Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def _create_searchindex(self, name, user, acl=False):
"""Create a searchindex in the database.
Args:
name: Name of the searchindex (string)
user: A user (instance of timesketch.models.user.User)
acl: Boolean value to decide if ACL permissions should be set
Returns:
A searchindex (instance of timesketch.models.sketch.SearchIndex)
"""
searchindex = SearchIndex.get_or_create(
name=name, description=name, index_name=name, user=user)
if acl:
for permission in ['read', 'write', 'delete']:
searchindex.grant_permission(permission=permission, user=user)
self._commit_to_database(searchindex)
return searchindex
def run(self, index_name):
"""Delete timeline in both Timesketch and Elasticsearch.
Args:
index_name: The name of the index in Elasticsearch
"""
if not isinstance(index_name, six.text_type):
index_name = codecs.decode(index_name, 'utf-8')
searchindex = SearchIndex.query.filter_by(
index_name=index_name).first()
if not searchindex:
sys.stdout.write('No such index\n')
sys.exit()
es = ElasticsearchDataStore(
host=current_app.config['ELASTIC_HOST'],
port=current_app.config['ELASTIC_PORT'])
timelines = Timeline.query.filter_by(searchindex=searchindex).all()
sketches = [
t.sketch for t in timelines
if t.sketch and t.sketch.get_status.status != 'deleted'
]
if sketches:
def add_comment(self, comment):
"""Add comment to event.
Args:
comment: Comment string.
Raises:
RuntimeError: if no sketch is present.
"""
if not self.sketch:
raise RuntimeError('No sketch provided.')
searchindex = SearchIndex.query.filter_by(
index_name=self.index_name).first()
db_event = SQLEvent.get_or_create(
sketch=self.sketch.sql_sketch, searchindex=searchindex,
document_id=self.event_id)
comment = SQLEvent.Comment(comment=comment, user=None)
db_event.comments.append(comment)
db_session.add(db_event)
db_session.commit()
self.add_label(label='__ts_comment')
try:
plaso_version = current_app.config['PLASO_VERSION']
except KeyError:
plaso_version = 'Unknown'
# Setup the form
form = AddTimelineForm()
form.timelines.choices = set((i.id, i.name) for i in indices.all())
# Create new timeline form POST
if form.validate_on_submit():
if not sketch.has_permission(current_user, 'write'):
abort(HTTP_STATUS_CODE_FORBIDDEN)
for searchindex_id in form.timelines.data:
searchindex = SearchIndex.query.get_with_acl(searchindex_id)
if searchindex not in [t.searchindex for t in sketch.timelines]:
_timeline = Timeline(
name=searchindex.name,
description=searchindex.description,
sketch=sketch,
user=current_user,
searchindex=searchindex)
db_session.add(_timeline)
sketch.timelines.append(_timeline)
db_session.commit()
# If enabled, run sketch analyzers when timeline is added.
# Import here to avoid circular imports.
from timesketch.lib import tasks
sketch_analyzer_group, _ = tasks.build_sketch_analysis_pipeline(
sketch_id, searchindex.id, current_user.id)
# We do not need a human readable filename or
# datastore index name, so we use UUIDs here.
index_name = hashlib.md5(index_name_seed.encode()).hexdigest()
if six.PY2:
index_name = codecs.decode(index_name, 'utf-8')
# Try to create index
try:
# Create the index in Elasticsearch (unless it already exists)
self.datastore.create_index(
index_name=index_name,
doc_type=event_type)
# Create the search index in the Timesketch database
searchindex = SearchIndex.get_or_create(
name=timeline_name,
description='internal timeline for user-created events',
user=current_user,
index_name=index_name)
searchindex.grant_permission(
permission='read', user=current_user)
searchindex.grant_permission(
permission='write', user=current_user)
searchindex.grant_permission(
permission='delete', user=current_user)
searchindex.set_status('ready')
db_session.add(searchindex)
db_session.commit()
timeline = None
if sketch and sketch.has_permission(current_user, 'write'):
def post(self, sketch_id):
"""Handles POST request to the resource.
Returns:
A sketch in JSON (instance of flask.wrappers.Response)
"""
sketch = Sketch.query.get_with_acl(sketch_id)
form = AddTimelineSimpleForm.build(request)
metadata = {'created': True}
searchindex_id = form.timeline.data
searchindex = SearchIndex.query.get_with_acl(searchindex_id)
timeline_id = [
t.searchindex.id for t in sketch.timelines
if t.searchindex.id == searchindex_id
]
if not form.validate_on_submit():
abort(
HTTP_STATUS_CODE_BAD_REQUEST, 'Unable to validate form data.')
if not sketch.has_permission(current_user, 'write'):
abort(
HTTP_STATUS_CODE_FORBIDDEN,
'User does not have write access to the sketch.')
if not timeline_id:
return_code = HTTP_STATUS_CODE_CREATED
def __init__(self, name, description, index_name, user):
"""Initialize the SearchIndex object.
Args:
name: The name of the timeline
description: The description for the timeline
index_name: The name of the searchindex
user: A user (instance of timesketch.models.user.User)
"""
super(SearchIndex, self).__init__()
self.name = name
self.description = description
self.index_name = index_name
self.user = user
def get(self):
"""Handles GET request to the resource.
Returns:
A view in JSON (instance of flask.wrappers.Response)
"""
TIMEOUT_THRESHOLD_SECONDS = current_app.config.get(
'CELERY_TASK_TIMEOUT', 7200)
indices = SearchIndex.query.filter(
SearchIndex.status.any(status='processing')).filter_by(
user=current_user).all()
schema = {'objects': [], 'meta': {}}
for search_index in indices:
# pylint: disable=too-many-function-args
celery_task = self.celery.AsyncResult(search_index.index_name)
task = dict(
task_id=celery_task.task_id,
state=celery_task.state,
successful=celery_task.successful(),
name=search_index.name,
result=False)
if celery_task.state == 'SUCCESS':
task['result'] = celery_task.result
elif celery_task.state == 'PENDING':
time_pending = (
search_index.updated_at - datetime.datetime.now())
self._Connect()
self._CreateIndexIfNotExists(self._index_name, mappings)
user = None
if self._timeline_owner:
user = timesketch_user.User.query.filter_by(
username=self._timeline_owner).first()
if not user:
raise RuntimeError(
'Unknown Timesketch user: {0:s}'.format(self._timeline_owner))
else:
logger.warning('Timeline will be visible to all Timesketch users')
with self._timesketch.app_context():
search_index = timesketch_sketch.SearchIndex.get_or_create(
name=self._timeline_name, description=self._timeline_name, user=user,
index_name=self._index_name)
# Grant the user read permission on the mapping object and set status.
# If user is None the timeline becomes visible to all users.
search_index.grant_permission(user=user, permission='read')
# In case we have a user grant additional permissions.
if user:
search_index.grant_permission(user=user, permission='write')
search_index.grant_permission(user=user, permission='delete')
# Let the Timesketch UI know that the timeline is processing.
search_index.set_status('processing')
# Save the mapping object to the Timesketch database.
def run_email_result_task(index_name, sketch_id=None):
"""Create email Celery task.
This task is run after all sketch analyzers are done and emails
the result of all analyzers to the user who imported the data.
Args:
index_name: An index name.
sketch_id: A sketch ID (optional).
Returns:
Email sent status.
"""
# We need to get a fake request context so that url_for() will work.
with current_app.test_request_context():
searchindex = SearchIndex.query.filter_by(index_name=index_name).first()
sketch = None
try:
to_username = searchindex.user.username
except AttributeError:
logging.warning('No user to send email to.')
return ''
if sketch_id:
sketch = Sketch.query.get(sketch_id)
subject = 'Timesketch: [{0:s}] is ready'.format(searchindex.name)
# TODO: Use jinja templates.
body = 'Your timeline [{0:s}] has been imported and is ready.'.format(
searchindex.name)