SimpleRisk 20220701-001 Release

Author: jsokol

simplerisk/admin/index.php

@@ -287,15 +287,36 @@
     $addusers_tab = false;
     $manageusers_tab = true;
 
+    // Get the POSTed user ID
     $value = (int)$_POST['user'];
 
     // Verify value is an integer
     if (is_int($value) && $value > 0)
     {
-        password_reset_by_userid($value);
+        // Open the database connection
+        $db = db_open();
 
-        // Display an alert
-        set_alert(true, "good", "A password reset email was sent to the user.");
+        // Get any password resets for this user in the past 10 minutes
+        $stmt = $db->prepare("SELECT * FROM password_reset pw LEFT JOIN user u ON pw.username = u.username WHERE pw.timestamp >= NOW() - INTERVAL 10 MINUTE AND u.value=:value;");
+        $stmt->bindParam(":value", $value, PDO::PARAM_INT);
+        $stmt->execute();
+        $results = $stmt->fetchAll(PDO::FETCH_ASSOC);
+
+        // Close the database connection
+        db_close($db);
+
+        // If we have password resets in the past 10 minutes
+        if (count($results) != 0)
+        {
+            set_alert(true, "bad", $lang['PasswordResetRequestsExceeded']);
+        }
+        else
+        {
+            password_reset_by_userid($value);
+
+            // Display an alert
+            set_alert(true, "good", "A password reset email was sent to the user.");
+        }
     } else {
         set_alert(true, "bad", $lang['PleaseSelectUser']);
     }

simplerisk/admin/user_management.php

@@ -43,7 +43,7 @@
         $name       = $_POST['asset_name'];
         $ip         = $_POST['ip'];
         $value      = $_POST['value'];
-        $location   = (int)$_POST['location'];
+        $location   = empty($_POST['location']) ? [] : $_POST['location'];
         $teams      = empty($_POST['team']) ? [] : $_POST['team'];
         $details    = $_POST['details'];
         $tags       = empty($_POST['tags']) ? [] : $_POST['tags'];

simplerisk/assets/adddeleteassets.php

@@ -111,9 +111,10 @@
     $test_steps     = $_POST['test_steps'];
     $approximate_time = (int)($_POST['approximate_time']) ? $_POST['approximate_time'] : 0;
     $expected_results = $_POST['expected_results'];
+    $tags           = empty($_POST['tags']) ? [] : $_POST['tags'];
 
     // Update a framework control test
-    update_framework_control_test($test_id, $tester, $test_frequency, $name, $objective, $test_steps, $approximate_time, $expected_results, $last_date, $next_date, false, $additional_stakeholders, $teams);
+    update_framework_control_test($test_id, $tester, $test_frequency, $name, $objective, $test_steps, $approximate_time, $expected_results, $last_date, $next_date, false, $additional_stakeholders, $teams, $tags);
 
     set_alert(true, "good", $escaper->escapeHtml($lang['TestSuccessUpdated']));
 
@@ -168,6 +169,7 @@
 
 	display_bootstrap_javascript();
 ?>
+    <script src="../js/pages/compliance.js?<?php echo current_version("app"); ?>"></script>
     <script src="../js/bootstrap-multiselect.js?<?php echo current_version("app"); ?>"></script>
 
     <title>SimpleRisk: Enterprise Risk Management Simplified</title>
@@ -182,6 +184,8 @@
     <link rel="stylesheet" href="../vendor/components/font-awesome/css/fontawesome.min.css?<?php echo current_version("app"); ?>">
     <link rel="stylesheet" href="../css/theme.css?<?php echo current_version("app"); ?>">
     <link rel="stylesheet" href="../css/side-navigation.css?<?php echo current_version("app"); ?>">
+    <link rel="stylesheet" href="../css/selectize.bootstrap3.css?<?php echo current_version("app"); ?>">
+    <script src="../js/selectize.min.js?<?php echo current_version("app"); ?>"></script>
     <?php
         setup_favicon("..");
         setup_alert_requirements("..");
@@ -317,6 +321,16 @@
                         $('[name=approximate_time]', modal).val(data['approximate_time']);
                         $('[name=expected_results]', modal).val(data['expected_results']);
                         $(".datepicker" , modal).datepicker();
+                        $.each(data['tags'], function (i, item) {
+                            $('[name=\'tags[]\']', modal).append($('<option>', { 
+                                value: item,
+                                text : item,
+                                selected : true,
+                            }));
+                        });
+                        var select = $('[name=\'tags[]\']', modal).selectize();
+                        var selectize = select[0].selectize;
+                        selectize.setValue(data['tags']);
 
                         modal.modal();
                     }
@@ -332,13 +346,33 @@
                 }else if($(this).hasClass("initiate-test-btn")){
                     var type = "test";
                 }
+                var modal = $('#tags--edit');
+                $('[name=audit_type]', modal).val(type);
+                $('[name=id]', modal).val($(this).data('id'));
+                modal.modal();
+                return;
+            });
+            // Event when clicks Initiate Framework, Control, Test Audit button
+            $("#tags--edit").on("click", "[name=continue_add_tags], [name=cancel_add_tags]", function(){
+                var type = $("#tags--edit [name=audit_type]").val();
+                var id = $("#tags--edit [name=id]").val();
+                var tags = $("#tags--edit [name='tags[]']").val();
+                if($(this).attr("name") == "continue_add_tags") {
+                    var tags = $("#tags--edit [name='tags[]']").val();
+                } else {
+                    var tags = [];
+                }
+                var select = $("#tags--edit [name='tags[]']").selectize();
+                var selectize = select[0].selectize;
+                selectize.clear();
 
                 $.ajax({
                     url: BASE_URL + '/api/compliance/audit_initiation/initiate',
                     type: 'POST',
                     data: {
-                        type: type,// control, test
-                        id: $(this).data('id'),
+                        type: type, // control, test
+                        tags: tags, // selected tags
+                        id: id,
                     },
                     success : function (res){
                         if(res.status_message){
@@ -480,6 +514,10 @@
             <label for=""><?php echo $escaper->escapeHtml($lang['ExpectedResults']); ?></label>
             <textarea name="expected_results" class="form-control" rows="6" style="width:100%;"></textarea>
 
+            <label for=""><?php echo $escaper->escapeHtml($lang['Tags']); ?></label>
+            <select class="test_tags" readonly name="tags[]" multiple placeholder="<?php echo $escaper->escapeHtml($lang['TagsWidgetPlaceholder']);?>"></select>
+            <div class="tag-max-length-warning" style="margin-top:-10px"><?php echo $escaper->escapeHtml($lang['MaxTagLengthWarning']);?></div>
+
             <input type="hidden" name="test_id" value="">
 
           </div>
@@ -490,6 +528,31 @@
         </div>
       </form>
     </div>
+
+    <!-- MODEL WINDOW FOR ADD TAGS TO TEST -->
+    <div id="tags--edit" class="modal hide" tabindex="-1" role="dialog" aria-hidden="true">
+      <form class="" id="tags-edit-form" method="post" autocomplete="off">
+        <div class="modal-header">
+          <button type="button" class="close" data-dismiss="modal">&times;</button>
+          <h4 class="modal-title"><?php echo $escaper->escapeHtml($lang['AddTagsToTestAudit']); ?></h4>
+        </div>
+        <div class="modal-body">
+          <div class="form-group" style="margin-bottom: 100px;">
+            <label for=""><?php echo $escaper->escapeHtml($lang['Tags']); ?></label>
+            <select class="test_tags" readonly name="tags[]" multiple placeholder="<?php echo $escaper->escapeHtml($lang['TagsWidgetPlaceholder']);?>"></select>
+            <div class="tag-max-length-warning" style="margin-top:-10px"><?php echo $escaper->escapeHtml($lang['MaxTagLengthWarning']);?></div>
+
+            <input type="hidden" name="audit_type" value="">
+            <input type="hidden" name="id" value="">
+          </div>
+        </div>
+        <div class="modal-footer">
+          <button name="cancel_add_tags" class="btn btn-default" data-dismiss="modal" aria-hidden="true"><?php echo $escaper->escapeHtml($lang['Cancel']); ?></button>
+          <button name="continue_add_tags" class="btn btn-danger" data-dismiss="modal" aria-hidden="true"><?php echo $escaper->escapeHtml($lang['Continue']); ?></button>
+        </div>
+      </form>
+    </div>
+
     <script>
         $( document ).ready(function() {
             $("#additional_stakeholders").multiselect();

simplerisk/compliance/audit_initiation.php

@@ -52,6 +52,7 @@
         $expected_results           = $_POST['expected_results'];
         $framework_control_id       = (int)$_POST['framework_control_id'];
         $teams                      = isset($_POST['team']) ? array_filter($_POST['team'], 'ctype_digit') : [];
+        $tags                       = empty($_POST['tags']) ? [] : $_POST['tags'];
 
         if (!$last_date)
             $last_date = "0000-00-00";
@@ -72,7 +73,7 @@
         }
         if($error !== true) {
             // Add a framework control test
-            add_framework_control_test($tester, $test_frequency, $name, $objective, $test_steps, $approximate_time, $expected_results, $framework_control_id, $additional_stakeholders, $last_date, false, $teams);
+            add_framework_control_test($tester, $test_frequency, $name, $objective, $test_steps, $approximate_time, $expected_results, $framework_control_id, $additional_stakeholders, $last_date, false, $teams, $tags);
             set_alert(true, "good", $lang['TestSuccessCreated']);
 
         } else {
@@ -114,6 +115,7 @@
         $test_steps                 = $_POST['test_steps'];
         $approximate_time           = !empty($_POST['approximate_time']) ? (int)$_POST['approximate_time'] : 0;
         $expected_results           = $_POST['expected_results'];
+        $tags                       = empty($_POST['tags']) ? [] : $_POST['tags'];
 
         if ($test_frequency < 0) {
             $error = true;
@@ -149,7 +151,7 @@
         }
         if($error !== true) {
             // Update a framework control test
-            update_framework_control_test($test_id, $tester, $test_frequency, $name, $objective, $test_steps, $approximate_time, $expected_results, $last_date, $next_date, false, $additional_stakeholders, $teams);
+            update_framework_control_test($test_id, $tester, $test_frequency, $name, $objective, $test_steps, $approximate_time, $expected_results, $last_date, $next_date, false, $additional_stakeholders, $teams, $tags);
 
             set_alert(true, "good", $lang['TestSuccessUpdated']);
         } else {
@@ -227,6 +229,8 @@
     <link rel="stylesheet" href="../vendor/components/font-awesome/css/fontawesome.min.css?<?php echo current_version("app"); ?>">
     <link rel="stylesheet" href="../css/theme.css?<?php echo current_version("app"); ?>">
     <link rel="stylesheet" href="../css/side-navigation.css?<?php echo current_version("app"); ?>">
+    <link rel="stylesheet" href="../css/selectize.bootstrap3.css?<?php echo current_version("app"); ?>">
+    <script src="../js/selectize.min.js?<?php echo current_version("app"); ?>"></script>
     <?php
         setup_favicon("..");
         setup_alert_requirements("..");
@@ -360,6 +364,10 @@
             <label for=""><?php echo $escaper->escapeHtml($lang['ExpectedResults']); ?></label>
             <textarea name="expected_results" class="form-control" rows="6" style="width:100%;"></textarea>
 
+            <label for=""><?php echo $escaper->escapeHtml($lang['Tags']); ?></label>
+            <select class="test_tags" readonly name="tags[]" multiple placeholder="<?php echo $escaper->escapeHtml($lang['TagsWidgetPlaceholder']);?>"></select>
+            <div class="tag-max-length-warning" style="margin-top:-10px"><?php echo $escaper->escapeHtml($lang['MaxTagLengthWarning']);?></div>
+
             <input type="hidden" name="framework_control_id" value="">
             <input type="hidden" name="filter_by_control" value="">
             <input type="hidden" name="filter_by_control_family" value="">
@@ -416,6 +424,10 @@
             <label for=""><?php echo $escaper->escapeHtml($lang['ExpectedResults']); ?></label>
             <textarea name="expected_results" class="form-control" rows="6" style="width:100%;"></textarea>
 
+            <label for=""><?php echo $escaper->escapeHtml($lang['Tags']); ?></label>
+            <select class="test_tags" readonly name="tags[]" multiple placeholder="<?php echo $escaper->escapeHtml($lang['TagsWidgetPlaceholder']);?>"></select>
+            <div class="tag-max-length-warning" style="margin-top:-10px"><?php echo $escaper->escapeHtml($lang['MaxTagLengthWarning']);?></div>
+
             <input type="hidden" name="test_id" value="">
             <input type="hidden" name="filter_by_control" value="">
             <input type="hidden" name="filter_by_control_family" value="">

simplerisk/compliance/index.php

@@ -101,6 +101,7 @@
     <script src="../js/basescript.js?<?php echo current_version("app"); ?>"></script>
     <script src="../js/common.js?<?php echo current_version("app"); ?>"></script>
     <script src="../js/pages/risk.js?<?php echo current_version("app"); ?>"></script>
+    <script src="../js/pages/compliance.js?<?php echo current_version("app"); ?>"></script>
     <script src="../js/jquery.blockUI.min.js?<?php echo current_version("app"); ?>"></script>
 
     <title>SimpleRisk: Enterprise Risk Management Simplified</title>
@@ -229,6 +230,7 @@
     </body>
     <script>
         $(document).ready(function(){
+            $(".datepicker").datepicker();
             $('#tab-content-container select.assets-asset-groups-select').each(function() {
                 setupAssetsAssetGroupsWidget($(this));
             });

simplerisk/compliance/testing.php

@@ -122,6 +122,9 @@ function do_backup($force=false) {
 
     // Create a random id for the backup
     $random_id = generate_token(50);
+
+    // Open the database connection
+    $db = db_open();
 
     // Insert the backup information into the database
     $stmt = $db->prepare("INSERT INTO `backups` (`random_id`, `app_zip_file_name`, `db_zip_file_name`) VALUES (:random_id, :app_zip_file_name, :db_zip_file_name);");