[MM-64686] Expose audit logging functionality via plugin API (#31204)
This commit exposes audit logging functionality to plugins via the plugin API, allowing plugins to create and log audit records. Additionally, it addresses a gob encoding issue that could cause plugin crashes when audit data contains nil pointers or unregistered types.
Этот коммит содержится в:
David Krauser
коммит произвёл
GitHub
GitHub
родитель
efb960a160
Коммит
aaa62a40ae
@@ -18,7 +18,6 @@ import (
|
||||
"github.com/mattermost/mattermost/server/public/shared/mlog"
|
||||
|
||||
"github.com/mattermost/mattermost/server/v8/channels/app"
|
||||
"github.com/mattermost/mattermost/server/v8/channels/audit"
|
||||
"github.com/mattermost/mattermost/server/v8/channels/store"
|
||||
"github.com/mattermost/mattermost/server/v8/channels/utils"
|
||||
)
|
||||
@@ -124,11 +123,11 @@ func createUser(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
inviteId := r.URL.Query().Get("iid")
|
||||
redirect := r.URL.Query().Get("r")
|
||||
|
||||
auditRec := c.MakeAuditRecord("createUser", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("createUser", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "invite_id", inviteId)
|
||||
audit.AddEventParameter(auditRec, "redirect", redirect)
|
||||
audit.AddEventParameterAuditable(auditRec, "user", &user)
|
||||
model.AddEventParameterToAuditRec(auditRec, "invite_id", inviteId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "redirect", redirect)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "user", &user)
|
||||
|
||||
// No permission check required
|
||||
|
||||
@@ -471,10 +470,10 @@ func setProfileImage(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("setProfileImage", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("setProfileImage", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
if imageArray[0] != nil {
|
||||
audit.AddEventParameter(auditRec, "filename", imageArray[0].Filename)
|
||||
model.AddEventParameterToAuditRec(auditRec, "filename", imageArray[0].Filename)
|
||||
}
|
||||
|
||||
user, err := c.App.GetUser(c.Params.UserId)
|
||||
@@ -520,8 +519,8 @@ func setDefaultProfileImage(c *Context, w http.ResponseWriter, r *http.Request)
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("setDefaultProfileImage", audit.Fail)
|
||||
audit.AddEventParameter(auditRec, "user_id", c.Params.UserId)
|
||||
auditRec := c.MakeAuditRecord("setDefaultProfileImage", model.AuditStatusFail)
|
||||
model.AddEventParameterToAuditRec(auditRec, "user_id", c.Params.UserId)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
|
||||
user, err := c.App.GetUser(c.Params.UserId)
|
||||
@@ -529,7 +528,7 @@ func setDefaultProfileImage(c *Context, w http.ResponseWriter, r *http.Request)
|
||||
c.Err = err
|
||||
return
|
||||
}
|
||||
audit.AddEventParameterAuditable(auditRec, "user", user)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "user", user)
|
||||
|
||||
if err := c.App.SetDefaultProfileImage(c.AppContext, user); err != nil {
|
||||
c.Err = err
|
||||
@@ -1248,7 +1247,7 @@ func updateUser(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("updateUser", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("updateUser", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
|
||||
var user model.User
|
||||
@@ -1257,7 +1256,7 @@ func updateUser(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
audit.AddEventParameterAuditable(auditRec, "user", &user)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "user", &user)
|
||||
// The user being updated in the payload must be the same one as indicated in the URL.
|
||||
if user.Id != c.Params.UserId {
|
||||
c.SetInvalidParam("user_id")
|
||||
@@ -1337,8 +1336,8 @@ func patchUser(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("patchUser", audit.Fail)
|
||||
audit.AddEventParameterAuditable(auditRec, "user_patch", &patch)
|
||||
auditRec := c.MakeAuditRecord("patchUser", model.AuditStatusFail)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "user_patch", &patch)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
|
||||
if !c.App.SessionHasPermissionToUserOrBot(c.AppContext, *c.AppContext.Session(), c.Params.UserId) {
|
||||
@@ -1416,9 +1415,9 @@ func deleteUser(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
userId := c.Params.UserId
|
||||
permanent := c.Params.Permanent
|
||||
|
||||
auditRec := c.MakeAuditRecord("deleteUser", audit.Fail)
|
||||
audit.AddEventParameter(auditRec, "user_id", userId)
|
||||
audit.AddEventParameter(auditRec, "permanent", permanent)
|
||||
auditRec := c.MakeAuditRecord("deleteUser", model.AuditStatusFail)
|
||||
model.AddEventParameterToAuditRec(auditRec, "user_id", userId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "permanent", permanent)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
|
||||
if !c.App.SessionHasPermissionToUserOrBot(c.AppContext, *c.AppContext.Session(), userId) {
|
||||
@@ -1490,8 +1489,8 @@ func updateUserRoles(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("updateUserRoles", audit.Fail)
|
||||
audit.AddEventParameter(auditRec, "roles", newRoles)
|
||||
auditRec := c.MakeAuditRecord("updateUserRoles", model.AuditStatusFail)
|
||||
model.AddEventParameterToAuditRec(auditRec, "roles", newRoles)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
|
||||
if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionManageRoles) {
|
||||
@@ -1527,9 +1526,9 @@ func updateUserActive(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("updateUserActive", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("updateUserActive", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "active", active)
|
||||
model.AddEventParameterToAuditRec(auditRec, "active", active)
|
||||
|
||||
// true when you're trying to de-activate yourself
|
||||
isSelfDeactivate := !active && c.Params.UserId == c.AppContext.Session().UserId
|
||||
@@ -1601,7 +1600,7 @@ func updateUserAuth(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("updateUserAuth", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("updateUserAuth", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
|
||||
var userAuth model.UserAuth
|
||||
@@ -1610,7 +1609,7 @@ func updateUserAuth(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
audit.AddEventParameterAuditable(auditRec, "user_auth", &userAuth)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "user_auth", &userAuth)
|
||||
|
||||
if userAuth.AuthData == nil || *userAuth.AuthData == "" || userAuth.AuthService == "" {
|
||||
c.Err = model.NewAppError("updateUserAuth", "api.user.update_user_auth.invalid_request", nil, "", http.StatusBadRequest)
|
||||
@@ -1643,7 +1642,7 @@ func updateUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("updateUserMfa", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("updateUserMfa", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
|
||||
if c.AppContext.Session().IsOAuth {
|
||||
@@ -1663,7 +1662,7 @@ func updateUserMfa(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
|
||||
if user, appErr := c.App.GetUser(c.Params.UserId); appErr == nil {
|
||||
audit.AddEventParameterAuditable(auditRec, "user", user)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "user", user)
|
||||
}
|
||||
|
||||
props := model.StringInterfaceFromJSON(r.Body)
|
||||
@@ -1736,13 +1735,13 @@ func updatePassword(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
props := model.MapFromJSON(r.Body)
|
||||
newPassword := props["new_password"]
|
||||
|
||||
auditRec := c.MakeAuditRecord("updatePassword", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("updatePassword", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
c.LogAudit("attempted")
|
||||
|
||||
var canUpdatePassword bool
|
||||
if user, err := c.App.GetUser(c.Params.UserId); err == nil {
|
||||
audit.AddEventParameterAuditable(auditRec, "user", user)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "user", user)
|
||||
|
||||
if user.IsSystemAdmin() {
|
||||
canUpdatePassword = c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionManageSystem)
|
||||
@@ -1802,7 +1801,7 @@ func resetPassword(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
|
||||
newPassword := props["new_password"]
|
||||
|
||||
auditRec := c.MakeAuditRecord("resetPassword", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("resetPassword", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
c.LogAudit("attempt - token=" + token)
|
||||
|
||||
@@ -1828,9 +1827,9 @@ func sendPasswordReset(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("sendPasswordReset", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("sendPasswordReset", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "email", email)
|
||||
model.AddEventParameterToAuditRec(auditRec, "email", email)
|
||||
|
||||
sent, err := c.App.SendPasswordReset(c.AppContext, email, c.App.GetSiteURL())
|
||||
if err != nil {
|
||||
@@ -1937,10 +1936,10 @@ func login(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("login", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("login", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "login_id", loginId)
|
||||
audit.AddEventParameter(auditRec, "device_id", deviceId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "login_id", loginId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "device_id", deviceId)
|
||||
|
||||
c.LogAuditWithUserId(id, "attempt - login_id="+loginId)
|
||||
|
||||
@@ -2065,9 +2064,9 @@ func loginCWS(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("login", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("login", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "login_id", loginID)
|
||||
model.AddEventParameterToAuditRec(auditRec, "login_id", loginID)
|
||||
user, err := c.App.AuthenticateUserForLogin(c.AppContext, "", loginID, "", "", token, false)
|
||||
if err != nil {
|
||||
c.LogAuditWithUserId("", "failure - login_id="+loginID)
|
||||
@@ -2075,7 +2074,7 @@ func loginCWS(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
http.Redirect(w, r, *c.App.Config().ServiceSettings.SiteURL, http.StatusFound)
|
||||
return
|
||||
}
|
||||
audit.AddEventParameterAuditable(auditRec, "user", user)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "user", user)
|
||||
c.LogAuditWithUserId(user.Id, "authenticated")
|
||||
isMobileDevice := utils.IsMobileRequest(r)
|
||||
session, err := c.App.DoLogin(c.AppContext, w, r, user, "", isMobileDevice, false, false)
|
||||
@@ -2108,7 +2107,7 @@ func logout(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
|
||||
func Logout(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
auditRec := c.MakeAuditRecord("Logout", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("Logout", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
c.LogAudit("")
|
||||
|
||||
@@ -2162,7 +2161,7 @@ func revokeSession(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("revokeSession", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("revokeSession", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
|
||||
if !c.App.SessionHasPermissionToUser(*c.AppContext.Session(), c.Params.UserId) {
|
||||
@@ -2176,7 +2175,7 @@ func revokeSession(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
c.SetInvalidParam("session_id")
|
||||
return
|
||||
}
|
||||
audit.AddEventParameter(auditRec, "session_id", sessionId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "session_id", sessionId)
|
||||
|
||||
session, err := c.App.GetSessionById(c.AppContext, sessionId)
|
||||
if err != nil {
|
||||
@@ -2209,9 +2208,9 @@ func revokeAllSessionsForUser(c *Context, w http.ResponseWriter, r *http.Request
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("revokeAllSessionsForUser", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("revokeAllSessionsForUser", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "user_id", c.Params.UserId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "user_id", c.Params.UserId)
|
||||
|
||||
if !c.App.SessionHasPermissionToUser(*c.AppContext.Session(), c.Params.UserId) {
|
||||
c.SetPermissionError(model.PermissionEditOtherUsers)
|
||||
@@ -2235,7 +2234,7 @@ func revokeAllSessionsAllUsers(c *Context, w http.ResponseWriter, r *http.Reques
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("revokeAllSessionsAllUsers", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("revokeAllSessionsAllUsers", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
|
||||
if err := c.App.RevokeSessionsFromAllUsers(); err != nil {
|
||||
@@ -2292,9 +2291,9 @@ func handleDeviceProps(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
|
||||
func attachDeviceId(c *Context, w http.ResponseWriter, r *http.Request, deviceId string) {
|
||||
auditRec := c.MakeAuditRecord("attachDeviceId", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("attachDeviceId", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "device_id", deviceId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "device_id", deviceId)
|
||||
|
||||
// A special case where we logout of all other sessions with the same device id
|
||||
if err := c.App.RevokeSessionsForDeviceId(c.AppContext, c.AppContext.Session().UserId, deviceId, c.AppContext.Session().Id); err != nil {
|
||||
@@ -2347,12 +2346,12 @@ func getUserAudits(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("getUserAudits", audit.Fail)
|
||||
audit.AddEventParameter(auditRec, "user_id", c.Params.UserId)
|
||||
auditRec := c.MakeAuditRecord("getUserAudits", model.AuditStatusFail)
|
||||
model.AddEventParameterToAuditRec(auditRec, "user_id", c.Params.UserId)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
|
||||
if user, err := c.App.GetUser(c.Params.UserId); err == nil {
|
||||
audit.AddEventParameterAuditable(auditRec, "user", user)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "user", user)
|
||||
}
|
||||
|
||||
if !c.App.SessionHasPermissionToUser(*c.AppContext.Session(), c.Params.UserId) {
|
||||
@@ -2384,7 +2383,7 @@ func verifyUserEmail(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("verifyUserEmail", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("verifyUserEmail", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
|
||||
if err := c.App.VerifyEmailFromToken(c.AppContext, token); err != nil {
|
||||
@@ -2409,10 +2408,10 @@ func sendVerificationEmail(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
redirect := r.URL.Query().Get("r")
|
||||
|
||||
auditRec := c.MakeAuditRecord("sendVerificationEmail", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("sendVerificationEmail", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "email", email)
|
||||
audit.AddEventParameter(auditRec, "redirect", redirect)
|
||||
model.AddEventParameterToAuditRec(auditRec, "email", email)
|
||||
model.AddEventParameterToAuditRec(auditRec, "redirect", redirect)
|
||||
|
||||
user, err := c.App.GetUserForLogin(c.AppContext, "", email)
|
||||
if err != nil {
|
||||
@@ -2440,9 +2439,9 @@ func switchAccountType(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("switchAccountType", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("switchAccountType", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameterAuditable(auditRec, "switch_request", &switchRequest)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "switch_request", &switchRequest)
|
||||
|
||||
link := ""
|
||||
var err *model.AppError
|
||||
@@ -2484,8 +2483,8 @@ func createUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("createUserAccessToken", audit.Fail)
|
||||
audit.AddEventParameter(auditRec, "user_id", c.Params.UserId)
|
||||
auditRec := c.MakeAuditRecord("createUserAccessToken", model.AuditStatusFail)
|
||||
model.AddEventParameterToAuditRec(auditRec, "user_id", c.Params.UserId)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
|
||||
user, err := c.App.GetUser(c.Params.UserId)
|
||||
@@ -2494,7 +2493,7 @@ func createUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
audit.AddEventParameterAuditable(auditRec, "user", user)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "user", user)
|
||||
|
||||
if user.IsRemote() {
|
||||
// remote/synthetic users cannot have access tokens
|
||||
@@ -2679,9 +2678,9 @@ func revokeUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
c.SetInvalidParam("token_id")
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("revokeUserAccessToken", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("revokeUserAccessToken", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "token_id", tokenId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "token_id", tokenId)
|
||||
c.LogAudit("")
|
||||
|
||||
if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionRevokeUserAccessToken) {
|
||||
@@ -2696,7 +2695,7 @@ func revokeUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
|
||||
if user, errGet := c.App.GetUser(accessToken.UserId); errGet == nil {
|
||||
audit.AddEventParameterAuditable(auditRec, "user", user)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "user", user)
|
||||
}
|
||||
|
||||
if !c.App.SessionHasPermissionToUserOrBot(c.AppContext, *c.AppContext.Session(), accessToken.UserId) {
|
||||
@@ -2723,8 +2722,8 @@ func disableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request)
|
||||
c.SetInvalidParam("token_id")
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("disableUserAccessToken", audit.Fail)
|
||||
audit.AddEventParameter(auditRec, "token_id", tokenId)
|
||||
auditRec := c.MakeAuditRecord("disableUserAccessToken", model.AuditStatusFail)
|
||||
model.AddEventParameterToAuditRec(auditRec, "token_id", tokenId)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
c.LogAudit("")
|
||||
|
||||
@@ -2741,7 +2740,7 @@ func disableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request)
|
||||
}
|
||||
|
||||
if user, errGet := c.App.GetUser(accessToken.UserId); errGet == nil {
|
||||
audit.AddEventParameterAuditable(auditRec, "user", user)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "user", user)
|
||||
}
|
||||
|
||||
if !c.App.SessionHasPermissionToUserOrBot(c.AppContext, *c.AppContext.Session(), accessToken.UserId) {
|
||||
@@ -2768,9 +2767,9 @@ func enableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
c.SetInvalidParam("token_id")
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("enableUserAccessToken", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("enableUserAccessToken", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "token_id", tokenId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "token_id", tokenId)
|
||||
c.LogAudit("")
|
||||
|
||||
// No separate permission for this action for now
|
||||
@@ -2786,7 +2785,7 @@ func enableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
|
||||
if user, errGet := c.App.GetUser(accessToken.UserId); errGet == nil {
|
||||
audit.AddEventParameterAuditable(auditRec, "user", user)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "user", user)
|
||||
}
|
||||
|
||||
if !c.App.SessionHasPermissionToUserOrBot(c.AppContext, *c.AppContext.Session(), accessToken.UserId) {
|
||||
@@ -2808,7 +2807,7 @@ func enableUserAccessToken(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
func saveUserTermsOfService(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
props := model.StringInterfaceFromJSON(r.Body)
|
||||
|
||||
auditRec := c.MakeAuditRecord("saveUserTermsOfService", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("saveUserTermsOfService", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
|
||||
userId := c.AppContext.Session().UserId
|
||||
@@ -2817,16 +2816,16 @@ func saveUserTermsOfService(c *Context, w http.ResponseWriter, r *http.Request)
|
||||
c.SetInvalidParam("termsOfServiceId")
|
||||
return
|
||||
}
|
||||
audit.AddEventParameter(auditRec, "terms_of_service_id", termsOfServiceId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "terms_of_service_id", termsOfServiceId)
|
||||
accepted, ok := props["accepted"].(bool)
|
||||
if !ok {
|
||||
c.SetInvalidParam("accepted")
|
||||
return
|
||||
}
|
||||
audit.AddEventParameter(auditRec, "accepted", accepted)
|
||||
model.AddEventParameterToAuditRec(auditRec, "accepted", accepted)
|
||||
|
||||
if user, err := c.App.GetUser(userId); err == nil {
|
||||
audit.AddEventParameterAuditable(auditRec, "user", user)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "user", user)
|
||||
}
|
||||
|
||||
if _, err := c.App.GetTermsOfService(termsOfServiceId); err != nil {
|
||||
@@ -2863,9 +2862,9 @@ func promoteGuestToUser(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("promoteGuestToUser", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("promoteGuestToUser", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "user_id", c.Params.UserId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "user_id", c.Params.UserId)
|
||||
|
||||
if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionPromoteGuest) {
|
||||
c.SetPermissionError(model.PermissionPromoteGuest)
|
||||
@@ -2916,8 +2915,8 @@ func demoteUserToGuest(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("demoteUserToGuest", audit.Fail)
|
||||
audit.AddEventParameter(auditRec, "user_id", c.Params.UserId)
|
||||
auditRec := c.MakeAuditRecord("demoteUserToGuest", model.AuditStatusFail)
|
||||
model.AddEventParameterToAuditRec(auditRec, "user_id", c.Params.UserId)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
|
||||
if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionDemoteToGuest) {
|
||||
@@ -2994,8 +2993,8 @@ func verifyUserEmailWithoutToken(c *Context, w http.ResponseWriter, r *http.Requ
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("verifyUserEmailWithoutToken", audit.Fail)
|
||||
audit.AddEventParameter(auditRec, "user_id", c.Params.UserId)
|
||||
auditRec := c.MakeAuditRecord("verifyUserEmailWithoutToken", model.AuditStatusFail)
|
||||
model.AddEventParameterToAuditRec(auditRec, "user_id", c.Params.UserId)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
auditRec.AddMeta("user_id", user.Id)
|
||||
|
||||
@@ -3029,10 +3028,10 @@ func convertUserToBot(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("convertUserToBot", audit.Fail)
|
||||
audit.AddEventParameter(auditRec, "user_id", c.Params.UserId)
|
||||
auditRec := c.MakeAuditRecord("convertUserToBot", model.AuditStatusFail)
|
||||
model.AddEventParameterToAuditRec(auditRec, "user_id", c.Params.UserId)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameterAuditable(auditRec, "user", user)
|
||||
model.AddEventParameterAuditableToAuditRec(auditRec, "user", user)
|
||||
|
||||
if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionManageSystem) {
|
||||
c.SetPermissionError(model.PermissionManageSystem)
|
||||
@@ -3183,11 +3182,11 @@ func migrateAuthToLDAP(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("migrateAuthToLdap", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("migrateAuthToLdap", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "from", from)
|
||||
audit.AddEventParameter(auditRec, "force", force)
|
||||
audit.AddEventParameter(auditRec, "match_field", matchField)
|
||||
model.AddEventParameterToAuditRec(auditRec, "from", from)
|
||||
model.AddEventParameterToAuditRec(auditRec, "force", force)
|
||||
model.AddEventParameterToAuditRec(auditRec, "match_field", matchField)
|
||||
|
||||
if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionManageSystem) {
|
||||
c.SetPermissionError(model.PermissionManageSystem)
|
||||
@@ -3242,11 +3241,11 @@ func migrateAuthToSaml(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
}
|
||||
usersMap := model.MapFromJSON(strings.NewReader(model.StringInterfaceToJSON(matches)))
|
||||
|
||||
auditRec := c.MakeAuditRecord("migrateAuthToSaml", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("migrateAuthToSaml", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "from", from)
|
||||
audit.AddEventParameter(auditRec, "auto", auto)
|
||||
audit.AddEventParameter(auditRec, "users_map", usersMap)
|
||||
model.AddEventParameterToAuditRec(auditRec, "from", from)
|
||||
model.AddEventParameterToAuditRec(auditRec, "auto", auto)
|
||||
model.AddEventParameterToAuditRec(auditRec, "users_map", usersMap)
|
||||
|
||||
if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionManageSystem) {
|
||||
c.SetPermissionError(model.PermissionManageSystem)
|
||||
@@ -3393,12 +3392,12 @@ func updateReadStateThreadByUser(c *Context, w http.ResponseWriter, r *http.Requ
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("updateReadStateThreadByUser", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("updateReadStateThreadByUser", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "user_id", c.Params.UserId)
|
||||
audit.AddEventParameter(auditRec, "thread_id", c.Params.ThreadId)
|
||||
audit.AddEventParameter(auditRec, "team_id", c.Params.TeamId)
|
||||
audit.AddEventParameter(auditRec, "timestamp", c.Params.Timestamp)
|
||||
model.AddEventParameterToAuditRec(auditRec, "user_id", c.Params.UserId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "thread_id", c.Params.ThreadId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "team_id", c.Params.TeamId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "timestamp", c.Params.Timestamp)
|
||||
if !c.App.SessionHasPermissionToUser(*c.AppContext.Session(), c.Params.UserId) {
|
||||
c.SetPermissionError(model.PermissionEditOtherUsers)
|
||||
return
|
||||
@@ -3427,12 +3426,12 @@ func setUnreadThreadByPostId(c *Context, w http.ResponseWriter, r *http.Request)
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("setUnreadThreadByPostId", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("setUnreadThreadByPostId", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "user_id", c.Params.UserId)
|
||||
audit.AddEventParameter(auditRec, "thread_id", c.Params.ThreadId)
|
||||
audit.AddEventParameter(auditRec, "team_id", c.Params.TeamId)
|
||||
audit.AddEventParameter(auditRec, "post_id", c.Params.PostId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "user_id", c.Params.UserId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "thread_id", c.Params.ThreadId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "team_id", c.Params.TeamId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "post_id", c.Params.PostId)
|
||||
|
||||
if !c.App.SessionHasPermissionToUser(*c.AppContext.Session(), c.Params.UserId) {
|
||||
c.SetPermissionError(model.PermissionEditOtherUsers)
|
||||
@@ -3471,11 +3470,11 @@ func unfollowThreadByUser(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("unfollowThreadByUser", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("unfollowThreadByUser", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "user_id", c.Params.UserId)
|
||||
audit.AddEventParameter(auditRec, "thread_id", c.Params.ThreadId)
|
||||
audit.AddEventParameter(auditRec, "team_id", c.Params.TeamId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "user_id", c.Params.UserId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "thread_id", c.Params.ThreadId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "team_id", c.Params.TeamId)
|
||||
|
||||
if !c.App.SessionHasPermissionToUser(*c.AppContext.Session(), c.Params.UserId) {
|
||||
c.SetPermissionError(model.PermissionEditOtherUsers)
|
||||
@@ -3503,11 +3502,11 @@ func followThreadByUser(c *Context, w http.ResponseWriter, r *http.Request) {
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("followThreadByUser", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("followThreadByUser", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "user_id", c.Params.UserId)
|
||||
audit.AddEventParameter(auditRec, "thread_id", c.Params.ThreadId)
|
||||
audit.AddEventParameter(auditRec, "team_id", c.Params.TeamId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "user_id", c.Params.UserId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "thread_id", c.Params.ThreadId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "team_id", c.Params.TeamId)
|
||||
|
||||
if !c.App.SessionHasPermissionToUser(*c.AppContext.Session(), c.Params.UserId) {
|
||||
c.SetPermissionError(model.PermissionEditOtherUsers)
|
||||
@@ -3535,10 +3534,10 @@ func updateReadStateAllThreadsByUser(c *Context, w http.ResponseWriter, r *http.
|
||||
return
|
||||
}
|
||||
|
||||
auditRec := c.MakeAuditRecord("updateReadStateAllThreadsByUser", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("updateReadStateAllThreadsByUser", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
audit.AddEventParameter(auditRec, "user_id", c.Params.UserId)
|
||||
audit.AddEventParameter(auditRec, "team_id", c.Params.TeamId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "user_id", c.Params.UserId)
|
||||
model.AddEventParameterToAuditRec(auditRec, "team_id", c.Params.TeamId)
|
||||
|
||||
if !c.App.SessionHasPermissionToUser(*c.AppContext.Session(), c.Params.UserId) {
|
||||
c.SetPermissionError(model.PermissionEditOtherUsers)
|
||||
@@ -3589,7 +3588,7 @@ func resetPasswordFailedAttempts(c *Context, w http.ResponseWriter, r *http.Requ
|
||||
}
|
||||
errParams := map[string]any{"userID": c.Params.UserId}
|
||||
|
||||
auditRec := c.MakeAuditRecord("resetPasswordFailedAttempts", audit.Fail)
|
||||
auditRec := c.MakeAuditRecord("resetPasswordFailedAttempts", model.AuditStatusFail)
|
||||
defer c.LogAuditRec(auditRec)
|
||||
|
||||
if !c.App.SessionHasPermissionTo(*c.AppContext.Session(), model.PermissionSysconsoleWriteUserManagementUsers) {
|
||||
|
||||
Ссылка в новой задаче
Block a user