timesketch icon indicating copy to clipboard operation
timesketch copied to clipboard

Add the ability to add custom fields to events

Open kiddinn opened this issue 5 years ago • 0 comments

That is to add the ability in the API and API client to add custom fields to already existing events.

Two approaches:

  1. Never allow a field in a document to be modified

A check is made in the API to make sure the field does not already exist, if it doesn't then go ahead, if it does then abort.

  1. Maintain a list of not allowed fields, and only modify the document if the requested field is not on that list.

  2. Maintain a list of allowed prefixes to custom fields... This could mean that you can only add fields that start with custom_ or something like that.

In (1) that would mean no updates can be made to any custom fields. In (2) that would mean that you could potentially modify an already existing field, my mistake or intentionally, which could be less than ideal. Also in (1) there may be potentially quite a few expensive lookups to make sure these fields are not already existing.

(3) means that there is no expensive lookup, if you define the prefix in a way where it doesn't collide with already existing field names you will not overwrite them. This could be an option.

kiddinn avatar Jul 09 '20 09:07 kiddinn