Skip to content

Commit 94dab1f

Browse files
jsokoljsokol
committed
SimpleRisk 20250731-001 Release
1 parent c21284f commit 94dab1f

4,216 files changed

Lines changed: 370265 additions & 247624 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎simplerisk/admin/audit_trail.php‎

Lines changed: 87 additions & 73 deletions
Original file line numberDiff line numberDiff line change
@@ -1,74 +1,84 @@
11
<?php
2-
/* This Source Code Form is subject to the terms of the Mozilla Public
3-
* License, v. 2.0. If a copy of the MPL was not distributed with this
4-
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
5-
6-
require_once(realpath(__DIR__ . '/../includes/functions.php'));
7-
8-
// If the days value is post
9-
if (isset($_GET['days']))
10-
{
11-
$days = (int)$_GET['days'];
12-
}
13-
// Otherwise use a week
14-
else $days = 7;
15-
16-
if(isset($_POST['download_audit_log']))
17-
{
18-
global $escaper, $lang;
19-
// Include Laminas Escaper for HTML Output Encoding
20-
$escaper = new simpleriskEscaper();
21-
22-
// Add various security headers
23-
add_security_headers();
24-
25-
add_session_check(['check_admin' => true]);
26-
27-
// Include the SimpleRisk language file
28-
require_once(language_file());
29-
30-
if(is_admin())
31-
{
32-
// If extra is activated, download audit logs
33-
if (import_export_extra())
34-
{
35-
require_once(realpath(__DIR__ . '/../extras/import-export/index.php'));
2+
/* This Source Code Form is subject to the terms of the Mozilla Public
3+
* License, v. 2.0. If a copy of the MPL was not distributed with this
4+
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
5+
6+
require_once(realpath(__DIR__ . '/../includes/functions.php'));
7+
8+
// If the days value is post
9+
if (isset($_GET['days'])) {
10+
11+
$days = (int)$_GET['days'];
12+
13+
// Otherwise use a week
14+
} else {
15+
16+
$days = 7;
17+
18+
}
19+
20+
if (isset($_POST['download_audit_log'])) {
21+
22+
global $escaper, $lang;
3623

37-
download_audit_logs($days);
38-
}else{
39-
set_alert(true, "bad", $escaper->escapeHtml($lang['YouCantDownloadBecauseImportExportExtraDisabled']));
24+
// Include Laminas Escaper for HTML Output Encoding
25+
$escaper = new simpleriskEscaper();
26+
27+
// Add various security headers
28+
add_security_headers();
29+
30+
add_session_check(['check_admin' => true]);
31+
32+
// Include the SimpleRisk language file
33+
require_once(language_file());
34+
35+
if (is_admin()) {
36+
37+
// If extra is activated, download audit logs
38+
if (import_export_extra()) {
39+
40+
require_once(realpath(__DIR__ . '/../extras/import-export/index.php'));
41+
42+
download_audit_logs($days);
43+
44+
} else {
45+
46+
set_alert(true, "bad", $escaper->escapeHtml($lang['YouCantDownloadBecauseImportExportExtraDisabled']));
47+
refresh();
48+
49+
}
50+
51+
// If this is not admin user, disable download
52+
} else {
53+
54+
set_alert(true, "bad", $escaper->escapeHtml($lang['AdminPermissionRequired']));
4055
refresh();
56+
4157
}
4258
}
43-
// If this is not admin user, disable download
44-
else
45-
{
46-
set_alert(true, "bad", $escaper->escapeHtml($lang['AdminPermissionRequired']));
47-
refresh();
48-
}
49-
}
50-
51-
// Render the header and sidebar
52-
require_once(realpath(__DIR__ . '/../includes/renderutils.php'));
53-
render_header_and_sidebar(permissions: ['check_admin' => true]);
54-
55-
/*********************
56-
* FUNCTION: DISPLAY *
57-
*********************/
58-
function display()
59-
{
60-
global $lang;
61-
global $escaper;
62-
63-
// If import/export extra is enabled and admin user, shows export audit log button
64-
if (import_export_extra() && is_admin())
65-
{
66-
// Include the Import-Export Extra
67-
require_once(realpath(__DIR__ . '/../extras/import-export/index.php'));
68-
69-
display_audit_download_btn();
59+
60+
// Render the header and sidebar
61+
require_once(realpath(__DIR__ . '/../includes/renderutils.php'));
62+
render_header_and_sidebar(permissions: ['check_admin' => true]);
63+
64+
/*********************
65+
* FUNCTION: DISPLAY *
66+
*********************/
67+
function display() {
68+
69+
global $lang;
70+
global $escaper;
71+
72+
// If import/export extra is enabled and admin user, shows export audit log button
73+
if (import_export_extra() && is_admin()) {
74+
75+
// Include the Import-Export Extra
76+
require_once(realpath(__DIR__ . '/../extras/import-export/index.php'));
77+
78+
display_audit_download_btn();
79+
80+
}
7081
}
71-
}
7282

7383
?>
7484
<div class="row bg-white">
@@ -77,19 +87,23 @@ function display()
7787
<div class="row">
7888
<div class="col-4 form-group">
7989
<select name="days" id="days" class="form-select">
80-
<option value="7"<?php echo ($days == 7) ? " selected" : ""; ?>>Past Week</option>
81-
<option value="30"<?php echo ($days == 30) ? " selected" : ""; ?>>Past Month</option>
82-
<option value="90"<?php echo ($days == 90) ? " selected" : ""; ?>>Past Quarter</option>
83-
<option value="180"<?php echo ($days == 180) ? " selected" : ""; ?>>Past 6 Months</option>
84-
<option value="365"<?php echo ($days == 365) ? " selected" : ""; ?>>Past Year</option>
85-
<option value="36500"<?php echo ($days == 36500) ? " selected" : ""; ?>>All Time</option>
90+
<option value="7"<?= ($days == 7) ? " selected" : ""; ?>>Past Week</option>
91+
<option value="30"<?= ($days == 30) ? " selected" : ""; ?>>Past Month</option>
92+
<option value="90"<?= ($days == 90) ? " selected" : ""; ?>>Past Quarter</option>
93+
<option value="180"<?= ($days == 180) ? " selected" : ""; ?>>Past 6 Months</option>
94+
<option value="365"<?= ($days == 365) ? " selected" : ""; ?>>Past Year</option>
95+
<option value="36500"<?= ($days == 36500) ? " selected" : ""; ?>>All Time</option>
8696
</select>
8797
</div>
8898
<div class="col-8 form-group text-end">
89-
<?php display(); ?>
99+
<?php
100+
display();
101+
?>
90102
</div>
91103
</div>
92-
<?php get_audit_trail_html(NULL, $days); ?>
104+
<?php
105+
get_audit_trail_html(NULL, $days);
106+
?>
93107
</div>
94108
</div>
95109
</div>

‎simplerisk/admin/configure_risk_formula.php‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,28 @@
1010
// Check if the risk formula update was submitted
1111
if (isset($_POST['update_risk_formula'])) {
1212

13+
global $lang, $escaper;
14+
1315
$risk_model = (int)$_POST['risk_models'];
16+
$need_risk_score_normalization = !empty($_POST['need_risk_score_normalization']) ? 'true' : 'false';
1417

1518
// Check if risk model value is integer
1619
if (is_int($risk_model)) {
1720

1821
// Risk model should be between 1 and 5
1922
if ((1 <= $risk_model) && ($risk_model <= 6)) {
2023

24+
$current_need_risk_score_normalization = get_setting('need_risk_score_normalization', 'true');
25+
if ($need_risk_score_normalization != $current_need_risk_score_normalization) {
26+
27+
//Update the need_risk_score_normalization setting
28+
update_setting('need_risk_score_normalization', $need_risk_score_normalization);
29+
30+
// Display an alert
31+
set_alert(true, "good", $escaper->escapeHtml($lang['TheRiskScoreNormalizationSettingWasUpdatedSuccessfully_TheScoresOfExistingRisksWereRecalculatedBasedOnTheNewSetting']));
32+
33+
}
34+
2135
// Update the risk model
2236
update_risk_model($risk_model);
2337

‎simplerisk/admin/index.php‎

Lines changed: 25 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -179,7 +179,7 @@
179179
// Update the base url
180180
update_setting("simplerisk_base_url", $simplerisk_base_url);
181181

182-
$_SESSION['base_url'] = $simplerisk_base_url;
182+
$_SESSION['base_url'] = rtrim($simplerisk_base_url, '/');
183183
} else {
184184
set_alert(true, "bad", $escaper->escapeHtml($lang['InvalidSimpleriskBaseUrl']));
185185
$error = true;
@@ -897,13 +897,24 @@
897897
);
898898
}
899899

900+
$need_risk_score_normalization = get_setting("need_risk_score_normalization", "true");
901+
902+
// Calculate the maximum risk score based on the current risk model
903+
$max_risk = calculate_maximum_risk_score();
904+
905+
if ($need_risk_score_normalization == "true") {
906+
$multiple_index = 10;
907+
} else {
908+
$multiple_index = round((100 / $max_risk), 2);
909+
}
910+
900911
foreach ($ranges as $key => $range) {
901912
if ($key == 0) {
902-
$slider_bg_grad = "{$range['color']} " . ($range['range'][1] * 10) . "%";
913+
$slider_bg_grad = "{$range['color']} " . ($range['range'][1] * $multiple_index) . "%";
903914
} elseif ($key == count($ranges) - 1) {
904-
$slider_bg_grad .= ", {$range['color']} " . ($ranges[$key - 1]['range'][1] * 10) . "%, {$range['color']} 100%";
915+
$slider_bg_grad .= ", {$range['color']} " . ($ranges[$key - 1]['range'][1] * $multiple_index) . "%, {$range['color']} 100%";
905916
} else {
906-
$slider_bg_grad .= ", {$range['color']} " . ($ranges[$key - 1]['range'][1] * 10) . "%, {$range['color']} " . ($range['range'][1] * 10) . "%";
917+
$slider_bg_grad .= ", {$range['color']} " . ($ranges[$key - 1]['range'][1] * $multiple_index) . "%, {$range['color']} " . ($range['range'][1] * $multiple_index) . "%";
907918
}
908919
}
909920
?>
@@ -1526,7 +1537,17 @@ function handleValueInRange(value) {
15261537
$("#slider").slider({
15271538
value:<?= $risk_appetite * 10; ?>,
15281539
min: 0,
1540+
<?php
1541+
if ($need_risk_score_normalization == "true") {
1542+
echo "
15291543
max: 100,
1544+
";
1545+
} else {
1546+
echo "
1547+
max: " . $max_risk * 10 . ",
1548+
";
1549+
}
1550+
?>
15301551
step: 1,
15311552
create: function() {
15321553
handleValueInRange($("#slider").slider("value") / 10);

‎simplerisk/api/index.php‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ function getRoute() { return app(); }
126126
app()->get('/governance/selected_parent_frameworks_dropdown', 'getSelectedParentFrameworksDropdownResponse');
127127
app()->get('/governance/control', 'getControlResponse');
128128
app()->get('/governance/framework', 'getFrameworkResponse');
129+
app()->post('/governance/update_framework', 'updateFrameworkResponse');
129130
app()->get('/governance/parent_documents_dropdown', 'getParentDocumentsDropdownResponse');
130131
app()->get('/governance/documents', 'getDocumentsResponse');
131132
app()->get('/governance/document', 'getDocumentResponse');
@@ -199,11 +200,13 @@ function getRoute() { return app(); }
199200
app()->post('/exceptions/update', 'update_exception_api');
200201
app()->post('/exceptions/delete', 'delete_exception_api');
201202
app()->post('/exceptions/approve', 'approve_exception_api');
203+
app()->post('/exceptions/unapprove', 'unapprove_exception_api');
202204
app()->post('/exceptions/batch-delete', 'batch_delete_exception_api');
203205
app()->get('/exceptions/tree', 'get_exceptions_as_treegrid_api');
204206
app()->get('/exceptions/exception', 'get_exception_api');
205207
app()->get('/exceptions/info', 'get_exception_for_display_api');
206208
app()->get('/exceptions/audit_log', 'get_exceptions_audit_log_api');
209+
app()->get('/exceptions/status', 'get_exceptions_status_api');
207210
/***********************************************************/
208211

209212
app()->get('/management/tag_options_of_type', 'getTagOptionsOfType');

‎simplerisk/api/v2/documentation.php‎

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -18,22 +18,19 @@
1818

1919
// Include the CSRF Magic library
2020
include_csrf_magic();
21-
22-
// It's saved safe so we're assuming it IS safe so dislaying it raw
23-
$base_url = get_setting('simplerisk_base_url');
2421
?>
2522
<!DOCTYPE html>
2623
<html lang="en">
2724
<head>
2825
<meta charset="UTF-8">
2926
<title>SimpleRisk API Documentation</title>
30-
<link rel="stylesheet" type="text/css" href="<?= $base_url ?>/vendor/swagger-api/swagger-ui/dist/swagger-ui.css">
31-
<script src="<?= $base_url ?>/vendor/swagger-api/swagger-ui/dist/swagger-ui-bundle.js"></script>
32-
<script src="<?= $base_url ?>/vendor/swagger-api/swagger-ui/dist/swagger-ui-standalone-preset.js"></script>
27+
<link rel="stylesheet" type="text/css" href="<?= build_url("vendor/swagger-api/swagger-ui/dist/swagger-ui.css") ?>"/>
28+
<script src="<?= build_url("vendor/swagger-api/swagger-ui/dist/swagger-ui-bundle.js") ?>"></script>
29+
<script src="<?= build_url("vendor/swagger-api/swagger-ui/dist/swagger-ui-standalone-preset.js") ?>"></script>
3330
<script>
3431
window.onload = function() {
3532
const ui = SwaggerUIBundle({
36-
url: "<?= $base_url ?>/api/v2/documentation/index.php",
33+
url: "<?= build_url("api/v2/documentation/index.php") ?>",
3734
dom_id: '#swagger-ui',
3835
requestInterceptor: function(request) {
3936
// Add the CSRF token to the request header if it's a POST

‎simplerisk/api/v2/documentation/admin.php‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -170,4 +170,24 @@ class OpenApiAdminTagsDelete {}
170170
*/
171171
class OpenApiAdminAllTagsDelete {}
172172

173+
/**
174+
* @OA\Get(
175+
* path="/admin/governance/documents/maptocontrols",
176+
* summary="Initiate an analysis of all document content to controls",
177+
* operationId="mapDocumentsToControls",
178+
* tags={"Administrator Operations"},
179+
* security={{"ApiKeyAuth":{}}},
180+
* @OA\Response(
181+
* response=200,
182+
* description="Mapped documents",
183+
* ),
184+
* @OA\Response(
185+
* response=403,
186+
* description="FORBIDDEN: The user does not having admin privileges.",
187+
* ),
188+
* )
189+
*/
190+
191+
class OpenApiAdminMapDocumentsToControls {}
192+
173193
?>

‎simplerisk/api/v2/documentation/general.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66

77
use OpenApi\Annotations as OA;
88

9-
define('SIMPLERISK_BASE_URL', get_setting("simplerisk_base_url"));
9+
define('SIMPLERISK_BASE_URL', rtrim(get_setting("simplerisk_base_url"), '/'));
1010
define('API_PATH', "/api/v2");
1111
define('SIMPLERISK_API_URL', SIMPLERISK_BASE_URL.API_PATH);
1212

0 commit comments

Comments
 (0)