diff --git a/web/dashboard/views.py b/web/dashboard/views.py index 9ec72f31..398b43ad 100644 --- a/web/dashboard/views.py +++ b/web/dashboard/views.py @@ -170,7 +170,7 @@ def profile(request): }) -@has_permission_decorator(PERM_ADD_MODIFY_SYSTEM_SETTINGS, redirect_url=FOUR_OH_FOUR_URL) +@has_permission_decorator(PERM_MODIFY_SYSTEM_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL) def admin_interface(request): UserModel = get_user_model() users = UserModel.objects.all() diff --git a/web/reNgine/definitions.py b/web/reNgine/definitions.py index 68eca474..03baceff 100644 --- a/web/reNgine/definitions.py +++ b/web/reNgine/definitions.py @@ -408,10 +408,14 @@ DEFAULT_DIR_FILE_FUZZ_EXTENSIONS = [ ] # Roles and Permissions -PERM_ADD_MODIFY_SYSTEM_SETTINGS = 'add_modify_system_settings' -PERM_ADD_MODIFY_SCAN_SETTINGS = 'add_modify_scan_settings' -PERM_VIEW_DOWNLOAD_REPORT = 'view_download_report' -PERM_INITATE_SCANS = 'initiate_scans' +PERM_MODIFY_SYSTEM_CONFIGURATIONS = 'modify_system_configurations' +PERM_MODIFY_SCAN_CONFIGURATIONS = 'modify_scan_configurations' +PERM_MODIFY_TARGETS = 'modify_targets' +PERM_MODIFY_SCAN_RESULTS = 'modify_scan_results' +PERM_MODIFY_WORDLISTS = 'modify_wordlists' +PERM_MODIFY_INTERESTING_LOOKUP = 'modify_interesting_lookup' +PERM_MODIFY_SCAN_REPORT = 'modify_scan_report' +PERM_INITATE_SCANS_SUBSCANS = 'initiate_scans_subscans' # 404 page url FOUR_OH_FOUR_URL = '/404/' diff --git a/web/reNgine/roles.py b/web/reNgine/roles.py index c56f2441..b0ea8c40 100644 --- a/web/reNgine/roles.py +++ b/web/reNgine/roles.py @@ -1,28 +1,40 @@ from rolepermissions.roles import AbstractUserRole from reNgine.definitions import * -class Admin(AbstractUserRole): +class SysAdmin(AbstractUserRole): available_permissions = { - PERM_ADD_MODIFY_SYSTEM_SETTINGS: True, - PERM_ADD_MODIFY_SCAN_SETTINGS: True, - PERM_VIEW_DOWNLOAD_REPORT: True, - PERM_INITATE_SCANS: True, + PERM_MODIFY_SYSTEM_CONFIGURATIONS: True, + PERM_MODIFY_SCAN_CONFIGURATIONS: True, + PERM_MODIFY_SCAN_RESULTS: True, + PERM_MODIFY_WORDLISTS: True, + PERM_MODIFY_INTERESTING_LOOKUP: True, + PERM_MODIFY_SCAN_REPORT: True, + PERM_INITATE_SCANS_SUBSCANS: True, + PERM_MODIFY_TARGETS: True, } class PenetrationTester(AbstractUserRole): available_permissions = { - PERM_ADD_MODIFY_SYSTEM_SETTINGS: False, - PERM_ADD_MODIFY_SCAN_SETTINGS: True, - PERM_VIEW_DOWNLOAD_REPORT: True, - PERM_INITATE_SCANS: True, + PERM_MODIFY_SYSTEM_CONFIGURATIONS: False, + PERM_MODIFY_SCAN_CONFIGURATIONS: True, + PERM_MODIFY_SCAN_RESULTS: True, + PERM_MODIFY_WORDLISTS: True, + PERM_MODIFY_INTERESTING_LOOKUP: True, + PERM_MODIFY_SCAN_REPORT: True, + PERM_INITATE_SCANS_SUBSCANS: True, + PERM_MODIFY_TARGETS: True, } class Auditor(AbstractUserRole): available_permissions = { - PERM_ADD_MODIFY_SYSTEM_SETTINGS: False, - PERM_ADD_MODIFY_SCAN_SETTINGS: False, - PERM_VIEW_DOWNLOAD_REPORT: True, - PERM_INITATE_SCANS: False, + PERM_MODIFY_SYSTEM_CONFIGURATIONS: False, + PERM_MODIFY_SCAN_CONFIGURATIONS: False, + PERM_MODIFY_SCAN_RESULTS: True, + PERM_MODIFY_WORDLISTS: False, + PERM_MODIFY_INTERESTING_LOOKUP: True, + PERM_MODIFY_SCAN_REPORT: True, + PERM_INITATE_SCANS_SUBSCANS: False, + PERM_MODIFY_TARGETS: False, } diff --git a/web/scanEngine/views.py b/web/scanEngine/views.py index 1418175e..68d7568b 100644 --- a/web/scanEngine/views.py +++ b/web/scanEngine/views.py @@ -14,6 +14,7 @@ from reNgine.tasks import (run_command, send_discord_message, from scanEngine.forms import * from scanEngine.forms import ConfigurationForm from scanEngine.models import * +from rolepermissions.decorators import has_permission_decorator def index(request): @@ -22,11 +23,11 @@ def index(request): 'engine_ul_show': 'show', 'engine_li': 'active', 'scan_engine_nav_active': 'active', - 'engine_type': engine_type, + 'engine_type': engine_type, } return render(request, 'scanEngine/index.html', context) - +@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL) def add_engine(request): form = AddEngineForm() if request.method == "POST": @@ -39,12 +40,12 @@ def add_engine(request): 'Scan Engine Added successfully') return http.HttpResponseRedirect(reverse('scan_engine_index')) context = { - 'scan_engine_nav_active': 'active', + 'scan_engine_nav_active': 'active', 'form': form } return render(request, 'scanEngine/add_engine.html', context) - +@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL) def delete_engine(request, id): obj = get_object_or_404(EngineType, id=id) if request.method == "POST": @@ -62,7 +63,7 @@ def delete_engine(request, id): 'Oops! Engine could not be deleted!') return http.JsonResponse(responseData) - +@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL) def update_engine(request, id): engine = get_object_or_404(EngineType, id=id) form = UpdateEngineForm( @@ -80,12 +81,12 @@ def update_engine(request, id): 'Engine edited successfully') return http.HttpResponseRedirect(reverse('scan_engine_index')) context = { - 'scan_engine_nav_active': 'active', + 'scan_engine_nav_active': 'active', 'form': form } return render(request, 'scanEngine/update_engine.html', context) - +@has_permission_decorator(PERM_MODIFY_WORDLISTS, redirect_url=FOUR_OH_FOUR_URL) def wordlist_list(request): wordlists = Wordlist.objects.all().order_by('id') context = { @@ -94,7 +95,7 @@ def wordlist_list(request): 'wordlists': wordlists} return render(request, 'scanEngine/wordlist/index.html', context) - +@has_permission_decorator(PERM_MODIFY_WORDLISTS, redirect_url=FOUR_OH_FOUR_URL) def add_wordlist(request): context = {'scan_engine_nav_active': 'active', 'wordlist_li': 'active'} form = AddWordlistForm(request.POST or None, request.FILES or None) @@ -122,7 +123,7 @@ def add_wordlist(request): context['form'] = form return render(request, 'scanEngine/wordlist/add.html', context) - +@has_permission_decorator(PERM_MODIFY_WORDLISTS, redirect_url=FOUR_OH_FOUR_URL) def delete_wordlist(request, id): obj = get_object_or_404(Wordlist, id=id) if request.method == "POST": @@ -148,7 +149,7 @@ def delete_wordlist(request, id): 'Oops! Wordlist could not be deleted!') return http.JsonResponse(responseData) - +@has_permission_decorator(PERM_MODIFY_INTERESTING_LOOKUP, redirect_url=FOUR_OH_FOUR_URL) def interesting_lookup(request): lookup_keywords = None context = {} @@ -182,6 +183,7 @@ def interesting_lookup(request): context['default_lookup'] = InterestingLookupModel.objects.filter(id=1) return render(request, 'scanEngine/lookup.html', context) +@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL) def tool_specific_settings(request): context = {} # check for incoming form requests @@ -240,7 +242,7 @@ def tool_specific_settings(request): fhandle.write(request.POST.get('amass_config_text_area')) messages.add_message(request, messages.INFO, 'Amass config updated!') return http.HttpResponseRedirect(reverse('tool_settings')) - + elif 'theharvester_config_text_area' in request.POST: with open('/usr/src/github/theHarvester/api-keys.yaml', "w") as fhandle: fhandle.write(request.POST.get('theharvester_config_text_area')) @@ -256,6 +258,7 @@ def tool_specific_settings(request): context['gf_patterns'] = sorted(gf_list.split('\n')) return render(request, 'scanEngine/settings/tool.html', context) +@has_permission_decorator(PERM_MODIFY_SYSTEM_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL) def rengine_settings(request): context = {} @@ -273,6 +276,7 @@ def rengine_settings(request): return render(request, 'scanEngine/settings/rengine.html', context) +@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL) def notification_settings(request): context = {} form = NotificationForm() @@ -307,6 +311,7 @@ def notification_settings(request): return render(request, 'scanEngine/settings/notification.html', context) +@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL) def proxy_settings(request): context = {} form = ProxyForm() @@ -332,8 +337,6 @@ def proxy_settings(request): messages.INFO, 'Proxies updated.') return http.HttpResponseRedirect(reverse('proxy_settings')) - - context['settings_nav_active'] = 'active' context['proxy_settings_li'] = 'active' context['settings_ul_show'] = 'show' @@ -341,6 +344,7 @@ def proxy_settings(request): return render(request, 'scanEngine/settings/proxy.html', context) +@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL) def test_hackerone(request): context = {} if request.method == "POST": @@ -358,7 +362,7 @@ def test_hackerone(request): return http.JsonResponse({"status": 401}) - +@has_permission_decorator(PERM_MODIFY_SCAN_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL) def hackerone_settings(request): context = {} form = HackeroneForm() @@ -392,7 +396,7 @@ def hackerone_settings(request): return render(request, 'scanEngine/settings/hackerone.html', context) - +@has_permission_decorator(PERM_MODIFY_SCAN_REPORT, redirect_url=FOUR_OH_FOUR_URL) def report_settings(request): context = {} form = ReportForm() @@ -433,14 +437,14 @@ def report_settings(request): return render(request, 'scanEngine/settings/report.html', context) - +@has_permission_decorator(PERM_MODIFY_SYSTEM_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL) def tool_arsenal_section(request): context = {} tools = InstalledExternalTool.objects.all().order_by('id') context['installed_tools'] = tools return render(request, 'scanEngine/settings/tool_arsenal.html', context) - +@has_permission_decorator(PERM_MODIFY_SYSTEM_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL) def add_tool(request): form = ExternalToolForm() if request.method == "POST": @@ -477,6 +481,7 @@ def add_tool(request): return render(request, 'scanEngine/settings/add_tool.html', context) +@has_permission_decorator(PERM_MODIFY_SYSTEM_CONFIGURATIONS, redirect_url=FOUR_OH_FOUR_URL) def modify_tool_in_arsenal(request, id): external_tool = get_object_or_404(InstalledExternalTool, id=id) form = ExternalToolForm() diff --git a/web/templates/base/_items/top_bar.html b/web/templates/base/_items/top_bar.html index 3d2c0470..6c20d930 100644 --- a/web/templates/base/_items/top_bar.html +++ b/web/templates/base/_items/top_bar.html @@ -23,35 +23,46 @@ - {% if user|can:'add_modify_scan_settings' %} + {% if user|can:'modify_targets' or user|can:'modify_scan_configurations' or user|can:'modify_system_configurations' or user|can:'modify_wordlists' %}
  • + {% if user|can:'modify_targets' %} Target + {% endif %} + {% if user|can:'modify_targets' %} Organization + {% endif %} + {% if user|can:'modify_scan_configurations' %} Scan Engine + {% endif %} + {% if user|can:'modify_system_configurations' %} External Tool + {% endif %} + {% if user|can:'modify_wordlists' %} Wordlist + {% endif %}
    • + {% endif %}
  • Interesting Lookup
    • + {% endif %}
  • + {% if user|can:'add_modify_system_settings' %} Proxies Tool Settings Tools Arsenal @@ -73,9 +75,9 @@ reNgine Settings Hackerone Settings Notification Settings + {% endif %}
    • - {% endif %}