fix: hide redundant RDP workstation line when it matches server host
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
@@ -82,6 +82,31 @@ def host_label(host: Host | None, *, fallback: str = "unknown") -> str:
|
|||||||
return html_escape(host.hostname)
|
return html_escape(host.hostname)
|
||||||
|
|
||||||
|
|
||||||
|
def _host_display_name_base(display_name: str | None) -> str:
|
||||||
|
if not display_name or not display_name.strip():
|
||||||
|
return ""
|
||||||
|
return display_name.strip().split("(", 1)[0].strip()
|
||||||
|
|
||||||
|
|
||||||
|
def _rdp_workstation_is_redundant(workstation: str, host: Host | None) -> bool:
|
||||||
|
"""Скрыть Workstation Name, если пусто/«-» или совпадает с hostname/display_name сервера."""
|
||||||
|
ws = (workstation or "").strip()
|
||||||
|
if not ws or ws in ("-", "N/A", "?"):
|
||||||
|
return True
|
||||||
|
if host is None:
|
||||||
|
return False
|
||||||
|
ws_key = ws.casefold()
|
||||||
|
if host.hostname and ws_key == host.hostname.strip().casefold():
|
||||||
|
return True
|
||||||
|
dn = (host.display_name or "").strip()
|
||||||
|
if dn and ws_key == dn.casefold():
|
||||||
|
return True
|
||||||
|
base = _host_display_name_base(host.display_name)
|
||||||
|
if base and ws_key == base.casefold():
|
||||||
|
return True
|
||||||
|
return False
|
||||||
|
|
||||||
|
|
||||||
def format_time(dt: datetime | None) -> str:
|
def format_time(dt: datetime | None) -> str:
|
||||||
if dt is None:
|
if dt is None:
|
||||||
return "-"
|
return "-"
|
||||||
@@ -175,13 +200,15 @@ def format_rdp_login_html(event: Event) -> str:
|
|||||||
|
|
||||||
user = html_escape(_detail(details, "user", "username"))
|
user = html_escape(_detail(details, "user", "username"))
|
||||||
ip = html_escape(_detail(details, "ip_address", "source_ip", "ip"))
|
ip = html_escape(_detail(details, "ip_address", "source_ip", "ip"))
|
||||||
workstation = html_escape(_detail(details, "workstation_name", "computer_name"))
|
workstation_raw = _detail(details, "workstation_name", "computer_name")
|
||||||
|
workstation = html_escape(workstation_raw)
|
||||||
process = html_escape(_detail(details, "process_name", "process", default=""))
|
process = html_escape(_detail(details, "process_name", "process", default=""))
|
||||||
logon = logon_type_label(details.get("logon_type"))
|
logon = logon_type_label(details.get("logon_type"))
|
||||||
|
|
||||||
msg = f"<b>{header}</b>\n"
|
msg = f"<b>{header}</b>\n"
|
||||||
msg += _line("👤", "Пользователь", user)
|
msg += _line("👤", "Пользователь", user)
|
||||||
msg += _line("🏢", "Сервер", host_label(event.host))
|
msg += _line("🏢", "Сервер", host_label(event.host))
|
||||||
|
if not _rdp_workstation_is_redundant(workstation_raw, event.host):
|
||||||
msg += _line("🖥️", "Рабочая станция", workstation)
|
msg += _line("🖥️", "Рабочая станция", workstation)
|
||||||
msg += _line("🌐", "IP адрес", ip)
|
msg += _line("🌐", "IP адрес", ip)
|
||||||
if process and process != "-":
|
if process and process != "-":
|
||||||
|
|||||||
@@ -49,6 +49,64 @@ def test_rdp_failed_template_includes_user_ip_logon():
|
|||||||
assert "<b>" in text
|
assert "<b>" in text
|
||||||
|
|
||||||
|
|
||||||
|
def test_rdp_login_hides_redundant_workstation_when_matches_hostname():
|
||||||
|
host = Host(
|
||||||
|
hostname="ITIS198",
|
||||||
|
display_name="ITIS (192.168.160.198)",
|
||||||
|
os_family="windows",
|
||||||
|
)
|
||||||
|
event = Event(
|
||||||
|
event_id="00000000-0000-4000-8000-000000000508",
|
||||||
|
host_id=1,
|
||||||
|
host=host,
|
||||||
|
occurred_at=datetime(2026, 5, 31, 18, 48, 52, tzinfo=timezone.utc),
|
||||||
|
category="auth",
|
||||||
|
type="rdp.login.success",
|
||||||
|
severity="info",
|
||||||
|
title="RDP login",
|
||||||
|
summary="papatramp",
|
||||||
|
details={
|
||||||
|
"user": "papatramp",
|
||||||
|
"ip_address": "192.168.160.3",
|
||||||
|
"logon_type": 10,
|
||||||
|
"workstation_name": "ITIS198",
|
||||||
|
"event_id_windows": 4624,
|
||||||
|
},
|
||||||
|
payload={},
|
||||||
|
)
|
||||||
|
text = format_rdp_login_html(event)
|
||||||
|
assert "ITIS" in text
|
||||||
|
assert "192.168.160.3" in text
|
||||||
|
assert "Рабочая станция" not in text
|
||||||
|
assert "ITIS198" not in text
|
||||||
|
|
||||||
|
|
||||||
|
def test_rdp_login_shows_workstation_when_client_differs():
|
||||||
|
host = Host(hostname="ITIS198", display_name="ITIS", os_family="windows")
|
||||||
|
event = Event(
|
||||||
|
event_id="00000000-0000-4000-8000-000000000509",
|
||||||
|
host_id=1,
|
||||||
|
host=host,
|
||||||
|
occurred_at=datetime(2026, 5, 31, 18, 48, 52, tzinfo=timezone.utc),
|
||||||
|
category="auth",
|
||||||
|
type="rdp.login.success",
|
||||||
|
severity="info",
|
||||||
|
title="RDP login",
|
||||||
|
summary="papatramp",
|
||||||
|
details={
|
||||||
|
"user": "papatramp",
|
||||||
|
"ip_address": "192.168.160.3",
|
||||||
|
"logon_type": 10,
|
||||||
|
"workstation_name": "NEW-ADMIN-PC",
|
||||||
|
"event_id_windows": 4624,
|
||||||
|
},
|
||||||
|
payload={},
|
||||||
|
)
|
||||||
|
text = format_rdp_login_html(event)
|
||||||
|
assert "Рабочая станция" in text
|
||||||
|
assert "NEW-ADMIN-PC" in text
|
||||||
|
|
||||||
|
|
||||||
def test_rdp_success_template():
|
def test_rdp_success_template():
|
||||||
event = Event(
|
event = Event(
|
||||||
event_id="00000000-0000-4000-8000-000000000502",
|
event_id="00000000-0000-4000-8000-000000000502",
|
||||||
|
|||||||
Reference in New Issue
Block a user