PyMISP
PyMISP copied to clipboard
MISP
fix: [search_index] Update date_from and date_to parameters to date str
I don't think it was always this way, but it now appears that MISP is unable to handle the datefrom and dateto parameters for the event index as timestamps. The value is directly passed to the DB, which has unexpected results depending on the DB choice:
- MariaDB: Seems to return everything, ignoring the filter
- Azure MySQL: Returns nothing
The solution is to instead format the field as a date string YYYY-MM-DD which correctly enables you to use these filters on the search_index endpoint. This should be a non-breaking change, as the fields accept the same input types as before.
Okay Tom and Jerry 🤣
On Thu, Oct 10, 2024 at 12:12 PM Tom King @.***> wrote:
I don't think it was always this way, but it now appears that MISP is unable to handle the datefrom and dateto parameters for the event index as timestamps. The value is directly passed to the DB, which has unexpected results depending on the DB choice:
- MariaDB: Seems to return everything, ignoring the filter
- Azure MySQL: Returns nothing
The solution is to instead format the field as a date string YYYY-MM-DD which correctly enables you to use these filters on the search_index endpoint. This should be a non-breaking change, as the fields accept the same input types as before.
You can view, comment on, or merge this pull request online at:
https://github.com/MISP/PyMISP/pull/1304 Commit Summary
- cf27fc6 https://github.com/MISP/PyMISP/pull/1304/commits/cf27fc6b7526f5cf6a44e0bfb292df92a592c3f8 fix: [search_index] Update date_from and date_to parameters to format as YYYY-MM-DD
File Changes
(2 files https://github.com/MISP/PyMISP/pull/1304/files)
- M pymisp/api.py https://github.com/MISP/PyMISP/pull/1304/files#diff-24ea984f4dba50159301da0922e0c7b1040f43b4eb51c7cd234c284ec651b6fd (27)
- M tests/testlive_comprehensive.py https://github.com/MISP/PyMISP/pull/1304/files#diff-18d444bbe7b98024421ef54ae066e8367d0a13ac90c1b8a6e07cae556e1c1b4a (26)
Patch Links:
- https://github.com/MISP/PyMISP/pull/1304.patch
- https://github.com/MISP/PyMISP/pull/1304.diff
— Reply to this email directly, view it on GitHub https://github.com/MISP/PyMISP/pull/1304, or unsubscribe https://github.com/notifications/unsubscribe-auth/BLL6ZRZQSW7AFVODBQYJV4LZ2ZOKPAVCNFSM6AAAAABPWRCC4KVHI2DSMVQWIX3LMV43ASLTON2WKOZSGU3TQNJRGU2DGMY . You are receiving this because you are subscribed to this thread.Message ID: @.***>
Just checking, which version of MISP are you using? That might be a new thing with 2.5 and PHP8.
cc @iglocska @mokaddem
I've tested on both 2.4 and 2.5 and a timestamp doesn't appear to work for either. A quick scan of the MISP codebase shows no changes to the index function in months so I think this predates any 2.5 and PHP8 switch, but I'll let @iglocska and @mokaddem confirm.