PHP Av_exception类代码示例

function check_ossim_error()
{
    if (ossim_error()) {
        $error = ossim_get_error();
        ossim_clean_error();
        Av_exception::throw_error(Av_exception::USER_ERROR, $error);
    }
}

function get_pulse_detail_from_id($conn)
{
    $type = POST('type');
    $pulse = POST('pulse');
    $id = POST('id');
    ossim_valid($type, 'alarm|event|alarm_event', 'illegal:' . _('Type'));
    ossim_valid($pulse, OSS_HEX, 'illegal:' . _('Pulse'));
    ossim_valid($id, OSS_HEX, 'illegal:' . _('ID'));
    if (ossim_error()) {
        Av_exception::throw_error(Av_exception::USER_ERROR, ossim_get_error_clean());
    }
    if ($type == 'alarm') {
        $pulse = Alarm::get_pulse_data_from_alarm($conn, $id, $pulse, TRUE);
    } elseif ($type == 'event') {
        $pulse = Siem::get_pulse_data_from_event($conn, $id, $pulse, FALSE, TRUE);
    } elseif ($type == 'alarm_event') {
        $pulse = Siem::get_pulse_data_from_event($conn, $id, $pulse, TRUE, TRUE);
    }
    return array('name' => $pulse['name'], 'descr' => $pulse['descr'], 'iocs' => array_values($pulse['iocs']));
}

function restart_search($conn, $data)
{
    $return['error'] = FALSE;
    $return['msg'] = '';
    $type = $data['type'];
    ossim_valid($type, 'asset', 'group', 'network', 'illegal:' . _("List Type"));
    if (ossim_error()) {
        $error = ossim_get_error();
        ossim_clean_error();
        $return['error'] = TRUE;
        $return['msg'] = $error;
        return $return;
    }
    Filter_list::delete_filters_from_session();
    try {
        $object = 'Filter_' . $type . '_list';
        if (!class_exists($object)) {
            Av_exception::throw_error(Av_exception::USER_ERROR, _('Invalid List Type'));
        }
        $filter_list = new $object($conn);
        $filter_list->store_filter_list_session();
    } catch (Exception $e) {
        $return['error'] = TRUE;
        $return['msg'] = $e->getMessage();
    }
    return $return;
}

session_write_close();
Session::logcheck('environment-menu', 'EventsHidsConfig');
$events_hids_config = Session::menu_perms('environment-menu', 'EventsHidsConfig');
try {
    $db = new ossim_db();
    $conn = $db->connect();
    $sensor_id = POST('sensor_id');
    ossim_valid($sensor_id, OSS_HEX, 'illegal:' . _('Sensor ID'));
    if (!ossim_error()) {
        if (!Ossec_utilities::is_sensor_allowed($conn, $sensor_id)) {
            $e_msg = _('Error! Sensor not allowed');
            Av_exception::throw_error(Av_exception::USER_ERROR, $e_msg);
        }
    } else {
        $e_msg = ossim_get_error_clean();
        Av_exception::throw_error(Av_exception::USER_ERROR, $e_msg);
    }
    $agents = Ossec_agent::get_list($sensor_id);
    $data = array();
    if (is_array($agents) && !empty($agents)) {
        foreach ($agents as $agent_id => $a_data) {
            if (empty($a_data)) {
                continue;
            }
            $a_unique_id = md5($agent_id);
            $agent_actions = Ossec_agent::get_actions($agent_id, $a_data);
            if (!empty($a_data['host_id'])) {
                $asset_name = Asset_host::get_name_by_id($conn, $a_data['host_id']);
            } else {
                $asset_name = '-';
            }

*
*
* On Debian GNU/Linux systems, the complete text of the GNU General
* Public License can be found in `/usr/share/common-licenses/GPL-2'.
*
* Otherwise you can read it here: http://www.gnu.org/licenses/gpl-2.0.txt
*
*/
require_once 'av_init.php';
Session::useractive();
if (!Session::am_i_admin()) {
    Av_exception::throw_error(Av_exception::USER_ERROR, _('You do not have permissions to see this section'));
}
$wizard = Welcome_wizard::get_instance();
if (!$wizard instanceof Welcome_wizard) {
    Av_exception::throw_error(Av_exception::USER_ERROR, "There was an error, the Welcome_wizard object doesn't exist");
}
//Getting the scan step to know if we have a scan running
$step = intval($wizard->get_step_data('scan_step'));
//Selected nets
$nets_selected = $wizard->get_step_data('scan_nets');
$nets_selected = is_array($nets_selected) ? $nets_selected : array();
$n_ids = array_fill_keys(array_keys($nets_selected), 1);
$paths = Asset::get_path_url(FALSE);
$iframe_url = $paths['network']['views'] . 'import_all_nets.php?import_type=welcome_wizard_nets';
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
    <head>
        <title> <?php 
echo _("AlienVault " . (Session::is_pro() ? "USM" : "OSSIM"));

                    $curid = $rs->fields['id'];
                }
            }
            $id = Av_report::get_new_report_module_id($conn);
            if ($curid > 0) {
                $sql = "UPDATE custom_report_types SET name=?,type='Custom Security Events',file='SIEM/CustomList.php',inputs='Number of Events:top:text:OSS_DIGIT:25:1000',custom_report_types.sql=? WHERE id=?";
                $params = array($name, "{$query1};{$query2};{$columns}", $curid);
            } else {
                $sql = "INSERT INTO custom_report_types (id,name,type,file,inputs,custom_report_types.sql) VALUES (?,?,'Custom Security Events','SIEM/CustomList.php','Number of Events:top:text:OSS_DIGIT:25:1000',?)";
                $params = array($id, $name, "{$query1};{$query2};{$columns}");
            }
            if ($conn->Execute($sql, $params)) {
                $msg = $curid > 0 ? _("Report Module") . " <b>'Custom Security Events - {$name}'</b> " . _("successfully updated") : _("Report Module successfully created as") . " <b>'Custom Security Events - {$name}'</b>";
                $msg_type = 'nf_success';
            } else {
                Av_exception::write_log(Av_exception::DB_ERROR, $conn->ErrorMsg());
                $msg = _("Error creating a new report type.");
                $msg_type = 'nf_error';
            }
            $db->close();
        } else {
            $msg = _("Error creating a new report type.");
            $msg_type = 'nf_error';
        }
    }
}
$tags = get_tags($idm_enabled);
if ($opensource) {
    unset($tags['PLUGIN_SOURCE_TYPE']);
    unset($tags['PLUGIN_SID_CATEGORY']);
    unset($tags['PLUGIN_SID_SUBCATEGORY']);

ossim_valid($search_str, OSS_INPUT, OSS_NULLABLE, 'illegal: ' . _('Search String'));
ossim_valid($from, OSS_DIGIT, 'illegal: ' . _('Configuration Parameter 2'));
ossim_valid($sec, OSS_DIGIT, 'illegal: ' . _('Configuration Parameter 3'));
if (ossim_error()) {
    $response['sEcho'] = intval($sec);
    $response['iTotalRecords'] = 0;
    $response['iTotalDisplayRecords'] = 0;
    $response['aaData'] = array();
    echo json_encode($response);
    exit;
}
// Get object from session
$asset_object = unserialize($_SESSION['asset_detail'][$asset_id]);
$class_name = get_class($asset_object);
if (!is_object($asset_object)) {
    Av_exception::throw_error(Av_exception::DB_ERROR, _('Error retrieving the asset data from Memory'));
}
$db = new ossim_db();
$conn = $db->connect();
$filters = array('where' => 'host_properties.property_ref <> 8', 'limit' => "{$from}, {$maxrows}");
if ($search_str != '') {
    $search_str = escape_sql($search_str, $conn);
    $filters['where'] .= ' AND host_properties.value LIKE "%' . $search_str . '%"';
}
// DATA
list($properties, $total) = $asset_object->get_properties($conn, $filters);
$data = array();
foreach ($properties as $_host_id => $prop_list) {
    $_host_aux = Asset_host::get_object($conn, $_host_id);
    $host = $_host_aux->get_name() . ' (' . $_host_aux->get_ips()->get_ips('string') . ')';
    foreach ($prop_list as $prop_id => $prop_data) {

function make_sid_filter($conn, $ip)
{
    $sids = array();
    if (preg_match("/\\d+\\/\\d+/", $ip)) {
        $aux = Cidr::expand_cidr($ip, 'SHORT', 'IP');
        if ($aux[0] == 'I' && $aux[1] == 'P') {
            $aux[0] = '0x0';
            $aux[1] = '0x0';
        } else {
            $aux[0] = bin2hex(inet_pton($aux[0]));
            $aux[1] = bin2hex(inet_pton($aux[1]));
        }
        $query = "SELECT d.id FROM alienvault_siem.device d, alienvault.sensor s \n\t\t          WHERE d.sensor_id=s.id \n\t\t          AND ( (s.ip >= UNHEX('" . $aux[0] . "') AND s.ip <= UNHEX('" . $aux[1] . "')) \n\t\t          OR (d.device_ip>=UNHEX('" . $aux[0] . "') AND d.device_ip <= UNHEX('" . $aux[1] . "')) )";
    } else {
        $ip = bin2hex(@inet_pton($ip));
        $query = "SELECT d.id FROM alienvault_siem.device d, alienvault.sensor s \n\t\t          WHERE d.sensor_id = s.id AND ( s.ip = UNHEX('{$ip}') OR d.device_ip = UNHEX('{$ip}') )";
    }
    //echo $query;
    if (!($rs =& $conn->Execute($query))) {
        Av_exception::throw_error(Av_exception::DB_ERROR, $conn->ErrorMsg());
    }
    while (!$rs->EOF) {
        $sids[] = $rs->fields['id'];
        $rs->MoveNext();
    }
    return implode(',', $sids);
}

ossim_valid($level, OSS_LETTER, ',', OSS_NULLABLE, 'illegal:' . _('Level Param'));
/***************************
 ****** RESPONSE VARS ******
 ***************************/
// Response array
$response = array();
// Array to store data
$data = array();
$total_messages = 0;
try {
    // If validation errors throw new exception with error details
    if (ossim_error()) {
        Av_exception::throw_error(Av_exception::USER_ERROR, ossim_get_error_clean());
    }
    if (strlen($search_str) > 30) {
        Av_exception::throw_error(Av_exception::USER_ERROR, 'Search string very long. Max length 30 characters');
    }
    /*********************
     ****** Filters ******
     *********************/
    /**
     * Returns order_by string by column
     *
     * @param  integer  $order
     *
     * @return string
     */
    $order_by = function ($order) {
        switch ($order) {
            case 0:
                return 'creation_time';

function get_map_objects($conn, $map, $map_array = array(), $obj_array = array())
{
    $map_array[$map]++;
    $query = "select * from risk_indicators where name <> 'rect' AND map = UNHEX(?)";
    $rs4 = $conn->Execute($query, array($map));
    if (!$rs4) {
        Av_exception::write_log(Av_exception::DB_ERROR, $conn->ErrorMsg());
    } else {
        while (!$rs4->EOF) {
            //It's a map
            if (preg_match("/view\\.php\\?map\\=([a-fA-F0-9]*)/", $rs4->fields['url'], $found)) {
                if (!$map_array[$found[1]]) {
                    list($map_array, $obj_array) = get_map_objects($conn, $found[1], $map_array, $obj_array);
                }
            } else {
                if (!$obj_array[$rs4->fields['id']]) {
                    $obj_array[$rs4->fields['id']] = $rs4->fields;
                }
            }
            $rs4->MoveNext();
        }
    }
    return array($map_array, $obj_array);
}

$only_unread = POST('only_unread') ? POST('only_unread') : '';
/**********************************
 ****** VALIDATE POST PARAMS ******
 **********************************/
ossim_valid($search, OSS_INPUT, OSS_NULLABLE, 'illegal:' . _('Search String'));
ossim_valid($only_unread, OSS_LETTER, OSS_NULLABLE, 'illegal:' . _('Only Unread Param'));
/***************************
 ****** RESPONSE VARS ******
 ***************************/
// Response array
$response = array();
// Array to store data
$data = array();
try {
    if (ossim_error()) {
        Av_exception::throw_error(Av_exception::USER_ERROR, ossim_get_error_clean());
    }
    /**********************
     ****** FILTERS *******
     **********************/
    $filters = array();
    if (!empty($search)) {
        $filters['search'] = $search;
    }
    if (!empty($only_unread)) {
        $filters['only_unread'] = 'true';
    }
    /**********************
     ****** GET DATA ******
     **********************/
    $status = new System_notifications();

//.........这里部分代码省略.........
            if (!ossim_valid($asset_value, OSS_DIGIT, 'illegal:' . _('Asset value'))) {
                $summary['by_nets'][$num_line]['errors']['Asset value'] = ossim_get_error_clean();
                $summary['general']['statistics']['errors']++;
                continue;
            }
        }
        //Insert/Update net in database
        if (count($summary['by_nets'][$num_line]['errors']) == 0) {
            try {
                $net = new Asset_net($net_id);
                if ($is_in_db == TRUE) {
                    $net->load_from_db($conn, $net_id);
                    $can_i_modify_ips = Asset_net::can_i_modify_ips($conn, $net_id);
                } else {
                    if ($can_i_create_assets == FALSE) {
                        $n_error_msg = _('Net') . ' ' . $name . ' ' . _("not allowed. You don't have permissions to import this net");
                        $summary['by_nets'][$num_line]['errors']['Net'] = $n_error_msg;
                        $summary['general']['statistics']['errors']++;
                        continue;
                    }
                }
                //Check CIDRs
                if ($can_i_modify_ips == TRUE) {
                    $aux_cidr = explode(',', $cidrs);
                    foreach ($aux_cidr as $cidr) {
                        $net_ids = Asset_net::get_id_by_ips($conn, $cidr, $ctx);
                        unset($net_ids[$net_id]);
                        if (!empty($net_ids)) {
                            $c_error_msg = _('CIDR') . ' ' . $cidrs . ' ' . _("not allowed. CIDR {$cidr} already exists for this entity");
                            $summary['by_nets'][$num_line]['errors']['CIDRs'] = $c_error_msg;
                            $summary['general']['statistics']['errors']++;
                            break;
                        } else {
                            if (Session::get_net_where() != '') {
                                if (!Asset_net::is_cidr_in_my_nets($conn, $cidr, $ctx)) {
                                    $c_error_msg = sprintf(_("Error! The CIDR %s is not allowed. Please check with your account admin for more information"), $cidrs);
                                    $summary['by_nets'][$num_line]['errors']['CIDRs'] = $c_error_msg;
                                    $summary['general']['statistics']['errors']++;
                                    break;
                                }
                            }
                        }
                    }
                } else {
                    $c_error_msg = _('Net') . ' ' . $name . ': ' . _("CIDRs not allowed. CIDRs cannot be modified");
                    $summary['by_nets'][$num_line]['status'] = 'warning';
                    $summary['general']['warnings']['errors']++;
                    $summary['by_nets'][$num_line]['warnings']['CIDRs'] = $c_error_msg;
                }
                //Setting new values
                if (count($summary['by_nets'][$num_line]['errors']) == 0) {
                    $net->set_ctx($ctx);
                    $net->set_name($name);
                    $net->set_descr($descr);
                    if ($is_in_db == FALSE) {
                        if ($can_i_modify_ips == TRUE) {
                            $net->set_ips($cidrs);
                        }
                        $net->set_sensors($sensors);
                    }
                    $net->set_asset_value($asset_value);
                    $net->save_in_db($conn, FALSE);
                    $summary['general']['statistics']['saved']++;
                    $summary['by_nets'][$num_line]['data'] = $is_in_db == TRUE ? _('Net updated') : _('New new inserted');
                    //Keep warnings
                    if ($summary['by_nets'][$num_line]['status'] != 'warning') {
                        $summary['by_nets'][$num_line]['status'] = 'success';
                    }
                }
            } catch (Exception $e) {
                $summary['by_nets'][$num_line]['errors']['Database error'] = $e->getMessage();
                $summary['general']['statistics']['errors']++;
            }
        }
    }
    if ($summary['general']['statistics']['saved'] > 0) {
        if ($summary['general']['statistics']['errors'] == 0) {
            $summary['general']['status'] = 'success';
            $summary['general']['data'] = _('All nets have been successfully imported');
        } else {
            $summary['general']['status'] = 'warning';
            $summary['general']['data'] = _('Some nets cannot be imported');
        }
        Util::disable_perm_triggers($conn, FALSE);
        try {
            Asset_net::report_changes($conn, 'nets');
        } catch (Exception $e) {
            Av_exception::write_log(Av_exception::USER_ERROR, $e->getMessage());
        }
    } else {
        $summary['general']['statistics']['errors'] = count($data);
        //CSV file is not empty, but all lines are wrong
        if (empty($summary['general']['status'])) {
            $summary['general']['status'] = 'error';
            $summary['general']['data'] = _('Nets cannot be imported');
        }
    }
    $db->close();
    return $summary;
}

ossim_valid($intent, OSS_DIGIT, OSS_NULLABLE, 'illegal:' . _("Intent"));
ossim_valid($directive_id, OSS_DIGIT, OSS_NULLABLE, 'illegal:' . _("Directive ID"));
ossim_valid($num_events, OSS_DIGIT, OSS_NULLABLE, 'illegal:' . _("Num Events"));
ossim_valid($num_events_op, OSS_ALPHA, OSS_NULLABLE, 'illegal:' . _("Num Events Operator"));
ossim_valid($tag, OSS_HEX, OSS_NULLABLE, 'illegal:' . _("Tag"));
ossim_valid($no_resolv, OSS_DIGIT, OSS_NULLABLE, 'illegal:' . _("No Resolv"));
ossim_valid($hide_closed, OSS_DIGIT, OSS_NULLABLE, 'illegal:' . _("Hide Closed"));
ossim_valid($show_options, OSS_DIGIT, OSS_NULLABLE, 'illegal:' . _("Show Options"));
if (ossim_error()) {
    $response['sEcho'] = $sec;
    $response['iTotalRecords'] = 0;
    $response['iTotalDisplayRecords'] = 0;
    $response['aaData'] = '';
    $error = ossim_get_error();
    ossim_clean_error();
    Av_exception::write_log(Av_exception::USER_ERROR, $error);
    echo json_encode($response);
    exit;
}
if (empty($show_options) || ($show_options < 1 || $show_options > 4)) {
    $show_options = 1;
}
$db = new ossim_db(TRUE);
$conn = $db->connect();
$db_groups = Alarm_groups::get_dbgroups($conn);
$criteria = array('group_type' => $group_type, 'show_options' => $show_options, 'hide_closed' => $hide_closed, 'from_date' => $date_from, 'to_date' => $date_to, 'ip_src' => $src_ip, 'ip_dst' => $dst_ip, 'asset_group' => $asset_group, 'sensor' => $sensor_query, 'query' => $alarm_name, 'directive_id' => $directive_id, 'intent' => $intent, 'num_events' => $num_events, 'num_events_op' => $num_events_op, 'tag' => $tag, 'limit' => "LIMIT {$offset}, {$limit}");
list($alarm_group, $total) = Alarm_groups::get_grouped_alarms($conn, $criteria, TRUE);
$results = array();
foreach ($alarm_group as $group) {
    $res = array();
    $group_id = $group['group_id'];

                    $response['data']['components_added_msg'] = sprintf($msg, $num_components, $component_type);
                    break;
                    // Delete components
                // Delete components
                case 'delete_components':
                    $tag->remove_components_from_filter($conn);
                    $msg = _('Your label has been deleted from  %d %s(s). You can view asset labels in the asset details');
                    $response['data']['components_deleted_msg'] = sprintf($msg, $num_components, $component_type);
                    break;
                default:
                    Av_exception::throw_error(Av_exception::USER_ERROR, _('Invalid action - please try again'));
            }
        }
        $response['status'] = 'OK';
        $response['data']['id'] = $tag->get_id();
        $response['data']['name'] = $tag->get_name();
        $response['data']['class'] = $tag->get_class();
    } else {
        Av_exception::throw_error(Av_exception::USER_ERROR, _('Action can not be completed'));
    }
} catch (\Exception $e) {
    $error_msg = $e->getMessage();
    if (empty($error_msg)) {
        $error_msg = _('Sorry, operation was not completed due to an error when processing the request');
    }
    $response['status'] = 'error';
    $response['data'] = $error_msg;
}
$db->close();
echo json_encode($response);
exit;

function SIEM_trends_week($param = '')
{
    global $tz;
    $tzc = Util::get_tzc($tz);
    $data = array();
    $plugins = '';
    $plugins_sql = '';
    $db = new ossim_db(TRUE);
    $dbconn = $db->connect();
    $_asset_where = make_asset_filter();
    $asset_where = $_asset_where[1];
    $sensor_where = make_ctx_filter() . $asset_where;
    $tax_join = '';
    if (preg_match("/taxonomy\\=(.+)/", $param, $found)) {
        if ($found[1] == 'honeypot') {
            $tax_join = 'alienvault.plugin_sid p, ';
            $tax_where = 'AND acid_event.plugin_id = p.plugin_id AND acid_event.plugin_sid = p.sid AND p.category_id = 19';
        }
        $param = '';
    } elseif ($param == 'ossec%') {
        $plugins_sql = 'AND acid_event.plugin_id between 7000 and 7999';
        $plugins = '7000-7999';
    }
    $sqlgraph = "SELECT COUNT(acid_event.id) as num_events, day(convert_tz(timestamp,'+00:00','{$tzc}')) AS intervalo, monthname(convert_tz(timestamp,'+00:00','{$tzc}')) AS suf \n        FROM {$tax_join} alienvault_siem.acid_event \n        WHERE timestamp BETWEEN '" . gmdate("Y-m-d 00:00:00", gmdate("U") - 604800) . "' AND '" . gmdate("Y-m-d 23:59:59") . "' {$plugins_sql} {$sensor_where} {$tax_where} \n        GROUP BY suf, intervalo \n        ORDER BY suf, intervalo";
    if (!($rg =& $dbconn->CacheExecute($sqlgraph))) {
        Av_exception::write_log(Av_exception::DB_ERROR, $dbconn->ErrorMsg());
    } else {
        while (!$rg->EOF) {
            $hours = $rg->fields['intervalo'] . ' ' . substr($rg->fields['suf'], 0, 3);
            $data[$hours] = $rg->fields['num_events'];
            $rg->MoveNext();
        }
    }
    $db->close();
    return $param != '' ? array($data, $plugins) : $data;
}