Add locked field to feeds for sync user permission control

- Add database migration case 141 for feeds.locked field
- Modify feed processing to set event locked status from feed config
- Add locked checkbox to feed add/edit UI forms
- Update controller to handle locked field in save operations

Fixes sync user permission issue where users could pull feed events
but not update them. Events from locked feeds can now be edited
by sync users, while unlocked feeds remain local-only.

Addresses GitHub issue MISP#10047

Co-Authored-By: Chris Horsley <chris.horsley@falconmouse.com>

Author: devin-ai-integration[bot]

app/Controller/FeedsController.php

@@ -280,6 +280,9 @@ public function add()
                 if (empty($feed['Feed']['lookup_visible'])) {
                     $feed['Feed']['lookup_visible'] = 0;
                 }
+                if (empty($feed['Feed']['locked'])) {
+                    $feed['Feed']['locked'] = 0;
+                }
                 if (empty($feed['Feed']['input_source'])) {
                     $feed['Feed']['input_source'] = 'network';
                 } else {
@@ -379,7 +382,8 @@ public function edit($feedId)
                 'lookup_visible',
                 'headers',
                 'orgc_id',
-                'fixed_event'
+                'fixed_event',
+                'locked'
             ],
             'afterFind' => function (array $feed) {
                 $feed['Feed']['settings'] = json_decode($feed['Feed']['settings'], true);

app/Model/AppModel.php

@@ -2480,6 +2480,9 @@ public function updateDatabase($command)
             case 140:
                 $sqlArray[] = "ALTER TABLE `taxii_servers` MODIFY `api_key` TEXT NOT NULL";
                 break;
+            case 141:
+                $sqlArray[] = "ALTER TABLE `feeds` ADD `locked` tinyint(1) NOT NULL DEFAULT 0;";
+                break;
             case 'fixNonEmptySharingGroupID':
                 $sqlArray[] = 'UPDATE `events` SET `sharing_group_id` = 0 WHERE `distribution` != 4;';
                 $sqlArray[] = 'UPDATE `attributes` SET `sharing_group_id` = 0 WHERE `distribution` != 4;';

app/Model/Feed.php

@@ -1061,6 +1061,7 @@ private function __prepareEvent($event, array $feed, $filterRules)
             } else {
                 $event['Event']['distribution'] = $feed['Feed']['distribution'];
                 $event['Event']['sharing_group_id'] = $feed['Feed']['sharing_group_id'];
+                $event['Event']['locked'] = !empty($feed['Feed']['locked']) ? 1 : 0;
                 if ($feed['Feed']['sharing_group_id']) {
                     $sg = $this->SharingGroup->find('first', array(
                         'recursive' => -1,

app/View/Feeds/add.ctp

@@ -31,6 +31,12 @@ echo $this->element('genericElements/Form/genericForm', [
                 'label' => __('Unpublish events'),
                 'type' => 'checkbox'
             ],
+            [
+                'field' => 'locked',
+                'label' => __('Lock events'),
+                'title' => __('Lock events created from this feed (allows sync users to edit them)'),
+                'type' => 'checkbox'
+            ],
             [
                 'field' => 'name',
                 'label' => __('Name'),