mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

MM-22273 New auditing system (phase 1) (#13967)

Просмотр исходного кода 
* New auditing API outputting to syslog via TLS

* New config section for specifying remote syslog server IP, port, and cert.

* Legacy audit API retained for access history feature
Этот коммит содержится в:
Doug Lauder
2020-03-12 15:50:21 -04:00
коммит произвёл GitHub
родитель bd1e7f2265
Коммит 4ac0619c90
156 изменённых файлов: 16991 добавлений и 49 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

41
api4/bot.go
Просмотреть файл

@@ -10,6 +10,7 @@ import (
"net/http"
"strconv"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -39,6 +40,9 @@ func createBot(c *Context, w http.ResponseWriter, r *http.Request) {
}
bot.Patch(botPatch)
auditRec := c.MakeAuditRecord("createBot", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_CREATE_BOT) {
c.SetPermissionError(model.PERMISSION_CREATE_BOT)
return
@@ -62,6 +66,11 @@ func createBot(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
// Note that the primary key of a bot is the UserId, and matches the primary key of the
// corresponding user.
auditRec.AddMeta("bot_id", createdBot.UserId)
w.WriteHeader(http.StatusCreated)
w.Write(createdBot.ToJson())
}
@@ -79,6 +88,10 @@ func patchBot(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("patchBot", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("bot_id", botUserId)
if err := c.App.SessionHasPermissionToManageBot(*c.App.Session(), botUserId); err != nil {
c.Err = err
return
@@ -90,6 +103,8 @@ func patchBot(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
w.Write(updatedBot.ToJson())
}
@@ -182,6 +197,11 @@ func updateBotActive(c *Context, w http.ResponseWriter, r *http.Request, active
}
botUserId := c.Params.BotUserId
auditRec := c.MakeAuditRecord("updateBotActive", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("bot_id", botUserId)
auditRec.AddMeta("enable", active)
if err := c.App.SessionHasPermissionToManageBot(*c.App.Session(), botUserId); err != nil {
c.Err = err
return
@@ -193,6 +213,8 @@ func updateBotActive(c *Context, w http.ResponseWriter, r *http.Request, active
return
}
auditRec.Success()
w.Write(bot.ToJson())
}
@@ -205,6 +227,11 @@ func assignBot(c *Context, w http.ResponseWriter, r *http.Request) {
botUserId := c.Params.BotUserId
userId := c.Params.UserId
auditRec := c.MakeAuditRecord("assignBot", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("bot_id", botUserId)
auditRec.AddMeta("assign_user_id", userId)
if err := c.App.SessionHasPermissionToManageBot(*c.App.Session(), botUserId); err != nil {
c.Err = err
return
@@ -223,6 +250,8 @@ func assignBot(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
w.Write(bot.ToJson())
}
@@ -276,6 +305,10 @@ func setBotIconImage(c *Context, w http.ResponseWriter, r *http.Request) {
}
botUserId := c.Params.BotUserId
auditRec := c.MakeAuditRecord("setBotIconImage", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("bot_id", botUserId)
if err := c.App.SessionHasPermissionToManageBot(*c.App.Session(), botUserId); err != nil {
c.Err = err
return
@@ -309,7 +342,9 @@ func setBotIconImage(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}
@@ -322,6 +357,10 @@ func deleteBotIconImage(c *Context, w http.ResponseWriter, r *http.Request) {
}
botUserId := c.Params.BotUserId
auditRec := c.MakeAuditRecord("deleteBotIconImage", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("bot_id", botUserId)
if err := c.App.SessionHasPermissionToManageBot(*c.App.Session(), botUserId); err != nil {
c.Err = err
return
@@ -332,6 +371,8 @@ func deleteBotIconImage(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}

10
api4/brand.go
Просмотреть файл

@@ -8,6 +8,7 @@ import (
"io/ioutil"
"net/http"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -57,6 +58,9 @@ func uploadBrandImage(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("uploadBrandImage", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -67,6 +71,7 @@ func uploadBrandImage(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("")
w.WriteHeader(http.StatusCreated)
@@ -74,6 +79,9 @@ func uploadBrandImage(c *Context, w http.ResponseWriter, r *http.Request) {
}
func deleteBrandImage(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("deleteBrandImage", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -84,5 +92,7 @@ func deleteBrandImage(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}

115
api4/channel.go
Просмотреть файл

@@ -8,6 +8,7 @@ import (
"net/http"
"strings"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/mlog"
"github.com/mattermost/mattermost-server/v5/model"
"github.com/mattermost/mattermost-server/v5/store"
@@ -70,6 +71,10 @@ func createChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("createChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_name", channel.Name)
if channel.Type == model.CHANNEL_OPEN && !c.App.SessionHasPermissionToTeam(*c.App.Session(), channel.TeamId, model.PERMISSION_CREATE_PUBLIC_CHANNEL) {
c.SetPermissionError(model.PERMISSION_CREATE_PUBLIC_CHANNEL)
return
@@ -86,7 +91,10 @@ func createChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("channel_id", sc.Id)
c.LogAudit("name=" + channel.Name)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(sc.ToJson()))
}
@@ -110,6 +118,10 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
originalOldChannel, err := c.App.GetChannel(channel.Id)
if err != nil {
c.Err = err
@@ -117,6 +129,8 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
}
oldChannel := originalOldChannel.DeepCopy()
auditRec.AddMeta("channel_name", oldChannel.Name)
switch oldChannel.Type {
case model.CHANNEL_OPEN:
if !c.App.SessionHasPermissionToChannel(*c.App.Session(), c.Params.ChannelId, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES) {
@@ -170,6 +184,7 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
if len(channel.Name) > 0 {
oldChannel.Name = channel.Name
auditRec.AddMeta("new_channel_name", oldChannel.Name)
}
if channel.GroupConstrained != nil {
@@ -187,7 +202,9 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
}
}
auditRec.Success()
c.LogAudit("name=" + channel.Name)
w.Write([]byte(oldChannel.ToJson()))
}
@@ -203,6 +220,11 @@ func convertChannelToPrivate(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec := c.MakeAuditRecord("convertChannelToPrivate", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", oldPublicChannel.Id)
auditRec.AddMeta("channel_name", oldPublicChannel.Name)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), oldPublicChannel.TeamId, model.PERMISSION_MANAGE_TEAM) {
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
return
@@ -232,7 +254,9 @@ func convertChannelToPrivate(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec.Success()
c.LogAudit("name=" + rchannel.Name)
w.Write([]byte(rchannel.ToJson()))
}
@@ -255,6 +279,13 @@ func updateChannelPrivacy(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateChannelPrivacy", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
auditRec.AddMeta("channel_type", channel.Type)
auditRec.AddMeta("new_channel_type", privacy)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), channel.TeamId, model.PERMISSION_MANAGE_TEAM) {
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
return
@@ -279,6 +310,7 @@ func updateChannelPrivacy(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("name=" + updatedChannel.Name)
w.Write([]byte(updatedChannel.ToJson()))
@@ -303,6 +335,11 @@ func patchChannel(c *Context, w http.ResponseWriter, r *http.Request) {
}
oldChannel := originalOldChannel.DeepCopy()
auditRec := c.MakeAuditRecord("patchChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", oldChannel.Id)
auditRec.AddMeta("channel_name", oldChannel.Name)
switch oldChannel.Type {
case model.CHANNEL_OPEN:
if !c.App.SessionHasPermissionToChannel(*c.App.Session(), c.Params.ChannelId, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES) {
@@ -340,7 +377,9 @@ func patchChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("")
w.Write([]byte(rchannel.ToJson()))
}
@@ -357,6 +396,11 @@ func restoreChannel(c *Context, w http.ResponseWriter, r *http.Request) {
}
teamId := channel.TeamId
auditRec := c.MakeAuditRecord("restoreChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), teamId, model.PERMISSION_MANAGE_TEAM) {
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
return
@@ -368,9 +412,10 @@ func restoreChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("name=" + channel.Name)
w.Write([]byte(channel.ToJson()))
w.Write([]byte(channel.ToJson()))
}
func createDirectChannel(c *Context, w http.ResponseWriter, r *http.Request) {
@@ -392,6 +437,9 @@ func createDirectChannel(c *Context, w http.ResponseWriter, r *http.Request) {
}
}
auditRec := c.MakeAuditRecord("createDirectChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_CREATE_DIRECT_CHANNEL) {
c.SetPermissionError(model.PERMISSION_CREATE_DIRECT_CHANNEL)
return
@@ -407,6 +455,8 @@ func createDirectChannel(c *Context, w http.ResponseWriter, r *http.Request) {
otherUserId = userIds[1]
}
auditRec.AddMeta("other_user_id", otherUserId)
canSee, err := c.App.UserCanSeeOtherUser(c.App.Session().UserId, otherUserId)
if err != nil {
c.Err = err
@@ -424,6 +474,10 @@ func createDirectChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("channel_id", sc.Id)
auditRec.AddMeta("channel_name", sc.Name)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(sc.ToJson()))
}
@@ -467,6 +521,9 @@ func createGroupChannel(c *Context, w http.ResponseWriter, r *http.Request) {
userIds = append(userIds, c.App.Session().UserId)
}
auditRec := c.MakeAuditRecord("createGroupChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_CREATE_GROUP_CHANNEL) {
c.SetPermissionError(model.PERMISSION_CREATE_GROUP_CHANNEL)
return
@@ -497,6 +554,10 @@ func createGroupChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("channel_id", groupChannel.Id)
auditRec.AddMeta("channel_name", groupChannel.Name)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(groupChannel.ToJson()))
}
@@ -949,6 +1010,11 @@ func deleteChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("deleteChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
if channel.Type == model.CHANNEL_DIRECT || channel.Type == model.CHANNEL_GROUP {
c.Err = model.NewAppError("deleteChannel", "api.channel.delete_channel.type.invalid", nil, "", http.StatusBadRequest)
return
@@ -970,6 +1036,7 @@ func deleteChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("name=" + channel.Name)
ReturnStatusOK(w)
@@ -1208,6 +1275,11 @@ func updateChannelMemberRoles(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec := c.MakeAuditRecord("updateChannelMemberRoles", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", c.Params.ChannelId)
auditRec.AddMeta("roles", newRoles)
if !c.App.SessionHasPermissionToChannel(*c.App.Session(), c.Params.ChannelId, model.PERMISSION_MANAGE_CHANNEL_ROLES) {
c.SetPermissionError(model.PERMISSION_MANAGE_CHANNEL_ROLES)
return
@@ -1218,6 +1290,8 @@ func updateChannelMemberRoles(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -1233,6 +1307,11 @@ func updateChannelMemberSchemeRoles(c *Context, w http.ResponseWriter, r *http.R
return
}
auditRec := c.MakeAuditRecord("updateChannelMemberSchemeRoles", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", c.Params.ChannelId)
auditRec.AddMeta("roles", schemeRoles)
if !c.App.SessionHasPermissionToChannel(*c.App.Session(), c.Params.ChannelId, model.PERMISSION_MANAGE_CHANNEL_ROLES) {
c.SetPermissionError(model.PERMISSION_MANAGE_CHANNEL_ROLES)
return
@@ -1243,6 +1322,8 @@ func updateChannelMemberSchemeRoles(c *Context, w http.ResponseWriter, r *http.R
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -1258,6 +1339,11 @@ func updateChannelMemberNotifyProps(c *Context, w http.ResponseWriter, r *http.R
return
}
auditRec := c.MakeAuditRecord("updateChannelMemberNotifyProps", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", c.Params.ChannelId)
auditRec.AddMeta("props", props)
if !c.App.SessionHasPermissionToUser(*c.App.Session(), c.Params.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
return
@@ -1269,6 +1355,8 @@ func updateChannelMemberNotifyProps(c *Context, w http.ResponseWriter, r *http.R
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -1314,6 +1402,11 @@ func addChannelMember(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("addChannelMember", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
if channel.Type == model.CHANNEL_DIRECT || channel.Type == model.CHANNEL_GROUP {
c.Err = model.NewAppError("addUserToChannel", "api.channel.add_user_to_channel.type.app_error", nil, "", http.StatusBadRequest)
return
@@ -1385,7 +1478,10 @@ func addChannelMember(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("add_user_id", cm.UserId)
c.LogAudit("name=" + channel.Name + " user_id=" + cm.UserId)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(cm.ToJson()))
}
@@ -1408,6 +1504,12 @@ func removeChannelMember(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("removeChannelMember", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
auditRec.AddMeta("remove_user_id", user.Id)
if !(channel.Type == model.CHANNEL_OPEN || channel.Type == model.CHANNEL_PRIVATE) {
c.Err = model.NewAppError("removeChannelMember", "api.channel.remove_channel_member.type.app_error", nil, "", http.StatusBadRequest)
return
@@ -1435,6 +1537,7 @@ func removeChannelMember(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("name=" + channel.Name + " user_id=" + c.Params.UserId)
ReturnStatusOK(w)
@@ -1452,6 +1555,10 @@ func updateChannelScheme(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateChannelScheme", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("new_scheme_id", schemeID)
if c.App.License() == nil {
c.Err = model.NewAppError("Api4.UpdateChannelScheme", "api.channel.update_channel_scheme.license.error", nil, "", http.StatusNotImplemented)
return
@@ -1479,6 +1586,10 @@ func updateChannelScheme(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
auditRec.AddMeta("old_scheme_id", channel.SchemeId)
channel.SchemeId = &scheme.Id
_, err = c.App.UpdateChannelScheme(channel)
@@ -1487,6 +1598,8 @@ func updateChannelScheme(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}

32
api4/command.go
Просмотреть файл

@@ -8,6 +8,7 @@ import (
"strconv"
"strings"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -32,6 +33,8 @@ func createCommand(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("createCommand", audit.Fail)
defer c.LogAuditRec(auditRec)
c.LogAudit("attempt")
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), cmd.TeamId, model.PERMISSION_MANAGE_SLASH_COMMANDS) {
@@ -47,7 +50,10 @@ func createCommand(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("command_id", rcmd.Id)
c.LogAudit("success")
w.WriteHeader(http.StatusCreated)
w.Write([]byte(rcmd.ToJson()))
}
@@ -64,6 +70,9 @@ func updateCommand(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateCommand", audit.Fail)
auditRec.AddMeta("command_id", c.Params.CommandId)
defer c.LogAuditRec(auditRec)
c.LogAudit("attempt")
oldCmd, err := c.App.GetCommand(c.Params.CommandId)
@@ -97,6 +106,7 @@ func updateCommand(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success")
w.Write([]byte(rcmd.ToJson()))
@@ -108,14 +118,18 @@ func moveCommand(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
c.LogAudit("attempt")
cmr, err := model.CommandMoveRequestFromJson(r.Body)
if err != nil {
c.SetInvalidParam("team_id")
return
}
auditRec := c.MakeAuditRecord("moveCommand", audit.Fail)
auditRec.AddMeta("command_id", c.Params.CommandId)
auditRec.AddMeta("to_team_id", cmr.TeamId)
defer c.LogAuditRec(auditRec)
c.LogAudit("attempt")
newTeam, appErr := c.App.GetTeam(cmr.TeamId)
if appErr != nil {
c.Err = appErr
@@ -133,6 +147,7 @@ func moveCommand(c *Context, w http.ResponseWriter, r *http.Request) {
c.SetCommandNotFoundError()
return
}
auditRec.AddMeta("from_team_id", cmd.TeamId)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), cmd.TeamId, model.PERMISSION_MANAGE_SLASH_COMMANDS) {
c.LogAudit("fail - inappropriate permissions")
@@ -147,7 +162,9 @@ func moveCommand(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success")
ReturnStatusOK(w)
}
@@ -157,6 +174,9 @@ func deleteCommand(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("deleteCommand", audit.Fail)
auditRec.AddMeta("command_id", c.Params.CommandId)
defer c.LogAuditRec(auditRec)
c.LogAudit("attempt")
cmd, err := c.App.GetCommand(c.Params.CommandId)
@@ -185,6 +205,7 @@ func deleteCommand(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success")
ReturnStatusOK(w)
@@ -347,7 +368,11 @@ func regenCommandToken(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("regenCommandToken", audit.Fail)
auditRec.AddMeta("command_id", c.Params.CommandId)
defer c.LogAuditRec(auditRec)
c.LogAudit("attempt")
cmd, err := c.App.GetCommand(c.Params.CommandId)
if err != nil {
c.SetCommandNotFoundError()
@@ -374,6 +399,9 @@ func regenCommandToken(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success")
resp := make(map[string]string)
resp["token"] = rcmd.Token

15
api4/compliance.go
Просмотреть файл

@@ -8,6 +8,7 @@ import (
"strconv"
"github.com/avct/uasurfer"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -25,6 +26,9 @@ func createComplianceReport(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec := c.MakeAuditRecord("createComplianceReport", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -38,7 +42,11 @@ func createComplianceReport(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec.Success()
auditRec.AddMeta("compliance_id", rjob.Id)
auditRec.AddMeta("compliance_desc", rjob.Desc)
c.LogAudit("")
w.WriteHeader(http.StatusCreated)
w.Write([]byte(rjob.ToJson()))
}
@@ -84,6 +92,10 @@ func downloadComplianceReport(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec := c.MakeAuditRecord("downloadComplianceReport", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("compliance_id", c.Params.ReportId)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -101,6 +113,7 @@ func downloadComplianceReport(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec.AddMeta("compliance_desc", job.Desc)
c.LogAudit("downloaded " + job.Desc)
w.Header().Set("Cache-Control", "max-age=2592000, public")
@@ -117,5 +130,7 @@ func downloadComplianceReport(c *Context, w http.ResponseWriter, r *http.Request
w.Header().Set("Content-Type", "application/octet-stream")
}
auditRec.Success()
w.Write(reportBytes)
}

19
api4/config.go
Просмотреть файл

@@ -7,6 +7,7 @@ import (
"net/http"
"reflect"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/config"
"github.com/mattermost/mattermost-server/v5/model"
"github.com/mattermost/mattermost-server/v5/utils"
@@ -34,6 +35,9 @@ func getConfig(c *Context, w http.ResponseWriter, r *http.Request) {
}
func configReload(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("configReload", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -46,6 +50,8 @@ func configReload(c *Context, w http.ResponseWriter, r *http.Request) {
c.App.ReloadConfig()
auditRec.Success()
w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
ReturnStatusOK(w)
}
@@ -57,6 +63,9 @@ func updateConfig(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateConfig", audit.Fail)
defer c.LogAuditRec(auditRec)
cfg.SetDefaults()
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
@@ -101,10 +110,11 @@ func updateConfig(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
c.LogAudit("updateConfig")
cfg = c.App.GetSanitizedConfig()
auditRec.Success()
c.LogAudit("updateConfig")
w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
w.Write([]byte(cfg.ToJson()))
}
@@ -151,6 +161,9 @@ func patchConfig(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("patchConfig", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -196,6 +209,8 @@ func patchConfig(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
w.Write([]byte(c.App.GetSanitizedConfig().ToJson()))
}

6
api4/elasticsearch.go
Просмотреть файл

@@ -6,6 +6,7 @@ package api4
import (
"net/http"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -39,6 +40,9 @@ func testElasticsearch(c *Context, w http.ResponseWriter, r *http.Request) {
}
func purgeElasticsearchIndexes(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("purgeElasticsearchIndexes", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -54,5 +58,7 @@ func purgeElasticsearchIndexes(c *Context, w http.ResponseWriter, r *http.Reques
return
}
auditRec.Success()
ReturnStatusOK(w)
}

15
api4/emoji.go
Просмотреть файл

@@ -10,6 +10,7 @@ import (
"strings"
"github.com/mattermost/mattermost-server/v5/app"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
"github.com/mattermost/mattermost-server/v5/web"
)
@@ -47,6 +48,9 @@ func createEmoji(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("createEmoji", audit.Fail)
defer c.LogAuditRec(auditRec)
// Allow any user with CREATE_EMOJIS permission at Team level to create emojis at system level
memberships, err := c.App.GetTeamMembersForUser(c.App.Session().UserId)
@@ -83,12 +87,16 @@ func createEmoji(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.AddMeta("emoji_id", emoji.Id)
auditRec.AddMeta("emoji_name", emoji.Name)
newEmoji, err := c.App.CreateEmoji(c.App.Session().UserId, emoji, m)
if err != nil {
c.Err = err
return
}
auditRec.Success()
w.Write([]byte(newEmoji.ToJson()))
}
@@ -119,11 +127,16 @@ func deleteEmoji(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("deleteEmoji", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("emoji_id", c.Params.EmojiId)
emoji, err := c.App.GetEmoji(c.Params.EmojiId)
if err != nil {
c.Err = err
return
}
auditRec.AddMeta("emoji_name", emoji.Name)
// Allow any user with DELETE_EMOJIS permission at Team level to delete emojis at system level
memberships, err := c.App.GetTeamMembersForUser(c.App.Session().UserId)
@@ -170,6 +183,8 @@ func deleteEmoji(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}

28
api4/file.go
Просмотреть файл

@@ -17,6 +17,7 @@ import (
"time"
"github.com/mattermost/mattermost-server/v5/app"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
"github.com/mattermost/mattermost-server/v5/utils"
)
@@ -153,12 +154,20 @@ func uploadFileSimple(c *Context, r *http.Request, timestamp time.Time) *model.F
return nil
}
auditRec := c.MakeAuditRecord("uploadFileSimple", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", c.Params.ChannelId)
auditRec.AddMeta("filename", c.Params.Filename)
if !c.App.SessionHasPermissionToChannel(*c.App.Session(), c.Params.ChannelId, model.PERMISSION_UPLOAD_FILE) {
c.SetPermissionError(model.PERMISSION_UPLOAD_FILE)
return nil
}
clientId := r.Form.Get("client_id")
auditRec.AddMeta("client_id", clientId)
auditRec.AddMeta("content_length", r.ContentLength)
info, appErr := c.App.UploadFileX(c.Params.ChannelId, c.Params.Filename, r.Body,
app.UploadFileSetTeamId(FILE_TEAM_ID),
app.UploadFileSetUserId(c.App.Session().UserId),
@@ -176,6 +185,7 @@ func uploadFileSimple(c *Context, r *http.Request, timestamp time.Time) *model.F
if clientId != "" {
fileUploadResponse.ClientIds = []string{clientId}
}
auditRec.Success()
return fileUploadResponse
}
@@ -316,6 +326,11 @@ NEXT_PART:
clientId = clientIds[nFiles]
}
auditRec := c.MakeAuditRecord("uploadFileMultipart", audit.Fail)
auditRec.AddMeta("channel_id", c.Params.ChannelId)
auditRec.AddMeta("filename", filename)
auditRec.AddMeta("client_id", clientId)
info, appErr := c.App.UploadFileX(c.Params.ChannelId, filename, part,
app.UploadFileSetTeamId(FILE_TEAM_ID),
app.UploadFileSetUserId(c.App.Session().UserId),
@@ -324,8 +339,11 @@ NEXT_PART:
app.UploadFileSetClientId(clientId))
if appErr != nil {
c.Err = appErr
c.LogAuditRec(auditRec)
return nil
}
auditRec.Success()
c.LogAuditRec(auditRec)
// add to the response
resp.FileInfos = append(resp.FileInfos, info)
@@ -409,6 +427,12 @@ func uploadFileMultipartLegacy(c *Context, mr *multipart.Reader,
clientId = clientIds[i]
}
auditRec := c.MakeAuditRecord("uploadFileMultipartLegacy", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channelId)
auditRec.AddMeta("filename", fileHeader.Filename)
auditRec.AddMeta("client_id", clientId)
info, appErr := c.App.UploadFileX(c.Params.ChannelId, fileHeader.Filename, f,
app.UploadFileSetTeamId(FILE_TEAM_ID),
app.UploadFileSetUserId(c.App.Session().UserId),
@@ -418,9 +442,13 @@ func uploadFileMultipartLegacy(c *Context, mr *multipart.Reader,
f.Close()
if appErr != nil {
c.Err = appErr
c.LogAuditRec(auditRec)
return nil
}
auditRec.Success()
c.LogAuditRec(auditRec)
resp.FileInfos = append(resp.FileInfos, info)
if clientId != "" {
resp.ClientIds = append(resp.ClientIds, clientId)

41
api4/group.go
Просмотреть файл

@@ -9,6 +9,7 @@ import (
"io/ioutil"
"net/http"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -105,6 +106,10 @@ func patchGroup(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("patchGroup", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("group_id", c.Params.GroupId)
if c.App.License() == nil || !*c.App.License().Features.LDAPGroups {
c.Err = model.NewAppError("Api4.patchGroup", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
return
@@ -120,6 +125,9 @@ func patchGroup(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("old_group_name", group.Name)
auditRec.AddMeta("old_group_display", group.DisplayName)
auditRec.AddMeta("old_group_desc", group.Description)
group.Patch(groupPatch)
@@ -129,12 +137,18 @@ func patchGroup(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.AddMeta("new_group_name", group.Name)
auditRec.AddMeta("new_group_display", group.DisplayName)
auditRec.AddMeta("new_group_desc", group.Description)
b, marshalErr := json.Marshal(group)
if marshalErr != nil {
c.Err = model.NewAppError("Api4.patchGroup", "api.marshal_error", nil, marshalErr.Error(), http.StatusInternalServerError)
return
}
auditRec.Success()
w.Write(b)
}
@@ -162,6 +176,12 @@ func linkGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("linkGroupSyncable", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("group_id", c.Params.GroupId)
auditRec.AddMeta("syncable_id", syncableID)
auditRec.AddMeta("syncable_type", syncableType)
var patch *model.GroupSyncablePatch
err = json.Unmarshal(body, &patch)
if err != nil || patch == nil {
@@ -203,7 +223,7 @@ func linkGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = model.NewAppError("Api4.createGroupSyncable", "api.marshal_error", nil, marshalErr.Error(), http.StatusInternalServerError)
return
}
auditRec.Success()
w.Write(b)
}
@@ -311,6 +331,12 @@ func patchGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("patchGroupSyncable", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("group_id", c.Params.GroupId)
auditRec.AddMeta("old_syncable_id", syncableID)
auditRec.AddMeta("old_syncable_type", syncableType)
var patch *model.GroupSyncablePatch
err = json.Unmarshal(body, &patch)
if err != nil || patch == nil {
@@ -344,6 +370,9 @@ func patchGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.AddMeta("new_syncable_id", groupSyncable.SyncableId)
auditRec.AddMeta("new_syncable_type", groupSyncable.Type)
// Not awaiting completion because the group sync job executes the same procedure—but for all syncables—and
// persists the execution status to the jobs table.
go c.App.SyncRolesAndMembership(syncableID, syncableType)
@@ -353,7 +382,7 @@ func patchGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = model.NewAppError("Api4.patchGroupSyncable", "api.marshal_error", nil, marshalErr.Error(), http.StatusInternalServerError)
return
}
auditRec.Success()
w.Write(b)
}
@@ -375,6 +404,12 @@ func unlinkGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
}
syncableType := c.Params.SyncableType
auditRec := c.MakeAuditRecord("unlinkGroupSyncable", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("group_id", c.Params.GroupId)
auditRec.AddMeta("syncable_id", syncableID)
auditRec.AddMeta("syncable_type", syncableType)
if c.App.License() == nil || !*c.App.License().Features.LDAPGroups {
c.Err = model.NewAppError("Api4.unlinkGroupSyncable", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
return
@@ -396,6 +431,8 @@ func unlinkGroupSyncable(c *Context, w http.ResponseWriter, r *http.Request) {
// persists the execution status to the jobs table.
go c.App.SyncRolesAndMembership(syncableID, syncableType)
auditRec.Success()
ReturnStatusOK(w)
}

14
api4/job.go
Просмотреть файл

@@ -6,6 +6,7 @@ package api4
import (
"net/http"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -44,6 +45,10 @@ func createJob(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("createJob", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("job_type", job.Type)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_JOBS) {
c.SetPermissionError(model.PERMISSION_MANAGE_JOBS)
return
@@ -55,6 +60,9 @@ func createJob(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("job_id", job.Id)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(job.ToJson()))
}
@@ -104,6 +112,10 @@ func cancelJob(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("cancelJob", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("job_id", c.Params.JobId)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_JOBS) {
c.SetPermissionError(model.PERMISSION_MANAGE_JOBS)
return
@@ -114,5 +126,7 @@ func cancelJob(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}

25
api4/ldap.go
Просмотреть файл

@@ -8,6 +8,7 @@ import (
"encoding/json"
"net/http"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -38,6 +39,9 @@ func syncLdap(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("syncLdap", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -45,6 +49,7 @@ func syncLdap(c *Context, w http.ResponseWriter, r *http.Request) {
c.App.SyncLdap()
auditRec.Success()
ReturnStatusOK(w)
}
@@ -130,6 +135,10 @@ func linkLdapGroup(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("linkLdapGroup", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("remote_id", c.Params.RemoteId)
if c.App.License() == nil || !*c.App.License().Features.LDAPGroups {
c.Err = model.NewAppError("Api4.linkLdapGroup", "api.ldap_groups.license_error", nil, "", http.StatusNotImplemented)
return
@@ -140,6 +149,8 @@ func linkLdapGroup(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("ldap_group_id", ldapGroup.Id)
auditRec.AddMeta("ldap_group_desc", ldapGroup.Description)
if ldapGroup == nil {
c.Err = model.NewAppError("Api4.linkLdapGroup", "api.ldap_group.not_found", nil, "", http.StatusNotFound)
@@ -151,6 +162,10 @@ func linkLdapGroup(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
if group != nil {
auditRec.AddMeta("group_id", group.Id)
auditRec.AddMeta("group_name", group.Name)
}
var status int
var newOrUpdatedGroup *model.Group
@@ -162,6 +177,7 @@ func linkLdapGroup(c *Context, w http.ResponseWriter, r *http.Request) {
} else {
displayName = ldapGroup.DisplayName
}
auditRec.AddMeta("ldap_group_display", displayName)
// Group has been previously linked
if group != nil {
@@ -204,6 +220,8 @@ func linkLdapGroup(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
w.WriteHeader(status)
w.Write(b)
}
@@ -214,6 +232,10 @@ func unlinkLdapGroup(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("unlinkLdapGroup", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("remote_id", c.Params.RemoteId)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -229,6 +251,8 @@ func unlinkLdapGroup(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("group_id", group.Id)
auditRec.AddMeta("group_name", group.Name)
if group.DeleteAt == 0 {
_, err = c.App.DeleteGroup(group.Id)
@@ -238,5 +262,6 @@ func unlinkLdapGroup(c *Context, w http.ResponseWriter, r *http.Request) {
}
}
auditRec.Success()
ReturnStatusOK(w)
}

10
api4/license.go
Просмотреть файл

@@ -8,6 +8,7 @@ import (
"io"
"net/http"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -42,6 +43,8 @@ func getClientLicense(c *Context, w http.ResponseWriter, r *http.Request) {
}
func addLicense(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("addLicense", audit.Fail)
defer c.LogAuditRec(auditRec)
c.LogAudit("attempt")
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
@@ -74,6 +77,7 @@ func addLicense(c *Context, w http.ResponseWriter, r *http.Request) {
}
fileData := fileArray[0]
auditRec.AddMeta("filename", fileData.Filename)
file, err := fileData.Open()
if err != nil {
@@ -103,11 +107,15 @@ func addLicense(c *Context, w http.ResponseWriter, r *http.Request) {
c.App.Srv().Jobs.StartWorkers()
}
auditRec.Success()
c.LogAudit("success")
w.Write([]byte(license.ToJson()))
}
func removeLicense(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("removeLicense", audit.Fail)
defer c.LogAuditRec(auditRec)
c.LogAudit("attempt")
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
@@ -125,6 +133,8 @@ func removeLicense(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success")
ReturnStatusOK(w)
}

32
api4/oauth.go
Просмотреть файл

@@ -6,6 +6,7 @@ package api4
import (
"net/http"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -29,6 +30,11 @@ func createOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("createOAuthApp", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("oauth_app_name", oauthApp.Name)
auditRec.AddMeta("oauth_app_desc", oauthApp.Description)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_OAUTH) {
c.SetPermissionError(model.PERMISSION_MANAGE_OAUTH)
return
@@ -46,7 +52,11 @@ func createOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("oauth_app_id", rapp.Id)
auditRec.AddMeta("client_id", rapp.Id)
c.LogAudit("client_id=" + rapp.Id)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(rapp.ToJson()))
}
@@ -57,6 +67,11 @@ func updateOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateOAuthApp", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("oauth_app_id", c.Params.AppId)
c.LogAudit("attempt")
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_OAUTH) {
c.SetPermissionError(model.PERMISSION_MANAGE_OAUTH)
return
@@ -67,6 +82,7 @@ func updateOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
c.SetInvalidParam("oauth_app")
return
}
auditRec.AddMeta("oauth_app_name", oauthApp.Name)
// The app being updated in the payload must be the same one as indicated in the URL.
if oauthApp.Id != c.Params.AppId {
@@ -74,8 +90,6 @@ func updateOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
c.LogAudit("attempt")
oldOauthApp, err := c.App.GetOAuthApp(c.Params.AppId)
if err != nil {
c.Err = err
@@ -97,6 +111,7 @@ func updateOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success")
w.Write([]byte(updatedOauthApp.ToJson()))
@@ -174,6 +189,9 @@ func deleteOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("deleteOAuthApp", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("oauth_app_id", c.Params.AppId)
c.LogAudit("attempt")
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_OAUTH) {
@@ -186,6 +204,7 @@ func deleteOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("oauth_app_name", oauthApp.Name)
if c.App.Session().UserId != oauthApp.CreatorId && !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM_WIDE_OAUTH) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM_WIDE_OAUTH)
@@ -198,7 +217,9 @@ func deleteOAuthApp(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success")
ReturnStatusOK(w)
}
@@ -208,6 +229,10 @@ func regenerateOAuthAppSecret(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec := c.MakeAuditRecord("regenerateOAuthAppSecret", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("oauth_app_id", c.Params.AppId)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_OAUTH) {
c.SetPermissionError(model.PERMISSION_MANAGE_OAUTH)
return
@@ -218,6 +243,7 @@ func regenerateOAuthAppSecret(c *Context, w http.ResponseWriter, r *http.Request
c.Err = err
return
}
auditRec.AddMeta("oauth_app_name", oauthApp.Name)
if oauthApp.CreatorId != c.App.Session().UserId && !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM_WIDE_OAUTH) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM_WIDE_OAUTH)
@@ -230,7 +256,9 @@ func regenerateOAuthAppSecret(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec.Success()
c.LogAudit("success")
w.Write([]byte(oauthApp.ToJson()))
}

34
api4/plugin.go
Просмотреть файл

@@ -13,6 +13,7 @@ import (
"net/url"
"strconv"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/mlog"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -46,6 +47,9 @@ func uploadPlugin(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("uploadPlugin", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -68,6 +72,7 @@ func uploadPlugin(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = model.NewAppError("uploadPlugin", "api.plugin.upload.array.app_error", nil, "", http.StatusBadRequest)
return
}
auditRec.AddMeta("filename", pluginArray[0].Filename)
file, err := pluginArray[0].Open()
if err != nil {
@@ -82,6 +87,7 @@ func uploadPlugin(c *Context, w http.ResponseWriter, r *http.Request) {
}
installPlugin(c, w, file, force)
auditRec.Success()
}
func installPluginFromUrl(c *Context, w http.ResponseWriter, r *http.Request) {
@@ -92,6 +98,9 @@ func installPluginFromUrl(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("installPluginFromUrl", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -99,6 +108,7 @@ func installPluginFromUrl(c *Context, w http.ResponseWriter, r *http.Request) {
force := r.URL.Query().Get("force") == "true"
downloadURL := r.URL.Query().Get("plugin_download_url")
auditRec.AddMeta("url", downloadURL)
pluginFileBytes, err := c.App.DownloadFromURL(downloadURL)
if err != nil {
@@ -107,6 +117,7 @@ func installPluginFromUrl(c *Context, w http.ResponseWriter, r *http.Request) {
}
installPlugin(c, w, bytes.NewReader(pluginFileBytes), force)
auditRec.Success()
}
func installMarketplacePlugin(c *Context, w http.ResponseWriter, r *http.Request) {
@@ -120,6 +131,9 @@ func installMarketplacePlugin(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec := c.MakeAuditRecord("installMarketplacePlugin", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -130,6 +144,7 @@ func installMarketplacePlugin(c *Context, w http.ResponseWriter, r *http.Request
c.Err = model.NewAppError("installMarketplacePlugin", "app.plugin.marketplace_plugin_request.app_error", nil, err.Error(), http.StatusNotImplemented)
return
}
auditRec.AddMeta("plugin_id", pluginRequest.Id)
manifest, appErr := c.App.InstallMarketplacePlugin(pluginRequest)
if appErr != nil {
@@ -137,6 +152,10 @@ func installMarketplacePlugin(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec.Success()
auditRec.AddMeta("plugin_name", manifest.Name)
auditRec.AddMeta("plugin_desc", manifest.Description)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(manifest.ToJson()))
}
@@ -192,6 +211,10 @@ func removePlugin(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("removePlugin", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("plugin_id", c.Params.PluginId)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -203,6 +226,7 @@ func removePlugin(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -280,6 +304,10 @@ func enablePlugin(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("enablePlugin", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("plugin_id", c.Params.PluginId)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -290,6 +318,7 @@ func enablePlugin(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -304,6 +333,10 @@ func disablePlugin(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("disablePlugin", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("plugin_id", c.Params.PluginId)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -314,6 +347,7 @@ func disablePlugin(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}

37
api4/post.go
Просмотреть файл

@@ -10,6 +10,7 @@ import (
"time"
"github.com/mattermost/mattermost-server/v5/app"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/mlog"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -43,6 +44,10 @@ func createPost(c *Context, w http.ResponseWriter, r *http.Request) {
post.UserId = c.App.Session().UserId
auditRec := c.MakeAuditRecord("createPost", audit.Fail)
defer c.LogAuditRecWithLevel(auditRec, app.RestContentLevel)
auditRec.AddMeta("channel_id", post.ChannelId)
hasPermission := false
if c.App.SessionHasPermissionToChannel(*c.App.Session(), post.ChannelId, model.PERMISSION_CREATE_POST) {
hasPermission = true
@@ -67,6 +72,8 @@ func createPost(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.Success()
auditRec.AddMeta("post_id", rp.Id)
setOnline := r.URL.Query().Get("set_online")
setOnlineBool := true // By default, always set online.
@@ -362,11 +369,17 @@ func deletePost(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("deletePost", audit.Fail)
defer c.LogAuditRecWithLevel(auditRec, app.RestContentLevel)
auditRec.AddMeta("post_id", c.Params.PostId)
post, err := c.App.GetSinglePost(c.Params.PostId)
if err != nil {
c.SetPermissionError(model.PERMISSION_DELETE_POST)
return
}
auditRec.AddMeta("channel_id", post.ChannelId)
auditRec.AddMeta("creator_user_id", post.UserId)
if c.App.Session().UserId == post.UserId {
if !c.App.SessionHasPermissionToChannel(*c.App.Session(), post.ChannelId, model.PERMISSION_DELETE_POST) {
@@ -385,6 +398,7 @@ func deletePost(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -516,6 +530,12 @@ func updatePost(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updatePost", audit.Fail)
defer c.LogAuditRecWithLevel(auditRec, app.RestContentLevel)
auditRec.AddMeta("post_id", post.Id)
auditRec.AddMeta("channel_id", post.ChannelId)
auditRec.AddMeta("creator_user_id", post.UserId)
// The post being updated in the payload must be the same one as indicated in the URL.
if post.Id != c.Params.PostId {
c.SetInvalidParam("id")
@@ -551,6 +571,8 @@ func updatePost(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
w.Write([]byte(rpost.ToJson()))
}
@@ -567,6 +589,10 @@ func patchPost(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("patchPost", audit.Fail)
defer c.LogAuditRecWithLevel(auditRec, app.RestContentLevel)
auditRec.AddMeta("post_id", c.Params.PostId)
// Updating the file_ids of a post is not a supported operation and will be ignored
post.FileIds = nil
@@ -580,6 +606,8 @@ func patchPost(c *Context, w http.ResponseWriter, r *http.Request) {
c.SetPermissionError(model.PERMISSION_EDIT_POST)
return
}
auditRec.AddMeta("channel_id", originalPost.ChannelId)
auditRec.AddMeta("creator_user_id", originalPost.UserId)
if c.App.Session().UserId != originalPost.UserId {
if !c.App.SessionHasPermissionToChannelByPost(*c.App.Session(), c.Params.PostId, model.PERMISSION_EDIT_OTHERS_POSTS) {
@@ -594,6 +622,8 @@ func patchPost(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
w.Write([]byte(patchedPost.ToJson()))
}
@@ -625,6 +655,10 @@ func saveIsPinnedPost(c *Context, w http.ResponseWriter, r *http.Request, isPinn
return
}
auditRec := c.MakeAuditRecord("saveIsPinnedPost", audit.Fail)
defer c.LogAuditRecWithLevel(auditRec, app.RestContentLevel)
auditRec.AddMeta("post_id", c.Params.PostId)
if !c.App.SessionHasPermissionToChannelByPost(*c.App.Session(), c.Params.PostId, model.PERMISSION_READ_CHANNEL) {
c.SetPermissionError(model.PERMISSION_READ_CHANNEL)
return
@@ -642,6 +676,8 @@ func saveIsPinnedPost(c *Context, w http.ResponseWriter, r *http.Request, isPinn
c.Err = err
return
}
auditRec.AddMeta("channel_id", post.ChannelId)
auditRec.AddMeta("creator_user_id", post.UserId)
channel, err := c.App.GetChannel(post.ChannelId)
if err != nil {
@@ -666,6 +702,7 @@ func saveIsPinnedPost(c *Context, w http.ResponseWriter, r *http.Request, isPinn
return
}
auditRec.Success()
ReturnStatusOK(w)
}

9
api4/preference.go
Просмотреть файл

@@ -6,6 +6,7 @@ package api4
import (
"net/http"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -83,6 +84,9 @@ func updatePreferences(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updatePreferences", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionToUser(*c.App.Session(), c.Params.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
return
@@ -118,6 +122,7 @@ func updatePreferences(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -127,6 +132,9 @@ func deletePreferences(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("deletePreferences", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionToUser(*c.App.Session(), c.Params.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
return
@@ -143,5 +151,6 @@ func deletePreferences(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}

10
api4/role.go
Просмотреть файл

@@ -7,6 +7,7 @@ import (
"net/http"
"strings"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -90,11 +91,18 @@ func patchRole(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("patchRole", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("role_id", c.Params.RoleId)
oldRole, err := c.App.GetRole(c.Params.RoleId)
if err != nil {
c.Err = err
return
}
auditRec.AddMeta("role_id", oldRole.Name)
auditRec.AddMeta("role_desc", oldRole.Description)
auditRec.AddMeta("role_display", oldRole.DisplayName)
if c.App.License() == nil && patch.Permissions != nil {
if oldRole.Name == "system_guest" || oldRole.Name == "team_guest" || oldRole.Name == "channel_guest" {
@@ -145,6 +153,8 @@ func patchRole(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("")
w.Write([]byte(role.ToJson()))
}

29
api4/saml.go
Просмотреть файл

@@ -9,6 +9,7 @@ import (
"mime/multipart"
"net/http"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -72,10 +73,15 @@ func addSamlPublicCertificate(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec := c.MakeAuditRecord("addSamlPublicCertificate", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("filename", fileData.Filename)
if err := c.App.AddSamlPublicCertificate(fileData); err != nil {
c.Err = err
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -91,10 +97,15 @@ func addSamlPrivateCertificate(c *Context, w http.ResponseWriter, r *http.Reques
return
}
auditRec := c.MakeAuditRecord("addSamlPrivateCertificate", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("filename", fileData.Filename)
if err := c.App.AddSamlPrivateCertificate(fileData); err != nil {
c.Err = err
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -115,6 +126,10 @@ func addSamlIdpCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("addSamlIdpCertificate", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("type", d)
if d == "application/x-pem-file" {
body, err := ioutil.ReadAll(r.Body)
if err != nil {
@@ -132,6 +147,7 @@ func addSamlIdpCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("filename", fileData.Filename)
if err := c.App.AddSamlIdpCertificate(fileData); err != nil {
c.Err = err
@@ -142,6 +158,7 @@ func addSamlIdpCertificate(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -151,11 +168,15 @@ func removeSamlPublicCertificate(c *Context, w http.ResponseWriter, r *http.Requ
return
}
auditRec := c.MakeAuditRecord("removeSamlPublicCertificate", audit.Fail)
defer c.LogAuditRec(auditRec)
if err := c.App.RemoveSamlPublicCertificate(); err != nil {
c.Err = err
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -165,11 +186,15 @@ func removeSamlPrivateCertificate(c *Context, w http.ResponseWriter, r *http.Req
return
}
auditRec := c.MakeAuditRecord("removeSamlPrivateCertificate", audit.Fail)
defer c.LogAuditRec(auditRec)
if err := c.App.RemoveSamlPrivateCertificate(); err != nil {
c.Err = err
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -179,11 +204,15 @@ func removeSamlIdpCertificate(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec := c.MakeAuditRecord("removeSamlIdpCertificate", audit.Fail)
defer c.LogAuditRec(auditRec)
if err := c.App.RemoveSamlIdpCertificate(); err != nil {
c.Err = err
return
}
auditRec.Success()
ReturnStatusOK(w)
}

27
api4/scheme.go
Просмотреть файл

@@ -6,6 +6,7 @@ package api4
import (
"net/http"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -26,6 +27,12 @@ func createScheme(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("createScheme", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("scheme_name", scheme.Name)
auditRec.AddMeta("scheme_display", scheme.DisplayName)
auditRec.AddMeta("scheme_desc", scheme.Description)
if c.App.License() == nil || !*c.App.License().Features.CustomPermissionsSchemes {
c.Err = model.NewAppError("Api4.CreateScheme", "api.scheme.create_scheme.license.error", nil, "", http.StatusNotImplemented)
return
@@ -42,6 +49,9 @@ func createScheme(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("scheme_id", scheme.Id)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(scheme.ToJson()))
}
@@ -161,6 +171,13 @@ func patchScheme(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("patchScheme", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("scheme_id", c.Params.SchemeId)
auditRec.AddMeta("new_scheme_name", patch.Name)
auditRec.AddMeta("new_scheme_display", patch.DisplayName)
auditRec.AddMeta("new_scheme_desc", patch.Description)
if c.App.License() == nil || !*c.App.License().Features.CustomPermissionsSchemes {
c.Err = model.NewAppError("Api4.PatchScheme", "api.scheme.patch_scheme.license.error", nil, "", http.StatusNotImplemented)
return
@@ -171,6 +188,9 @@ func patchScheme(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("old_scheme_name", scheme.Name)
auditRec.AddMeta("old_scheme_display", scheme.DisplayName)
auditRec.AddMeta("old_scheme_desc", scheme.Description)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
@@ -183,7 +203,9 @@ func patchScheme(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("")
w.Write([]byte(scheme.ToJson()))
}
@@ -193,6 +215,10 @@ func deleteScheme(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("deleteScheme", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("scheme_id", c.Params.SchemeId)
if c.App.License() == nil || !*c.App.License().Features.CustomPermissionsSchemes {
c.Err = model.NewAppError("Api4.DeleteScheme", "api.scheme.delete_scheme.license.error", nil, "", http.StatusNotImplemented)
return
@@ -208,5 +234,6 @@ func deleteScheme(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}

22
api4/system.go
Просмотреть файл

@@ -11,6 +11,7 @@ import (
"strconv"
"time"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/mlog"
"github.com/mattermost/mattermost-server/v5/model"
"github.com/mattermost/mattermost-server/v5/services/cache/lru"
@@ -203,6 +204,9 @@ func databaseRecycle(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("databaseRecycle", audit.Fail)
defer c.LogAuditRec(auditRec)
if *c.App.Config().ExperimentalSettings.RestrictSystemAdmin {
c.Err = model.NewAppError("databaseRecycle", "api.restricted_system_admin", nil, "", http.StatusForbidden)
return
@@ -210,6 +214,7 @@ func databaseRecycle(c *Context, w http.ResponseWriter, r *http.Request) {
c.App.RecycleDatabaseConnection()
auditRec.Success()
ReturnStatusOK(w)
}
@@ -219,6 +224,9 @@ func invalidateCaches(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("invalidateCaches", audit.Fail)
defer c.LogAuditRec(auditRec)
if *c.App.Config().ExperimentalSettings.RestrictSystemAdmin {
c.Err = model.NewAppError("invalidateCaches", "api.restricted_system_admin", nil, "", http.StatusForbidden)
return
@@ -230,6 +238,8 @@ func invalidateCaches(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
w.Header().Set("Cache-Control", "no-cache, no-store, must-revalidate")
ReturnStatusOK(w)
}
@@ -481,8 +491,14 @@ func setServerBusy(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("setServerBusy", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("seconds", i)
c.App.Srv().Busy.Set(time.Second * time.Duration(i))
mlog.Warn("server busy state activated - non-critical services disabled", mlog.Int64("seconds", i))
auditRec.Success()
ReturnStatusOK(w)
}
@@ -491,8 +507,14 @@ func clearServerBusy(c *Context, w http.ResponseWriter, r *http.Request) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
}
auditRec := c.MakeAuditRecord("clearServerBusy", audit.Fail)
defer c.LogAuditRec(auditRec)
c.App.Srv().Busy.Clear()
mlog.Info("server busy state cleared - non-critical services enabled")
auditRec.Success()
ReturnStatusOK(w)
}

162
api4/team.go
Просмотреть файл

@@ -15,6 +15,7 @@ import (
"strconv"
"strings"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -81,6 +82,11 @@ func createTeam(c *Context, w http.ResponseWriter, r *http.Request) {
}
team.Email = strings.ToLower(team.Email)
auditRec := c.MakeAuditRecord("createTeam", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_name", team.Name)
auditRec.AddMeta("team_display", team.DisplayName)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_CREATE_TEAM) {
c.Err = model.NewAppError("createTeam", "api.team.is_team_creation_allowed.disabled.app_error", nil, "", http.StatusForbidden)
return
@@ -94,6 +100,9 @@ func createTeam(c *Context, w http.ResponseWriter, r *http.Request) {
// Don't sanitize the team here since the user will be a team admin and their session won't reflect that yet
auditRec.Success()
auditRec.AddMeta("team_id", rteam.Id)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(rteam.ToJson()))
}
@@ -160,6 +169,12 @@ func updateTeam(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateTeam", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_id", c.Params.TeamId)
auditRec.AddMeta("team_name", team.Name)
auditRec.AddMeta("team_display", team.DisplayName)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), c.Params.TeamId, model.PERMISSION_MANAGE_TEAM) {
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
return
@@ -171,6 +186,8 @@ func updateTeam(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.App.SanitizeTeam(*c.App.Session(), updatedTeam)
w.Write([]byte(updatedTeam.ToJson()))
}
@@ -188,6 +205,10 @@ func patchTeam(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("patchTeam", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_id", c.Params.TeamId)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), c.Params.TeamId, model.PERMISSION_MANAGE_TEAM) {
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
return
@@ -202,7 +223,11 @@ func patchTeam(c *Context, w http.ResponseWriter, r *http.Request) {
c.App.SanitizeTeam(*c.App.Session(), patchedTeam)
auditRec.Success()
auditRec.AddMeta("team_name", patchedTeam.Name)
auditRec.AddMeta("team_display", patchedTeam.DisplayName)
c.LogAudit("")
w.Write([]byte(patchedTeam.ToJson()))
}
@@ -217,6 +242,10 @@ func regenerateTeamInviteId(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec := c.MakeAuditRecord("regenerateTeamInviteId", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_id", c.Params.TeamId)
patchedTeam, err := c.App.RegenerateTeamInviteId(c.Params.TeamId)
if err != nil {
c.Err = err
@@ -225,7 +254,11 @@ func regenerateTeamInviteId(c *Context, w http.ResponseWriter, r *http.Request)
c.App.SanitizeTeam(*c.App.Session(), patchedTeam)
auditRec.Success()
auditRec.AddMeta("team_name", patchedTeam.Name)
auditRec.AddMeta("team_display", patchedTeam.DisplayName)
c.LogAudit("")
w.Write([]byte(patchedTeam.ToJson()))
}
@@ -240,6 +273,10 @@ func deleteTeam(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("deleteTeam", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_id", c.Params.TeamId)
var err *model.AppError
if c.Params.Permanent && *c.App.Config().ServiceSettings.EnableAPITeamDeletion {
err = c.App.PermanentDeleteTeamId(c.Params.TeamId)
@@ -252,6 +289,7 @@ func deleteTeam(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -438,6 +476,11 @@ func addTeamMember(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("addTeamMember", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_id", c.Params.TeamId)
auditRec.AddMeta("add_user_id", member.UserId)
if member.UserId == c.App.Session().UserId {
var team *model.Team
team, err = c.App.GetTeam(member.TeamId)
@@ -466,6 +509,8 @@ func addTeamMember(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("team_name", team.Name)
auditRec.AddMeta("team_display", team.DisplayName)
if team.IsGroupConstrained() {
nonMembers, err := c.App.FilterNonGroupTeamMembers([]string{member.UserId}, team)
@@ -490,6 +535,8 @@ func addTeamMember(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
w.WriteHeader(http.StatusCreated)
w.Write([]byte(member.ToJson()))
}
@@ -501,6 +548,10 @@ func addUserToTeamFromInvite(c *Context, w http.ResponseWriter, r *http.Request)
var member *model.TeamMember
var err *model.AppError
auditRec := c.MakeAuditRecord("addUserToTeamFromInvite", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("invite_id", inviteId)
if len(tokenId) > 0 {
member, err = c.App.AddTeamMemberByToken(c.App.Session().UserId, tokenId)
} else if len(inviteId) > 0 {
@@ -519,6 +570,11 @@ func addUserToTeamFromInvite(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec.Success()
if member != nil {
auditRec.AddMeta("add_user_id", member.UserId)
}
w.WriteHeader(http.StatusCreated)
w.Write([]byte(member.ToJson()))
}
@@ -544,16 +600,24 @@ func addTeamMembers(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("addTeamMembers", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_id", c.Params.TeamId)
auditRec.AddMeta("count", len(members))
var memberIDs []string
for _, member := range members {
memberIDs = append(memberIDs, member.UserId)
}
auditRec.AddMeta("user_ids", memberIDs)
team, err := c.App.GetTeam(c.Params.TeamId)
if err != nil {
c.Err = err
return
}
auditRec.AddMeta("team_name", team.Name)
auditRec.AddMeta("team_display", team.DisplayName)
if team.IsGroupConstrained() {
nonMembers, err := c.App.FilterNonGroupTeamMembers(memberIDs, team)
@@ -593,11 +657,22 @@ func addTeamMembers(c *Context, w http.ResponseWriter, r *http.Request) {
membersWithErrors, err := c.App.AddTeamMembers(c.Params.TeamId, userIds, c.App.Session().UserId, graceful)
if membersWithErrors != nil {
errList := make([]string, 0, len(membersWithErrors))
for _, m := range membersWithErrors {
if m.Error != nil {
errList = append(errList, model.TeamMemberWithErrorToString(m))
}
}
auditRec.AddMeta("errors", errList)
}
if err != nil {
c.Err = err
return
}
auditRec.Success()
w.WriteHeader(http.StatusCreated)
if graceful {
@@ -615,6 +690,10 @@ func removeTeamMember(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("removeTeamMember", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_id", c.Params.TeamId)
if c.App.Session().UserId != c.Params.UserId {
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), c.Params.TeamId, model.PERMISSION_REMOVE_USER_FROM_TEAM) {
c.SetPermissionError(model.PERMISSION_REMOVE_USER_FROM_TEAM)
@@ -627,12 +706,15 @@ func removeTeamMember(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("team_name", team.Name)
auditRec.AddMeta("team_display", team.DisplayName)
user, err := c.App.GetUser(c.Params.UserId)
if err != nil {
c.Err = err
return
}
auditRec.AddMeta("remove_user_id", user.Id)
if team.IsGroupConstrained() && (c.Params.UserId != c.App.Session().UserId) && !user.IsBot {
c.Err = model.NewAppError("removeTeamMember", "api.team.remove_member.group_constrained.app_error", nil, "", http.StatusBadRequest)
@@ -644,6 +726,7 @@ func removeTeamMember(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -712,6 +795,11 @@ func updateTeamMemberRoles(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateTeamMemberRoles", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_id", c.Params.TeamId)
auditRec.AddMeta("update_user_id", c.Params.UserId)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), c.Params.TeamId, model.PERMISSION_MANAGE_TEAM_ROLES) {
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM_ROLES)
return
@@ -722,6 +810,7 @@ func updateTeamMemberRoles(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -737,6 +826,14 @@ func updateTeamMemberSchemeRoles(c *Context, w http.ResponseWriter, r *http.Requ
return
}
auditRec := c.MakeAuditRecord("updateTeamMemberSchemeRoles", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_id", c.Params.TeamId)
auditRec.AddMeta("update_user_id", c.Params.UserId)
auditRec.AddMeta("new_scheme_admin", schemeRoles.SchemeAdmin)
auditRec.AddMeta("new_scheme_user", schemeRoles.SchemeUser)
auditRec.AddMeta("new_scheme_guest", schemeRoles.SchemeGuest)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), c.Params.TeamId, model.PERMISSION_MANAGE_TEAM_ROLES) {
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM_ROLES)
return
@@ -747,6 +844,7 @@ func updateTeamMemberSchemeRoles(c *Context, w http.ResponseWriter, r *http.Requ
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -925,6 +1023,10 @@ func importTeam(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("importTeam", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_id", c.Params.TeamId)
fileInfo := fileInfoArray[0]
fileData, err := fileInfo.Open()
@@ -933,6 +1035,9 @@ func importTeam(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
defer fileData.Close()
auditRec.AddMeta("filename", fileInfo.Filename)
auditRec.AddMeta("filesize", fileSize)
auditRec.AddMeta("from", importFrom)
var log *bytes.Buffer
switch importFrom {
@@ -949,6 +1054,7 @@ func importTeam(c *Context, w http.ResponseWriter, r *http.Request) {
if c.Err != nil {
w.WriteHeader(c.Err.StatusCode)
}
auditRec.Success()
w.Write([]byte(model.MapToJson(data)))
}
@@ -980,8 +1086,23 @@ func inviteUsersToTeam(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("inviteUsersToTeam", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_id", c.Params.TeamId)
auditRec.AddMeta("count", len(emailList))
auditRec.AddMeta("emails", emailList)
if graceful {
invitesWithError, err := c.App.InviteNewUsersToTeamGracefully(emailList, c.Params.TeamId, c.App.Session().UserId)
if invitesWithError != nil {
errList := make([]string, 0, len(invitesWithError))
for _, inv := range invitesWithError {
if inv.Error != nil {
errList = append(errList, model.EmailInviteWithErrorToString(inv))
}
}
auditRec.AddMeta("errors", errList)
}
if err != nil {
c.Err = err
return
@@ -996,6 +1117,7 @@ func inviteUsersToTeam(c *Context, w http.ResponseWriter, r *http.Request) {
}
ReturnStatusOK(w)
}
auditRec.Success()
}
func inviteGuestsToChannels(c *Context, w http.ResponseWriter, r *http.Request) {
@@ -1015,6 +1137,10 @@ func inviteGuestsToChannels(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec := c.MakeAuditRecord("inviteGuestsToChannels", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_id", c.Params.TeamId)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), c.Params.TeamId, model.PERMISSION_INVITE_GUEST) {
c.SetPermissionError(model.PERMISSION_INVITE_GUEST)
return
@@ -1028,10 +1154,19 @@ func inviteGuestsToChannels(c *Context, w http.ResponseWriter, r *http.Request)
c.Err = err
return
}
auditRec.AddMeta("email_count", len(guestsInvite.Emails))
auditRec.AddMeta("emails", guestsInvite.Emails)
auditRec.AddMeta("channel_count", len(guestsInvite.Channels))
auditRec.AddMeta("channels", guestsInvite.Channels)
if graceful {
invitesWithError, err := c.App.InviteGuestsToChannelsGracefully(c.Params.TeamId, guestsInvite, c.App.Session().UserId)
if err != nil {
errList := make([]string, 0, len(invitesWithError))
for _, inv := range invitesWithError {
errList = append(errList, model.EmailInviteWithErrorToString(inv))
}
auditRec.AddMeta("errors", errList)
c.Err = err
return
}
@@ -1045,6 +1180,7 @@ func inviteGuestsToChannels(c *Context, w http.ResponseWriter, r *http.Request)
}
ReturnStatusOK(w)
}
auditRec.Success()
}
func getInviteInfo(c *Context, w http.ResponseWriter, r *http.Request) {
@@ -1078,11 +1214,15 @@ func invalidateAllEmailInvites(c *Context, w http.ResponseWriter, r *http.Reques
return
}
auditRec := c.MakeAuditRecord("invalidateAllEmailInvites", audit.Fail)
defer c.LogAuditRec(auditRec)
if err := c.App.InvalidateAllEmailInvites(); err != nil {
c.Err = err
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -1131,6 +1271,10 @@ func setTeamIcon(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("setTeamIcon", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_id", c.Params.TeamId)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), c.Params.TeamId, model.PERMISSION_MANAGE_TEAM) {
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
return
@@ -1166,7 +1310,9 @@ func setTeamIcon(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}
@@ -1176,6 +1322,10 @@ func removeTeamIcon(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("removeTeamIcon", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_id", c.Params.TeamId)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), c.Params.TeamId, model.PERMISSION_MANAGE_TEAM) {
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
return
@@ -1186,7 +1336,9 @@ func removeTeamIcon(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}
@@ -1202,6 +1354,10 @@ func updateTeamScheme(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateTeamScheme", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("team_id", c.Params.TeamId)
if c.App.License() == nil {
c.Err = model.NewAppError("Api4.UpdateTeamScheme", "api.team.update_team_scheme.license.error", nil, "", http.StatusNotImplemented)
return
@@ -1218,6 +1374,9 @@ func updateTeamScheme(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("scheme_id", scheme.Id)
auditRec.AddMeta("scheme_name", scheme.Name)
auditRec.AddMeta("scheme_display", scheme.DisplayName)
if scheme.Scope != model.SCHEME_SCOPE_TEAM {
c.Err = model.NewAppError("Api4.UpdateTeamScheme", "api.team.update_team_scheme.scheme_scope.error", nil, "", http.StatusBadRequest)
@@ -1230,6 +1389,8 @@ func updateTeamScheme(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("team_name", team.Name)
auditRec.AddMeta("team_display", team.DisplayName)
team.SchemeId = schemeID
@@ -1239,6 +1400,7 @@ func updateTeamScheme(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}

5
api4/terms_of_service.go
Просмотреть файл

@@ -7,6 +7,7 @@ import (
"net/http"
"github.com/mattermost/mattermost-server/v5/app"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -36,6 +37,9 @@ func createTermsOfService(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("createTermsOfService", audit.Fail)
defer c.LogAuditRec(auditRec)
props := model.MapFromJson(r.Body)
text := props["text"]
userId := c.App.Session().UserId
@@ -62,4 +66,5 @@ func createTermsOfService(c *Context, w http.ResponseWriter, r *http.Request) {
} else {
w.Write([]byte(oldTermsOfService.ToJson()))
}
auditRec.Success()
}

199
api4/user.go
Просмотреть файл

@@ -14,6 +14,7 @@ import (
"time"
"github.com/mattermost/mattermost-server/v5/app"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/mlog"
"github.com/mattermost/mattermost-server/v5/model"
"github.com/mattermost/mattermost-server/v5/store"
@@ -92,6 +93,11 @@ func createUser(c *Context, w http.ResponseWriter, r *http.Request) {
tokenId := r.URL.Query().Get("t")
inviteId := r.URL.Query().Get("iid")
auditRec := c.MakeAuditRecord("createUser", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("invite_id", inviteId)
auditRec.AddMeta("create_username", user.Username)
// No permission check required
var ruser *model.User
@@ -103,6 +109,7 @@ func createUser(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = model.NewAppError("CreateUserWithToken", "api.user.create_user.signup_link_invalid.app_error", nil, err.Error(), http.StatusBadRequest)
return
}
auditRec.AddMeta("token_type", token.Type)
if token.Type == app.TOKEN_TYPE_GUEST_INVITATION {
if c.App.License() == nil {
@@ -119,6 +126,7 @@ func createUser(c *Context, w http.ResponseWriter, r *http.Request) {
ruser, err = c.App.CreateUserWithInviteId(user, inviteId)
} else if c.IsSystemAdmin() {
ruser, err = c.App.CreateUserAsAdmin(user)
auditRec.AddMeta("admin", true)
} else {
ruser, err = c.App.CreateUserFromSignup(user)
}
@@ -128,6 +136,9 @@ func createUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("create_user_id", ruser.Id)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(ruser.ToJson()))
}
@@ -412,13 +423,22 @@ func setProfileImage(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("setProfileImage", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("set_user_id", c.Params.UserId)
if imageArray[0] != nil {
auditRec.AddMeta("filename", imageArray[0].Filename)
}
imageData := imageArray[0]
if err := c.App.SetProfileImage(c.Params.UserId, imageData); err != nil {
c.Err = err
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}
@@ -438,18 +458,25 @@ func setDefaultProfileImage(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec := c.MakeAuditRecord("setDefaultProfileImage", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("set_user_id", c.Params.UserId)
user, err := c.App.GetUser(c.Params.UserId)
if err != nil {
c.Err = err
return
}
auditRec.AddMeta("set_username", user.Username)
if err := c.App.SetDefaultProfileImage(user); err != nil {
c.Err = err
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}
@@ -859,6 +886,10 @@ func updateUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateUser", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("update_user_id", user.Id)
if !c.App.SessionHasPermissionToUser(*c.App.Session(), user.Id) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
return
@@ -893,7 +924,11 @@ func updateUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("update_username", ruser.Username)
auditRec.AddMeta("update_email", ruser.Email)
c.LogAudit("")
w.Write([]byte(ruser.ToJson()))
}
@@ -909,6 +944,10 @@ func patchUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("patchUser", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("patch_user_id", c.Params.UserId)
if !c.App.SessionHasPermissionToUser(*c.App.Session(), c.Params.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
return
@@ -948,7 +987,12 @@ func patchUser(c *Context, w http.ResponseWriter, r *http.Request) {
}
c.App.SetAutoResponderStatus(ruser, ouser.NotifyProps)
auditRec.Success()
auditRec.AddMeta("patch_username", ruser.Username)
auditRec.AddMeta("patch_email", ruser.Email)
c.LogAudit("")
w.Write([]byte(ruser.ToJson()))
}
@@ -960,6 +1004,10 @@ func deleteUser(c *Context, w http.ResponseWriter, r *http.Request) {
userId := c.Params.UserId
auditRec := c.MakeAuditRecord("deleteUser", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("delete_user_id", c.Params.UserId)
if !c.App.SessionHasPermissionToUser(*c.App.Session(), userId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
return
@@ -976,12 +1024,14 @@ func deleteUser(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("delete_username", user.Username)
if _, err = c.App.UpdateActive(user, false); err != nil {
c.Err = err
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -999,6 +1049,11 @@ func updateUserRoles(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateUserRoles", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("update_user_id", c.Params.UserId)
auditRec.AddMeta("new_roles", newRoles)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_ROLES) {
c.SetPermissionError(model.PERMISSION_MANAGE_ROLES)
return
@@ -1009,7 +1064,9 @@ func updateUserRoles(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit(fmt.Sprintf("user=%s roles=%s", c.Params.UserId, newRoles))
ReturnStatusOK(w)
}
@@ -1027,6 +1084,11 @@ func updateUserActive(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateUserActive", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("update_user_id", c.Params.UserId)
auditRec.AddMeta("new_active", active)
// true when you're trying to de-activate yourself
isSelfDeactive := !active && c.Params.UserId == c.App.Session().UserId
@@ -1056,7 +1118,9 @@ func updateUserActive(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
}
auditRec.Success()
c.LogAudit(fmt.Sprintf("user_id=%s active=%v", user.Id, active))
if isSelfDeactive {
c.App.Srv().Go(func() {
if err = c.App.SendDeactivateAccountEmail(user.Email, user.Locale, c.App.GetSiteURL()); err != nil {
@@ -1078,6 +1142,10 @@ func updateUserAuth(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateUserAuth", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("update_user_id", c.Params.UserId)
userAuth := model.UserAuthFromJson(r.Body)
if userAuth == nil {
c.SetInvalidParam("user")
@@ -1090,7 +1158,10 @@ func updateUserAuth(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("auth_service", user.AuthService)
c.LogAudit(fmt.Sprintf("updated user %s auth to service=%v", c.Params.UserId, user.AuthService))
w.Write([]byte(user.ToJson()))
}
@@ -1134,6 +1205,10 @@ func updateUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateUserMfa", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("update_user_id", c.Params.UserId)
if c.App.Session().IsOAuth {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
c.Err.DetailedError += ", attempted access by oauth app"
@@ -1168,7 +1243,10 @@ func updateUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("activate", activate)
c.LogAudit("success - mfa updated")
ReturnStatusOK(w)
}
@@ -1210,6 +1288,9 @@ func updatePassword(c *Context, w http.ResponseWriter, r *http.Request) {
props := model.MapFromJson(r.Body)
newPassword := props["new_password"]
auditRec := c.MakeAuditRecord("updatePassword", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("update_user_id", c.Params.UserId)
c.LogAudit("attempted")
var err *model.AppError
@@ -1233,7 +1314,9 @@ func updatePassword(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("completed")
ReturnStatusOK(w)
}
@@ -1248,6 +1331,9 @@ func resetPassword(c *Context, w http.ResponseWriter, r *http.Request) {
newPassword := props["new_password"]
auditRec := c.MakeAuditRecord("resetPassword", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("token", token)
c.LogAudit("attempt - token=" + token)
if err := c.App.ResetPasswordFromToken(token, newPassword); err != nil {
@@ -1256,6 +1342,7 @@ func resetPassword(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success - token=" + token)
ReturnStatusOK(w)
@@ -1271,6 +1358,10 @@ func sendPasswordReset(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("sendPasswordReset", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("email", email)
sent, err := c.App.SendPasswordReset(email, c.App.GetSiteURL())
if err != nil {
if *c.App.Config().ServiceSettings.ExperimentalEnableHardenedMode {
@@ -1282,9 +1373,9 @@ func sendPasswordReset(c *Context, w http.ResponseWriter, r *http.Request) {
}
if sent {
auditRec.Success()
c.LogAudit("sent=" + email)
}
ReturnStatusOK(w)
}
@@ -1374,14 +1465,20 @@ func login(c *Context, w http.ResponseWriter, r *http.Request) {
}
}
c.LogAuditWithUserId(id, "attempt - login_id="+loginId)
user, err := c.App.AuthenticateUserForLogin(id, loginId, password, mfaToken, ldapOnly)
auditRec := c.MakeAuditRecord("login", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("login_id", loginId)
auditRec.AddMeta("device_id", deviceId)
c.LogAuditWithUserId(id, "attempt - login_id="+loginId)
user, err := c.App.AuthenticateUserForLogin(id, loginId, password, mfaToken, ldapOnly)
if err != nil {
c.LogAuditWithUserId(id, "failure - login_id="+loginId)
c.Err = err
return
}
auditRec.AddMeta(audit.KeyUserID, user.Id)
if user.IsGuest() {
if c.App.License() == nil {
@@ -1421,6 +1518,7 @@ func login(c *Context, w http.ResponseWriter, r *http.Request) {
user.Sanitize(map[string]bool{})
auditRec.Success()
w.Write([]byte(user.ToJson()))
}
@@ -1429,7 +1527,10 @@ func logout(c *Context, w http.ResponseWriter, r *http.Request) {
}
func Logout(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("Logout", audit.Fail)
defer c.LogAuditRec(auditRec)
c.LogAudit("")
c.RemoveSessionCookie(w, r)
if c.App.Session().Id != "" {
if err := c.App.RevokeSessionById(c.App.Session().Id); err != nil {
@@ -1438,6 +1539,7 @@ func Logout(c *Context, w http.ResponseWriter, r *http.Request) {
}
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -1471,6 +1573,10 @@ func revokeSession(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("revokeSession", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("revoke_user_id", c.Params.UserId)
if !c.App.SessionHasPermissionToUser(*c.App.Session(), c.Params.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
return
@@ -1488,6 +1594,7 @@ func revokeSession(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("device_id", session.DeviceId)
if session.UserId != c.Params.UserId {
c.SetInvalidUrlParam("user_id")
@@ -1499,6 +1606,9 @@ func revokeSession(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}
@@ -1508,6 +1618,10 @@ func revokeAllSessionsForUser(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec := c.MakeAuditRecord("revokeAllSessionsForUser", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("revoke_user_id", c.Params.UserId)
if !c.App.SessionHasPermissionToUser(*c.App.Session(), c.Params.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
return
@@ -1518,6 +1632,9 @@ func revokeAllSessionsForUser(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}
@@ -1527,11 +1644,17 @@ func revokeAllSessionsAllUsers(c *Context, w http.ResponseWriter, r *http.Reques
return
}
auditRec := c.MakeAuditRecord("revokeAllSessionsAllUsers", audit.Fail)
defer c.LogAuditRec(auditRec)
if err := c.App.RevokeSessionsFromAllUsers(); err != nil {
c.Err = err
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}
@@ -1544,6 +1667,10 @@ func attachDeviceId(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("attachDeviceId", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("device_id", deviceId)
// A special case where we logout of all other sessions with the same device id
if err := c.App.RevokeSessionsForDeviceId(c.App.Session().UserId, deviceId, c.App.Session().Id); err != nil {
c.Err = err
@@ -1581,7 +1708,9 @@ func attachDeviceId(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("")
ReturnStatusOK(w)
}
@@ -1614,12 +1743,17 @@ func verifyUserEmail(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("verifyUserEmail", audit.Fail)
defer c.LogAuditRec(auditRec)
if err := c.App.VerifyEmailFromToken(token); err != nil {
c.Err = model.NewAppError("verifyUserEmail", "api.user.verify_email.bad_link.app_error", nil, err.Error(), http.StatusBadRequest)
return
}
auditRec.Success()
c.LogAudit("Email Verified")
ReturnStatusOK(w)
}
@@ -1633,12 +1767,18 @@ func sendVerificationEmail(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("sendVerificationEmail", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("email", email)
user, err := c.App.GetUserForLogin("", email)
if err != nil {
// Don't want to leak whether the email is valid or not
ReturnStatusOK(w)
return
}
auditRec.AddMeta("send_user_id", user.Id)
auditRec.AddMeta("send_username", user.Username)
if err = c.App.SendEmailVerification(user, user.Email); err != nil {
// Don't want to leak whether the email is valid or not
@@ -1647,6 +1787,7 @@ func sendVerificationEmail(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -1657,6 +1798,12 @@ func switchAccountType(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("switchAccountType", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("email", switchRequest.Email)
auditRec.AddMeta("new_service", switchRequest.NewService)
auditRec.AddMeta("old_service", switchRequest.CurrentService)
link := ""
var err *model.AppError
@@ -1683,7 +1830,9 @@ func switchAccountType(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success")
w.Write([]byte(model.MapToJson(map[string]string{"follow_link": link})))
}
@@ -1693,6 +1842,10 @@ func createUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("createUserAccessToken", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("create_user_id", c.Params.UserId)
if c.App.Session().IsOAuth {
c.SetPermissionError(model.PERMISSION_CREATE_USER_ACCESS_TOKEN)
c.Err.DetailedError += ", attempted access by oauth app"
@@ -1731,7 +1884,10 @@ func createUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("token_id", accessToken.Id)
c.LogAudit("success - token_id=" + accessToken.Id)
w.Write([]byte(accessToken.ToJson()))
}
@@ -1833,6 +1989,9 @@ func revokeUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
c.SetInvalidParam("token_id")
}
auditRec := c.MakeAuditRecord("revokeUserAccessToken", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("token_id", tokenId)
c.LogAudit("")
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_REVOKE_USER_ACCESS_TOKEN) {
@@ -1845,6 +2004,7 @@ func revokeUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("revoke_user_id", accessToken.UserId)
if !c.App.SessionHasPermissionToUserOrBot(*c.App.Session(), accessToken.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
@@ -1856,7 +2016,9 @@ func revokeUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success - token_id=" + accessToken.Id)
ReturnStatusOK(w)
}
@@ -1868,6 +2030,9 @@ func disableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request)
c.SetInvalidParam("token_id")
}
auditRec := c.MakeAuditRecord("disableUserAccessToken", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("token_id", tokenId)
c.LogAudit("")
// No separate permission for this action for now
@@ -1881,6 +2046,7 @@ func disableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request)
c.Err = err
return
}
auditRec.AddMeta("disable_user_id", accessToken.UserId)
if !c.App.SessionHasPermissionToUserOrBot(*c.App.Session(), accessToken.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
@@ -1892,7 +2058,9 @@ func disableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec.Success()
c.LogAudit("success - token_id=" + accessToken.Id)
ReturnStatusOK(w)
}
@@ -1904,6 +2072,9 @@ func enableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
c.SetInvalidParam("token_id")
}
auditRec := c.MakeAuditRecord("enableUserAccessToken", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("token_id", tokenId)
c.LogAudit("")
// No separate permission for this action for now
@@ -1917,6 +2088,7 @@ func enableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("enabled_user_id", accessToken.UserId)
if !c.App.SessionHasPermissionToUserOrBot(*c.App.Session(), accessToken.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
@@ -1928,7 +2100,9 @@ func enableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success - token_id=" + accessToken.Id)
ReturnStatusOK(w)
}
@@ -1939,6 +2113,11 @@ func saveUserTermsOfService(c *Context, w http.ResponseWriter, r *http.Request)
termsOfServiceId := props["termsOfServiceId"].(string)
accepted := props["accepted"].(bool)
auditRec := c.MakeAuditRecord("saveUserTermsOfService", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("terms_id", termsOfServiceId)
auditRec.AddMeta("accepted", accepted)
if _, err := c.App.GetTermsOfService(termsOfServiceId); err != nil {
c.Err = err
return
@@ -1949,7 +2128,9 @@ func saveUserTermsOfService(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec.Success()
c.LogAudit("TermsOfServiceId=" + termsOfServiceId + ", accepted=" + strconv.FormatBool(accepted))
ReturnStatusOK(w)
}
@@ -1969,6 +2150,10 @@ func promoteGuestToUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("promoteGuestToUser", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("promote_user_id", c.Params.UserId)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_PROMOTE_GUEST) {
c.SetPermissionError(model.PERMISSION_PROMOTE_GUEST)
return
@@ -1979,6 +2164,7 @@ func promoteGuestToUser(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("promote_username", user.Username)
if !user.IsGuest() {
c.Err = model.NewAppError("Api4.promoteGuestToUser", "api.user.promote_guest_to_user.no_guest.app_error", nil, "", http.StatusNotImplemented)
@@ -1990,6 +2176,7 @@ func promoteGuestToUser(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -2009,6 +2196,10 @@ func demoteUserToGuest(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("demoteUserToGuest", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("demote_user_id", c.Params.UserId)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_DEMOTE_TO_GUEST) {
c.SetPermissionError(model.PERMISSION_DEMOTE_TO_GUEST)
return
@@ -2019,6 +2210,7 @@ func demoteUserToGuest(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("demote_username", user.Username)
if user.IsGuest() {
c.Err = model.NewAppError("Api4.demoteUserToGuest", "api.user.demote_user_to_guest.already_guest.app_error", nil, "", http.StatusNotImplemented)
@@ -2030,5 +2222,6 @@ func demoteUserToGuest(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}

79
api4/webhook.go
Просмотреть файл

@@ -6,6 +6,7 @@ package api4
import (
"net/http"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/model"
)
@@ -37,6 +38,11 @@ func createIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("createIncomingHook", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
auditRec.AddMeta("team_id", channel.TeamId)
c.LogAudit("attempt")
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), channel.TeamId, model.PERMISSION_MANAGE_INCOMING_WEBHOOKS) {
@@ -56,7 +62,11 @@ func createIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("hook_id", incomingHook.Id)
auditRec.AddMeta("hook_display", incomingHook.DisplayName)
c.LogAudit("success")
w.WriteHeader(http.StatusCreated)
w.Write([]byte(incomingHook.ToJson()))
}
@@ -79,6 +89,9 @@ func updateIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateIncomingHook", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("hook_id", c.Params.HookId)
c.LogAudit("attempt")
oldHook, err := c.App.GetIncomingWebhook(c.Params.HookId)
@@ -86,6 +99,7 @@ func updateIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("team_id", oldHook.TeamId)
if updatedHook.TeamId == "" {
updatedHook.TeamId = oldHook.TeamId
@@ -101,6 +115,8 @@ func updateIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
if channel.TeamId != updatedHook.TeamId {
c.SetInvalidParam("channel_id")
@@ -130,7 +146,9 @@ func updateIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success")
w.WriteHeader(http.StatusCreated)
w.Write([]byte(incomingHook.ToJson()))
}
@@ -194,6 +212,14 @@ func getIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("getIncomingHook", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("hook_id", hook.Id)
auditRec.AddMeta("hook_display", hook.DisplayName)
auditRec.AddMeta("channel_id", hook.ChannelId)
auditRec.AddMeta("team_id", hook.TeamId)
c.LogAudit("attempt")
channel, err = c.App.GetChannel(hook.ChannelId)
if err != nil {
c.Err = err
@@ -213,6 +239,9 @@ func getIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success")
w.Write([]byte(hook.ToJson()))
}
@@ -240,6 +269,14 @@ func deleteIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("deleteIncomingHook", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("hook_id", hook.Id)
auditRec.AddMeta("hook_display", hook.DisplayName)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
auditRec.AddMeta("team_id", hook.TeamId)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), hook.TeamId, model.PERMISSION_MANAGE_INCOMING_WEBHOOKS) ||
(channel.Type != model.CHANNEL_OPEN && !c.App.SessionHasPermissionToChannel(*c.App.Session(), hook.ChannelId, model.PERMISSION_READ_CHANNEL)) {
c.LogAudit("fail - bad permissions")
@@ -258,6 +295,7 @@ func deleteIncomingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -279,6 +317,12 @@ func updateOutgoingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateOutgoingHook", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("hook_id", updatedHook.Id)
auditRec.AddMeta("hook_display", updatedHook.DisplayName)
auditRec.AddMeta("channel_id", updatedHook.ChannelId)
auditRec.AddMeta("team_id", updatedHook.TeamId)
c.LogAudit("attempt")
oldHook, err := c.App.GetOutgoingWebhook(c.Params.HookId)
@@ -315,7 +359,9 @@ func updateOutgoingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success")
w.Write([]byte(rhook.ToJson()))
}
@@ -326,6 +372,9 @@ func createOutgoingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("createOutgoingHook", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("hook_id", hook.Id)
c.LogAudit("attempt")
hook.CreatorId = c.App.Session().UserId
@@ -342,7 +391,12 @@ func createOutgoingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("hook_display", rhook.DisplayName)
auditRec.AddMeta("channel_id", rhook.ChannelId)
auditRec.AddMeta("team_id", rhook.TeamId)
c.LogAudit("success")
w.WriteHeader(http.StatusCreated)
w.Write([]byte(rhook.ToJson()))
}
@@ -413,6 +467,12 @@ func getOutgoingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("getOutgoingHook", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("hook_id", hook.Id)
auditRec.AddMeta("hook_display", hook.DisplayName)
auditRec.AddMeta("channel_id", hook.ChannelId)
auditRec.AddMeta("team_id", hook.TeamId)
c.LogAudit("attempt")
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), hook.TeamId, model.PERMISSION_MANAGE_OUTGOING_WEBHOOKS) {
@@ -426,7 +486,9 @@ func getOutgoingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success")
w.Write([]byte(hook.ToJson()))
}
@@ -442,6 +504,12 @@ func regenOutgoingHookToken(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec := c.MakeAuditRecord("regenOutgoingHookToken", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("hook_id", hook.Id)
auditRec.AddMeta("hook_display", hook.DisplayName)
auditRec.AddMeta("channel_id", hook.ChannelId)
auditRec.AddMeta("team_id", hook.TeamId)
c.LogAudit("attempt")
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), hook.TeamId, model.PERMISSION_MANAGE_OUTGOING_WEBHOOKS) {
@@ -461,6 +529,9 @@ func regenOutgoingHookToken(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec.Success()
c.LogAudit("success")
w.Write([]byte(rhook.ToJson()))
}
@@ -476,6 +547,12 @@ func deleteOutgoingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("deleteOutgoingHook", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("hook_id", hook.Id)
auditRec.AddMeta("hook_display", hook.DisplayName)
auditRec.AddMeta("channel_id", hook.ChannelId)
auditRec.AddMeta("team_id", hook.TeamId)
c.LogAudit("attempt")
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), hook.TeamId, model.PERMISSION_MANAGE_OUTGOING_WEBHOOKS) {
@@ -495,6 +572,8 @@ func deleteOutgoingHook(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("success")
ReturnStatusOK(w)
}