assemblyline-ui 4.7.0.dev28__py3-none-any.whl → 4.7.0.dev31__py3-none-any.whl

assemblyline_ui/VERSION

@@ -1 +1 @@
-4.7.0.dev28
+4.7.0.dev31

assemblyline_ui/api/v4/authentication.py

@@ -513,11 +513,11 @@ def saml_acs(**_):
             data["roles"] = load_roles(data["type"], user_roles)
 
             # Load in the user DN
-            if dn := get_attribute(saml_user_data, "dn"):
+            if dn := get_attribute(saml_user_data, config.auth.saml.attributes.dn_attribute):
                 data["dn"] = dn
 
             # Get the dynamic classification info
-            if u_classification := get_attribute(saml_user_data, "classification"):
+            if u_classification := get_attribute(saml_user_data, config.auth.saml.attributes.classification_attribute):
                 data["classification"] = get_dynamic_classification(u_classification, data)
 
             # Save the updated user

assemblyline_ui/api/v4/user.py

@@ -197,8 +197,9 @@ def who_am_i(**kwargs):
 
     # System configuration
     user_data['c12nDef'] = classification_definition
+    full_alias_access = user_data['is_admin'] or CLASSIFICATION.is_accessible(user_data['classification'], CLASSIFICATION.RESTRICTED)
     user_data['classification_aliases'] = {k: v for k, v in CLASSIFICATION_ALIASES.items().items()
-                                           if k in user_data['classification'] or user_data['is_admin'] or CLASSIFICATION.is_accessible(user_data['classification'], CLASSIFICATION.RESTRICTED)}
+                                           if k in user_data['classification'] or full_alias_access}
 
     # create tag-to-source lookup mapping
     external_source_tags = {}

assemblyline_ui/error.py

@@ -37,7 +37,7 @@ def handle_401(e):
     else:
         msg = str(e)
 
-    ip = ip_address(session.get("ip", request.remote_addr))
+    ip = ip_address(request.headers.get("X-Forwarded-For", request.remote_addr))
     data = {}
 
     # Check which OAuth providers are available based on IP filters

assemblyline_ui/helper/user.py

@@ -90,11 +90,14 @@ def increase_daily_submission_quota(user) -> Optional[str]:
             daily_quota = config.ui.default_quotas.daily_submissions
 
         if daily_quota != 0:
-            current_daily_quota = DAILY_QUOTA_TRACKER.increment_submission(quota_user)
-            flask_session['remaining_quota_submission'] = max(daily_quota - current_daily_quota, 0)
-            if current_daily_quota > daily_quota:
-                LOGGER.info(f"User {quota_user} exceeded their daily submission quota of {daily_quota}.")
-                return f"You've exceeded your daily maximum submission quota of {daily_quota}"
+            current_daily_quota = DAILY_QUOTA_TRACKER.get_submission(quota_user)
+            if current_daily_quota >= daily_quota:
+                LOGGER.info(f"User {quota_user} reached their daily submission quota of {daily_quota}.")
+
+                return f"You've reached your daily maximum submission quota of {daily_quota}"
+            else:
+                new_daily_quota = DAILY_QUOTA_TRACKER.increment_submission(quota_user)
+                flask_session["remaining_quota_submission"] = max(daily_quota - new_daily_quota, 0)
 
     return None
 
@@ -121,13 +124,11 @@ def check_async_submission_quota(user) -> Optional[str]:
             return daily_submission_quota_error
 
         if max_quota != 0 and not ASYNC_SUBMISSION_TRACKER.begin(quota_user, max_quota):
-            LOGGER.info(f"User {quota_user} exceeded their async submission quota of {max_quota}.")
-
             # Decrease the daily quota as we have increase it in the increase_daily_submission_quota call
             # but the user is out of concurrent async submission quotas
             release_daily_submission_quota(user)
-
-            return f"You've exceeded your maximum concurrent async submission quota of {max_quota}"
+            LOGGER.info(f"User {quota_user} exceeded their async submission quota of {max_quota}.")
+            return f"You've exceeded your maximum async concurrent submission quota of {max_quota}"
 
     return None
 
@@ -135,6 +136,8 @@ def check_async_submission_quota(user) -> Optional[str]:
 def check_submission_quota(user) -> Optional[str]:
     if config.ui.enforce_quota:
         quota_user = user['uname']
+
+        # get max concurrent submission quota
         max_quota = user.get('submission_quota')
         if max_quota is None:
             max_quota = config.ui.default_quotas.concurrent_submissions
@@ -143,13 +146,13 @@ def check_submission_quota(user) -> Optional[str]:
         if daily_submission_quota_error:
             return daily_submission_quota_error
 
+        # if a user do have a max_quota set and number of concurrent queues are <= max quota
         if max_quota != 0 and not SUBMISSION_TRACKER.begin(quota_user, max_quota):
-            LOGGER.info(f"User {quota_user} exceeded their submission quota of {max_quota}.")
 
             # Decrease the daily quota as we have increase it in the increase_daily_submission_quota call
             # but the user is out of concurrent submission quotas
             release_daily_submission_quota(user)
-
+            LOGGER.info(f"User {quota_user} exceeded their concurrent submission quota of {max_quota}.")
             return f"You've exceeded your maximum concurrent submission quota of {max_quota}"
 
     return None
@@ -316,15 +319,18 @@ def get_default_user_settings(user: dict) -> dict:
     settings.update({"default_zip_password": DEFAULT_ZIP_PASSWORD, "download_encoding": DOWNLOAD_ENCODING})
     return UserSettings(settings).as_primitives()
 
+
 def get_user_api_keys_dict(uname):
     apikeys = get_user_api_keys(uname)
     apikeys_dict = dict((apikey['key_name'], apikey) for apikey in apikeys)
     return apikeys_dict
 
+
 def get_user_api_keys(uname):
     apikeys = STORAGE.apikey.stream_search(f"uname:{uname}", as_obj=False)
     return apikeys
 
+
 def load_user_settings(user):
     default_settings = get_default_user_settings(user)
     user_classfication = user.get('classification', Classification.UNRESTRICTED)

assemblyline_ui/security/ldap_auth.py

@@ -9,7 +9,7 @@ import ldap
 import ldap.filter
 from assemblyline.common.str_utils import safe_str
 from assemblyline.odm.models.user import load_roles
-from flask import request, session
+from flask import request
 
 from assemblyline_ui.config import CLASSIFICATION, config
 from assemblyline_ui.helper.user import (
@@ -176,7 +176,7 @@ def validate_ldapuser(username, password, storage):
         ldap_obj = BasicLDAPWrapper(config.auth.ldap)
 
         # Check if IP is allowed to use LDAP auth
-        ip = ip_address(session.get("ip", request.remote_addr))
+        ip = ip_address(request.headers.get("X-Forwarded-For", request.remote_addr))
         if config.auth.ldap.ip_filter and not any(ip in ip_network(cidr) for cidr in config.auth.ldap.ip_filter):
             raise AuthenticationException(f"Access from IP {ip} is not allowed for LDAP login")
 

assemblyline_ui/security/oauth_auth.py

@@ -5,7 +5,7 @@ import elasticapm
 import jwt
 import requests
 from assemblyline.odm.models.user import load_roles_form_acls
-from flask import request, session
+from flask import request
 
 from assemblyline_ui.config import CACHE, STORAGE, config, get_token_store
 from assemblyline_ui.helper.oauth import get_profile_identifiers
@@ -61,7 +61,7 @@ def validate_oauth_token(oauth_token, oauth_provider, return_user=False):
             raise AuthenticationException(f"oAuth provider '{oauth_provider}' does not have a jwks_uri configured.")
 
         # Check if user is allowed to use this OAuth provider from its IP
-        ip = ip_address(session.get("ip", request.remote_addr))
+        ip = ip_address(request.headers.get("X-Forwarded-For", request.remote_addr))
         if oauth_provider_config.ip_filter and not any(ip in ip_network(cidr) for cidr in oauth_provider_config.ip_filter):
             raise AuthenticationException(f"Access from IP {ip} is not allowed for oAuth provider: {oauth_provider}")
 

assemblyline_ui/security/saml_auth.py

@@ -2,7 +2,7 @@ from ipaddress import ip_address, ip_network
 from typing import Any, Optional
 
 from assemblyline.odm.models.user import ROLES, TYPES
-from flask import request, session
+from flask import request
 
 from assemblyline_ui.config import config, get_token_store
 from assemblyline_ui.http_exceptions import AuthenticationException
@@ -14,7 +14,7 @@ def validate_saml_user(username: str, saml_token_id: str):
         raise AuthenticationException("SAML login is disabled")
 
     # Check if user is allowed to use SAML auth from its IP
-    ip = ip_address(session.get("ip", request.remote_addr))
+    ip = ip_address(request.headers.get("X-Forwarded-For", request.remote_addr))
     if config.auth.saml.ip_filter and not any(ip in ip_network(cidr) for cidr in config.auth.saml.ip_filter):
         raise AuthenticationException(f"Access from IP {ip} is not allowed for SAML login")
 

assemblyline_ui/security/userpass_auth.py

@@ -2,7 +2,7 @@ from ipaddress import ip_address, ip_network
 
 import elasticapm
 from assemblyline.common.security import verify_password
-from flask import request, session
+from flask import request
 
 from assemblyline_ui.config import config
 from assemblyline_ui.http_exceptions import AuthenticationException
@@ -14,7 +14,7 @@ def validate_userpass(username, password, storage):
     # You can overload this to pass username/password to an LDAP server for exemple
     if config.auth.internal.enabled and username and password:
         # Check if user is allowed to use internal auth from its IP
-        ip = ip_address(session.get("ip", request.remote_addr))
+        ip = ip_address(request.headers.get("X-Forwarded-For", request.remote_addr))
         if config.auth.internal.ip_filter and not any(ip in ip_network(cidr) for cidr in config.auth.internal.ip_filter):
             raise AuthenticationException(f"Access from IP {ip} is not allowed for username/password login")
 

{assemblyline_ui-4.7.0.dev28.dist-info → assemblyline_ui-4.7.0.dev31.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: assemblyline-ui
-Version: 4.7.0.dev28
+Version: 4.7.0.dev31
 Summary: Assemblyline 4 - API and Socket IO server
 Home-page: https://github.com/CybercentreCanada/assemblyline-ui/
 Author: CCCS Assemblyline development team

{assemblyline_ui-4.7.0.dev28.dist-info → assemblyline_ui-4.7.0.dev31.dist-info}/RECORD

@@ -1,8 +1,8 @@
-assemblyline_ui/VERSION,sha256=jfq1PXUsoabJh-h4btgHCYilGIJBvL5ntE1l0aayUQc,12
+assemblyline_ui/VERSION,sha256=7O8Pk4citoXgxUOZlbtxeL-RH4VRdO9u98i9s5MCt4Q,12
 assemblyline_ui/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 assemblyline_ui/app.py,sha256=ok96rpL0-Hb5amqa7ojhuB0boQceZG7E32NX6LZm-f4,7849
 assemblyline_ui/config.py,sha256=4M5wpG_OwJPjZAjRWIUMMyF4KG30oJidNDnFM-IVJCw,8927
-assemblyline_ui/error.py,sha256=7tZt46dJXAuFhHSsmQPcQ1Dc7de56p1l8JG0BbDOFr8,6009
+assemblyline_ui/error.py,sha256=9XUR2DMCd-Q5NWr88LKWpr1wu2180hehJf9rY1wnyBA,6030
 assemblyline_ui/gunicorn_config.py,sha256=db1Afugkwut9mxMigRq-L1_pRgUpRiDX4KySXY4_elg,1041
 assemblyline_ui/gunicorn_config_socketio.py,sha256=WWAWzrZOw1OXEiV_nNMKf-wH6A0Ckio2juCYWu-QfAE,115
 assemblyline_ui/healthz.py,sha256=IFr2ofSddFX8pvoixMmZHSlk364oKD_vURl_GRT6J2s,777
@@ -17,7 +17,7 @@ assemblyline_ui/api/v4/alert.py,sha256=XsOATBo5TZb5lhS1h34Pna-RLAZIUpk2WK_0sJ-we
 assemblyline_ui/api/v4/apikey.py,sha256=Ots7aPK9bi5ZzAePHPezQYwvv8Q7ygQAgOHpAZ1zTqo,11794
 assemblyline_ui/api/v4/archive.py,sha256=B_aFiur04RE_oIWw-Z0r4Au9PiRb2fJZAryCQeg3YkI,25781
 assemblyline_ui/api/v4/assistant.py,sha256=tNuamWxQZ1BbtuO9YT4DOVZHtzKD178KiqAWhDg5F5A,2766
-assemblyline_ui/api/v4/authentication.py,sha256=-rX_ugio-ARNiSn-t0W0kduuiyENY_h8brnWpKrIS3E,41494
+assemblyline_ui/api/v4/authentication.py,sha256=GN457_uLJGGBir2jA_6BIRWcoj79qOLhkmFCzH7wud0,41566
 assemblyline_ui/api/v4/badlist.py,sha256=lTqRLs8F745U0biPdC4AHimj0VUiCLcNFEae7UnjIwg,31507
 assemblyline_ui/api/v4/bundle.py,sha256=UcLUpErpiAk5LSYeC0zHDw_WpQiPcM8uhH7NwmWi4hw,5521
 assemblyline_ui/api/v4/error.py,sha256=RdpnDqM-tiFdG-Qni3-_8kn7VPlB0UW1VafUF2EHw8Q,2586
@@ -41,7 +41,7 @@ assemblyline_ui/api/v4/submission.py,sha256=WxMY00ePNdOMFXyu9j38sxpe0vT26u-Z_biM
 assemblyline_ui/api/v4/submit.py,sha256=5nfuX6Ud3FMdDGIOgBAdcb6kpMbINk750Ph5yp90O8c,18372
 assemblyline_ui/api/v4/system.py,sha256=4JhLhpmPfKzbXiHsBoJxSZP-ibu-lnmk4FrtaLExaRM,24861
 assemblyline_ui/api/v4/ui.py,sha256=J3OoLEETlFgeq7DbSlubTPebMQJOUx6UwRIt8mCBYbQ,11508
-assemblyline_ui/api/v4/user.py,sha256=m_xvc59imrxbRBwnNkZeH2vZbcW5smDgLIcIRVobaP0,47848
+assemblyline_ui/api/v4/user.py,sha256=94yE9rq2XnWgf1N8AEHPbMWiP23yCgzFvZ1nm0Ka7f0,47890
 assemblyline_ui/api/v4/webauthn.py,sha256=ouVWMMd0aMnNV5iaKbWY1AnsUE5_BKAtaUg9j77Rvow,4875
 assemblyline_ui/api/v4/workflow.py,sha256=Uz50960KyvFDm39NKYNSq5OXT0CA0u_FO5xPP61aYiQ,10579
 assemblyline_ui/helper/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -52,7 +52,7 @@ assemblyline_ui/helper/search.py,sha256=ri3IpUEnNyzrYYIx0Eb-2lQG-42QhG1YFUDAtpMB
 assemblyline_ui/helper/service.py,sha256=NSNK25rVUpsF7ElfzWZl4Ro7VQItmEB_JbBfnhSxmwo,5176
 assemblyline_ui/helper/signature.py,sha256=PUiQk56QoY5Ye2Pg3jRNgOT2i2ZqTWkk_0dv-Bfy9vI,899
 assemblyline_ui/helper/submission.py,sha256=fZ-XuH1TkiyzPOJMUAYmcIHHXbGWANDknbeWsHQc-Ms,32632
-assemblyline_ui/helper/user.py,sha256=dK3JElrulX1T3yuAx9-JdaaP4BYY8ulrYA58Rm2vhZM,17212
+assemblyline_ui/helper/user.py,sha256=d5umOq5GcvsIUuxjeW4_2xbzjEwoAdcSyHswpE5rCO4,17462
 assemblyline_ui/helper/ai/__init__.py,sha256=m2Nb3UgSiXNz3l6rUX17BlKwT1YLjAHn7W87SWP8e9o,1052
 assemblyline_ui/helper/ai/base.py,sha256=0aAecNUh6jxuqlNoZzZDbnPMuqZUzh5hCKt1hpdFvLg,8801
 assemblyline_ui/helper/ai/cohere.py,sha256=Er2s2m5oD0svOyV2WnELuwZLY4FtJwTZFazr5T_Yir8,7021
@@ -60,11 +60,11 @@ assemblyline_ui/helper/ai/openai.py,sha256=37MNSMiJha9SVCDGIqYGF2Y-pYjhulhvzHPuA
 assemblyline_ui/security/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 assemblyline_ui/security/apikey_auth.py,sha256=-KX7Ps1XYTP7Bgv6Dn290IEMJ7UBxHFJihILMpdf9zs,2214
 assemblyline_ui/security/authenticator.py,sha256=Lra3F9HJ2PU-A9lRY5_purqkUXZ3QRbKf8mDc6Zdq4o,7911
-assemblyline_ui/security/ldap_auth.py,sha256=43MWtxj_EyMNEySPgIerEyyL8b8Hb2V4qhOrfF3Kn08,10085
-assemblyline_ui/security/oauth_auth.py,sha256=QrIFvjIGGJy-XUdluGkEPrEktzCokt3mx-nieCp3Ucg,4689
-assemblyline_ui/security/saml_auth.py,sha256=cjvddqnELQv8eZfmiZPPHbXPpbK0HD8ZwQTeEi55zyA,2229
+assemblyline_ui/security/ldap_auth.py,sha256=xEDPA3wD_HKNqdMYenBijM_ZvP8G-CUHyGoWYiBSeP4,10097
+assemblyline_ui/security/oauth_auth.py,sha256=SrPHUX6A_J9rrQsZaZDdkHQ1nn9WvbYmsjEp4gPcIaU,4701
+assemblyline_ui/security/saml_auth.py,sha256=w5GAhGDJzW2VzjPhBLM6v2dfprcqSoG8TTG06msEfa8,2241
 assemblyline_ui/security/second_factor_auth.py,sha256=l3SjJ5vn3bYxkPTtKWLewbZUSWtm1REqllzZvvsh9BU,2953
-assemblyline_ui/security/userpass_auth.py,sha256=KLIg-VulLqeJEYyj0FlD-rLAn-SX-2A38UUqbRNSNlw,1192
+assemblyline_ui/security/userpass_auth.py,sha256=vy2cwxGtz-pQ-kMMUch2sji4D-t4jreEZDv-pFamTKg,1204
 assemblyline_ui/security/utils.py,sha256=CE6H9sM8S26vrzPATuCfwZv0TA7kBs3IRajaeX1aU3Q,5920
 assemblyline_ui/sio/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 assemblyline_ui/sio/alert.py,sha256=aTtrkZW21igbP6UcFgo1_fXdF8RpCBlMiKsNdpwItZw,2170
@@ -74,8 +74,8 @@ assemblyline_ui/sio/live_submission.py,sha256=mS0oGO5rEA8PLa8kjBcodOG-Q0CG4SpYAo
 assemblyline_ui/sio/retrohunt.py,sha256=vlH_x6Rb4pm3GM1sNLH1C42-NVR3VoAsEfkAu3L30fY,2146
 assemblyline_ui/sio/status.py,sha256=_Bxf1KLPOJEUIk4J9_j9fzvQWUXqSIT9xnJKhT1hhuc,1980
 assemblyline_ui/sio/submission.py,sha256=IYJuGz73HK9HtYfqc-gWW8tc1lt5VZ62Qn64AaGGtm8,2222
-assemblyline_ui-4.7.0.dev28.dist-info/licenses/LICENCE.md,sha256=NSkYo9EH8h5oOkzg4VhjAHF4339MqPP2cQ8msTPgl-c,1396
-assemblyline_ui-4.7.0.dev28.dist-info/METADATA,sha256=3USQJyIt0ilZKPdl9SvyiCYFW47ysnx8Vqj6NvMcttQ,8174
-assemblyline_ui-4.7.0.dev28.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-assemblyline_ui-4.7.0.dev28.dist-info/top_level.txt,sha256=WLa7-PKLJTbMUbKKU3q3kg5_uAV67hss5kC71PAbIeg,16
-assemblyline_ui-4.7.0.dev28.dist-info/RECORD,,
+assemblyline_ui-4.7.0.dev31.dist-info/licenses/LICENCE.md,sha256=NSkYo9EH8h5oOkzg4VhjAHF4339MqPP2cQ8msTPgl-c,1396
+assemblyline_ui-4.7.0.dev31.dist-info/METADATA,sha256=wq2fGO6OWiyvUq1a_lke4Keu3BCDQQSXljlaI7F-MTw,8174
+assemblyline_ui-4.7.0.dev31.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+assemblyline_ui-4.7.0.dev31.dist-info/top_level.txt,sha256=WLa7-PKLJTbMUbKKU3q3kg5_uAV67hss5kC71PAbIeg,16
+assemblyline_ui-4.7.0.dev31.dist-info/RECORD,,