VinceCommContact, on_delete=models.CASCADE)
country_code = models.CharField(max_length=5, default="+1")
phone = models.CharField(max_length=50)
- phone_type = models.CharField(max_length=20, choices=PHONE_TYPE, default='Work')
+ phone_type = models.CharField(max_length=20, choices=PHONE_TYPE, default="Work")
comment = models.CharField(max_length=200, blank=True, null=True)
version = models.IntegerField(default=0)
public = models.BooleanField(default=False)
@@ -382,30 +396,21 @@ class VinceCommPhone(models.Model):
def __str__(self):
return "%s %s" % (country_code, phone)
+
class VinceCommEmail(models.Model):
- EMAIL_FUNCTION=(
- ('TO', 'TO'),
- ('CC', 'CC'),
- ('EMAIL', 'EMAIL'),
- ('REPLYTO', 'REPLYTO')
- )
- EMAIL_TYPE = (
- ('Work', 'Work'),
- ('Other', 'Other'),
- ('Home', 'Home'),
- ('School', 'School')
- )
+ EMAIL_FUNCTION = (("TO", "TO"), ("CC", "CC"), ("EMAIL", "EMAIL"), ("REPLYTO", "REPLYTO"))
+ EMAIL_TYPE = (("Work", "Work"), ("Other", "Other"), ("Home", "Home"), ("School", "School"))
contact = models.ForeignKey(VinceCommContact, on_delete=models.CASCADE)
email = models.EmailField(max_length=254)
- email_type = models.CharField(max_length=20, choices=EMAIL_TYPE, default='Work')
+ email_type = models.CharField(max_length=20, choices=EMAIL_TYPE, default="Work")
name = models.CharField(max_length=200, blank=True, null=True)
- email_function = models.CharField(max_length=10, choices=EMAIL_FUNCTION, default='TO')
+ email_function = models.CharField(max_length=10, choices=EMAIL_FUNCTION, default="TO")
status = models.BooleanField(default=True)
version = models.IntegerField(default=0)
invited = models.BooleanField(default=False)
public = models.BooleanField(default=False)
email_list = models.BooleanField(default=True)
-
+
def __str__(self):
return self.email
@@ -420,6 +425,7 @@ class VinceCommWebsite(models.Model):
def __str__(self):
return self.url
+
class VinceCommPgP(models.Model):
contact = models.ForeignKey(VinceCommContact, on_delete=models.CASCADE)
pgp_key_id = models.CharField(max_length=200)
@@ -432,46 +438,30 @@ class VinceCommPgP(models.Model):
pgp_protocol = models.CharField(max_length=30, default="GPG1 ARMOR MIME")
version = models.IntegerField(default=0)
public = models.BooleanField(default=False)
- pgp_email = models.EmailField(max_length=254,
- help_text=_('The email address that belongs with this PGP key'),
- blank=True, null=True)
+ pgp_email = models.EmailField(
+ max_length=254, help_text=_("The email address that belongs with this PGP key"), blank=True, null=True
+ )
def __str__(self):
return self.pgp_fingerprint
class ContactInfoChange(models.Model):
- contact = models.ForeignKey(
- VinceCommContact,
- on_delete=models.CASCADE
- )
- model = models.CharField(
- _('Model'), max_length=100
- )
- field = models.CharField(
- _('Field'), max_length=100
- )
- old_value = models.TextField(
- _('Old Value'),
- blank=True,
- null=True
- )
- new_value = models.TextField(
- _('New Value'),
- blank=True,
- null=True
- )
-
+ contact = models.ForeignKey(VinceCommContact, on_delete=models.CASCADE)
+ model = models.CharField(_("Model"), max_length=100)
+ field = models.CharField(_("Field"), max_length=100)
+ old_value = models.TextField(_("Old Value"), blank=True, null=True)
+ new_value = models.TextField(_("New Value"), blank=True, null=True)
+
action = models.ForeignKey(
"VendorAction",
on_delete=models.CASCADE,
blank=True,
null=True,
- verbose_name=_('Vendor Action'),
+ verbose_name=_("Vendor Action"),
)
- approved = models.BooleanField(
- default=False)
-
+ approved = models.BooleanField(default=False)
+
def _get_ts(self):
if self.action:
return self.action.created
@@ -479,52 +469,39 @@ def _get_ts(self):
return timezone.now()
action_ts = property(_get_ts)
-
+
def __str__(self):
- out = '%s: %s: %s ' % (self.action, self.model, self.field)
+ out = "%s: %s: %s " % (self.action, self.model, self.field)
if not self.new_value:
-# out += ugettext('removed')
- out += '%s' % self.old_value
+ # out += ugettext('removed')
+ out += "%s" % self.old_value
elif not self.old_value:
- out += _('added %s') % self.new_value
+ out += _("added %s") % self.new_value
else:
out += _('changed from "%(old_value)s" to "%(new_value)s"') % {
- 'old_value': self.old_value,
- 'new_value': self.new_value
+ "old_value": self.old_value,
+ "new_value": self.new_value,
}
return out
+
def __repr__(self):
return self.__str__()
-
+
class GroupContact(models.Model):
- group = models.OneToOneField(
- Group,
- on_delete=models.CASCADE)
+ group = models.OneToOneField(Group, on_delete=models.CASCADE)
- contact = models.ForeignKey(
- VinceCommContact,
- on_delete=models.CASCADE,
- blank=True,
- null=True)
+ contact = models.ForeignKey(VinceCommContact, on_delete=models.CASCADE, blank=True, null=True)
default_access = models.BooleanField(
- default=True,
- help_text="If true, grant case access to users in group by default")
-
- logo = models.FileField(
- storage=SharedMediaStorage(location="vince_logos"),
- blank=True,
- null=True)
+ default=True, help_text="If true, grant case access to users in group by default"
+ )
- logocolor = models.CharField(
- max_length=10,
- default=random_logo_color)
+ logo = models.FileField(storage=SharedMediaStorage(location="vince_logos"), blank=True, null=True)
- vincetrack = models.BooleanField(
- default=False,
- help_text="Is this a vincetrack group?"
- )
+ logocolor = models.CharField(max_length=10, default=random_logo_color)
+
+ vincetrack = models.BooleanField(default=False, help_text="Is this a vincetrack group?")
def _get_url(self):
ed = ED(base64.b64encode(settings.SECRET_KEY.encode()))
@@ -532,7 +509,7 @@ def _get_url(self):
return reverse("vinny:groupcard", args=[egid])
url = property(_get_url)
-
+
def get_logo(self):
if self.logo:
return self.logo.url
@@ -565,140 +542,121 @@ def get_vince_users(self):
class CoordinatorSettings(models.Model):
- group = models.OneToOneField(
- Group,
- on_delete=models.CASCADE)
+ group = models.OneToOneField(Group, on_delete=models.CASCADE)
team_signature = models.TextField(
blank=True,
null=True,
- help_text=_('Email signature for automatic case messages sent by VINCE to case participants'),
+ help_text=_("Email signature for automatic case messages sent by VINCE to case participants"),
)
team_email = models.CharField(
max_length=100,
blank=True,
null=True,
- help_text=_('Email address to use for outgoing email. If not set, uses DEFAULT_REPLY_EMAIL in settings'),
+ help_text=_("Email address to use for outgoing email. If not set, uses DEFAULT_REPLY_EMAIL in settings"),
)
disclosure_link = models.URLField(
blank=True,
null=True,
- help_text=_("Link to disclosure guidance that will be presented to case members at first view of case")
+ help_text=_("Link to disclosure guidance that will be presented to case members at first view of case"),
)
-
-
+
+
class VinceCommGroupAdmin(models.Model):
- contact = models.ForeignKey(VinceCommContact,
- on_delete=models.CASCADE)
+ contact = models.ForeignKey(VinceCommContact, on_delete=models.CASCADE)
- email = models.ForeignKey(VinceCommEmail,
- on_delete=models.CASCADE)
+ email = models.ForeignKey(VinceCommEmail, on_delete=models.CASCADE)
comm_action = models.BooleanField(
- default = False,
- help_text = "If true, group admin was created by another group admin"
+ default=False, help_text="If true, group admin was created by another group admin"
)
def __str__(self):
return "%s" % self.email.email
-
def get_uuid_filename(self, filename):
name = str(self.uuid)
return name
-
+
+
class VinceAttachment(models.Model):
file = models.FileField(
- _('File'),
+ _("File"),
storage=SharedMediaStorage(),
upload_to=get_uuid_filename,
max_length=1000,
)
filename = models.CharField(
- _('Filename'),
+ _("Filename"),
max_length=1000,
)
mime_type = models.CharField(
- _('MIME Type'),
+ _("MIME Type"),
max_length=255,
)
size = models.IntegerField(
- _('Size'),
- help_text=_('Size of this file in bytes'),
+ _("Size"),
+ help_text=_("Size of this file in bytes"),
)
- uuid = models.UUIDField(
- default=uuid.uuid4,
- editable=False,
- unique=True)
+ uuid = models.UUIDField(default=uuid.uuid4, editable=False, unique=True)
- uploaded_time = models.DateTimeField(
- default=timezone.now)
+ uploaded_time = models.DateTimeField(default=timezone.now)
def __str__(self):
- return '%s' % self.filename
+ return "%s" % self.filename
def _get_access_url(self):
- filename = vinceutils.safe_filename(self.filename,str(self.uuid),self.mime_type)
- url = self.file.storage.url(self.file.name, parameters={'ResponseContentDisposition': f'attachment; filename="{filename}"'}, expire=10)
+ filename = vinceutils.safe_filename(self.filename, str(self.uuid), self.mime_type)
+ url = self.file.storage.url(
+ self.file.name, parameters={"ResponseContentDisposition": f'attachment; filename="{filename}"'}, expire=10
+ )
return url
-
+
access_url = property(_get_access_url)
class Meta:
- ordering = ('filename',)
- verbose_name = _('Vince Attachment')
- verbose_name_plural = _('Vince Attachments')
+ ordering = ("filename",)
+ verbose_name = _("Vince Attachment")
+ verbose_name_plural = _("Vince Attachments")
class VinceTrackAttachment(models.Model):
- file = models.ForeignKey(
- VinceAttachment,
- on_delete=models.CASCADE)
+ file = models.ForeignKey(VinceAttachment, on_delete=models.CASCADE)
- case = models.ForeignKey(
- "Case",
- blank=True,
- null=True,
- on_delete=models.SET_NULL)
+ case = models.ForeignKey("Case", blank=True, null=True, on_delete=models.SET_NULL)
+
+ vulnote = models.BooleanField(default=False)
+
+ shared = models.BooleanField(default=False)
- vulnote = models.BooleanField(
- default = False)
- shared = models.BooleanField(
- default = False)
-
-
class VinceCommInvitedUsers(models.Model):
- email = models.CharField(
- max_length=200)
-
- case = models.ForeignKey(
- "Case",
- on_delete=models.CASCADE)
+ email = models.CharField(max_length=200)
+
+ case = models.ForeignKey("Case", on_delete=models.CASCADE)
user = models.ForeignKey(
settings.AUTH_USER_MODEL,
blank=True,
null=True,
- help_text=_('The user that invited this user.'),
- on_delete=models.SET_NULL)
+ help_text=_("The user that invited this user."),
+ on_delete=models.SET_NULL,
+ )
- coordinator = models.BooleanField(
- default = False)
+ coordinator = models.BooleanField(default=False)
+
+ # the id of the CaseParticipant in VINCE
+ vince_id = models.IntegerField(default=0)
- # the id of the CaseParticipant in VINCE
- vince_id = models.IntegerField(
- default=0)
-
def __str__(self):
return "%s" % self.email
@@ -708,20 +666,21 @@ def update_filename(instance, filename):
if instance.vrf_id:
new_filename = "vrf%s_%s" % (instance.vrf_id, filename)
else:
- new_filename= "novrf_%s" % filename
+ new_filename = "novrf_%s" % filename
return new_filename
-
+
class VTCaseRequest(models.Model):
- """
+ """
A Case Request is a request for VINCE vulnerability coordination that
has either been manually created by a coordinator or has come from
the Vulnerability Reporting Form (VRF).
-
+
A Case Request will eventually (but not always) become a Vulnerability
- Case if selected by the Vuln Coordination Team.
+ Case if selected by the Vuln Coordination Team.
"""
+
PENDING_STATUS = 0
OPEN_STATUS = 1
REOPENED_STATUS = 2
@@ -730,18 +689,20 @@ class VTCaseRequest(models.Model):
DUPLICATE_STATUS = 5
STATUS_CHOICES = (
- (PENDING_STATUS, _('Pending')),
- (OPEN_STATUS, _('Open')),
- (REOPENED_STATUS, _('Reopened')),
- (RESOLVED_STATUS, _('Resolved')),
- (CLOSED_STATUS, _('Closed')),
- (DUPLICATE_STATUS, _('Duplicate')),
+ (PENDING_STATUS, _("Pending")),
+ (OPEN_STATUS, _("Open")),
+ (REOPENED_STATUS, _("Reopened")),
+ (RESOLVED_STATUS, _("Resolved")),
+ (CLOSED_STATUS, _("Closed")),
+ (DUPLICATE_STATUS, _("Duplicate")),
)
- WHY_NOT_CHOICES = [('1', 'I have not attempted to contact any vendors'),
- ('2', 'I have been unable to find contact information for a vendor'),
- ('3', 'Other')]
-
+ WHY_NOT_CHOICES = [
+ ("1", "I have not attempted to contact any vendors"),
+ ("2", "I have been unable to find contact information for a vendor"),
+ ("3", "Other"),
+ ]
+
vrf_id = models.CharField(max_length=20)
contact_name = models.CharField(max_length=100, blank=True, null=True)
contact_org = models.CharField(max_length=100, blank=True, null=True)
@@ -760,9 +721,7 @@ class VTCaseRequest(models.Model):
product_name = models.CharField(max_length=500)
product_version = models.CharField(max_length=100, blank=True, null=True)
metadata = OldJSONField(
- help_text=_('Extensible, currently used to specify relevance to AI/ML systems'),
- blank=True,
- null=True
+ help_text=_("Extensible, currently used to specify relevance to AI/ML systems"), blank=True, null=True
)
ics_impact = models.BooleanField(default=False)
vul_description = models.TextField(blank=True, null=True)
@@ -775,56 +734,51 @@ class VTCaseRequest(models.Model):
exploit_references = models.CharField(max_length=1000, blank=True, null=True)
vul_disclose = models.BooleanField(default=False)
disclosure_plans = models.CharField(max_length=1000, blank=True, null=True)
- user_file = models.FileField(blank=True, null=True,
- storage=PrivateMediaStorage(),
- upload_to=update_filename)
+ user_file = models.FileField(blank=True, null=True, storage=PrivateMediaStorage(), upload_to=update_filename)
date_submitted = models.DateTimeField(default=timezone.now)
- tracking = models.CharField(max_length=100,blank=True, null=True)
+ tracking = models.CharField(max_length=100, blank=True, null=True)
status = models.IntegerField(
- _('Status'),
+ _("Status"),
choices=STATUS_CHOICES,
- default=PENDING_STATUS,
+ default=PENDING_STATUS,
)
comments = models.TextField(blank=True, null=True)
search_vector = SearchVectorField(null=True)
- new_vuid = models.CharField(
- max_length=20,
- blank=True,
- null=True)
-
+ new_vuid = models.CharField(max_length=20, blank=True, null=True)
+
coordinator = models.ForeignKey(
- Group,
- blank=True,
- null=True,
- help_text=_('The group assigned to this report.'),
- on_delete=models.SET_NULL)
-
+ Group, blank=True, null=True, help_text=_("The group assigned to this report."), on_delete=models.SET_NULL
+ )
+
user = models.ForeignKey(
settings.AUTH_USER_MODEL,
blank=True,
null=True,
- help_text=_('The user that submitted the report.'),
- on_delete=models.SET_NULL)
+ help_text=_("The user that submitted the report."),
+ on_delete=models.SET_NULL,
+ )
class Meta:
- indexes = [ GinIndex(
- fields = ['search_vector'],
- name = 'vc_caserequest_gin',
+ indexes = [
+ GinIndex(
+ fields=["search_vector"],
+ name="vc_caserequest_gin",
)
- ]
+ ]
def get_absolute_url(self):
from django.urls import reverse
- return reverse('vinny:cr', args=(self.id,))
+
+ return reverse("vinny:cr", args=(self.id,))
def _get_modified(self):
return self.date_submitted
modified = property(_get_modified)
-
+
def __str__(self):
return self.vrf_id
@@ -837,48 +791,43 @@ def _get_status(self):
"""
Displays the ticket status, with an "On Hold" message if needed.
"""
- return u'%s' % (self.get_status_display())
+ return "%s" % (self.get_status_display())
get_status = property(_get_status)
def _get_status_html(self):
if self.status == self.OPEN_STATUS:
- return f"{self.get_status_display()}"
+ return f'{self.get_status_display()}'
elif self.status == self.PENDING_STATUS:
- return f"{self.get_status_display()}"
+ return f'{self.get_status_display()}'
elif self.status == self.CLOSED_STATUS:
- return f"{self.get_status_display()}"
+ return f'{self.get_status_display()}'
else:
- return f"{self.get_status_display()}"
+ return f'{self.get_status_display()}'
get_status_html = property(_get_status_html)
-
+
+
class CRFollowUp(models.Model):
cr = models.ForeignKey(
VTCaseRequest,
- on_delete = models.CASCADE,
- verbose_name=_('Case Request'),
+ on_delete=models.CASCADE,
+ verbose_name=_("Case Request"),
)
- date = models.DateTimeField(
- _('Date'),
- default=timezone.now
- )
-
- last_edit = models.DateTimeField(
- _('Last Modified Date'),
- blank=True,
- null=True)
+ date = models.DateTimeField(_("Date"), default=timezone.now)
+
+ last_edit = models.DateTimeField(_("Last Modified Date"), blank=True, null=True)
title = models.CharField(
- _('Title'),
+ _("Title"),
max_length=200,
blank=True,
null=True,
)
-
+
comment = models.TextField(
- _('Comment'),
+ _("Comment"),
blank=True,
null=True,
)
@@ -888,131 +837,98 @@ class CRFollowUp(models.Model):
on_delete=models.CASCADE,
blank=True,
null=True,
- verbose_name=_('User'),
+ verbose_name=_("User"),
)
new_status = models.IntegerField(
- _('New Status'),
+ _("New Status"),
choices=VTCaseRequest.STATUS_CHOICES,
blank=True,
null=True,
- help_text=_('If the status was changed, what was it changed to?'),
+ help_text=_("If the status was changed, what was it changed to?"),
)
def __str__(self):
- return '%s' % self.title
+ return "%s" % self.title
+
class ReportAttachment(models.Model):
-
+
action = models.ForeignKey(
- CRFollowUp,
- on_delete=models.CASCADE,
- verbose_name=_('Vendor Action'),
- blank=True,
- null=True
+ CRFollowUp, on_delete=models.CASCADE, verbose_name=_("Vendor Action"), blank=True, null=True
)
- file = models.ForeignKey(
- VinceAttachment,
- on_delete=models.CASCADE,
- blank=True,
- null=True)
-
- attachment = models.FileField(
- storage=PrivateMediaStorage(),
- blank=True,
- null=True)
+ file = models.ForeignKey(VinceAttachment, on_delete=models.CASCADE, blank=True, null=True)
+
+ attachment = models.FileField(storage=PrivateMediaStorage(), blank=True, null=True)
+
+ vince_id = models.IntegerField(default=0)
- vince_id = models.IntegerField(
- default = 0
- )
-
class Case(models.Model):
ACTIVE_STATUS = 1
INACTIVE_STATUS = 2
STATUS_CHOICES = (
- (ACTIVE_STATUS, _('Active')),
- (INACTIVE_STATUS, _('Inactive')),
- )
- vuid = models.CharField(
- max_length=20
- )
- created = models.DateTimeField(
- auto_now_add=True
- )
- modified = models.DateTimeField(
- auto_now=True
+ (ACTIVE_STATUS, _("Active")),
+ (INACTIVE_STATUS, _("Inactive")),
)
+ vuid = models.CharField(max_length=20)
+ created = models.DateTimeField(auto_now_add=True)
+ modified = models.DateTimeField(auto_now=True)
status = models.IntegerField(
- _('Status'),
+ _("Status"),
choices=STATUS_CHOICES,
default=ACTIVE_STATUS,
)
summary = models.CharField(
max_length=1000,
- help_text=_('A summary of the case.'),
- )
- title = models.CharField(
- max_length=500,
- help_text=_('A title for this case. Optional.')
- )
-
- due_date = models.DateTimeField(
- blank=True, null=True
+ help_text=_("A summary of the case."),
)
+ title = models.CharField(max_length=500, help_text=_("A title for this case. Optional."))
- publicdate = models.DateTimeField(
- blank=True, null=True
- )
+ due_date = models.DateTimeField(blank=True, null=True)
- publicurl = models.CharField(
- max_length=500, blank=True, null=True,
- help_text=_('The URL for the public notice of a vulnerability.')
- )
-
- vince_id = models.IntegerField(
- default=0
- )
-
- cr = models.OneToOneField(
- VTCaseRequest,
- blank=True, null=True,
- on_delete=models.SET_NULL
+ publicdate = models.DateTimeField(blank=True, null=True)
+
+ publicurl = models.CharField(
+ max_length=500, blank=True, null=True, help_text=_("The URL for the public notice of a vulnerability.")
)
+ vince_id = models.IntegerField(default=0)
+
+ cr = models.OneToOneField(VTCaseRequest, blank=True, null=True, on_delete=models.SET_NULL)
+
team_owner = models.ForeignKey(
- Group,
- blank=True, null=True,
- help_text=_('The coordinator group that is leading this case'),
- on_delete=models.SET_NULL)
-
- note = models.OneToOneField(
- "VCVUReport",
+ Group,
+ blank=True,
+ null=True,
+ help_text=_("The coordinator group that is leading this case"),
on_delete=models.SET_NULL,
- blank=True, null=True)
+ )
- uid = models.CharField(
- max_length=50,
- default=generate_uuid)
+ note = models.OneToOneField("VCVUReport", on_delete=models.SET_NULL, blank=True, null=True)
+
+ uid = models.CharField(max_length=50, default=generate_uuid)
search_vector = SearchVectorField(null=True)
def get_absolute_url(self):
from django.urls import reverse
- return reverse('vinny:case', args=(self.id,))
-
+
+ return reverse("vinny:case", args=(self.id,))
+
class Meta:
- indexes = [ GinIndex(
- fields = ['search_vector'],
- name = 'vc_case_gin',
+ indexes = [
+ GinIndex(
+ fields=["search_vector"],
+ name="vc_case_gin",
)
]
def __str__(self):
return self.vuid
-
+
def get_title(self):
return "%s%s: %s" % (settings.CASE_IDENTIFIER, self.vuid, self.title)
@@ -1020,26 +936,27 @@ def get_vuid(self):
return f"{settings.CASE_IDENTIFIER}%s" % self.vuid
vu_vuid = property(get_vuid)
-
+
def _get_status(self):
"""
Displays the ticket status, with an "On Hold" message if needed.
"""
- held_msg=""
- return u'%s%s' % (self.get_status_display(), held_msg)
+ held_msg = ""
+ return "%s%s" % (self.get_status_display(), held_msg)
get_status = property(_get_status)
def _get_case_for_url(self):
- """ A URL-friendly ticket ID, used in links. """
- return u"VU%s" % (self.vuid)
+ """A URL-friendly ticket ID, used in links."""
+ return "VU%s" % (self.vuid)
case_for_url = property(_get_case_for_url)
def get_absolute_url(self):
from django.urls import reverse
- return reverse('vinny:case', args=(self.id,))
-
+
+ return reverse("vinny:case", args=(self.id,))
+
def _is_published(self):
try:
if self.note.datefirstpublished:
@@ -1053,255 +970,201 @@ def _is_published(self):
def _get_status_html(self):
return_str = ""
if self.status == self.ACTIVE_STATUS:
- return_str = f"{self.get_status_display()}"
+ return_str = f'{self.get_status_display()}'
else:
- return_str = f"{self.get_status_display()}"
+ return_str = f'{self.get_status_display()}'
if self.published:
# published assumed public
- return_str = return_str + f" Public"
+ return_str = return_str + f' Public'
elif self.publicdate:
- return_str = return_str + f" Public"
+ return_str = return_str + f' Public'
return return_str
get_status_html = property(_get_status_html)
+
class VinceCommCaseAttachment(models.Model):
action = models.ForeignKey(
- "VendorAction",
- on_delete=models.CASCADE,
- verbose_name=_('Vendor Action'),
- blank=True,
- null=True
+ "VendorAction", on_delete=models.CASCADE, verbose_name=_("Vendor Action"), blank=True, null=True
)
- file = models.ForeignKey(
- VinceAttachment,
- on_delete=models.CASCADE,
- blank=True,
- null=True)
-
- attachment = models.FileField(
- storage=PrivateMediaStorage(),
- blank=True,
- null=True)
+ file = models.ForeignKey(VinceAttachment, on_delete=models.CASCADE, blank=True, null=True)
+
+ attachment = models.FileField(storage=PrivateMediaStorage(), blank=True, null=True)
+
+ vince_id = models.IntegerField(default=0)
- vince_id = models.IntegerField(
- default = 0
- )
class CaseVulnerabilityManager(models.Manager):
def get_queryset(self):
return super(CaseVulnerabilityManager, self).get_queryset().filter(deleted=False)
-
+
+
class CaseVulnerability(models.Model):
- cve = models.CharField(
- _('CVE'),
- max_length=50,
- blank=True,
- null=True)
+ cve = models.CharField(_("CVE"), max_length=50, blank=True, null=True)
- description = models.TextField(
- _('Description'))
-
- case = models.ForeignKey(
- Case,
- on_delete=models.CASCADE)
+ description = models.TextField(_("Description"))
+
+ case = models.ForeignKey(Case, on_delete=models.CASCADE)
- date_added = models.DateTimeField(
- default=timezone.now)
+ date_added = models.DateTimeField(default=timezone.now)
vince_id = models.IntegerField(
- blank=True, null=True,
- help_text=_('The vince pk'),
+ blank=True,
+ null=True,
+ help_text=_("The vince pk"),
)
deleted = models.BooleanField(
- default = False,
- help_text=_('Only True if vulnerability is removed after publication')
+ default=False, help_text=_("Only True if vulnerability is removed after publication")
)
- case_increment = models.IntegerField(
- default = 0)
-
- ask_vendor_status = models.BooleanField(
- default=False)
+ case_increment = models.IntegerField(default=0)
+
+ ask_vendor_status = models.BooleanField(default=False)
objects = CaseVulnerabilityManager()
-
+
def __str__(self):
return "%s" % self.description
def _get_vul(self):
- """ A user-friendly Vul ID, which is the cve if cve exists,
- otherwise it's a combination of vul ID and case. """
- if (self.cve):
- return u"CVE-%s" % self.cve
+ """A user-friendly Vul ID, which is the cve if cve exists,
+ otherwise it's a combination of vul ID and case."""
+ if self.cve:
+ return "CVE-%s" % self.cve
else:
- return u"%s" % self.cert_id
+ return "%s" % self.cert_id
vul = property(_get_vul)
def _get_vul_for_url(self):
- """ A URL-friendly vul ID, used in links. """
- return u"%s-%s" % (self.case.case_for_url, self.vince_id)
+ """A URL-friendly vul ID, used in links."""
+ return "%s-%s" % (self.case.case_for_url, self.vince_id)
vul_for_url = property(_get_vul_for_url)
- def _get_cert_id(self):
- return u"%s%s.%d" % (settings.CASE_IDENTIFIER, self.case.vuid, self.case_increment)
+ def _get_cert_id(self):
+ return "%s%s.%d" % (settings.CASE_IDENTIFIER, self.case.vuid, self.case_increment)
cert_id = property(_get_cert_id)
def as_dict(self):
exploits = CaseVulExploit.objects.filter(vul=self).count()
link = reverse("vinny:vuldetail", args=(self.id,))
- editstatus = reverse('vinny:status', args=(self.case.id,))
+ editstatus = reverse("vinny:status", args=(self.case.id,))
return {
- 'id': self.id,
- 'cert_id': self.cert_id,
- 'ask_vendor_status': self.ask_vendor_status,
- 'description': self.description,
- 'cve': self.vul,
- 'exploits': exploits,
- 'vuldetaillink': link,
- 'editstatus': editstatus,
- 'date_added': self.date_added.strftime('%Y-%m-%d'),
- }
+ "id": self.id,
+ "cert_id": self.cert_id,
+ "ask_vendor_status": self.ask_vendor_status,
+ "description": self.description,
+ "cve": self.vul,
+ "exploits": exploits,
+ "vuldetaillink": link,
+ "editstatus": editstatus,
+ "date_added": self.date_added.strftime("%Y-%m-%d"),
+ }
class CaseVulCVSS(models.Model):
- vul = models.ForeignKey(
- CaseVulnerability,
- on_delete=models.CASCADE)
+ vul = models.ForeignKey(CaseVulnerability, on_delete=models.CASCADE)
- last_modified = models.DateTimeField(
- _('Last Modified Date'),
- default=timezone.now)
+ last_modified = models.DateTimeField(_("Last Modified Date"), default=timezone.now)
- vector = models.CharField(
- _('CVSS Vector String'),
- max_length=100,
- blank=True,
- null=True)
+ vector = models.CharField(_("CVSS Vector String"), max_length=100, blank=True, null=True)
- score = models.DecimalField(
- _('CVSS Base Score'),
- max_digits=3,
- decimal_places=1,
- blank=True,
- null=True)
+ score = models.DecimalField(_("CVSS Base Score"), max_digits=3, decimal_places=1, blank=True, null=True)
- severity = models.CharField(
- _('CVSS Severity'),
- max_length=20,
- blank=True,
- null=True)
+ severity = models.CharField(_("CVSS Severity"), max_length=20, blank=True, null=True)
def __str__(self):
return self.vector
-
-
+
+
class CaseVulExploit(models.Model):
- EXPLOIT_CHOICES = (('code', 'code'),
- ('report', 'report'),
- ('other', 'other')
- )
+ EXPLOIT_CHOICES = (("code", "code"), ("report", "report"), ("other", "other"))
- vul = models.ForeignKey(
- CaseVulnerability,
- on_delete=models.CASCADE)
+ vul = models.ForeignKey(CaseVulnerability, on_delete=models.CASCADE)
- date_added = models.DateTimeField(
- default=timezone.now)
+ date_added = models.DateTimeField(default=timezone.now)
- reference_date = models.DateTimeField(
- blank=True,
- null=True)
+ reference_date = models.DateTimeField(blank=True, null=True)
link = models.URLField()
- reference_type = models.CharField(
- max_length=30,
- choices=EXPLOIT_CHOICES,
- default='code')
+ reference_type = models.CharField(max_length=30, choices=EXPLOIT_CHOICES, default="code")
- notes = models.TextField(blank=True,
- null=True)
+ notes = models.TextField(blank=True, null=True)
vince_id = models.IntegerField(
- blank=True, null=True,
- help_text=_('The vince exploit pk'),
+ blank=True,
+ null=True,
+ help_text=_("The vince exploit pk"),
)
def __str__(self):
return "%s" % self.link
-
+
+
class CaseMember(models.Model):
- case = models.ForeignKey(
- Case,
- on_delete=models.CASCADE)
+ case = models.ForeignKey(Case, on_delete=models.CASCADE)
- group = models.ForeignKey(
- Group,
- blank=True, null=True,
- on_delete=models.CASCADE)
+ group = models.ForeignKey(Group, blank=True, null=True, on_delete=models.CASCADE)
participant = models.ForeignKey(
settings.AUTH_USER_MODEL,
- blank=True, null=True,
- help_text=_('A participant in the case'),
- related_name='participant',
- on_delete = models.CASCADE)
+ blank=True,
+ null=True,
+ help_text=_("A participant in the case"),
+ related_name="participant",
+ on_delete=models.CASCADE,
+ )
- added = models.DateTimeField(
- default=timezone.now)
+ added = models.DateTimeField(default=timezone.now)
user = models.ForeignKey(
settings.AUTH_USER_MODEL,
blank=True,
null=True,
- help_text=_('The user that added the vendor.'),
- on_delete=models.SET_NULL)
+ help_text=_("The user that added the vendor."),
+ on_delete=models.SET_NULL,
+ )
- seen = models.BooleanField(
- default=False)
+ seen = models.BooleanField(default=False)
- coordinator = models.BooleanField(
- default = False)
+ coordinator = models.BooleanField(default=False)
+
+ reporter_group = models.BooleanField(default=False)
- reporter_group = models.BooleanField(
- default = False)
-
# the id of the CaseParticipant in VINCE
- vince_id = models.IntegerField(
- default=0)
+ vince_id = models.IntegerField(default=0)
def get_member_name(self):
name = "Case Member"
if self.participant:
return self.participant
elif self.group:
- name = vinceutils.deepGet(self,'group.groupcontact.contact.vendor_name')
+ name = vinceutils.deepGet(self, "group.groupcontact.contact.vendor_name")
if name:
return name
- elif vinceutils.deepGet(self,'group.name'):
+ elif vinceutils.deepGet(self, "group.name"):
return self.group.name
return name
-
+
def __str__(self):
name = self.get_member_name()
return f"{name} for case {self.case.vu_vuid}"
-
+
def share_status(self):
status = CaseStatement.objects.filter(member=self).first()
if status:
return status.share
else:
return False
-
+
def get_general_status(self):
status = CaseMemberStatus.objects.filter(member=self)
stat = 3
@@ -1312,43 +1175,40 @@ def get_general_status(self):
if x.status == 2:
stat = 2
return stat
-
+
def get_statement(self):
stmt = CaseStatement.objects.filter(member=self, statement__isnull=False)
if stmt:
return stmt
else:
return CaseMemberStatus.objects.filter(member=self, statement__isnull=False)
-
+
class Meta:
- unique_together = (('group', 'case', 'participant'),)
+ unique_together = (("group", "case", "participant"),)
class CaseMemberStatusManager(models.Manager):
def get_queryset(self):
return super(CaseMemberStatusManager, self).get_queryset().exclude(vulnerability__deleted=True)
-
+
+
class CaseMemberStatus(models.Model):
AFFECTED = 1
UNAFFECTED = 2
UNKNOWN = 3
STATUS_CHOICES = (
- (UNAFFECTED, _('Not Affected')),
- (AFFECTED, _('Affected')),
- (UNKNOWN, _('Unknown')),
+ (UNAFFECTED, _("Not Affected")),
+ (AFFECTED, _("Affected")),
+ (UNKNOWN, _("Unknown")),
)
- member = models.ForeignKey(
- CaseMember,
- on_delete=models.CASCADE)
+ member = models.ForeignKey(CaseMember, on_delete=models.CASCADE)
- vulnerability = models.ForeignKey(
- CaseVulnerability,
- on_delete=models.CASCADE)
+ vulnerability = models.ForeignKey(CaseVulnerability, on_delete=models.CASCADE)
status = models.IntegerField(
- _('Status'),
+ _("Status"),
choices=STATUS_CHOICES,
)
@@ -1356,88 +1216,71 @@ class CaseMemberStatus(models.Model):
settings.AUTH_USER_MODEL,
blank=True,
null=True,
- help_text=_('The user that committed status.'),
- on_delete=models.SET_NULL)
+ help_text=_("The user that committed status."),
+ on_delete=models.SET_NULL,
+ )
- references = models.TextField(
- blank=True,
- null=True)
+ references = models.TextField(blank=True, null=True)
- statement = models.TextField(
- blank=True,
- null=True)
+ statement = models.TextField(blank=True, null=True)
- date_added = models.DateTimeField(
- default=timezone.now)
+ date_added = models.DateTimeField(default=timezone.now)
- date_modified = models.DateTimeField(
- auto_now=True
- )
+ date_modified = models.DateTimeField(auto_now=True)
- approved = models.BooleanField(
- default=False
- )
+ approved = models.BooleanField(default=False)
objects = CaseMemberStatusManager()
-
+
class Meta:
- unique_together = (('member', 'vulnerability'),)
+ unique_together = (("member", "vulnerability"),)
+
class CaseStatement(models.Model):
### This is a general statement on a case vs a statement on a vul ###
case = models.ForeignKey(
Case,
- help_text=('The case this post belongs to'),
+ help_text=("The case this post belongs to"),
on_delete=models.CASCADE,
)
- member = models.ForeignKey(
- CaseMember,
- on_delete=models.CASCADE)
+ member = models.ForeignKey(CaseMember, on_delete=models.CASCADE)
user = models.ForeignKey(
settings.AUTH_USER_MODEL,
blank=True,
null=True,
- help_text=_('The user that provided statement.'),
- on_delete=models.SET_NULL)
+ help_text=_("The user that provided statement."),
+ on_delete=models.SET_NULL,
+ )
- references = models.TextField(
- blank=True,
- null=True)
+ references = models.TextField(blank=True, null=True)
- statement = models.TextField(
- blank=True,
- null=True)
+ statement = models.TextField(blank=True, null=True)
- addendum = models.TextField(
- blank=True,
- null=True)
+ addendum = models.TextField(blank=True, null=True)
- share = models.BooleanField(
- default=False)
-
- date_added = models.DateTimeField(
- default=timezone.now)
+ share = models.BooleanField(default=False)
- date_modified = models.DateTimeField(
- auto_now=True
- )
+ date_added = models.DateTimeField(default=timezone.now)
- approved = models.BooleanField(
- default=False)
+ date_modified = models.DateTimeField(auto_now=True)
+
+ approved = models.BooleanField(default=False)
def __str__(self):
return self.statement
-
+
class Meta:
- unique_together = (('case', 'member'),)
+ unique_together = (("case", "member"),)
+
-
""" Adapted from Misago
https://github.com/rafalp/Misago
"""
+
+
class PostManager(models.Manager):
def search(self, case=None, query=None, author_list=[]):
qs = self.get_queryset()
@@ -1452,54 +1295,49 @@ def search(self, case=None, query=None, author_list=[]):
class Post(models.Model):
current_revision = models.OneToOneField(
- 'PostRevision',
+ "PostRevision",
blank=True,
null=True,
on_delete=models.CASCADE,
- related_name='current_set',
- help_text=_('The revision displayed for this post. If you need to rollback, change value of this field.'))
+ related_name="current_set",
+ help_text=_("The revision displayed for this post. If you need to rollback, change value of this field."),
+ )
case = models.ForeignKey(
Case,
- help_text=('The case this post belongs to'),
+ help_text=("The case this post belongs to"),
on_delete=models.CASCADE,
)
- created = models.DateTimeField(
- auto_now_add=True
- )
+ created = models.DateTimeField(auto_now_add=True)
- modified = models.DateTimeField(
- auto_now=True
- )
+ modified = models.DateTimeField(auto_now=True)
author = models.ForeignKey(
settings.AUTH_USER_MODEL,
- blank=True, null=True,
- help_text=_('The writer of this post.'),
- on_delete=models.SET_NULL)
+ blank=True,
+ null=True,
+ help_text=_("The writer of this post."),
+ on_delete=models.SET_NULL,
+ )
group = models.ForeignKey(
- Group,
- blank=True, null=True,
- help_text=_('The group of the user'),
- on_delete=models.SET_NULL
+ Group, blank=True, null=True, help_text=_("The group of the user"), on_delete=models.SET_NULL
)
vince_id = models.IntegerField(
- blank=True, null=True,
- help_text=_('The vince pk'),
+ blank=True,
+ null=True,
+ help_text=_("The vince pk"),
)
pinned = models.BooleanField(
default=False,
- help_text=_('A pinned post is pinned to the top of the page.'),
+ help_text=_("A pinned post is pinned to the top of the page."),
)
- deleted = models.BooleanField(
- default=False
- )
-
+ deleted = models.BooleanField(default=False)
+
objects = PostManager()
def add_revision(self, new_revision, save=True):
@@ -1508,9 +1346,10 @@ def add_revision(self, new_revision, save=True):
revision.
"""
assert self.id or save, (
- 'Article.add_revision: Sorry, you cannot add a'
- 'revision to an article that has not been saved '
- 'without using save=True')
+ "Article.add_revision: Sorry, you cannot add a"
+ "revision to an article that has not been saved "
+ "without using save=True"
+ )
if not self.id:
self.save()
revisions = self.postrevision_set.all()
@@ -1526,11 +1365,11 @@ def add_revision(self, new_revision, save=True):
self.current_revision = new_revision
if save:
self.save()
-
+
def __str__(self):
if self.current_revision:
return str(self.current_revision.revision_number)
- obj_name = _('Post without content (%d)') % (self.id)
+ obj_name = _("Post without content (%d)") % (self.id)
return str(obj_name)
def get_org_name(self):
@@ -1576,7 +1415,7 @@ def get_org_logo(self):
return self.author.vinceprofile.get_logo()
else:
return None
-
+
def get_post_count(self):
numposts = Post.objects.filter(author=self.author).count()
if numposts == 1:
@@ -1604,31 +1443,32 @@ def replies(self):
def num_replies(self):
return self.children.count()
+
class ThreadedPost(Post):
parent = models.ForeignKey(
Post,
- null=True, blank=True,
+ null=True,
+ blank=True,
on_delete=models.CASCADE,
default=None,
related_name="children",
- verbose_name=_('Parent'))
+ verbose_name=_("Parent"),
+ )
newest_activity = models.DateTimeField(null=True)
objects = PostManager()
class Meta(object):
- verbose_name = _('Threaded post')
- verbose_name_plural = _('Threaded posts')
-
-class BaseRevisionMixin(models.Model):
+ verbose_name = _("Threaded post")
+ verbose_name_plural = _("Threaded posts")
+
+class BaseRevisionMixin(models.Model):
"""This is an abstract model used as a mixin: Do not override any of the
core model methods but respect the inheritor's freedom to do so itself."""
- revision_number = models.IntegerField(
- editable=False,
- verbose_name=_('revision number'))
+ revision_number = models.IntegerField(editable=False, verbose_name=_("revision number"))
user_message = models.TextField(
blank=True,
@@ -1640,30 +1480,22 @@ class BaseRevisionMixin(models.Model):
)
user = models.ForeignKey(
- settings.AUTH_USER_MODEL,
- verbose_name=_('user'),
- blank=True, null=True,
- on_delete=models.SET_NULL)
+ settings.AUTH_USER_MODEL, verbose_name=_("user"), blank=True, null=True, on_delete=models.SET_NULL
+ )
- modified = models.DateTimeField(
- auto_now=True)
+ modified = models.DateTimeField(auto_now=True)
- created = models.DateTimeField(
- auto_now_add=True)
+ created = models.DateTimeField(auto_now_add=True)
- previous_revision = models.ForeignKey(
- 'self',
- blank=True, null=True,
- on_delete=models.SET_NULL
- )
+ previous_revision = models.ForeignKey("self", blank=True, null=True, on_delete=models.SET_NULL)
deleted = models.BooleanField(
- verbose_name=_('deleted'),
+ verbose_name=_("deleted"),
default=False,
)
locked = models.BooleanField(
- verbose_name=_('locked'),
+ verbose_name=_("locked"),
default=False,
)
@@ -1680,7 +1512,6 @@ def inherit_predecessor(self, predecessor):
self.locked = predecessor.locked
self.revision_number = predecessor.revision_number + 1
-
def set_from_request(self, request):
if request.user.is_authenticated:
self.user = request.user
@@ -1689,22 +1520,17 @@ class Meta:
abstract = True
-class PostRevision(BaseRevisionMixin, models.Model):
+class PostRevision(BaseRevisionMixin, models.Model):
"""This is where main revision data is stored. To make it easier to
copy, NEVER create m2m relationships."""
- post = models.ForeignKey(
- Post,
- on_delete=models.CASCADE,
- verbose_name=_('Post'))
+ post = models.ForeignKey(Post, on_delete=models.CASCADE, verbose_name=_("Post"))
# This is where the content goes, with whatever markup language is used
- content = models.TextField(
- blank=True,
- verbose_name=_('vulnote contents'))
+ content = models.TextField(blank=True, verbose_name=_("vulnote contents"))
search_vector = SearchVectorField(null=True)
-
+
def __str__(self):
if self.revision_number:
return "(%d)" % self.revision_number
@@ -1716,7 +1542,7 @@ def clean(self):
# but when revisions are created programatically, they might
# have UNIX line endings \n instead.
logger.debug(self.content)
- self.content = self.content.replace('\r', '').replace('\n', '\r\n')
+ self.content = self.content.replace("\r", "").replace("\n", "\r\n")
def inherit_predecessor(self, post):
"""
@@ -1727,17 +1553,18 @@ def inherit_predecessor(self, post):
predecessor = post.current_revision
self.post = predecessor.post
self.content = predecessor.content
-# self.title = predecessor.title
+ # self.title = predecessor.title
self.deleted = predecessor.deleted
self.locked = predecessor.locked
class Meta:
- get_latest_by = 'revision_number'
- ordering = ('created',)
- unique_together = ('post', 'revision_number')
- indexes = [ GinIndex(
- fields = ['search_vector'],
- name = 'post_gin',
+ get_latest_by = "revision_number"
+ ordering = ("created",)
+ unique_together = ("post", "revision_number")
+ indexes = [
+ GinIndex(
+ fields=["search_vector"],
+ name="post_gin",
)
]
@@ -1745,32 +1572,17 @@ class Meta:
# Adapted from Pinax-messages Project
class Thread(models.Model):
- subject = models.CharField(
- max_length=150)
+ subject = models.CharField(max_length=150)
- users = models.ManyToManyField(
- settings.AUTH_USER_MODEL,
- through="UserThread")
+ users = models.ManyToManyField(settings.AUTH_USER_MODEL, through="UserThread")
- case = models.ForeignKey(
- Case,
- blank=True, null=True,
- on_delete=models.CASCADE)
+ case = models.ForeignKey(Case, blank=True, null=True, on_delete=models.CASCADE)
- to_group = models.CharField(
- max_length=250,
- blank = True,
- null = True
- )
+ to_group = models.CharField(max_length=250, blank=True, null=True)
- from_group = models.CharField(
- max_length=150,
- blank = True,
- null = True
- )
+ from_group = models.CharField(max_length=150, blank=True, null=True)
- groupchat = models.BooleanField(
- default=False)
+ groupchat = models.BooleanField(default=False)
@classmethod
def none(cls):
@@ -1790,17 +1602,16 @@ def deleted(cls, user):
@classmethod
def read(cls, user):
- return cls.objects.filter(userthread__user=user, userthread__deleted=False, userthread__unread=False).distinct()
+ return cls.objects.filter(
+ userthread__user=user, userthread__deleted=False, userthread__unread=False
+ ).distinct()
@classmethod
def unread(cls, user):
return cls.objects.filter(userthread__user=user, userthread__deleted=False, userthread__unread=True).distinct()
def __str__(self):
- return "{}: {}".format(
- self.subject,
- ", ".join([str(user) for user in self.users.all()])
- )
+ return "{}: {}".format(self.subject, ", ".join([str(user) for user in self.users.all()]))
def get_absolute_url(self):
return reverse("vinny:thread_detail", args=[self.pk])
@@ -1824,7 +1635,7 @@ def number_attachments(self):
@cached_attribute
def num_messages(self):
return len(self.messages.all())
-
+
@classmethod
def ordered(cls, objs):
"""
@@ -1840,23 +1651,21 @@ def ordered(cls, objs):
def get_absolute_url(self):
from django.urls import reverse
- return reverse('vinny:thread_detail', args=(self.id,))
+
+ return reverse("vinny:thread_detail", args=(self.id,))
class UserThread(models.Model):
- thread = models.ForeignKey(
- Thread,
- on_delete=models.CASCADE)
+ thread = models.ForeignKey(Thread, on_delete=models.CASCADE)
- user = models.ForeignKey(
- settings.AUTH_USER_MODEL,
- on_delete=models.CASCADE)
+ user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
unread = models.BooleanField()
deleted = models.BooleanField()
+
class MessageManager(models.Manager):
def search(self, case=None, query=None, author_list=None):
qs = self.get_queryset()
@@ -1866,28 +1675,22 @@ def search(self, case=None, query=None, author_list=None):
qs = qs.filter(sender__in=author_list)
if query is not None:
qs = qs.filter(content__search=query)
-
+
return qs
-
+
+
class Message(models.Model):
- thread = models.ForeignKey(
- Thread,
- related_name="messages",
- on_delete=models.CASCADE)
+ thread = models.ForeignKey(Thread, related_name="messages", on_delete=models.CASCADE)
- sender = models.ForeignKey(
- settings.AUTH_USER_MODEL,
- related_name="sent_messages",
- on_delete=models.CASCADE)
+ sender = models.ForeignKey(settings.AUTH_USER_MODEL, related_name="sent_messages", on_delete=models.CASCADE)
- created = models.DateTimeField(
- default=timezone.now)
+ created = models.DateTimeField(default=timezone.now)
content = models.TextField(blank=True, null=True)
objects = MessageManager()
-
+
@classmethod
def new_reply(cls, thread, user, content):
"""
@@ -1899,7 +1702,7 @@ def new_reply(cls, thread, user, content):
thread.userthread_set.exclude(user=user).update(deleted=False, unread=True)
thread.userthread_set.filter(user=user).update(deleted=False, unread=False)
message_sent.send(sender=cls, message=msg, thread=thread, reply=True)
- #for recip in thread.userthread_set.exclude(user=user):
+ # for recip in thread.userthread_set.exclude(user=user):
# send_newmessage_mail(msg, recip.user)
return msg
@@ -1915,34 +1718,50 @@ def new_message(cls, from_user, to_users, case, subject, content, signal=True):
else:
vc = None
thread = Thread.objects.create(subject=subject, case=vc)
- track_users=[]
+ track_users = []
direct_msg = False
- #get coordinators on case
+ # get coordinators on case
if vc:
- vt_groups = CaseMember.objects.filter(case=case, coordinator=True).exclude(group__groupcontact__vincetrack=False).exclude(group__groupcontact__isnull=True).values_list('group', flat=True)
+ vt_groups = (
+ CaseMember.objects.filter(case=case, coordinator=True)
+ .exclude(group__groupcontact__vincetrack=False)
+ .exclude(group__groupcontact__isnull=True)
+ .values_list("group", flat=True)
+ )
logger.debug(vt_groups)
- vt_users = User.objects.using('vincecomm').filter(groups__in=vt_groups)
+ vt_users = User.objects.using("vincecomm").filter(groups__in=vt_groups)
logger.debug(vt_users)
- to_group = ", ".join(list(CaseMember.objects.filter(case=case, coordinator=True).exclude(group__groupcontact__vincetrack=False).exclude(group__groupcontact__isnull=True).values_list('group__groupcontact__contact__vendor_name', flat=True)))
-
+ to_group = ", ".join(
+ list(
+ CaseMember.objects.filter(case=case, coordinator=True)
+ .exclude(group__groupcontact__vincetrack=False)
+ .exclude(group__groupcontact__isnull=True)
+ .values_list("group__groupcontact__contact__vendor_name", flat=True)
+ )
+ )
+
else:
- #otherwise just send to admin group (settings.py)
- #lookup group:
- to_g = Group.objects.using('vincecomm').filter(groupcontact__contact__vendor_name=settings.COGNITO_ADMIN_GROUP).first()
+ # otherwise just send to admin group (settings.py)
+ # lookup group:
+ to_g = (
+ Group.objects.using("vincecomm")
+ .filter(groupcontact__contact__vendor_name=settings.COGNITO_ADMIN_GROUP)
+ .first()
+ )
if to_g:
- vt_users = User.objects.using('vincecomm').filter(groups__id=to_g.id, is_staff=True)
+ vt_users = User.objects.using("vincecomm").filter(groups__id=to_g.id, is_staff=True)
else:
logger.warning(f"ERROR: No group for {settings.COGNITO_ADMIN_GROUP}")
to_group = settings.COGNITO_ADMIN_GROUP
-
+
if to_users:
for user in to_users:
- puser = User.objects.using('vincecomm').filter(id=user).first()
- if puser.groups.filter(name='vincetrack').exists():
+ puser = User.objects.using("vincecomm").filter(id=user).first()
+ if puser.groups.filter(name="vincetrack").exists():
track_users.append(puser)
thread.userthread_set.create(user=puser, deleted=False, unread=True)
- #IF TO_USERS means this is from Coordinators
+ # IF TO_USERS means this is from Coordinators
direct_msg = True
else:
thread.to_group = to_group
@@ -1952,16 +1771,16 @@ def new_message(cls, from_user, to_users, case, subject, content, signal=True):
thread.userthread_set.create(user=user, deleted=False, unread=True)
if direct_msg:
- #need to give access to all vt_users in the from_user group
+ # need to give access to all vt_users in the from_user group
if not vc:
team = from_user.groups.filter(groupcontact__vincetrack=True)
- vt_users = User.objects.using('vincecomm').filter(groups__in=team)
- #else if case - this goes to the coordinators on the case
+ vt_users = User.objects.using("vincecomm").filter(groups__in=team)
+ # else if case - this goes to the coordinators on the case
for user in vt_users:
thread.userthread_set.create(user=user, deleted=True, unread=False)
else:
thread.userthread_set.create(user=from_user, deleted=True, unread=False)
-
+
msg = cls.objects.create(thread=thread, sender=from_user, content=content)
if signal:
message_sent.send(sender=cls, message=msg, thread=thread, reply=False)
@@ -1972,10 +1791,10 @@ def new_message(cls, from_user, to_users, case, subject, content, signal=True):
# but we need to notify them if it's a direct message from
# one track member to another
send_newmessage_mail(msg, user, notrack=False)
- #if to_users:
+ # if to_users:
# for user in emails:
# send_newmessage_mail(msg, user)
-
+
return msg
def _get_user(self):
@@ -1987,29 +1806,21 @@ def _get_vc(self):
return True
vc = property(_get_vc)
-
+
class Meta:
ordering = ("created",)
def get_absolute_url(self):
return self.thread.get_absolute_url()
+
class MessageAttachment(models.Model):
- file = models.ForeignKey(
- VinceAttachment,
- on_delete=models.CASCADE,
- blank=True,
- null=True)
-
- attachment = models.FileField(
- storage=PrivateMediaStorage(),
- blank=True,
- null=True)
-
- message = models.ForeignKey(
- Message,
- on_delete=models.CASCADE)
+ file = models.ForeignKey(VinceAttachment, on_delete=models.CASCADE, blank=True, null=True)
+
+ attachment = models.FileField(storage=PrivateMediaStorage(), blank=True, null=True)
+
+ message = models.ForeignKey(Message, on_delete=models.CASCADE)
@classmethod
def attach_file(cls, message, file):
@@ -2024,8 +1835,8 @@ def attach_file(cls, message, file):
mime_type = file.content_type
except:
mime_type = mimetypes.guess_type(filename, strict=False)[0]
- if not(mime_type):
- mime_type = 'application/octet-stream'
+ if not (mime_type):
+ mime_type = "application/octet-stream"
att = VinceAttachment(
file=file,
@@ -2037,30 +1848,32 @@ def attach_file(cls, message, file):
na = cls.objects.create(message=message, file=att)
print(na.file.file.name)
- s3 = boto3.client('s3', region_name=settings.AWS_REGION)
+ s3 = boto3.client("s3", region_name=settings.AWS_REGION)
# check tag will be acceptable?
- nopass = re.findall(r'[^-+= \.:/@A-Za-z0-9_]', filename)
+ nopass = re.findall(r"[^-+= \.:/@A-Za-z0-9_]", filename)
if nopass:
- #this tag contains unacceptable chars, so do not add tag
- rd = s3.put_object_tagging(Bucket=settings.PRIVATE_BUCKET_NAME,
- Key='vince_attachments/'+ na.file.file.name,
- Tagging={'TagSet':[{'Key': 'Message', 'Value':str(message.id)}]})
+ # this tag contains unacceptable chars, so do not add tag
+ rd = s3.put_object_tagging(
+ Bucket=settings.PRIVATE_BUCKET_NAME,
+ Key="vince_attachments/" + na.file.file.name,
+ Tagging={"TagSet": [{"Key": "Message", "Value": str(message.id)}]},
+ )
else:
- rd = s3.put_object_tagging(Bucket=settings.PRIVATE_BUCKET_NAME,
- Key='vince_attachments/'+ na.file.file.name,
- Tagging={'TagSet':[{'Key': 'Message', 'Value':str(message.id)},
- {'Key':'Filename', 'Value':filename}]})
+ rd = s3.put_object_tagging(
+ Bucket=settings.PRIVATE_BUCKET_NAME,
+ Key="vince_attachments/" + na.file.file.name,
+ Tagging={
+ "TagSet": [{"Key": "Message", "Value": str(message.id)}, {"Key": "Filename", "Value": filename}]
+ },
+ )
+
-
class VendorAction(models.Model):
- created = models.DateTimeField(
- _('Date'),
- default=timezone.now
- )
+ created = models.DateTimeField(_("Date"), default=timezone.now)
title = models.CharField(
- _('Title'),
+ _("Title"),
max_length=200,
blank=True,
null=True,
@@ -2069,38 +1882,25 @@ class VendorAction(models.Model):
user = models.ForeignKey(
settings.AUTH_USER_MODEL,
on_delete=models.CASCADE,
- verbose_name=_('User'),
+ verbose_name=_("User"),
)
- member = models.ForeignKey(
- CaseMember,
- on_delete=models.SET_NULL,
- blank=True,
- null=True)
-
- case = models.ForeignKey(
- Case,
- on_delete=models.SET_NULL,
- blank=True,
- null=True)
+ member = models.ForeignKey(CaseMember, on_delete=models.SET_NULL, blank=True, null=True)
- post = models.ForeignKey(
- Post,
- on_delete=models.SET_NULL,
- blank=True,
- null=True)
+ case = models.ForeignKey(Case, on_delete=models.SET_NULL, blank=True, null=True)
+ post = models.ForeignKey(Post, on_delete=models.SET_NULL, blank=True, null=True)
def _get_date(self):
# this is just so we can rename 'created' for sorting purposes
return self.created
date = property(_get_date)
-
+
def __str__(self):
if self.case and self.member:
- return f'{self.case.vuid}: {self.created} {self.title}'
- return '%s' % self.title
+ return f"{self.case.vuid}: {self.created} {self.title}"
+ return "%s" % self.title
def _get_vc(self):
return True
@@ -2113,48 +1913,44 @@ class VendorStatusChange(models.Model):
action = models.ForeignKey(
VendorAction,
on_delete=models.CASCADE,
- verbose_name=_('Vendor Action'),
+ verbose_name=_("Vendor Action"),
)
-
+
field = models.CharField(
- _('Field'),
+ _("Field"),
max_length=100,
)
old_value = models.TextField(
- _('Old Value'),
+ _("Old Value"),
blank=True,
null=True,
)
new_value = models.TextField(
- _('New Value'),
+ _("New Value"),
blank=True,
null=True,
)
- vul = models.ForeignKey(
- CaseVulnerability,
- on_delete=models.CASCADE,
- blank=True,
- null=True)
+ vul = models.ForeignKey(CaseVulnerability, on_delete=models.CASCADE, blank=True, null=True)
def __str__(self):
- out = '%s ' % self.field
+ out = "%s " % self.field
if not self.new_value:
- out += 'removed'
+ out += "removed"
elif not self.old_value:
- out += ('set to %s') % self.new_value
+ out += ("set to %s") % self.new_value
else:
out += ('changed from "%(old_value)s" to "%(new_value)s"') % {
- 'old_value': self.old_value,
- 'new_value': self.new_value
+ "old_value": self.old_value,
+ "new_value": self.new_value,
}
return out
class Meta:
- verbose_name = _('Vendor Status change')
- verbose_name_plural = _('Vendor status changes')
+ verbose_name = _("Vendor Status change")
+ verbose_name_plural = _("Vendor status changes")
class VCVUReport(models.Model):
@@ -2162,48 +1958,38 @@ class VCVUReport(models.Model):
idnumber = models.CharField(max_length=20)
name = models.CharField(max_length=500)
overview = models.TextField(blank=True, null=True)
- datecreated = models.DateTimeField(default = timezone.now)
+ datecreated = models.DateTimeField(default=timezone.now)
publicdate = models.DateTimeField(null=True, blank=True)
datefirstpublished = models.DateTimeField(null=True, blank=True)
dateupdated = models.DateTimeField(blank=True, null=True)
keywords_str = models.TextField(blank=True, null=True)
vulnote = models.ForeignKey(
- 'VCVulnerabilityNote',
- blank=True, null=True,
- help_text=('This is used for VINCE published Vul Notes'),
- on_delete=models.CASCADE)
+ "VCVulnerabilityNote",
+ blank=True,
+ null=True,
+ help_text=("This is used for VINCE published Vul Notes"),
+ on_delete=models.CASCADE,
+ )
+
class VCVulnerabilityNote(models.Model):
- content = models.TextField(
- verbose_name=_('vulnote contents'))
+ content = models.TextField(verbose_name=_("vulnote contents"))
- title = models.CharField(
- max_length=512,
- verbose_name=_('vul note title'))
+ title = models.CharField(max_length=512, verbose_name=_("vul note title"))
- references = models.TextField(
- blank=True,
- null=True,
- verbose_name=_('references'))
+ references = models.TextField(blank=True, null=True, verbose_name=_("references"))
- dateupdated = models.DateTimeField(
- default=timezone.now)
+ dateupdated = models.DateTimeField(default=timezone.now)
- datefirstpublished = models.DateTimeField(
- blank=True, null=True)
+ datefirstpublished = models.DateTimeField(blank=True, null=True)
- revision_number = models.IntegerField(
- default=1,
- verbose_name=_('revision number'))
+ revision_number = models.IntegerField(default=1, verbose_name=_("revision number"))
vuid = models.CharField(max_length=20)
- publicdate = models.DateTimeField(
- null=True,
- blank=True)
+ publicdate = models.DateTimeField(null=True, blank=True)
- published = models.BooleanField(
- default=False)
+ published = models.BooleanField(default=False)
def get_title(self):
return "%s: %s" % (self.vu_vuid, self.title)
@@ -2223,241 +2009,161 @@ def _get_idnumber(self):
def __str__(self):
return self.vuid
+
class VCNoteVulnerability(models.Model):
- cve = models.CharField(
- _('CVE'),
- max_length=50,
- blank=True,
- null=True)
+ cve = models.CharField(_("CVE"), max_length=50, blank=True, null=True)
- description = models.TextField(
- _('Description'))
+ description = models.TextField(_("Description"))
- note = models.ForeignKey(
- VCVulnerabilityNote,
- related_name="notevuls",
- on_delete=models.CASCADE)
+ note = models.ForeignKey(VCVulnerabilityNote, related_name="notevuls", on_delete=models.CASCADE)
- uid = models.CharField(
- max_length=100)
+ uid = models.CharField(max_length=100)
- case_increment = models.IntegerField(
- default = 0)
+ case_increment = models.IntegerField(default=0)
- date_added = models.DateTimeField(
- default=timezone.now)
+ date_added = models.DateTimeField(default=timezone.now)
- dateupdated= models.DateTimeField(
- auto_now=True
- )
+ dateupdated = models.DateTimeField(auto_now=True)
def __str__(self):
return "%s" % self.vul
def _get_vul(self):
- """ A user-friendly Vul ID, which is the cve if cve exists,
- otherwise it's a combination of vul ID and case. """
- if (self.cve):
- return u"CVE-%s" % self.cve
+ """A user-friendly Vul ID, which is the cve if cve exists,
+ otherwise it's a combination of vul ID and case."""
+ if self.cve:
+ return "CVE-%s" % self.cve
else:
- return u"%s" % self.cert_id
+ return "%s" % self.cert_id
+
vul = property(_get_vul)
def _get_cert_id(self):
- return u"%s%s.%d" % (settings.CASE_IDENTIFIER, self.note.vuid, self.case_increment)
+ return "%s%s.%d" % (settings.CASE_IDENTIFIER, self.note.vuid, self.case_increment)
cert_id = property(_get_cert_id)
+
class VCVendor(models.Model):
- note = models.ForeignKey(
- VCVulnerabilityNote,
- related_name="vendors",
- on_delete=models.CASCADE)
+ note = models.ForeignKey(VCVulnerabilityNote, related_name="vendors", on_delete=models.CASCADE)
contact_date = models.DateTimeField(
- help_text=_('The date that this vendor was first contacted about this vulnerability.'),
- blank=True,
- null=True
+ help_text=_("The date that this vendor was first contacted about this vulnerability."), blank=True, null=True
)
- vendor = models.CharField(
- max_length=200,
- help_text=_('The name of the vendor that may be affected.')
- )
+ vendor = models.CharField(max_length=200, help_text=_("The name of the vendor that may be affected."))
- uuid = models.UUIDField(
- blank=True,
- null=True,
- help_text=_('The uuid of the contact.')
- )
+ uuid = models.UUIDField(blank=True, null=True, help_text=_("The uuid of the contact."))
- references = models.TextField(
- help_text=_('Vendor references for this case'),
- blank=True,
- null=True)
+ references = models.TextField(help_text=_("Vendor references for this case"), blank=True, null=True)
statement = models.TextField(
- help_text=_('A general vendor statement for all vuls in the case'),
- blank=True,
- null=True)
-
- statement_date = models.DateTimeField(
- blank=True,
- null=True
- )
-
- addendum = models.TextField(
- blank=True,
- null=True)
-
- dateupdated = models.DateTimeField(
- default=timezone.now
+ help_text=_("A general vendor statement for all vuls in the case"), blank=True, null=True
)
+ statement_date = models.DateTimeField(blank=True, null=True)
+
+ addendum = models.TextField(blank=True, null=True)
+
+ dateupdated = models.DateTimeField(default=timezone.now)
+
def get_status(self):
- status = VCVendorVulStatus.objects.filter(vendor=self).order_by('status').first()
+ status = VCVendorVulStatus.objects.filter(vendor=self).order_by("status").first()
if status:
return status.get_status_display()
else:
return "Unknown"
+
class VCVendorVulStatus(models.Model):
AFFECTED_STATUS = 1
UNAFFECTED_STATUS = 2
UNKNOWN_STATUS = 3
- STATUS_CHOICES = (
- (AFFECTED_STATUS, "Affected"),
- (UNAFFECTED_STATUS, "Not Affected"),
- (UNKNOWN_STATUS, "Unknown")
- )
+ STATUS_CHOICES = ((AFFECTED_STATUS, "Affected"), (UNAFFECTED_STATUS, "Not Affected"), (UNKNOWN_STATUS, "Unknown"))
- vendor = models.ForeignKey(
- VCVendor,
- related_name="vendorvulstatus",
- on_delete=models.CASCADE)
+ vendor = models.ForeignKey(VCVendor, related_name="vendorvulstatus", on_delete=models.CASCADE)
- vul = models.ForeignKey(
- VCNoteVulnerability,
- related_name="notevulnerability",
- on_delete=models.CASCADE)
+ vul = models.ForeignKey(VCNoteVulnerability, related_name="notevulnerability", on_delete=models.CASCADE)
status = models.IntegerField(
choices=STATUS_CHOICES,
- default = UNKNOWN_STATUS,
- help_text=_('The vendor status. Unknown until vendor says otherwise.')
+ default=UNKNOWN_STATUS,
+ help_text=_("The vendor status. Unknown until vendor says otherwise."),
)
- date_added = models.DateTimeField(
- default=timezone.now)
+ date_added = models.DateTimeField(default=timezone.now)
- dateupdated = models.DateTimeField(
- auto_now=True
- )
+ dateupdated = models.DateTimeField(auto_now=True)
+
+ references = models.TextField(blank=True, null=True)
+
+ statement = models.TextField(blank=True, null=True)
- references = models.TextField(
- blank=True,
- null=True)
- statement = models.TextField(
- blank=True,
- null=True)
-
class CaseTracking(models.Model):
- case = models.ForeignKey(
- Case,
- on_delete=models.CASCADE)
+ case = models.ForeignKey(Case, on_delete=models.CASCADE)
- group = models.ForeignKey(
- Group,
- on_delete=models.CASCADE)
+ group = models.ForeignKey(Group, on_delete=models.CASCADE)
- tracking = models.CharField(
- blank=True, null=True,
- max_length=100)
-
- added_by = models.ForeignKey(
- settings.AUTH_USER_MODEL,
- blank=True, null=True,
- on_delete=models.SET_NULL)
+ tracking = models.CharField(blank=True, null=True, max_length=100)
- dateupdated = models.DateTimeField(
- auto_now=True
- )
+ added_by = models.ForeignKey(settings.AUTH_USER_MODEL, blank=True, null=True, on_delete=models.SET_NULL)
+
+ dateupdated = models.DateTimeField(auto_now=True)
class Meta:
- unique_together = (('group', 'case'),)
-
+ unique_together = (("group", "case"),)
+
def __str__(self):
return self.tracking
+
class CaseViewed(models.Model):
- case = models.ForeignKey(
- Case,
- on_delete=models.CASCADE)
-
- user = models.ForeignKey(
- settings.AUTH_USER_MODEL,
- blank=True, null=True,
- on_delete=models.CASCADE)
+ case = models.ForeignKey(Case, on_delete=models.CASCADE)
- date_viewed = models.DateTimeField(
- default=timezone.now)
+ user = models.ForeignKey(settings.AUTH_USER_MODEL, blank=True, null=True, on_delete=models.CASCADE)
+
+ date_viewed = models.DateTimeField(default=timezone.now)
class CaseCoordinator(models.Model):
- case = models.ForeignKey(
- Case,
- on_delete=models.CASCADE)
+ case = models.ForeignKey(Case, on_delete=models.CASCADE)
- assigned = models.ForeignKey(
- settings.AUTH_USER_MODEL,
- on_delete=models.CASCADE)
+ assigned = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
def __str__(self):
return f"%s is assigned to %s" % (self.assigned.get_username(), self.case.vu_vuid)
-
+
class CaseMemberUserAccess(models.Model):
- casemember = models.ForeignKey(
- CaseMember,
- on_delete=models.CASCADE)
+ casemember = models.ForeignKey(CaseMember, on_delete=models.CASCADE)
- user = models.ForeignKey(
- settings.AUTH_USER_MODEL,
- on_delete=models.CASCADE)
+ user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
admin = models.ForeignKey(
settings.AUTH_USER_MODEL,
- related_name='admin',
+ related_name="admin",
help_text="User that made change",
on_delete=models.SET_NULL,
- blank=True, null=True)
+ blank=True,
+ null=True,
+ )
- date_modified = models.DateTimeField(
- default=timezone.now)
+ date_modified = models.DateTimeField(default=timezone.now)
class VCDailyNotification(models.Model):
- user = models.ForeignKey(
- settings.AUTH_USER_MODEL,
- on_delete=models.CASCADE)
+ user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
- case = models.ForeignKey(
- Case,
- on_delete=models.CASCADE)
+ case = models.ForeignKey(Case, on_delete=models.CASCADE)
- posts = models.IntegerField(
- default = 1)
+ posts = models.IntegerField(default=1)
+
+ tracking = models.CharField(max_length=100, blank=True, null=True)
- tracking = models.CharField(
- max_length=100,
- blank=True,
- null=True
- )
-
def __str__(self):
if self.tracking:
if self.posts > 1:
@@ -2468,66 +2174,45 @@ def __str__(self):
return f"{self.posts} new posts in case {self.case.vu_vuid}."
else:
return f"{self.posts} new post in case {self.case.vu_vuid}."
-
+
class VINCEEmailNotification(models.Model):
- user = models.ForeignKey(
- settings.AUTH_USER_MODEL,
- on_delete=models.CASCADE)
+ user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
- case = models.ForeignKey(
- Case,
- blank=True,
- null=True,
- on_delete=models.SET_NULL)
+ case = models.ForeignKey(Case, blank=True, null=True, on_delete=models.SET_NULL)
- summary = models.BooleanField(
- default=False)
+ summary = models.BooleanField(default=False)
- date_sent = models.DateTimeField(
- default=timezone.now)
+ date_sent = models.DateTimeField(default=timezone.now)
class UserApproveRequest(models.Model):
- """ User making a request to join a Vendor Group """
-
+ """User making a request to join a Vendor Group"""
+
class Status(models.IntegerChoices):
ACCEPTED = 1
DENIED = 0
UNKNOWN = -1
EXPIRED = -2
- status = models.IntegerField(choices=Status.choices,default=Status.UNKNOWN)
- user = models.ForeignKey(
- settings.AUTH_USER_MODEL,
- on_delete=models.CASCADE)
+ status = models.IntegerField(choices=Status.choices, default=Status.UNKNOWN)
+ user = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.CASCADE)
created_at = models.DateTimeField(default=timezone.now)
-
+
completed_at = models.DateTimeField(blank=True, null=True)
- #Admin user or whoever rejected/approved this request.
- completed_by = models.CharField(
- max_length=255,
- blank=True,
- null=True
- )
+ # Admin user or whoever rejected/approved this request.
+ completed_by = models.CharField(max_length=255, blank=True, null=True)
expires_at = models.DateTimeField(default=timezone.now() + timedelta(days=30))
- contact = models.ForeignKey(
- VinceCommContact,
- on_delete=models.CASCADE)
+ contact = models.ForeignKey(VinceCommContact, on_delete=models.CASCADE)
- thread = models.ForeignKey(
- Thread,
- on_delete=models.DO_NOTHING,
- blank=True,
- null=True)
+ thread = models.ForeignKey(Thread, on_delete=models.DO_NOTHING, blank=True, null=True)
class Meta:
- unique_together = (('user', 'contact'),)
+ unique_together = (("user", "contact"),)
def __str__(self):
return f"User approve request for {self.user} to join {self.contact}"
-
diff --git a/vinny/serializers.py b/vinny/serializers.py
index b524211..681c2ff 100644
--- a/vinny/serializers.py
+++ b/vinny/serializers.py
@@ -28,7 +28,17 @@
########################################################################
from django.contrib.auth.models import User
from rest_framework import serializers
-from vinny.models import Case, Post, VTCaseRequest, CaseMemberStatus, CaseVulnerability, CaseMember, CaseStatement, VCVulnerabilityNote, VinceCommContact
+from vinny.models import (
+ Case,
+ Post,
+ VTCaseRequest,
+ CaseMemberStatus,
+ CaseVulnerability,
+ CaseMember,
+ CaseStatement,
+ VCVulnerabilityNote,
+ VinceCommContact,
+)
import uuid
import os
import json
@@ -41,6 +51,7 @@
logger.setLevel(logging.DEBUG)
+
class VendorInfoSerializer(serializers.ModelSerializer):
emails = serializers.SerializerMethodField()
users = serializers.SerializerMethodField()
@@ -50,54 +61,75 @@ def get_emails(self, obj):
def get_users(self, obj):
emails = obj.get_emails()
- users = User.objects.using('vincecomm').filter(email__in=emails).values_list('vinceprofile__preferred_username', flat=True)
+ users = (
+ User.objects.using("vincecomm")
+ .filter(email__in=emails)
+ .values_list("vinceprofile__preferred_username", flat=True)
+ )
return list(users)
-
+
class Meta:
model = VinceCommContact
- fields = ['id', 'vendor_name', 'emails', 'users']
-
+ fields = ["id", "vendor_name", "emails", "users"]
+
class CaseSerializer(serializers.ModelSerializer):
status = serializers.SerializerMethodField()
-
-
+
class Meta:
model = Case
- fields = ("vuid", "created", "status", "summary", "title", "due_date")
+ fields = ("vuid", "created", "status", "summary", "title", "due_date")
def get_status(self, obj):
return obj.get_status_display()
class PostSerializer(serializers.ModelSerializer):
- content = serializers.CharField(source='current_revision.content')
+ content = serializers.CharField(source="current_revision.content")
author = serializers.SerializerMethodField()
-
+
class Meta:
model = Post
fields = ("created", "author", "pinned", "content")
def get_author(self, obj):
if obj.author:
- return {"org": obj.get_org_name(),
- "active": obj.author.is_active,
- "name": obj.author.vinceprofile.preferred_username,
- "email": obj.author.email}
+ return {
+ "org": obj.get_org_name(),
+ "active": obj.author.is_active,
+ "name": obj.author.vinceprofile.preferred_username,
+ "email": obj.author.email,
+ }
else:
- return {"org": obj.get_org_name(),
- "active": False,
- "name": "User removed",
- "email": "unknown@example.com"}
-
+ return {"org": obj.get_org_name(), "active": False, "name": "User removed", "email": "unknown@example.com"}
class OrigReportSerializer(serializers.ModelSerializer):
class Meta:
model = VTCaseRequest
- fields = ('vendor_name', 'product_name', 'product_version', 'vul_description', 'vul_exploit', 'vul_impact', 'vul_discovery', 'vul_public', 'public_references', 'vul_exploited', 'exploit_references', 'vul_disclose', 'disclosure_plans', 'date_submitted', 'share_release', 'contact_name', 'contact_phone', 'contact_email', 'contact_org')
-
+ fields = (
+ "vendor_name",
+ "product_name",
+ "product_version",
+ "vul_description",
+ "vul_exploit",
+ "vul_impact",
+ "vul_discovery",
+ "vul_public",
+ "public_references",
+ "vul_exploited",
+ "exploit_references",
+ "vul_disclose",
+ "disclosure_plans",
+ "date_submitted",
+ "share_release",
+ "contact_name",
+ "contact_phone",
+ "contact_email",
+ "contact_org",
+ )
+
def remove_fields_from_representation(self, representation, remove_fields):
for remove_field in remove_fields:
try:
@@ -108,18 +140,19 @@ def remove_fields_from_representation(self, representation, remove_fields):
def to_representation(self, obj):
ret = super(OrigReportSerializer, self).to_representation(obj)
if obj.share_release == False:
- remove_fields = ('contact_name', 'contact_email', 'contact_phone', 'contact_org', 'share_release')
+ remove_fields = ("contact_name", "contact_email", "contact_phone", "contact_org", "share_release")
self.remove_fields_from_representation(ret, remove_fields)
return ret
+
class VendorStatusSerializer(serializers.ModelSerializer):
status = serializers.SerializerMethodField()
vulnerability = serializers.SerializerMethodField()
vendor = serializers.SerializerMethodField()
- statement_date = serializers.DateTimeField(source='date_added')
+ statement_date = serializers.DateTimeField(source="date_added")
statement = serializers.SerializerMethodField()
references = serializers.SerializerMethodField()
-
+
class Meta:
model = CaseMemberStatus
fields = ["vulnerability", "vendor", "status", "statement", "references", "statement_date"]
@@ -135,6 +168,7 @@ def get_statement(self, obj):
return obj.statement
else:
return ""
+
def get_references(self, obj):
if obj.member.share_status():
return obj.references
@@ -150,18 +184,22 @@ def get_vendor(self, obj):
except:
return obj.member.group.name
+
class VendorStatusUpdateSerializer(serializers.ModelSerializer):
vendor = serializers.IntegerField(required=False)
vulnerability = serializers.CharField(max_length=50)
- references = serializers.ListField(child=serializers.URLField(max_length=250, min_length=None, allow_blank=False), allow_empty=True)
+ references = serializers.ListField(
+ child=serializers.URLField(max_length=250, min_length=None, allow_blank=False), allow_empty=True
+ )
statement = serializers.CharField(max_length=2000, allow_blank=True)
- status = serializers.ChoiceField(choices=['Affected', 'Not Affected', 'Unknown'])
+ status = serializers.ChoiceField(choices=["Affected", "Not Affected", "Unknown"])
share = serializers.BooleanField(default=False, required=False)
-
+
class Meta:
model = CaseMemberStatus
fields = ["vendor", "status", "statement", "references", "vulnerability", "share"]
-
+
+
class VendorSerializer(serializers.ModelSerializer):
vendor = serializers.SerializerMethodField()
status = serializers.SerializerMethodField()
@@ -170,14 +208,14 @@ class VendorSerializer(serializers.ModelSerializer):
cert_addendum = serializers.SerializerMethodField()
date_added = serializers.SerializerMethodField()
statement_date = serializers.SerializerMethodField()
-
+
class Meta:
model = CaseMember
fields = ["vendor", "status", "statement", "references", "date_added", "cert_addendum", "statement_date"]
def get_date_added(self, obj):
return obj.added
-
+
def get_statement(self, obj):
stmt = obj.get_statement()
if stmt:
@@ -189,7 +227,7 @@ def get_statement_date(self, obj):
return stmt[0].date_modified
else:
return None
-
+
def get_references(self, obj):
stmt = obj.get_statement()
if stmt:
@@ -201,7 +239,7 @@ def get_cert_addendum(self, obj):
return stmt.addendum
else:
return None
-
+
def get_status(self, obj):
if obj.share_status():
status = obj.get_general_status()
@@ -212,37 +250,47 @@ def get_status(self, obj):
else:
return "Unknown"
return "Unknown"
-
def get_vendor(self, obj):
try:
return obj.group.groupcontact.contact.vendor_name
except:
return obj.group.name
-
+
+
class VulSerializer(serializers.ModelSerializer):
name = serializers.SerializerMethodField()
-
+
class Meta:
model = CaseVulnerability
- fields = ['name', 'cve', 'description', 'date_added']
+ fields = ["name", "cve", "description", "date_added"]
def get_name(self, obj):
return obj.vul
-
class VulNoteSerializer(serializers.ModelSerializer):
revision = serializers.IntegerField(source="revision_number")
references = serializers.SerializerMethodField()
-
+
class Meta:
model = VCVulnerabilityNote
- fields = ["vuid", "title", "content", "references", "datefirstpublished", "vuid", "dateupdated", "published", "revision"]
+ fields = [
+ "vuid",
+ "title",
+ "content",
+ "references",
+ "datefirstpublished",
+ "vuid",
+ "dateupdated",
+ "published",
+ "revision",
+ ]
def get_references(self, obj):
return obj.references.splitlines()
+
class CSAFSerializer(serializers.ModelSerializer):
"""
This serializer starts with a Case and then builds out using both
@@ -254,35 +302,42 @@ class CSAFSerializer(serializers.ModelSerializer):
status = cs[i].status (1 == 'AFFECTED', 2 == 'UNAFFECTED')
vendor = cs[i].member.group.groupcontact.contact.vendor_name
"""
- document = serializers.SerializerMethodField('get_csafdocument')
- vulnerabilities = serializers.SerializerMethodField('get_csafvuls')
- product_tree = serializers.SerializerMethodField('get_csafprods')
+
+ document = serializers.SerializerMethodField("get_csafdocument")
+ vulnerabilities = serializers.SerializerMethodField("get_csafvuls")
+ product_tree = serializers.SerializerMethodField("get_csafprods")
mproduct_tree = {"branches": []}
- template_json_dir = os.path.join(os.path.dirname(__file__),
- 'templatesjson', 'csaf')
-
+ template_json_dir = os.path.join(os.path.dirname(__file__), "templatesjson", "csaf")
+
class Meta:
model = Case
- fields = ["document","vulnerabilities","product_tree"]
-
+ fields = ["document", "vulnerabilities", "product_tree"]
def to_representation(self, case):
ret = super().to_representation(case)
- if not ret['vulnerabilities']:
- del ret['product_tree']
- if hasattr(settings,'CSAF_VUL_EMPTY'):
- ret['vulnerabilities'] = settings.CSAF_VUL_EMPTY
+ if not ret["vulnerabilities"]:
+ del ret["product_tree"]
+ if hasattr(settings, "CSAF_VUL_EMPTY"):
+ ret["vulnerabilities"] = settings.CSAF_VUL_EMPTY
else:
- ret['vulnerabilities'] = [{"notes": [{"category": "general","text": "No vulnerabilities have been defined at this time for this report"}]}]
+ ret["vulnerabilities"] = [
+ {
+ "notes": [
+ {
+ "category": "general",
+ "text": "No vulnerabilities have been defined at this time for this report",
+ }
+ ]
+ }
+ ]
return ret
-
- def get_csafdocument(self,case):
- tfile = os.path.join(self.template_json_dir,"document.json")
+ def get_csafdocument(self, case):
+ tfile = os.path.join(self.template_json_dir, "document.json")
add_document = {}
if not os.path.exists(tfile):
return {"error": "Template file for csaf missing"}
- csafdocument_template = open(tfile,"r").read()
+ csafdocument_template = open(tfile, "r").read()
vulnote = reverse("vincepub:vudetail", args=[case.vuid])
# Either one of this is the way to know l.publicdate or l.published
if case.publicdate or case.published:
@@ -291,18 +346,18 @@ def get_csafdocument(self,case):
else:
publicurl = f"{settings.KB_SERVER_NAME}{vulnote}#PendingRelease"
case_status = "interim"
- if hasattr(settings,"CSAF_TLP_MAP") and settings.CSAF_TLP_MAP.get("PRIVATE"):
+ if hasattr(settings, "CSAF_TLP_MAP") and settings.CSAF_TLP_MAP.get("PRIVATE"):
tlp_type = settings.CSAF_TLP_MAP.get("PRIVATE")
- if hasattr(settings,"CSAF_DISTRIBUTION_OPTIONS") and settings.CSAF_DISTRIBUTION_OPTIONS.get(tlp_type):
+ if hasattr(settings, "CSAF_DISTRIBUTION_OPTIONS") and settings.CSAF_DISTRIBUTION_OPTIONS.get(tlp_type):
add_document.update(settings.CSAF_DISTRIBUTION_OPTIONS.get(tlp_type))
ackurl = f"{settings.KB_SERVER_NAME}{vulnote}#acknowledgments"
if case.modified:
- revision_date = case.modified.isoformat(timespec='seconds')
+ revision_date = case.modified.isoformat(timespec="seconds")
revision_number = case.modified.strftime("1.%Y%m%d%H%M%S.0")
case_version = revision_number
else:
- revision_date = datetime.datetime.now(datetime.timezone.utc).isoformat(timespec='seconds')
+ revision_date = datetime.datetime.now(datetime.timezone.utc).isoformat(timespec="seconds")
revision_number = revision_date.strftime("1.%Y%m%d%H%M%S.0")
case_version = revision_number
csafdocument = csafdocument_template % {
@@ -311,7 +366,7 @@ def get_csafdocument(self,case):
"summary": json.dumps(case.summary),
"LEGAL_DISCLAIMER": settings.LEGAL_DISCLAIMER,
"title": json.dumps(case.title),
- "due_date": case.due_date,
+ "due_date": case.due_date.isoformat(timespec="seconds"),
"VINCE_VERSION": settings.VERSION,
"ORG_NAME": settings.ORG_NAME,
"ORG_POLICY_URL": settings.ORG_POLICY_URL,
@@ -323,9 +378,9 @@ def get_csafdocument(self,case):
"revision_date": revision_date,
"revision_number": revision_number,
"case_status": case_status,
- "case_version": case_version
+ "case_version": case_version,
}
- csafd = json.loads(csafdocument,strict=False)
+ csafd = json.loads(csafdocument, strict=False)
csafd.update(add_document)
return csafd
@@ -335,14 +390,14 @@ def get_csafvuls(self, case):
if not len(casevuls):
return None
csafvuls = []
- tfile = os.path.join(self.template_json_dir,"vulnerability.json")
- csafvul_template = open(tfile,"r").read()
- tfile = os.path.join(self.template_json_dir,"product_tree.json")
+ tfile = os.path.join(self.template_json_dir, "vulnerability.json")
+ csafvul_template = open(tfile, "r").read()
+ tfile = os.path.join(self.template_json_dir, "product_tree.json")
if not os.path.exists(tfile):
return [{"error": "Template file for csaf missing"}]
- csafproduct_template = open(tfile,"r").read()
+ csafproduct_template = open(tfile, "r").read()
for casevul in casevuls:
- casems = list(CaseMemberStatus.objects.filter(vulnerability = casevul))
+ casems = list(CaseMemberStatus.objects.filter(vulnerability=casevul))
known_affected = []
known_not_affected = []
if casevul.cve:
@@ -352,14 +407,15 @@ def get_csafvuls(self, case):
else:
cve = None
csafvul = csafvul_template % {
- "vuid": casevul.vul,
- "cve": cve,
+ "vuid": casevul.vul,
+ "cve": cve,
"ORG_NAME": settings.ORG_NAME,
- "title": json.dumps(casevul.description.split(".")[0]+"."),
- "description": json.dumps(casevul.description) }
- csafvulj = json.loads(csafvul,strict=False)
+ "title": json.dumps(casevul.description.split(".")[0] + "."),
+ "description": json.dumps(casevul.description),
+ }
+ csafvulj = json.loads(csafvul, strict=False)
if cve is None:
- del csafvulj['cve']
+ del csafvulj["cve"]
for casem in casems:
try:
vendor = casem.member.group.groupcontact.contact.vendor_name
@@ -367,7 +423,7 @@ def get_csafvuls(self, case):
logger.info(f"Strange vendor without a vendor name {casem} for case # {case}")
vendor = "Unspecified"
if case.published or casem.member.share_status():
- csaf_productid = "CSAFPID-"+str(uuid.uuid1())
+ csaf_productid = "CSAFPID-" + str(uuid.uuid1())
else:
logger.debug(f"Vendor {vendor} for case {case} is not sharing their status")
continue
@@ -375,23 +431,22 @@ def get_csafvuls(self, case):
known_affected.append(csaf_productid)
elif casem.status == 2:
known_not_affected.append(csaf_productid)
- #(1 == 'AFFECTED', 2 == 'UNAFFECTED')
+ # (1 == 'AFFECTED', 2 == 'UNAFFECTED')
# we include products that are Unknown
# so it is clear that we have anounced to this vendor
# who has not responded.
- csafproduct = csafproduct_template % {
- "vendor_name": vendor,
- "csaf_productid": csaf_productid }
+ csafproduct = csafproduct_template % {"vendor_name": vendor, "csaf_productid": csaf_productid}
self.mproduct_tree["branches"].append(json.loads(csafproduct))
if len(known_affected) > 0:
- if not 'product_status' in csafvulj:
- csafvulj['product_status'] = {}
- csafvulj['product_status']['known_affected'] = known_affected
+ if not "product_status" in csafvulj:
+ csafvulj["product_status"] = {}
+ csafvulj["product_status"]["known_affected"] = known_affected
if len(known_not_affected) > 0:
- if not 'product_status' in csafvulj:
- csafvulj['product_status'] = {}
- csafvulj['product_status']['known_not_affected'] = known_not_affected
+ if not "product_status" in csafvulj:
+ csafvulj["product_status"] = {}
+ csafvulj["product_status"]["known_not_affected"] = known_not_affected
csafvuls.append(csafvulj)
return csafvuls
- def get_csafprods(self,case):
+
+ def get_csafprods(self, case):
return self.mproduct_tree
diff --git a/vinny/templates/vinny/base.html b/vinny/templates/vinny/base.html
index ff0c738..6c110e9 100644
--- a/vinny/templates/vinny/base.html
+++ b/vinny/templates/vinny/base.html
@@ -92,7 +92,7 @@