Skip to content

Commit cff57f4

Browse files
devGregAdevGregA
authored
Merge pull request DefectDojo#550 from DefectDojo/dev
1.3.0 Release
2 parents 979fc83 + 8bb2a26 commit cff57f4

File tree

26 files changed

+366
-150
lines changed

26 files changed

+366
-150
lines changed

‎.gitignore‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,6 @@ Quarterly.txt
8181
# yarn
8282
components/*
8383
!components/package.json
84-
yarn_components/
8584
dojo/static/*
8685
!dojo/static/dojo/*
8786
dojo/media

‎ansible/dev-install/templates/settings.py.j2‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,8 @@ STATICFILES_DIRS = (
8989
# Put strings here, like "/home/html/static" or "C:/www/django/static".
9090
# Always use forward slashes, even on Windows.
9191
# Don't forget to use absolute paths, not relative paths.
92-
os.path.dirname(DOJO_ROOT) + "/components/yarn_components",
92+
os.path.join(os.path.dirname(DOJO_ROOT), 'components', 'node_modules',
93+
'@yarn_components'),
9394
)
9495

9596
# List of finder classes that know how to find static files in
@@ -99,7 +100,9 @@ STATICFILES_FINDERS = (
99100
'django.contrib.staticfiles.finders.AppDirectoriesFinder',
100101
)
101102

102-
FILE_UPLOAD_HANDLERS = ("django.core.files.uploadhandler.TemporaryFileUploadHandler",)
103+
FILE_UPLOAD_HANDLERS = (
104+
"django.core.files.uploadhandler.TemporaryFileUploadHandler",
105+
)
103106

104107
# Make this unique, and don't share it with anybody.
105108
SECRET_KEY = 'DOJOSECRET'
@@ -222,7 +225,8 @@ LOGGING = {
222225
'disable_existing_loggers': False,
223226
'formatters': {
224227
'verbose': {
225-
'format': '[%(asctime)s] %(levelname)s [%(name)s:%(lineno)d] %(message)s',
228+
'format': '[%(asctime)s] %(levelname)s '
229+
'[%(name)s:%(lineno)d] %(message)s',
226230
'datefmt': '%d/%b/%Y %H:%M:%S',
227231
},
228232
'simple': {

‎components/package.json‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,5 @@
3232
},
3333
"engines": {
3434
"yarn": ">= 1.0.0"
35-
},
36-
"scripts": {
37-
"postinstall": "node -e \"try { require('fs').symlinkSync(require('path').resolve('node_modules/@yarn_components'), 'yarn_components', 'junction') } catch (e) { }\""
3835
}
3936
}

‎dojo/__init__.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# Django starts so that shared_task will use this app.
55
from .celery import app as celery_app # noqa
66

7-
__version__ = '1.2.9'
7+
__version__ = '1.3.0'
88
__url__ = 'https://github.com/DefectDojo/django-DefectDojo'
99
__docs__ = 'http://defectdojo.readthedocs.io/'
1010
__demo__ = 'http://defectdojo.pythonanywhere.com/'

‎dojo/benchmark/urls.py‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,7 @@
55

66
urlpatterns = [
77
url(r'^benchmark/(?P<pid>\d+)/type/(?P<type>\d+)$', views.benchmark_view, name='view_product_benchmark'),
8-
url(r'^benchmark/(?P<pid>\d+)/type/(?P<type>\d+)/category/(?P<cat>\d+)', views.benchmark_view, name='view_product_benchmark')
8+
url(r'^benchmark/(?P<pid>\d+)/type/(?P<type>\d+)/category/(?P<cat>\d+)', views.benchmark_view, name='view_product_benchmark'),
9+
url(r'^benchmark/(?P<pid>\d+)/type/(?P<type>\d+)/category/(?P<cat>\d+)/edit/(?P<bid>\d+)', views.benchmark_view, name='edit_benchmark'),
10+
url(r'^benchmark/(?P<pid>\d+)/type/(?P<type>\d+)/delete', views.delete, name='delete_product_benchmark')
911
]

‎dojo/benchmark/views.py‎

Lines changed: 29 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
from django.db.models import Count, Q
2020

2121
from dojo.filters import ProductFilter, ProductFindingFilter
22-
from dojo.forms import ProductForm, EngForm, DeleteProductForm, Benchmark_Requirement, Benchmark_Product_SummaryForm
22+
from dojo.forms import Benchmark_Requirement, Benchmark_Product_SummaryForm, DeleteBenchmarkForm
2323
from dojo.models import Notifications, Dojo_User, Benchmark_Type, Benchmark_Category, \
2424
Benchmark_Requirement, Benchmark_Product, Product, Benchmark_Product_Summary
2525
from dojo.utils import get_page_items, add_breadcrumb, get_punchcard_data, handle_uploaded_selenium, get_system_setting
@@ -79,7 +79,7 @@ def score_asvs(product, benchmark_type):
7979

8080
benchmark_product_summary.save()
8181

82-
82+
@user_passes_test(lambda u: u.is_staff)
8383
def benchmark_view(request, pid, type, cat=None):
8484
product = get_object_or_404(Product, id=pid)
8585
benchmark_type = get_object_or_404(Benchmark_Type, id=type)
@@ -145,26 +145,32 @@ def benchmark_view(request, pid, type, cat=None):
145145
'category_name': category_name,
146146
'benchmark_category': benchmark_category})
147147

148+
@user_passes_test(lambda u: u.is_staff)
149+
def delete(request, pid, type):
150+
product = get_object_or_404(Product, id=pid)
151+
benchmark_type = get_object_or_404(Benchmark_Type, id=type)
152+
benchmark_product_summary = Benchmark_Product_Summary.objects.filter(product=product, benchmark_type=type).first()
153+
form = DeleteBenchmarkForm(instance=benchmark_product_summary)
154+
print form
155+
from django.contrib.admin.utils import NestedObjects
156+
from django.db import DEFAULT_DB_ALIAS
148157

149-
@user_passes_test(lambda u: u.is_superuser)
150-
def global_notifications(request):
151-
try:
152-
notifications_obj = Notifications.objects.get(user=None)
153-
except:
154-
notifications_obj = Notifications(user=None)
155-
156-
form = NotificationsForm(instance=notifications_obj)
157158
if request.method == 'POST':
158-
form = NotificationsForm(request.POST, instance=notifications_obj)
159-
if form.is_valid():
160-
new_settings = form.save()
161-
messages.add_message(request,
162-
messages.SUCCESS,
163-
'Settings saved.',
164-
extra_tags='alert-success')
165-
166-
add_breadcrumb(title="Global notification settings", top_level=False, request=request)
167-
return render(request, 'dojo/notifications.html',
168-
{'form': form,
169-
'scope': 'global',
170-
'admin': request.user.is_superuser})
159+
if 'id' in request.POST and str(benchmark_product_summary.id) == request.POST['id']:
160+
form = DeleteBenchmarkForm(request.POST, instance=benchmark_product_summary)
161+
if form.is_valid():
162+
benchmark_product = Benchmark_Product.objects.filter(product=product, control__category__type=type)
163+
benchmark_product.delete()
164+
benchmark_product_summary.delete()
165+
messages.add_message(request,
166+
messages.SUCCESS,
167+
'Benchmarks removed.',
168+
extra_tags='alert-success')
169+
return HttpResponseRedirect(reverse('product'))
170+
171+
add_breadcrumb(parent=product, title="Delete Benchmarks", top_level=False, request=request)
172+
173+
return render(request, 'dojo/delete_benchmark.html',
174+
{'product': product,
175+
'form': form
176+
})

‎dojo/engagement/views.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ def edit_engagement(request, eid):
117117
form = EngForm2(request.POST, instance=eng)
118118
if 'jiraform-push_to_jira' in request.POST:
119119
jform = JIRAFindingForm(request.POST, prefix='jiraform', enabled=True)
120-
if form.is_valid():
120+
if form.is_valid() and jform and jform.is_valid():
121121
if 'jiraform-push_to_jira' in request.POST:
122122
try:
123123
jissue = JIRA_Issue.objects.get(engagement=eng)

‎dojo/finding/views.py‎

Lines changed: 42 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
ClosedFingingSuperFilter, TemplateFindingFilter
2828
from dojo.forms import NoteForm, CloseFindingForm, FindingForm, PromoteFindingForm, FindingTemplateForm, \
2929
DeleteFindingTemplateForm, FindingImageFormSet, JIRAFindingForm, ReviewFindingForm, ClearFindingReviewForm, \
30-
DefectFindingForm, StubFindingForm, ApplyFindingTemplateForm
30+
DefectFindingForm, StubFindingForm, DeleteFindingForm, DeleteStubFindingForm, ApplyFindingTemplateForm
3131
from dojo.models import Product_Type, Finding, Notes, \
3232
Risk_Acceptance, BurpRawRequestResponse, Stub_Finding, Endpoint, Finding_Template, FindingImage, \
3333
FindingImageAccessToken, JIRA_Issue, JIRA_PKey, JIRA_Conf, Dojo_User, Cred_User, Cred_Mapping, Test
@@ -322,19 +322,30 @@ def reopen_finding(request, fid):
322322
extra_tags='alert-success')
323323
return HttpResponseRedirect(reverse('view_finding', args=(finding.id,)))
324324

325-
326325
@user_passes_test(lambda u: u.is_staff)
327326
def delete_finding(request, fid):
328327
finding = get_object_or_404(Finding, id=fid)
329-
tid = finding.test.id
330-
del finding.tags
331-
finding.delete()
332-
messages.add_message(request,
333-
messages.SUCCESS,
334-
'Finding deleted successfully.',
335-
extra_tags='alert-success')
336-
return HttpResponseRedirect(reverse('view_test', args=(tid,)))
337328

329+
form = DeleteFindingForm(instance=finding)
330+
331+
if request.method == 'POST':
332+
form = DeleteFindingForm(request.POST, instance=finding)
333+
if form.is_valid():
334+
tid = finding.test.id
335+
del finding.tags
336+
finding.delete()
337+
messages.add_message(request,
338+
messages.SUCCESS,
339+
'Finding deleted successfully.',
340+
extra_tags='alert-success')
341+
return HttpResponseRedirect(reverse('view_test', args=(tid,)))
342+
else:
343+
messages.add_message(request,
344+
messages.ERROR,
345+
'Unable to delete finding, please try again.',
346+
extra_tags='alert-danger')
347+
else:
348+
return HttpResponseForbidden()
338349

339350
@user_passes_test(lambda u: u.is_staff)
340351
def edit_finding(request, fid):
@@ -697,20 +708,30 @@ def add_stub_finding(request, tid):
697708
add_breadcrumb(title="Add Stub Finding", top_level=False, request=request)
698709
return HttpResponseRedirect(reverse('view_test', args=(tid,)))
699710

700-
701711
@user_passes_test(lambda u: u.is_staff)
702712
def delete_stub_finding(request, fid):
703713
finding = get_object_or_404(Stub_Finding, id=fid)
704-
tid = finding.test.id
705-
if hasattr(finding, 'tags'):
706-
del finding.tags
707-
finding.delete()
708-
messages.add_message(request,
709-
messages.SUCCESS,
710-
'Potential Finding deleted successfully.',
711-
extra_tags='alert-success')
712-
return HttpResponseRedirect(reverse('view_test', args=(tid,)))
714+
form = DeleteStubFindingForm(instance=finding)
713715

716+
if request.method == 'POST':
717+
form = DeleteStubFindingForm(request.POST, instance=finding)
718+
if form.is_valid():
719+
tid = finding.test.id
720+
if hasattr(finding, 'tags'):
721+
del finding.tags
722+
finding.delete()
723+
messages.add_message(request,
724+
messages.SUCCESS,
725+
'Potential Finding deleted successfully.',
726+
extra_tags='alert-success')
727+
return HttpResponseRedirect(reverse('view_test', args=(tid,)))
728+
else:
729+
messages.add_message(request,
730+
messages.ERROR,
731+
'Unable to delete potential finding, please try again.',
732+
extra_tags='alert-danger')
733+
else:
734+
return HttpResponseForbidden()
714735

715736
@user_passes_test(lambda u: u.is_staff)
716737
def promote_to_finding(request, fid):
@@ -725,7 +746,7 @@ def promote_to_finding(request, fid):
725746
jira_available = True
726747
else:
727748
jform = None
728-
749+
729750
form = PromoteFindingForm(initial={'title': finding.title,
730751
'date': finding.date,
731752
'severity': finding.severity,

‎dojo/forms.py‎

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -844,8 +844,13 @@ class Meta:
844844

845845

846846
class FindingBulkUpdateForm(forms.ModelForm):
847+
def __init__(self, *args, **kwargs):
848+
super(FindingBulkUpdateForm, self).__init__(*args, **kwargs)
849+
self.fields['severity'].required = False
850+
847851
def clean(self):
848852
cleaned_data = super(FindingBulkUpdateForm, self).clean()
853+
849854
if (cleaned_data['active'] or cleaned_data['verified']) and cleaned_data['duplicate']:
850855
raise forms.ValidationError('Duplicate findings cannot be'
851856
' verified or active')
@@ -1286,7 +1291,7 @@ class ReportOptionsForm(forms.Form):
12861291
include_finding_images = forms.ChoiceField(choices=yes_no, label="Finding Images")
12871292
include_executive_summary = forms.ChoiceField(choices=yes_no, label="Executive Summary")
12881293
include_table_of_contents = forms.ChoiceField(choices=yes_no, label="Table of Contents")
1289-
report_type = forms.ChoiceField(choices=(('AsciiDoc', 'AsciiDoc'), ('PDF', 'PDF')))
1294+
report_type = forms.ChoiceField(choices=(('AsciiDoc', 'AsciiDoc'),('HTML', 'HTML'), ('PDF', 'PDF')))
12901295

12911296

12921297
class CustomReportOptionsForm(forms.Form):
@@ -1305,6 +1310,21 @@ class Meta:
13051310
model = Report
13061311
fields = ('id',)
13071312

1313+
class DeleteFindingForm(forms.ModelForm):
1314+
id = forms.IntegerField(required=True,
1315+
widget=forms.widgets.HiddenInput())
1316+
1317+
class Meta:
1318+
model = Finding
1319+
fields = ('id',)
1320+
1321+
class DeleteStubFindingForm(forms.ModelForm):
1322+
id = forms.IntegerField(required=True,
1323+
widget=forms.widgets.HiddenInput())
1324+
1325+
class Meta:
1326+
model = Stub_Finding
1327+
fields = ('id',)
13081328

13091329
class AddFindingImageForm(forms.ModelForm):
13101330
class Meta:
@@ -1333,6 +1353,14 @@ class Meta:
13331353
model = Benchmark_Product_Summary
13341354
exclude = ['product', 'current_level', 'benchmark_type', 'asvs_level_1_benchmark', 'asvs_level_1_score', 'asvs_level_2_benchmark', 'asvs_level_2_score', 'asvs_level_3_benchmark', 'asvs_level_3_score']
13351355

1356+
class DeleteBenchmarkForm(forms.ModelForm):
1357+
id = forms.IntegerField(required=True,
1358+
widget=forms.widgets.HiddenInput())
1359+
1360+
class Meta:
1361+
model = Benchmark_Product_Summary
1362+
exclude = ['product', 'benchmark_type', 'desired_level', 'current_level', 'asvs_level_1_benchmark', 'asvs_level_1_score', 'asvs_level_2_benchmark', 'asvs_level_2_score', 'asvs_level_3_benchmark', 'asvs_level_3_score', 'publish']
1363+
13361364
class JIRA_PKeyForm(forms.ModelForm):
13371365

13381366
class Meta:

‎dojo/models.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1619,6 +1619,7 @@ class Meta:
16191619
admin.site.register(Cred_User)
16201620
admin.site.register(Cred_Mapping)
16211621
admin.site.register(System_Settings, System_SettingsAdmin)
1622+
admin.site.register(CWE)
16221623

16231624

16241625
watson.register(Product)

0 commit comments

Comments
 (0)