mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

MM-22273 New auditing system (phase 1) (#13967)

Просмотр исходного кода 
* New auditing API outputting to syslog via TLS

* New config section for specifying remote syslog server IP, port, and cert.

* Legacy audit API retained for access history feature
Этот коммит содержится в:
Doug Lauder
2020-03-12 15:50:21 -04:00
коммит произвёл GitHub
родитель bd1e7f2265
Коммит 4ac0619c90
156 изменённых файлов: 16991 добавлений и 49 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

115
api4/channel.go
Просмотреть файл

@@ -8,6 +8,7 @@ import (
"net/http"
"strings"
"github.com/mattermost/mattermost-server/v5/audit"
"github.com/mattermost/mattermost-server/v5/mlog"
"github.com/mattermost/mattermost-server/v5/model"
"github.com/mattermost/mattermost-server/v5/store"
@@ -70,6 +71,10 @@ func createChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("createChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_name", channel.Name)
if channel.Type == model.CHANNEL_OPEN && !c.App.SessionHasPermissionToTeam(*c.App.Session(), channel.TeamId, model.PERMISSION_CREATE_PUBLIC_CHANNEL) {
c.SetPermissionError(model.PERMISSION_CREATE_PUBLIC_CHANNEL)
return
@@ -86,7 +91,10 @@ func createChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("channel_id", sc.Id)
c.LogAudit("name=" + channel.Name)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(sc.ToJson()))
}
@@ -110,6 +118,10 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
originalOldChannel, err := c.App.GetChannel(channel.Id)
if err != nil {
c.Err = err
@@ -117,6 +129,8 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
}
oldChannel := originalOldChannel.DeepCopy()
auditRec.AddMeta("channel_name", oldChannel.Name)
switch oldChannel.Type {
case model.CHANNEL_OPEN:
if !c.App.SessionHasPermissionToChannel(*c.App.Session(), c.Params.ChannelId, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES) {
@@ -170,6 +184,7 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
if len(channel.Name) > 0 {
oldChannel.Name = channel.Name
auditRec.AddMeta("new_channel_name", oldChannel.Name)
}
if channel.GroupConstrained != nil {
@@ -187,7 +202,9 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
}
}
auditRec.Success()
c.LogAudit("name=" + channel.Name)
w.Write([]byte(oldChannel.ToJson()))
}
@@ -203,6 +220,11 @@ func convertChannelToPrivate(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec := c.MakeAuditRecord("convertChannelToPrivate", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", oldPublicChannel.Id)
auditRec.AddMeta("channel_name", oldPublicChannel.Name)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), oldPublicChannel.TeamId, model.PERMISSION_MANAGE_TEAM) {
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
return
@@ -232,7 +254,9 @@ func convertChannelToPrivate(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec.Success()
c.LogAudit("name=" + rchannel.Name)
w.Write([]byte(rchannel.ToJson()))
}
@@ -255,6 +279,13 @@ func updateChannelPrivacy(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateChannelPrivacy", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
auditRec.AddMeta("channel_type", channel.Type)
auditRec.AddMeta("new_channel_type", privacy)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), channel.TeamId, model.PERMISSION_MANAGE_TEAM) {
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
return
@@ -279,6 +310,7 @@ func updateChannelPrivacy(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("name=" + updatedChannel.Name)
w.Write([]byte(updatedChannel.ToJson()))
@@ -303,6 +335,11 @@ func patchChannel(c *Context, w http.ResponseWriter, r *http.Request) {
}
oldChannel := originalOldChannel.DeepCopy()
auditRec := c.MakeAuditRecord("patchChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", oldChannel.Id)
auditRec.AddMeta("channel_name", oldChannel.Name)
switch oldChannel.Type {
case model.CHANNEL_OPEN:
if !c.App.SessionHasPermissionToChannel(*c.App.Session(), c.Params.ChannelId, model.PERMISSION_MANAGE_PUBLIC_CHANNEL_PROPERTIES) {
@@ -340,7 +377,9 @@ func patchChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("")
w.Write([]byte(rchannel.ToJson()))
}
@@ -357,6 +396,11 @@ func restoreChannel(c *Context, w http.ResponseWriter, r *http.Request) {
}
teamId := channel.TeamId
auditRec := c.MakeAuditRecord("restoreChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), teamId, model.PERMISSION_MANAGE_TEAM) {
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
return
@@ -368,9 +412,10 @@ func restoreChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("name=" + channel.Name)
w.Write([]byte(channel.ToJson()))
w.Write([]byte(channel.ToJson()))
}
func createDirectChannel(c *Context, w http.ResponseWriter, r *http.Request) {
@@ -392,6 +437,9 @@ func createDirectChannel(c *Context, w http.ResponseWriter, r *http.Request) {
}
}
auditRec := c.MakeAuditRecord("createDirectChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_CREATE_DIRECT_CHANNEL) {
c.SetPermissionError(model.PERMISSION_CREATE_DIRECT_CHANNEL)
return
@@ -407,6 +455,8 @@ func createDirectChannel(c *Context, w http.ResponseWriter, r *http.Request) {
otherUserId = userIds[1]
}
auditRec.AddMeta("other_user_id", otherUserId)
canSee, err := c.App.UserCanSeeOtherUser(c.App.Session().UserId, otherUserId)
if err != nil {
c.Err = err
@@ -424,6 +474,10 @@ func createDirectChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("channel_id", sc.Id)
auditRec.AddMeta("channel_name", sc.Name)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(sc.ToJson()))
}
@@ -467,6 +521,9 @@ func createGroupChannel(c *Context, w http.ResponseWriter, r *http.Request) {
userIds = append(userIds, c.App.Session().UserId)
}
auditRec := c.MakeAuditRecord("createGroupChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_CREATE_GROUP_CHANNEL) {
c.SetPermissionError(model.PERMISSION_CREATE_GROUP_CHANNEL)
return
@@ -497,6 +554,10 @@ func createGroupChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("channel_id", groupChannel.Id)
auditRec.AddMeta("channel_name", groupChannel.Name)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(groupChannel.ToJson()))
}
@@ -949,6 +1010,11 @@ func deleteChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("deleteChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
if channel.Type == model.CHANNEL_DIRECT || channel.Type == model.CHANNEL_GROUP {
c.Err = model.NewAppError("deleteChannel", "api.channel.delete_channel.type.invalid", nil, "", http.StatusBadRequest)
return
@@ -970,6 +1036,7 @@ func deleteChannel(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("name=" + channel.Name)
ReturnStatusOK(w)
@@ -1208,6 +1275,11 @@ func updateChannelMemberRoles(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec := c.MakeAuditRecord("updateChannelMemberRoles", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", c.Params.ChannelId)
auditRec.AddMeta("roles", newRoles)
if !c.App.SessionHasPermissionToChannel(*c.App.Session(), c.Params.ChannelId, model.PERMISSION_MANAGE_CHANNEL_ROLES) {
c.SetPermissionError(model.PERMISSION_MANAGE_CHANNEL_ROLES)
return
@@ -1218,6 +1290,8 @@ func updateChannelMemberRoles(c *Context, w http.ResponseWriter, r *http.Request
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -1233,6 +1307,11 @@ func updateChannelMemberSchemeRoles(c *Context, w http.ResponseWriter, r *http.R
return
}
auditRec := c.MakeAuditRecord("updateChannelMemberSchemeRoles", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", c.Params.ChannelId)
auditRec.AddMeta("roles", schemeRoles)
if !c.App.SessionHasPermissionToChannel(*c.App.Session(), c.Params.ChannelId, model.PERMISSION_MANAGE_CHANNEL_ROLES) {
c.SetPermissionError(model.PERMISSION_MANAGE_CHANNEL_ROLES)
return
@@ -1243,6 +1322,8 @@ func updateChannelMemberSchemeRoles(c *Context, w http.ResponseWriter, r *http.R
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -1258,6 +1339,11 @@ func updateChannelMemberNotifyProps(c *Context, w http.ResponseWriter, r *http.R
return
}
auditRec := c.MakeAuditRecord("updateChannelMemberNotifyProps", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", c.Params.ChannelId)
auditRec.AddMeta("props", props)
if !c.App.SessionHasPermissionToUser(*c.App.Session(), c.Params.UserId) {
c.SetPermissionError(model.PERMISSION_EDIT_OTHER_USERS)
return
@@ -1269,6 +1355,8 @@ func updateChannelMemberNotifyProps(c *Context, w http.ResponseWriter, r *http.R
return
}
auditRec.Success()
ReturnStatusOK(w)
}
@@ -1314,6 +1402,11 @@ func addChannelMember(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("addChannelMember", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
if channel.Type == model.CHANNEL_DIRECT || channel.Type == model.CHANNEL_GROUP {
c.Err = model.NewAppError("addUserToChannel", "api.channel.add_user_to_channel.type.app_error", nil, "", http.StatusBadRequest)
return
@@ -1385,7 +1478,10 @@ func addChannelMember(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
auditRec.AddMeta("add_user_id", cm.UserId)
c.LogAudit("name=" + channel.Name + " user_id=" + cm.UserId)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(cm.ToJson()))
}
@@ -1408,6 +1504,12 @@ func removeChannelMember(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("removeChannelMember", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
auditRec.AddMeta("remove_user_id", user.Id)
if !(channel.Type == model.CHANNEL_OPEN || channel.Type == model.CHANNEL_PRIVATE) {
c.Err = model.NewAppError("removeChannelMember", "api.channel.remove_channel_member.type.app_error", nil, "", http.StatusBadRequest)
return
@@ -1435,6 +1537,7 @@ func removeChannelMember(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
c.LogAudit("name=" + channel.Name + " user_id=" + c.Params.UserId)
ReturnStatusOK(w)
@@ -1452,6 +1555,10 @@ func updateChannelScheme(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec := c.MakeAuditRecord("updateChannelScheme", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("new_scheme_id", schemeID)
if c.App.License() == nil {
c.Err = model.NewAppError("Api4.UpdateChannelScheme", "api.channel.update_channel_scheme.license.error", nil, "", http.StatusNotImplemented)
return
@@ -1479,6 +1586,10 @@ func updateChannelScheme(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
auditRec.AddMeta("old_scheme_id", channel.SchemeId)
channel.SchemeId = &scheme.Id
_, err = c.App.UpdateChannelScheme(channel)
@@ -1487,6 +1598,8 @@ func updateChannelScheme(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.Success()
ReturnStatusOK(w)
}