mirrors/mostlymatter
1
0
Форкнуть 0
Код Задачи Запросы на слияние Действия Пакеты Проекты Релизы Вики Активность

MM-22785 audit server CLI (#14144)

Просмотр исходного кода 
Add auditing to server CLI.

Also:
- simplify auditing in API layer
- reduce number of AddMeta calls
- have models serialize themselves
- more consistent field naming
Этот коммит содержится в:
Doug Lauder
2020-04-08 00:52:30 -04:00
коммит произвёл GitHub
родитель e2d1af17de
Коммит 6a27ed4a1d
45 изменённых файлов: 1488 добавлений и 244 удалений
Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

55
api4/channel.go
Просмотреть файл

@@ -73,7 +73,7 @@ func createChannel(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("createChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_name", channel.Name)
auditRec.AddMeta("channel", channel)
if channel.Type == model.CHANNEL_OPEN && !c.App.SessionHasPermissionToTeam(*c.App.Session(), channel.TeamId, model.PERMISSION_CREATE_PUBLIC_CHANNEL) {
c.SetPermissionError(model.PERMISSION_CREATE_PUBLIC_CHANNEL)
@@ -92,7 +92,7 @@ func createChannel(c *Context, w http.ResponseWriter, r *http.Request) {
}
auditRec.Success()
auditRec.AddMeta("channel_id", sc.Id)
auditRec.AddMeta("channel", sc) // overwrite meta
c.LogAudit("name=" + channel.Name)
w.WriteHeader(http.StatusCreated)
@@ -120,7 +120,6 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("updateChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
originalOldChannel, err := c.App.GetChannel(channel.Id)
if err != nil {
@@ -129,7 +128,7 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
}
oldChannel := originalOldChannel.DeepCopy()
auditRec.AddMeta("channel_name", oldChannel.Name)
auditRec.AddMeta("channel", oldChannel)
switch oldChannel.Type {
case model.CHANNEL_OPEN:
@@ -146,7 +145,7 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
case model.CHANNEL_GROUP, model.CHANNEL_DIRECT:
// Modifying the header is not linked to any specific permission for group/dm channels, so just check for membership.
if _, err := c.App.GetChannelMember(channel.Id, c.App.Session().UserId); err != nil {
if _, errGet := c.App.GetChannelMember(channel.Id, c.App.Session().UserId); errGet != nil {
c.Err = model.NewAppError("updateChannel", "api.channel.patch_update_channel.forbidden.app_error", nil, "", http.StatusForbidden)
return
}
@@ -191,10 +190,12 @@ func updateChannel(c *Context, w http.ResponseWriter, r *http.Request) {
oldChannel.GroupConstrained = channel.GroupConstrained
}
if _, err := c.App.UpdateChannel(oldChannel); err != nil {
updatedChannel, err := c.App.UpdateChannel(oldChannel)
if err != nil {
c.Err = err
return
}
auditRec.AddMeta("update", updatedChannel)
if oldChannelDisplayName != channel.DisplayName {
if err := c.App.PostUpdateChannelDisplayNameMessage(c.App.Session().UserId, channel, oldChannelDisplayName, channel.DisplayName); err != nil {
@@ -222,8 +223,7 @@ func convertChannelToPrivate(c *Context, w http.ResponseWriter, r *http.Request)
auditRec := c.MakeAuditRecord("convertChannelToPrivate", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", oldPublicChannel.Id)
auditRec.AddMeta("channel_name", oldPublicChannel.Name)
auditRec.AddMeta("channel", oldPublicChannel)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), oldPublicChannel.TeamId, model.PERMISSION_MANAGE_TEAM) {
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
@@ -245,6 +245,7 @@ func convertChannelToPrivate(c *Context, w http.ResponseWriter, r *http.Request)
c.Err = err
return
}
auditRec.AddMeta("user", user)
oldPublicChannel.Type = model.CHANNEL_PRIVATE
@@ -281,10 +282,8 @@ func updateChannelPrivacy(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("updateChannelPrivacy", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
auditRec.AddMeta("channel_type", channel.Type)
auditRec.AddMeta("new_channel_type", privacy)
auditRec.AddMeta("channel", channel)
auditRec.AddMeta("new_type", privacy)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), channel.TeamId, model.PERMISSION_MANAGE_TEAM) {
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
@@ -301,6 +300,7 @@ func updateChannelPrivacy(c *Context, w http.ResponseWriter, r *http.Request) {
c.Err = err
return
}
auditRec.AddMeta("user", user)
channel.Type = privacy
@@ -337,8 +337,7 @@ func patchChannel(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("patchChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", oldChannel.Id)
auditRec.AddMeta("channel_name", oldChannel.Name)
auditRec.AddMeta("channel", oldChannel)
switch oldChannel.Type {
case model.CHANNEL_OPEN:
@@ -379,6 +378,7 @@ func patchChannel(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec.Success()
c.LogAudit("")
auditRec.AddMeta("patch", rchannel)
w.Write([]byte(rchannel.ToJson()))
}
@@ -398,8 +398,7 @@ func restoreChannel(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("restoreChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
auditRec.AddMeta("channel", channel)
if !c.App.SessionHasPermissionToTeam(*c.App.Session(), teamId, model.PERMISSION_MANAGE_TEAM) {
c.SetPermissionError(model.PERMISSION_MANAGE_TEAM)
@@ -475,8 +474,7 @@ func createDirectChannel(c *Context, w http.ResponseWriter, r *http.Request) {
}
auditRec.Success()
auditRec.AddMeta("channel_id", sc.Id)
auditRec.AddMeta("channel_name", sc.Name)
auditRec.AddMeta("channel", sc)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(sc.ToJson()))
@@ -555,8 +553,7 @@ func createGroupChannel(c *Context, w http.ResponseWriter, r *http.Request) {
}
auditRec.Success()
auditRec.AddMeta("channel_id", groupChannel.Id)
auditRec.AddMeta("channel_name", groupChannel.Name)
auditRec.AddMeta("channel", groupChannel)
w.WriteHeader(http.StatusCreated)
w.Write([]byte(groupChannel.ToJson()))
@@ -1012,8 +1009,7 @@ func deleteChannel(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("deleteChannel", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
auditRec.AddMeta("channeld", channel)
if channel.Type == model.CHANNEL_DIRECT || channel.Type == model.CHANNEL_GROUP {
c.Err = model.NewAppError("deleteChannel", "api.channel.delete_channel.type.invalid", nil, "", http.StatusBadRequest)
@@ -1404,8 +1400,7 @@ func addChannelMember(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("addChannelMember", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
auditRec.AddMeta("channel", channel)
if channel.Type == model.CHANNEL_DIRECT || channel.Type == model.CHANNEL_GROUP {
c.Err = model.NewAppError("addUserToChannel", "api.channel.add_user_to_channel.type.app_error", nil, "", http.StatusBadRequest)
@@ -1506,8 +1501,7 @@ func removeChannelMember(c *Context, w http.ResponseWriter, r *http.Request) {
auditRec := c.MakeAuditRecord("removeChannelMember", audit.Fail)
defer c.LogAuditRec(auditRec)
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
auditRec.AddMeta("channel", channel)
auditRec.AddMeta("remove_user_id", user.Id)
if !(channel.Type == model.CHANNEL_OPEN || channel.Type == model.CHANNEL_PRIVATE) {
@@ -1586,8 +1580,7 @@ func updateChannelScheme(c *Context, w http.ResponseWriter, r *http.Request) {
return
}
auditRec.AddMeta("channel_id", channel.Id)
auditRec.AddMeta("channel_name", channel.Name)
auditRec.AddMeta("channel", channel)
auditRec.AddMeta("old_scheme_id", channel.SchemeId)
channel.SchemeId = &scheme.Id
@@ -1701,6 +1694,9 @@ func patchChannelModerations(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec := c.MakeAuditRecord("patchChannelModerations", audit.Fail)
defer c.LogAuditRec(auditRec)
if !c.App.SessionHasPermissionTo(*c.App.Session(), model.PERMISSION_MANAGE_SYSTEM) {
c.SetPermissionError(model.PERMISSION_MANAGE_SYSTEM)
return
@@ -1711,6 +1707,7 @@ func patchChannelModerations(c *Context, w http.ResponseWriter, r *http.Request)
c.Err = err
return
}
auditRec.AddMeta("channel", channel)
channelModerationsPatch := model.ChannelModerationsPatchFromJson(r.Body)
channelModerations, err := c.App.PatchChannelModerationsForChannel(channel, channelModerationsPatch)
@@ -1718,6 +1715,7 @@ func patchChannelModerations(c *Context, w http.ResponseWriter, r *http.Request)
c.Err = err
return
}
auditRec.AddMeta("patch", channelModerationsPatch)
b, marshalErr := json.Marshal(channelModerations)
if marshalErr != nil {
@@ -1725,5 +1723,6 @@ func patchChannelModerations(c *Context, w http.ResponseWriter, r *http.Request)
return
}
auditRec.Success()
w.Write(b)
}