When adding finding from a template, unable to add Systems/Endpoints

[freeandnull]

I reproduced this on my local machine, and on "http://defectdojo.pythonanywhere.com". The issue is when adding a finding from a template, it is no longer possible add a "systems/endpoints".

It's clear the URL on the "+" button loses the engagement ID because BEFORE clicking "Add Finding from Template", the URL for the "+" button is "http://defectdojo.pythonanywhere.com/endpoints/1/add".

After adding a finding from a template, the URL for the "+" button change to: "http://defectdojo.pythonanywhere.com/endpoints//add".

Note the double "//" where the engagement ID should exist, but does not.

Steps to reproduce:

1. Browse to an Engagement and add a finding to a test, like here: http://defectdojo.pythonanywhere.com/test/5/add_findings
2. Click "Add Finding from Template"
3. Select a template finding
4. Now that new finding is populated with data from the template, scroll down to "Systems/Endpoints" and click the "+" icon to the right of the textbox.
5. The popup shows the generic "add endpoint" page, and not the correct one which allows me to add the endpoint for this specific finding.

[grendel513]

Thanks for letting us know. We will take a look and provide a fix soon.

[freeandnull]

I downloaded and installed the latest defect-dojo on a new Ubuntu 14.04 VM a few hours ago (Django 1.8).

I'm now finding when trying to add a new finding, that clicking the "+" on Systems/Endpoints takes me to 127.0.0.1/endpoints/1/add, which pops up the generic add endpoint screen. Adding the endpoint works, but it doesn't show up on the "add finding" tab that initiated the popup. Which means I can't add a new finding because I can't add even an existing system/endpoint to the finding.

Before this change, I noticed that clicking this button called "http://defectdojo.pythonanywhere.com/endpoints/1/add?_popup=1".

Am I simply mis-understanding something or mis-configuring something?

[grendel513]

hey @HexHash64 -

https://defectdojo.pythonanywhere.com is running the latest code and I do not see the behavior you describe.

Here is how I tested:

1. Navigate to https://defectdojo.pythonanywhere.com/test/4
2. Use 'gear' pull down to click on Add Findings, which takes you to https://defectdojo.pythonanywhere.com/test/4/add_findings
3. Click on Add Finding from Template button
4. Select (click) on the Test finding in the 'Template findings' modal.
5. The form is now pre-populated with the Test finding data
6. Click on the + sign in the Systems / Endpoints field.
7. The Add Endpoint pop-up should appear (https://defectdojo.pythonanywhere.com/endpoints/1/add?_popup=1)
8. Enter any number of Endpoints (one per line). For my test I entered 10.0.0.1 and https://10.0.0.3/index.php?no=3
9. Click the 'Submit' button.
10. The pop up closes and the Systems / Endpoints field is updated with the new endpoints.
11. Check 'Active' and 'Verified' and click the 'Finished' button.
12. Finding is added and you are redirected back to the API Test page.
13. Verify finding is correct by visiting https://defectdojo.pythonanywhere.com/finding/240

Both the Endpoints were added successfully in my test.

Without looking at your set up, it will be difficult for me to see what is happening on your box. A couple of things to make sure of.

1. Run ./manage.py bower install
2. Once that completes, run ./manage.py collectstatic
3. Finally restart your server.

The add related solution depends on javascript and your static files setting to be correct.

Hope this helps!

[freeandnull]

That seems to have fixed it. Thanks!