Skip to content

Commit 4bd6934

Browse files
valentijnscholtenvalentijnscholten
committed
allow toggling of CVSS fields
1 parent f1eb700 commit 4bd6934

File tree

4 files changed

+89
-24
lines changed

4 files changed

+89
-24
lines changed

‎dojo/db_migrations/0234_finding_cvssv4_finding_cvssv4_score.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,4 +32,14 @@ class Migration(migrations.Migration):
3232
name='cvssv4_score',
3333
field=models.FloatField(blank=True, help_text='Numerical CVSS4 score for the vulnerability. If the vector is given without a score, the score is calcaulated while saving the finding. The value must be between 0-10.', null=True, validators=[django.core.validators.MinValueValidator(0.0), django.core.validators.MaxValueValidator(10.0)], verbose_name='CVSSv4 Score'),
3434
),
35+
migrations.AddField(
36+
model_name='system_settings',
37+
name='enable_cvss3_display',
38+
field=models.BooleanField(default=True, help_text='With this setting turned off, CVSS3 fields will be hidden in the user interface.', verbose_name='Enable CVSS3 Display'),
39+
),
40+
migrations.AddField(
41+
model_name='system_settings',
42+
name='enable_cvss4_display',
43+
field=models.BooleanField(default=True, help_text='With this setting turned off, CVSS4 fields will be hidden in the user interface.', verbose_name='Enable CVSS4 Display'),
44+
),
3545
]

‎dojo/forms.py

Lines changed: 62 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1148,10 +1148,10 @@ class AddFindingForm(forms.ModelForm):
11481148
widget=forms.TextInput(attrs={"class": "datepicker", "autocomplete": "off"}))
11491149
cwe = forms.IntegerField(required=False)
11501150
vulnerability_ids = vulnerability_ids_field
1151-
cvssv3 = forms.CharField(max_length=117, required=False, widget=forms.TextInput(attrs={"class": "cvsscalculator", "data-toggle": "dropdown", "aria-haspopup": "true", "aria-expanded": "false"}))
1152-
cvssv3_score = forms.FloatField(required=False, max_value=10.0, min_value=0.0)
1153-
cvssv4 = forms.CharField(max_length=255, required=False)
1154-
cvssv4_score = forms.FloatField(required=False, max_value=10.0, min_value=0.0)
1151+
cvssv3 = forms.CharField(label="CVSS3 Vector", max_length=117, required=False, widget=forms.TextInput(attrs={"class": "cvsscalculator", "data-toggle": "dropdown", "aria-haspopup": "true", "aria-expanded": "false"}))
1152+
cvssv3_score = forms.FloatField(label="CVSS3 Score", required=False, max_value=10.0, min_value=0.0)
1153+
cvssv4 = forms.CharField(label="CVSS4 Vector", max_length=255, required=False)
1154+
cvssv4_score = forms.FloatField(label="CVSS4 Score", required=False, max_value=10.0, min_value=0.0)
11551155
description = forms.CharField(widget=forms.Textarea)
11561156
severity = forms.ChoiceField(
11571157
choices=SEVERITY_CHOICES,
@@ -1200,6 +1200,9 @@ def __init__(self, *args, **kwargs):
12001200

12011201
self.endpoints_to_add_list = []
12021202

1203+
# Hide CVSS fields based on system settings
1204+
hide_cvss_fields_if_disabled(self)
1205+
12031206
def clean(self):
12041207
cleaned_data = super().clean()
12051208
if ((cleaned_data["active"] or cleaned_data["verified"]) and cleaned_data["duplicate"]):
@@ -1242,10 +1245,10 @@ class AdHocFindingForm(forms.ModelForm):
12421245
required=False,
12431246
disabled=True)
12441247

1245-
cvssv3 = forms.CharField(max_length=117, required=False, widget=forms.TextInput(attrs={"class": "cvsscalculator", "data-toggle": "dropdown", "aria-haspopup": "true", "aria-expanded": "false"}))
1246-
cvssv3_score = forms.FloatField(required=False, max_value=10.0, min_value=0.0)
1247-
cvssv4 = forms.CharField(max_length=255, required=False)
1248-
cvssv4_score = forms.FloatField(required=False, max_value=10.0, min_value=0.0)
1248+
cvssv3 = forms.CharField(label="CVSS3 Vector", max_length=117, required=False, widget=forms.TextInput(attrs={"class": "cvsscalculator", "data-toggle": "dropdown", "aria-haspopup": "true", "aria-expanded": "false"}))
1249+
cvssv3_score = forms.FloatField(label="CVSS3 Score", required=False, max_value=10.0, min_value=0.0)
1250+
cvssv4 = forms.CharField(label="CVSS4 Vector", max_length=255, required=False)
1251+
cvssv4_score = forms.FloatField(label="CVSS4 Score", required=False, max_value=10.0, min_value=0.0)
12491252
description = forms.CharField(widget=forms.Textarea)
12501253
severity = forms.ChoiceField(
12511254
choices=SEVERITY_CHOICES,
@@ -1294,6 +1297,9 @@ def __init__(self, *args, **kwargs):
12941297

12951298
self.endpoints_to_add_list = []
12961299

1300+
# Hide CVSS fields based on system settings
1301+
hide_cvss_fields_if_disabled(self)
1302+
12971303
def clean(self):
12981304
cleaned_data = super().clean()
12991305
if ((cleaned_data["active"] or cleaned_data["verified"]) and cleaned_data["duplicate"]):
@@ -1334,10 +1340,10 @@ class PromoteFindingForm(forms.ModelForm):
13341340
required=False,
13351341
disabled=True)
13361342

1337-
cvssv3 = forms.CharField(max_length=117, required=False, widget=forms.TextInput(attrs={"class": "cvsscalculator", "data-toggle": "dropdown", "aria-haspopup": "true", "aria-expanded": "false"}))
1338-
cvssv3_score = forms.FloatField(required=False, max_value=10.0, min_value=0.0)
1339-
cvssv4 = forms.CharField(max_length=255, required=False)
1340-
cvssv4_score = forms.FloatField(required=False, max_value=10.0, min_value=0.0)
1343+
cvssv3 = forms.CharField(label="CVSS3 Vector", max_length=117, required=False, widget=forms.TextInput(attrs={"class": "cvsscalculator", "data-toggle": "dropdown", "aria-haspopup": "true", "aria-expanded": "false"}))
1344+
cvssv3_score = forms.FloatField(label="CVSS3 Score", required=False, max_value=10.0, min_value=0.0)
1345+
cvssv4 = forms.CharField(label="CVSS4 Vector", max_length=255, required=False)
1346+
cvssv4_score = forms.FloatField(label="CVSS4 Score", required=False, max_value=10.0, min_value=0.0)
13411347
description = forms.CharField(widget=forms.Textarea)
13421348
severity = forms.ChoiceField(
13431349
choices=SEVERITY_CHOICES,
@@ -1371,6 +1377,9 @@ def __init__(self, *args, **kwargs):
13711377

13721378
self.endpoints_to_add_list = []
13731379

1380+
# Hide CVSS fields based on system settings
1381+
hide_cvss_fields_if_disabled(self)
1382+
13741383
def clean(self):
13751384
cleaned_data = super().clean()
13761385

@@ -1405,10 +1414,10 @@ class FindingForm(forms.ModelForm):
14051414
required=False,
14061415
disabled=True)
14071416

1408-
cvssv3 = forms.CharField(max_length=117, required=False, widget=forms.TextInput(attrs={"class": "cvsscalculator", "data-toggle": "dropdown", "aria-haspopup": "true", "aria-expanded": "false"}))
1409-
cvssv3_score = forms.FloatField(required=False, max_value=10.0, min_value=0.0)
1410-
cvssv4 = forms.CharField(max_length=255, required=False)
1411-
cvssv4_score = forms.FloatField(required=False, max_value=10.0, min_value=0.0)
1417+
cvssv3 = forms.CharField(label="CVSS3 Vector", max_length=117, required=False, widget=forms.TextInput(attrs={"class": "cvsscalculator", "data-toggle": "dropdown", "aria-haspopup": "true", "aria-expanded": "false"}))
1418+
cvssv3_score = forms.FloatField(label="CVSS3 Score", required=False, max_value=10.0, min_value=0.0)
1419+
cvssv4 = forms.CharField(label="CVSS4 Vector", max_length=255, required=False)
1420+
cvssv4_score = forms.FloatField(label="CVSS4 Score", required=False, max_value=10.0, min_value=0.0)
14121421

14131422
description = forms.CharField(widget=forms.Textarea)
14141423
severity = forms.ChoiceField(
@@ -1497,6 +1506,9 @@ def __init__(self, *args, **kwargs):
14971506

14981507
self.endpoints_to_add_list = []
14991508

1509+
# Hide CVSS fields based on system settings
1510+
hide_cvss_fields_if_disabled(self)
1511+
15001512
def clean(self):
15011513
cleaned_data = super().clean()
15021514

@@ -1585,6 +1597,9 @@ def __init__(self, template=None, *args, **kwargs):
15851597
if template:
15861598
self.template.vulnerability_ids = "\n".join(template.vulnerability_ids)
15871599

1600+
# Hide CVSS fields based on system settings
1601+
hide_cvss_fields_if_disabled(self)
1602+
15881603
def clean(self):
15891604
cleaned_data = super().clean()
15901605

@@ -1613,7 +1628,7 @@ class FindingTemplateForm(forms.ModelForm):
16131628

16141629
cwe = forms.IntegerField(label="CWE", required=False)
16151630
vulnerability_ids = vulnerability_ids_field
1616-
cvssv3 = forms.CharField(max_length=117, required=False, widget=forms.TextInput(attrs={"class": "btn btn-secondary dropdown-toggle", "data-toggle": "dropdown", "aria-haspopup": "true", "aria-expanded": "false"}))
1631+
cvssv3 = forms.CharField(label="CVSS3 Vector", max_length=117, required=False, widget=forms.TextInput(attrs={"class": "btn btn-secondary dropdown-toggle", "data-toggle": "dropdown", "aria-haspopup": "true", "aria-expanded": "false"}))
16171632
severity = forms.ChoiceField(
16181633
required=False,
16191634
choices=SEVERITY_CHOICES,
@@ -1627,6 +1642,9 @@ def __init__(self, *args, **kwargs):
16271642
super().__init__(*args, **kwargs)
16281643
self.fields["tags"].autocomplete_tags = Finding.tags.tag_model.objects.all().order_by("name")
16291644

1645+
# Hide CVSS fields based on system settings
1646+
hide_cvss_fields_if_disabled(self)
1647+
16301648
class Meta:
16311649
model = Finding_Template
16321650
order = ("title", "cwe", "vulnerability_ids", "cvssv3", "severity", "description", "impact")
@@ -3797,3 +3815,30 @@ def set_permission(self, codename):
37973815
else:
37983816
msg = "Neither user or group are set"
37993817
raise Exception(msg)
3818+
3819+
3820+
def hide_cvss_fields_if_disabled(form_instance):
3821+
"""Hide CVSS fields based on system settings."""
3822+
enable_cvss3 = get_system_setting("enable_cvss3_display", True)
3823+
enable_cvss4 = get_system_setting("enable_cvss4_display", True)
3824+
3825+
# Hide CVSS3 fields if disabled
3826+
if not enable_cvss3:
3827+
if "cvssv3" in form_instance.fields:
3828+
del form_instance.fields["cvssv3"]
3829+
if "cvssv3_score" in form_instance.fields:
3830+
del form_instance.fields["cvssv3_score"]
3831+
if "cvss_info" in form_instance.fields:
3832+
del form_instance.fields["cvss_info"]
3833+
3834+
# Hide CVSS4 fields if disabled
3835+
if not enable_cvss4:
3836+
if "cvssv4" in form_instance.fields:
3837+
del form_instance.fields["cvssv4"]
3838+
if "cvssv4_score" in form_instance.fields:
3839+
del form_instance.fields["cvssv4_score"]
3840+
3841+
# If both are disabled, hide all CVSS related fields
3842+
if not enable_cvss3 and not enable_cvss4:
3843+
if "cvss_info" in form_instance.fields:
3844+
del form_instance.fields["cvss_info"]

‎dojo/models.py

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -598,6 +598,16 @@ class System_Settings(models.Model):
598598
blank=False,
599599
verbose_name=_("Enable Calendar"),
600600
help_text=_("With this setting turned off, the Calendar will be disabled in the user interface."))
601+
enable_cvss3_display = models.BooleanField(
602+
default=True,
603+
blank=False,
604+
verbose_name=_("Enable CVSS3 Display"),
605+
help_text=_("With this setting turned off, CVSS3 fields will be hidden in the user interface."))
606+
enable_cvss4_display = models.BooleanField(
607+
default=True,
608+
blank=False,
609+
verbose_name=_("Enable CVSS4 Display"),
610+
help_text=_("With this setting turned off, CVSS4 fields will be hidden in the user interface."))
601611
default_group = models.ForeignKey(
602612
Dojo_Group,
603613
null=True,
@@ -816,7 +826,7 @@ def clean(self):
816826
class Product_Type(models.Model):
817827

818828
"""
819-
Product types represent the top level model, these can be business unit divisions, different offices or locations, development teams, or any other logical way of distinguishing “types” of products.
829+
Product types represent the top level model, these can be business unit divisions, different offices or locations, development teams, or any other logical way of distinguishing "types" of products.
820830
`
821831
Examples:
822832
* IAM Team

‎dojo/templates/dojo/view_finding.html

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -290,10 +290,10 @@ <h3 class="pull-left finding-title">
290290
<span class="label severity severity-{{ finding.severity }}">
291291
{% if finding.severity %}
292292
{{ finding.severity_display }}
293-
{% if finding.cvssv4_score or finding.cvssv3_score %}
293+
{% if system_settings.enable_cvss4_display and finding.cvssv4_score or system_settings.enable_cvss3_display and finding.cvssv3_score %}
294294
<i class="no-italics has-popover" font-style="normal" data-toggle="tooltip" data-placement="bottom" data-container="body" data-html="true" title="" href="#"
295-
data-content="{% if finding.cvssv4 %}{{ finding.cvssv4 }} ({{ finding.cvssv4_score }}){% endif %}{% if finding.cvssv4 and finding.cvssv3 %}<br/>{% endif %}{% if finding.cvssv3 %}{{ finding.cvssv3 }} ({{ finding.cvssv3_score }}){% endif %}">
296-
({% if finding.cvssv4_score %}{{ finding.cvssv4_score }}{% if finding.cvssv3_score %}, {% endif %}{% endif %}{% if finding.cvssv3_score %}{{ finding.cvssv3_score }}{% endif %})</i>
295+
data-content="{% if system_settings.enable_cvss4_display and finding.cvssv4 %}{{ finding.cvssv4 }} ({{ finding.cvssv4_score }}){% endif %}{% if system_settings.enable_cvss4_display and finding.cvssv4 and system_settings.enable_cvss3_display and finding.cvssv3 %}<br/>{% endif %}{% if system_settings.enable_cvss3_display and finding.cvssv3 %}{{ finding.cvssv3 }} ({{ finding.cvssv3_score }}){% endif %}">
296+
({% if system_settings.enable_cvss4_display and finding.cvssv4_score %}{{ finding.cvssv4_score }}{% if system_settings.enable_cvss3_display and finding.cvssv3_score %}, {% endif %}{% endif %}{% if system_settings.enable_cvss3_display and finding.cvssv3_score %}{{ finding.cvssv3_score }}{% endif %})</i>
297297
{% endif %}
298298
{% else %}
299299
Unknown
@@ -1169,9 +1169,9 @@ <h4>Credential
11691169
<script type="application/javascript" src="{% static "jquery.hotkeys/jquery.hotkeys.js" %}"></script>
11701170
<script type="text/javascript" src="{% static "jquery-highlight/jquery.highlight.js" %}"></script>
11711171
<script type="text/javascript">
1172-
var firstID = {{findings_list.0}};
1173-
var currentID = {{finding.id}};
1174-
var lastID = {{findings_list_lastElement}};
1172+
var firstID = {% if findings_list.0 %}{{findings_list.0}}{% else %}null{% endif %};
1173+
var currentID = {% if finding.id %}{{finding.id}}{% else %}null{% endif %};
1174+
var lastID = {% if findings_list_lastElement %}{{findings_list_lastElement}}{% else %}null{% endif %};
11751175
if(currentID != firstID)
11761176
{
11771177
$('.PrevAndNext_Buttons').append('<a href="{% url 'view_finding' prev_finding_id %}" class="btn btn-primary">Previous Finding</a> ');

0 commit comments

Comments
 (0)