first steps credential store

This commit is contained in:
fbsanchez 2019-06-21 12:03:25 +02:00
parent e2e53cf248
commit 6682bad19f
7 changed files with 483 additions and 104 deletions

View File

@ -42,4 +42,15 @@ ALTER TABLE `tusuario` ADD COLUMN `ehorus_user_level_user` VARCHAR(60);
ALTER TABLE `tusuario` ADD COLUMN `ehorus_user_level_pass` VARCHAR(45);
ALTER TABLE `tusuario` ADD COLUMN `ehorus_user_level_enabled` TINYINT(1) DEFAULT '1';
CREATE TABLE IF NOT EXISTS `tcredential_store` (
`identifier` varchar(100) NOT NULL,
`id_group` mediumint(4) unsigned NOT NULL DEFAULT 0,
`product` text,
`username` text,
`password` text,
`extra_1` text,
`extra_2` text,
PRIMARY KEY (`identifier`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
COMMIT;

View File

@ -2192,3 +2192,16 @@ CREATE TABLE `tvisual_console_elements_cache` (
ON UPDATE CASCADE
) engine=InnoDB DEFAULT CHARSET=utf8;
-- ---------------------------------------------------------------------
-- Table `tcredential_store`
-- ---------------------------------------------------------------------
CREATE TABLE IF NOT EXISTS `tcredential_store` (
`identifier` varchar(100) NOT NULL,
`id_group` mediumint(4) unsigned NOT NULL DEFAULT 0,
`product` text,
`username` text,
`password` text,
`extra_1` text,
`extra_2` text,
PRIMARY KEY (`identifier`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

View File

@ -0,0 +1,184 @@
<?php
/**
* Credentials management view.
*
* @category Credentials management
* @package Pandora FMS
* @subpackage Opensource
* @version 1.0.0
* @license See below
*
* ______ ___ _______ _______ ________
* | __ \.-----.--.--.--| |.-----.----.-----. | ___| | | __|
* | __/| _ | | _ || _ | _| _ | | ___| |__ |
* |___| |___._|__|__|_____||_____|__| |___._| |___| |__|_|__|_______|
*
* ============================================================================
* Copyright (c) 2005-2019 Artica Soluciones Tecnologicas
* Please see http://pandorafms.org for full contribution list
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation for version 2.
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
* ============================================================================
*/
// Begin.
global $config;
// Check access.
check_login();
if (! check_acl($config['id_user'], 0, 'PM')) {
db_pandora_audit(
'ACL Violation',
'Trying to access event viewer'
);
if (is_ajax()) {
return ['error' => 'noaccess'];
}
include 'general/noaccess.php';
return;
}
// Required files.
ui_require_css_file('credential_store');
require_once $config['homedir'].'/include/functions_credential_store.php';
if (is_ajax()) {
$draw = get_parameter('draw', 0);
$filter = get_parameter('filter', []);
if ($draw) {
// Datatables offset, limit and order.
$start = get_parameter('start', 0);
$length = get_parameter('length', $config['block_size']);
$order = get_datatable_order(true);
try {
ob_start();
$fields = [
'cs.*',
'tg.nombre as `group`',
];
// Retrieve data.
$data = credentials_get_all(
// Fields.
$fields,
// Filter.
$filter,
// Offset.
$start,
// Limit.
$length,
// Order.
$order['direction'],
// Sort field.
$order['field']
);
// Retrieve counter.
$count = credentials_get_all(
'count',
$filter
);
if ($data) {
$data = array_reduce(
$data,
function ($carry, $item) {
// Transforms array of arrays $data into an array
// of objects, making a post-process of certain fields.
$tmp = (object) $item;
$tmp->username = io_safe_output($tmp->username);
$carry[] = $tmp;
return $carry;
}
);
}
// Datatables format: RecordsTotal && recordsfiltered.
echo json_encode(
[
'data' => $data,
'recordsTotal' => $count,
'recordsFiltered' => $count,
]
);
// Capture output.
$response = ob_get_clean();
} catch (Exception $e) {
return json_encode(['error' => $e->getMessage()]);
}
// If not valid, show error with issue.
json_decode($response);
if (json_last_error() == JSON_ERROR_NONE) {
// If valid dump.
echo $response;
} else {
echo json_encode(
['error' => $response]
);
}
return;
}
return;
}
// Load interface.
try {
$columns = [
'group',
'identifier',
'product',
'username',
'options',
];
$column_names = [
__('Group'),
__('Identifier'),
__('Product'),
__('User'),
[
'text' => __('Options'),
'class' => 'action_buttons',
],
];
// Load datatables user interface.
ui_print_datatable(
[
'class' => 'info_table events',
'style' => 'width: 100%',
'columns' => $columns,
'column_names' => $column_names,
'ajax_url' => 'godmode/groups/credential_store',
'ajax_postprocess' => 'process_datatables_item(item)',
'no_sortable_columns' => [-1],
]
);
} catch (Exception $e) {
echo $e->getMessage();
}
?>
<script type="text/javascript">
function process_datatables_item(item) {
item.options = 'aa';
}
</script>

View File

@ -1,20 +1,36 @@
<?php
/**
* Group management view.
*
* @category Group View
* @package Pandora FMS
* @subpackage Opensource
* @version 1.0.0
* @license See below
*
* ______ ___ _______ _______ ________
* | __ \.-----.--.--.--| |.-----.----.-----. | ___| | | __|
* | __/| _ | | _ || _ | _| _ | | ___| |__ |
* |___| |___._|__|__|_____||_____|__| |___._| |___| |__|_|__|_______|
*
* ============================================================================
* Copyright (c) 2005-2019 Artica Soluciones Tecnologicas
* Please see http://pandorafms.org for full contribution list
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation for version 2.
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
* ============================================================================
*/
// Pandora FMS - http://pandorafms.com
// ==================================================
// Copyright (c) 2005-2010 Artica Soluciones Tecnologicas
// Please see http://pandorafms.org for full contribution list
// This program is free software; you can redistribute it and/or
// modify it under the terms of the GNU General Public License
// as published by the Free Software Foundation for version 2.
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
// Begin.
ui_require_css_file('tree');
ui_require_css_file('fixed-bottom-box');
// Load global vars
// Load global vars.
global $config;
check_login();
@ -76,15 +92,17 @@ if (is_ajax()) {
$recursion = (int) get_parameter('recursion', 0);
$privilege = (string) get_parameter('privilege', '');
$all_agents = (int) get_parameter('all_agents', 0);
// Is is possible add keys prefix to avoid auto sorting in js object conversion
// Is is possible add keys prefix to avoid auto sorting in
// js object conversion.
$keys_prefix = (string) get_parameter('keys_prefix', '');
// This attr is for the operation "bulk alert accions add", it controls the query that take the agents
// from db
// This attr is for the operation "bulk alert accions add", it controls
// the query that take the agents from db.
$add_alert_bulk_op = get_parameter('add_alert_bulk_op', false);
// Ids of agents to be include in the SQL clause as id_agent IN ()
// Ids of agents to be include in the SQL clause as id_agent IN ().
$filter_agents_json = (string) get_parameter('filter_agents_json', '');
$status_agents = (int) get_parameter('status_agents', AGENT_STATUS_ALL);
// Juanma (22/05/2014) Fix: If setted remove void agents from result (by default and for compatibility show void agents)
// Juanma (22/05/2014) Fix: If setted remove void agents from result
// (by default and for compatibility show void agents).
$show_void_agents = (int) get_parameter('show_void_agents', 1);
$serialized = (bool) get_parameter('serialized', false);
$serialized_separator = (string) get_parameter('serialized_separator', '|');
@ -121,7 +139,7 @@ if (is_ajax()) {
$filter['status'] = $status_agents;
}
// Juanma (22/05/2014) Fix: If remove void agents setted
// Juanma (22/05/2014) Fix: If remove void agents set.
$_sql_post = ' 1=1 ';
if ($show_void_agents == 0) {
$_sql_post .= ' AND id_agente IN (SELECT a.id_agente FROM tagente a, tagente_modulo b WHERE a.id_agente=b.id_agente AND b.delete_pending=0) AND \'1\'';
@ -131,8 +149,9 @@ if (is_ajax()) {
$id_groups_get_agents = $id_group;
if ($id_group == 0 && $privilege != '') {
$groups = users_get_groups($config['id_user'], $privilege, false);
// if group ID doesn't matter and $privilege is specified (like 'AW'),
// retruns all agents that current user has $privilege privilege for.
// If group ID doesn't matter and $privilege is specified
// (like 'AW'), retruns all agents that current user has $privilege
// privilege for.
$id_groups_get_agents = array_keys($groups);
}
@ -149,13 +168,13 @@ if (is_ajax()) {
);
$agents_disabled = [];
// Add keys prefix
// Add keys prefix.
if ($keys_prefix !== '') {
foreach ($agents as $k => $v) {
$agents[$keys_prefix.$k] = $v;
unset($agents[$k]);
if ($all_agents) {
// Unserialize to get the status
// Unserialize to get the status.
if ($serialized && is_metaconsole()) {
$agent_info = explode($serialized_separator, $k);
$agent_disabled = db_get_value_filter(
@ -174,7 +193,8 @@ if (is_ajax()) {
['id_agente' => $agent_info[1]]
);
} else if (!$serialized && is_metaconsole()) {
// Cannot retrieve the disabled status. Mark all as not disabled
// Cannot retrieve the disabled status.
// Mark all as not disabled.
$agent_disabled = 0;
} else {
$agent_disabled = db_get_value_filter(
@ -226,11 +246,13 @@ if (! check_acl($config['id_user'], 0, 'PM')) {
}
$sec = defined('METACONSOLE') ? 'advanced' : 'gagente';
$url_tree = "index.php?sec=$sec&sec2=godmode/groups/group_list&tab=tree";
$url_groups = "index.php?sec=$sec&sec2=godmode/groups/group_list&tab=groups";
$url_credbox = 'index.php?sec='.$sec.'&sec2=godmode/groups/group_list&tab=credbox';
$url_tree = 'index.php?sec='.$sec.'&sec2=godmode/groups/group_list&tab=tree';
$url_groups = 'index.php?sec='.$sec.'&sec2=godmode/groups/group_list&tab=groups';
$buttons['tree'] = [
'active' => false,
'text' => "<a href='$url_tree'>".html_print_image(
'text' => '<a href="'.$url_tree.'">'.html_print_image(
'images/gm_massive_operations.png',
true,
[
@ -241,7 +263,7 @@ $buttons['tree'] = [
$buttons['groups'] = [
'active' => false,
'text' => "<a href='$url_groups'>".html_print_image(
'text' => '<a href="'.$url_groups.'">'.html_print_image(
'images/group.png',
true,
[
@ -250,21 +272,38 @@ $buttons['groups'] = [
).'</a>',
];
$buttons['credbox'] = [
'active' => false,
'text' => '<a href="'.$url_credbox.'">'.html_print_image(
'images/key.png',
true,
[
'title' => __('Credential Store'),
]
).'</a>',
];
$tab = (string) get_parameter('tab', 'groups');
// Marks correct tab
$title = __('Groups defined in %s', get_product_name());
// Marks correct tab.
switch ($tab) {
case 'tree':
$buttons['tree']['active'] = true;
break;
case 'credbox':
$buttons['credbox']['active'] = true;
$title = __('Credential store');
break;
case 'groups':
default:
$buttons['groups']['active'] = true;
break;
}
// Header
// Header.
if (defined('METACONSOLE')) {
agents_meta_print_header();
echo '<div class="notify">';
@ -272,7 +311,7 @@ if (defined('METACONSOLE')) {
echo '</div>';
} else {
ui_print_page_header(
__('Groups defined in %s', get_product_name()),
$title,
'images/group.png',
false,
'group_list_tab',
@ -281,12 +320,19 @@ if (defined('METACONSOLE')) {
);
}
// Load credential store view before parse list-tree forms.
if ($tab == 'credbox') {
include_once __DIR__.'/credential_store.php';
// Stop script.
return;
}
$create_group = (bool) get_parameter('create_group');
$update_group = (bool) get_parameter('update_group');
$delete_group = (bool) get_parameter('delete_group');
$pure = get_parameter('pure', 0);
// Create group
// Create group.
if (($create_group) && (check_acl($config['id_user'], 0, 'PM'))) {
$name = (string) get_parameter('name');
$icon = (string) get_parameter('icon');
@ -301,7 +347,7 @@ if (($create_group) && (check_acl($config['id_user'], 0, 'PM'))) {
$check = db_get_value('nombre', 'tgrupo', 'nombre', $name);
$propagate = (bool) get_parameter('propagate');
// Check if name field is empty
// Check if name field is empty.
if ($name != '') {
if (!$check) {
$values = [
@ -328,12 +374,11 @@ if (($create_group) && (check_acl($config['id_user'], 0, 'PM'))) {
ui_print_error_message(__('Each group must have a different name'));
}
} else {
// $result = false;
ui_print_error_message(__('Group must have a name'));
}
}
// Update group
// Update group.
if ($update_group) {
$id_group = (int) get_parameter('id_group');
$name = (string) get_parameter('name');
@ -349,49 +394,35 @@ if ($update_group) {
$contact = (string) get_parameter('contact');
$other = (string) get_parameter('other');
// Check if name field is empty
// Check if name field is empty.
if ($name != '') {
switch ($config['dbtype']) {
case 'mysql':
$sql = sprintf(
'UPDATE tgrupo SET nombre = "%s",
icon = "%s", disabled = %d, parent = %d, custom_id = "%s", propagate = %d, id_skin = %d, description = "%s", contact = "%s", other = "%s", password = "%s"
WHERE id_grupo = %d',
$name,
empty($icon) ? '' : substr($icon, 0, -4),
!$alerts_enabled,
$id_parent,
$custom_id,
$propagate,
$skin,
$description,
$contact,
$other,
$group_pass,
$id_group
);
break;
case 'postgresql':
case 'oracle':
$sql = sprintf(
'UPDATE tgrupo SET nombre = \'%s\',
icon = \'%s\', disabled = %d, parent = %d, custom_id = \'%s\', propagate = %d, id_skin = %d, description = \'%s\', contact = \'%s\', other = \'%s\'
WHERE id_grupo = %d',
$name,
substr($icon, 0, -4),
!$alerts_enabled,
$id_parent,
$custom_id,
$propagate,
$skin,
$description,
$contact,
$other,
$id_group
);
break;
}
$sql = sprintf(
'UPDATE tgrupo
SET nombre = "%s",
icon = "%s",
disabled = %d,
parent = %d,
custom_id = "%s",
propagate = %d,
id_skin = %d,
description = "%s",
contact = "%s",
other = "%s",
password = "%s"
WHERE id_grupo = %d',
$name,
empty($icon) ? '' : substr($icon, 0, -4),
!$alerts_enabled,
$id_parent,
$custom_id,
$propagate,
$skin,
$description,
$contact,
$other,
$group_pass,
$id_group
);
$result = db_process_sql($sql);
} else {
@ -405,7 +436,7 @@ if ($update_group) {
}
}
// Delete group
// Delete group.
if (($delete_group) && (check_acl($config['id_user'], 0, 'PM'))) {
$id_group = (int) get_parameter('id_group');
@ -445,7 +476,14 @@ if (($delete_group) && (check_acl($config['id_user'], 0, 'PM'))) {
}
}
// Credential store is loaded previously in this document to avoid
// process group tree - list forms.
if ($tab == 'tree') {
/*
* Group tree view.
*/
echo html_print_image(
'images/spinner.gif',
true,
@ -456,6 +494,10 @@ if ($tab == 'tree') {
);
echo "<div id='tree-controller-recipient'></div>";
} else {
/*
* Group list view.
*/
$acl = '';
$search_name = '';
$offset = (int) get_parameter('offset', 0);
@ -463,17 +505,22 @@ if ($tab == 'tree') {
$block_size = $config['block_size'];
if (!empty($search)) {
$search_name = "AND t.nombre LIKE '%$search%'";
$search_name = 'AND t.nombre LIKE "%'.$search.'%"';
}
if (!users_can_manage_group_all('AR')) {
$user_groups_acl = users_get_groups(false, 'AR');
$groups_acl = implode(',', $user_groups_ACL);
if (empty($groups_acl)) {
return ui_print_info_message(['no_close' => true, 'message' => __('There are no defined groups') ]);
return ui_print_info_message(
[
'no_close' => true,
'message' => __('There are no defined groups'),
]
);
}
$acl = "AND t.id_grupo IN ($groups_acl)";
$acl = 'AND t.id_grupo IN ('.$groups_acl.')';
}
$form = "<form method='post' action=''>";
@ -488,29 +535,37 @@ if ($tab == 'tree') {
echo $form;
$groups_sql = "SELECT t.*,
$groups_sql = sprintf(
'SELECT t.*,
p.nombre AS parent_name,
IF(t.parent=p.id_grupo, 1, 0) AS has_child
FROM tgrupo t
LEFT JOIN tgrupo p
FROM tgrupo t
LEFT JOIN tgrupo p
ON t.parent=p.id_grupo
WHERE 1=1
$acl
$search_name
WHERE 1=1
%s
%s
ORDER BY nombre
LIMIT $offset, $block_size
";
LIMIT %d, %d',
$acl,
$search_name,
$offset,
$block_size
);
$groups = db_get_all_rows_sql($groups_sql);
if (!empty($groups)) {
// Count all groups for pagination only saw user and filters
$groups_sql_count = "SELECT count(*)
// Count all groups for pagination only saw user and filters.
$groups_sql_count = sprintf(
'SELECT count(*)
FROM tgrupo t
WHERE 1=1
$acl
$search_name
";
%s
%s',
$acl,
$search_name
);
$groups_count = db_get_value_sql($groups_sql_count);
$table = new StdClass();
@ -545,7 +600,7 @@ if ($tab == 'tree') {
$url = 'index.php?sec=gagente&sec2=godmode/groups/configure_group&id_group='.$group['id_grupo'];
$url_delete = 'index.php?sec=gagente&sec2=godmode/groups/group_list&delete_group=1&id_group='.$group['id_grupo'];
$table->data[$key][0] = $group['id_grupo'];
$table->data[$key][1] = "<a href='$url'>".$group['nombre'].'</a>';
$table->data[$key][1] = '<a href="'.$url.'">'.$group['nombre'].'</a>';
if ($group['icon'] != '') {
$table->data[$key][2] = html_print_image(
'images/groups_small/'.$group['icon'].'.png',
@ -553,22 +608,25 @@ if ($tab == 'tree') {
[
'style' => '',
'class' => 'bot',
'alt' => $group['nombre'],
'alt' => $group['nombre'],
'title' => $group['nombre'],
false, false, false, true
]
],
false,
false,
false,
true
);
} else {
$table->data[$key][2] = '';
}
// reporting_get_group_stats
$table->data[$key][3] = $group['disabled'] ? __('Disabled') : __('Enabled');
// Reporting_get_group_stats.
$table->data[$key][3] = ($group['disabled']) ? __('Disabled') : __('Enabled');
$table->data[$key][4] = $group['parent_name'];
$table->data[$key][5] = $group['description'];
$table->cellclass[$key][6] = 'action_buttons';
$table->data[$key][6] = "<a href='$url'>".html_print_image(
$table->data[$key][6] = '<a href="'.$url.'">'.html_print_image(
'images/config.png',
true,
[

View File

@ -0,0 +1,97 @@
<?php
/**
* Credentials management auxiliary functions.
*
* @category Credentials management library.
* @package Pandora FMS
* @subpackage Opensource
* @version 1.0.0
* @license See below
*
* ______ ___ _______ _______ ________
* | __ \.-----.--.--.--| |.-----.----.-----. | ___| | | __|
* | __/| _ | | _ || _ | _| _ | | ___| |__ |
* |___| |___._|__|__|_____||_____|__| |___._| |___| |__|_|__|_______|
*
* ============================================================================
* Copyright (c) 2005-2019 Artica Soluciones Tecnologicas
* Please see http://pandorafms.org for full contribution list
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation for version 2.
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
* ============================================================================
*/
// Begin.
/**
* Returns an array with all the credentials matching filter and ACL.
*
* @param array $fields Fields array or 'count' keyword to retrieve count.
* @param array $filter Filters to be applied.
* @param integer $offset Offset (pagination).
* @param integer $limit Limit (pagination).
* @param string $order Sort order.
* @param string $sort_field Sort field.
*
* @return array With all results or false if error.
* @throws Exception On error.
*/
function credentials_get_all(
$fields,
array $filter,
$offset=null,
$limit=null,
$order=null,
$sort_field=null
) {
$sql_filters = [];
$group_by = '';
$pagination = '';
global $config;
$user_is_admin = users_is_admin();
if (!is_array($filter)) {
error_log('[credential_get_all] Filter must be an array.');
throw new Exception('[credential_get_all] Filter must be an array.');
}
$count = false;
if (!is_array($fields) && $fields == 'count') {
$fields = ['cs.*'];
$count = true;
} else if (!is_array($fields)) {
error_log('[credential_get_all] Fields must be an array or "count".');
throw new Exception('[credential_get_all] Fields must be an array or "count".');
}
$sql = sprintf(
'SELECT %s
FROM tcredential_store cs
LEFT JOIN tgrupo tg
ON tg.id_grupo = cs.id_group
WHERE 1=1
%s
%s
%s',
join(',', $fields),
join(',', $sql_filters),
$group_by,
$pagination
);
if ($count) {
$sql = sprintf('SELECT count(*) as n FROM ( %s ) tt', $sql);
return db_get_value_sql($sql);
}
return db_get_all_rows_sql($sql);
}

View File

@ -2907,8 +2907,10 @@ function ui_print_datatable(array $parameters)
if (isset($parameters['id'])) {
$table_id = $parameters['id'];
$form_id = 'form_'.$parameters['id'];
} else {
$table_id = uniqid('datatable_');
$form_id = uniqid('datatable_filter_');
}
if (!isset($parameters['columns']) || !is_array($parameters['columns'])) {
@ -2995,8 +2997,6 @@ function ui_print_datatable(array $parameters)
if (isset($parameters['form']) && is_array($parameters['form'])) {
if (isset($parameters['form']['id'])) {
$form_id = $parameters['form']['id'];
} else {
$form_id = uniqid('datatable_filter_');
}
if (isset($parameters['form']['class'])) {
@ -3220,8 +3220,10 @@ function ui_print_datatable(array $parameters)
$.extend(data, {
filter: values,'."\n";
foreach ($parameters['ajax_data'] as $k => $v) {
$js .= $k.':'.json_encode($v).",\n";
if (is_array($parameters['ajax_data'])) {
foreach ($parameters['ajax_data'] as $k => $v) {
$js .= $k.':'.json_encode($v).",\n";
}
}
$js .= 'page: "'.$parameters['ajax_url'].'"

View File

@ -693,6 +693,20 @@ CREATE TABLE IF NOT EXISTS `tgrupo` (
KEY `parent_index` (`parent`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
-- ---------------------------------------------------------------------
-- Table `tcredential_store`
-- ---------------------------------------------------------------------
CREATE TABLE IF NOT EXISTS `tcredential_store` (
`identifier` varchar(100) NOT NULL,
`id_group` mediumint(4) unsigned NOT NULL DEFAULT 0,
`product` text,
`username` text,
`password` text,
`extra_1` text,
`extra_2` text,
PRIMARY KEY (`identifier`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
-- ---------------------------------------------------------------------
-- Table `tincidencia`
-- ---------------------------------------------------------------------