From 8b8d17f089a9a768b2573b2c2293a4dd09bd94f0 Mon Sep 17 00:00:00 2001
From: fbsanchez <fborja.sanchez@artica.es>
Date: Tue, 18 Jun 2019 18:35:34 +0200
Subject: [PATCH] event ajax validation little improvement

---
 pandora_console/include/ajax/events.php       | 57 ++++++++++++++++++-
 .../include/javascript/pandora_events.js      | 24 +++++---
 pandora_console/operation/events/events.php   | 34 +++++++----
 3 files changed, 93 insertions(+), 22 deletions(-)

diff --git a/pandora_console/include/ajax/events.php b/pandora_console/include/ajax/events.php
index 6ec6222fa9..ce173898b2 100644
--- a/pandora_console/include/ajax/events.php
+++ b/pandora_console/include/ajax/events.php
@@ -87,9 +87,26 @@ $delete_event = get_parameter('delete_event', 0);
 if ($delete_event) {
     $filter = get_parameter('filter', []);
     $id_evento = get_parameter('id_evento', 0);
+    $event_rep = get_parameter('event_rep', 0);
+
+    if ($event_rep === 0) {
+        // Disable group by when there're result is unique.
+        $filter['group_rep'] = 0;
+    }
 
     // Check acl.
-    echo events_delete($id_evento, $filter);
+    if (! check_acl($config['id_user'], 0, 'EM')) {
+        echo 'unauthorized';
+        return;
+    }
+
+    $r = events_delete($id_evento, $filter);
+    if ($r === false) {
+        echo 'Failed';
+    } else {
+        echo $r;
+    }
+
     return;
 }
 
@@ -97,9 +114,26 @@ if ($delete_event) {
 if ($validate_event) {
     $filter = get_parameter('filter', []);
     $id_evento = get_parameter('id_evento', 0);
+    $event_rep = get_parameter('event_rep', 0);
+
+    if ($event_rep === 0) {
+        // Disable group by when there're result is unique.
+        $filter['group_rep'] = 0;
+    }
 
     // Check acl.
-    echo events_update_status($id_evento, EVENT_VALIDATE, $filter);
+    if (! check_acl($config['id_user'], 0, 'EW')) {
+        echo 'unauthorized';
+        return;
+    }
+
+    $r = events_update_status($id_evento, EVENT_VALIDATE, $filter);
+    if ($r === false) {
+        echo 'Failed';
+    } else {
+        echo $r;
+    }
+
     return;
 }
 
@@ -107,9 +141,26 @@ if ($validate_event) {
 if ($in_process_event) {
     $filter = get_parameter('filter', []);
     $id_evento = get_parameter('id_evento', 0);
+    $event_rep = get_parameter('event_rep', 0);
+
+    if ($event_rep === 0) {
+        // Disable group by when there're result is unique.
+        $filter['group_rep'] = 0;
+    }
 
     // Check acl.
-    echo events_update_status($id_evento, EVENT_PROCESS, $filter);
+    if (! check_acl($config['id_user'], 0, 'EW')) {
+        echo 'unauthorized';
+        return;
+    }
+
+    $r = events_update_status($id_evento, EVENT_PROCESS, $filter);
+    if ($r === false) {
+        echo 'Failed';
+    } else {
+        echo $r;
+    }
+
     return;
 }
 
diff --git a/pandora_console/include/javascript/pandora_events.js b/pandora_console/include/javascript/pandora_events.js
index b2ef8ffaf4..d0a83bd6e8 100644
--- a/pandora_console/include/javascript/pandora_events.js
+++ b/pandora_console/include/javascript/pandora_events.js
@@ -669,7 +669,7 @@ function show_event_response_command_dialog(id, response, total_checked) {
 }
 
 var processed = 0;
-function update_event(table, id_evento, type, row) {
+function update_event(table, id_evento, type, event_rep, row) {
   var inputs = $("#events_form :input");
   var values = {};
   var redraw = false;
@@ -690,6 +690,7 @@ function update_event(table, id_evento, type, row) {
       in_process_event: type.in_process_event,
       delete_event: type.delete_event,
       id_evento: id_evento,
+      event_rep: event_rep,
       filter: values
     },
     success: function(d) {
@@ -717,7 +718,7 @@ function update_event(table, id_evento, type, row) {
   });
 }
 
-function validate_event(table, id_evento, row) {
+function validate_event(table, id_evento, event_rep, row) {
   var button = document.getElementById("val-" + id_evento);
   if (!button) {
     // Button does not exist. Ignore.
@@ -726,10 +727,10 @@ function validate_event(table, id_evento, row) {
 
   button.children[0];
   button.children[0].src = "images/spinner.gif";
-  return update_event(table, id_evento, { validate_event: 1 }, row);
+  return update_event(table, id_evento, { validate_event: 1 }, event_rep, row);
 }
 
-function in_process_event(table, id_evento, row) {
+function in_process_event(table, id_evento, event_rep, row) {
   var button = document.getElementById("proc-" + id_evento);
   if (!button) {
     // Button does not exist. Ignore.
@@ -738,10 +739,16 @@ function in_process_event(table, id_evento, row) {
 
   button.children[0];
   button.children[0].src = "images/spinner.gif";
-  return update_event(table, id_evento, { in_process_event: 1 }, row);
+  return update_event(
+    table,
+    id_evento,
+    { in_process_event: 1 },
+    event_rep,
+    row
+  );
 }
 
-function delete_event(table, id_evento, row) {
+function delete_event(table, id_evento, event_rep, row) {
   var button = document.getElementById("del-" + id_evento);
   if (!button) {
     // Button does not exist. Ignore.
@@ -750,7 +757,7 @@ function delete_event(table, id_evento, row) {
 
   button.children[0];
   button.children[0].src = "images/spinner.gif";
-  return update_event(table, id_evento, { delete_event: 1 }, row);
+  return update_event(table, id_evento, { delete_event: 1 }, event_rep, row);
 }
 
 // Imported from old files.
@@ -832,6 +839,7 @@ function execute_event_response(event_list_btn) {
           in_process_event(
             dt_events,
             $(this).val(),
+            $(this).attr("event_rep"),
             this.parentElement.parentElement
           );
         });
@@ -841,6 +849,7 @@ function execute_event_response(event_list_btn) {
           validate_event(
             dt_events,
             $(this).val(),
+            $(this).attr("event_rep"),
             this.parentElement.parentElement
           );
         });
@@ -850,6 +859,7 @@ function execute_event_response(event_list_btn) {
           delete_event(
             dt_events,
             $(this).val(),
+            $(this).attr("event_rep"),
             this.parentElement.parentElement
           );
         });
diff --git a/pandora_console/operation/events/events.php b/pandora_console/operation/events/events.php
index a609e98956..85576edc9c 100644
--- a/pandora_console/operation/events/events.php
+++ b/pandora_console/operation/events/events.php
@@ -1478,8 +1478,8 @@ function process_datatables_item(item) {
     evn += output;
     evn += '</div>'
 
-    item.criticity = '<div class="criticity" style="background: ';
-    item.criticity += color + '">' + text + "</div>";
+    criticity = '<div class="criticity" style="background: ';
+    criticity += color + '">' + text + "</div>";
 
     // Grouped events.
     if(item.max_timestamp) {
@@ -1531,8 +1531,8 @@ function process_datatables_item(item) {
         break;
     }
 
-    item.event_type = '<div class="criticity" style="background: ';
-    item.event_type += color + '">' + text + "</div>";
+    event_type = '<div class="criticity" style="background: ';
+    event_type += color + '">' + text + "</div>";
 
     /* Module status */
     /* Event severity prepared */
@@ -1567,8 +1567,8 @@ function process_datatables_item(item) {
         break;
     }
 
-    item.module_status = '<div class="criticity" style="background: ';
-    item.module_status += color + '">' + text + "</div>";
+    module_status = '<div class="criticity" style="background: ';
+    module_status += color + '">' + text + "</div>";
 
 
     /* Agent name link */
@@ -1617,10 +1617,10 @@ function process_datatables_item(item) {
             // Validate.
             item.options += '<a href="javascript:" onclick="validate_event(dt_<?php echo $table_id; ?>,';
             if (item.max_id_evento) {
-                item.options += item.max_id_evento+', this)" id="val-'+item.max_id_evento+'">';
+                item.options += item.max_id_evento+', '+ item.event_rep +', this)" id="val-'+item.max_id_evento+'">';
                 item.options += '<?php echo html_print_image('images/tick.png', true, ['title' => __('Validate events')]); ?></a>';
             } else {
-                item.options += item.id_evento+', this)" id="val-'+item.id_evento+'">';
+                item.options += item.id_evento+', 0, this)" id="val-'+item.id_evento+'">';
                 item.options += '<?php echo html_print_image('images/tick.png', true, ['title' => __('Validate event')]); ?></a>';
             }
         }
@@ -1629,9 +1629,9 @@ function process_datatables_item(item) {
             // In process.
             item.options += '<a href="javascript:" onclick="in_process_event(dt_<?php echo $table_id; ?>,';
             if (item.max_id_evento) {
-                item.options += item.max_id_evento+', this)" id="proc-'+item.max_id_evento+'">';
+                item.options += item.max_id_evento+', '+ item.event_rep +', this)" id="proc-'+item.max_id_evento+'">';
             } else {
-                item.options += item.id_evento+', this)" id="proc-'+item.id_evento+'">';
+                item.options += item.id_evento+', 0, this)" id="proc-'+item.id_evento+'">';
             }
             item.options += '<?php echo html_print_image('images/hourglass.png', true, ['title' => __('Change to in progress status')]); ?></a>';
         }
@@ -1641,10 +1641,10 @@ function process_datatables_item(item) {
         // Delete.
         item.options += '<a href="javascript:" onclick="delete_event(dt_<?php echo $table_id; ?>,';
         if (item.max_id_evento) {
-            item.options += item.max_id_evento+', this)" id="del-'+item.max_id_evento+'">';
+            item.options += item.max_id_evento+', '+ item.event_rep +', this)" id="del-'+item.max_id_evento+'">';
             item.options += '<?php echo html_print_image('images/cross.png', true, ['title' => __('Delete events')]); ?></a>';
         } else {
-            item.options += item.id_evento+', this)" id="del-'+item.id_evento+'">';
+            item.options += item.id_evento+', 0, this)" id="del-'+item.id_evento+'">';
             item.options += '<?php echo html_print_image('images/cross.png', true, ['title' => __('Delete event')]); ?></a>';
         }
     }
@@ -1652,6 +1652,11 @@ function process_datatables_item(item) {
     // Multi select.
     item.m = '<input name="checkbox-multi[]" type="checkbox" value="';
     item.m += item.id_evento+'" id="checkbox-multi-'+item.id_evento+'" ';
+    if (item.max_id_evento) {
+        item.m += ' event_rep="' + item.event_rep +'" ';
+    } else {
+        item.m += ' event_rep="0" ';
+    }
     item.m += 'class="candeleted chk_val">';
         <?php
     }
@@ -1673,10 +1678,15 @@ function process_datatables_item(item) {
         break;
     }
 
+    /* Update column content now to avoid json poisoning. */
     item.estado = '<div>';
     item.estado += img;
     item.estado += '</div>';
 
+    item.criticity = criticity;
+    item.event_type = event_type;
+    item.module_status = module_status;
+
     /* Event ID dash */
     item.id_evento = "#"+item.id_evento;