- {this.state.load ? (
-
-
-
- ) : null}
- {/* It must get renderized only in configuration app to show Miscellaneous tab in configuration App */}
- {!this.state.load &&
- !this.apiIsDown &&
- this.state.settingsTabsProps?.tabs ? (
-
-
-
- ) : null}
- {/* end head */}
-
- {/* api */}
- {this.state.tab === 'api' && !this.state.load ? (
-
- {/* API table section */}
-
-
+
+ render() {
+ return (
+
+ {this.state.load ? (
+
+
-
- ) : null}
- {/* End API configuration card section */}
- {/* end api */}
-
- {/* configuration */}
- {this.state.tab === 'configuration' && !this.state.load ? (
-
-
-
- ) : null}
- {/* end configuration */}
- {/* miscellaneous */}
- {this.state.tab === 'miscellaneous' && !this.state.load ? (
-
-
-
- ) : null}
- {/* end miscellaneous */}
- {/* about */}
- {this.state.tab === 'about' && !this.state.load ? (
-
-
-
- ) : null}
- {/* end about */}
- {/* sample data */}
- {this.state.tab === 'sample_data' && !this.state.load ? (
-
-
-
- ) : null}
- {/* end sample data */}
-
- );
- }
-}
+ ) : null}
+ {/* It must get renderized only in configuration app to show Miscellaneous tab in configuration App */}
+ {!this.state.load && (
+ <>
+ {!this.apiIsDown && this.state.tabs && (
+
+
+ {this.state.tabs.map(tab => (
+ this.switchTab(tab.id)}
+ >
+ {tab.name}
+
+ ))}
+
+
+ )}
+ {this.renderView(this.state.tab)}
+
+ )}
+
+ );
+ }
+ },
+);
diff --git a/plugins/main/public/controllers/management/components/management/statistics/statistics-overview.js b/plugins/main/public/controllers/management/components/management/statistics/statistics-overview.js
index 9cb91c89c2..da238bb4fc 100644
--- a/plugins/main/public/controllers/management/components/management/statistics/statistics-overview.js
+++ b/plugins/main/public/controllers/management/components/management/statistics/statistics-overview.js
@@ -34,7 +34,6 @@ import {
} from '../../../../../components/common/hocs';
import { PromptStatisticsDisabled } from './prompt-statistics-disabled';
import { PromptStatisticsNoIndices } from './prompt-statistics-no-indices';
-import { WazuhConfig } from '../../../../../react-services/wazuh-config';
import { WzRequest } from '../../../../../react-services/wz-request';
import { UI_ERROR_SEVERITIES } from '../../../../../react-services/error-orchestrator/types';
import { UI_LOGGER_LEVELS } from '../../../../../../common/constants';
@@ -43,8 +42,7 @@ import { getCore } from '../../../../../kibana-services';
import { appSettings, statistics } from '../../../../../utils/applications';
import { RedirectAppLinks } from '../../../../../../../../src/plugins/opensearch_dashboards_react/public';
import { DashboardTabsPanels } from '../../../../../components/overview/server-management-statistics/dashboards/dashboardTabsPanels';
-
-const wzConfig = new WazuhConfig();
+import { connect } from 'react-redux';
export class WzStatisticsOverview extends Component {
_isMounted = false;
@@ -174,19 +172,21 @@ export class WzStatisticsOverview extends Component {
-
-
-
- Settings
-
-
-
+ {this.props.configurationUIEditable && (
+
+
+
+ Settings
+
+
+
+ )}
@@ -215,14 +215,21 @@ export class WzStatisticsOverview extends Component {
}
}
+const mapStateToProps = state => ({
+ statisticsEnabled: state.appConfig.data?.['cron.statistics.status'],
+ configurationUIEditable:
+ state.appConfig.data?.['configuration.ui_api_editable'],
+});
+
export default compose(
withGlobalBreadcrumb([{ text: statistics.breadcrumbLabel }]),
withUserAuthorizationPrompt([
{ action: 'cluster:status', resource: '*:*:*' },
{ action: 'cluster:read', resource: 'node:id:*' },
]),
+ connect(mapStateToProps),
withGuard(props => {
- return !(wzConfig.getConfig() || {})['cron.statistics.status']; // if 'cron.statistics.status' is false, then it renders PromptStatisticsDisabled component
+ return !props.statisticsEnabled;
}, PromptStatisticsDisabled),
)(props => {
const [loading, setLoading] = useState(false);
diff --git a/plugins/main/public/plugin.ts b/plugins/main/public/plugin.ts
index f8dee3b0e8..2214c6d21c 100644
--- a/plugins/main/public/plugin.ts
+++ b/plugins/main/public/plugin.ts
@@ -149,9 +149,9 @@ export class WazuhPlugin
? undefined
: 'Interval is not valid.';
});
+ setWzCurrentAppID(id);
// Set the dynamic redirection
setWzMainParams(redirectTo());
- setWzCurrentAppID(id);
initializeInterceptor(core);
if (!this.initializeInnerAngular) {
throw Error(
diff --git a/plugins/main/server/controllers/decorators.test.ts b/plugins/main/server/controllers/decorators.test.ts
new file mode 100644
index 0000000000..57da5b1900
--- /dev/null
+++ b/plugins/main/server/controllers/decorators.test.ts
@@ -0,0 +1,175 @@
+import {
+ routeDecoratorProtectedAdministrator,
+ routeDecoratorConfigurationAPIEditable,
+ compose,
+} from './decorators';
+
+const mockContext = ({
+ isAdmin = false,
+ isConfigurationAPIEditable = false,
+}: {
+ isAdmin?: boolean;
+ isConfigurationAPIEditable: boolean;
+}) => ({
+ wazuh: {
+ security: {
+ getCurrentUser: () => {},
+ },
+ logger: {
+ info: jest.fn(),
+ warn: jest.fn(),
+ error: jest.fn(),
+ debug: jest.fn(),
+ get: jest.fn(() => ({
+ info: jest.fn(),
+ warn: jest.fn(),
+ error: jest.fn(),
+ debug: jest.fn(),
+ })),
+ },
+ },
+ wazuh_core: {
+ configuration: {
+ get: jest.fn(async () => isConfigurationAPIEditable),
+ },
+ dashboardSecurity: {
+ isAdministratorUser: () => ({
+ administrator: isAdmin,
+ administrator_requirements: !isAdmin
+ ? 'User is not administrator'
+ : null,
+ }),
+ },
+ },
+});
+
+const mockRequest = () => {
+ return {};
+};
+
+const mockResponse = () => {
+ const mockRes = jest.fn(data => data);
+ return {
+ ok: mockRes,
+ forbidden: mockRes,
+ custom: mockRes,
+ };
+};
+
+describe('route decorator: routeDecoratorProtectedAdministrator', () => {
+ it.each`
+ title | isAdmin | isHandlerRun | responseBodyMessage
+ ${'Run handler'} | ${true} | ${true} | ${null}
+ ${'Avoid handler is run'} | ${false} | ${false} | ${'403 - User is not administrator'}
+ `(
+ `$title`,
+ async ({
+ isAdmin,
+ isHandlerRun,
+ responseBodyMessage,
+ }: {
+ isAdmin: boolean;
+ isHandlerRun: boolean;
+ responseBodyMessage: string | null;
+ }) => {
+ const mockHandler = jest.fn();
+ const wrappedHandler =
+ routeDecoratorProtectedAdministrator(3021)(mockHandler);
+ const response = await wrappedHandler(
+ mockContext({ isAdmin }),
+ mockRequest(),
+ mockResponse(),
+ );
+
+ if (isHandlerRun) {
+ expect(mockHandler).toHaveBeenCalled();
+ } else {
+ expect(mockHandler).not.toHaveBeenCalled();
+ }
+
+ responseBodyMessage &&
+ expect(response.body.message).toBe(responseBodyMessage);
+ },
+ );
+});
+
+describe('route decorator: routeDecoratorConfigurationAPIEditable', () => {
+ it.each`
+ title | isConfigurationAPIEditable | isHandlerRun | responseBodyMessage
+ ${'Run handler'} | ${true} | ${true} | ${null}
+ ${'Avoid handler is run'} | ${false} | ${false} | ${'The ability to edit the configuration from API is disabled. This can be enabled using configuration.ui_api_editable setting from the configuration file. Contact with an administrator.'}
+ `(
+ `$title`,
+ async ({
+ isConfigurationAPIEditable,
+ isHandlerRun,
+ responseBodyMessage,
+ }: {
+ isConfigurationAPIEditable: boolean;
+ isHandlerRun: boolean;
+ responseBodyMessage: string | null;
+ }) => {
+ const mockHandler = jest.fn();
+ const wrappedHandler =
+ routeDecoratorConfigurationAPIEditable(3021)(mockHandler);
+ const response = await wrappedHandler(
+ mockContext({ isConfigurationAPIEditable }),
+ mockRequest(),
+ mockResponse(),
+ );
+
+ if (isHandlerRun) {
+ expect(mockHandler).toHaveBeenCalled();
+ } else {
+ expect(mockHandler).not.toHaveBeenCalled();
+ }
+
+ responseBodyMessage &&
+ expect(response.body.message).toBe(responseBodyMessage);
+ },
+ );
+});
+
+describe('route decorators composition', () => {
+ it.each`
+ title | config | isHandlerRun | responseBodyMessage
+ ${'Run handler'} | ${{ isConfigurationAPIEditable: true, isAdmin: true }} | ${true} | ${null}
+ ${'Avoid handler is run'} | ${{ isConfigurationAPIEditable: false, isAdmin: true }} | ${false} | ${'The ability to edit the configuration from API is disabled. This can be enabled using configuration.ui_api_editable setting from the configuration file. Contact with an administrator.'}
+ ${'Avoid handler is run'} | ${{ isConfigurationAPIEditable: true, isAdmin: false }} | ${false} | ${'403 - User is not administrator'}
+ ${'Avoid handler is run'} | ${{ isConfigurationAPIEditable: false, isAdmin: false }} | ${false} | ${'The ability to edit the configuration from API is disabled. This can be enabled using configuration.ui_api_editable setting from the configuration file. Contact with an administrator.'}
+ `(
+ `$title`,
+ async ({
+ config,
+ isHandlerRun,
+ responseBodyMessage,
+ }: {
+ config: {
+ isAdmin: boolean;
+ isConfigurationAPIEditable: boolean;
+ };
+ isHandlerRun: boolean;
+ responseBodyMessage: string | null;
+ }) => {
+ const mockHandler = jest.fn();
+ const wrappedHandler = compose(
+ routeDecoratorConfigurationAPIEditable(3021),
+ routeDecoratorProtectedAdministrator(3021),
+ )(mockHandler);
+ const response = await wrappedHandler(
+ mockContext(config),
+ mockRequest(),
+ mockResponse(),
+ );
+
+ if (isHandlerRun) {
+ expect(mockHandler).toHaveBeenCalled();
+ } else {
+ expect(mockHandler).not.toHaveBeenCalled();
+ }
+
+ responseBodyMessage &&
+ expect(response.body.message).toBe(responseBodyMessage);
+ },
+ );
+});
diff --git a/plugins/main/server/controllers/decorators.ts b/plugins/main/server/controllers/decorators.ts
index d96765f8bd..e3f2c90ddf 100644
--- a/plugins/main/server/controllers/decorators.ts
+++ b/plugins/main/server/controllers/decorators.ts
@@ -1,22 +1,56 @@
import { ErrorResponse } from '../lib/error-response';
-export function routeDecoratorProtectedAdministrator(
- routeHandler,
- errorCode: number,
-) {
- return async (context, request, response) => {
- try {
- const { administrator, administrator_requirements } =
- await context.wazuh_core.dashboardSecurity.isAdministratorUser(
- context,
- request,
+export function routeDecoratorProtectedAdministrator(errorCode: number) {
+ return handler => {
+ return async (context, request, response) => {
+ try {
+ const { administrator, administrator_requirements } =
+ await context.wazuh_core.dashboardSecurity.isAdministratorUser(
+ context,
+ request,
+ );
+ if (!administrator) {
+ return ErrorResponse(administrator_requirements, 403, 403, response);
+ }
+ return await handler(context, request, response);
+ } catch (error) {
+ return ErrorResponse(error.message || error, errorCode, 500, response);
+ }
+ };
+ };
+}
+
+export function routeDecoratorConfigurationAPIEditable(errorCode) {
+ return handler => {
+ return async (context, request, response) => {
+ try {
+ const canEditConfiguration = await context.wazuh_core.configuration.get(
+ 'configuration.ui_api_editable',
);
- if (!administrator) {
- return ErrorResponse(administrator_requirements, 403, 403, response);
+
+ if (!canEditConfiguration) {
+ return response.forbidden({
+ body: {
+ message:
+ 'The ability to edit the configuration from API is disabled. This can be enabled using configuration.ui_api_editable setting from the configuration file. Contact with an administrator.',
+ },
+ });
+ }
+ return await handler(context, request, response);
+ } catch (error) {
+ return ErrorResponse(error.message || error, errorCode, 500, response);
}
- return await routeHandler(context, request, response);
- } catch (error) {
- return ErrorResponse(error.message || error, errorCode, 500, response);
- }
+ };
};
}
+
+export function compose(...functions: Function[]) {
+ if (functions.length === 1) {
+ return functions[0];
+ }
+ return functions.reduce(
+ (acc, fn) =>
+ (...args: any) =>
+ acc(fn(...args)),
+ );
+}
diff --git a/plugins/main/server/controllers/wazuh-elastic.ts b/plugins/main/server/controllers/wazuh-elastic.ts
index 5b462058f8..87af3f2743 100644
--- a/plugins/main/server/controllers/wazuh-elastic.ts
+++ b/plugins/main/server/controllers/wazuh-elastic.ts
@@ -641,7 +641,7 @@ export class WazuhElasticCtrl {
* @param {*} response
* {index: string, alerts: [...], count: number} or ErrorResponse
*/
- createSampleAlerts = routeDecoratorProtectedAdministrator(
+ createSampleAlerts = routeDecoratorProtectedAdministrator(1000)(
async (
context: RequestHandlerContext,
request: OpenSearchDashboardsRequest<{ category: string }>,
@@ -724,7 +724,6 @@ export class WazuhElasticCtrl {
return ErrorResponse(errorMessage || error, 1000, statusCode, response);
}
},
- 1000,
);
/**
* This deletes sample alerts
@@ -733,7 +732,7 @@ export class WazuhElasticCtrl {
* @param {*} response
* {result: "deleted", index: string} or ErrorResponse
*/
- deleteSampleAlerts = routeDecoratorProtectedAdministrator(
+ deleteSampleAlerts = routeDecoratorProtectedAdministrator(1000)(
async (
context: RequestHandlerContext,
request: OpenSearchDashboardsRequest<{ category: string }>,
@@ -779,7 +778,6 @@ export class WazuhElasticCtrl {
return ErrorResponse(errorMessage || error, 1000, statusCode, response);
}
},
- 1000,
);
async alerts(
diff --git a/plugins/main/server/controllers/wazuh-utils/wazuh-utils.ts b/plugins/main/server/controllers/wazuh-utils/wazuh-utils.ts
index 7bffe972e3..1a65103498 100644
--- a/plugins/main/server/controllers/wazuh-utils/wazuh-utils.ts
+++ b/plugins/main/server/controllers/wazuh-utils/wazuh-utils.ts
@@ -22,7 +22,11 @@ import path from 'path';
import { createDirectoryIfNotExists } from '../../lib/filesystem';
import glob from 'glob';
import { getFileExtensionFromBuffer } from '../../../common/services/file-extension';
-import { routeDecoratorProtectedAdministrator } from '../decorators';
+import {
+ compose,
+ routeDecoratorConfigurationAPIEditable,
+ routeDecoratorProtectedAdministrator,
+} from '../decorators';
// TODO: these controllers have no logs. We should include them.
export class WazuhUtilsCtrl {
@@ -71,7 +75,10 @@ export class WazuhUtilsCtrl {
* @param {Object} response
* @returns {Object}
*/
- updateConfiguration = routeDecoratorProtectedAdministrator(
+ updateConfiguration = compose(
+ routeDecoratorConfigurationAPIEditable(3021),
+ routeDecoratorProtectedAdministrator(3021),
+ )(
async (
context: RequestHandlerContext,
request: OpenSearchDashboardsRequest,
@@ -100,7 +107,6 @@ export class WazuhUtilsCtrl {
},
});
},
- 3021,
);
/**
@@ -110,7 +116,10 @@ export class WazuhUtilsCtrl {
* @param {Object} response
* @returns {Object} Configuration File or ErrorResponse
*/
- uploadFile = routeDecoratorProtectedAdministrator(
+ uploadFile = compose(
+ routeDecoratorConfigurationAPIEditable(3022),
+ routeDecoratorProtectedAdministrator(3022),
+ )(
async (
context: RequestHandlerContext,
request: KibanaRequest,
@@ -175,7 +184,6 @@ export class WazuhUtilsCtrl {
},
});
},
- 3022,
);
/**
@@ -185,7 +193,10 @@ export class WazuhUtilsCtrl {
* @param {Object} response
* @returns {Object} Configuration File or ErrorResponse
*/
- deleteFile = routeDecoratorProtectedAdministrator(
+ deleteFile = compose(
+ routeDecoratorConfigurationAPIEditable(3023),
+ routeDecoratorProtectedAdministrator(3023),
+ )(
async (
context: RequestHandlerContext,
request: KibanaRequest,
@@ -222,6 +233,5 @@ export class WazuhUtilsCtrl {
},
});
},
- 3023,
);
}
diff --git a/plugins/main/server/routes/wazuh-utils/wazuh-utils.test.ts b/plugins/main/server/routes/wazuh-utils/wazuh-utils.test.ts
index 608c59abdb..9fa9841b8c 100644
--- a/plugins/main/server/routes/wazuh-utils/wazuh-utils.test.ts
+++ b/plugins/main/server/routes/wazuh-utils/wazuh-utils.test.ts
@@ -6,7 +6,6 @@ import { loggingSystemMock } from '../../../../../src/core/server/logging/loggin
import { ByteSizeValue } from '@osd/config-schema';
import supertest from 'supertest';
import { WazuhUtilsRoutes } from './wazuh-utils';
-import { WazuhUtilsCtrl } from '../../controllers/wazuh-utils/wazuh-utils';
import fs from 'fs';
import path from 'path';
import glob from 'glob';
@@ -34,20 +33,22 @@ const context = {
get: jest.fn(),
set: jest.fn(),
},
+ dashboardSecurity: {
+ isAdministratorUser: jest.fn(),
+ },
},
};
+// Register settings
+context.wazuh_core.configuration._settings.set('pattern', {
+ validate: () => undefined,
+ isConfigurableFromSettings: true,
+});
+
const enhanceWithContext = (fn: (...args: any[]) => any) =>
fn.bind(null, context);
let server, innerServer;
-jest.mock('../../controllers/decorators', () => ({
- routeDecoratorProtectedAdministrator:
- handler =>
- async (...args) =>
- handler(...args),
-}));
-
beforeAll(async () => {
// Create server
const config = {
@@ -89,6 +90,48 @@ afterAll(async () => {
jest.clearAllMocks();
});
+describe('[endpoint] PUT /utils/configuration - protected route', () => {
+ it.each`
+ title | isConfigurationAPIEditable | isAdmin | responseStatusCode | responseBodyMessage
+ ${'test'} | ${true} | ${false} | ${403} | ${'403 - Mock: User has no permissions'}
+ ${'test'} | ${false} | ${true} | ${403} | ${'The ability to edit the configuration from API is disabled. This can be enabled using configuration.ui_api_editable setting from the configuration file. Contact with an administrator.'}
+ `(
+ '$title',
+ async ({
+ isConfigurationAPIEditable,
+ isAdmin,
+ responseStatusCode,
+ responseBodyMessage,
+ }: {
+ isConfigurationAPIEditable: boolean;
+ isAdmin: boolean;
+ responseStatusCode: number;
+ responseBodyMessage: string | null;
+ }) => {
+ context.wazuh_core.configuration.get.mockReturnValueOnce(
+ isConfigurationAPIEditable,
+ );
+ context.wazuh_core.dashboardSecurity.isAdministratorUser.mockReturnValueOnce(
+ {
+ administrator: isAdmin,
+ administrator_requirements: !isAdmin
+ ? 'Mock: User has no permissions'
+ : null,
+ },
+ );
+ const settings = { pattern: 'test-alerts-groupA-*' };
+ const response = await supertest(innerServer.listener)
+ .put('/utils/configuration')
+ .send(settings)
+ .expect(responseStatusCode);
+
+ if (responseBodyMessage) {
+ expect(response.body.message).toBe(responseBodyMessage);
+ }
+ },
+ );
+});
+
describe.skip('[endpoint] GET /utils/configuration', () => {
it(`Get plugin configuration and ensure the hosts is not returned GET /utils/configuration - 200`, async () => {
const initialConfig = {
@@ -240,8 +283,6 @@ describe.skip('[endpoint] PUT /utils/configuration', () => {
.send(settings)
.expect(responseStatusCode);
- console.log(response.body);
-
responseStatusCode === 200 &&
expect(response.body.data.updatedConfiguration).toEqual(settings);
responseStatusCode === 200 &&
@@ -292,6 +333,8 @@ describe.skip('[endpoint] PUT /utils/configuration', () => {
${'checks.template'} | ${0} | ${400} | ${'[request body.checks.template]: expected value of type [boolean] but got [number]'}
${'checks.timeFilter'} | ${true} | ${200} | ${null}
${'checks.timeFilter'} | ${0} | ${400} | ${'[request body.checks.timeFilter]: expected value of type [boolean] but got [number]'}
+ ${'configuration.ui_api_editable'} | ${true} | ${200} | ${null}
+ ${'configuration.ui_api_editable'} | ${true} | ${400} | ${'[request body.configuration.ui_api_editable]: expected value of type [boolean] but got [number]'}
${'cron.prefix'} | ${'test'} | ${200} | ${null}
${'cron.prefix'} | ${'test space'} | ${400} | ${'[request body.cron.prefix]: No whitespaces allowed.'}
${'cron.prefix'} | ${''} | ${400} | ${'[request body.cron.prefix]: Value can not be empty.'}
diff --git a/plugins/wazuh-core/common/constants.ts b/plugins/wazuh-core/common/constants.ts
index 59da67e7bd..83944ad2e9 100644
--- a/plugins/wazuh-core/common/constants.ts
+++ b/plugins/wazuh-core/common/constants.ts
@@ -866,6 +866,38 @@ export const PLUGIN_SETTINGS: { [key: string]: TPluginSetting } = {
},
validate: SettingsValidator.isBoolean,
},
+ 'configuration.ui_api_editable': {
+ title: 'Configuration UI editable',
+ description:
+ 'Enable or disable the ability to edit the configuration from UI or API endpoints. When disabled, this can only be edited from the configuration file, the related API endpoints are disabled, and the UI is inaccessible.',
+ store: {
+ file: {
+ configurableManaged: false,
+ },
+ },
+ category: SettingCategory.GENERAL,
+ type: EpluginSettingType.switch,
+ defaultValue: true,
+ isConfigurableFromSettings: false,
+ requiresRestartingPluginPlatform: true,
+ options: {
+ switch: {
+ values: {
+ disabled: { label: 'false', value: false },
+ enabled: { label: 'true', value: true },
+ },
+ },
+ },
+ uiFormTransformChangedInputValue: function (
+ value: boolean | string,
+ ): boolean {
+ return Boolean(value);
+ },
+ validateUIForm: function (value) {
+ return this.validate(value);
+ },
+ validate: SettingsValidator.isBoolean,
+ },
'cron.prefix': {
title: 'Cron prefix',
description: 'Define the index prefix of predefined jobs.',
diff --git a/plugins/wazuh-core/common/plugin-settings.test.ts b/plugins/wazuh-core/common/plugin-settings.test.ts
index 9345d688ce..9444fdd31d 100644
--- a/plugins/wazuh-core/common/plugin-settings.test.ts
+++ b/plugins/wazuh-core/common/plugin-settings.test.ts
@@ -37,6 +37,8 @@ describe('[settings] Input validation', () => {
${'checks.setup'} | ${0} | ${'It should be a boolean. Allowed values: true or false.'}
${'checks.template'} | ${true} | ${undefined}
${'checks.template'} | ${0} | ${'It should be a boolean. Allowed values: true or false.'}
+ ${'configuration.ui_api_editable'} | ${true} | ${undefined}
+ ${'configuration.ui_api_editable'} | ${0} | ${'It should be a boolean. Allowed values: true or false.'}
${'checks.timeFilter'} | ${true} | ${undefined}
${'checks.timeFilter'} | ${0} | ${'It should be a boolean. Allowed values: true or false.'}
${'cron.prefix'} | ${'test'} | ${undefined}