Skip to content

Commit 23f9a74

Browse files
romanetarsmarcet
romanetar
authored and
smarcet
committed
feat: add action_by and environment to privilege escalation email (#89)
Signed-off-by: romanetar <[email protected]>
1 parent 0678685 commit 23f9a74

File tree

6 files changed

+68
-18
lines changed

6 files changed

+68
-18
lines changed

‎app/Jobs/NotifyMonitoredSecurityGroupActivity.php‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -77,6 +77,8 @@ final class NotifyMonitoredSecurityGroupActivity implements ShouldQueue
7777
*/
7878
public $group_slug;
7979

80+
public $action_by;
81+
8082
/**
8183
* @param string $action
8284
* @param int $user_id
@@ -85,6 +87,7 @@ final class NotifyMonitoredSecurityGroupActivity implements ShouldQueue
8587
* @param int $group_id
8688
* @param string $group_name
8789
* @param string $group_slug
90+
* @param string $action_by
8891
* @throws ValidationException
8992
*/
9093
public function __construct
@@ -95,7 +98,8 @@ public function __construct
9598
string $user_name,
9699
int $group_id,
97100
string $group_name,
98-
string $group_slug
101+
string $group_slug,
102+
string $action_by
99103
)
100104
{
101105
if(!in_array($action, self::ValidActions)){
@@ -108,19 +112,21 @@ public function __construct
108112
$this->group_id = $group_id;
109113
$this->group_name = $group_name;
110114
$this->group_slug = $group_slug;
115+
$this->action_by = $action_by;
111116

112117
Log::debug
113118
(
114119
sprintf
115120
(
116-
"NotifyMonitoredSecurityGroupActivity::constructor action %s user_id %s user_email %s user_name %s group_id %s group_name %s group_slug %s",
121+
"NotifyMonitoredSecurityGroupActivity::constructor action %s user_id %s user_email %s user_name %s group_id %s group_name %s group_slug %s action_by %s",
117122
$action,
118123
$user_id,
119124
$user_email,
120125
$user_name,
121126
$group_id,
122127
$group_name,
123-
$group_slug
128+
$group_slug,
129+
$action_by
124130
)
125131
);
126132
}
@@ -134,14 +140,15 @@ public function handle(IUserService $service){
134140
(
135141
sprintf
136142
(
137-
"NotifyMonitoredSecurityGroupActivity::handle action %s user_id %s user_email %s user_name %s group_id %s group_name %s group_slug %s",
143+
"NotifyMonitoredSecurityGroupActivity::handle action %s user_id %s user_email %s user_name %s group_id %s group_name %s group_slug %s action_by %s",
138144
$this->action,
139145
$this->user_id,
140146
$this->user_email,
141147
$this->user_name,
142148
$this->group_id,
143149
$this->group_name,
144-
$this->group_slug
150+
$this->group_slug,
151+
$this->action_by
145152
)
146153
);
147154

@@ -153,9 +160,9 @@ public function handle(IUserService $service){
153160
$this->user_name,
154161
$this->group_id,
155162
$this->group_name,
156-
$this->group_slug
163+
$this->group_slug,
164+
$this->action_by
157165
);
158-
159166
}
160167

161168
public function failed(\Throwable $exception)

‎app/Mail/MonitoredSecurityGroupNotificationEmail.php‎

Lines changed: 24 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,11 @@ final class MonitoredSecurityGroupNotificationEmail extends Mailable
3434
*/
3535
public $action;
3636

37+
/**
38+
* @var string
39+
*/
40+
public $action_by;
41+
3742
/**
3843
* @var int
3944
*/
@@ -76,9 +81,17 @@ final class MonitoredSecurityGroupNotificationEmail extends Mailable
7681
*/
7782
public $subject;
7883

84+
/**
85+
* @var string
86+
*/
87+
public $env;
88+
89+
public $action_by_phrase;
90+
7991
/**
8092
* @param string $email
8193
* @param string $action
94+
* @param string $action_by
8295
* @param int $user_id
8396
* @param string $user_email
8497
* @param string $user_name
@@ -90,6 +103,7 @@ public function __construct
90103
(
91104
string $email,
92105
string $action,
106+
string $action_by,
93107
int $user_id,
94108
string $user_email,
95109
string $user_name,
@@ -100,20 +114,23 @@ public function __construct
100114
{
101115
$this->email = $email;
102116
$this->action = $action;
117+
$this->action_by = $action_by;
103118
$this->user_id = $user_id;
104119
$this->user_email = $user_email;
105120
$this->user_name = $user_name;
106121
$this->group_id = $group_id;
107122
$this->group_name = $group_name;
108123
$this->group_slug = $group_slug;
109-
124+
$this->env = Config::get('app.env');
125+
$this->action_by_phrase = $this->action_by ? " by $this->action_by" : "";
110126
Log::debug
111127
(
112128
sprintf
113129
(
114-
"MonitoredSecurityGroupNotificationEmail::constructor email %s action %s user_id %s user_email %s user_name %s group_id %s group_name %s group_slug %s",
130+
"MonitoredSecurityGroupNotificationEmail::constructor email %s action %s action_by %s user_id %s user_email %s user_name %s group_id %s group_name %s group_slug %s",
115131
$email,
116132
$action,
133+
$action_by,
117134
$user_id,
118135
$user_email,
119136
$user_name,
@@ -126,15 +143,19 @@ public function __construct
126143

127144
public function build()
128145
{
146+
147+
129148
$this->subject = sprintf
130149
(
131-
"[%s] Monitored Security Groups - User %s (%s) has been %s - Group %s (%s)"
150+
"[%s] Monitored Security Groups - User %s (%s) has been %s%s - Group %s (%s) - Environment: %s"
132151
,Config::get('app.app_name')
133152
,$this->user_name
134153
,$this->user_email
135154
,$this->action
155+
,$this->action_by_phrase
136156
,$this->group_name
137157
,$this->group_id
158+
,$this->env
138159
);
139160
Log::debug(sprintf("MonitoredSecurityGroupNotificationEmail::build to %s", $this->email));
140161
return $this->from(Config::get("mail.from"))

‎app/Services/OpenId/UserService.php‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,6 @@
3737
use Illuminate\Support\Facades\Storage;
3838
use models\exceptions\EntityNotFoundException;
3939
use models\exceptions\ValidationException;
40-
use Models\OAuth2\Client;
4140
use models\utils\IEntity;
4241
use OAuth2\IResourceServerContext;
4342
use OAuth2\Models\IClient;
@@ -474,7 +473,17 @@ public function updateProfilePhoto($user_id, UploadedFile $file, $max_file_size
474473
return $user;
475474
}
476475

477-
public function notifyMonitoredSecurityGroupActivity(string $action, int $user_id, string $user_email, string $user_name, int $group_id, string $group_name, string $group_slug): void
476+
public function notifyMonitoredSecurityGroupActivity
477+
(
478+
string $action,
479+
int $user_id,
480+
string $user_email,
481+
string $user_name,
482+
int $group_id,
483+
string $group_name,
484+
string $group_slug,
485+
string $action_by
486+
): void
478487
{
479488
$watcher_groups = Config::get('audit.monitored_security_groups_set_activity_watchers', []);
480489

@@ -497,13 +506,15 @@ public function notifyMonitoredSecurityGroupActivity(string $action, int $user_i
497506
continue;
498507
}
499508
$notified_users[] = $user->getId();
509+
500510
Log::debug(sprintf("UserService::notifyMonitoredSecurityGroupActivity processing user %s", $user->getId()));
501511
Mail::queue
502512
(
503513
new MonitoredSecurityGroupNotificationEmail
504514
(
505515
$user->getEmail(),
506516
$action,
517+
$action_by,
507518
$user_id,
508519
$user_email,
509520
$user_name,
@@ -514,6 +525,5 @@ public function notifyMonitoredSecurityGroupActivity(string $action, int $user_i
514525
);
515526
}
516527
}
517-
518528
}
519529
}

‎app/libs/Auth/Models/User.php‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -731,6 +731,7 @@ public function addToGroup(Group $group)
731731
);
732732

733733
$current_user = Auth::user();
734+
$action_by = '';
734735
if($current_user instanceof User){
735736
Log::debug
736737
(
@@ -769,6 +770,7 @@ public function addToGroup(Group $group)
769770
);
770771

771772
AddUserAction::dispatch($this->id, IPHelper::getUserIp(), $action);
773+
$action_by = sprintf("%s (%s)", $current_user->getFullName(), $current_user->getEmail());
772774
}
773775

774776
if ($this->groups->contains($group))
@@ -789,7 +791,8 @@ public function addToGroup(Group $group)
789791
$this->getFullName(),
790792
$group->getId(),
791793
$group->getName(),
792-
$group->getSlug()
794+
$group->getSlug(),
795+
$action_by
793796
);
794797
}
795798
}
@@ -810,6 +813,7 @@ public function removeFromGroup(Group $group)
810813
)
811814
);
812815
$current_user = Auth::user();
816+
$action_by = '';
813817
if($current_user instanceof User){
814818
Log::debug
815819
(
@@ -845,6 +849,7 @@ public function removeFromGroup(Group $group)
845849
);
846850

847851
AddUserAction::dispatch($this->id, IPHelper::getUserIp(), $action);
852+
$action_by = sprintf("%s (%s)", $current_user->getFullName(), $current_user->getEmail());
848853
}
849854

850855
if (!$this->groups->contains($group)) return;
@@ -862,7 +867,8 @@ public function removeFromGroup(Group $group)
862867
$this->getFullName(),
863868
$group->getId(),
864869
$group->getName(),
865-
$group->getSlug()
870+
$group->getSlug(),
871+
$action_by
866872
);
867873
}
868874
}

‎app/libs/OpenId/Services/IUserService.php‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,7 @@ public function update(int $id, array $payload): IEntity;
9191
* @param int $group_id
9292
* @param string $group_name
9393
* @param string $group_slug
94+
* @params string $action_by
9495
* @return void
9596
*/
9697
public function notifyMonitoredSecurityGroupActivity(
@@ -100,7 +101,8 @@ public function notifyMonitoredSecurityGroupActivity(
100101
string $user_name,
101102
int $group_id,
102103
string $group_name,
103-
string $group_slug
104+
string $group_slug,
105+
string $action_by,
104106
): void;
105107

106108
}

‎resources/views/emails/audit/monitored_security_group_notification.blade.php‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,18 @@
1515
<td align="center" style="font-size:0px;padding:10px 25px;word-break:break-word;">
1616
<div style="font-family:open Sans Helvetica, Arial, sans-serif;font-size:16px;line-height:1;text-align:center;color:#000000;">
1717
<p>
18-
User {!! $user_name !!} (Email: {!! $user_email !!}) has been <b>{!! $action !!}</b>
18+
User {!! $user_name !!} (Email: {!! $user_email !!}) has been <b>{!! $action !!}</b> {!! $action_by_phrase !!}
1919
</p>
2020
</div>
2121
</td>
2222
</tr>
2323
<tr>
2424
<td align="center" style="font-size:0px;padding:10px 25px;padding-right:25px;padding-left:25px;word-break:break-word;">
25-
<div style="font-family:open Sans Helvetica, Arial, sans-serif;font-size:16px;line-height:1;text-align:center;color:#000000;">Thanks! <br/><br/>{{Config::get('app.tenant_name')}} Support Team</div>
25+
<div style="font-family:open Sans Helvetica, Arial, sans-serif;font-size:16px;line-height:1;text-align:center;color:#000000;">
26+
Thanks! <br/><br/>
27+
{{Config::get('app.tenant_name')}} Support Team <br/><br/>
28+
<b>{!! $env !!} ENVIRONMENT</b>
29+
</div>
2630
</td>
2731
</tr>
2832
</tbody>

0 commit comments

Comments
 (0)