django-restit 4.2.33__tar.gz → 4.2.34__tar.gz

{django_restit-4.2.33 → django_restit-4.2.34}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: django-restit
-Version: 4.2.33
+Version: 4.2.34
 Summary: A Rest Framework for DJANGO
 License: MIT
 Author: Ian Starnes

{django_restit-4.2.33 → django_restit-4.2.34}/account/models/member.py

@@ -683,6 +683,7 @@ class Member(User, RestModel, MetaDataModel):
             if Member.objects.filter(auth_code=code).count() == 0:
                 self.auth_code = code
                 self.auth_code_expires = datetime.now() + timedelta(seconds=expires)
+                self.auditLog(f"auth_code generated '{code}'", "auth_code", level=21)
                 self.save()
                 return self.auth_code
         return None

{django_restit-4.2.33 → django_restit-4.2.34}/account/rpc/auth.py

@@ -242,7 +242,7 @@ def is_member_logged_in(request):
 
 
 @rd.urlPOST('invite/validate')
-@rd.never_cache
+@rd.requires_params(["username"])
 def member_invite_confirm(request):
     username = request.DATA.get('username', None)
     auth_code = request.DATA.get(["auth_token", "invite_token"], None)
@@ -256,7 +256,7 @@ def member_invite_confirm(request):
 
 
 @rd.urlPOST('mfa/request_code')
-@rd.never_cache
+@rd.requires_params(["username"])
 def member_request_code(request):
     member, resp = get_member_from_request(request)
     if resp is not None:

{django_restit-4.2.33 → django_restit-4.2.34}/account/rpc/member.py

@@ -18,8 +18,8 @@ def member_me_action(request):
         return restPermissionDenied(request, "not authenticated")
     if request.method == "GET":
         # request.session['ws4redis:memberof'] = request.member.getGroupUUIDs()
-        from rest import helpers as rh
-        rh.debug("user_platform", request.DATA.getUserAgentPlatform())
+        # from rest import helpers as rh
+        # rh.debug("user_platform", request.DATA.getUserAgentPlatform())
         return request.member.on_rest_get(request)
     elif request.method == "POST":
         return request.member.on_rest_post(request)

{django_restit-4.2.33 → django_restit-4.2.34}/incident/models/event.py

@@ -46,7 +46,7 @@ class Event(JSONMetaData, rm.RestModel):
     class RestMeta:
         POST_SAVE_FIELDS = ["level", "catagory"]
         SEARCH_FIELDS = ["description", "hostname"]
-        VIEW_PERMS = ["view_incidents"]
+        VIEW_PERMS = ["view_incidents", "view_logs"]
         CREATE_PERMS = None  # allow anyone to create an event
         GRAPHS = {
             "default": {

{django_restit-4.2.33 → django_restit-4.2.34}/incident/models/incident.py

@@ -168,6 +168,9 @@ class Incident(models.Model, rm.RestModel, rm.MetaDataModel):
                 self.triggerTask()
             elif self.rule.action.startswith("group:"):
                 self.triggerGroup()
+            elif self.rule.action == "resolved":
+                self.state = INCIDENT_STATE_RESOLVED
+                self.save()
             elif self.rule.action.startswith("firewall_block"):
                 if settings.FIREWALL_GLOBAL_BLOCK:
                     Task.Publish("incident", "firewall_block", 

{django_restit-4.2.33 → django_restit-4.2.34}/incident/parsers/ossec.py

@@ -22,6 +22,27 @@ def removeNonAscii(input_str):
     return ''.join(char for char in cleaned_str if 32 <= ord(char) < 128)
 
 
+def extractURL(text):
+    match = re.search(r"GET\s+(https?://[^\s]+)\s+HTTP/\d\.\d", text)
+    if match:
+        return match.group(1)
+    return None
+
+
+def extractDomain(text):
+    match = re.search(r"https?://([^/:]+)", text)
+    if match:
+        return match.group(1)
+    return None
+
+
+def extractUrlPath(text):
+    match = re.search(r"https?://[^/]+(/[^?]*)", text)
+    if match:
+        return match.group(1)
+    return None
+
+
 def parseAlert(request, data):
     # helpers.log_print(data)
     try:
@@ -145,15 +166,25 @@ def parseAlert(request, data):
         if m and m.groups():
             alert.src_ip = m.group(1)
     elif "web,accesslog," in data.text and "https:" in data.text:
-        p = data.text.find("https:")
-        url = data.text[p:]
-        alert.ssh_sig = url[p:url.find(' ')]
+        alert.ssh_sig = extractURL(data.text)
+        if alert.ssh_sig:
+            alert.hostname = extractDomain(alert.ssh_sig)
 
     if alert.ext_ip is None:
         alert.ext_ip = alert.src_ip
     if alert.src_ip is not None and len(alert.src_ip) > 6:
         # lets do a lookup for the src
         alert.geoip = GeoIP.lookup(alert.src_ip)
+
+    if irule == 31111:
+        url = alert.ssh_sig
+        hostname = alert.hostname
+        if url:
+            hostname = extractDomain(url)
+        if alert.geoip and alert.geoip.isp:
+            alert.title = f"Suspicious fetch of .js, {hostname} ISP: {alert.geoip.isp}"
+        else:
+            alert.title = f"Suspicious fetch of .js, {hostname}"
     # finally here we change the alert level
     if irule in LEVEL_REMAP_BY_RULE:
         alert.level = LEVEL_REMAP_BY_RULE[irule]

{django_restit-4.2.33 → django_restit-4.2.34}/incident/rpc.py

@@ -77,15 +77,19 @@ def ossec_alert_creat_from_request(request):
                 elif od.level <= 3:
                     level = 8
                 metadata = od.toDict(graph="default")
+                # we reuse the ssh_sig because it is a text field to store urls
                 ssh_sig = metadata.get("ssh_sig", None)
                 if ssh_sig is not None and ssh_sig.startswith("http"):    
                     metadata.url = ssh_sig
+                    metadata.domain = ossec.extractDomain(metadata.url)
+                    metadata.path = ossec.extractUrlPath(metadata.url)
                     metadata.pop("ssh_sig")
                 if od.geoip:
                     metadata["country"] = od.geoip.country
                     metadata["city"] = od.geoip.city
                     metadata["province"] = od.geoip.state
                     metadata["isp"] = od.geoip.isp
+
                 am.Event.createFromDict(None, {
                     "hostname": od.hostname,
                     "description": od.title,

{django_restit-4.2.33 → django_restit-4.2.34}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "django-restit"
-version = "4.2.33"
+version = "4.2.34"
 description = "A Rest Framework for DJANGO"
 authors = ["Ian Starnes <ians@311labs.com>"]
 license = "MIT"

{django_restit-4.2.33 → django_restit-4.2.34}/rest/__init__.py

@@ -1,4 +1,4 @@
 from .uberdict import UberDict  # noqa: F401
 from .settings_helper import settings  # noqa: F401
 
-__version__ = "4.2.33"
+__version__ = "4.2.34"

{django_restit-4.2.33 → django_restit-4.2.34}/rest/models/base.py

@@ -828,6 +828,8 @@ class RestModel(object):
             request.member.auditLog(F"deleted {self.get_class_name(True)}:{self.pk}", "deleted", level=8)
 
     def auditLog(self, message, action="log", path=None, level=0, group=None, method=None):
+        if group is None and hasattr(self, "group"):
+            group = self.group
         PLOG = self.getModel("auditlog", "PersistentLog")
         component = self.get_class_name(True)
         PLOG.log(message=message, action=action, path=path, level=level, method=method, component=component, pkey=self.id, group=group)