diff --git a/docker/nginx/entrypoint.sh b/docker/nginx/entrypoint.sh index 2b8591f6d..25cba44d6 100644 --- a/docker/nginx/entrypoint.sh +++ b/docker/nginx/entrypoint.sh @@ -46,9 +46,18 @@ if [ -n "${SERVER_NAME:-}" ]; then export SERVER_NAME fi +# The /collab/ location resolves its upstream at request time so nginx +# doesn't refuse to start when the (optional) collab service is absent. +# The resolver address is container-runtime-specific: Docker's embedded +# DNS is always 127.0.0.11, but podman/netavark's aardvark-dns listens on +# the network gateway instead. Read the real nameserver out of this +# container's own /etc/resolv.conf so both runtimes work. +DNS_RESOLVER=$(awk '/^nameserver/{print $2; exit}' /etc/resolv.conf) +export DNS_RESOLVER="${DNS_RESOLVER:-127.0.0.11}" + # envsubst will make a substitution on every $variable in a file, since the nginx file contains nginx variable like $host, we have to limit the substitution to this set # otherwise, each nginx variable will be replaced by an empty string -envsubst '${INTERFACE_HTTPS_PORT} ${IRIS_UPSTREAM_SERVER} ${IRIS_UPSTREAM_PORT} ${SERVER_NAME} ${KEY_FILENAME} ${CERT_FILENAME} ${IRIS_FRONTEND_SERVER} ${IRIS_FRONTEND_PORT}' < /etc/nginx/nginx.conf > /tmp/nginx.conf +envsubst '${INTERFACE_HTTPS_PORT} ${IRIS_UPSTREAM_SERVER} ${IRIS_UPSTREAM_PORT} ${SERVER_NAME} ${KEY_FILENAME} ${CERT_FILENAME} ${IRIS_FRONTEND_SERVER} ${IRIS_FRONTEND_PORT} ${DNS_RESOLVER}' < /etc/nginx/nginx.conf > /tmp/nginx.conf cp /tmp/nginx.conf /etc/nginx/nginx.conf rm /tmp/nginx.conf diff --git a/docker/nginx/nginx.conf b/docker/nginx/nginx.conf index 42e400927..b3351982c 100644 --- a/docker/nginx/nginx.conf +++ b/docker/nginx/nginx.conf @@ -155,13 +155,21 @@ http { } location /collab/ { - # Resolve at request time (Docker's embedded DNS) instead of at - # nginx startup: the collab service is a BV-only optional - # feature and isn't present in every compose stack (e.g. the - # upstream-derived dev/CI stack). A static proxy_pass hostname - # would make nginx refuse to start entirely when "collab" can't - # be resolved; this way only /collab/ requests fail if it's absent. - resolver 127.0.0.11 valid=30s; + # Resolve at request time (the container's own DNS resolver) + # instead of at nginx startup: the collab service is a BV-only + # optional feature and isn't present in every compose stack (e.g. + # the upstream-derived dev/CI stack). A static proxy_pass + # hostname would make nginx refuse to start entirely when + # "collab" can't be resolved; this way only /collab/ requests + # fail if it's absent. + # + # ${DNS_RESOLVER} is templated by entrypoint.sh from the + # container's /etc/resolv.conf. It is NOT hardcoded to Docker's + # embedded-DNS address (127.0.0.11) because that address doesn't + # exist under podman/netavark, where aardvark-dns listens on the + # network gateway instead — a hardcoded 127.0.0.11 here silently + # 502s every /collab/ request after a 30s resolver timeout. + resolver ${DNS_RESOLVER} valid=30s; set $collab_upstream collab; proxy_set_header Host $http_host; diff --git a/e2e/tests/administrator/case/ioc.spec.js b/e2e/tests/administrator/case/ioc.spec.js index 0db39df0f..70c13d0c0 100644 --- a/e2e/tests/administrator/case/ioc.spec.js +++ b/e2e/tests/administrator/case/ioc.spec.js @@ -13,14 +13,17 @@ test.beforeEach(async({ page }) => { test('should be able to update IOC', async ({ page }) => { const iocValue = `IOC value - ${crypto.randomUUID()}`; + const iocDescription = `IOC description - ${crypto.randomUUID()}`; await page.getByRole('button', { name: 'Add IOC' }).click(); await page.getByRole('button', { name: 'None' }).click(); await page.getByRole('listbox').getByRole('option', { name: 'AS', exact: true }).click(); await page.getByLabel('IOC Value *').fill(iocValue); + await page.locator('#ioc_description .ProseMirror').fill(iocDescription); await page.getByRole('button', { name: 'Save' }).click(); await page.getByRole('link', { name: iocValue }).click(); + await expect(page.locator('#ioc_description .ProseMirror')).toContainText(iocDescription); const newIocValue = `IOC value - ${crypto.randomUUID()}`; await page.getByLabel('IOC Value *').fill(newIocValue); await page.getByRole('button', { name: 'Update' }).click(); @@ -89,4 +92,4 @@ test('should be able to update IOC custom attribute', async ({ page, rest }) => partial_overwrite: false } }) -}); \ No newline at end of file +}); diff --git a/source/app/blueprints/access_controls.py b/source/app/blueprints/access_controls.py index 6bed54d62..d6b9befd6 100644 --- a/source/app/blueprints/access_controls.py +++ b/source/app/blueprints/access_controls.py @@ -413,9 +413,17 @@ def wrap(*args, **kwargs): return redirect(not_authenticated_redirection_url(request.full_path)) chan_id = args[0].get('channel') - if chan_id: + if not chan_id: + return _ac_return_access_denied(caseid=0) + + # Clients occasionally join a room before a case is selected + # (e.g. `case-null`), producing a non-numeric id. That's not an + # authorization bypass attempt, just a premature join - deny + # gracefully instead of raising and killing the socketio + # event-handler thread. + try: case_id = int(chan_id.replace('case-', '').split('-')[0]) - else: + except ValueError: return _ac_return_access_denied(caseid=0) access = ac_fast_check_user_has_case_access(iris_current_user.id, case_id, access_level) diff --git a/source/app/blueprints/pages/case/templates/case.html b/source/app/blueprints/pages/case/templates/case.html index 7a10c821f..aa13f5f87 100644 --- a/source/app/blueprints/pages/case/templates/case.html +++ b/source/app/blueprints/pages/case/templates/case.html @@ -4,7 +4,6 @@ - {% endblock stylesheets %} {% block content %} {% if current_user.is_authenticated %} diff --git a/source/app/blueprints/pages/case/templates/case_assets.html b/source/app/blueprints/pages/case/templates/case_assets.html index a18096bab..11581b1b5 100644 --- a/source/app/blueprints/pages/case/templates/case_assets.html +++ b/source/app/blueprints/pages/case/templates/case_assets.html @@ -1,7 +1,6 @@ {% extends "layouts/default_ext.html" %} {% block title %} Case Assets {% endblock title %} {% block stylesheets %} {% include 'includes/header_case.html' %} - {% endblock stylesheets %} {% block content %} {% include 'includes/navigation_ext.html' %} @@ -148,4 +147,4 @@
Upload assets list (CSV format)
-{% endblock javascripts %} \ No newline at end of file +{% endblock javascripts %} diff --git a/source/app/blueprints/pages/case/templates/case_notes_v2.html b/source/app/blueprints/pages/case/templates/case_notes_v2.html index 4d58ab289..5bf1c2811 100644 --- a/source/app/blueprints/pages/case/templates/case_notes_v2.html +++ b/source/app/blueprints/pages/case/templates/case_notes_v2.html @@ -1,7 +1,6 @@ {% extends "layouts/default_ext.html" %} {% block title %} Case notes {% endblock title %} {% block stylesheets %} {% include 'includes/header_case.html' %} - {% endblock stylesheets %} {% block content %} {% include 'includes/navigation_ext.html' %} @@ -88,7 +87,7 @@

- -
- - -
diff --git a/source/app/blueprints/pages/case/templates/modal_add_case_event.html b/source/app/blueprints/pages/case/templates/modal_add_case_event.html index 2a6d4fa21..b5b981b36 100644 --- a/source/app/blueprints/pages/case/templates/modal_add_case_event.html +++ b/source/app/blueprints/pages/case/templates/modal_add_case_event.html @@ -79,26 +79,7 @@

{% if event.event_id %} Event ID #{{ event.event_i
-
-
- - -
-
- -
-
-
-
{% if event.event_content %}{{ event.event_content }}{% endif %}
- -
- -
+
{% if event.event_content %}{{ event.event_content }}{% endif %}
@@ -326,4 +307,4 @@

{% if event.event_id %} Event ID #{{ event.event_i ]); $('#event_iocs').trigger('change'); -{% endif %} \ No newline at end of file +{% endif %} diff --git a/source/app/blueprints/pages/case/templates/modal_add_case_ioc.html b/source/app/blueprints/pages/case/templates/modal_add_case_ioc.html index 873e3a2f9..278ec1ec3 100644 --- a/source/app/blueprints/pages/case/templates/modal_add_case_ioc.html +++ b/source/app/blueprints/pages/case/templates/modal_add_case_ioc.html @@ -72,26 +72,7 @@

{% if ioc.ioc_id %}Edit IOC #{{ ioc.ioc_id }}{% els {% endif %}
-
-
- - -
-
- -
-
-
-
{% if ioc and ioc.ioc_description %}{{ ioc.ioc_description }}{% endif %}
- -
- -
+
{% if ioc and ioc.ioc_description %}{{ ioc.ioc_description }}{% endif %}
@@ -144,4 +125,4 @@

{% if ioc.ioc_id %}Edit IOC #{{ ioc.ioc_id }}{% els {% else %} $('#ioc_tlp_id').selectpicker('val', '2'); {% endif %} - \ No newline at end of file + diff --git a/source/app/blueprints/pages/case/templates/modal_add_case_rfile.html b/source/app/blueprints/pages/case/templates/modal_add_case_rfile.html index c345ced9d..ba4e65bd7 100644 --- a/source/app/blueprints/pages/case/templates/modal_add_case_rfile.html +++ b/source/app/blueprints/pages/case/templates/modal_add_case_rfile.html @@ -100,26 +100,7 @@

{% if rfile.id %}Edit evidence #{{rfile.id}}{% else
-
-
- - -
-
- -
-
-
-
{% if rfile %}{{ rfile.file_description }}{% endif %}
- -
- -
+
{% if rfile %}{{ rfile.file_description }}{% endif %}
@@ -142,4 +123,4 @@

{% if rfile.id %}Edit evidence #{{rfile.id}}{% else {% endif %}

-

\ No newline at end of file + diff --git a/source/app/blueprints/pages/case/templates/modal_add_case_task.html b/source/app/blueprints/pages/case/templates/modal_add_case_task.html index 053a879ad..d52b0a786 100644 --- a/source/app/blueprints/pages/case/templates/modal_add_case_task.html +++ b/source/app/blueprints/pages/case/templates/modal_add_case_task.html @@ -59,26 +59,7 @@

{% if task.id %} Task ID #{{ task.id }}{% else %}
-
-
- - -
-
- -
-
-
-
{% if task.task_description %}{{ task.task_description }}{% endif %}
- -
- -
+
{% if task.task_description %}{{ task.task_description }}{% endif %}
diff --git a/source/app/blueprints/pages/login/login_routes.py b/source/app/blueprints/pages/login/login_routes.py index 51353a6a1..9b85754a6 100644 --- a/source/app/blueprints/pages/login/login_routes.py +++ b/source/app/blueprints/pages/login/login_routes.py @@ -46,7 +46,7 @@ from app.datamgmt.manage.manage_users_db import create_user from app.datamgmt.manage.manage_users_db import update_user_groups from app.datamgmt.manage.manage_users_db import get_user -from app.forms import LoginForm, MFASetupForm +from app.forms import LoginForm, MFASetupForm, MFAVerifyForm from app.blueprints.iris_user import iris_current_user from app.iris_engine.utils.tracker import track_activity from app.datamgmt.manage.manage_groups_db import get_groups_list @@ -154,8 +154,7 @@ def login(): form = LoginForm(request.form) - # check if both http method is POST and form is valid on submit - if not form.is_submitted() and not form.validate(): + if not form.validate_on_submit(): return _render_template_login(form, None) # assign form data to variables @@ -406,20 +405,27 @@ def _clear_pre_mfa_state(preserve_lockout=False): session.pop("pending_mfa_secret", None) if not preserve_lockout: session.pop("mfa_fail_count", None) + session.pop("mfa_fail_user_id", None) session.pop("mfa_lockout_until", None) -def _mfa_is_locked_out(): +def _mfa_is_locked_out(user): + if session.get("mfa_fail_user_id") != user.id: + return False locked_until = session.get("mfa_lockout_until") if locked_until and locked_until > time.time(): return True if locked_until and locked_until <= time.time(): session.pop("mfa_lockout_until", None) + session.pop("mfa_fail_user_id", None) session["mfa_fail_count"] = 0 return False def _register_mfa_failure(user, reason): + if session.get("mfa_fail_user_id") != user.id: + session["mfa_fail_count"] = 0 + session["mfa_fail_user_id"] = user.id session["mfa_fail_count"] = session.get("mfa_fail_count", 0) + 1 track_activity( f"Failed MFA {reason} for user {user.user} " @@ -433,6 +439,8 @@ def _register_mfa_failure(user, reason): # the lockout timestamp so a fresh /login cannot wipe it. _clear_pre_mfa_state(preserve_lockout=True) session.pop("username", None) + return True + return False @app.route("/auth/mfa-setup", methods=["GET", "POST"]) @@ -449,13 +457,13 @@ def mfa_setup(): if user.mfa_setup_complete and user.mfa_secrets: return redirect(url_for("mfa_verify")) - if _mfa_is_locked_out(): + if _mfa_is_locked_out(user): flash("Too many attempts. Please try again later.", "danger") return redirect(url_for("login.login")) form = MFASetupForm() - if form.submit() and form.validate(): + if form.validate_on_submit(): token = form.token.data user_password = form.user_password.data @@ -469,7 +477,7 @@ def mfa_setup(): totp = pyotp.TOTP(mfa_secret) - if totp.verify(token): + if totp.verify(str(token).strip(), valid_window=1): has_valid_password = False if is_authentication_ldap() is True: if validate_ldap_login( @@ -483,7 +491,10 @@ def mfa_setup(): has_valid_password = True if not has_valid_password: - _register_mfa_failure(user, "setup (invalid password)") + locked_out = _register_mfa_failure(user, "setup (invalid password)") + if locked_out: + flash("Too many attempts. Please try again later.", "danger") + return redirect(url_for("login.login")) flash("Invalid password. Please try again.", "danger") return render_template("mfa_setup.html", form=form) @@ -501,7 +512,10 @@ def mfa_setup(): session["mfa_verified_for_user_id"] = user.id _clear_pre_mfa_state() return wrap_login_user(user) - _register_mfa_failure(user, "setup (invalid token)") + locked_out = _register_mfa_failure(user, "setup (invalid token)") + if locked_out: + flash("Too many attempts. Please try again later.", "danger") + return redirect(url_for("login.login")) flash("Invalid token or password. Please try again.", "danger") # Generate a fresh secret on every GET and stash it in the session. The @@ -536,21 +550,16 @@ def mfa_verify(): ) return redirect(url_for("mfa_setup")) - if _mfa_is_locked_out(): + if _mfa_is_locked_out(user): flash("Too many attempts. Please try again later.", "danger") return redirect(url_for("login.login")) - form = MFASetupForm() - form.user_password.data = "not required for verification" + form = MFAVerifyForm() - if form.submit() and form.validate(): + if form.validate_on_submit(): token = form.token.data - if not token: - flash("Token is required.", "danger") - return render_template("mfa_verify.html", form=form) - totp = pyotp.TOTP(user.mfa_secrets) - if totp.verify(token): + if totp.verify(str(token).strip(), valid_window=1): track_activity( f"MFA verification successful for user {user.user}", ctx_less=True, display_in_ui=False, @@ -561,7 +570,10 @@ def mfa_verify(): session["mfa_verified_for_user_id"] = user.id _clear_pre_mfa_state() return wrap_login_user(user) - _register_mfa_failure(user, "verification (invalid token)") + locked_out = _register_mfa_failure(user, "verification (invalid token)") + if locked_out: + flash("Too many attempts. Please try again later.", "danger") + return redirect(url_for("login.login")) flash("Invalid token. Please try again.", "danger") return render_template("mfa_verify.html", form=form) diff --git a/source/app/blueprints/pages/login/templates/_auth_messages.html b/source/app/blueprints/pages/login/templates/_auth_messages.html new file mode 100644 index 000000000..8c895dd0e --- /dev/null +++ b/source/app/blueprints/pages/login/templates/_auth_messages.html @@ -0,0 +1,17 @@ +{% with messages = get_flashed_messages(with_categories=true) %} + {% for category, message in messages %} + + {% endfor %} +{% endwith %} + +{% if form and form.errors %} + +{% endif %} diff --git a/source/app/blueprints/pages/login/templates/login.html b/source/app/blueprints/pages/login/templates/login.html index 586a669e2..27d8c873a 100644 --- a/source/app/blueprints/pages/login/templates/login.html +++ b/source/app/blueprints/pages/login/templates/login.html @@ -22,6 +22,8 @@

{{ organisation_name }}