735880c398
Creating minified JS file from chnages in #1909
2020-08-08 15:04:59 -05:00
0558da90fe
Added support to allow invalid IMAP certificates ( #1909 )
...
This commit allows self-signed certificates to be used in upstream IMAP connections.
2020-08-08 15:03:42 -05:00
90fed5a575
Added escaping for error message in sending profile hostname
2020-08-06 22:21:41 -05:00
b684fb4ebd
Fixing issue where campaigns aren't showing up in the archived tab if they have been marked as completed.
...
Fixes #1892
2020-07-25 14:47:37 -05:00
19ef924d89
Properly escaping server output when a request is made to ping a malicious webhook URL.
...
Fixes #1901
2020-07-24 23:04:55 -05:00
b25f5ac5e4
Updated PapaParse config to prevent CSV injection.
...
I've updated the PapaParse JS library to the latest version from the master branch which supports the `escapeForumlae` option in order to prevent malicious event entries from being parsed and executed by the Gophish user's spreadsheet software.
When a new PapaParse release is created, I'll update this code to use the updated minified file.
2020-07-24 22:44:24 -05:00
4e9b94b641
Fixed validation when setting IMAP hostname
2020-07-17 22:40:10 -05:00
bb7de8df3e
Initial Implementation of a Password Policy ( #1867 )
...
This PR adds the initial work to implement a password policy as defined in #1538 .
Specifically, this implements the following
* Rate limiting for the login handler
* Implementing the ability for system admins to require a user to reset their password
* Implementing a password policy that requires passwords to be a minimum of 8 characters
* Removes the default password (gophish) for admin users to instead have the password randomly generated when Gophish first starts up
* Adds a password strength meter when choosing a new password
Fixes #1538
2020-06-19 22:03:51 -05:00
ec8b17238e
General code cleanup as part of an effort to integrate staticcheck into our CI pipeline.
2020-05-25 21:46:36 -05:00
b57210f6e7
Rebuilt JS files from #1812
2020-05-24 22:24:57 -05:00
b29544c208
Rebuilding JS files from #1838
2020-05-23 12:56:18 -05:00
353639e168
Use GroupsSummary to create and copy campaign ( #1838 )
...
The Groups (get all groups and associated targets) call is used while
loading the modal for creating and copying a campaign. As the Groups API gets
all the associated targets for a groups as well, it slows the system
considerably if there are large number of groups and targets (~200
groups each with ~100-10000 targets).
As targets are not really needed in this workflow, this call can be
replaced by the GroupsSummary call.
2020-05-23 12:51:43 -05:00
726e3c96ac
Rebuilding JS files from #1830
2020-05-08 21:02:05 -05:00
116c2a7e7e
Load datatable rows all at once ( #1830 )
...
This change modifies how we populate DataTables to draw the table only once vs. drawing it when we add each new row. This should result in tables loading quicker.
2020-05-03 22:03:58 -05:00
38a6a77c9c
Added ability to allow admin to 'su' to other accounts ( #1812 )
...
* Added ability to allow admin to 'su' to other accounts
* Naming convention and user message modifications
* Removed debug statement
2020-04-27 18:19:20 -05:00
118d9899d6
Updated minified scripts from #1772
2020-03-15 12:41:19 -05:00
c0be58aa3d
Add "mark as reported" to results table ( #1772 )
...
This commit adds the ability to mark a result as reported directly from the campaign results view.
2020-03-15 12:38:51 -05:00
2e3aacd22d
Remove Unused Variable ( #1774 )
...
The timeline_series_data variable is created twice before using it. This resolves that.
2020-03-05 07:28:17 -06:00
ecb6d46914
Rebuilding minified JS to support #1722
2020-01-18 12:49:34 -06:00
9de32746ee
Added IMAP support for checking reported emails ( #1612 )
...
Initial support of managing reporting through IMAP.
Co-Authored-By: Jordan Wright <jmwright798@gmail.com>
2020-01-18 11:58:34 -06:00
01287e0dd5
Minor cleanup on webhook feature integration
...
- Ran gofmt
- Rebuilt minified static files
- Updated validation payload
2019-12-15 22:07:55 -06:00
28cd7a238e
Add Webhook Support
...
Adds support for managing outgoing webhooks. Closes #1602
2019-12-15 20:27:21 -06:00
6222c5e180
Upgrade SweetAlert2 Dependency ( #1583 )
...
Upgrades the SweetAlert2 dependency to version 8.x.x.
Co-authored-by: Glenn Wilkinson <glenn.wilkinson@gmail.com>
2019-09-10 19:49:23 -05:00
24fe998a3a
Fix multiple XSS issues in User Management Page ( #1547 )
...
If the user name is embedding some JS code, it will be executed on the client side. Note: gophish/static/js/dist/app/users.min.js will need to be regenerated too.
2019-08-23 21:07:15 -05:00
a1a2de13a4
Added a check to ensure the target details are correct if manually created.
...
Fixes #1475
2019-05-31 19:31:16 -05:00
84096b8724
Implement User Management API ( #1473 )
...
This implements the first pass for a user management API allowing users with the `ModifySystem` permission to create, modify, and delete users. In addition to this, any user is able to use the API to view or modify their own account information.
2019-05-31 13:58:18 -05:00
6ca2b76ceb
Update Javascript Dependencies ( #1440 )
...
* updated devDependencies, migrated gulpfile.js to gulp 4.0 syntax (#1438 )
* Rebuilding JS dependencies with new gulp config. Updated yarn.lock.
Co-authored-by: Christian Schwartz <christian.schwartz@gmail.com>
2019-04-21 16:34:52 -05:00
2eb4f4d348
Move API key to Bearer Token ( #1439 )
...
* Moved api_key from URL to authorization header in requests (#1434 )
* Fixing some minor formatting and rebuilding minified JS
2019-04-21 15:21:36 -05:00
3cec2dabbf
Add Archived Campaigns View ( #1367 )
...
* Adding archived view for campaigns (#1334 )
* Formatted the code, did some very minor cleanup, and rebuilt the minified JS
Closes #448
2019-02-19 21:30:18 -06:00
ba8ceb81da
Initial commit of RBAC support. ( #1366 )
...
* Initial commit of RBAC support. Closes #1333
2019-02-19 20:33:50 -06:00
4ec9f07859
Updating campaign datepicker format to match other date formats. Fixes #1288
2018-12-30 14:26:35 -06:00
b4ff771b3a
Added autocomplete for template tags to the editor for email templates and landing pages.
2018-12-30 00:02:41 -06:00
60133b45e8
Updated CKEditor to 4.11.1
2018-12-27 17:23:59 -06:00
191ec6e436
Added the CKEditor link dialog fixes to the email templates
2018-12-27 15:04:24 -06:00
ea97d6257d
Cleaned up CKEditor link dialog to be more simple. Related to #1327
2018-12-27 14:54:04 -06:00
3b248d25c7
Make Campaign Results Pie Chart Consistent with Dashboard ( #1272 )
2018-11-11 15:37:49 -06:00
468da007d5
Added result ID to campaign results view. Fixes #1239
2018-10-18 15:05:59 -05:00
ebc099b6c2
Changed modals to avoid exiting when the user clicks outside them. Fixes #1236
2018-10-15 10:40:57 -05:00
c315867cea
Removing console debug statements
2018-10-03 15:00:56 -05:00
a0c1860a0a
Fixed bug when copying campaign.
...
Fixes #549
Fixes #898
2018-10-03 15:00:08 -05:00
c9e800dda7
Updated campaigns.js to automatically default dropdown values if only one option is available.
2018-09-09 15:08:52 -05:00
de3c3a2e9c
Fixed ability to sort campaign results by reported status. Fixes #1157
2018-09-02 12:18:41 -05:00
fa1d4d74b0
Added sweetalert2 delete dialogs to all objects for consistency.
2018-09-02 12:11:06 -05:00
7dcf30f277
Add Support for Timed Campaigns ( #1184 )
...
This builds on the work from @c-f in #1090 to fully add support for "timed" campaigns, in which the emails are spaced apart as opposed to all being sent at once.
2018-09-02 11:17:52 -05:00
f09b448ec1
Added device details to clicked link and submitted data events. Fixes #1009
2018-06-12 20:37:09 -05:00
b2bd879318
Implemented view change to HTML WSYWIG view when HTML is imported for landing pages and email templates. Fixes #1100
2018-06-11 20:16:28 -05:00
35a8f13990
Improved group CSV parsing. Added ability to download CSV template from the group modal.
2018-06-09 13:22:11 -05:00
222399c5f6
De-emphasized campaign report icon while we don't have clients available.
2018-05-24 20:32:08 -05:00
3a7a62e9d6
Changed /api/reset to require API key instead of just requiring a valid session. Fixes #1028
2018-03-29 20:59:26 -05:00
2131c17c33
Fixing SSRF by requiring an API key for all import endpoints. Fixes #1026
2018-03-26 21:04:22 -05:00
Jordan Wright
Glenn Wilkinson
Prasoon Dwivedi
Paul Werther
Alex Maslakov
David Maciejak