SimpleRisk 20240923-001 Release

Author: jsokol

simplerisk/account/profile.php

@@ -281,14 +281,14 @@
         if (isset($_SESSION['user_type']) && $_SESSION['user_type'] != "ldap") {
 
             $html = "
-        <div class='card-body border m-t-5 flex-grow-1'>
-            <div>
+        <div class='card-body border flex-grow-1'>
             ";
 
             $resetRequestMessages = getPasswordReqeustMessages();
             if(count($resetRequestMessages)) {
 
-                $html .= "
+                $html .= "    
+            <div>
                 <h4>" . $escaper->escapeHtml($lang['PasswordRequirements']) . "</h4>
                 <ul>
                 ";
@@ -303,17 +303,15 @@
 
                 $html .= "
                 </ul>
+            </div>
                 ";
 
             }
 
-            $html .= "
-            </div>
-            ";
             echo $html;
 
     ?>
-            <div class="m-t-30">
+            <div>
                 <form class="form-horizontal" action="" method="post">
                     <h4><?= $escaper->escapeHtml($lang['ChangePassword']);?></h4>
                     <div class="form-group">

simplerisk/admin/active_assessments.php

@@ -37,9 +37,8 @@
 ?>
 <div class="row bg-white">
     <div class="col-12">
-        <div class="card-body my-2 border d-flex align-items-center">
-            <label class="text-danger">Warning:</label>
-            <div class="text-danger m-l-20">* Deleted Assessments Cannot Be Recovered</div>
+        <div class="card-body my-2 border d-flex align-items-center alert alert-danger" role="alert">
+            Deleted Assessments Cannot Be Recovered
         </div>
         <div class='card-body my-2 border'>
             <?php display_active_assessments(); ?>
@@ -60,6 +59,8 @@ function checkAll(bx) {
     $(function () {
         $('#questionaires_table').DataTable({
             serverSide: false,
+			order: [[1, 'asc']],
+			columnDefs: [{'targets': 0, 'orderable': false}],
         });
         $('.btn-delete').on('click', function () {
             confirm(_lang['GenericDeleteItemConfirmation'], () => $('#delete_active_assessments').trigger('submit'));

simplerisk/admin/add_remove_values.php

@@ -347,8 +347,7 @@
                 <input type="hidden" value="" name="id"/>
                 <input type="hidden" value="" name="name"/>
                 <div class="row" >
-                    <div class="col-md-6 form-group">
-                        <h4><?= $escaper->escapeHtml($lang['Select']); ?></h4>
+                    <div class="col-md-3 form-group pb-4">
                         <select id="table-sections" class="form-select" name="table-sections">
     <?php
         foreach($tableConfig as $table => $config){
@@ -386,42 +385,42 @@
                     $display = "display: none;";
                 }
             }
-            echo'
+            echo '
                         <div class="row">
                             <div class="hero-unit" data-table_name="' . $table . '" style="' . $display . '">
                                 <h4>' . $escaper->escapeHtml($lang[$config['headerKey']]) . '</h4>
                                 <div class="row" style="align-items:flex-end">
-                                    <div class="col-md-4 form-group">
+                                    <div class="col-md-6 form-group">
                                         <label>' . $text_addItem . ':</label>
                                         <input id="' . $table . '_new" type="text" maxlength="' . $config['lengthLimit'] .'" size="20" class="form-control"/>
                                     </div>
-                                    <div class="col-md-2 form-group">
+                                    <div class="col-md-1 form-group">
                                         <input type="submit" value="' .  $text_add . ' " data-action="add" class="btn btn-submit form-control"/>
                                     </div>
                                 </div>
                                 <div class="row" style="align-items:flex-end">
-                                    <div class="col-md-2 form-group">
+                                    <div class="col-md-3 form-group">
                                         <label>' . $text_change . ':</label>
             ';
                                         create_dropdown($table, NULL, $table . "_update_from");
             echo'
                                     </div>
-                                    <div class="col-md-2 form-group">
+                                    <div class="col-md-3 form-group">
                                         <label>' . $text_to . ':</label>
                                         <input id="' . $table . '_update_to" type="text" maxlength="' . $config['lengthLimit'] . '" size="20"  class="form-control"/>
                                     </div>
-                                    <div class="col-md-2 form-group">
+                                    <div class="col-md-1 form-group">
                                         <input type="submit" value="' . $text_update . '" data-action="update"  class="btn btn-submit form-control"/>
                                     </div>
                                 </div>
                                 <div class="row" style="align-items:flex-end">
-                                    <div class="col-md-4">
+                                    <div class="col-md-6">
                                         <label>' . $text_deleteItem . ':</label>
             ';
                                         create_dropdown($table, NULL, $table . "_delete");
             echo '
                                     </div>
-                                    <div class="col-md-2">
+                                    <div class="col-md-1">
                                         <input type="submit" value="' . $text_delete . '" data-action="delete" class="btn btn-submit form-control"/>
                                     </div>
                                 </div>

simplerisk/admin/artificial_intelligence.php

@@ -0,0 +1,135 @@
+<?php
+/* This Source Code Form is subject to the terms of the Mozilla Public
+* License, v. 2.0. If a copy of the MPL was not distributed with this
+* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// Render the header and sidebar
+require_once(realpath(__DIR__ . '/../includes/renderutils.php'));
+require_once(realpath(__DIR__ . '/../includes/functions.php'));
+require_once(realpath(__DIR__ . '/../includes/artificial_intelligence.php'));
+render_header_and_sidebar(['multiselect'], ['check_admin' => true]);
+
+// Include the language file
+// Ignoring detections related to language files
+// @phan-suppress-next-line SecurityCheck-PathTraversal
+require_once(language_file());
+
+// If the extra directory exists
+if (is_dir(realpath(__DIR__ . '/../extras/artificial_intelligence')))
+{
+    // Include the Artificial Intelligence Extra
+    require_once(realpath(__DIR__ . '/../extras/artificial_intelligence/index.php'));
+
+    // If the user wants to activate the extra
+    if (isset($_POST['activate']))
+    {
+        // Enable the Artificial Intelligence Extra
+        enable_artificial_intelligence_extra();
+    }
+
+    // If the user wants to deactivate the extra
+    if (isset($_POST['deactivate']))
+    {
+        // Disable the Artificial Intelligence Extra
+        disable_artificial_intelligence_extra();
+    }
+
+    // If the user updated the configuration
+    if (isset($_POST['update_artificial_intelligence_settings']))
+    {
+        // Update the artificial intelligence settings
+        update_artificial_intelligence_settings();
+    }
+}
+
+/*********************
+ * FUNCTION: DISPLAY *
+ *********************/
+function display($display = "")
+{
+    global $lang;
+    global $escaper;
+
+    // If the extra directory exists
+    if (is_dir(realpath(__DIR__ . '/../extras/artificial_intelligence')))
+    {
+        // But the extra is not activated
+        if (!artificial_intelligence_extra())
+        {
+            echo "<div class='card-body my-2 border'>";
+            // If the extra is not restricted based on the install type
+            if (!restricted_extra("artificial_intelligence"))
+            {
+                echo "
+                    <form id='activate_extra' name='activate' method='post' action=''>
+                        <input type='submit' value='" . $escaper->escapeHtml($lang['Activate']) . "' name='activate' class='btn btn-submit'/>
+                    </form>";
+            }
+            // The extra is restricted
+            else echo $escaper->escapeHtml($lang['YouNeedToUpgradeYourSimpleRiskSubscription']);
+            echo "</div>";
+        }
+        // Once it has been activated
+        else
+        {
+            // Include the Notification Extra
+            require_once(realpath(__DIR__ . '/../extras/artificial_intelligence/index.php'));
+
+            display_artificial_intelligence();
+        }
+    }
+    // Otherwise, the Extra does not exist
+    else
+    {
+        echo "
+            <div class='card-body my-2 border'>
+                <a href='https://www.simplerisk.com/extras' target='_blank' class='text-info'>Purchase the Extra</a>
+            </div>";
+    }
+}
+?>
+<div class="row bg-white"> 
+    <div class="col-12">
+        <?php display(); ?>
+
+        <div class='card-body my-2 border'>
+            <form name='anthropic_settings' method='post' action=''>
+                <div class='row'>
+                    <div class='form-group'>
+                        <label>Anthropic API Key:</label>
+                        <?php display_anthropic_api_key_input() ?>
+                    </div>
+                </div>
+            </form>
+        </div>
+
+<?php
+    // If we have an Anthropic API key
+    if (get_setting("anthropic_api_key") != false)
+    {
+        // Process the added/updated context
+        $parameter_array = get_artificial_intelligence_context_parameter_array();
+        $settings_prefix = "ai_context_";
+        $parameter_array = update_posted_settings_values($parameter_array, $settings_prefix);
+
+        // If this was a POST to update the AI context
+        if (isset($_POST['save_ai_context']))
+        {
+            // Update a setting for the last time this prefix was updated
+            $setting_name = $settings_prefix . "last_saved";
+            update_setting($setting_name, time());
+        }
+
+        // Provide the user with the ability to add context
+        display_artificial_intelligence_add_context($parameter_array);
+    }
+?>
+    </div>
+    <script>
+        <?php prevent_form_double_submit_script(['activate_extra', 'deactivate_extra']); ?>
+    </script>
+</div>
+<?php
+    // Render the footer of the page. Please don't put code after this part.
+    render_footer();
+?>

simplerisk/admin/audit_trail.php

@@ -3,9 +3,7 @@
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-// Render the header and sidebar
-require_once(realpath(__DIR__ . '/../includes/renderutils.php'));
-render_header_and_sidebar(permissions: ['check_admin' => true]);
+require_once(realpath(__DIR__ . '/../includes/functions.php'));
 
 // If the days value is post
 if (isset($_GET['days']))
@@ -17,6 +15,18 @@
 
 if(isset($_POST['download_audit_log']))
 {
+    global $escaper, $lang;
+    // Include Laminas Escaper for HTML Output Encoding
+    $escaper = new simpleriskEscaper();
+
+    // Add various security headers
+    add_security_headers();
+
+    add_session_check(['check_admin' => true]);
+
+    // Include the SimpleRisk language file
+    require_once(language_file());
+
     if(is_admin())
     {
         // If extra is activated, download audit logs
@@ -38,6 +48,10 @@
     }
 }
 
+// Render the header and sidebar
+require_once(realpath(__DIR__ . '/../includes/renderutils.php'));
+render_header_and_sidebar(permissions: ['check_admin' => true]);
+
 /*********************
  * FUNCTION: DISPLAY *
  *********************/

simplerisk/admin/complianceforge.php

@@ -114,7 +114,6 @@ function display() {
 		<?php display(); ?>
 	</div>
 </div>
-<?php display_set_default_date_format_script(); ?>
 <?php
 	// Render the footer of the page. Please don't put code after this part.
 	render_footer();