Merge pull request #76 from adulau/master (1f5aefe2) · Commits · Zhang Yushan / cve-search

web/index.py

+30 −63

Original line number	Diff line number	Diff line
		@@ -86,6 +86,7 @@ def getBrowseList(vendor):
		def getWhitelist():
		collection = db.mgmt_whitelist
		whitelist = collection.find()
		for x in whitelist:x.pop("_id")
		return whitelist


		@@ -141,6 +142,7 @@ def seen_mark(cve):
		def getBlacklist():
		collection = db.mgmt_blacklist
		blacklist = collection.find()
		for x in blacklist:x.pop("_id")
		return blacklist


		@@ -320,9 +322,9 @@ def getFilterSettingsFromPost(r):
		'timeTypeSelect': timeTypeSelect, 'cvssSelect': cvssSelect,
		'cvss': cvss, 'rejectedSelect': rejectedSelect, "hideSeen": hideSeen}
		# retrieving data
		skip = r * 50
		cve = filter_logic(blacklist, whitelist, unlisted, timeSelect, startDate, endDate,
		timeTypeSelect, cvssSelect, cvss, rejectedSelect, hideSeen, pageLength, skip)
		timeTypeSelect, cvssSelect, cvss, rejectedSelect, hideSeen, pageLength, r)

		return(settings,cve)

		@login_manager.user_loader
		@@ -518,7 +520,7 @@ def admin():
		if not current_user.is_authenticated():
		return render_template('login.html', status=status)
		else:
		return render_template('admin.html', status=status)
		return render_template('admin.html', status=status, stats=adminStats())
		else:
		person = User.get("_dummy_")
		login_user(person)
		@@ -581,51 +583,51 @@ def whitelistView():
		return render_template('list.html', rules=whitelist, status=status, listType="Whitelist")


		@app.route('/admin/whitelist/add', methods=['POST'])
		@app.route('/admin/addToList')
		@login_required
		def whitelistAdd():
		cpe = request.form.get('cpe')
		cpeType = request.form.get('type')
		if addCPEToList(cpe, "whitelist", cpeType):
		status = ["added", "success"]
		else:
		status = ["already_exists", "info"]
		whitelist = getWhitelist()
		return render_template('list.html', rules=whitelist, status=status, listType="Whitelist")
		def listAdd():
		cpe = request.args.get('cpe')
		cpeType = request.args.get('type')
		lst = request.args.get('list')
		status = ["added", "success"] if addCPEToList(cpe, lst, cpeType) else ["already_exists", "info"]
		returnList = list(getWhitelist()) if lst=="whitelist" else list(getBlacklist())
		return jsonify({"status":status, "rules":returnList, "listType":lst.title()})


		@app.route('/admin/whitelist/remove', methods=['POST'])
		@app.route('/admin/removeFromList')
		@login_required
		def whitelistRemove():
		cpe = request.form.get('cpe')
		def listRemove():
		cpe = request.args.get('cpe', type=str)
		cpe = urllib.parse.quote_plus(cpe).lower()
		cpe = cpe.replace("%3a", ":")
		cpe = cpe.replace("%2f", "/")
		lst = request.args.get('list', type=str)
		if cpe:
		if (removeWhitelist(cpe) > 0):
		status = ["removed", "success"]
		else:
		status = ["already_removed", "info"]
		result=removeWhitelist(cpe) if lst=="whitelist" else removeBlacklist(cpe)
		status = ["removed", "success"] if (result > 0) else ["already_removed", "info"]
		else:
		status = ["invalid_url", "error"]
		whitelist = getWhitelist()
		return render_template('list.html', rules=whitelist, status=status, listType="Whitelist")
		returnList = list(getWhitelist()) if lst=="whitelist" else list(getBlacklist())
		return jsonify({"status":status, "rules":returnList, "listType":lst.title()})


		@app.route('/admin/whitelist/edit', methods=['POST'])
		@login_required
		def whitelistEdit():
		oldCPE = request.form.get('oldCPE')
		newCPE = request.form.get('cpe')
		oldCPE = request.args.get('oldCPE')
		newCPE = request.args.get('cpe')
		lst = request.args.get('list')
		if oldCPE and newCPE:
		if (updateWhitelist(oldCPE, newCPE)):
		result = updateWhitelist(oldCPE, newCPE) if lst=="whitelist" else updateBlacklist(oldCPE, newCPE)
		if (result):
		status = ["updated", "success"]
		else:
		status = ["update_failed", "error"]
		else:
		status = ["invalid_url", "error"]
		whitelist = getWhitelist()
		return render_template('list.html', rules=whitelist, status=status, listType="Whitelist")
		returnList = list(getWhitelist()) if lst=="whitelist" else list(getBlacklist())
		return jsonify({"rules":returnList, "status":status, "listType":lst})



		@app.route('/admin/blacklist/import', methods=['POST'])
		@@ -673,41 +675,6 @@ def blacklistView():
		status = ["default", "none"]
		return render_template('list.html', rules=blacklist, status=status, listType="Blacklist")


		@app.route('/admin/blacklist/add', methods=['POST'])
		@login_required
		def blacklistAdd():
		cpe = request.form.get('cpe')
		cpeType = request.form.get('type')
		if cpe:
		if addCPEToList(cpe, "blacklist", cpeType):
		status = ["added", "success"]
		else:
		status = ["already_exists", "info"]
		else:
		status = ["invalid_url", "error"]
		blacklist = getBlacklist()
		return render_template('list.html', rules=blacklist, status=status, listType="Blacklist")


		@app.route('/admin/blacklist/remove', methods=['POST'])
		@login_required
		def blacklistRemove():
		cpe = request.form.get('cpe')
		cpe = urllib.parse.quote_plus(cpe).lower()
		cpe = cpe.replace("%3a", ":")
		cpe = cpe.replace("%2f", "/")
		if cpe:
		if (removeBlacklist(cpe) > 0):
		status = ["removed", "success"]
		else:
		status = ["already_removed", "info"]
		else:
		status = ["invalid_url", "error"]
		blacklist = getBlacklist()
		return render_template('list.html', rules=blacklist, status=status, listType="Blacklist")


		@app.route('/admin/blacklist/edit', methods=['POST'])
		@login_required
		def blacklistEdit():
		@@ -816,7 +783,7 @@ def login_check():
		try:
		if person and pbkdf2_sha256.verify(password, person.password):
		login_user(person)
		return render_template('admin.html', status=["logged_in", "success"])
		return render_template('admin.html', status=["logged_in", "success"], stats=adminStats())
		else:
		return render_template('login.html', status=["wrong_combination", "warning"])
		except:

web/templates/list.html

+100 −63

Original line number	Diff line number	Diff line
		@@ -8,10 +8,8 @@
		<script type="text/javascript">
		var editedCPE
		function addItem(cpetype) {
		var CPE
		var commentArray
		var keyword
		var comments = ""
		var CPE, commentArray, keyword;
		var comments = "";
		if(cpetype == "cpe"){
		CPE = document.getElementById("cpeid").value.trim();
		commentArray = document.getElementById("cpecomments").value.trim();
		@@ -29,15 +27,100 @@
		CPE = CPE+comments;
		if(editedCPE){
		var url ="/admin/{{ listType\|lower }}/edit";
		postURL(url, CPE, cpetype);
		}else{
		var url ="/admin/{{ listType\|lower }}/add";
		$.getJSON('/admin/addToList', {
		list:'{{ listType\|lower }}', cpe:CPE, type:cpetype
		}, function(data) {
		showStatus(data);
		fillTable(data);
		});
		}
		postURL(url, CPE, cpetype);
		}
		function showStatus(data){
		$("#status").removeClass();
		$("#status_icon").removeClass();
		if(data['status'][1] =='success'){
		$("#status").addClass("alert alert-success");
		$("#status_icon").addClass("glyphicon glyphicon-ok-sign");
		}else if (data['status'][1] =='info'){
		$("#status").addClass("alert alert-info");
		$("#status_icon").addClass("glyphicon glyphicon-info-sign");
		}else if (data['status'][1] =='warning'){
		$("#status").addClass("alert alert-warning");
		$("#status_icon").addClass("glyphicon glyphicon-warning-sign");
		}else if (data['status'][1] =='error'){
		$("#status").addClass("alert alert-danger");
		$("#status_icon").addClass("glyphicon glyphicon-remove-sign");
		}
		$("#status_message").empty();
		if(data['status'][0] =='added'){
		$("#status_message").append("Rule added to the "+data["listType"]);
		}else if(data['status'][0] == 'removed'){
		$("#status_message").append("Rule removed from the "+data["listType"]);
		}else if(data['status'][0] == 'updated'){
		$("#status_message").append("The rule was updated");
		}else if(data['status'][0] == 'update_failed'){
		$("#status_message").append("Failed to update the rule in the "+data["listType"]);
		}else if(data['status'][0] == 'already_exists'){
		$("#status_message").append("This rule or a more global rule already exists in the "+data["listType"]);
		}else if(data['status'][0] == 'already_removed'){
		$("#status_message").append("Rule was already removed from the "+data["listType"]);
		}else if(data['status'][0] == 'uinvalid_url'){
		$("#status_message").append("Invalid URL!");
		}
		$("#status").removeTemporaryClass("hidden", 3000);
		}
		function fillTable(data){
		var rules=data['rules'];
		$("#cpes > tbody > tr").remove();
		$("#keywords > tbody > tr").remove();
		var line = "";
		for (i=0;i<rules.length;i++){
		//First td
		line += "<tr><td><a href='javascript:remove(\""+rules[i]['id']+"\")'><span class='glyphicon glyphicon-remove'></span></a></td>";
		//Second td
		if('comments' in rules[i]){
		line += "<td><a href='javascript:editCPE('"+rules[i]['id']+"',"+rules[i]['comments']+")'><span class='glyphicon glyphicon-edit'></span></a></td>";
		}else{
		line += "<td><a href='javascript:editCPE('"+rules[i]['id']+"',[])'><span class='glyphicon glyphicon-edit'></span></a></td>";
		}
		//Third td
		line += "<td>"+rules[i]['id']+"</td>";
		//Possible fourth td
		if(rules[i]['type']!='cpe'){
		if(rules[i]['type'] == 'targethardware'){
		line += "<td>Target Hardware</td>";
		}else if (rules[i]['type'] == 'targetsoftware'){
		line += "<td>Target Software</td>";
		}
		}
		//last td
		line += "<td><ul>";
		if('comments' in rules[i]){
		for (j=0;j<rules[i]['comments'].length;j++){
		line += "<li>"+rules[i]['comments'][j]+"</li>";
		}
		}
		line += "</ul></td></tr>";
		if(rules[i]['type']=='cpe'){
		$("#cpes > tbody").append(line);
		}else{
		$("#keywords > tbody").append(line);
		}
		line="";
		}
		}

		function remove(item){
		if(confirm("Are you sure you want to remove this rule?")){
		var url = "/admin/{{ listType\|lower }}/remove";
		postURL(url,item);
		$.getJSON('/admin/removeFromList', {
		list:'{{ listType\|lower }}',
		cpe:item
		}, function(data) {
		showStatus(data);
		fillTable(data);
		});
		}
		}
		function postURL(url, cpe, cpetype) {
		@@ -109,43 +192,9 @@
		</ol>
		<!-- add items -->
		<!-- Status -->
		<div>
		<!-- type -->
		{% if status[1] == 'success' %}
		<div class="alert alert-success">
		<span class="glyphicon glyphicon-ok-sign"></span>
		{% elif status[1] == 'info' %}
		<div class="alert alert-info">
		<span class="glyphicon glyphicon-info-sign"></span>
		{% elif status[1] == 'warning' %}
		<div class="alert alert-warning">
		<span class="glyphicon glyphicon-warning-sign"></span>
		{% elif status[1] == 'error' %}
		<div class="alert alert-danger">
		<span class="glyphicon glyphicon-remove-sign"></span>
		{% else %}
		<div>
		{% endif %}
		<!-- content -->
		{% if (status[0] == 'added') %}
		Rule added to the {{ listType }}
		{% elif status[0] == 'removed' %}
		Rule removed from the {{ listType }}
		{% elif (status[0] == 'updated') %}
		The rule was updated
		{% elif (status[0] == 'update_failed') %}
		Failed to update the rule in the {{ listType }}
		{% elif (status[0] == 'already_exists') %}
		This rule or a more global rule already exists in the {{ listType }}
		{% elif (status[0] == 'already_removed') %}
		Rule was already removed from the {{ listType }}.
		{% elif (status[0] == 'invalid_url') %}
		Invalid URL!
		{% endif %}
		{% if (status[0] != 'default') %}
		<br /><br /><a href="/admin/{{listType\|lower}}/view"><span class="glyphicon glyphicon-remove"></span> close</a>
		{% endif %}
		</div>
		<div id="status" class="hidden">
		<span id="status_icon"></span>
		<div id="status_message"></div>
		</div>
		<!-- Add new rule -->
		<div class="well well-small">
		@@ -180,17 +229,12 @@
		<tr>
		<td>
		<b>CPE Rules</b>
		<table class="table table-hover table-striped table-condensed">
		<table id="cpes" class="table table-hover table-striped table-condensed">
		<thead><tr class="warning"><td></td><td></td><td>Rule</td><td>Comments</td></tr></thead>
		<tbody>
		<tr class="warning">
		<td></td>
		<td></td>
		<td>Rule</td>
		<td>Comments</td>
		</tr>
		{% for ruleID in rulesList if ruleID['type']=='cpe' %}
		<tr>
		<td><a href="javascript:remove('{{ruleID['id']\|htmlEncode}}')"><span class="glyphicon glyphicon-remove"></span></a></td>
		<td><a href="javascript:remove('{{ruleID['id']}}')"><span class="glyphicon glyphicon-remove"></span></a></td>
		{% if ruleID['comments'] is defined %}
		<td><a href='javascript:editCPE("{{ruleID["id"]\|htmlEncode}}",{{ruleID["comments"]}})'><span class="glyphicon glyphicon-edit"></span></a></td>
		{% else %}
		@@ -211,18 +255,12 @@
		</td>
		<td>
		<b>Keywords</b>
		<table class="table table-hover table-striped table-condensed">
		<table id="keywords" class="table table-hover table-striped table-condensed">
		<thead><tr class="warning"><td></td><td></td><td>Rule</td><td>Keyword</td><td>Comments</td></tr></thead>
		<tbody>
		<tr class="warning">
		<td></td>
		<td></td>
		<td>Rule</td>
		<td>Keyword</td>
		<td>Comments</td>
		</tr>
		{% for ruleID in rulesList if ruleID['type']!='cpe' %}
		<tr>
		<td><a href="javascript:remove('{{ruleID['id']\|htmlEncode}}')"><span class="glyphicon glyphicon-remove"></span></a></td>
		<td><a href="javascript:remove('{{ruleID['id']}}')"><span class="glyphicon glyphicon-remove"></span></a></td>
		{% if ruleID['comments'] is defined %}
		<td><a href='javascript:editCPE("{{ruleID["id"]\|htmlEncode}}",{{ruleID["comments"]}})'><span class="glyphicon glyphicon-edit"></span></a></td>
		{% else %}
		@@ -250,7 +288,6 @@
		</td>
		</tr>
		</table>

		<a href="#" class="back-to-top">Back to Top</a>
		</div>
		<!-- end content -->

Admin message