SimpleRisk 20241209-001 Release

Author: jsokol

simplerisk/admin/index.php

@@ -1121,7 +1121,7 @@
                         </div>
                     </div>
                 </div>
-                <form name="backups_settings" method="post" action="">
+                <form name="backups_settings" method="post" action="" class="block-on-submit">
                     <div class="card-body my-2 border">
                         <div class="row">
                             <div class="col-md-12">

simplerisk/api/index.php

@@ -102,7 +102,7 @@ function getRoute() { return app(); }
         app()->post('/assessment/update', 'updateAssessment');
 
         app()->post('/datatable/framework_controls', 'getFrameworkControlsDatatable');
-        app()->get('/datatable/mitigation_controls', 'getMitigationControlsDatatable');
+        app()->post('/datatable/mitigation_controls', 'getMitigationControlsDatatable');
         app()->get('/role_responsibilities/get_responsibilities', 'getResponsibilitiesByRoleIdForm');
 
         /******************** Risk Management Datatatable API **********************/
@@ -136,7 +136,7 @@ function getRoute() { return app(); }
         app()->post('/governance/add_control', 'addControlResponse');
         app()->post('/governance/update_control', 'updateControlResponse');
 
-        app()->get('/compliance/define_tests', 'getDefineTestsResponse');
+        app()->post('/compliance/define_tests', 'getDefineTestsResponse');
         app()->get('/compliance/test', 'getTestResponse');
         app()->get('/compliance/initiate_audits', 'getInitiateTestAuditsResponse');
         app()->post('/compliance/active_audits', 'getActiveTestAuditsResponse');
@@ -265,6 +265,9 @@ function getRoute() { return app(); }
         app()->get('/complianceforgescf/disable', 'api_complianceforgescf_disable');
         app()->get('/complianceforgescf/status', 'api_complianceforgescf_status');
 
+    /************************** DATATABLE API BEGIN *******************************/
+        app()->post('/get/datatable', 'getDatatableAPI');
+    /*************************** DATATABLE API END ********************************/
 
 	/************************** SIMPLERISK EXTRAS APIS ************************************/
 

simplerisk/api/v2/index.php

@@ -150,7 +150,7 @@
     app()->post('/assessment/update', 'updateAssessment');
 
     app()->post('/datatable/framework_controls', 'getFrameworkControlsDatatable');
-    app()->get('/datatable/mitigation_controls', 'getMitigationControlsDatatable');
+    app()->post('/datatable/mitigation_controls', 'getMitigationControlsDatatable');
     app()->get('/role_responsibilities/get_responsibilities', 'getResponsibilitiesByRoleIdForm');
 
     /******************** Risk Management Datatatable API **********************/
@@ -184,7 +184,7 @@
     app()->post('/governance/add_control', 'addControlResponse');
     app()->post('/governance/update_control', 'updateControlResponse');
 
-    app()->get('/compliance/define_tests', 'getDefineTestsResponse');
+    app()->post('/compliance/define_tests', 'getDefineTestsResponse');
     app()->get('/compliance/test', 'getTestResponse');
     app()->get('/compliance/initiate_audits', 'getInitiateTestAuditsResponse');
     app()->post('/compliance/active_audits', 'getActiveTestAuditsResponse');
@@ -322,6 +322,10 @@
     // Enable / disable the Incident Management Extra
     app()->post('/admin/incidentmanagement', 'incidentManagementAPI');
 
+    /************************** DATATABLE API BEGIN *******************************/
+    app()->post('/get/datatable', 'getDatatableAPI');
+    /*************************** DATATABLE API END ********************************/
+
     /************************** SIMPLERISK EXTRAS APIS ************************************/
 
     // If the Advanced Search Extra is enabled

simplerisk/assessments/contacts.php

@@ -91,7 +91,7 @@
 <div id="aseessment-contact--add" class="modal fade" tabindex="-1" role="dialog" aria-labelledby="aseessment-contact--add" aria-hidden="true">
     <div class="modal-dialog modal-lg modal-dialog-scrollable modal-dialog-centered">
         <div class="modal-content">
-            <form method="post" action="">
+            <form method="post" action="" name="aseessment-contact--add-form">
                 <div class="modal-header">
                     <h4 class="modal-title"><?= $escaper->escapeHtml($lang['AddNewAssessmentContact']); ?></h4>
                     <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
@@ -111,7 +111,7 @@
                     </div>
                     <div class="form-group">
                         <label><?= $escaper->escapeHtml($lang['Phone']);?> :</label>
-                        <input required class = "form-control" name="phone" maxlength="200" size="100" value="" type="text">
+                        <input class = "form-control" name="phone" maxlength="200" size="100" value="" type="text">
                     </div>
                     <div class="form-group">
                         <label><?= $escaper->escapeHtml($lang['ContactManager']);?> :</label>
@@ -137,7 +137,7 @@
 <div id="aseessment-contact--edit" class="modal fade" tabindex="-1" role="dialog" aria-labelledby="aseessment-contact--edit" aria-hidden="true">
     <div class="modal-dialog modal-lg modal-dialog-scrollable modal-dialog-centered">
         <div class="modal-content">
-            <form method="post" action="">
+            <form method="post" action="" name="aseessment-contact--edit-form">
                 <input type='hidden' name='id' value=''/>
                 <div class="modal-header">
                     <h4 class="modal-title"><?= $escaper->escapeHtml($lang['UpdateAssessmentContact']); ?></h4>
@@ -158,7 +158,7 @@
                     </div>
                     <div class="form-group">
                         <label><?= $escaper->escapeHtml($lang['Phone']);?> :</label>
-                        <input name="phone" class = "form-control" maxlength="200" value="" size="100" type="text" required>
+                        <input name="phone" class = "form-control" maxlength="200" value="" size="100" type="text">
                     </div>
                     <div class="form-group">
                         <label><?= $escaper->escapeHtml($lang['ContactManager']);?> :</label>
@@ -264,6 +264,16 @@
             $("#aseessment-contact--delete").modal("show");
 
         });
+        
+        // Phone number validation before submitting the add/edit assessment contact form data
+        $('body').on("submit", "[name=aseessment-contact--add-form], [name=aseessment-contact--edit-form]", function() {
+            let phone_regex = /^[+]?[\d\s-]{10,15}$/;
+            let input_value = $(this).find("[name=phone]").val();
+            if (!phone_regex.test(input_value)) {
+                toastr.error("<?= $escaper->escapeHtml($lang['PleaseEnterAValidPhoneNumber']) ?>");
+                event.preventDefault();
+            }
+        });
 
     });
 

simplerisk/compliance/active_audits.php

@@ -1,25 +1,24 @@
 <?php
-/* This Source Code Form is subject to the terms of the Mozilla Public
-* License, v. 2.0. If a copy of the MPL was not distributed with this
-* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+    /* This Source Code Form is subject to the terms of the Mozilla Public
+    * License, v. 2.0. If a copy of the MPL was not distributed with this
+    * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-// Include required functions file
-require_once(realpath(__DIR__ . '/../includes/renderutils.php'));
-render_header_and_sidebar(['blockUI', 'selectize', 'datatables', 'WYSIWYG', 'multiselect', 'CUSTOM:pages/compliance.js', 'CUSTOM:common.js'], ['check_compliance' => true]);
+    // Include required functions file
+    require_once(realpath(__DIR__ . '/../includes/renderutils.php'));
+    render_header_and_sidebar(['blockUI', 'selectize', 'datatables', 'WYSIWYG', 'multiselect', 'CUSTOM:pages/compliance.js', 'CUSTOM:common.js'], ['check_compliance' => true]);
 
-// Include required functions file
-require_once(realpath(__DIR__ . '/../includes/governance.php'));
-require_once(realpath(__DIR__ . '/../includes/compliance.php'));
+    // Include required functions file
+    require_once(realpath(__DIR__ . '/../includes/compliance.php'));
 
 ?>
 <div class="row bg-white">
     <div class="col-12">
-        <div class="compliance-content-container">
-            <?php display_active_audits(); ?>
-        </div>
+    <?php 
+        display_active_audits(); 
+    ?>
     </div>
 </div>
 <?php  
-// Render the footer of the page. Please don't put code after this part.
-render_footer();
+    // Render the footer of the page. Please don't put code after this part.
+    render_footer();
 ?>

simplerisk/compliance/past_audits.php

@@ -1,20 +1,21 @@
 <?php
-/* This Source Code Form is subject to the terms of the Mozilla Public
-* License, v. 2.0. If a copy of the MPL was not distributed with this
-* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+    /* This Source Code Form is subject to the terms of the Mozilla Public
+    * License, v. 2.0. If a copy of the MPL was not distributed with this
+    * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-// Include required functions file
-require_once(realpath(__DIR__ . '/../includes/renderutils.php'));
-render_header_and_sidebar(['blockUI', 'selectize', 'datatables', 'WYSIWYG', 'multiselect', 'datetimerangepicker', 'CUSTOM:pages/compliance.js'], ['check_compliance' => true]);
+    // Include required functions file
+    require_once(realpath(__DIR__ . '/../includes/renderutils.php'));
+    render_header_and_sidebar(['blockUI', 'selectize', 'datatables', 'WYSIWYG', 'multiselect', 'datetimerangepicker', 'CUSTOM:pages/compliance.js'], ['check_compliance' => true]);
 
-// Include required functions file
-require_once(realpath(__DIR__ . '/../includes/governance.php'));
-require_once(realpath(__DIR__ . '/../includes/compliance.php'));
+    // Include required functions file
+    require_once(realpath(__DIR__ . '/../includes/compliance.php'));
 
 ?>
-<div class="row bg-white compliance-content-container">
+<div class="row bg-white">
     <div class="col-12">
-        <?php display_past_audits(); ?>
+    <?php 
+        display_past_audits(); 
+    ?>
     </div>
 </div>
 <?php

simplerisk/cron/cron_backup.php

@@ -95,10 +95,22 @@ function do_backup($force=false) {
 
     // Get the path to the database backup file
     $db_backup_file = $timestamp_path . '/simplerisk-db-backup-' . $timestamp . '.sql';
+
+    // Get the mysqldump command
+    $cmd = get_mysqldump_command();
+
+    // Add the output redirect to the mysqldump command
+    $db_backup_cmd = $cmd . ' > ' . escapeshellarg($db_backup_file);
+
+    // Backup the database
+    $mysqldump = system($db_backup_cmd);
+
+    $db_zip_file_name = $timestamp_path . '/simplerisk-db-backup-' . $timestamp . '.zip';
     create_zip_file($db_backup_file, $db_zip_file_name);
 
     // Remove the uncompressed database backup
     unlink($db_backup_file);
+
     // Create a zip file containing the current SimpleRisk files
     $simplerisk_directory =  realpath(__DIR__) . '/../';
     $app_zip_file_name = $timestamp_path . '/simplerisk-app-backup-' . $timestamp . '.zip';
@@ -119,45 +131,56 @@ function do_backup($force=false) {
     $stmt->bindParam(":app_zip_file_name", $app_zip_file_name, PDO::PARAM_STR);
     $stmt->bindParam(":db_zip_file_name", $db_zip_file_name, PDO::PARAM_STR);
     $stmt->execute();
-    
-    // Delete backup information from the database that is older than the backup_remove days ago
-    $stmt = $db->prepare("DELETE FROM `backups` WHERE timestamp < (NOW() - INTERVAL :backup_remove DAY);");
+
+    // Get the list of expired backups
+    $stmt = $db->prepare("SELECT * FROM `backups` WHERE timestamp < (NOW() - INTERVAL :backup_remove DAY);");
     $stmt->bindParam(":backup_remove", $backup_remove, PDO::PARAM_INT);
     $stmt->execute();
-    
-    // Close the database connection
-    db_close($db);
-    
-    $directories = glob($backup_path."/*");
-    $now = time();
-    
-    // Remove all directories older than the backup remove days
-    foreach ($directories as $directory)
-    {
-        // If it is a directory
-        if (is_dir($directory))
-        {
-            // If the directory was created more than the backup_remove days ago
-            // 60 seconds x 60 minutes x 24 hours x # of days
-            if ($now - filemtime($directory) >= 60 * 60 * 24 * $backup_remove)
-            {
-                // Remove all files from this directory
-                array_map('unlink', glob("$directory/*.*"));
-                
-                // Remove the directory
-                rmdir($directory);
-                
-                $message = "Removed backup older than {$backup_remove} days: {$directory}.";
-                write_debug_log_cli($message);
-                write_log(0, 0, $message, 'backup');
+    $backups_to_delete = $stmt->fetchAll(PDO::FETCH_ASSOC);
+
+    // Iterate through the list of expired backups and clean them up
+    foreach ($backups_to_delete as $backup_to_delete) {
+
+        // Initializing variables in every iteration
+        $parent_directory = dirname($backup_to_delete['app_zip_file_name']);
+        $missing_backup_directory = !is_dir($parent_directory);
+        $backup_directory_delete_successful = false;
+
+        // If the backup directory exists
+        if (!$missing_backup_directory) {
+
+            // Remove all files from this directory
+            array_map('unlink', glob("$parent_directory/*.*"));
+
+            // Remove the directory
+            rmdir($parent_directory);
+
+            // Check if the directory was successfully removed
+            $backup_directory_delete_successful = !is_dir($parent_directory);
+            if ($backup_directory_delete_successful) {
+                $message = "Removed backup older than {$backup_remove} days: '{$parent_directory}'.";
+            } else {
+                $message = "Failed to remove backup directory '{$parent_directory}', not deleting the associated database entry.";
             }
+        } else {
+            $message = "Backup directory '{$parent_directory}' was already deleted, cleaned up associated database entry.";
         }
+
+        // Delete the database entry if the directory was either missing already or successfully deleted
+        if ($missing_backup_directory || $backup_directory_delete_successful) {
+            $stmt = $db->prepare("DELETE FROM `backups` WHERE `random_id` = :random_id;");
+            $stmt->bindParam(":random_id", $backup_to_delete['random_id'], PDO::PARAM_STR);
+            $stmt->execute();
+        }
+
+        write_debug_log_cli($message);
+        write_log(0, 0, $message, 'backup');
     }
-    
+
     $message = "Backup successfully completed.";
     write_debug_log_cli($message);
     write_log(0, 0, $message, 'backup');
-    
+
     // If the backup was requested from the UI
     if ($force) {
         set_alert(true, "good", $message);

simplerisk/css/style.min.css

@@ -6,7 +6,8 @@
     'CUSTOM:common.js' => ['Yes', 'Cancel', 'FieldIsRequired'],
     'EXTRA:JS:assessments:questionnaire_templates.js' => ['SelectedOnAnotherTab', 'ID', 'SelectedQuestions', 'SearchForQuestion', 'ConfirmDisableTabbedExperience', 'ConfirmDeleteTab', 'NewTab', 'Default'],
     'CUSTOM:pages/plan-project.js' => ['AreYouSureYouWantToDeleteThisProject'],
-    'datatables' => ['All', 'datatables_ShowAll', 'datatables_ShowLess', 'First', 'Previous', 'Next', 'Last']
+    'datatables' => ['All', 'datatables_ShowAll', 'datatables_ShowLess', 'First', 'Previous', 'Next', 'Last'],
+    'blockUI' => ['ProcessingPleaseWait'],
 ];
 
 ?>
@@ -116,13 +117,44 @@
 			$.blockUI.defaults.css = {
 				padding: 0,
                 margin: 0,
-                width: '30%',
+                width: '20%',
                 top: '40%',
-                left: '35%',
+                left: '40%',
                 textAlign: 'center',
                 cursor: 'wait',
-				blockMsgClass: 'blockMsg'
+                color: 'var(--sr-light)',
+				backgroundColor: 'rgba(0, 0, 0, 0)', // hide the background, so only the spinner is visible
 			};
+
+            $.blockUI.defaults.overlayCSS = { 
+                backgroundColor: 'var(--sr-dark)', 
+                opacity: 0.6, 
+                cursor: 'wait' 
+        	}
+
+			$.blockUI.defaults.message = "<i class='fa fa-spinner fa-spin' style='font-size:24px;'></i>";
+
+			// Store the original blockUI object, so we can still call it as a function and reassign its properties to the new implementation
+		    var _original_blockui = $.blockUI;
+
+			// Redefine the blockUI function call, so we can have different 'defaults' for it than for the block() function
+            $.blockUI = function(arguments){
+				_original_blockui({
+					css: {
+    					padding: 5,
+    					border: '3px solid var(--sr-default)',
+    					backgroundColor: 'var(--sr-dark)',
+    				},
+    				message: "<i class='fa fa-spinner fa-spin' style='font-size:24px; padding-right: 10px;'></i>" + _lang['ProcessingPleaseWait'],
+    			});
+            };
+
+            // Assign the properties of the original to the new implementation
+            Object.assign($.blockUI, _original_blockui);
+		});
+
+		$(document).on('submit', 'form.block-on-submit', function (e) {
+			$.blockUI();
 		});
 	</script>
 <?php 
@@ -585,6 +617,7 @@ function resize() {el.width((el.val().length + 1) * int);}
                 var label = $(this).parent().find("span.editable");
                 $(this).hide();
                 label.text($(this).val());
+                label.attr("title", $(this).val());
                 label.show();
             });
         });