django-restit 4.2.32__py3-none-any.whl → 4.2.34__py3-none-any.whl

account/models/member.py

@@ -683,6 +683,7 @@ class Member(User, RestModel, MetaDataModel):
             if Member.objects.filter(auth_code=code).count() == 0:
                 self.auth_code = code
                 self.auth_code_expires = datetime.now() + timedelta(seconds=expires)
+                self.auditLog(f"auth_code generated '{code}'", "auth_code", level=21)
                 self.save()
                 return self.auth_code
         return None

account/rpc/auth.py

@@ -242,7 +242,7 @@ def is_member_logged_in(request):
 
 
 @rd.urlPOST('invite/validate')
-@rd.never_cache
+@rd.requires_params(["username"])
 def member_invite_confirm(request):
     username = request.DATA.get('username', None)
     auth_code = request.DATA.get(["auth_token", "invite_token"], None)
@@ -256,7 +256,7 @@ def member_invite_confirm(request):
 
 
 @rd.urlPOST('mfa/request_code')
-@rd.never_cache
+@rd.requires_params(["username"])
 def member_request_code(request):
     member, resp = get_member_from_request(request)
     if resp is not None:

account/rpc/member.py

@@ -18,8 +18,8 @@ def member_me_action(request):
         return restPermissionDenied(request, "not authenticated")
     if request.method == "GET":
         # request.session['ws4redis:memberof'] = request.member.getGroupUUIDs()
-        from rest import helpers as rh
-        rh.debug("user_platform", request.DATA.getUserAgentPlatform())
+        # from rest import helpers as rh
+        # rh.debug("user_platform", request.DATA.getUserAgentPlatform())
         return request.member.on_rest_get(request)
     elif request.method == "POST":
         return request.member.on_rest_post(request)

{django_restit-4.2.32.dist-info → django_restit-4.2.34.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-restit
-Version: 4.2.32
+Version: 4.2.34
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes

{django_restit-4.2.32.dist-info → django_restit-4.2.34.dist-info}/RECORD

@@ -24,7 +24,7 @@ account/models/device.py,sha256=XipNpByreGubB5-d4ZBOoIV5Xw14b2Btcgn6fXz8HAc,4105
 account/models/feeds.py,sha256=FXqcZ1Qy4oYOLzai7-GL4WNd7iKPb5Y3ZqvKQunq1Yk,1861
 account/models/group.py,sha256=krFO_Q7kas6j36eYIVpOalLkNfWd1Mj4IniPgENJay4,20628
 account/models/legacy.py,sha256=zYdtv4LC0ooxPVqWM-uToPwV-lYWQLorSE6p6yn1xDw,2720
-account/models/member.py,sha256=y2XRiFkIJU8OTAgJiba0MlFGabAYmpD3vc4pH5wepKg,50043
+account/models/member.py,sha256=IC-z-ZDzSBh9EYr8rfvHguttbubBNTKp2vYrQz9nUBQ,50129
 account/models/membership.py,sha256=K2fd0TJYhfv58HPyjQVlahlOPz3Q6ZwrxVkguG-2Ej8,7806
 account/models/notify.py,sha256=YnZujSHJHY7B09e6FIyZIEJRWLPYk1Sk1e92tFzB1IA,12078
 account/models/passkeys.py,sha256=TJxITUi4DT4_1tW2K7ZlOcRjJuMVl2NtKz7pKQU8-Tw,1516
@@ -36,10 +36,10 @@ account/passkeys/__init__.py,sha256=FwXYJXwSJXfkLojGBcVpF1dFpgFhzDdd9N_3naYQ0cc,
 account/passkeys/core.py,sha256=X8y1TCXupZZV-GF10nuPVmdpN0qYuzKe03RnaDlepP4,4116
 account/periodic.py,sha256=-u0n-7QTJgDOkasGhBAPwHAwjpqWGA-MZLEFkVTqCGU,874
 account/rpc/__init__.py,sha256=SGF0M_-H0dKh3b1apSX29BotNWAvITYccGQVC0MIjL8,336
-account/rpc/auth.py,sha256=vde9ELpqjkg1oY5B0Xa3qghNZ8brqCUgEx-K5rM6AzQ,15557
+account/rpc/auth.py,sha256=eywdJSjsi_Ds2pM4wnltPJUfjIQqf6r6e99eKS7q3BA,15593
 account/rpc/device.py,sha256=fbbZFp3cUdhVXvD7gVFOqFWj4hKS3bjZKD_aF5fQxd8,2852
 account/rpc/group.py,sha256=pr88ayqVUIBolR3FlWL0sb-JaH1PWH0ow39L7C6K6Rk,3466
-account/rpc/member.py,sha256=2HwARWk_1HHgZga3Y0Ii2NoTyzj1e3BuHpQ5miUQmCI,1260
+account/rpc/member.py,sha256=PU-Uz5KUI_BZFy-F-taDqAfnt_AwONYXSzUvfm7eyTw,1264
 account/rpc/notify.py,sha256=Q2YWejP36egeF060Hih5uX4Psv_B8NWlLLPi7iDYlIw,3344
 account/rpc/oauth.py,sha256=ISLVsR5HvKALANokaOFRvF4FTRxWtXPvVnZAYANKxpo,2864
 account/rpc/passkeys.py,sha256=5x28nYILJUMMSwfVuWYL66hfoGUXahMqOwiHhM4I3Do,1729
@@ -102,15 +102,15 @@ incident/migrations/0013_rulecheck_is_required.py,sha256=cL7tOj5XGPpKd2f5BojIKfN
 incident/migrations/0014_event_group_alter_rulecheck_index.py,sha256=v3gm5k0LVoas27qUDOt7el7YtK4yjFVLeEpuFUCoXaQ,724
 incident/migrations/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 incident/models/__init__.py,sha256=NMphuhb0RTMf7Ov4QkNv7iv6_I8Wtr3xQ54yjX_a31M,209
-incident/models/event.py,sha256=sY1k1PGNfv7C04lMRN86XCillfA_BgsVbOb5-SFZOvQ,7251
-incident/models/incident.py,sha256=8h_0t3AcCXOfA5t-bR9mYfFS4tMwEXCNeWVisRcJOy4,18285
+incident/models/event.py,sha256=CYyJHcTCRSkZuOynVNVBO6P9466OamMVV63jWEbDBZ8,7264
+incident/models/incident.py,sha256=0M7QN32BwlHYRvnUWPqI4IIThSpActGDdbmbPjNcJ9A,18415
 incident/models/ossec.py,sha256=p1ptr-8lnaj1EP_VmPR58b2LmaYBGaYYKAMqhWK5yZM,2227
 incident/models/rules.py,sha256=uT5GhW6Flso287lJGphAlWwL20NRnHDAZoGrWBBQfeE,6260
 incident/models/ticket.py,sha256=S3kqGQpYLE6Y4M9IKu_60sgW-f592xNr8uufqHnvDoU,2302
 incident/parsers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-incident/parsers/ossec.py,sha256=pnGJdamC8bNth3c07dCVwy9hM7kldUhd74i_eFXRk34,6333
+incident/parsers/ossec.py,sha256=Bc82n0AeXMBxMxzfAR-1puHyxldcikqeu5MeGRk1zMc,7142
 incident/periodic.py,sha256=eX1rQK6v65A9ugofTvJPSmAWei6C-3EYgzCMuGZ03jM,381
-incident/rpc.py,sha256=FFOMOf_awj0cy-tjIOsjUD63HrNLfrC1krZDwojG0WE,7684
+incident/rpc.py,sha256=g91tUpD5FYfl_q044VVwVyomNRhQfMLC1LeB-RRH3jM,7908
 incident/templates/email/incident_change.html,sha256=O_5ocWTsnqmmOuQhAtXEiE4rWecnZnJjoKU4MwV6ILo,14178
 incident/templates/email/incident_new.html,sha256=IPX3CqIrvdrZSn13_jlR6sEb0If8ftvUrUpkzC5G2Gc,15173
 incident/templates/email/incident_plain.html,sha256=fx4zsoldG1AQEBA6IYx5BJp_MAMizgjjx9EmuR5m4SQ,14727
@@ -359,7 +359,7 @@ pushit/utils.py,sha256=IeTCGa-164nmB1jIsK1lu1O1QzUhS3BKfuXHGjCW-ck,2121
 rest/.gitignore,sha256=TbEvWRMnAiajCTOdhiNrd9eeCAaIjRp9PRjE_VkMM5g,118
 rest/README.md,sha256=V3ETc-cJu8PZIbKr9xSe_pA4JEUpC8Dhw4bQeVCDJPw,5460
 rest/RemoteEvents.py,sha256=nL46U7AuxIrlw2JunphR1tsXyqi-ep_gD9CYGpYbNgE,72
-rest/__init__.py,sha256=WW-avasF3t1u6jXL0uIaU9MJtPtdKxjn0ZPoaMMAl7M,121
+rest/__init__.py,sha256=S_WfIhIPQUOluFpyXFWGT_zK5Q-hZklAhRvPWuqNO8s,121
 rest/arc4.py,sha256=y644IbF1ec--e4cUJ3KEYsewTCITK0gmlwa5mJruFC0,1967
 rest/cache.py,sha256=1Qg0rkaCJCaVP0-l5hZg2CIblTdeBSlj_0fP6vlKUpU,83
 rest/crypto/__init__.py,sha256=Tl0U11rgj1eBYqd6OXJ2_XSdNLumW_JkBZnaJqI6Ldw,72
@@ -391,12 +391,12 @@ rest/middleware/request.py,sha256=JchRNy5L-bGd-7h-KFYekGRvREe2eCkZXKOYqIkP2hI,41
 rest/middleware/session.py,sha256=zHSoQpIzRLmpqr_JvW406wzpvU3W3gDbm5JhtzLAMlE,10240
 rest/middleware/session_store.py,sha256=1nSdeXK8PyuYgGgIufqrS6j6QpIrQ7zbMNT0ol75e6U,1901
 rest/models/__init__.py,sha256=M8pvFDq-WCF-QcM58X7pMufYYe0aaQ3U0PwGe9TKbbY,130
-rest/models/base.py,sha256=1g7QeFp-zAf1dXNNZPY1SEgOwD9imirqQM0FIIYDG7c,66730
+rest/models/base.py,sha256=LNnlAEkKlwFME61Ek46jdLmF2dCRX6yn72U_st_YoN8,66944
 rest/models/cacher.py,sha256=eKz8TINVhWEqKhJGMsRkKZTtBUIv5rN3NHbZwOC56Uk,578
 rest/models/metadata.py,sha256=ui0962oaWbYGIbkNs7oaUGKyaca9epsW2H-ywgyH7rg,12631
 rest/net.py,sha256=LTF4ip-ur8C2G7NETVOg7ioACegBGo4sDJA18PfF5kQ,1691
 rest/regexes.yaml,sha256=VoGb4E-P_K9f82Yzcpltgzekpt9usRtwu9PYlo46nUw,149463
-rest/requestex.py,sha256=qtm6vpvbHzNYqMj8271TyelnWagZ5i0q50TfXW943F8,15834
+rest/requestex.py,sha256=dYXDIg1TLu44FYFjR9X-6AAr7E5yeeGySrlEBC7ZOcU,15677
 rest/rpc.py,sha256=Z-0Q62VeMViZiS_9vBHKJmbERgemsfg8pnKFjV-DH-w,4200
 rest/search.py,sha256=QVjk2b5tZLgf1zM2MHvJTyRjwUbY5ZD7HXSTmSPXtvU,8362
 rest/serializers/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -491,7 +491,7 @@ ws4redis/servers/uwsgi.py,sha256=VyhoCI1DnVFqBiJYHoxqn5Idlf6uJPHvfBKgkjs34mo,172
 ws4redis/settings.py,sha256=K0yBiLUuY81iDM4Yr-k8hbvjn5VVHu5zQhmMK8Dtz0s,1536
 ws4redis/utf8validator.py,sha256=S0OlfjeGRP75aO6CzZsF4oTjRQAgR17OWE9rgZdMBZA,5122
 ws4redis/websocket.py,sha256=R0TUyPsoVRD7Y_oU7w2I6NL4fPwiz5Vl94-fUkZgLHA,14848
-django_restit-4.2.32.dist-info/LICENSE.md,sha256=VHN4hhEeVOoFjtG-5fVv4jesA4SWi0Z-KgOzzN6a1ps,1068
-django_restit-4.2.32.dist-info/METADATA,sha256=mvZT3W4B3OUsvjsipHNktbh4NE0Wwkf1Sx7bG-LOV3U,7594
-django_restit-4.2.32.dist-info/WHEEL,sha256=Zb28QaM1gQi8f4VCBhsUklF61CTlNYfs9YAZn-TOGFk,88
-django_restit-4.2.32.dist-info/RECORD,,
+django_restit-4.2.34.dist-info/LICENSE.md,sha256=VHN4hhEeVOoFjtG-5fVv4jesA4SWi0Z-KgOzzN6a1ps,1068
+django_restit-4.2.34.dist-info/METADATA,sha256=_MJaPQPmu76cBOsqmwpe8OYoBA6nIsRqsmuUOdXRDEk,7594
+django_restit-4.2.34.dist-info/WHEEL,sha256=Zb28QaM1gQi8f4VCBhsUklF61CTlNYfs9YAZn-TOGFk,88
+django_restit-4.2.34.dist-info/RECORD,,

incident/models/event.py

@@ -46,7 +46,7 @@ class Event(JSONMetaData, rm.RestModel):
     class RestMeta:
         POST_SAVE_FIELDS = ["level", "catagory"]
         SEARCH_FIELDS = ["description", "hostname"]
-        VIEW_PERMS = ["view_incidents"]
+        VIEW_PERMS = ["view_incidents", "view_logs"]
         CREATE_PERMS = None  # allow anyone to create an event
         GRAPHS = {
             "default": {

incident/models/incident.py

@@ -168,6 +168,9 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
                 self.triggerTask()
             elif self.rule.action.startswith("group:"):
                 self.triggerGroup()
+            elif self.rule.action == "resolved":
+                self.state = INCIDENT_STATE_RESOLVED
+                self.save()
             elif self.rule.action.startswith("firewall_block"):
                 if settings.FIREWALL_GLOBAL_BLOCK:
                     Task.Publish("incident", "firewall_block", 

incident/parsers/ossec.py

@@ -22,6 +22,27 @@ def removeNonAscii(input_str):
     return ''.join(char for char in cleaned_str if 32 <= ord(char) < 128)
 
 
+def extractURL(text):
+    match = re.search(r"GET\s+(https?://[^\s]+)\s+HTTP/\d\.\d", text)
+    if match:
+        return match.group(1)
+    return None
+
+
+def extractDomain(text):
+    match = re.search(r"https?://([^/:]+)", text)
+    if match:
+        return match.group(1)
+    return None
+
+
+def extractUrlPath(text):
+    match = re.search(r"https?://[^/]+(/[^?]*)", text)
+    if match:
+        return match.group(1)
+    return None
+
+
 def parseAlert(request, data):
     # helpers.log_print(data)
     try:
@@ -145,15 +166,25 @@ def parseAlert(request, data):
         if m and m.groups():
             alert.src_ip = m.group(1)
     elif "web,accesslog," in data.text and "https:" in data.text:
-        p = data.text.find("https:")
-        url = data.text[p:]
-        alert.ssh_sig = url[p:url.find(' ')]
+        alert.ssh_sig = extractURL(data.text)
+        if alert.ssh_sig:
+            alert.hostname = extractDomain(alert.ssh_sig)
 
     if alert.ext_ip is None:
         alert.ext_ip = alert.src_ip
     if alert.src_ip is not None and len(alert.src_ip) > 6:
         # lets do a lookup for the src
         alert.geoip = GeoIP.lookup(alert.src_ip)
+
+    if irule == 31111:
+        url = alert.ssh_sig
+        hostname = alert.hostname
+        if url:
+            hostname = extractDomain(url)
+        if alert.geoip and alert.geoip.isp:
+            alert.title = f"Suspicious fetch of .js, {hostname} ISP: {alert.geoip.isp}"
+        else:
+            alert.title = f"Suspicious fetch of .js, {hostname}"
     # finally here we change the alert level
     if irule in LEVEL_REMAP_BY_RULE:
         alert.level = LEVEL_REMAP_BY_RULE[irule]

incident/rpc.py

@@ -77,15 +77,19 @@ def ossec_alert_creat_from_request(request):
                 elif od.level <= 3:
                     level = 8
                 metadata = od.toDict(graph="default")
+                # we reuse the ssh_sig because it is a text field to store urls
                 ssh_sig = metadata.get("ssh_sig", None)
                 if ssh_sig is not None and ssh_sig.startswith("http"):    
                     metadata.url = ssh_sig
+                    metadata.domain = ossec.extractDomain(metadata.url)
+                    metadata.path = ossec.extractUrlPath(metadata.url)
                     metadata.pop("ssh_sig")
                 if od.geoip:
                     metadata["country"] = od.geoip.country
                     metadata["city"] = od.geoip.city
                     metadata["province"] = od.geoip.state
                     metadata["isp"] = od.geoip.isp
+
                 am.Event.createFromDict(None, {
                     "hostname": od.hostname,
                     "description": od.title,

rest/__init__.py

@@ -1,4 +1,4 @@
 from .uberdict import UberDict  # noqa: F401
 from .settings_helper import settings  # noqa: F401
 
-__version__ = "4.2.32"
+__version__ = "4.2.34"

rest/models/base.py

@@ -828,6 +828,8 @@ class RestModel(object):
             request.member.auditLog(F"deleted {self.get_class_name(True)}:{self.pk}", "deleted", level=8)
 
     def auditLog(self, message, action="log", path=None, level=0, group=None, method=None):
+        if group is None and hasattr(self, "group"):
+            group = self.group
         PLOG = self.getModel("auditlog", "PersistentLog")
         component = self.get_class_name(True)
         PLOG.log(message=message, action=action, path=path, level=level, method=method, component=component, pkey=self.id, group=group)
@@ -880,9 +882,11 @@ class RestModel(object):
         return_response = not as_dict
         return GRAPH_HELPERS.restGet(request, self, return_httpresponse=return_response, **self.getGraph(graph))
 
-    def toDict(self, graph=None):
+    def toDict(self, graph=None, schema=None):
         RestModel._setupGraphHelpers()
-        return self.restGet(None, graph=graph, as_dict=True)
+        if schema is None:
+            return self.restGet(None, graph=graph, as_dict=True)
+        return GRAPH_HELPERS.restGet(None, self, return_httpresponse=False, **schema)
 
     def __str__(self):
         return f"<{self.get_class_name(True)}>"

rest/requestex.py

@@ -252,9 +252,6 @@ class RequestData(object):
     def log(self, include_headers=True):
         if not self.is_logged:
             self.is_logged = True
-            track = self.get("track", None)
-            cardnumber = self.get(["cardnumber", "pan"], None)
-            password = self.get("password", None)
             sanitized = UberDict.fromdict(self.toDict())
             if include_headers:
                 headers = {}