Single OSSEC rule to supress alert_by_email - email

Im trying to supress/ignore the alert_by_email-option for every OSSEC-rule. The documentation suggests the following:
"Some rules have an option set to force OSSEC into sending an alert email. This option is alert_by_email. One of these rules is 1002. To ignore these rules you will have to create a rule to specifically ignore it, or overwrite the rule without the alert_by_email option."
However I could not find any example for creating a single role to ignore the option. Hope you guys can help me.

Add the following rule in your ossec/rules/local_rules.xml file:
Add the rule at the bottom of the file but make sure it is within the <group> tag.
<group>
...
..
...
<rule id="1002" level="2" overwrite="yes">
<options>no_email_alert</options>
<description>Unknown problem somewhere in the system.</description>
</rule>
</group>
This will stop sending email alerts for rule id=1002

Related

Problem with rule validation - valid on save, invalid on load

While testing the unchanged CodeEffects asp.net core demo application (Editor 5.0.4.8, Engine 5.0.2.6) I've found an interesting problem.
If I create an execution rule that checks for example if FirstName contains two spaces, I can save this rule without a problem, and in SaveRule action it passes the validation using editor.Rule.IsValid. Here is an example of the rule definition:
<if>
<clause>
<condition type="contains" stringComparison="OrdinalIgnoreCase">
<property name="FirstName" />
<value> </value>
</condition>
</clause>
<then>
<method name="Register">
<value>aaaa</value>
</method>
</then>
</if>
But when refreshing the editor and trying to load this saved rule it won't load into editor. The reason is that the LoadRule controller action returns empty json.
While investigating this further it looks that the editor.GetClientRuleData returns null because the rule is invalid. If I check editor.Rule.IsValid just before calling editor.GetClientRuleData I can see it return false and the editor.Rule.InvalidElements holds one element:
{{c:"",h:"v120"}}
The error message would be "The only allowed operators for empty string values are IS and IS NOT" but of course it's not shown in the editor in the demo project as this is not expected to happen.
Not sure if this is in any way related to the problem, but one obvious difference between LoadRule and SaveRule actions is how the rule is loaded.
When saving the rule, the rule data (coming from the UI) is loaded into editor with
editor.LoadClientData(data.Data);
and when loading the rule it's loaded using the xml (from the storage) effectively calling this:
editor.Rule = Rule.Models.RuleModel.Create(ruleXml, typeof(Models.Patient))
So my question is why can invalid rule pass the validation on save, and then the same rule fails the validation on load? Any fix I can try or a workaround?
This issue has been fixed in the latest version of Rule Editor. You need to update Code Effects references from NuGet:
CodeEffects.Rule.Common - 5.0.2.4, CodeEffects.Rule.Editor.Core - 5.0.4.1 (this is the assembly that contains that fix), CodeEffects.Rule.Editor.Web.Core - 5.0.4.8

Submit form to rewritten URLs?

I am trying to create nice URL's for my Magento search form, to make:
http://domain.com/catalogsearch/result/?q=KEYWORD
look like this:
http://domain.com/search/KEYWORD
I have written this is my htaccess file:
RewriteRule ^search/([^/]+)/?$ /catalogsearch/result/?q=$1 [QSA,P,NC]
Which works nicely, when I type in http://domain.com/search/KEYWORD it displays the results as it should.
BUT...
I can't workout how to get my search form to go to the nice format URL, it still goes to the original.
My search form is currently like this:
<form id="search_form" action="http://domain.com/catalogsearch/result/" method="get">
<input id="search" type="search" name="q" value="KEYWORD" maxlength="128">
<button type="submit">search</button>
</form>
Any point in the right direction much appreciated.
There are a couple of things going on here, so let me try to explain the best I can.
First and foremost, your main issue is the generation of this new "pretty" search URL. When you use a <form> with method="GET", each input (i.e. <input name="q">) will get appended to the form's action as a query parameter (you'll get /search?q=foo instead of /search/foo).
In order to fix this, you need to do two things:
Change your form tag to look like this:
<form id="search_form" action="<?php echo Mage::getUrl('search'); ?>" method="GET">
This will ensure that the form is submitted to /search instead of /catalogsearch/result. (You'll still get a ?q=foo, though, and that will be resolved in #2.)
Add a bit of JavaScript which hijacks the form submission and forms the desired URL:
var form = document.getElementById('search_form'),
input = document.getElementById('search');
form.onsubmit = function() {
// navigate to the desired page
window.location = form.action + input.value;
// don't actually submit the form
return false;
};
That'll get you up and running, but there are still some other issues which you should resolve.
Using RewriteRule based rewrites with Magento does not work well. I haven't quite figured out the technical reason for this, but I've had the same trouble that you're having. The reason that your rewrite works with the P flag is because the P flag turns the rewrite into a proxy request. This means that your web server will make another request to itself with the new URL, which avoids the typical RewriteRule trouble you'd run into.
So, how do you utilize a custom pretty URL without using RewriteRule? You use Magento's internal rewrite logic! Magento offers regex-based rewrite logic similar to RewriteRule through its configuration XML:
<config>
<global>
<rewrite>
<some_unique_identifier>
<from><![CDATA[#/search/(.*)/?$#]]></from>
<to><![CDATA[/catalogsearch/result/index/q/$1/]]></to>
<complete />
</some_unique_identifier>
</rewrite>
</global>
</config>
By putting that configuration in one of your modules, Magento will internally rewrite requests of the form /search/foo to /catalogsearch/result/index/q/foo/. Note that you have to use Magento's custom parameter structure (name-value pairs separated by /), as it will not parse query string parameters after it performs this internal rewrite. Also note that you have to specify the full module-controller-action trio (/catalogsearch/result/index/) because otherwise q would be interpreted as an action name, not a parameter name.
This is much better than using a proxy request because it doesn't issue a secondary request, and the rewrite happens in Magento's core route handling logic.
This should be enough to get you completely up and running on the right path. However, if you're interested, you could take this one step further.
By using the above techniques, you'll end up with three URLs for your searches: /search/foo, /catalogsearch/result/?q=foo, and /catalogsearch/result/q/foo. This means that you essentially have three pages for each search query, all with the same content. This is not great for SEO purposes. In order to combat this drawback, you can create a 301 permanent redirect from the second two URLs to redirect to your pretty URL, or you can use a <link rel="canonical"> tag to tell search engines that your pretty URL is the main one.
Anyways, I hope that all of this helps and puts you on the right track!

grails access form attributes in controller

In grails i have a form with g:field tags like:
<g:field name="test" from="0..20"/>
I am trying to find a way how I can access the "from" attribute in my controller.
I can get the "value" attribute by using:
print params.test
I have tried:
print params.test.from
I'm sure there must be a way to do this but I can not seem to find it.
What I am wanting to achieve by this is perform validation so that the value does not go outside the the from range.
I know that this can be added in the domain, but in my situation I need to allow the user to overwrite the range constraints.
Any ideas?
By the time that code hits the browser, it is just HTML. from doesn't exist anymore. If that is being rendered into some sort of client side validation, that's not going to get submitted back to the server in a form submit.
If you explain what you are really needing to do in your question, I can provide a better answer.
You can pass the "from" values as hidden fields.
<g:hiddenField name="min" value="0" />
<g:hiddenField name="max" value="20" />
Something like that.

Creating a working copy for Plone 4 custom content types

I have created a custom Plone content type in my package i.e. my.product.
I am in need of integrating a working copy support: so that a "published" document (in my case, a published content type) stays online while it is being edited. Basically, I want to take advantage of 'Working Copy Support (Iterate)' provided by plone.app.iterate to achieve what is explained here. This will provide me with ability to check-in/check-out my changes.
Is this possible in Plone 4 with custom content types using Archetypes? How would one go about it if yes?
I added the following two files inside my.product/my/product/profiles/default folder and it appears to work:
diff_tool.xml
<?xml version="1.0"?>
<object>
<difftypes>
<type portal_type="MyCustomType">
<field name="any" difftype="Compound Diff for AT types"/>
</type>
</difftypes>
</object>
repositorytool.xml
<?xml version="1.0"?>
<repositorytool>
<policymap>
<type name="MyCustomType">
<policy name="at_edit_autoversion"/>
<policy name="version_on_revert"/>
</type>
</policymap>
</repositorytool>
I have never used plone.app.iterate, but this is the generic approach how to solve the problem.
Actions are installed by plone.app.iterate GenericSetup profile. You can see actions here:
https://github.com/plone/plone.app.iterate/blob/master/plone/app/iterate/profiles/default/actions.xml
Pay note to the line *available_expr* which tells when to show the action or not. It points to helper view with the conditition.
The view is defined here
https://github.com/plone/plone.app.iterate/blob/master/plone/app/iterate/browser/configure.zcml#L7
The checks that are performed for the content item if it's archiveable
https://github.com/plone/plone.app.iterate/blob/master/plone/app/iterate/browser/control.py#L47
Most likely the failure comes from if not interfaces.IIterateAware.providedBy condition. Your custom contennt must declare this interface. However, you can confirm this putting a pdb breakpoint in checkin_allowed(self) and step it though line-by-line and see what happens with your content type.

WiX: Preserve on major upgrade, remove on uninstall

I have defined a component to cleanup a generated (not installed) file on uninstall but leave intact on a major upgrade after reading this post
<Component Id="C_RemoveOnUninstall" Guid="XXX">
<RemoveFile Id="DeleteGeneratedFile" Name="ProgramGeneratedFile" On="uninstall"/>
<Condition>REMOVE="ALL" AND NOT UPGRADINGPRODUCTCODE</Condition>
</Component>
With condition above, the file is left behind for both upgrade and uninstall.
Without the condition, the file is deleted for both upgrade and uinstall.
I have tried RemoveFile for each of On="install/uninstall/both" but it does not seem to matter. Have read this post but I am hoping to make component conditions work and avoid writing custom action for this.
Does this code look correct? Any solutions or work around?
This approach assumes the RemoveFiles action ignores an item in the RemoveFile table when the property DirProperty referrers to has a value of null. The property DirProperty referrers to will be set during uninstall though not during an upgrade.
Conditionally set the property:
<SetProperty Id="prop_GeneratedFileDir" Value="[GeneratedFileDir]" After="InstallInitialize" Sequence="execute">
REMOVE="ALL" AND NOT UPGRADINGPRODUCTCODE
</SetProperty>
Define an element for the RemoveFile table:
<Component Id="C_RemoveOnUninstall" Guid="XXX">
<RemoveFile Id="DeleteGeneratedFile" Property="prop_GeneratedFileDir" Name="ProgramGeneratedFile" On="uninstall"/>
<CreateFolder/>
</Component>
Some helpful links:
wix-users, RemoveFile Table, RemoveFile Element, RemoveFolderEx Element