Welcome to mirror list, hosted at ThFree Co, Russian Federation.

github.com/undo-ransomware/ransomware_detection.git - Unnamed repository; edit this file 'description' to name the repository.
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthias Held <ilovemilk@wusa.io>2020-12-20 20:31:56 +0300
committerMatthias Held <ilovemilk@wusa.io>2020-12-20 20:31:56 +0300
commit592424b62f5a87dead82688260be4b76925229c8 (patch)
treed68b137e1e9361cd25e31d5af50f31394d8a3862
parent48a091acf472728777b4948c04153ab2ca8c9eee (diff)
-rw-r--r--lib/Controller/FileOperationController.php56
-rw-r--r--lib/Controller/RecoveredFileOperationController.php56
-rw-r--r--lib/Events/FilesEvents.php1
-rw-r--r--lib/Monitor.php46
-rw-r--r--src/views/History.vue1
-rw-r--r--src/views/Recover.vue1
6 files changed, 131 insertions, 30 deletions
diff --git a/lib/Controller/FileOperationController.php b/lib/Controller/FileOperationController.php
index c36537e..ac10dc4 100644
--- a/lib/Controller/FileOperationController.php
+++ b/lib/Controller/FileOperationController.php
@@ -158,6 +158,7 @@ class FileOperationController extends Controller
{
$deleted = 0;
$recovered = 0;
+ $couldNotBeRecovered = 0;
$filesRecovered = array();
foreach ($ids as $id) {
@@ -169,7 +170,9 @@ class FileOperationController extends Controller
// clean up file operation cause it will never be recovered
$this->service->deleteById($id, false);
- return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered), Http::STATUS_BAD_REQUEST);
+ $couldNotBeRecovered++;
+ array_push($filesRecovered, $id);
+ break;
}
switch ($file->getCommand()) {
case Monitor::WRITE:
@@ -180,13 +183,31 @@ class FileOperationController extends Controller
array_push($filesRecovered, $id);
} else {
// File cannot be deleted
- return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered), Http::STATUS_INTERNAL_SERVER_ERROR);
+ $this->logger->warning('recover: File cannot be deleted.', array('app' => Application::APP_ID));
+
+ // clean up file operation cause it will never be recovered
+ $this->service->deleteById($id, false);
+
+ $couldNotBeRecovered++;
+ array_push($filesRecovered, $id);
+ break;
}
break;
case Monitor::DELETE:
// Recover deleted files by restoring them from the trashbin
// It's not necessary to use the real path
$trashItem = $this->trashManager->getTrashNodeById($this->userManager->get($this->userId), $file->getFileId());
+ if (is_null($trashItem)) {
+ // no item found in trashbin
+ $this->logger->warning('recover: File or folder is not located in the trashbin.', array('app' => Application::APP_ID));
+
+ // clean up file operation cause it will never be recovered
+ $this->service->deleteById($id, false);
+
+ $couldNotBeRecovered++;
+ array_push($filesRecovered, $id);
+ break;
+ }
$name = substr($trashItem->getName(), 0, strrpos($trashItem->getName(), "."));
if (strpos($trashItem->getInternalPath(), "files_trashbin/files/") !== false) {
$path = str_replace("files_trashbin/files/", "", $trashItem->getInternalPath());
@@ -203,11 +224,13 @@ class FileOperationController extends Controller
// clean up file operation cause it will never be recovered
$this->service->deleteById($id, false);
- return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered), Http::STATUS_BAD_REQUEST);
+ $couldNotBeRecovered++;
+ array_push($filesRecovered, $id);
+ break;
}
break;
case Monitor::RENAME:
- $this->service->deleteById($id, true);
+ $this->service->deleteById($id, false);
$deleted++;
array_push($filesRecovered, $id);
@@ -221,7 +244,14 @@ class FileOperationController extends Controller
array_push($filesRecovered, $id);
} else {
// File cannot be deleted
- return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered), Http::STATUS_INTERNAL_SERVER_ERROR);
+ $this->logger->warning('recover: File cannot be deleted.', array('app' => Application::APP_ID));
+
+ // clean up file operation cause it will never be recovered
+ $this->service->deleteById($id, false);
+
+ $couldNotBeRecovered++;
+ array_push($filesRecovered, $id);
+ break;
}
break;
default:
@@ -236,15 +266,25 @@ class FileOperationController extends Controller
// Found more than one with the same file name
$this->logger->debug('recover: Found more than one with the same file name.', array('app' => Application::APP_ID));
- return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered), Http::STATUS_BAD_REQUEST);
+ // clean up file operation cause it will never be recovered
+ $this->service->deleteById($id, false);
+
+ $couldNotBeRecovered++;
+ array_push($filesRecovered, $id);
+ break;
} catch (\OCP\AppFramework\Db\DoesNotExistException $exception) {
// Nothing found
$this->logger->debug('recover: Files does not exist.', array('app' => Application::APP_ID));
- return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered), Http::STATUS_BAD_REQUEST);
+ // clean up file operation cause it will never be recovered
+ $this->service->deleteById($id, false);
+
+ $couldNotBeRecovered++;
+ array_push($filesRecovered, $id);
+ break;
}
}
- return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered), Http::STATUS_OK);
+ return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered, 'couldNotBeRecovered' => $couldNotBeRecovered), Http::STATUS_OK);
}
/**
diff --git a/lib/Controller/RecoveredFileOperationController.php b/lib/Controller/RecoveredFileOperationController.php
index 69f6ab7..ce72b1e 100644
--- a/lib/Controller/RecoveredFileOperationController.php
+++ b/lib/Controller/RecoveredFileOperationController.php
@@ -146,6 +146,7 @@ class RecoveredFileOperationController extends Controller
{
$deleted = 0;
$recovered = 0;
+ $couldNotBeRecovered = 0;
$filesRecovered = array();
foreach ($ids as $id) {
@@ -157,7 +158,9 @@ class RecoveredFileOperationController extends Controller
// clean up file operation cause it will never be recovered
$this->service->deleteById($id, false);
- return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered), Http::STATUS_BAD_REQUEST);
+ $couldNotBeRecovered++;
+ array_push($filesRecovered, $id);
+ break;
}
switch ($file->getCommand()) {
case Monitor::WRITE:
@@ -168,13 +171,31 @@ class RecoveredFileOperationController extends Controller
array_push($filesRecovered, $id);
} else {
// File cannot be deleted
- return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered), Http::STATUS_INTERNAL_SERVER_ERROR);
+ $this->logger->warning('recover: File cannot be deleted.', array('app' => Application::APP_ID));
+
+ // clean up file operation cause it will never be recovered
+ $this->service->deleteById($id, false);
+
+ $couldNotBeRecovered++;
+ array_push($filesRecovered, $id);
+ break;
}
break;
case Monitor::DELETE:
// Recover deleted files by restoring them from the trashbin
// It's not necessary to use the real path
$trashItem = $this->trashManager->getTrashNodeById($this->userManager->get($this->userId), $file->getFileId());
+ if (is_null($trashItem)) {
+ // no item found in trashbin
+ $this->logger->warning('recover: File or folder is not located in the trashbin.', array('app' => Application::APP_ID));
+
+ // clean up file operation cause it will never be recovered
+ $this->service->deleteById($id, false);
+
+ $couldNotBeRecovered++;
+ array_push($filesRecovered, $id);
+ break;
+ }
$name = substr($trashItem->getName(), 0, strrpos($trashItem->getName(), "."));
if (strpos($trashItem->getInternalPath(), "files_trashbin/files/") !== false) {
$path = str_replace("files_trashbin/files/", "", $trashItem->getInternalPath());
@@ -191,11 +212,13 @@ class RecoveredFileOperationController extends Controller
// clean up file operation cause it will never be recovered
$this->service->deleteById($id, false);
- return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered), Http::STATUS_BAD_REQUEST);
+ $couldNotBeRecovered++;
+ array_push($filesRecovered, $id);
+ break;
}
break;
case Monitor::RENAME:
- $this->service->deleteById($id, true);
+ $this->service->deleteById($id, false);
$deleted++;
array_push($filesRecovered, $id);
@@ -209,7 +232,14 @@ class RecoveredFileOperationController extends Controller
array_push($filesRecovered, $id);
} else {
// File cannot be deleted
- return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered), Http::STATUS_INTERNAL_SERVER_ERROR);
+ $this->logger->warning('recover: File cannot be deleted.', array('app' => Application::APP_ID));
+
+ // clean up file operation cause it will never be recovered
+ $this->service->deleteById($id, false);
+
+ $couldNotBeRecovered++;
+ array_push($filesRecovered, $id);
+ break;
}
break;
default:
@@ -224,15 +254,25 @@ class RecoveredFileOperationController extends Controller
// Found more than one with the same file name
$this->logger->debug('recover: Found more than one with the same file name.', array('app' => Application::APP_ID));
- return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered), Http::STATUS_BAD_REQUEST);
+ // clean up file operation cause it will never be recovered
+ $this->service->deleteById($id, false);
+
+ $couldNotBeRecovered++;
+ array_push($filesRecovered, $id);
+ break;
} catch (\OCP\AppFramework\Db\DoesNotExistException $exception) {
// Nothing found
$this->logger->debug('recover: Files does not exist.', array('app' => Application::APP_ID));
- return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered), Http::STATUS_BAD_REQUEST);
+ // clean up file operation cause it will never be recovered
+ $this->service->deleteById($id, false);
+
+ $couldNotBeRecovered++;
+ array_push($filesRecovered, $id);
+ break;
}
}
- return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered), Http::STATUS_OK);
+ return new JSONResponse(array('recovered' => $recovered, 'deleted' => $deleted, 'filesRecovered' => $filesRecovered, 'couldNotBeRecovered' => $couldNotBeRecovered), Http::STATUS_OK);
}
/**
diff --git a/lib/Events/FilesEvents.php b/lib/Events/FilesEvents.php
index 59122cc..9fdc81c 100644
--- a/lib/Events/FilesEvents.php
+++ b/lib/Events/FilesEvents.php
@@ -72,7 +72,6 @@ class FilesEvents {
* @param array $params
*/
public function onFileRename(Node $source, Node $target) {
- $this->logger->warning($target->getId());
$this->logger->debug("Renaming ".$source->getPath()." to ".$target->getPath(), ['app' => Application::APP_ID]);
$this->analyze($source, $target, Monitor::RENAME);
}
diff --git a/lib/Monitor.php b/lib/Monitor.php
index 7497356..b8187a8 100644
--- a/lib/Monitor.php
+++ b/lib/Monitor.php
@@ -151,9 +151,17 @@ class Monitor
return;
}
- if ($source->getId() === $this->rootFolder->getUserFolder($this->userId)->getId()) {
- $this->logger->warning("The source node is the user folder.", ['app' => Application::APP_ID]);
- return;
+ if ($mode !== self::RENAME) {
+ // the source file does not exist if it is renamed
+ if ($source->getId() === $this->rootFolder->getUserFolder($this->userId)->getId()) {
+ $this->logger->warning("The source node is the user folder.", ['app' => Application::APP_ID]);
+ return;
+ }
+ } else {
+ if ($target->getId() === $this->rootFolder->getUserFolder($this->userId)->getId()) {
+ $this->logger->warning("The target node is the user folder.", ['app' => Application::APP_ID]);
+ return;
+ }
}
$storage = $source->getStorage();
@@ -378,15 +386,23 @@ class Monitor
return;
}
- if ($source->getId() === $this->rootFolder->getUserFolder($this->userId)->getId()) {
- $this->logger->warning("The source node is the user folder.", ['app' => Application::APP_ID]);
- return;
+ if ($mode !== self::RENAME) {
+ // the source file does not exist if it is renamed
+ if ($source->getId() === $this->rootFolder->getUserFolder($this->userId)->getId()) {
+ $this->logger->warning("The source node is the user folder.", ['app' => Application::APP_ID]);
+ return;
+ }
+ } else {
+ if ($target->getId() === $this->rootFolder->getUserFolder($this->userId)->getId()) {
+ $this->logger->warning("The target node is the user folder.", ['app' => Application::APP_ID]);
+ return;
+ }
}
$fileOperation = new FileOperation();
$fileOperation->setUserId($this->userId);
$fileOperation->setPath(str_replace('files', '', pathinfo($source->getInternalPath())['dirname']));
$fileOperation->setOriginalName($source->getName());
- if ($operation === self::RENAME) {
+ if ($mode === self::RENAME) {
$fileOperation->setNewName(pathinfo($target->getInternalPath())['basename']);
$fileOperation->setMimeType($target->getMimeType());
$fileOperation->setFileId($target->getId());
@@ -438,15 +454,23 @@ class Monitor
return;
}
- if ($source->getId() === $this->rootFolder->getUserFolder($this->userId)->getId()) {
- $this->logger->warning("The source node is the user folder.", ['app' => Application::APP_ID]);
- return;
+ if ($mode !== self::RENAME) {
+ // the source file does not exist if it is renamed
+ if ($source->getId() === $this->rootFolder->getUserFolder($this->userId)->getId()) {
+ $this->logger->warning("The source node is the user folder.", ['app' => Application::APP_ID]);
+ return;
+ }
+ } else {
+ if ($target->getId() === $this->rootFolder->getUserFolder($this->userId)->getId()) {
+ $this->logger->warning("The target node is the user folder.", ['app' => Application::APP_ID]);
+ return;
+ }
}
$fileOperation = new FileOperation();
$fileOperation->setUserId($this->userId);
$fileOperation->setPath(str_replace('files', '', pathinfo($source->getInternalPath())['dirname']));
$fileOperation->setOriginalName($source->getName());
- if ($operation === self::RENAME) {
+ if ($mode === self::RENAME) {
$fileOperation->setNewName(pathinfo($target->getInternalPath())['basename']);
$fileOperation->setMimeType($target->getMimeType());
$fileOperation->setFileId($target->getId());
diff --git a/src/views/History.vue b/src/views/History.vue
index 635ec48..c5b6954 100644
--- a/src/views/History.vue
+++ b/src/views/History.vue
@@ -17,7 +17,6 @@
class="ransomware-table"
:headers="headers"
:items="fileOperations"
- hide-default-footer
show-select
item-key="id"
>
diff --git a/src/views/Recover.vue b/src/views/Recover.vue
index a00b5d9..c92a66f 100644
--- a/src/views/Recover.vue
+++ b/src/views/Recover.vue
@@ -19,7 +19,6 @@
class="ransomware-table"
:headers="headers"
:items="detection.fileOperations"
- hide-default-footer
>
<template v-slot:item.timestamp = "{ item }">
<local-time>{{ moment(item.timestamp) }}</local-time>