Thehive: Importing Template Button Non-Functional

[frankangiolelli]

Request Type: Bug

Problem Description:

When clicking on "Admin" -> "Case Template" and then either "New Template" or "Import Template" in TheHive nothing happens. The button shows as if it is being clicked, however there is no activity, result or output of any kind.

OS Version(Server): Ubuntu 16.04.3 LTS
OS Client: Windows 10
TheHive version: 3.0
Package Type: Deb
Browser Version: Chrome 62.0.3202.94 64bit & Firefox 56.0 32bit

Problem Description

Describe the problem/bug as clearly as possible.

Steps to Reproduce

Click on Admin
Click on Case Template
Click on "New Template" or "Import Template"
Scratch head and goatee

Possible Solutions

Reinstall?

Complementary information

Am running nginx as a front end rproxy and forwarding https TLS v1.2 from port 443 to localhost:9000. Additionally, when clicking on "New Template" or "Import Template", no logs show up in nginx. TheHive logs do not show any warning or errors.

[nadouani]

Hello do you have any error on the browser console? You can have access to the Web Console but clicking: Firefox's Tools Menu > Web Developer > Web Console

[frankangiolelli]

Seems there are a few.
Unknown property ‘user-select’. Declaration dropped. index.html:1:4278
Expected declaration but found ‘{’. Skipped to next declaration.
Expected ‘none’, URL, or filter function but found ‘alpha(’. Error in parsing value for ‘filter’. Declaration dropped.

[nadouani]

Can you please send me a screenshot of these errors?

[frankangiolelli]

[nadouani]

Can you reproduce the issue when accessing thehive without the nginx rproxy? do you have a special nginx config for thehive?

[frankangiolelli]

Checking now, nothing special, just rproxy on 443 to 9000. Will do this now and report back.

[3c7]

I'm using TheHive (3.0.1) behind Nginx, too. No errors here.

[frankangiolelli]

Same issue occurs after I stopped Nginx, placed thehive port to 10000 and used it unencrypted. (can't do 9000 because then I have to jump through big hoops on a unicycle). Interestingly enough, the Report Template seems to work.

[nadouani]

Do you have this issue on the "Dashboards list". Can you got to "Dashboard" and hit "Import"?

[frankangiolelli]

The Dashboard import works ok.

[nadouani]

This weird, it shares the same code as case template import, let me investigate ;)

[frankangiolelli]

Many thanks Nadouani.

[mrod42]

@nadouani Happy Holidays!

Im sure you guys are still recovering from New Years, but I was wondering if you have any new insight on out template issues?

[frankangiolelli]

@nadouani
i have reloaded TheHive & Cortex from scratch using the training OVA. The issue came up again - the Template Import and New buttons no longer work.

The two changes that occurred prior to the issue were the implementation of nginx as a reverse proxy on the box and importing 3 existing templates from a prior version.

Here is what the site complained about:
vendor.2da1f52e.js:6 TypeError: Cannot read property 'type' of undefined
at http://:9000/scripts/scripts.afab0788.js:1:22576
at Function.s.map.s.collect (http://:9000/scripts/vendor.2da1f52e.js:23:20844)
at o (http://:9000/scripts/scripts.afab0788.js:1:22508)
at Object.n.loadTemplate (http://:9000/scripts/scripts.afab0788.js:1:23370)
at new (http://:9000/scripts/scripts.afab0788.js:1:23500)
at Object.h [as instantiate] (http://:9000/scripts/vendor.2da1f52e.js:5:5439)
at http://:9000/scripts/vendor.2da1f52e.js:5:31464
at Object. (http://:9000/scripts/vendor.2da1f52e.js:19:9911)
at http://:9000/scripts/vendor.2da1f52e.js:4:22200
at ra (http://:9000/scripts/vendor.2da1f52e.js:5:26605)

[nadouani]

Well, I'll try again to reproduce the issue using the training VM and let you know ASAP

[frankangiolelli]

Roger. Meanwhile I am going to test the case templates on my dev box and let you know if that reproduces the results.

[nadouani]

Can you double check the content of your browser's LocalStorage and share what you find on it?

[frankangiolelli]

@nadouani Will do. I have been able to recreate this by importing a prior case template. I'm not validating that through some trial and error. Will advise.

[frankangiolelli]

@nadouani Below is a screenshot of the local storage.

What I've discovered is that if I Import a prior template BEFORE creating a new template, the issue is recreated. However, if I create a new template and then import the prior templates, the issue does NOT occur.

[nadouani]

OK, I'll try this to reproduce it. Thanks

[nadouani]

Hello, I've few questions:

1/ When clicking on the "Import Template" button, do you see the Import dialog?
2/ Do you already have all the metrics defined on the case template you try to import?
2/ Do you already have all the custom fields defined on the case template you try to import?

I'm still unable to reproduce, even using a fresh training VM, with TH 3.0.3 and with zero case templates

[frankangiolelli]

Answer to 1: Nothing happens on the Import Template button. No dialog, no action, nothing.
Answer to 2: Looks like there are no metrics defined in the templates.
Answer to 3: There are custom fields, those were not created in advance of importing the template.

Thanks @nadouani

[nadouani]

Hello,

so the issue is clear: you have one or multiple case template that break the template admin page, because of the usage of a custom field that doesn't exist.

We have 2 options:

1/ add the missing custom fields, even temporarily until fixing the cate templates page
2/ find the broken case templates and remove them from the database, fix them, and reimport them

Which option do you prefer? :)

Nabil

[frankangiolelli]

Hi @nadouani . I removed the broken case templates.

[nadouani]

Thanks, we will fix this issue to prevent users from falling into the same issue. Thanks

[frankangiolelli]

Cool. It would be nice to have a panic button on templates or an alternate manual remove process to dump one or all templates. Thanks for being so responsive.

[forensic65x]

Same thing just happened to me. I imported 2 case templates with no issue.

Neither of the 2 case templates showed up in the Admin => Case templates section and I was unable to use the import or new template option. The templates did show up under New Case though.

I added the custom fields and now the templates show up in the Admin => Case templates section and I am able to edit existing templates or add new ones.

[mthlvt]

reproduced by importing a case with custom fields not defined, fixed it by creating the fields

[marcnil815]

I have a similar issue.
One template A.
One used custom field X in Template A.

Custom field exists, but still all buttons in the template page are bot working and template A is not listed.

I used to have another template B. Unfortunately I cannot remember if and how I deleted it.

No errors in logs.

[nadouani]

We will fix this in two steps

Step 1: prevent the missing custom fields from breaking the case template admin page
Step 2: improve the template export feature to include the custom fields and metrics definitions during the export