Closed blu3ch1m3ra closed 2 months ago
yep that seems to be a bug, I assume that should be
search_templates = [search_templates]
Instead, I do not have the time to edit and test it myself right now, so I am assigning it to @berggren to look at it
Describe the bug
When importing search templates through the admin cli, it throws me an UnboundLocalError.
To Reproduce
tsctl import-search-templates /etc/timesketch/templates/
Expected behavior
I expected a clean import of the given search template, so that I can use it in my timesketch instance
Priority
P3
Screenshots/Video
System & Environment
Ubuntu 22.04.2 LTS inside the latest docker image with the id b9e1c8f595c2
Additional context
I did a quick review, and indeed in line 287 I found that the variable search_template_list is assigned with a list of itself, which does not work. https://github.com/google/timesketch/blob/b9b2972986ce299f34c1867501fe906829191a68/timesketch/tsctl.py#L287
I dug a little bit deeper and found furthermore, that the variable search_template_list is not used furthermore in the code. This should be fixed.
As I'm not 100% sure what the author intended refused from submitting a PR. Is it correct, that this function is just supposed to crawl all of the yml files load all the paths into a list and then iterate through the list and load all the yaml search templates? if yes I can submit a PR to fix this bug.