WEBDIENSTE/rengine
1
0
Fork 0
mirror of https://github.com/yogeshojha/rengine.git synced 2026-09-12 04:47:40 +02:00
Code Issues Packages Projects Releases Wiki Activity

Added New permission models

Browse Source
This commit is contained in:
Yogesh Ojha
2023-06-20 10:47:43 +05:30
parent 3f94fd4eff
commit 5d3c7cc4e0
6 changed files with 71 additions and 38 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/dashboard/views.py
+1 -1
View File
@@ -170,7 +170,7 @@ def profile(request):
})
@has_permission_decorator(PERM_ADD_MODIFY_SYSTEM_SETTINGS, redirect_url=FOUR_OH_FOUR_URL)
@has_permission_decorator(PERM_MODIFY_SYSTEM_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL)
def admin_interface(request):
UserModel = get_user_model()
users = UserModel.objects.all()
web/reNgine/definitions.py
+8 -4
View File
@@ -408,10 +408,14 @@ DEFAULT_DIR_FILE_FUZZ_EXTENSIONS = [
]
# Roles and Permissions
PERM_ADD_MODIFY_SYSTEM_SETTINGS = 'add_modify_system_settings'
PERM_ADD_MODIFY_SCAN_SETTINGS = 'add_modify_scan_settings'
PERM_VIEW_DOWNLOAD_REPORT = 'view_download_report'
PERM_INITATE_SCANS = 'initiate_scans'
PERM_MODIFY_SYSTEM_CONFIGURATIONS = 'modify_system_configurations'
PERM_MODIFY_SCAN_CONFIGURATIONS = 'modify_scan_configurations'
PERM_MODIFY_TARGETS = 'modify_targets'
PERM_MODIFY_SCAN_RESULTS = 'modify_scan_results'
PERM_MODIFY_WORDLISTS = 'modify_wordlists'
PERM_MODIFY_INTERESTING_LOOKUP = 'modify_interesting_lookup'
PERM_MODIFY_SCAN_REPORT = 'modify_scan_report'
PERM_INITATE_SCANS_SUBSCANS = 'initiate_scans_subscans'
# 404 page url
FOUR_OH_FOUR_URL = '/404/'
web/reNgine/roles.py
+25 -13
View File
@@ -1,28 +1,40 @@
from rolepermissions.roles import AbstractUserRole
from reNgine.definitions import *
class Admin(AbstractUserRole):
class SysAdmin(AbstractUserRole):
available_permissions = {
PERM_ADD_MODIFY_SYSTEM_SETTINGS: True,
PERM_ADD_MODIFY_SCAN_SETTINGS: True,
PERM_VIEW_DOWNLOAD_REPORT: True,
PERM_INITATE_SCANS: True,
PERM_MODIFY_SYSTEM_CONFIGURATIONS: True,
PERM_MODIFY_SCAN_CONFIGURATIONS: True,
PERM_MODIFY_SCAN_RESULTS: True,
PERM_MODIFY_WORDLISTS: True,
PERM_MODIFY_INTERESTING_LOOKUP: True,
PERM_MODIFY_SCAN_REPORT: True,
PERM_INITATE_SCANS_SUBSCANS: True,
PERM_MODIFY_TARGETS: True,
}
class PenetrationTester(AbstractUserRole):
available_permissions = {
PERM_ADD_MODIFY_SYSTEM_SETTINGS: False,
PERM_ADD_MODIFY_SCAN_SETTINGS: True,
PERM_VIEW_DOWNLOAD_REPORT: True,
PERM_INITATE_SCANS: True,
PERM_MODIFY_SYSTEM_CONFIGURATIONS: False,
PERM_MODIFY_SCAN_CONFIGURATIONS: True,
PERM_MODIFY_SCAN_RESULTS: True,
PERM_MODIFY_WORDLISTS: True,
PERM_MODIFY_INTERESTING_LOOKUP: True,
PERM_MODIFY_SCAN_REPORT: True,
PERM_INITATE_SCANS_SUBSCANS: True,
PERM_MODIFY_TARGETS: True,
}
class Auditor(AbstractUserRole):
available_permissions = {
PERM_ADD_MODIFY_SYSTEM_SETTINGS: False,
PERM_ADD_MODIFY_SCAN_SETTINGS: False,
PERM_VIEW_DOWNLOAD_REPORT: True,
PERM_INITATE_SCANS: False,
PERM_MODIFY_SYSTEM_CONFIGURATIONS: False,
PERM_MODIFY_SCAN_CONFIGURATIONS: False,
PERM_MODIFY_SCAN_RESULTS: True,
PERM_MODIFY_WORDLISTS: False,
PERM_MODIFY_INTERESTING_LOOKUP: True,
PERM_MODIFY_SCAN_REPORT: True,
PERM_INITATE_SCANS_SUBSCANS: False,
PERM_MODIFY_TARGETS: False,
}
web/scanEngine/views.py
+22 -17
View File
@@ -14,6 +14,7 @@ from reNgine.tasks import (run_command, send_discord_message,
from scanEngine.forms import *
from scanEngine.forms import ConfigurationForm
from scanEngine.models import *
from rolepermissions.decorators import has_permission_decorator
def index(request):
@@ -22,11 +23,11 @@ def index(request):
'engine_ul_show': 'show',
'engine_li': 'active',
'scan_engine_nav_active': 'active',
'engine_type': engine_type,
'engine_type': engine_type,
}
return render(request, 'scanEngine/index.html', context)
@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL)
def add_engine(request):
form = AddEngineForm()
if request.method == "POST":
@@ -39,12 +40,12 @@ def add_engine(request):
'Scan Engine Added successfully')
return http.HttpResponseRedirect(reverse('scan_engine_index'))
context = {
'scan_engine_nav_active': 'active',
'scan_engine_nav_active': 'active',
'form': form
}
return render(request, 'scanEngine/add_engine.html', context)
@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL)
def delete_engine(request, id):
obj = get_object_or_404(EngineType, id=id)
if request.method == "POST":
@@ -62,7 +63,7 @@ def delete_engine(request, id):
'Oops! Engine could not be deleted!')
return http.JsonResponse(responseData)
@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL)
def update_engine(request, id):
engine = get_object_or_404(EngineType, id=id)
form = UpdateEngineForm(
@@ -80,12 +81,12 @@ def update_engine(request, id):
'Engine edited successfully')
return http.HttpResponseRedirect(reverse('scan_engine_index'))
context = {
'scan_engine_nav_active': 'active',
'scan_engine_nav_active': 'active',
'form': form
}
return render(request, 'scanEngine/update_engine.html', context)
@has_permission_decorator(PERM_MODIFY_WORDLISTS, redirect_url=FOUR_OH_FOUR_URL)
def wordlist_list(request):
wordlists = Wordlist.objects.all().order_by('id')
context = {
@@ -94,7 +95,7 @@ def wordlist_list(request):
'wordlists': wordlists}
return render(request, 'scanEngine/wordlist/index.html', context)
@has_permission_decorator(PERM_MODIFY_WORDLISTS, redirect_url=FOUR_OH_FOUR_URL)
def add_wordlist(request):
context = {'scan_engine_nav_active': 'active', 'wordlist_li': 'active'}
form = AddWordlistForm(request.POST or None, request.FILES or None)
@@ -122,7 +123,7 @@ def add_wordlist(request):
context['form'] = form
return render(request, 'scanEngine/wordlist/add.html', context)
@has_permission_decorator(PERM_MODIFY_WORDLISTS, redirect_url=FOUR_OH_FOUR_URL)
def delete_wordlist(request, id):
obj = get_object_or_404(Wordlist, id=id)
if request.method == "POST":
@@ -148,7 +149,7 @@ def delete_wordlist(request, id):
'Oops! Wordlist could not be deleted!')
return http.JsonResponse(responseData)
@has_permission_decorator(PERM_MODIFY_INTERESTING_LOOKUP, redirect_url=FOUR_OH_FOUR_URL)
def interesting_lookup(request):
lookup_keywords = None
context = {}
@@ -182,6 +183,7 @@ def interesting_lookup(request):
context['default_lookup'] = InterestingLookupModel.objects.filter(id=1)
return render(request, 'scanEngine/lookup.html', context)
@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL)
def tool_specific_settings(request):
context = {}
# check for incoming form requests
@@ -240,7 +242,7 @@ def tool_specific_settings(request):
fhandle.write(request.POST.get('amass_config_text_area'))
messages.add_message(request, messages.INFO, 'Amass config updated!')
return http.HttpResponseRedirect(reverse('tool_settings'))
elif 'theharvester_config_text_area' in request.POST:
with open('/usr/src/github/theHarvester/api-keys.yaml', "w") as fhandle:
fhandle.write(request.POST.get('theharvester_config_text_area'))
@@ -256,6 +258,7 @@ def tool_specific_settings(request):
context['gf_patterns'] = sorted(gf_list.split('\n'))
return render(request, 'scanEngine/settings/tool.html', context)
@has_permission_decorator(PERM_MODIFY_SYSTEM_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL)
def rengine_settings(request):
context = {}
@@ -273,6 +276,7 @@ def rengine_settings(request):
return render(request, 'scanEngine/settings/rengine.html', context)
@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL)
def notification_settings(request):
context = {}
form = NotificationForm()
@@ -307,6 +311,7 @@ def notification_settings(request):
return render(request, 'scanEngine/settings/notification.html', context)
@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL)
def proxy_settings(request):
context = {}
form = ProxyForm()
@@ -332,8 +337,6 @@ def proxy_settings(request):
messages.INFO,
'Proxies updated.')
return http.HttpResponseRedirect(reverse('proxy_settings'))
context['settings_nav_active'] = 'active'
context['proxy_settings_li'] = 'active'
context['settings_ul_show'] = 'show'
@@ -341,6 +344,7 @@ def proxy_settings(request):
return render(request, 'scanEngine/settings/proxy.html', context)
@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL)
def test_hackerone(request):
context = {}
if request.method == "POST":
@@ -358,7 +362,7 @@ def test_hackerone(request):
return http.JsonResponse({"status": 401})
@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL)
def hackerone_settings(request):
context = {}
form = HackeroneForm()
@@ -392,7 +396,7 @@ def hackerone_settings(request):
return render(request, 'scanEngine/settings/hackerone.html', context)
@has_permission_decorator(PERM_MODIFY_SCAN_REPORT, redirect_url=FOUR_OH_FOUR_URL)
def report_settings(request):
context = {}
form = ReportForm()
@@ -433,14 +437,14 @@ def report_settings(request):
return render(request, 'scanEngine/settings/report.html', context)
@has_permission_decorator(PERM_MODIFY_SYSTEM_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL)
def tool_arsenal_section(request):
context = {}
tools = InstalledExternalTool.objects.all().order_by('id')
context['installed_tools'] = tools
return render(request, 'scanEngine/settings/tool_arsenal.html', context)
@has_permission_decorator(PERM_MODIFY_SYSTEM_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL)
def add_tool(request):
form = ExternalToolForm()
if request.method == "POST":
@@ -477,6 +481,7 @@ def add_tool(request):
return render(request, 'scanEngine/settings/add_tool.html', context)
@has_permission_decorator(PERM_MODIFY_SYSTEM_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL)
def modify_tool_in_arsenal(request, id):
external_tool = get_object_or_404(InstalledExternalTool, id=id)
form = ExternalToolForm()
web/templates/base/_items/top_bar.html
+12 -2
View File
File diff suppressed because one or more lines are too long
web/templates/base/_items/top_nav.html
+3 -1
View File
@@ -59,6 +59,7 @@
<a href="{% url 'interesting_lookup' %}" class="dropdown-item">Interesting Lookup</a>
</div>
</li>
{% endif %}
<li class="nav-item dropdown {{settings_nav_active}}">
<a class="nav-link dropdown-toggle arrow-none" href="#" id="topnav-settings" role="button"
data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">
@@ -66,6 +67,7 @@
<div class="arrow-down"></div>
</a>
<div class="dropdown-menu" aria-labelledby="topnav-settings">
{% if user|can:'add_modify_system_settings' %}
<a href="{% url 'proxy_settings' %}" class="dropdown-item">Proxies</a>
<a href="{% url 'tool_settings' %}" class="dropdown-item">Tool Settings</a>
<a href="{% url 'tool_arsenal' %}" class="dropdown-item">Tools Arsenal</a>
@@ -73,9 +75,9 @@
<a href="{% url 'rengine_settings' %}" class="dropdown-item">reNgine Settings</a>
<a href="{% url 'hackerone_settings' %}" class="dropdown-item">Hackerone Settings</a>
<a href="{% url 'notification_settings' %}" class="dropdown-item">Notification Settings</a>
{% endif %}
</div>
</li>
{% endif %}
</ul>
</div>
</nav>