initial commit of SVN release repo

browserconfig.xml

@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="utf-8"?>
+<browserconfig>
+  <msapplication>
+    <tile>
+      <square70x70logo src="/mstile-70x70.png"/>
+      <square150x150logo src="/mstile-150x150.png"/>
+      <square310x310logo src="/mstile-310x310.png"/>
+      <wide310x150logo src="/mstile-310x150.png"/>
+      <TileColor>#da532c</TileColor>
+    </tile>
+  </msapplication>
+</browserconfig>

classes/DateTimeDiff.php

@@ -0,0 +1,198 @@
+<?php
+/*
+ * File: DateTimeDiff.php
+ * Purpose: File to calculate DateTime differences
+ * Author: Ryan Prather
+ * Created: Feb 23, 2018
+ *
+ * Copyright 2018: Cyber Perspectives, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ * - Feb 23, 2018 - File Created
+ */
+
+/**
+ * Class to automagically calculate time differences
+ *
+ * @author godsg
+ */
+class DateTimeDiff
+{
+
+    /**
+     * The starting clock
+     *
+     * @var DateTime
+     */
+    private $_dtStart = null;
+
+    /**
+     * The ending clock
+     *
+     * @var DateTime
+     */
+    private $_dtEnd = null;
+
+    /**
+     * Variable to store difference between _dtEnd - _dtStart
+     *
+     * @var DateInterval
+     */
+    private $_diff = null;
+
+    /**
+     * Variable to store total time difference
+     *
+     * @var DateInterval
+     */
+    private $_totalDiff = null;
+
+    /**
+     * Constructor
+     */
+    public function __construct()
+    {
+        $this->_dtStart = new DateTime();
+    }
+
+    /**
+     * Getter function for _dtStart
+     * 
+     * @return DateTime
+     */
+    public function getStartClock()
+    {
+        return $this->_dtStart;
+    }
+
+    /**
+     * Getter function for _dtStart as formatted time
+     *
+     * @return string
+     */
+    public function getStartClockTime()
+    {
+        return $this->_dtStart->format("H:i:s");
+    }
+
+    /**
+     * Getter function for _dtEnd
+     *
+     * @return DateTime
+     */
+    public function getEndClock()
+    {
+        return $this->_dtEnd;
+    }
+
+    /**
+     * Getter function for _dtEnd as formatted time
+     *
+     * @return string
+     */
+    public function getEndClockTime()
+    {
+        return $this->_dtEnd->format("H:i:s");
+    }
+
+    /**
+     * Function to stop the clock and set the ending time
+     */
+    public function stopClock()
+    {
+        $this->_dtEnd = new DateTime();
+
+        $this->updateDiff();
+        $this->updateTotalDiff();
+
+    }
+
+    /**
+     * Function to reset the starting clock for another difference
+     */
+    public function resetClock()
+    {
+        $this->_dtStart = new DateTime();
+    }
+
+    /**
+     * Function to set the difference
+     */
+    public function updateDiff()
+    {
+        $this->_diff = $this->_dtEnd->diff($this->_dtStart);
+    }
+
+    /**
+     * Getter function for _diff
+     *
+     * @return DateInterval
+     */
+    public function getDiff()
+    {
+        return $this->_diff;
+    }
+
+    /**
+     * Function to return _diff as a formatting string
+     *
+     * @return string
+     */
+    public function getDiffString()
+    {
+        return $this->_diff->format("%H:%I:%S");
+    }
+
+    /**
+     * Function to update the total difference
+     */
+    public function updateTotalDiff()
+    {
+        $this->_totalDiff = $this->addIntervals();
+    }
+
+    /**
+     * Getter function for _totalDiff
+     *
+     * @return DateInterval
+     */
+    public function getTotalDiff()
+    {
+        return $this->_totalDiff;
+    }
+
+    /**
+     * Function to return to _totalDiff as a formatted string
+     *
+     * @return string
+     */
+    public function getTotalDiffString()
+    {
+        return $this->_totalDiff->format("%H:%I:%S");
+    }
+
+    /**
+     * Function to add two DateIntervals together and return the difference result
+     *
+     * @return DateInterval
+     */
+    public function addIntervals()
+    {
+        $a = new DateTime("00:00");
+        $b = clone $a;
+
+        if (is_a($this->_totalDiff, 'DateInterval')) {
+          $a->add($this->_totalDiff);
+        }
+
+        if (is_a($this->_diff, 'DateInterval')) {
+          $a->add($this->_diff);
+        }
+
+        return $b->diff($a);
+    }
+
+}

classes/advisories.inc

@@ -0,0 +1,217 @@
+<?php
+/**
+ * File: advisories.inc
+ * Author: Ryan Prather
+ * Purpose: This class creates an advisory from the software vendor.
+ * 			This advisory can be used to link other PDIs
+ * Created: Sep 16, 2013
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 16, 2013 - File created
+ */
+
+/**
+ *
+ * @author Ryan Prather
+ *
+ */
+class advisory {
+
+  /**
+   * PDI ID
+   *
+   * @var integer
+   */
+  protected $pdi_id = 0;
+
+  /**
+   * Advisory ID
+   *
+   * @var string
+   */
+  protected $adv_id = '';
+
+  /**
+   * Reference text for the advisory
+   *
+   * @var string
+   */
+  protected $reference = '';
+
+  /**
+   * Type of the advisory (MS, KB, RH, etc)
+   *
+   * @var string
+   */
+  protected $type = '';
+
+  /**
+   * URL to issuing vendor
+   *
+   * @var string
+   */
+  protected $url = '';
+
+  /**
+   * Advisory title
+   *
+   * @var string
+   */
+  protected $title = '';
+
+  /**
+   * Advisory impact
+   *
+   * @var string
+   */
+  protected $impact = '';
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_PDI_ID
+   * @param string $str_Advisory
+   * @param string $str_Ref
+   * @param string $str_Type
+   * @param string $str_URL
+   */
+  public function __construct($int_PDI_ID, $str_Advisory, $str_Ref, $str_Type, $str_URL) {
+    $this->pdi_id = $int_PDI_ID;
+    $this->adv_id = $str_Advisory;
+    $this->reference = $str_Ref;
+    $this->type = $str_Type;
+    $this->url = $str_URL;
+  }
+
+  /**
+   * Getter function for the advisory PDI linkage
+   *
+   * @return integer
+   */
+  public function get_PDI_ID() {
+    return $this->pdi_id;
+  }
+
+  /**
+   * Setter function for the advisory PDI linkage
+   *
+   * @param integer $int_PDI_ID
+   */
+  public function set_PDI_ID($int_PDI_ID) {
+    $this->pdi_id = $int_PDI_ID;
+  }
+
+  /**
+   * Getter function for advisory ID
+   *
+   * @return string
+   */
+  public function get_Advisory_ID() {
+    return $this->adv_id;
+  }
+
+  /**
+   * Setter function for advisory ID
+   *
+   * @param string $str_Advisory_ID
+   */
+  public function set_Advisory_ID($str_Advisory_ID) {
+    $this->adv_id = $str_Advisory_ID;
+  }
+
+  /**
+   * Getter function for the advisory reference text
+   *
+   * @return string
+   */
+  public function get_Ref_Text() {
+    return $this->reference;
+  }
+
+  /**
+   * Setter function for the advisory reference text
+   *
+   * @param string $str_Ref
+   */
+  public function set_Ref_Text($str_Ref) {
+    $this->reference = $str_Ref;
+  }
+
+  /**
+   * Getter function for the advisory type
+   *
+   * @return string
+   */
+  public function get_Type() {
+    return $this->type;
+  }
+
+  /**
+   * Setter function for the advisory type
+   *
+   * @param string $str_Type
+   */
+  public function set_Type($str_Type) {
+    $this->type = $str_Type;
+  }
+
+  /**
+   * Getter function for the advisory URL
+   *
+   * @return string
+   */
+  public function get_URL() {
+    return $this->url;
+  }
+
+  /**
+   * Setter for the advisory URL
+   *
+   * @param string $str_URL
+   */
+  public function set_URL($str_URL) {
+    $this->url = $str_URL;
+  }
+
+  /**
+   * Getter function for advisory title
+   *
+   * @return string
+   */
+  public function get_Title() {
+    return $this->title;
+  }
+
+  /**
+   * Setter function for advisory title
+   *
+   * @param string $str_Title_In
+   */
+  public function set_Title($str_Title_In) {
+    $this->title = $str_Title_In;
+  }
+
+  /**
+   * Getter function for advisory impact
+   *
+   * @return string
+   */
+  public function get_Impact() {
+    return $this->impact;
+  }
+
+  /**
+   * Setter function for advisory impact
+   *
+   * @param string $str_Impact_In
+   */
+  public function set_Impact($str_Impact_In) {
+    $this->impact = $str_Impact_In;
+  }
+}

classes/category.inc

@@ -0,0 +1,17 @@
+<?php
+/**
+ * File: category.inc
+ * Author: Ryan Prather
+ * Purpose: Code for future use
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ */
+

classes/cce.inc

@@ -0,0 +1,69 @@
+<?php
+/**
+ * File: cce.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a CCE
+ * Created: Sep 26, 2013
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 26, 2013 - File created
+ */
+
+/**
+ * Represents a CCE
+ *
+ * @author Ryan Prather
+ *
+ */
+class cce {
+  /**
+   * PDI ID
+   *
+   * @var integer
+   */
+  protected $pdi_id = 0;
+
+  /**
+   * CCE ID
+   *
+   * @var string
+   */
+  protected $cce_id = '';
+
+  /**
+   * Constructor
+   *
+   * @param integer $pdi_id_in
+   *    PDI ID that this is linked to
+   * @param string $cce_in
+   *    CCE ID
+   */
+  public function __construct($pdi_id_in, $cce_in) {
+    $this->pdi_id = $pdi_id_in;
+    $this->cce_id = $cce_in;
+  }
+
+  /**
+   * Getter function for PDI ID
+   *
+   * @return integer
+   */
+  public function get_PDI_ID() {
+    return $this->pdi_id;
+  }
+
+  /**
+   * Getter function for CCE
+   *
+   * @return string
+   */
+  public function get_CCE_ID() {
+    return $this->cce_id;
+  }
+}

classes/cci.inc

@@ -0,0 +1,113 @@
+<?php
+/**
+ * File: cci.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a Control Correlation Identifier from NIST
+ * Created: Sep 16, 2014
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 16, 2014 - File created
+ */
+
+/**
+ * @author Ryan Prather
+ */
+class cci {
+  /**
+   * The CCI ID
+   *
+   * @var string
+   */
+  public $cci_id = '';
+
+  /**
+   * Control ID
+   *
+   * @var string
+   */
+  public $control_id = '';
+
+  /**
+   * Enhancement ID
+   *
+   * @var int
+   */
+  public $enh_id = '';
+
+  /**
+   * Definition of the CCI similar to a long description
+   *
+   * @var string
+   */
+  public $definition = '';
+
+  /**
+   * Implentation Guidance
+   *
+   * @var string
+   */
+  public $guidance = '';
+
+  /**
+   * Assessment procedures
+   *
+   * @var string
+   */
+  public $procedure = '';
+
+  /**
+   * Reference link from CCI to the NIST link
+   *
+   * @var array:cci_reference
+   */
+  public $refs = array();
+
+  /**
+   * Constructor
+   */
+  public function __construct() {}
+}
+
+/**
+ * @author Ryan Prather
+ */
+class cci_reference {
+  /**
+   * Title of the reference
+   *
+   * @var string
+   */
+  public $title = '';
+
+  /**
+   * Release version
+   *
+   * @var int
+   */
+  public $ver = 0;
+
+  /**
+   * URL to the reference
+   *
+   * @var string
+   */
+  public $url = '';
+
+  /**
+   * Index
+   *
+   * @var string
+   */
+  public $index = '';
+
+  /**
+   * Constructor
+   */
+  public function __construct() {}
+}

classes/checklist.inc

@@ -0,0 +1,596 @@
+<?php
+/**
+ * File: checklist.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a checklist that links a PDI and software package
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright 2017: Cyber Perspectives, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ *  - Mar 3, 2017 - Added method to find icon based on checklist name and cleaned up print_Option method
+ *  - Mar 4, 2017 - Fixed type with Windows icon image (used .jpg instead of .png)
+ *  - May 13, 2017 - Added WindowsFirewall.jpg image for checklist
+ *  - May 19, 2017 - Fixed typo for WindowsFirewall
+ *  - Aug 23, 2017 - JO, Expanded checklist icons
+ */
+
+/**
+ * Represents a checklist that links a PDI and software package
+ *
+ * @author Ryan Prather
+ *
+ */
+class checklist
+{
+
+    /**
+     * The ID of the checklist
+     *
+     * @var integer
+     */
+    public $id = 0;
+
+    /**
+     * The checklist ID
+     *
+     * @var string
+     */
+    public $checklist_id = '';
+
+    /**
+     * Array of software that this checklist is applicable on
+     *
+     * @var array
+     */
+    public $sw = null;
+
+    /**
+     * The name of the checklist
+     *
+     * @var string
+     */
+    public $name = '';
+
+    /**
+     * The checklist description
+     *
+     * @var string
+     */
+    public $description = '';
+
+    /**
+     * The date of release
+     *
+     * @var DateTime
+     */
+    public $date;
+
+    /**
+     * The file name that contains the checklist
+     *
+     * @var string
+     */
+    public $file_name = '';
+
+    /**
+     * The checklist version
+     *
+     * @var integer
+     */
+    public $ver = 0;
+
+    /**
+     * The checklist release
+     *
+     * @var string
+     */
+    public $release = 0;
+
+    /**
+     * The checklist type (benchmark, manual)
+     *
+     * @var string
+     */
+    public $type = '';
+
+    /**
+     * The file name of the icon to display
+     *
+     * @var string
+     */
+    public $icon = '';
+
+    /**
+     * Classification of the checklist
+     *
+     * @var string
+     */
+    public $classification = '';
+
+    /**
+     * Constructor
+     *
+     * @param integer $int_ID
+     * @param string $str_Checklist_ID
+     * @param string $str_Name
+     * @param string $str_Description
+     * @param DateTime $dt_Date
+     * @param string $str_File_Name
+     * @param integer $int_Ver
+     * @param string $str_Release
+     * @param string $str_Type
+     * @param string $str_Icon
+     */
+    public function __construct($int_ID, $str_Checklist_ID, $str_Name, $str_Description, $dt_Date, $str_File_Name, $int_Ver, $str_Release, $str_Type, $str_Icon)
+    {
+        $this->id           = $int_ID;
+        $this->checklist_id = $str_Checklist_ID;
+        $this->name         = str_ireplace("STIG STIG", "STIG", str_ireplace("Secure Technical Implementation Guide", "STIG", $str_Name));
+        $this->description  = $str_Description;
+        if (is_string($dt_Date)) {
+            $this->date = new DateTime($dt_Date);
+        }
+        else {
+            $this->date = $dt_Date;
+        }
+        $this->file_name = $str_File_Name;
+        $this->ver       = $int_Ver;
+        $this->release   = $str_Release;
+        $this->type      = $str_Type;
+
+        if (!$str_Icon) {
+            $this->find_Icon();
+        }
+        else {
+            $this->icon = $str_Icon;
+        }
+
+        $this->sw = array();
+    }
+
+    /**
+     * Getter function for the ID
+     *
+     * @return integer
+     */
+    public function get_ID()
+    {
+        return $this->id;
+    }
+
+    /**
+     * Getter function for the checklist ID
+     *
+     * @return string
+     */
+    public function get_Checklist_ID()
+    {
+        return $this->checklist_id;
+    }
+
+    /**
+     * Getter function for the software ID
+     *
+     * @return integer
+     */
+    public function get_SW()
+    {
+        return $this->sw;
+    }
+
+    /**
+     * Function to add a software object to the applicable software array
+     *
+     * @param software $sw_in
+     */
+    public function add_SW($sw_in)
+    {
+        if (is_a($sw_in, "software")) {
+            $this->sw[$sw_in->get_ID()] = $sw_in;
+        }
+        elseif (is_array($sw_in)) {
+            $this->sw = array_merge($this->sw, $sw_in);
+        }
+    }
+
+    /**
+     * Getter function for the checklist name
+     *
+     * @return string
+     */
+    public function get_Name()
+    {
+        return $this->name;
+    }
+
+    /**
+     * Gettr function for the checklist description
+     *
+     * @return string
+     */
+    public function get_Description()
+    {
+        return $this->description;
+    }
+
+    /**
+     * Getter function for the release date
+     *
+     * @return DateTime
+     */
+    public function get_Date()
+    {
+        return $this->date;
+    }
+
+    /**
+     * Getter function for the file name
+     *
+     * @return string
+     */
+    public function get_File_Name()
+    {
+        return $this->file_name;
+    }
+
+    /**
+     * Getter function for the checklist version
+     *
+     * @return integer
+     */
+    public function get_Version()
+    {
+        return $this->ver;
+    }
+
+    /**
+     * Getter function for the checklist release
+     *
+     * @return string
+     */
+    public function get_Release()
+    {
+        return $this->release;
+    }
+
+    /**
+     * Getter function for the checklist type
+     *
+     * @return string
+     */
+    public function get_type()
+    {
+        return $this->type;
+    }
+
+    /**
+     * Getter function for the checklist icon
+     *
+     * @return string
+     */
+    public function get_Icon()
+    {
+        return $this->icon;
+    }
+
+    /**
+     * Getter function for the checklist classification
+     *
+     * @return string
+     */
+    public function get_Classification()
+    {
+        return $this->classification;
+    }
+
+    /**
+     * Setter function for the checklist classification
+     *
+     * @param string $class_in
+     */
+    public function set_Classification($class_in)
+    {
+        $this->classification = $class_in;
+    }
+
+    /**
+     * Function to determine the Checklist icon based on the name
+     */
+    public function find_Icon()
+    {
+        if (!empty($this->name)) {
+            switch ($this->name) {
+                case (preg_match("/AIX/i", $this->name) ? true : false):
+                    $this->icon = 'AIX.png';
+                    break;
+                case (preg_match("/Application Security|Application Server|Application Layer Gateway/i", $this->name) ? true : false):
+                    $this->icon = 'Application Development.gif';
+                    break;
+                case (preg_match("/Active Directory/i", $this->name) ? true : false):
+                    $this->icon = 'Active Directory.png';
+                    break;
+                case (preg_match("/Acrobat Reader|Adobe Acrobat/i", $this->name) ? true : false):
+                    $this->icon = 'Adobe Reader.png';
+                    break;
+                case (preg_match("/Coldfusion/i", $this->name) ? true : false):
+                    $this->icon = 'Adobe Coldfusion.png';
+                    break;
+                case (preg_match("/Apache/i", $this->name) ? true : false):
+                    $this->icon = 'Apache Web.jpg';
+                    break;
+                case (preg_match("/Apple OS X|Apple iOS/i", $this->name) ? true : false):
+                    $this->icon = 'Apple.jpg';
+                    break;
+                case (preg_match("/Blackberry|BB10|BBDS10/i", $this->name) ? true : false):
+                    $this->icon = 'Blackberry.jpg';
+                    break;
+                case (preg_match("/DNS/i", $this->name) ? true : false):
+                    $this->icon = 'DNS.jpg';
+                    break;
+                case (preg_match("/ESXi/i", $this->name) ? true : false):
+                    $this->icon = 'VMware (ESXi).jpg';
+                    break;
+                case (preg_match("/VMWare/i", $this->name) ? true : false);
+                    $this->icon = 'VMware.jpg';
+                    break;
+                case (preg_match("/Exchange/i", $this->name) ? true : false):
+                    $this->icon = 'Microsoft Exchange.gif';
+                    break;
+                case (preg_match("/Google Chrome/i", $this->name) ? true : false):
+                    $this->icon = 'Google Chrome.jpg';
+                    break;
+                case (preg_match("/HP\-UX/i", $this->name) ? true : false):
+                    $this->icon = 'HPUX.jpg';
+                    break;
+                case (preg_match("/IIS/i", $this->name) ? true : false):
+                    $this->icon = 'Microsoft IIS.png';
+                    break;
+                case (preg_match("/Intrusion Detection/i", $this->name) ? true : false):
+                    $this->icon = 'Intrusion Detection System.jpg';
+                    break;
+                case (preg_match("/Keyboard Video/i", $this->name) ? true : false):
+                    $this->icon = 'KVM.jpg';
+                    break;
+                case (preg_match("/Android/i", $this->name) ? true : false):
+                    $this->icon = 'Android.gif';
+                    break;
+                case (preg_match("/MS SQL|Microsoft SQL Server/i", $this->name) ? true : false):
+                    $this->icon = 'MSSQL.png';
+                    break;
+                case (preg_match("/Oracle Database/i", $this->name) ? true : false):
+                    $this->icon = 'Oracle Database.png';
+                    break;
+                case (preg_match("/Database|Postgres/i", $this->name) ? true : false):
+                    $this->icon = 'Database.png';
+                    break;
+                case (preg_match("/Java Runtime|JRE/i", $this->name) ? true : false):
+                    $this->icon = 'Sun Java.jpg';
+                    break;
+                case (preg_match("/Windows Firewall/i", $this->name) ? true : false):
+                    $this->icon = 'WindowsFirewall.jpg';
+                    break;
+                case (preg_match("/Windows Server \d{4}|Windows \d{4}/i", $this->name) ? true : false):
+                    $this->icon = "WindowsServer.png";
+                    break;
+                case (preg_match("/Windows ([\d]+|Vista|XP)/i", $this->name) ? true : false):
+                    $this->icon = "Windows.png";
+                    break;
+                case (preg_match("/Windows Defender/i", $this->name) ? true : false):
+                    $this->icon = "Windows Defender.png";
+                    break;
+                case (preg_match("/Web Server|Oracle HTTP|Oracle WebLogic/i", $this->name) ? true : false):
+                    $this->icon = 'Web Server.png';
+                    break;
+                case (preg_match("/Mcafee/i", $this->name) ? true : false):
+                    $this->icon = 'Mcafee.jpg';
+                    break;
+                case (preg_match("/Microsoft (Access|Excel|PowerPoint|Groove|InfoPath|Lync|Office System|OneNote|Outlook|Project|Publisher|Visio|Word) ([\d]+)/i", $this->name) ? true : false):
+                    $this->icon = "Office.png";
+                    break;
+                case (preg_match("/SharePoint/i", $this->name) ? true : false):
+                    $this->icon = 'Microsoft Sharepoint.png';
+                    break;
+                case (preg_match("/Dot Net/i", $this->name) ? true : false):
+                    $this->icon = 'Microsoft .NET.png';
+                    break;
+                case (preg_match("/Internet Explorer/i", $this->name) ? true : false):
+                    $this->icon = 'Internet Explorer.png';
+                    break;
+                case (preg_match("/Windows Phone/i", $this->name) ? true : false):
+                    $this->icon = 'Windows Phone.jpg';
+                    break;
+                case (preg_match("/Mozilla Firefox/i", $this->name) ? true : false):
+                    $this->icon = 'Firefox.png';
+                    break;
+                case (preg_match("/Network Printers/i", $this->name) ? true : false):
+                    $this->icon = 'Printer Scanner Fax.jpg';
+                    break;
+                case (preg_match("/Firewall[^C]+Cisco/i", $this->name) ? true : false):
+                case (preg_match("/Firewall/i", $this->name) ? true : false):
+                    $this->icon = 'Firewall.jpg';
+                    break;
+                case (preg_match("/VPN/i", $this->name) ? true : false):
+                    $this->icon = 'VPN.jpg';
+                    break;
+                case (preg_match("/Switch([^C]+)Cisco/i", $this->name) ? true : false):
+                    $this->icon = 'Cisco Switch.jpg';
+                    break;
+                case (preg_match("/Switch/i", $this->name) ? true : false):
+                    $this->icon = 'Network Switch.png';
+                    break;
+                case (preg_match("/Router[^C]+Cisco/i", $this->name) ? true : false):
+                    $this->icon = 'Cisco Router.jpg';
+                    break;
+                case (preg_match("/Router/i", $this->name) ? true : false):
+                    $this->icon = 'Network Router.png';
+                    break;
+                case (preg_match("/WLAN|WMAN/i", $this->name) ? true : false):
+                    $this->icon = 'Network Device.jpg';
+                    break;
+                case (preg_match("/Network/i", $this->name) ? true : false):
+                    $this->icon = 'Network Device.jpg';
+                    break;
+                case (preg_match("/Skype/i", $this->name) ? true : false):
+                    $this->icon = 'Skype.png';
+                    break;
+                case (preg_match("/OneDrive/i", $this->name) ? true : false):
+                    $this->icon = 'OneDrive.png';
+                    break;
+                case (preg_match("/Red ?Hat/i", $this->name) ? true : false):
+                    $this->icon = 'RedHat Linux.jpg';
+                    break;
+                case (preg_match("/SUSE Linux/i", $this->name) ? true : false):
+                    $this->icon = 'SUSE Linux.png';
+                    break;
+                case (preg_match("/Solaris/i", $this->name) ? true : false):
+                    $this->icon = 'Solaris Unix.png';
+                    break;
+                case (preg_match("/Storage Area/i", $this->name) ? true : false):
+                    $this->icon = 'Storage Area Network.gif';
+                    break;
+                case (preg_match("/z\/OS/i", $this->name) ? true : false):
+                    $this->icon = 'ZOS.jpg';
+                    break;
+                // Added by Jeff Odegard, 23 Aug 17
+                case (preg_match("/Email Services Policy/i", $this->name) ? true : false):
+                    $this->icon = 'exchange.png';
+                    break;
+                case (preg_match("/L3/i", $this->name) ? true : false):
+                    $this->icon = 'L3.png';
+                    break;
+                case (preg_match("/Symantec/i", $this->name) ? true : false):
+                    $this->icon = 'Symantec.jpg';
+                    break;
+                case (preg_match("/Tanium/i", $this->name) ? true : false):
+                    $this->icon = 'Tanium.jpeg';
+                    break;
+                case (preg_match("/Voice Video Services/i", $this->name) ? true : false):
+                    $this->icon = 'voip.jpg';
+                    break;
+                case (preg_match("/Video Services|VTC/i", $this->name) ? true : false):
+                    $this->icon = 'video-conferencing.png';
+                    break;
+                case (preg_match("/Voice Video/i", $this->name) ? true : false):
+                    $this->icon = 'voice-video.png';
+                    break;
+                case (preg_match("/Sun Ray/i", $this->name) ? true : false):
+                    $this->icon = 'sunray.jpg';
+                    break;
+                case (preg_match("/VOIP/i", $this->name) ? true : false):
+                    $this->icon = 'voip.jpg';
+                    break;
+                case (preg_match("/SteelHead/i", $this->name) ? true : false):
+                    $this->icon = 'SteelHead.png';
+                    break;
+                case (preg_match("/SmartPhone/i", $this->name) ? true : false):
+                    $this->icon = 'mobile.jpg';
+                    break;
+                case (preg_match("/MAC OSX/i", $this->name) ? true : false):
+                    $this->icon = 'mac-os-x.png';
+                    break;
+                case (preg_match("/Good/i", $this->name) ? true : false):
+                    $this->icon = 'good.png';
+                    break;
+                case (preg_match("/Oracle Linux/i", $this->name) ? true : false):
+                    $this->icon = 'oracle-linux.png';
+                    break;
+                case (preg_match("/Juniper/i", $this->name) ? true : false):
+                    $this->icon = 'juniper-networks.png';
+                    break;
+                case (preg_match("/Jboss/i", $this->name) ? true : false):
+                    $this->icon = 'jboss.png';
+                    break;
+                case (preg_match("/Google/i", $this->name) ? true : false):
+                    $this->icon = 'Google-Search-Appliance.jpg';
+                    break;
+                case (preg_match("/Wireless/i", $this->name) ? true : false):
+                    $this->icon = 'wireless.png';
+                    break;
+                case (preg_match("/F5 BIG/i", $this->name) ? true : false):
+                    $this->icon = 'f5-big-ip.jpg';
+                    break;
+                case (preg_match("/Test and Development Zone/i", $this->name) ? true : false):
+                    $this->icon = 'Enclave.jpg';
+                    break;
+                case (preg_match("/Arista/i", $this->name) ? true : false):
+                    $this->icon = 'Arista.png';
+                    break;
+                case (preg_match("/CA API/i", $this->name) ? true : false):
+                    $this->icon = 'CA TEchnologies.jpg';
+                    break;
+                case (preg_match("/Cisco IOS/i", $this->name) ? true : false):
+                    $this->icon = 'Cisco IOS.jpg';
+                    break;
+                case (preg_match("/BIND 9/i", $this->name) ? true : false):
+                    $this->icon = 'BIND DNS.jpg';
+                    break;
+                case (preg_match("/MobileIron/i", $this->name) ? true : false):
+                    $this->icon = 'mobileiron.png';
+                    break;
+                case (preg_match("/Mobile Policy/i", $this->name) ? true : false):
+                    $this->icon = 'mobile.jpg';
+                    break;
+                case (preg_match("/Mobile Device/i", $this->name) ? true : false):
+                    $this->icon = 'mobile-device.jpg';
+                    break;
+                case (preg_match("/BIND 9/i", $this->name) ? true : false):
+                    $this->icon = 'BIND DNS.jpg';
+                    break;
+                case (preg_match("/Remote Access/i", $this->name) ? true : false):
+                    $this->icon = 'remote-access.gif';
+                    break;
+                case (preg_match("/Remote Endpoint/i", $this->name) ? true : false):
+                    $this->icon = 'Remote-Endpoint.jpg';
+                    break;
+                case (preg_match("/Xenapp/i", $this->name) ? true : false):
+                    $this->icon = 'xenapp.jpg';
+                    break;
+                case (preg_match("/Removable Storage/i", $this->name) ? true : false):
+                    $this->icon = 'storage.jpg';
+                    break;
+                case (preg_match("/Traditional Security/i", $this->name) ? true : false):
+                    $this->icon = 'security.jpg';
+                    break;
+                case (preg_match("/IBM/i", $this->name) ? true : false):
+                    $this->icon = 'IBM.jpg';
+                    break;
+                case (preg_match("/Operating System/i", $this->name) ? true : false):
+                    $this->icon = 'operating_system.png';
+                    break;
+                case (preg_match("/HPE 3PAR/i", $this->name) ? true : false):
+                    $this->icon = 'HP-3par-logo.jpg';
+                    break;
+                case (preg_match("/MDM /i", $this->name) ? true : false):
+                    $this->icon = 'mobile-device-management.png';
+                    break;
+                case (preg_match("/Mainframe /i", $this->name) ? true : false):
+                    $this->icon = 'mainframe.png';
+                    break;
+                default:
+                    $this->icon = 'Orphan.png';
+            }
+        }
+    }
+
+    /**
+     * Function to print out an option element
+     *
+     * @return string
+     */
+    public function print_Option()
+    {
+        $type = strtolower($this->type) == 'iavm' ? strtoupper($this->type) : ucfirst($this->type);
+        return "<option value='{$this->id}' " .
+            "title='{$this->name} V{$this->ver}R{$this->release} ({$this->type})'>" .
+            "{$this->name} V{$this->ver}R{$this->release} ({$type})</option>";
+    }
+}

classes/cpe.inc

@@ -0,0 +1,87 @@
+<?php
+/**
+ * File: cpe.inc
+ * Author: Ryan Prather
+ * Purpose: Class to represent a Common Platform Enumeration (CPE)
+ * Created: Mar 2, 2015
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Mar 2, 2015 - File created
+ */
+
+class cpe {
+
+  public $part;
+
+
+  public $vendor;
+
+
+  public $product;
+
+
+  public $version;
+
+
+  public $update;
+
+
+  public $edition;
+
+
+  public $lang;
+
+
+  public $sw_edition;
+
+
+  public $tgt_sw;
+
+
+  public $tgt_hw;
+
+
+  public $other;
+
+  /**
+   * Constructor
+   *
+   * @param string $cpe_string
+   */
+  public function __construct($cpe_string) {
+    $cpe_string = str_replace("_", " ", $cpe_string);
+    $arr = explode(":", trim($cpe_string));
+    if($arr[1] == '2.3') {
+      $this->part       = $arr[2];
+      $this->vendor     = $arr[3];
+      $this->product    = $arr[4];
+      $this->version    = $arr[5];
+      $this->update     = $arr[6];
+      $this->edition    = $arr[7] == '*' ? NULL : $arr[7];
+      $this->lang       = $arr[8] == '*' ? NULL : $arr[8];
+      $this->sw_edition = $arr[9] == '*' ? NULL : $arr[9];
+      $this->tgt_sw     = $arr[10] == '*' ? NULL : $arr[10];
+      $this->tgt_hw     = $arr[11] == '*' ? NULL : $arr[11];
+      $this->other      = $arr[12] == '*' ? NULL : $arr[12];
+    }
+    else {
+      $this->part       = $arr[1];
+      $this->vendor     = $arr[2];
+      $this->product    = $arr[3];
+      $this->version    = isset($arr[4]) ? $arr[4] : NULL;
+      $this->update     = isset($arr[5]) ? $arr[5] : NULL;
+      $this->edition    = NULL;
+      $this->lang       = NULL;
+      $this->sw_edition = NULL;
+      $this->tgt_sw     = NULL;
+      $this->tgt_hw     = NULL;
+      $this->other      = NULL;
+    }
+  }
+}

classes/cve.inc

@@ -0,0 +1,413 @@
+<?php
+/**
+ * File: cve.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a CVE
+ * Created: Sep 26, 2013
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 26, 2013 - File created
+ */
+
+/**
+ * Represents a CVE
+ *
+ * @author Ryan Prather
+ *
+ */
+class cve {
+
+  /**
+   * PDI ID
+   *
+   * @var integer
+   */
+  protected $pdi_id = 0;
+
+  /**
+   * CVE ID
+   *
+   * @var string
+   */
+  protected $cve = '';
+
+  /**
+   * Sequence ID
+   *
+   * @var string
+   */
+  protected $seq = '';
+
+  /**
+   * Status of the CVE entry (Entry, Candidate)
+   *
+   * @var string
+   */
+  protected $status = '';
+
+  /**
+   * Phase of the CVE entry (modified, proposed, interim, assigned)
+   *
+   * @var string
+   */
+  protected $phase = '';
+
+  /**
+   * Date the phase was last changed
+   *
+   * @var string
+   */
+  protected $phase_date = '';
+
+  /**
+   * Description of the CVE
+   *
+   * @var string
+   */
+  protected $desc = '';
+
+  /**
+   * IAVM Notice ID
+   *
+   * @var array
+   */
+  protected $iavm = array();
+
+  /**
+   * Array of references
+   *
+   * @var multiple:cve_reference
+   */
+  protected $ref = array();
+
+  /**
+   * XML content from the original CVE
+   *
+   * @var string
+   */
+  protected $xml = '';
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_PDI_ID
+   * @param string $str_CVE
+   */
+  public function __construct($int_PDI_ID, $str_CVE) {
+    $this->pdi_id = $int_PDI_ID;
+    $this->cve = $str_CVE;
+  }
+
+  /**
+   * Getter function for PDI ID
+   *
+   * @return integer
+   */
+  public function get_PDI_ID() {
+    return $this->pdi_id;
+  }
+
+  /**
+   * Getter function CVE
+   *
+   * @return string
+   */
+  public function get_CVE() {
+    return $this->cve;
+  }
+
+  /**
+   * Setter function for CVE
+   *
+   * @param string $str_CVE
+   */
+  public function set_CVE($str_CVE) {
+    $this->cve = $str_CVE;
+  }
+
+  /**
+   * Getter method for sequence
+   *
+   * @return string
+   */
+  public function get_Sequence() {
+    return $this->seq;
+  }
+
+  /**
+   * Setter function for Sequence
+   *
+   * @param string $str_Seq_In
+   */
+  public function set_Sequence($str_Seq_In) {
+    $this->seq = $str_Seq_In;
+  }
+
+  /**
+   * Getter method for status
+   *
+   * @return string
+   */
+  public function get_Status() {
+    return $this->status;
+  }
+
+  /**
+   * Setter method for status
+   *
+   * @param string $str_Status_In
+   */
+  public function set_Status($str_Status_In) {
+    $this->status = $str_Status_In;
+  }
+
+  /**
+   * Getter function for phase
+   *
+   * @return string
+   */
+  public function get_Phase() {
+    return $this->phase;
+  }
+
+  /**
+   * Setter function for phase
+   *
+   * @param string $str_Phase_In
+   */
+  public function set_Phase($str_Phase_In) {
+    $this->phase = $str_Phase_In;
+  }
+
+  /**
+   * Getter function for phase date
+   *
+   * @return string
+   */
+  public function get_Phase_Date() {
+    return $this->phase_date;
+  }
+
+  /**
+   * Getter function for phase date as DateTime
+   *
+   * @return DateTime
+   */
+  public function get_Phase_Date_Date() {
+    return new DateTime($this->phase_date);
+  }
+
+  /**
+   * Setter function for phase date
+   *
+   * @param string $str_Phase_Date_In
+   */
+  public function set_Phase_Date($str_Phase_Date_In) {
+    if(is_string($str_Phase_Date_In)) {
+      $this->phase_date = $str_Phase_Date_In;
+    }
+    elseif(is_a($str_Phase_Date_In, "DateTime")) {
+      $this->phase_date = $str_Phase_Date_In->format(DATE_W3C);
+    }
+  }
+
+  /**
+   * Getter function for CVE description
+   *
+   * @return string
+   */
+  public function get_Description() {
+    return $this->desc;
+  }
+
+  /**
+   * Setter function for the CVE description
+   *
+   * @param string $str_Description_In
+   */
+  public function set_Description($str_Description_In) {
+    $this->desc = $str_Description_In;
+  }
+
+  /**
+   * Getter functio for the IAVM Notice ID
+   *
+   * @return array
+   */
+  public function get_IAVM() {
+    return $this->iavm;
+  }
+
+  /**
+   * Setter function for the IAVM Notice ID
+   *
+   * @param string $iavm_in
+   */
+  public function add_IAVM($iavm_in) {
+    if(!in_array($iavm_in, $this->iavm)) {
+      $this->iavm[] = $iavm_in;
+    }
+  }
+
+  /**
+   * Getter function for cve reference array
+   *
+   * @return array:cve_reference
+   */
+  public function get_References() {
+    return $this->ref;
+  }
+
+  /**
+   * Function to add cve reference to array
+   *
+   * @param cve_reference $ref_in
+   */
+  public function add_Reference($ref_in) {
+    $this->ref[] = $ref_in;
+  }
+
+  /**
+   * Function to see if a reference exists in this CVE
+   *
+   * @param string $ref_in
+   */
+  public function ref_Exists($ref_in) {
+    foreach($this->ref as $key => $ref) {
+      if($ref->get_Value() == $ref_in) {
+        return $ref;
+      }
+    }
+
+    return false;
+  }
+
+  /**
+   * Function to remove reference from array
+   *
+   * Return true if found and removed, otherwise false
+   *
+   * @param cve_reference $ref_in
+   * @return boolean
+   */
+  public function remove_Reference($ref_in) {
+    foreach($this->ref as $key => $ref) {
+      if($ref->get_ID() == $ref_in->get_ID()) {
+        unset($this->ref[$key]);
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  /**
+   * Getter function for CVE XML
+   *
+   * @return string
+   */
+  public function get_XML() {
+    return $this->xml;
+  }
+
+  /**
+   * Setter function for CVE XML
+   *
+   * @param string $xml_in
+   */
+  public function set_XML($xml_in) {
+    $this->xml = $xml_in;
+  }
+}
+
+/**
+ * Represent a CVE Reference
+ *
+ * @author Ryan Prather
+ */
+class cve_reference {
+  /**
+   * Reference ID from DB
+   *
+   * @var integer
+   */
+  protected $id = 0;
+
+  /**
+   * Reference source
+   *
+   * @var string
+   */
+  protected $source = '';
+
+  /**
+   * CVE URL
+   *
+   * @var string
+   */
+  protected $url = '';
+
+  /**
+   * CVE Reference value
+   *
+   * @var string
+   */
+  protected $val = '';
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_ID_In
+   * @param string $str_Source_In
+   * @param string $str_URL_In
+   * @param string $str_Val_In
+   */
+  public function __construct($int_ID_In, $str_Source_In, $str_URL_In, $str_Val_In) {
+    $this->id = $int_ID_In;
+    $this->source = $str_Source_In;
+    $this->url = $str_URL_In;
+    $this->val = $str_Val_In;
+  }
+
+  /**
+   * Getter function for reference id
+   *
+   * @return integer
+   */
+  public function get_ID() {
+    return $this->id;
+  }
+
+  /**
+   * Getter function for reference source
+   *
+   * @return string
+   */
+  public function get_Source() {
+    return $this->source;
+  }
+
+  /**
+   * Getter function for reference URL
+   *
+   * @return string
+   */
+  public function get_URL() {
+    return $this->url;
+  }
+
+  /**
+   * Getter function for reference value
+   *
+   * @return string
+   */
+  public function get_Value() {
+    return $this->val;
+  }
+}

classes/echecklist.inc

@@ -0,0 +1,386 @@
+<?php
+/**
+ * File: echecklist.inc
+ * Author: Ryan Prather
+ * Purpose: Represents and entry in an eChecklist
+ * Created: Oct 14, 2013
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Oct 14, 2013 - File created
+ */
+
+/**
+ * Represents an echecklist object
+ *
+ * @author Ryan Prather
+ */
+class echecklist {
+  /**
+   * Defines what the first column is that has a host name in it (0-based)
+   *
+   * @var integer
+   */
+  const HOST_COL_START = 5;
+
+  /**
+   * PDI ID
+   *
+   * @var integer
+   */
+  protected $pdi_id = 0;
+
+  /**
+   * STIG ID
+   *
+   * @var string
+   */
+  protected $stig = '';
+
+  /**
+   * VMS ID (GoldDisk)
+   *
+   * @var string
+   */
+  protected $vms = '';
+
+  /**
+   * Category level (1-3)
+   *
+   * @var integer
+   */
+  protected $cat = 0;
+
+  /**
+   * IA Control
+   *
+   * @var string
+   */
+  protected $ia_controls = array();
+
+  /**
+   * Short title
+   *
+   * @var string
+   */
+  protected $short_title = '';
+
+  /**
+   * Array of target statuses
+   *
+   * @var array:string
+   */
+  protected $tgt_status = array ();
+
+  /**
+   * Notes
+   *
+   * @var string
+   */
+  protected $notes = '';
+
+  /**
+   * Check contents
+   *
+   * @var string
+   */
+  protected $check_contents = '';
+
+  /**
+   * Missing PDI
+   *
+   * @var string
+   */
+  protected $missing_pdi = '';
+
+  /**
+   * Constructor
+   *
+   * @param string $str_STIG_ID
+   * @param string $str_VMS_ID
+   * @param integer $int_Cat_Level
+   * @param string $str_IA_Controls
+   * @param string $str_Short_Title
+   * @param string $str_Targets
+   * @param string $str_Notes
+   * @param string $str_Check_Contents
+   * @param string $str_Missing_PDI
+   */
+  public function __construct($str_STIG_ID, $str_VMS_ID, $int_Cat_Level, $str_IA_Controls, $str_Short_Title, $str_Targets, $str_Notes, $str_Check_Contents, $str_Missing_PDI) {
+    $this->stig = $str_STIG_ID;
+    $this->vms = $str_VMS_ID;
+    if(is_numeric($int_Cat_Level) && $int_Cat_Level > 0) {
+      $this->cat = $int_Cat_Level;
+    }
+    elseif($int_Cat_Level == 0) {
+      $this->cat = 2;
+    }
+    else {
+      $this->cat = substr_count($int_Cat_Level, "I");
+    }
+    $this->ia_controls = $str_IA_Controls;
+    $this->short_title = $str_Short_Title;
+    $this->notes = $str_Notes;
+    $this->check_contents = $str_Check_Contents;
+    $this->missing_pdi = $str_Missing_PDI;
+
+    if(substr_count($str_Targets, ",") > 0) {
+      $hosts = explode(",", $str_Targets);
+      foreach($hosts as $host) {
+        $id_status = explode("=>", $host);
+        $this->tgt_status[$id_status[0]] = $id_status[1];
+      }
+    }
+  }
+
+  /**
+   * Getter function for PDI ID
+   *
+   * @return integer
+   */
+  public function get_PDI_ID() {
+    return $this->pdi_id;
+  }
+
+  /**
+   * Setter function for PDI ID
+   *
+   * @param integer $pdi_id_in
+   */
+  public function set_PDI_ID($pdi_id_in) {
+    $this->pdi_id = $pdi_id_in;
+  }
+
+  /**
+   * Getter function for STIG ID
+   *
+   * @return string
+   */
+  public function get_STIG_ID() {
+    return $this->stig;
+  }
+
+  /**
+   * Getter function for VMS ID
+   *
+   * @return string
+   */
+  public function get_VMS_ID() {
+    return $this->vms;
+  }
+
+  /**
+   * Getter function for category level
+   *
+   * @return integer
+   */
+  public function get_Cat_Level() {
+    return $this->cat;
+  }
+
+  /**
+   * Getter function for string category level
+   *
+   * @return string
+   */
+  public function get_Cat_Level_String() {
+    if($this->cat) {
+      return implode("", array_fill(0, $this->cat, "I"));
+    }
+    return 'II';
+  }
+
+  /**
+   * Setter function for the category level
+   *
+   * @param mixed $cat_lvl_in
+   */
+  public function set_Cat_Level($cat_lvl_in) {
+    if(is_numeric($cat_lvl_in)) {
+      $this->cat = $cat_lvl_in;
+    }
+    elseif(preg_match("/I/i", $cat_lvl_in)) {
+      $this->cat = substr_count($cat_lvl_in, "I");
+    }
+  }
+
+  /**
+   * Getter function for IA control
+   *
+   * @return array
+   */
+  public function get_IA_Controls() {
+    return $this->ia_controls;
+  }
+
+  /**
+   *
+   * @return string
+   */
+  public function get_IA_Controls_String() {
+    if(is_string($this->ia_controls)) {
+      return $this->ia_controls;
+    }
+    elseif(is_array($this->ia_controls)) {
+      return implode(" ", $this->ia_controls);
+    }
+  }
+
+  /**
+   * Setter function for IA controls
+   *
+   * @param mixed $ia_controls_in
+   */
+  public function set_IA_Controls($ia_controls_in) {
+    if(is_array($ia_controls_in)) {
+      $this->ia_controls = $ia_controls_in;
+    }
+    elseif(is_string($ia_controls_in)) {
+      $this->ia_controls = explode(" ", $ia_controls_in);
+    }
+  }
+
+  /**
+   * Getter function for short title
+   *
+   * @return string
+   */
+  public function get_Short_Title() {
+    return $this->short_title;
+  }
+
+  /**
+   * Setter function for short title
+   *
+   * @param string $short_title_in
+   */
+  public function set_Short_Title($short_title_in) {
+    $this->short_title = $short_title_in;
+  }
+
+  /**
+   * Getter function for target status array
+   *
+   * @return array:string
+   */
+  public function get_Targets() {
+    return $this->tgt_status;
+  }
+
+  /**
+   * Add function for target status
+   *
+   * @param integer $int_Target_ID
+   * @param string $str_Status
+   */
+  public function add_Target($int_Target_ID, $str_Status) {
+    $this->tgt_status[$int_Target_ID] = $str_Status;
+  }
+
+  /**
+   * Setter function to set the status of an associated target
+   *
+   * @param integer $int_Target_ID
+   * @param string $str_Status
+   */
+  public function set_Target_Status($int_Target_ID, $str_Status) {
+    $this->tgt_status[$int_Target_ID] = $str_Status;
+  }
+
+  /**
+   * Getter function for notes
+   *
+   * @return string
+   */
+  public function get_Notes() {
+    return $this->notes;
+  }
+
+  /**
+   * Setter function for notes
+   *
+   * @param string $notes
+   */
+  public function set_Notes($notes) {
+    $this->notes = $notes;
+  }
+
+  /**
+   * Append notes
+   *
+   * @param string $notes
+   */
+  public function append_Notes($notes) {
+    $this->notes .= $notes;
+  }
+
+  /**
+   * Getter function for check contents
+   *
+   * @return string
+   */
+  public function get_Check_Contents() {
+    return $this->check_contents;
+  }
+
+  /**
+   * Setter function for check contents
+   *
+   * @param string $chk_contents_in
+   */
+  public function set_Check_Contents($chk_contents_in) {
+    $this->check_contents = $chk_contents_in;
+  }
+
+  /**
+   * Getter function for missing PDI
+   *
+   * @return string
+   */
+  public function get_Missing_PDI() {
+    return $this->missing_pdi;
+  }
+
+  /**
+   * Setter function for missing PDI
+   *
+   * @param string $missing_pdi_in
+   */
+  public function set_Missing_PDI($missing_pdi_in) {
+    $this->missing_pdi = $missing_pdi_in;
+  }
+
+  /**
+   * Getter function for preformated table row
+   *
+   * @return string
+   */
+  public function get_Table_Row() {
+    $cat_string = $this->get_Cat_Level_String();
+
+    $ret = "<tr>" .
+      "<td>$this->stig</td>" .
+      "<td>$this->vms</td>" .
+      "<td class='cat_" . $cat_string . "'>" . $cat_string . "</td>" .
+      "<td>$this->ia_controls</td>" .
+      "<td>$this->short_title</td>";
+
+    foreach($this->tgt_status as $key => $val) {
+      $class = str_replace(' ', '_', strtolower($val));
+      $ret .= "<td class='$key $class cat_" . $this->cat . "'>$val</td>";
+    }
+
+    $ret .= "<td>".htmlentities($this->notes)."</td>" .
+      "<td>$this->check_contents</td>" .
+      "<td>$this->missing_pdi</td>" .
+    "</tr>";
+
+    return $ret;
+  }
+
+}

classes/error.inc

@@ -0,0 +1,220 @@
+<?php
+/**
+ * File: error.inc
+ * Author: Ryan Prather
+ * Purpose: This file will contain the error handler for the ST&E Manager
+ * Created: Jun 18, 2014
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Jun 18, 2014 - File created
+ *  - Jul 29, 2014 - Added script log functionality
+ *  - Sep 05, 2014 - Fixed bug with realpath returning false for absent file
+ *  - Oct 24, 2016 - Converted Sagacity_Error::E_DEBUG constant to global constant (define)
+ * 					 Added "DEBUG" output to all functions
+ *  - Nov 7, 2016 - Added timestamp to debug prints and updated copyright to include CP
+ *  - Nov 9, 2016 - Changed err_handler to use sagacity.log and write to file using file_put_contents
+ *  - Nov 16, 2016 - Changed sql_handler to write to file using file_put_contents
+ *  - Dec 7, 2016 - Fixed sql_handler, err_handler, and script_log to only print out on E_DEBUG when using cli and use PHP_EOL
+ *  - Mar 3, 2017 - Formatting
+ *  - Mar 22, 2017 - Check that log file is writable in constructor
+ *  - May 13, 2017 - Added check in script_log, err_handler, and sql_handler functions to check that LOG_LEVEL = E_DEBUG
+ */
+
+require 'vendor/autoload.php';
+
+use Monolog\Logger;
+use Monolog\Handler\StreamHandler;
+use Monolog\Formatter\LineFormatter;
+
+/**
+ * Represents the error object to do error handling
+ *
+ * @author Ryan Prather
+ */
+class Sagacity_Error extends Logger
+{
+
+    /**
+     * File handle
+     *
+     * @var resource
+     */
+    private $fh = null;
+
+    /**
+     * Log file name
+     *
+     * @var string
+     */
+    private $fname = '';
+
+    /**
+     * Constructor
+     *
+     * @param string $fname_in
+     */
+    public function __construct($fname_in)
+    {
+        $this->fname = preg_replace("/[\.][^\.]+$/", '', basename($fname_in));
+        if (!file_exists(LOG_PATH . "/{$this->fname}.log")) {
+            touch(LOG_PATH . "/{$this->fname}.log");
+        }
+
+        if (!is_writeable(LOG_PATH . "/{$this->fname}.log")) {
+            self::err_handler("File " . realpath(LOG_PATH) . "/{$this->fname}.log is not writable", E_ERROR);
+        }
+
+        $log_level = Logger::ERROR;
+        switch(LOG_LEVEL) {
+            case E_WARNING:
+                $log_level = Logger::WARNING;
+                break;
+            case E_NOTICE:
+                $log_level = Logger::INFO;
+                break;
+            case E_DEBUG:
+                $log_level = Logger::DEBUG;
+                break;
+        }
+
+        $this->fh = new Logger($this->fname);
+        $this->fh->pushHandler(new StreamHandler(LOG_PATH . "/{$this->fname}.log", $log_level));
+
+        if(PHP_SAPI == 'cli') {
+            $stream = new StreamHandler("php://output", $log_level);
+            $stream->setFormatter(new LineFormatter("%datetime% %level_name% %message%\n", "H:i:s.u"));
+            $this->fh->pushHandler($stream);
+        }
+    }
+
+    /**
+     * Function to write to SQL error log file
+     *
+     * @param string $sql
+     *   SQL line that is the problem
+     * @param integer $errno [optional]
+     *   Error number (Default is E_NOTICE)
+     */
+    public static function sql_handler($sql, $errno = E_NOTICE)
+    {
+        if (!file_exists(LOG_PATH . "/sql_log")) {
+            touch(LOG_PATH . "/sql_log");
+        }
+        $dt     = new DateTime();
+        $errlvl = 'NOTICE';
+        switch ($errno) {
+            case E_USER_WARNING:
+            case E_WARNING:
+                $errlvl = "WARNING";
+                break;
+            case E_USER_ERROR:
+            case E_ERROR:
+                $errlvl = "ERROR";
+                break;
+            case E_DEBUG:
+                $errlvl = "DEBUG";
+                break;
+            default:
+        }
+
+        $errmsg = "{$dt->format(DateTime::ISO8601)} - $errlvl - $sql" . PHP_EOL;
+
+        file_put_contents(realpath(LOG_PATH . "/sql_log"), $errmsg, FILE_APPEND);
+
+        if ($errno == E_ERROR) {
+            die($sql . PHP_EOL);
+        }
+        elseif ($errno == E_DEBUG && LOG_LEVEL == E_DEBUG && substr(php_sapi_name(), 0, 3) == 'cli') {
+            print $errmsg;
+        }
+    }
+
+    /**
+     * Function to write application error to log file
+     *
+     * @param string $errmsg
+     *   Error message to write
+     * @param integer $errno [optional]
+     *   Error number (Default is E_NOTICE)
+     */
+    public static function err_handler($errmsg, $errno = E_NOTICE)
+    {
+        if (!file_exists(LOG_PATH . "/sagacity.log")) {
+            touch(LOG_PATH . "/sagacity.log");
+        }
+        $dt  = new DateTime();
+        $str = "{$dt->format(DateTime::ISO8601)} - ";
+        switch ($errno) {
+            case E_USER_WARNING:
+            case E_WARNING:
+                $str .= "WARNING";
+                break;
+            case E_USER_ERROR:
+            case E_ERROR:
+                $str .= "ERROR";
+                break;
+            case E_USER_NOTICE:
+            case E_NOTICE:
+                $str .= "NOTICE";
+                break;
+            case E_DEBUG:
+                $str .= "DEBUG";
+                break;
+            default:
+        }
+
+        file_put_contents(realpath(LOG_PATH . "/sagacity.log"), "$str - $errmsg" . PHP_EOL, FILE_APPEND);
+
+        if ($errno == E_ERROR || $errno == E_USER_ERROR) {
+            die($errmsg . PHP_EOL);
+        }
+        if ($errno == E_DEBUG && LOG_LEVEL == E_DEBUG && substr(php_sapi_name(), 0, 3) == 'cli') {
+            print "$str - $errmsg" . PHP_EOL;
+        }
+    }
+
+    /**
+     * Function to output a message to the script log file
+     *
+     * @param string $errmsg
+     * @param integer $errno [optional]
+     */
+    public function script_log($errmsg, $errno = E_NOTICE)
+    {
+        if (!is_a($this->fh, "Monolog\Logger")) {
+            return;
+        }
+
+        switch($errno) {
+            case E_ERROR:
+                $this->fh->error($errmsg);
+                die;
+                break;
+
+            case E_WARNING:
+                $this->fh->warning($errmsg);
+                break;
+
+            case E_NOTICE:
+                $this->fh->info($errmsg);
+                break;
+
+            case E_DEBUG:
+                $this->fh->debug($errmsg);
+                break;
+
+            default:
+                $this->fh->emergency($errmsg);
+                die;
+        }
+    }
+}

classes/finding.inc

@@ -0,0 +1,597 @@
+<?php
+
+/**
+ * File: finding.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a finding
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ *  - Sep 1, 2016 - Updated Copyright and added comments to finding_status class
+ *  - Nov 7, 2016 - Added finding::inc_Finding_Count function to increment counter
+ *  - May 25, 2017 - Fixed bug of get_Category method returning empty severity (defaults to II if empty)
+ *  - Jan 10, 2018 - Formatting
+ */
+
+/**
+ * Represents a finding
+ *
+ * @author Ryan Prather
+ *
+ */
+class finding {
+
+  /**
+   * Finding ID
+   *
+   * @var integer
+   */
+  protected $id = null;
+
+  /**
+   * Target ID
+   *
+   * @var integer
+   */
+  protected $tgt_id = null;
+
+  /**
+   * PDI ID
+   *
+   * @var integer
+   */
+  protected $pdi_id = null;
+
+  /**
+   * Scan ID
+   *
+   * @var integer
+   */
+  protected $scan_id = null;
+
+  /**
+   * Finding Status ID
+   *
+   * @var integer
+   */
+  protected $finding_status_id = null;
+
+  /**
+   * Updated category for the finding
+   *
+   * @var int
+   */
+  protected $cat = null;
+
+  /**
+   * Array of ia controls that apply to this finding
+   *
+   * @var array:string
+   */
+  protected $ia_controls = array();
+
+  /**
+   * Notes
+   *
+   * @var string
+   */
+  protected $notes = null;
+
+  /**
+   * Change ID
+   *
+   * @var integer
+   */
+  protected $change_id = null;
+
+  /**
+   * Original source
+   *
+   * @var string
+   */
+  protected $orig_src = null;
+
+  /**
+   * Finding iteration (incremented if finding is updated
+   *
+   * @var integer
+   */
+  protected $finding_itr = null;
+
+  /**
+   * Array of statuses
+   *
+   * @var array:string
+   */
+  protected $STATUS = [
+    1 => 'Not Reviewed',
+    2 => 'Not a Finding',
+    3 => 'Open',
+    4 => 'Not Applicable',
+    5 => 'No Data',
+    6 => 'Exception',
+    7 => 'False Positive'
+  ];
+
+  /**
+   * Constant for no change
+   *
+   * @var integer
+   */
+  const NC = 0;
+
+  /**
+   * Constant for change ID::TO_OPEN
+   *
+   * @var integer
+   */
+  const TO_OPEN = 1;
+
+  /**
+   * Constant for change ID::TO_NF
+   *
+   * @var integer
+   */
+  const TO_NF = 2;
+
+  /**
+   * Constant for change ID::TO_NA
+   *
+   * @var integer
+   */
+  const TO_NA = 3;
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_ID
+   * @param integer $int_Tgt_ID
+   * @param integer $int_PDI_ID
+   * @param integer $int_Scan_ID
+   * @param integer|string $Finding_Status
+   * @param string $str_Notes
+   * @param integer $int_Change_ID
+   * @param string $str_Orig_Src
+   * @param integer $int_Finding_Itr
+   */
+  public function __construct($int_ID, $int_Tgt_ID, $int_PDI_ID, $int_Scan_ID, $Finding_Status, $str_Notes, $int_Change_ID, $str_Orig_Src, $int_Finding_Itr) {
+    $this->id = $int_ID;
+    $this->tgt_id = $int_Tgt_ID;
+    $this->pdi_id = $int_PDI_ID;
+    $this->scan_id = $int_Scan_ID;
+    if (is_numeric($Finding_Status)) {
+      $this->finding_status_id = $Finding_Status;
+    }
+    else {
+      $this->finding_status_id = $this->get_Finding_Status_ID($Finding_Status);
+    }
+    $this->notes = $str_Notes;
+    $this->change_id = $int_Change_ID;
+    $this->orig_src = $str_Orig_Src;
+    $this->finding_itr = $int_Finding_Itr;
+  }
+
+  /**
+   * Getter function for Finding ID
+   *
+   * @return integer
+   */
+  public function get_ID() {
+    return $this->id;
+  }
+
+  /**
+   * Getter function for target ID
+   *
+   * @return integer
+   */
+  public function get_Tgt_ID() {
+    return $this->tgt_id;
+  }
+
+  /**
+   * Setter function for target ID
+   *
+   * @param integer $int_Tgt_ID
+   */
+  public function set_Tgt_ID($int_Tgt_ID) {
+    $this->tgt_id = $int_Tgt_ID;
+  }
+
+  /**
+   * Getter function for PDI ID
+   *
+   * @return integer
+   */
+  public function get_PDI_ID() {
+    return $this->pdi_id;
+  }
+
+  /**
+   * Setter function for PDI ID
+   *
+   * @param integer $int_PDI_ID
+   */
+  public function set_PDI_ID($int_PDI_ID) {
+    $this->pdi_id = $int_PDI_ID;
+  }
+
+  /**
+   * Getter function for Scan ID
+   *
+   * @return integer
+   */
+  public function get_Scan_ID() {
+    return $this->scan_id;
+  }
+
+  /**
+   * Setter function for Scan ID
+   *
+   * @param integer $int_Scan_ID
+   */
+  public function set_Scan_ID($int_Scan_ID) {
+    $this->scan_id = $int_Scan_ID;
+  }
+
+  /**
+   * Getter function for Finding status ID
+   *
+   * @return integer
+   */
+  public function get_Finding_Status() {
+    return $this->finding_status_id;
+  }
+
+  /**
+   * Getter function for Finding status ID based on string
+   *
+   * @param string $status
+   * @return integer
+   */
+  public function get_Finding_Status_ID($status) {
+    foreach ($this->STATUS as $key => $val) {
+      if ($val == $status) {
+        return $key;
+      }
+    }
+  }
+
+  /**
+   * Getter function for finding status string
+   *
+   * @param integer $int_Status_ID
+   * @return string
+   */
+  public function get_Finding_Status_String($int_Status_ID = null) {
+    if ($int_Status_ID) {
+      return $this->STATUS[$int_Status_ID];
+    }
+    else {
+      return $this->STATUS[$this->finding_status_id];
+    }
+  }
+
+  /**
+   * Setter function for finding status
+   *
+   * @param integer $int_Finding_Status_ID
+   */
+  public function set_Finding_Status($int_Finding_Status_ID) {
+    $this->finding_status_id = $int_Finding_Status_ID;
+  }
+
+  /**
+   * Setter function for finding status
+   *
+   * @param string $str_New_Status
+   */
+  public function set_Finding_Status_By_String($str_New_Status) {
+    $this->finding_status_id = $this->get_Finding_Status_ID($str_New_Status);
+  }
+
+  /**
+   * Getter function for notes
+   *
+   * @return string
+   */
+  public function get_Notes() {
+    return $this->notes;
+  }
+
+  /**
+   * Setter function for notes
+   *
+   * @param string $str_Notes
+   */
+  public function set_Notes($str_Notes) {
+    $this->notes = $str_Notes;
+  }
+
+  /**
+   * Function to prepend notes to the existing list
+   *
+   * @param string $str_Notes
+   */
+  public function prepend_Notes($str_Notes) {
+    $this->notes = $str_Notes . PHP_EOL . $this->notes;
+  }
+
+  /**
+   * Function to append notes
+   *
+   * @param string $str_Notes
+   * @param boolean $merge
+   */
+  public function append_Notes($str_Notes, $merge = false) {
+    $this->notes .= PHP_EOL . ($merge ? "(Merged Target)" . PHP_EOL : "") . $str_Notes;
+  }
+
+  /**
+   * Getter function for change ID
+   *
+   * @return integer
+   */
+  public function get_Change_ID() {
+    if ($this->change_id) {
+      return $this->change_id;
+    }
+    else {
+      return $this::NC;
+    }
+  }
+
+  /**
+   * Setter function for change ID
+   *
+   * @param integer $int_Change_ID
+   */
+  public function set_Change_ID($int_Change_ID) {
+    $this->change_id = $int_Change_ID;
+  }
+
+  /**
+   * Getter function for original source
+   *
+   * @return string
+   */
+  public function get_Original_Source() {
+    return $this->orig_src;
+  }
+
+  /**
+   * Setter function for original source
+   *
+   * @param string $str_Original_Source
+   */
+  public function set_Original_Source($str_Original_Source) {
+    $this->orig_src = $str_Original_Source;
+  }
+
+  /**
+   * Getter function for finding iteration
+   *
+   * @return integer
+   */
+  public function get_Finding_Iteration() {
+    return $this->finding_itr;
+  }
+
+  /**
+   * Setter function for finding iteration
+   *
+   * @param integer $int_Finding_Iteration
+   */
+  public function set_Finding_Iteration($int_Finding_Iteration) {
+    $this->finding_itr = $int_Finding_Iteration;
+  }
+
+  /**
+   * Increment the finding count by 1
+   */
+  public function inc_Finding_Count() {
+    $this->finding_itr++;
+  }
+
+  /**
+   * Getter function for deconflicted status
+   *
+   * @param string $str_New_Status
+   * @return string
+   */
+  public function get_Deconflicted_Status($str_New_Status) {
+    // must get original status first!
+    return deconflict_status::$DECONFLICTED_STATUS[$this->get_Finding_Status_String()][$str_New_Status];
+  }
+
+  /**
+   * Getter function for category
+   *
+   * @return int
+   */
+  public function get_Category() {
+    if (empty($this->cat)) {
+      return 2;
+    }
+    return $this->cat;
+  }
+
+  /**
+   * Setter function for category
+   *
+   * @param mixed $cat_in
+   */
+  public function set_Category($cat_in) {
+    if (is_numeric($cat_in)) {
+      $this->cat = $cat_in;
+    }
+    elseif (is_string($cat_in)) {
+      $this->cat = substr_count($cat_in, "I");
+    }
+  }
+
+  /**
+   * Getter function for IA controls
+   *
+   * @return array:string
+   */
+  public function get_IA_Controls() {
+    return $this->ia_controls;
+  }
+
+  /**
+   * Getter function for IA Controls
+   *
+   * @return string
+   */
+  public function get_IA_Controls_String() {
+    return implode(" ", $this->ia_controls);
+  }
+
+  /**
+   * Setter function for the IA Controls
+   *
+   * @param mixed $ia_controls_in
+   */
+  public function set_IA_Controls($ia_controls_in) {
+    if (is_array($ia_controls_in)) {
+      $this->ia_controls = $ia_controls_in;
+    }
+    elseif (is_string($ia_controls_in)) {
+      $this->ia_controls = explode(" ", $ia_controls_in);
+    }
+  }
+
+  /**
+   * Function to add an IA control the the array
+   *
+   * @param string $ia_control_in
+   */
+  public function add_IA_Control($ia_control_in) {
+    $add = true;
+    foreach ($this->ia_controls as $ia) {
+      if ($ia == $ia_control_in) {
+        $add = false;
+        break;
+      }
+    }
+
+    if ($add) {
+      $this->ia_controls[] = $ia_control_in;
+    }
+  }
+
+}
+
+/**
+ * The finding status
+ *
+ * @author Ryan Prather
+ */
+class finding_status {
+
+  /**
+   * The database ID of the finding status
+   *
+   * @var int
+   */
+  public $id = 0;
+
+  /**
+   * The status of the finding
+   *
+   * @var string
+   */
+  public $status = '';
+
+}
+
+/**
+ * Class to deconflict statuses
+ *
+ * @author Ryan Prather
+ */
+class deconflict_status {
+
+  /**
+   * Stores the matrix of current -> new statuses
+   *
+   * @var array:string
+   */
+  static $DECONFLICTED_STATUS = [
+    'Exception'      => [
+      'Exception'      => 'Exception',
+      'False Positive' => 'False Positive',
+      'Open'           => 'Exception',
+      'Not a Finding'  => 'Exception',
+      'Not Applicable' => 'Exception',
+      'Not Reviewed'   => 'Exception',
+      'No Data'        => 'Exception'
+    ],
+    'False Positive' => [
+      'Exception'      => 'Exception',
+      'False Positive' => 'False Positive',
+      'Open'           => 'False Positive',
+      'Not a Finding'  => 'False Positive',
+      'Not Applicable' => 'False Positive',
+      'Not Reviewed'   => 'False Positive',
+      'No Data'        => 'False Positive'
+    ],
+    'Open'           => [
+      'Exception'      => 'Exception',
+      'False Positive' => 'False Positive',
+      'Open'           => 'Open',
+      'Not a Finding'  => 'Open',
+      'Not Applicable' => 'Open',
+      'Not Reviewed'   => 'Open',
+      'No Data'        => 'Open'
+    ],
+    'Not a Finding'  => [
+      'Exception'      => 'Exception',
+      'False Positive' => 'False Positive',
+      'Open'           => 'Open',
+      'Not a Finding'  => 'Not a Finding',
+      'Not Applicable' => 'Not a Finding',
+      'Not Reviewed'   => 'Not a Finding',
+      'No Data'        => 'Not a Finding'
+    ],
+    'Not Applicable' => [
+      'Exception'      => 'Exception',
+      'False Positive' => 'False Positive',
+      'Open'           => 'Open',
+      'Not a Finding'  => 'Not a Finding',
+      'Not Applicable' => 'Not Applicable',
+      'Not Reviewed'   => 'Not Applicable',
+      'No Data'        => 'Not Reviewed'
+    ],
+    'Not Reviewed'   => [
+      'Exception'      => 'Exception',
+      'False Positive' => 'False Positive',
+      'Open'           => 'Open',
+      'Not a Finding'  => 'Not a Finding',
+      'Not Applicable' => 'Not Applicable',
+      'Not Reviewed'   => 'Not Reviewed',
+      'No Data'        => 'Not Reviewed'
+    ],
+    'No Data'        => [
+      'Exception'      => 'Exception',
+      'False Positive' => 'False Positive',
+      'Open'           => 'Open',
+      'Not a Finding'  => 'Not a Finding',
+      'Not Applicable' => 'Not Applicable',
+      'Not Reviewed'   => 'Not Reviewed',
+      'No Data'        => 'No Data'
+    ]
+  ];
+
+}

classes/golddisk.inc

@@ -0,0 +1,114 @@
+<?php
+/**
+ * File: golddisk.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a Golddisk check
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ */
+
+/**
+ * Represent a Golddisk check
+ *
+ * @author Ryan Prather
+ *
+ */
+class golddisk {
+
+  /**
+   * PDI ID
+   *
+   * @var integer
+   */
+  protected $pdi_id = 0;
+
+  /**
+   * VMS ID
+   *
+   * @var string
+   */
+  protected $vms_id = '';
+
+  /**
+   * Short Title
+   *
+   * @var string
+   */
+  protected $short_title = '';
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_PDI_ID
+   * @param string $str_VMS_ID
+   * @param string $str_Short_Title
+   */
+  public function __construct($int_PDI_ID, $str_VMS_ID, $str_Short_Title) {
+    $this->pdi_id = $int_PDI_ID;
+    $this->vms_id = $str_VMS_ID;
+    $this->short_title = $str_Short_Title;
+  }
+
+  /**
+   * Getter function for PDI ID
+   *
+   * @return integer
+   */
+  public function get_PDI_ID() {
+    return $this->pdi_id;
+  }
+
+  /**
+   * Setter function for PDI ID
+   *
+   * @param integer $int_PDI_ID
+   */
+  public function set_PDI_ID($int_PDI_ID) {
+    $this->pdi_id = $int_PDI_ID;
+  }
+
+  /**
+   * Getter function for VMS ID
+   *
+   * @return string
+   */
+  public function get_ID() {
+    return $this->vms_id;
+  }
+
+  /**
+   * Setter function for VMS ID
+   *
+   * @param string $str_VMS_ID
+   */
+  public function set_ID($str_VMS_ID) {
+    $this->vms_id = $str_VMS_ID;
+  }
+
+  /**
+   * Getter function for short title
+   *
+   * @return string
+   */
+  public function get_Short_Title() {
+    return $this->short_title;
+  }
+
+  /**
+   * Setter function for short title
+   *
+   * @param string $str_Short_Title
+   */
+  public function set_Short_Title($str_Short_Title) {
+    $this->short_title = $str_Short_Title;
+  }
+
+}

classes/host_list.inc

@@ -0,0 +1,195 @@
+<?php
+/**
+ * File: host_list.inc
+ * Author: Ryan Prather
+ * Purpose: Represents an imported scan
+ * Created: Jan 16, 2018
+ *
+ * Copyright 2016-2018: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ * - Jan 16, 2018 - File created
+ * - Feb 6, 2018 - Added getter/setter methods
+ */
+
+/**
+ * Description of host_list
+ *
+ * @author Ryan Prather
+ */
+class host_list
+{
+
+    /**
+     * Target ID
+     *
+     * @var integer
+     */
+    private $_targetId = 0;
+
+    /**
+     * Target name
+     *
+     * @var string
+     */
+    private $_targetName = null;
+
+    /**
+     * Target IP address
+     *
+     * @var string
+     */
+    private $_targetIp = null;
+
+    /**
+     * Number of findings for this target
+     *
+     * @var integer
+     */
+    private $_findingCount = 0;
+
+    /**
+     * Was there an error when scanning the target
+     *
+     * @var boolean
+     */
+    private $_scanError = false;
+
+    /**
+     * Are their any special notes for the target
+     *
+     * @var string
+     */
+    private $_scanNotes = null;
+
+    /**
+     * Constructor
+     */
+    public function __construct()
+    {
+
+    }
+
+    /**
+     * Getter function for _targetId
+     *
+     * @return int
+     */
+    public function getTargetId()
+    {
+        return $this->_targetId;
+    }
+
+    /**
+     * Setter function for _targetId
+     *
+     * @param int $intTargetId
+     */
+    public function setTargetId($intTargetId)
+    {
+        $this->_targetId = $intTargetId;
+    }
+
+    /**
+     * Getter function for _targetName
+     *
+     * @return string
+     */
+    public function getTargetName()
+    {
+        return $this->_targetName;
+    }
+
+    /**
+     * Setter function for _targetName
+     *
+     * @param string $strTargetName
+     */
+    public function setTargetName($strTargetName)
+    {
+        $this->_targetName = $strTargetName;
+    }
+
+    /**
+     * Getter function for _targetIp
+     *
+     * @return string
+     */
+    public function getTargetIp()
+    {
+        return $this->_targetIp;
+    }
+
+    /**
+     * Setter function for _targetIp
+     *
+     * @param string $strTargetIp
+     */
+    public function setTargetIp($strTargetIp)
+    {
+        $this->_targetIp = $strTargetIp;
+    }
+
+    /**
+     * Getter function for _findingCount
+     *
+     * @return int
+     */
+    public function getFindingCount()
+    {
+        return $this->_findingCount;
+    }
+
+    /**
+     * Setter function for _findingCount
+     *
+     * @param int $intFindingCount
+     */
+    public function setFindingCount($intFindingCount)
+    {
+        $this->_findingCount = $intFindingCount;
+    }
+
+    /**
+     * Getter function for _scanError
+     *
+     * @return bool
+     */
+    public function getScanError()
+    {
+        return $this->_scanError;
+    }
+
+    /**
+     * Setter function for _scanError
+     *
+     * @param bool $blnScanError
+     */
+    public function setScanError($blnScanError)
+    {
+        $this->_scanError = $blnScanError;
+    }
+
+    /**
+     * Getter function for _scanNotes
+     *
+     * @return string
+     */
+    public function getScanNotes()
+    {
+        return $this->_scanNotes;
+    }
+
+    /**
+     * Setter function for _scanNotes
+     *
+     * @param string $strScanNotes
+     */
+    public function setScanNotes($strScanNotes)
+    {
+        $this->_scanNotes = $strScanNotes;
+    }
+}

classes/ia_control.inc

@@ -0,0 +1,127 @@
+<?php
+/**
+ * File: ia_control.inc
+ * Author: Ryan Prather
+ * Purpose: Represents an IA Control that can be applied to a PDI
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ */
+
+/**
+ * Represents an IA Control that can be applied to a PDI
+ *
+ * @author Ryan Prather
+ *
+ */
+class ia_control {
+
+  /**
+   * PDI ID
+   *
+   * @var integer
+   */
+  protected $pdi_id = 0;
+
+  /**
+   * Type
+   *
+   * @var string
+   */
+  protected $type = '';
+
+  /**
+   * Type ID
+   *
+   * @var integer
+   */
+  protected $type_id = 0;
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_PDI_ID
+   * @param string $str_Type
+   * @param integer $int_Type_ID
+   */
+  public function __construct($int_PDI_ID, $str_Type, $int_Type_ID) {
+    $this->pdi_id = $int_PDI_ID;
+    $this->type = $str_Type;
+    $this->type_id = $int_Type_ID;
+  }
+
+  /**
+   * Getter function for PDI ID
+   *
+   * @return integer
+   */
+  public function get_PDI_ID() {
+    return $this->pdi_id;
+  }
+
+  /**
+   * Setter function for PDI ID
+   *
+   * @param integer $int_PDI_ID
+   */
+  public function set_PDI_ID($int_PDI_ID) {
+    $this->pdi_id = $int_PDI_ID;
+  }
+
+  /**
+   * Getter function for Type
+   *
+   * @return string
+   */
+  public function get_Type() {
+    return $this->type;
+  }
+
+  /**
+   * Setter function for type
+   *
+   * @param string $str_Type
+   */
+  public function set_Type($str_Type) {
+    $this->type = $str_Type;
+  }
+
+  /**
+   * Getter function for type ID
+   *
+   * @return integer
+   */
+  public function get_Type_ID() {
+    return $this->type_id;
+  }
+
+  /**
+   * Setter function for type ID
+   *
+   * @param integer $int_Type_ID
+   */
+  public function set_Type_ID($int_Type_ID) {
+    $this->type_id = $int_Type_ID;
+  }
+
+  /**
+   * Function to print a IA Control in the proper format
+   *
+   * @return string
+   */
+  public function print_Control() {
+    if($this->type == 'CCI') {
+      return $this->type."-".str_pad($this->type_id, 6, "0", STR_PAD_LEFT);
+    }
+
+    return $this->type."-".$this->type_id;
+  }
+
+}

classes/import.inc

@@ -0,0 +1,839 @@
+<?php
+
+/**
+ * File: import.inc
+ * Author: Ryan Prather
+ * Purpose: Class to allow the parsing and traversing of the tmp directory to find result files to import
+ * Created: Sep 27, 2013
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 27, 2013 - File created
+ *  - Sep 1, 2016 - Updated Copyright, updated purpose, and updated to make platform independent
+ *  - Oct 24, 2016 - Cleaned up script call string and converted to use PHP_OS constant instead of php_uname() function
+ *  - Nov 7, 2016 - Made several updates to the scan_Result_Files function
+ *  - Dec 7, 2016 - Fixed bug in scan_Result_Files where Windows threading was not being run and changed PHP constant to PHP_BIN
+ *  - Jan 30, 2017 - Added parse_config.ini file when parsing and execution check for Linux and Windows
+ *  - Feb 15, 2017 - Fix bug with PHP_BIN not being declared for some reason (need to troubleshoot further)
+ *  - Feb 21, 2017 - Fixed path issues with scripts not running
+ *  - Jun 27, 2017 - Removed include for PHPExcel.php library
+ *  - Oct 23, 2017 - Fixes for pdi class
+ */
+include_once 'config.inc';
+include_once 'database.inc';
+include_once 'echecklist.inc';
+include_once 'helper.inc';
+include_once 'vendor/autoload.php';
+
+/**
+ * Class to control the importing of files
+ *
+ * @author Ryan Prather
+ */
+class import {
+
+  /**
+   * The current include_once path
+   *
+   * @var string
+   */
+  protected $current_path = '';
+
+  /**
+   * String array of regular expressions.
+   * Files matching these expressions will be skipped
+   *
+   * @var string
+   */
+  protected $SKIP = array(
+    '/HBSS/i',
+    '/SharePoint/i',
+    '/ISSE/i',
+    '/_[Mm]ac/i',
+    '/Guard/i',
+    '/SME_PED/i',
+    '/_zOS_/i',
+    '/BlackBerry/i',
+    '/C2\-Fix/i',
+    '/Enclave_Zone/i',
+    '/General_Mobile/i',
+    '/Remote_/i',
+    '/_Tandem/i',
+    '/xenapp/i',
+    '/internet/i',
+    '/android/i',
+    '/JVAP/i',
+    '/apple/i',
+    '/OpenVMS/i',
+    '/VVoIP/i',
+    '/Wireless/i',
+    '/REL-LAN/i',
+    '/dictionary/i',
+    '/IBM_/i',
+    '/Smartphone/i',
+    '/Exchange/i',
+    '/Juniper/i',
+    '/Mobility/i',
+    '/ESXi/i',
+    '/FW_SRG/i',
+    '/PlayBook_OS/i',
+    '/vCenter_Server/i'
+  );
+
+  /**
+   * Class constructor
+   */
+  public function __construct() {
+    set_time_limit(0);
+  }
+
+  /**
+   * Class destructor to reset the include_once path and time limits
+   */
+  public function __destruct() {
+    set_time_limit(30);
+  }
+
+  /**
+   * Function to scan the tmp directory for result files and call the appropriate parsers
+   */
+  public function scan_Result_Files($redirect = true) {
+    chdir(DOC_ROOT . "/exec");
+
+    $ignore = filter_input(INPUT_POST, 'ignore', FILTER_VALIDATE_BOOLEAN) ? "true" : "false";
+    $doc_root = realpath(DOC_ROOT);
+    $ste = filter_input(INPUT_COOKIE, 'ste', FILTER_VALIDATE_INT);
+    if (!$ste) {
+      $ste = filter_input(INPUT_POST, 'ste', FILTER_VALIDATE_INT);
+    }
+    $location = filter_input(INPUT_POST, 'location', FILTER_SANITIZE_STRING);
+
+    $conf = <<<EOF
+[system_params]
+ste = $ste
+location = $location
+doc_root = $doc_root
+ignore = $ignore
+
+EOF;
+
+    file_put_contents(DOC_ROOT . "/exec/parse_config.ini", $conf);
+
+    $script = realpath(defined('PHP_BIN') ? PHP_BIN : PHP) .
+        " -c " . realpath(PHP_CONF) .
+        " -f " . realpath(DOC_ROOT . "/exec/background_results.php");
+
+    if (LOG_LEVEL == E_DEBUG) {
+      Sagacity_Error::err_handler("Script to execute: $script", E_DEBUG);
+    }
+
+    $process = new Cocur\BackgroundProcess\BackgroundProcess("cd " . realpath(DOC_ROOT . "/exec") . " && " . $script);
+    $process->run();
+
+    if ($redirect) {
+      header("/results/");
+    }
+  }
+
+  /**
+   * Function to scan '/xampp/www/tmp' directory for catalog files
+   */
+  public function scan_Catalog_Files() {
+    chdir(DOC_ROOT . "/tmp");
+    $files = glob("*");
+
+    foreach ($files as $file) {
+      if (substr($file, -3) == 'zip') {
+        // $this->import_STIG_ZIP("../tmp/$file");
+      }
+      elseif (preg_match('/pdi\-|\_catalog/i', $file)) {
+        // $this->import_PDI_CSV("../tmp/$file");
+      }
+      elseif (preg_match('/\-xccdf\.xml$/i', $file)) {
+        // $this->import_STIG("../tmp/$file");
+      }
+    }
+  }
+
+  /**
+   * Function to scan host data files and import findings
+   */
+  public function import_Host_Data_Collection() {
+    $db = new db();
+
+    $doc_root = realpath(DOC_ROOT);
+    $overwrite = (isset($_REQUEST['overwrite']) && $_REQUEST['overwrite'] ? "true" : "false");
+
+    $conf = <<<EOF
+[system_params]
+ste = {$_REQUEST['ste']}
+location = "{$_REQUEST['location']}"
+doc_root = $doc_root
+target = {$_REQUEST['tgt']}
+overwrite = $overwrite
+
+EOF;
+
+    file_put_contents(DOC_ROOT . "/exec/parse_config.ini", $conf);
+
+    $script = realpath(defined('PHP_BIN') ? PHP_BIN : PHP) .
+        " -c " . realpath(PHP_CONF) .
+        " -f " . realpath(DOC_ROOT . "/exec/parse_host_data_collection.php");
+
+    if (substr(strtolower(PHP_OS), 0, 3) == 'win') {
+      $shell = new COM("WScript.Shell");
+      $shell->CurrentDirectory = DOC_ROOT;
+      $shell->run($script, 0, false);
+    }
+    elseif (substr(strtolower(PHP_OS), 0, 3) == 'lin') {
+      exec("$script > /dev/null &");
+    }
+    else {
+      Sagacity_Error::err_handler("Unknown OS: " . PHP_OS);
+    }
+
+
+    header("Location: /ste/");
+  }
+
+  /**
+   * function to import PDI CSV file to database
+   */
+  public function import_PDI_CSV() {
+    $db = new db();
+
+    $handle = fopen(DOC_ROOT . "/tmp/All-PDI-Catalog.csv", "r");
+    $data = fgetcsv($handle);
+    $data = fgetcsv($handle);
+
+    while ($data = fgetcsv($handle)) {
+      $catalog = array(
+        'stig_id'        => (isset($data[0]) ? $data[0] : ""),
+        'vms_id'         => (isset($data[1]) ? $data[1] : ""),
+        'cat_lvl'        => (isset($data[2]) ? $data[2] : "II"),
+        'ia_controls'    => (isset($data[3]) ? $data[3] : ""),
+        'short_title'    => (isset($data[4]) ? $data[4] : ""),
+        'description'    => (isset($data[5]) ? $data[5] : ""),
+        'notes'          => (isset($data[6]) ? $data[6] : ""),
+        'retina_id'      => (isset($data[7]) ? $data[7] : ""),
+        'vul_id'         => (isset($data[8]) ? $data[8] : ""),
+        'check_contents' => (isset($data[9]) ? $data[9] : ""),
+        'sv_rule_id'     => (isset($data[10]) ? $data[10] : ""),
+        'nessus_id'      => (isset($data[11]) ? $data[11] : "")
+      );
+
+      if ($catalog['stig_id'] != 'No Reference') {
+        $ref = $db->get_STIG($catalog['stig_id']);
+      }
+
+      if (is_null($ref) && $catalog['vms_id'] != 'No Reference') {
+        $ref = $db->get_GoldDisk($catalog['vms_id']);
+      }
+
+      if (is_array($ref) && count($ref) && isset($ref[0])) {
+        $ref = $ref[0];
+      }
+
+      if (!is_null($ref)) {
+        $pdi = new pdi($ref->get_PDI_ID(), $catalog['cat_lvl'], "NOW");
+        $pdi->set_Short_Title($catalog['short_title']);
+        $pdi->set_Group_Title($catalog['short_title']);
+        $pdi->set_Description($catalog['description']);
+
+        if ($catalog['ia_controls']) {
+          $ia_controls = array();
+          foreach (explode(" ", $catalog['ia_controls']) as $ia) {
+            $ia_controls[] = new ia_control($ref->get_PDI_ID(), substr($ia, 0, -2), substr($ia, -1));
+          }
+
+          if (!$db->save_IA_Control($ia_controls)) {
+            print "error updating ia controls on id: " . $ref->get_ID() . "<br />";
+          }
+        }
+
+        // Check for retina data
+        if ($catalog['retina_id']) {
+          $retina = new retina($ref->get_PDI_ID(), $catalog['retina_id']);
+
+          if (!$db->save_Retina($retina)) {
+            print "error updating retina id: " . $catalog['retina_id'] . "<br />";
+          }
+        }
+
+        // Vul_ID
+        if ($catalog['vul_id']) {
+
+        }
+
+        if ($catalog['sv_rule_id']) {
+          $sv_rule = array();
+          foreach (explode(" ", $catalog['sv_rule_id']) as $rule) {
+            $sv_rule[] = new sv_rule($ref->get_PDI_ID(), $rule);
+          }
+
+          if (!$db->save_SV_Rule($sv_rule)) {
+            print "error updating sv rule on pdi: " . $ref->get_ID() . "<br />";
+          }
+        }
+
+        if ($catalog['nessus_id']) {
+          $nessus = new nessus($ref->get_PDI_ID(), $catalog['nessus_id']);
+
+          if (!$db->save_Nessus($nessus)) {
+            print "error updating nessus id: " . $catalog['nessus_id'] . "<br />";
+          }
+        }
+      }
+      else {
+        $pdi = new pdi(0, $catalog['cat_lvl'], "NOW");
+        $pdi->set_Short_Title($catalog['short_title']);
+        $pdi->set_Group_Title($catalog['short_title']);
+        $pdi->set_Description($catalog['description']);
+
+        $pdi_id = $db->save_PDI($pdi);
+
+        if ($catalog['stig_id'] != 'No Reference') {
+          $stig = new stig($pdi_id, $catalog['stig_id'], $catalog['description']);
+          $ref = $stig;
+          $db->add_Stig($stig);
+        }
+
+        if ($catalog['vms_id'] != 'No Reference') {
+          $golddisk = new golddisk($pdi_id, $catalog['vms_id'], $catalog['short_title']);
+
+          if ($ref == null) {
+            $ref = $golddisk;
+          }
+
+          $db->save_GoldDisk($golddisk);
+        }
+
+        if ($catalog['ia_controls']) {
+          $ia_controls = array();
+          foreach (explode(" ", $catalog['ia_controls']) as $ia) {
+            $ia_controls[] = new ia_control($pdi_id, substr($ia, 0, -2), substr($ia, -1));
+          }
+
+          if (!$db->save_IA_Control($ia_controls)) {
+            print "error updating ia controls on pdi_id: " . $ref->get_ID() . "<br />";
+          }
+        }
+
+        // Check for retina data
+        if ($catalog['retina_id']) {
+          $retina = new retina($pdi_id, $catalog['retina_id']);
+
+          if (!$db->save_Retina($retina)) {
+            print "error updating retina id: " . $catalog['retina_id'] . "<br />";
+          }
+        }
+
+        // Vul_ID
+        if ($catalog['vul_id']) {
+
+        }
+
+        // sv_rule
+        if ($catalog['sv_rule_id']) {
+          $sv_rule = array();
+          foreach (explode(" ", $catalog['sv_rule_id']) as $rule) {
+            $sv_rule[] = new sv_rule($pdi_id, $rule);
+          }
+
+          if (!$db->save_SV_Rule($sv_rule)) {
+            print "error updating sv rule on pdi: " . $ref->get_ID() . "<br />";
+          }
+        }
+
+        if ($catalog['nessus_id']) {
+          $nessus = new nessus($pdi_id, $catalog['nessus_id']);
+
+          if (!$db->save_Nessus($nessus)) {
+            print "error updating nessus id: " . $catalog['nessus_id'] . "<br />";
+          }
+        }
+      }
+    }
+    fclose($handle);
+  }
+
+  /**
+   * function for SRR script
+   * runs script net-SRR.pl
+   * exports a csv format file
+   */
+  public function net_SRR() {
+
+  }
+
+  /**
+   * function for unix SRR conversion to csv
+   * runs script unix-xml-to-echecklist.pl
+   * runs script unix-srr-to-csv.pl
+   */
+  public function unix_srr_to_csv() {
+
+  }
+
+  /**
+   * Function to import DISA STIG content to database
+   *
+   * @param array $request
+   */
+  public function import_STIG_XML($request = array()) {
+    $script = realpath(defined('PHP_BIN') ? PHP_BIN : PHP) . " " .
+        realpath(DOC_ROOT . "/exec/background_stigs.php") . " " .
+        (isset($request['delete']) ? ' --delete' : '') .
+        (isset($request['override']) ? " --ia" : "");
+
+    $shell = new COM("WScript.Shell");
+    $shell->CurrentDirectory = DOC_ROOT . "/exec";
+    $shell->run($script, 0, false);
+
+    header("location: " . $_SERVER['HTTP_REFERER']);
+  }
+
+  /**
+   * Function to convert a retina CSV to an eChecklist and store on database
+   */
+  public function retina_csv_echecklist() {
+    $files = glob('*.csv');
+    $db = new db();
+
+    $source = $db->get_Sources('Retina');
+    $ste = $db->get_STE($_REQUEST['ste'])[0];
+
+    foreach ($files as $file) {
+      $scan = new scan(null, $source, $ste, '1', $file, 'CURRENT_TIMESTAMP');
+      $db->save_Scan($scan);
+
+      exec(PERL . "/perl " . DOC_ROOT . "/exec/retina-csv-to-echecklist.pl " . DOC_ROOT . "/tmp/$file --db", $output, $result);
+    }
+  }
+
+  /**
+   * function to import golddisk info into scans table
+   * runs script golddisk-xml-to-echecklist.pl
+   */
+  public function golddisk_xml_echecklist() {
+    $files = glob('*.xml');
+    $db = new db();
+
+    $source = $db->get_Sources('Golddisk');
+    $ste = $db->get_STE($_REQUEST['ste'])[0];
+
+    foreach ($files as $file) {
+      $scan = new scan(null, $source, $ste, '1', $file, 'CURRENT_TIMESTAMP');
+      $db->save_Scan($scan);
+
+      exec(PERL . "/perl " . DOC_ROOT . "/exec/golddisk-xml-to-echecklist.pl " . DOC_ROOT . "/tmp/$file --db", $output, $result);
+    }
+  }
+
+  /**
+   *
+   */
+  public function import_IAVM_CVE() {
+    $filename = '../tmp/iavm-to-cve(u).xml';
+    $xml = simplexml_load_file($filename);
+    $db = new db();
+
+    foreach ($xml->IAVM as $iavm) {
+      $vms_id = preg_replace('/V[0]+/', 'V-', (string) $iavm->S['VMSKey']);
+      $stig_id = (string) $iavm->S['IAVM'];
+      $title = (string) $iavm->S['Title'];
+      $release_date = DateTime::createFromFormat('d M Y', $iavm->S['ReleaseDate']);
+      $revision_date = DateTime::createFromFormat('d M Y', $iavm->Revision['Date']);
+
+      $cves_tags = $iavm->CVEs;
+      $cves = array();
+
+      $pdi = $db->get_Stig($stig_id);
+      if (is_array($pdi) && count($pdi) && isset($pdi[0]) && is_a($pdi[0], 'stig')) {
+        $pdi = $pdi[0];
+      }
+
+      if (is_null($pdi)) {
+        $pdi = $db->get_GoldDisk($vms_id);
+        if (is_array($pdi) && count($pdi) && isset($pdi[0]) && is_a($pdi[0], 'golddisk')) {
+          $pdi = $pdi[0];
+        }
+      }
+
+      if (is_null($pdi)) {
+        $cat_lvl = substr_count((string) $iavm->S['Severity'], 'I');
+        $pdi = new pdi(null, $cat_lvl, (string) $iavm->S['ReleaseDate']);
+        $pdi->set_Short_Title($title);
+        $pdi->set_Group_Title($title);
+        $pdi->set_Description($title);
+        $pdi_id = $db->save_PDI($pdi);
+
+        $stig = new stig($pdi_id, $stig_id, $title);
+        $db->add_Stig($stig);
+
+        $golddisk = new golddisk($pdi_id, $vms_id, $title);
+        $db->save_GoldDisk($golddisk);
+      }
+      else {
+        $pdi_id = $pdi->get_PDI_ID();
+      }
+
+      foreach ($cves_tags->CVENumber as $cve) {
+        $cve_id = (string) $cve;
+
+        $cves[] = new cve(null, $cve_id, $release_date, $title);
+      }
+
+      $db->add_CVE($cves);
+
+      $ref_tags = $iavm->References;
+      $refs = array();
+
+      foreach ($ref_tags->Reference as $ref) {
+        $ref_type = '';
+        $adv_id = '';
+        $url = (string) $ref['URL'];
+        $name = (string) $ref['RefName'];
+        $match = array();
+
+        $refs[] = new advisory($pdi_id, $adv_id, $name, $ref_type, $url);
+      }
+    }
+
+    $ref = $row[8];
+    $url = $row[9];
+
+    if (strpos($ref, 'Microsoft') !== false) {
+      $x++;
+      $type = 'Microsoft';
+      $ret = preg_match('/(MS\d{2}\-\d{3}|KB\d{6,7}|\d{6,7})/', $ref, $match);
+
+      if (count($match)) {
+        $id = $match[1];
+      }
+    }
+    elseif (strpos($ref, 'Adobe') !== false) {
+      $x++;
+      $type = 'Adobe';
+      $ret = preg_match('/(APSA\d{2}\-\d{2}|APSB\d{2}\-\d{2})/', $ref, $match);
+
+      if (count($match)) {
+        $id = $match[1];
+      }
+    }
+    elseif (strpos($ref, 'Apache') !== false) {
+      $x++;
+      $type = 'Apache';
+      $ret = preg_match('/(CVE\-\d{4}\-\d{4}|S\d\-\d{3})/', $ref, $match);
+
+      if (count($match)) {
+        $id = $match[1];
+      }
+    }
+    elseif (strpos($ref, 'CERT') !== false) {
+      $x++;
+      $type = 'US-CERT';
+      $match = array();
+
+      if (strpos($url, 'techalerts') !== false) {
+        $ret = preg_match('/(TA\d{2}\-\d{3}\s).html/', $url, $match);
+      }
+      elseif (strpos($url, 'vuls') !== false) {
+        $ret = preg_match('/([^\/]+)$/', $url, $match);
+      }
+
+      if (count($match)) {
+        $id = $match[1];
+      }
+    }
+    elseif (strpos($ref, 'Cisco') !== false) {
+      $x++;
+      $type = 'Cisco';
+      $ret = preg_match('/([^\/]+)(\.s?html)$/', $url, $match);
+
+      if (count($match) > 0) {
+        $id = $match[1];
+      }
+      else {
+        $ret = preg_match('/([^\/]+)$/', $url, $match);
+        if (count($match)) {
+          $id = $match[1];
+        }
+      }
+    }
+    elseif (strpos($ref, 'Citrix') !== false) {
+      $x++;
+      $type = 'Citrix';
+      $ret = preg_match('/([^\/]+)$/', $url, $match);
+
+      if (count($match)) {
+        $id = $match[1];
+      }
+    }
+    elseif (strpos($ref, 'Debian') !== false) {
+      $x++;
+      $type = 'Debian';
+      $ret = preg_match('/([^\/]+)$/', $url, $match);
+
+      if (count($match)) {
+        $id = $match[1];
+      }
+    }
+    elseif (strpos($ref, 'HP') !== false) {
+      $x++;
+      $type = 'HP';
+      $ret = preg_match('/(HPSB\S+\ SSRT\S+)[\ ?\)?]/', $ref, $match);
+
+      if (count($match)) {
+        $id = $match[1];
+      }
+      else {
+        $ret = preg_match('/(HPSB\S+)[\ ?\)?]/', $ref, $match);
+        if (count($match)) {
+          $id = $match[1];
+        }
+      }
+    }
+    elseif (strpos($ref, 'IBM') !== false) {
+      $x++;
+      $type = 'IBM';
+      $ret = preg_match('/(\d{5,8})/', $ref, $match);
+
+      if (count($match)) {
+        $id = $match[1];
+      }
+      else {
+        $ret = preg_match('/([^\=|\/]+)$/', $url, $match);
+        if (count($match)) {
+          $id = $match[1];
+        }
+      }
+    }
+    elseif (strpos($ref, 'Juniper') !== false) {
+      $x++;
+      $type = 'Juniper';
+      $ret = preg_match('/(PSN\-\d{4}\-\d{2}\-\d{3}|JSA\d{5})/', $url, $match);
+
+      if (count($match)) {
+        $id = $match[1];
+      }
+    }
+    elseif (strpos($ref, 'Oracle') !== false) {
+      $x++;
+      $type = 'Oracle';
+      $url = basename($url);
+      $ret = preg_match('/([\S]+)\.html/', $url, $match);
+
+      if (count($match)) {
+        $id = $match[1];
+      }
+    }
+    elseif (strpos($ref, 'McAfee') !== false) {
+      $x++;
+      $type = 'McAfee';
+      $query = parse_query($url);
+
+      if (count($match)) {
+        $id = isset($query['id']) ? $query['id'] : '';
+      }
+    }
+    elseif (strpos($ref, 'Red Hat') !== false) {
+      $x++;
+      $type = 'Red Hat';
+      $ret = preg_match('/([^\/]+)\.html/', $url, $match);
+
+      if (count($match)) {
+        $id = $match[1];
+      }
+    }
+    elseif (strpos($ref, 'Secunia') !== false) {
+      $x++;
+      $type = 'Secunia';
+      $ret = preg_match('/([^\/]+)\/([^\/]+)\/?$/', $url, $match);
+
+      if (count($match)) {
+        if ($match[2] == 'advisory') {
+          $id = $match[1];
+        }
+        elseif (is_numeric($match[1]) && count($match[2]) == 1) {
+          $id = $match[1];
+        }
+        else {
+          $id = $match[2];
+        }
+      }
+    }
+    elseif (strpos($url, 'securitytracker') !== false) {
+      $x++;
+      $type = 'Security Tracker';
+      $ret = preg_match('/([^\/]+)\.html$/', $url, $match);
+
+      if (count($match)) {
+        $id = $match[1];
+      }
+    }
+    elseif (strpos($ref, 'SecurityFocus') !== false) {
+      $x++;
+      $type = 'SecurityFocus';
+      $ret = preg_match('/([^\/]+)\/?$/', $url, $match);
+
+      if (count($match)) {
+        if ($match[1] != 'info') {
+          $id = $match[1];
+        }
+        else {
+          $ret = preg_match('/([^\/]+)\/info/', $url, $match);
+          $id = $match[1];
+        }
+      }
+    }
+    elseif (strpos($ref, 'Sun') !== false) {
+      $x++;
+      $type = 'Sun';
+      $query = parse_query($url);
+
+      $id = isset($query['assetkey']) ? $query['assetkey'] : '';
+
+      if (!$id) {
+        $ret = preg_match('/([^\/]+)$/', parse_url($url, PHP_URL_PATH), $match);
+        $id = $match[1];
+      }
+    }
+    elseif (strpos($ref, 'Symantec') !== false) {
+      $x++;
+      $type = 'Symantec';
+      $ret = preg_match('/(\d{5}|SYM\d{2}\-\d{3})/', $ref, $match);
+
+      if (count($match)) {
+        $id = $match[1];
+      }
+    }
+    elseif (strpos($url, 'ZDI') !== false) {
+      $x++;
+      $type = 'ZDI';
+      $ret = preg_match('/([^\/]+)(\.html|\/)$/', $url, $match);
+
+      if (count($match)) {
+        $id = $match[1];
+      }
+    }
+    elseif (strpos($ref, 'Wireshark') !== false) {
+      $x++;
+      $type = 'Wireshark';
+      $ret = preg_match('/([^\/]+)\.html$/', $url, $match);
+
+      if (count($match)) {
+        $id = $match[1];
+      }
+    }
+  }
+
+  /**
+   *
+   * @param string $in
+   * @return multitype:Ambigous <>
+   */
+  public function parse_query($in) {
+    /**
+     * Use this function to parse out the query array element from
+     * the output of parse_url().
+     */
+    $query_string = substr($in, strpos($in, '?') + 1);
+    $query_arr = explode('&', $query_string);
+    $arr = array();
+
+    foreach ($query_arr as $val) {
+      $x = explode('=', $val);
+      $arr[$x[0]] = isset($x[1]) ? $x[1] : '';
+    }
+    unset($val, $x, $var);
+    return $arr;
+  }
+
+  /**
+   * Function for fixing a DISA OVAL file
+   */
+  public function fix_Oval() {
+    chdir("../tmp");
+    $files = glob("*-oval.xml");
+    $ret = '';
+    $db = new db();
+
+    foreach ($files as $file) {
+      $xml = new DOMDocument();
+      if (!$xml->load($file)) {
+        error_log("error reading xml file");
+      }
+      $xml->formatOutput = true;
+      $xml->preserveWhiteSpace = true;
+      $const_arr = null;
+
+      $variables = $xml->getElementsByTagName("variables")
+          ->item(0);
+      $first_node = $variables->firstChild;
+      while ($node = $xml->getElementsByTagName("external_variable")
+      ->item(0)) {
+        $id = $node->getAttribute("id");
+        $id = explode(':', $id)[3];
+
+        $comment = $node->getAttribute("comment");
+        $ver = $node->getAttribute("version");
+        $datatype = $node->getAttribute("datatype");
+
+        $tmp = $db->get_Oval_Const($id);
+        $const_arr[$tmp['const_id']]['values'] = $tmp['values'];
+        $const_arr[$tmp['const_id']]['ver'] = $ver;
+        $const_arr[$tmp['const_id']]['datatype'] = $datatype;
+        $const_arr[$tmp['const_id']]['comment'] = $comment;
+
+        $var_com = $xml->createElement('variable_component');
+        $var_com->setAttribute('var_ref', "oval:smc.gpea.windows:var:" . $tmp['const_id']);
+
+        $loc_var = $xml->createElement('local_variable');
+        $loc_var->setAttribute('id', "oval:mil.disa.fso.windows:var:" . $id);
+        $loc_var->setAttribute('version', $ver);
+        $loc_var->setAttribute('datatype', $datatype);
+        $loc_var->setAttribute('comment', $comment);
+        $loc_var->appendChild($var_com);
+
+        $variables->replaceChild($loc_var, $node);
+      }
+
+      foreach ($const_arr as $key => $value) {
+        $const_var = $xml->createElement('constant_variable');
+        $const_var->setAttribute('id', 'oval:smc.gpea.windows:var:' . $key);
+        $const_var->setAttribute('version', $const_arr[$key]['ver']);
+        $const_var->setAttribute('datatype', $const_arr[$key]['datatype']);
+        $const_var->setAttribute('comment', $const_arr[$key]['comment']);
+
+        foreach ($value['values'] as $val) {
+          $txt = $xml->createTextNode($val);
+          $val_var = $xml->createElement("value");
+          $val_var->appendChild($txt);
+
+          $const_var->appendChild($val_var);
+        }
+
+        $variables->appendChild($const_var);
+      }
+
+      rename($file, "oval\\$file");
+      return $xml->saveXML();
+    }
+  }
+
+  private function getElementById($doc, $id) {
+    $xpath = new DOMXPath($doc);
+    return $xpath->query("//*[@id='$id']")
+            ->item(0);
+  }
+
+}

classes/interfaces.inc

@@ -0,0 +1,522 @@
+<?php
+
+/**
+ * File: interfaces.inc
+ * Author: Ryan Prather
+ * Purpose: Represents an interface that is assigned to a target
+ * Created: Sep 16, 2013
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 16, 2013 - File created
+ *  - Sep 1, 2016 - Updated Copyright and converted to use generic port class
+ *  - Oct 24, 2016 - Fixed bug with direct call to tcp_port and udp_port private variables (#6)
+ *  - Jul 31, 2017 - Fixed bug #280 with updating tcp and udp port notes and banner.
+ *  - Aug 14, 2017 - Fixed bug for absent tcp and udp ports when updating. (#284)
+ *  - Oct 23, 2017 - Added MAC
+ */
+
+/**
+ * Class to represent a hardware interface
+ *
+ * @author Ryan Prather
+ */
+class interfaces {
+
+  /**
+   * Integer used in the database for interfaces ID
+   *
+   * @var integer
+   */
+  protected $id = 0;
+
+  /**
+   * Integer used in database for Target ID
+   *
+   * @var integer
+   */
+  protected $tgt_id = 0;
+
+  /**
+   * String to store the name of the interface
+   *
+   * @var string
+   */
+  protected $name = '';
+
+  /**
+   * String to store the interface Media Access Control (MAC) address
+   * @var string
+   */
+  protected $mac = '';
+
+  /**
+   * String to store the ipv4 of the interface
+   *
+   * @var string
+   */
+  protected $ipv4 = '';
+
+  /**
+   * String to store the ipv6 of the interface
+   *
+   * @var string
+   */
+  protected $ipv6 = '';
+
+  /**
+   * String to store the hostname of the interface
+   *
+   * @var string
+   */
+  protected $hostname = '';
+
+  /**
+   * Array of TCP ports open on this interface
+   *
+   * @var array:tcp_ports
+   */
+  protected $tcp_ports = array();
+
+  /**
+   * Array of UDP ports open on this interface
+   *
+   * @var array:udp_ports
+   */
+  protected $udp_ports = array();
+
+  /**
+   * String to store the fully qualified domain name (fqdn) of the interface
+   *
+   * @var string
+   */
+  protected $fqdn = '';
+
+  /**
+   * String to store the description of the interface
+   *
+   * @var string
+   */
+  protected $description = '';
+
+  /**
+   * Interface notes
+   *
+   * @var string
+   */
+  protected $notes = '';
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_ID
+   * @param integer $int_TGT_ID
+   * @param string $str_Name
+   * @param string $str_Ipv4
+   * @param string $str_Ipv6
+   * @param string $str_Hostname
+   * @param string $str_FQDN
+   * @param string $str_Description
+   */
+  public function __construct($int_ID, $int_TGT_ID, $str_Name, $str_Ipv4, $str_Ipv6, $str_Hostname, $str_FQDN, $str_Description) {
+    $this->id = $int_ID;
+    $this->tgt_id = $int_TGT_ID;
+    $this->name = $str_Name;
+    $this->ipv4 = $str_Ipv4;
+    $this->ipv6 = $str_Ipv6;
+    $this->hostname = $str_Hostname;
+    $this->fqdn = $str_FQDN;
+    $this->description = $str_Description;
+  }
+
+  /**
+   * Getter function for interface ID
+   *
+   * @return integer
+   */
+  public function get_ID() {
+    return $this->id;
+  }
+
+  /**
+   * Setter function for interface ID
+   *
+   * @param interface $int_id_in
+   */
+  public function set_ID($int_id_in) {
+    $this->id = $int_id_in;
+  }
+
+  /**
+   * Getter function for target ID
+   *
+   * @return integer
+   */
+  public function get_TGT_ID() {
+    return $this->tgt_id;
+  }
+
+  /**
+   * Setter function for the target id
+   *
+   * @param integer $int_tgt_id_in
+   */
+  public function set_TGT_ID($int_tgt_id_in) {
+    $this->tgt_id = $int_tgt_id_in;
+  }
+
+  /**
+   * Getter function for interface name
+   *
+   * @return string
+   */
+  public function get_Name() {
+    return $this->name;
+  }
+
+  /**
+   * Setter function for interface name
+   *
+   * @param string $str_Name
+   */
+  public function set_Name($str_Name) {
+    $this->name = $str_Name;
+  }
+
+  /**
+   * Getter function for the interface MAC
+   *
+   * @return string
+   */
+  public function get_MAC() {
+    return $this->mac;
+  }
+
+  /**
+   * Setter function for the interface MAC
+   *
+   * @param string $mac
+   */
+  public function set_MAC($mac) {
+    $this->mac = $mac;
+  }
+
+  /**
+   * Getter function for interface IPv4 address
+   *
+   * @return string
+   */
+  public function get_IPv4() {
+    return $this->ipv4;
+  }
+
+  /**
+   * Setter function for interface IPv4 address
+   *
+   * @param string $str_Ipv4
+   */
+  public function set_IPv4($str_Ipv4) {
+    $this->ipv4 = $str_Ipv4;
+  }
+
+  /**
+   * Getter function for interface IPv6 address
+   *
+   * @return string
+   */
+  public function get_IPv6() {
+    return $this->ipv6;
+  }
+
+  /**
+   * Setter function for interface IPv6 address
+   *
+   * @param string $str_Ipv6
+   */
+  public function set_IPv6($str_Ipv6) {
+    $this->ipv6 = $str_Ipv6;
+  }
+
+  /**
+   * Getter function for hostname
+   *
+   * @return string
+   */
+  public function get_Hostname() {
+    return $this->hostname;
+  }
+
+  /**
+   * Setter function for hostname
+   *
+   * @param string $str_Hostname
+   */
+  public function set_Hostname($str_Hostname) {
+    $this->hostname = $str_Hostname;
+  }
+
+  /**
+   * Getter function for TCP ports
+   *
+   * @return array:tcp_ports
+   */
+  public function get_TCP_Ports() {
+    return $this->tcp_ports;
+  }
+
+  /**
+   * Return a TCP Port object of a specific port
+   *
+   * @param integer $port_number
+   *
+   * @return NULL|tcp_ports
+   */
+  public function get_TCP_Port_By_Port_Number($port_number) {
+    return isset($this->tcp_ports[$port_number]) ? $this->tcp_ports[$port_number] : null;
+  }
+
+  /**
+   * Function to check and see if a TCP port is open
+   *
+   * @param int $port_number
+   *
+   * @return boolean
+   */
+  public function is_TCP_Port_Open($port_number) {
+    return isset($this->tcp_ports[$port_number]);
+  }
+
+  /**
+   * Update a specific tcp port
+   *
+   * @param tcp_ports $tcp_port
+   */
+  public function update_TCP_Port($tcp_port) {
+    if (isset($this->tcp_ports[$tcp_port->get_Port()])) {
+      // Get pointer to current port by reference so updates persist upon return
+      $cur_port = &$this->tcp_ports[$tcp_port->get_Port()];
+      // Get current and new port banner and notes to determine if we need to update.
+      $cur_banner = $cur_port->get_Banner();
+      $cur_notes = $cur_port->get_Notes();
+
+      $new_banner = $tcp_port->get_Banner();
+      $new_notes = $tcp_port->get_Notes();
+
+      // Only update banner if new banner is not already in current banner
+      if (!empty($new_banner) && strpos($cur_banner, $new_banner) === false) {
+        $cur_port->set_Banner($tcp_port->get_Banner());
+      }
+      // Only update notes if new notes is not already in current notes
+      if (!empty($new_notes) && strpos($cur_notes, $new_notes) === false) {
+        $cur_port->append_Notes($tcp_port->get_Notes());
+      }
+    }
+    else {
+      $this->tcp_ports[$tcp_port->get_Port()] = $tcp_port;
+    }
+  }
+
+  /**
+   * Setter function for TCP ports
+   *
+   * @param tcp_ports $tcp_Ports
+   */
+  public function add_TCP_Ports($tcp_Ports) {
+    if (!isset($this->tcp_ports[$tcp_Ports->get_Port()])) {
+      $this->tcp_ports[$tcp_Ports->get_Port()] = $tcp_Ports;
+    }
+    else {
+      if (empty($this->tcp_ports[$tcp_Ports->get_Port()]->get_Banner())) {
+        $this->tcp_ports[$tcp_Ports->get_Port()]->set_Banner($tcp_Ports->get_Banner());
+      }
+      else {
+        $this->tcp_ports[$tcp_Ports->get_Port()]->set_Banner($this->tcp_ports[$tcp_Ports->get_Port()]->get_Banner() . PHP_EOL . $tcp_Ports->get_Banner());
+      }
+    }
+  }
+
+  /**
+   * Setter function for TCP ports based on array
+   *
+   * @param integer $port_number
+   */
+  public function remove_TCP_Ports_Array($port_number) {
+    unset($this->tcp_ports[$port_number]);
+  }
+
+  /**
+   * Getter function for UDP ports
+   *
+   * @return array:udp_ports
+   */
+  public function get_UDP_Ports() {
+    return $this->udp_ports;
+  }
+
+  /**
+   * Return a UDP Port object of a specific port
+   *
+   * @param integer $port_number
+   *
+   * @return NULL|udp_ports
+   */
+  public function get_UDP_Port_By_Port_Number($port_number) {
+    return isset($this->udp_port[$port_number]) ? $this->udp_ports[$port_number] : null;
+  }
+
+  /**
+   * Function to check and see if a UDP port is open
+   *
+   * @param int $port_number
+   *
+   * @return boolean
+   */
+  public function is_UDP_Port_Open($port_number) {
+    return isset($this->udp_ports[$port_number]);
+  }
+
+  /**
+   * Update a specific udp port
+   *
+   * @param udp_ports $udp_port
+   */
+  public function update_UDP_Port($udp_port) {
+    if (isset($this->udp_ports[$udp_port->get_Port()])) {
+      // Get pointer to current port by reference so updates persist upon return
+      $cur_port = &$this->udp_ports[$udp_port->get_Port()];
+      // Get current and new port banner and notes to determine if we need to update.
+      $cur_banner = $cur_port->get_Banner();
+      $cur_notes = $cur_port->get_Notes();
+
+      $new_banner = $udp_port->get_Banner();
+      $new_notes = $udp_port->get_Notes();
+
+      // Only update banner if new banner is not already in current banner
+      if (!empty($new_banner) && strpos($cur_banner, $new_banner) === false) {
+        $cur_port->set_Banner($udp_port->get_Banner());
+      }
+      // Only update notes if new notes is not already in current notes
+      if (!empty($new_notes) && strpos($cur_notes, $new_notes) === false) {
+        $cur_port->append_Notes($udp_port->get_Notes());
+      }
+    }
+    else {
+      $this->udp_ports[$udp_port->get_Port()] = $udp_port;
+    }
+  }
+
+  /**
+   * Setter function for UDP ports
+   *
+   * @param udp_ports $udp_Ports
+   */
+  public function add_UDP_Ports($udp_Ports) {
+    if (!isset($this->udp_ports[$udp_Ports->get_Port()])) {
+      $this->udp_ports[$udp_Ports->get_Port()] = $udp_Ports;
+    }
+    else {
+      if (!$this->udp_ports[$udp_Ports->get_Port()]->get_Banner()) {
+        $this->udp_ports[$udp_Ports->get_Port()]->set_Banner($udp_Ports->get_Banner());
+      }
+      else {
+        $this->udp_ports[$udp_Ports->get_Port()]->set_Banner($this->udp_ports[$udp_Ports->get_Port()]->get_Banner() . PHP_EOL . $udp_Ports->get_Banner());
+      }
+    }
+  }
+
+  /**
+   * Function to remove port from array
+   *
+   * @param integer $port_number
+   */
+  public function remove_UDP_Ports_Array($port_number) {
+    unset($this->udp_ports[$port_number]);
+  }
+
+  /**
+   * Getter function for FQDN
+   *
+   * @return string
+   */
+  public function get_FQDN() {
+    return $this->fqdn;
+  }
+
+  /**
+   * Setter function for FQDN
+   *
+   * @param string $str_FQDN
+   */
+  public function set_FQDN($str_FQDN) {
+    $this->fqdn = $str_FQDN;
+  }
+
+  /**
+   * Getter function for Description
+   *
+   * @return string
+   */
+  public function get_Description() {
+    return $this->description;
+  }
+
+  /**
+   * Setter function for Description
+   *
+   * @param string $str_Description
+   */
+  public function set_Description($str_Description) {
+    $this->description = $str_Description;
+  }
+
+  /**
+   * Getter function for interface notes
+   *
+   * @return string
+   */
+  public function get_Notes() {
+    return $this->notes;
+  }
+
+  /**
+   * Setter function for interface notes
+   *
+   * @param string $notes_in
+   */
+  public function set_Notes($notes_in) {
+    $this->notes = $notes_in;
+  }
+
+  /**
+   * Getter function for preformated table row
+   *
+   * @return string
+   */
+  public function get_Table_Data($Odd_Row) {
+    $ret = "<tr";
+
+    if ($Odd_Row) {
+      $ret .= " class='DynamicContent odd_row'";
+    }
+    else {
+      $ret .= " class='DynamicContent even_row'";
+    }
+
+    $ret .= "><td><input type='text' style='width:100px;' name='ip[$this->id]' value='$this->ipv4' title='Type DELETE to remove the interface' /></td>";
+    $ret .= "<td><input type='text' style='width:215px;' name='hostname[$this->id]' value='$this->hostname'/></td>";
+    $ret .= "<td><input type='text' style='width:215px;' name='name[$this->id]' value='$this->name'/></td>";
+    $ret .= "<td><input type='text' style='width:215px;' name='fqdn[$this->id]' value='$this->fqdn'/></td>";
+    $ret .= "<td><textarea style='width:390px;vertical-align:bottom;' rows='2' name='description[$this->id]'>$this->description</textarea></td></tr>";
+
+    return $ret;
+  }
+
+}

classes/nasl.inc

@@ -0,0 +1,255 @@
+<?php
+
+/**
+ * File: nasl.inc
+ * Author: Ryan Prather
+ * Purpose: Class to store data from
+ * Created: Jan 15, 2017
+ *
+ * Copyright 2017: Cyber Perspectives, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Jan 15, 2017 - File created
+ *  - Jan 31, 2017 - Completed parse testing
+ *  - Feb 15, 2017 - Fix bug if last modification or creation date are not formatted correctly
+ *  - Feb 21, 2017 - Changed throwing exception to just print error and return
+ *  - Apr 5, 2017 - Removed deleting NASL file from within class...now happens in wrapper code
+ *  - Jun 27, 2017 - Matt Shuter: Added fix for deprecated plugins (#262 & #270)
+ */
+
+/**
+ * Class to parse NVT .nasl files from OpenVAS and Nessus
+ */
+class nasl {
+
+  /**
+   * Constructor
+   *
+   * @param string $file
+   */
+  public function __construct($file = null) {
+    if (!is_null($file) && file_exists($file)) {
+      $this->parse($file);
+    }
+  }
+
+  /**
+   * Parsing function
+   *
+   * @param string $file
+   *
+   * @return boolean
+   */
+  public function parse($file) {
+    $file_contents = null;
+    if (file_exists($file)) {
+      $file_contents = file_get_contents($file);
+    }
+    else {
+      print "\tCould not find file {$file}" . PHP_EOL;
+      return false;
+    }
+
+    // Capture regex matches for parsing
+    $match = array();
+
+    // Check to see if the plugin is disabled/deprecated and if so, return
+    if (preg_match("/Disabled on ([\d\/]+)|@DEPRECATED@/i", $file_contents)) {
+      print "\tPlugin file $file is DISABLED" . PHP_EOL;
+      return false;
+    }
+
+    if (preg_match("/script_id\(([\d\.]+)\)/", $file_contents, $match)) {
+      $this->{'id'} = $match[1];
+    }
+    elseif (preg_match("/script_oid\(\"([\d\.]+)\"\)/", $file_contents, $match)) {
+      $this->{'oid'} = $match[1];
+      $oid = explode(".", $match[1]);
+      $this->{'id'} = end($oid);
+    }
+    elseif (preg_match("/script_o?id\(([^\)]+)\)/", $file_contents, $match)) {
+      preg_match("/" . preg_quote($match[1], "/") . "[^\"]+\"([^\"]+)\"/", $file_contents, $match);
+
+      $this->{'oid'} = $match[1];
+      $oid = explode(".", $match[1]);
+      $this->{'id'} = end($oid);
+    }
+    else {
+      print "\tCould not find an ID in $file" . PHP_EOL;
+      return false;
+    }
+
+    if (preg_match("/script_version\(\"[^\d]+([\d\.]+)[^\n]+/", $file_contents, $match)) {
+      $this->{'rev'} = $match[1];
+    }
+
+    if (preg_match("/script_cvs_date\([^\d]+([\d\-\/]+)/", $file_contents, $match)) {
+      try {
+        $this->{'last_modification'} = new DateTime($match[1]);
+      }
+      catch (Exception $e) {
+        die(print_r($e, true));
+      }
+    }
+
+    if (preg_match("/script_set_attribute\([^\"]+\"plugin_publication_date\"[^\"]+\"([\d\/]+)\"/", $file_contents, $match)) {
+      try {
+        $this->{'creation_date'} = new DateTime($match[1]);
+      }
+      catch (Exception $e) {
+        die(print_r($e, true));
+      }
+    }
+
+    if (preg_match("/script_set_cvss_base_vector\(\"([^\"]+)\"/", $file_contents, $match)) {
+      $this->{'cvss_base_vector'} = $match[1];
+    }
+
+    if (preg_match("/script_name\(([^\"]+)?\"([^\"]+)\"\)/", $file_contents, $match)) {
+      $this->{'name'} = $match[2];
+    }
+
+    if (preg_match("/script_category\(([^\)]+)\)/", $file_contents, $match)) {
+      $this->{'cat'} = $match[1];
+    }
+
+    if (preg_match("/script_copyright\(([^\"]+)?\"([^\"]+)\"\)/", $file_contents, $match)) {
+      $this->{'copyright'} = $match[2];
+    }
+
+    if (preg_match("/script_family\(([^\"]+)?\"([^\"]+)\"\)/", $file_contents, $match)) {
+      $this->{'family'} = $match[2];
+    }
+
+    if (preg_match("/script_summary\(([^\"]+)?\"([^\"]+)\"\)/", $file_contents, $match)) {
+      $this->{'summary'} = $match[2];
+    }
+
+    if (preg_match("/script_require_ports\(([^\d]+)?([\d]+)\)/", $file_contents, $match)) {
+      $this->{'protocol'} = explode(',', str_replace(array('"', ' '), '', $match[2]));
+      if (count($this->protocol) == 1) {
+        $this->protocol = $this->protocol[0];
+      }
+    }
+
+    if (preg_match("/CPE ?\= ?\"([^\"]+)\"/", $file_contents, $match)) {
+      $this->{'cpe'} = $match[1];
+    }
+
+    if (preg_match("/script_set_attribute/", $file_contents)) {
+      if (preg_match_all("/script_set_attribute\(([^a]+)?attribute:\"([^\"]+)\",([^v]+)?value:([^\"]+)?\"([^\"]+)\"/", $file_contents, $match)) {
+        foreach ($match[2] as $key => $val) {
+          if ($val == 'cpe') {
+            $this->{$val}[] = str_replace("p-cpe", "cpe", $match[5][$key]);
+          }
+          else {
+            $this->{$val} = $match[5][$key];
+          }
+        }
+      }
+    }
+
+    if (preg_match("/script_cve_id\(([^\)]+)\)/", $file_contents, $match)) {
+      if (($pos = strpos($match[1], ",")) !== false) {
+        $this->{'ref'}['cve'] = explode(',', str_replace(array(' ', '"'), "", $match[1]));
+      }
+      else {
+        $this->{'ref'}['cve'] = array(0 => str_replace(array(" ", '"'), "", $match[1]));
+      }
+    }
+
+    if (preg_match("/script_bugtraq_id\(([\d]+)/", $file_contents, $match)) {
+      if (($pos = strpos($match[1], ",")) !== false) {
+        $this->{'ref'}['bug'] = explode(",", str_replace(array(' ', '"'), "", $match[1]));
+      }
+      else {
+        $this->{'ref'}['bug'] = array(0 => $match[1]);
+      }
+    }
+
+    if (preg_match("/script_cwe_id\(([^\)]+)\)/", $file_contents, $match)) {
+      if (($pos = strpos($match[1], ",")) !== false) {
+        $this->{'ref'}['cwe'] = explode(",", str_replace(array(' '), '', $match[1]));
+      }
+      else {
+        $this->{'ref'}['cwe'] = array(0 => $match[1]);
+      }
+    }
+
+    if (preg_match("/script_osvdb_id\(([\d\, ]+)\)/", $file_contents, $match)) {
+      if (($pos = strpos($match[1], ",")) !== false) {
+        $this->{'ref'}['osvdb'] = explode(",", str_replace(" ", "", $match[1]));
+      }
+      else {
+        $this->{'ref'}['osvdb'] = array(0 => $match[1]);
+      }
+    }
+
+    $script_xrefs = preg_grep("/script_xref/", explode("\n", $file_contents));
+
+    if (count($script_xrefs)) {
+      foreach ($script_xrefs as $y) {
+        if (preg_match("/([^\"]+)\"\)\;$/", $y, $match)) {
+          if (substr($match[1], 0, 4) == 'http') {
+            $this->{'ref'}["URL"][] = $match[1];
+          }
+          else {
+            $val = $match[1];
+            if (preg_match("/script_xref\([^\"]+\"([^\"]+)\"/", $y, $match)) {
+              $this->{'ref'}[$match[1]][] = $val;
+            }
+          }
+        }
+      }
+    }
+
+    if (preg_match_all("/script_tag\(([^\"]+)?\"([^\"]+)\"[^v]+value *: *([^\)\(]+)/", $file_contents, $match)) {
+      $match2 = array();
+      foreach ($match[2] as $key => $val) {
+        if (strpos($match[3][$key], '"') !== false) {
+          $this->{$val} = str_replace('"', '', $match[3][$key]);
+        }
+        elseif (preg_match("/" . preg_quote($match[3][$key], "/") . " [^\"]+\"([^\"]+)\"/", $file_contents, $match2)) {
+          $this->{$val} = $match2[1];
+        }
+      }
+    }
+
+    if (preg_match_all("/script_tag\(([^\"]+)?\"([^\"]+)\"[^\"]+\"([^\"]+)/", $file_contents, $match)) {
+      $dt = array();
+      foreach ($match[2] as $key => $val) {
+        if ($val == 'creation_date') {
+          if (preg_match("/^([\d\/\-\+\ \:]+)/", $match[3][$key], $dt)) {
+            try {
+              $this->{$val} = new DateTime($dt[1]);
+            }
+            catch (Exception $e) {
+              if (preg_match("/\+05340/", $dt[1], $match)) {
+                $this->{$val} = new DateTime(substr($dt[1], 0, -7) . "+0530");
+              }
+            }
+          }
+        }
+        elseif ($val == 'last_modification') {
+          if (preg_match("/: ([\d\-\/\ \+\:]+)/", $match[3][$key], $dt)) {
+            try {
+              $this->{$val} = new DateTime($dt[1]);
+            }
+            catch (Exception $e) {
+              die(print_r($e, true));
+            }
+          }
+        }
+        elseif (!isset($this->{$val})) {
+          $this->{$val} = $match[3][$key];
+        }
+      }
+    }
+
+    return true;
+  }
+
+}

classes/nessus.inc

@@ -0,0 +1,466 @@
+<?php
+
+/**
+ * File: nessus.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a Nessus scan
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ *  - Mar 22, 2017 - Removed setting function for values that were moved to meta data,
+ *                   Added compare_Reference function to compare 2 references from 2 nessus objects
+ */
+
+/**
+ * Represents a Nessus scan
+ *
+ * @author Ryan Prather
+ *
+ */
+class nessus {
+
+  /**
+   * PDI ID
+   *
+   * @var integer
+   */
+  protected $pdi_id = 0;
+
+  /**
+   * Nessus Id
+   *
+   * @var string
+   */
+  protected $nessus_id = '';
+
+  /**
+   * Name
+   *
+   * @var string
+   */
+  protected $name = '';
+
+  /**
+   * Summary
+   *
+   * @var string
+   */
+  protected $summary = '';
+
+  /**
+   * Description
+   *
+   * @var string
+   */
+  protected $description = '';
+
+  /**
+   * Solution
+   *
+   * @var string
+   */
+  protected $solution = '';
+
+  /**
+   * Family
+   *
+   * @var unknown
+   */
+  protected $family = '';
+
+  /**
+   * Category
+   *
+   * @var string
+   */
+  protected $category = '';
+
+  /**
+   * Copyright
+   *
+   * @var string
+   */
+  protected $copyright = '';
+
+  /**
+   * Protocol
+   *
+   * @var string
+   */
+  protected $protocol = '';
+
+  /**
+   * Version of the plugin
+   *
+   * @var string
+   */
+  protected $version = '';
+
+  /**
+   * File name of the Nessus plugin file
+   *
+   * @var string
+   */
+  protected $file_name = '';
+
+  /**
+   * Date of the Nessus plugin file
+   *
+   * @var string
+   */
+  protected $file_date = '';
+
+  /**
+   * Array of reference IDs that link to this plugin
+   *   multidimensional array, first dimension is type, second dimension is value
+   *
+   * @var array
+   */
+  protected $refs = array();
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_PDI_ID
+   * @param string $str_Nessus_ID
+   */
+  public function __construct($int_PDI_ID, $str_Nessus_ID) {
+    $this->pdi_id = $int_PDI_ID;
+    $this->nessus_id = $str_Nessus_ID;
+
+    $this->refs = array();
+  }
+
+  /**
+   * Getter function for PDI ID
+   *
+   * @return integer
+   */
+  public function get_PDI_ID() {
+    return $this->pdi_id;
+  }
+
+  /**
+   * Setter function for PDI ID
+   *
+   * @param integer $int_PDI_ID
+   */
+  public function set_PDI_ID($int_PDI_ID) {
+    $this->pdi_id = $int_PDI_ID;
+  }
+
+  /**
+   * Getter function for Nessus ID
+   *
+   * @return string
+   */
+  public function get_Nessus_ID() {
+    return $this->nessus_id;
+  }
+
+  /**
+   * Setter function for Nessus ID
+   *
+   * @param string $str_Nessus_ID
+   */
+  public function set_Nessus_ID($str_Nessus_ID) {
+    $this->nessus_id = $str_Nessus_ID;
+  }
+
+  /**
+   * Getter function for plugin name
+   *
+   * @return string
+   */
+  public function get_Name() {
+    return $this->name;
+  }
+
+  /**
+   * Setter function for plugin name
+   *
+   * @param string $str_Name_In
+   */
+  public function set_Name($str_Name_In) {
+    $this->name = $str_Name_In;
+  }
+
+  /**
+   * Getter function for plugin summary
+   *
+   * @return string|null
+   */
+  public function get_Summary() {
+    if (isset($this->refs['summary'])) {
+      return $this->refs['summary'];
+    }
+    return null;
+  }
+
+  /**
+   * Getter function for plugin description
+   *
+   * @return string|null
+   */
+  public function get_Description() {
+    if (isset($this->refs['description'])) {
+      return $this->refs['description'];
+    }
+    return null;
+  }
+
+  /**
+   * Getter function for plugin solution
+   *
+   * @return string
+   */
+  public function get_Solution() {
+    if (isset($this->refs['solution'])) {
+      return $this->refs['solution'];
+    }
+    return null;
+  }
+
+  /**
+   * Getter function for plugin family
+   *
+   * @return string
+   */
+  public function get_Family() {
+    if (isset($this->refs['family'])) {
+      return $this->refs['family'];
+    }
+    return null;
+  }
+
+  /**
+   * Getter function for plugin category
+   *
+   * @return string
+   */
+  public function get_Category() {
+    if (isset($this->refs['category'])) {
+      return $this->refs['category'];
+    }
+    return null;
+  }
+
+  /**
+   * Getter function for plugin copyright
+   *
+   * @return string
+   */
+  public function get_Copyright() {
+    return $this->copyright;
+  }
+
+  /**
+   * Setter function for plugin copyright
+   *
+   * @param string $str_Copyright_In
+   */
+  public function set_Copyright($str_Copyright_In) {
+    $this->copyright = $str_Copyright_In;
+  }
+
+  /**
+   * Getter function for plugin protocol
+   *
+   * @return string
+   */
+  public function get_Protocol() {
+    if (isset($this->refs['protocol'])) {
+      return $this->refs['protocol'];
+    }
+    return null;
+  }
+
+  /**
+   * Getter function for plugin version
+   *
+   * @return string
+   */
+  public function get_Version() {
+    return $this->version;
+  }
+
+  /**
+   * Setter function for plugin version
+   *
+   * @param string $str_Version_In
+   */
+  public function set_Version($str_Version_In) {
+    $this->version = $str_Version_In;
+  }
+
+  /**
+   * Getter function for plugin file name
+   *
+   * @return string
+   */
+  public function get_FileName() {
+    return $this->file_name;
+  }
+
+  /**
+   * Setter function for plugin file name
+   *
+   * @param string $str_FileName_In
+   */
+  public function set_FileName($str_FileName_In) {
+    $this->file_name = $str_FileName_In;
+  }
+
+  /**
+   * Getter function for plugin file date
+   *
+   * @return string
+   */
+  public function get_FileDate() {
+    return $this->file_date;
+  }
+
+  /**
+   * Getter function for plugin file date
+   *
+   * @return DateTime
+   */
+  public function get_FileDate_Date() {
+    return DateTime::createFromFormat("U", $this->file_date);
+  }
+
+  /**
+   * Setter function for plugin file date
+   *
+   * @param string $str_FileDate_In
+   */
+  public function set_FileDate($str_FileDate_In) {
+    $this->file_date = $str_FileDate_In;
+  }
+
+  /**
+   * Function to return multidimensional array of all references
+   *
+   * @return multitype:string
+   */
+  public function get_Reference() {
+    return $this->refs;
+  }
+
+  /**
+   * Function to return an array of references
+   *
+   * @param string $type
+   *    The type you want to isolate
+   *
+   * @return multitype:string
+   *    Returns an array of references that are linked to a type
+   */
+  public function get_Reference_By_Type($type) {
+    if ($type == 'iavm') {
+      $tmp = array();
+      if (isset($this->refs['iava'])) {
+        $tmp = array_merge($tmp, $this->refs['iava']);
+      }
+      if (isset($this->refs['iavb'])) {
+        $tmp = array_merge($tmp, $this->refs['iavb']);
+      }
+      if (isset($this->refs['iavt'])) {
+        $tmp = array_merge($tmp, $this->refs['iavt']);
+      }
+
+      return $tmp;
+    }
+    if (isset($this->refs[strtolower($type)])) {
+      return $this->refs[strtolower($type)];
+    }
+
+    return array();
+  }
+
+  /**
+   * Function to see if a reference is already in the array
+   *
+   * @param string $type
+   *    The reference type you are searching for
+   * @param string $val
+   *    The value you are searching for
+   *
+   * @return boolean
+   *    Returns TRUE if found, otherwise false
+   */
+  public function ref_Found($type, $val) {
+    if (isset($this->refs[strtolower($type)])) {
+      foreach ($this->refs[strtolower($type)] as $ref) {
+        if ($ref == $val) {
+          return true;
+        }
+      }
+    }
+
+    return false;
+  }
+
+  /**
+   * Function to add a reference to the array
+   *
+   * @param string $type
+   *    An enumerated type of reference ('cve','bid','osvdb','edb','iavm','msft','cert','cwe')
+   * @param string $val
+   *    The type value
+   */
+  public function add_Reference($type, $val) {
+    $this->refs[strtolower($type)][] = $val;
+  }
+
+  /**
+   * Function to remove a reference
+   *
+   * @param string $type
+   *    An enumerated type of reference ('cve','bid','osvdb','edb','iavm','msft','cert','cwe')
+   *    More can be added if necessary
+   * @param string $val
+   *    The value of the type
+   *
+   * @return boolean
+   *    Returns TRUE if successful, otherwise false
+   */
+  public function remove_Reference($type, $val) {
+    foreach ($this->ref[strtolower($type)] as $key => $ref) {
+      if ($ref == $val) {
+        unset($this->ref[$key]);
+        return true;
+      }
+    }
+
+    return false;
+  }
+
+  /**
+   * To compare the meta data in two different nessus objects
+   *
+   * @param nessus $refs
+   *
+   * @return array
+   */
+  public function compare_References($refs) {
+    $ret = array();
+    foreach ($this->refs as $type => $ref) {
+      foreach ($ref as $val) {
+        if (!$refs->ref_Found($type, $val)) {
+          $ret[$type][] = $val;
+        }
+      }
+    }
+
+    return $ret;
+  }
+
+}

classes/oval.inc

@@ -0,0 +1,255 @@
+<?php
+/**
+ * File: oval.inc
+ * Author: Ryan Prather
+ * Purpose: Represents an Oval check
+ * Created: Sep 26, 2013
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 26, 2013 - File created
+ */
+
+include_once 'oval_ref.inc';
+
+/**
+ * Represents an Oval check
+ *
+ * @author Ryan Prather
+ *
+ */
+class oval {
+  /**
+   * PDI ID
+   *
+   * @var integer
+   */
+  protected $pdi_id = 0;
+
+  /**
+   * Oval ID
+   *
+   * @var string
+   */
+  protected $oval_id = '';
+
+  /**
+   * Definition title
+   *
+   * @var string
+   */
+  protected $title = '';
+
+  /**
+   * Definition description
+   *
+   * @var string
+   */
+  protected $desc = '';
+
+  /**
+   * Platform
+   *
+   * @var string
+   */
+  protected $platform = '';
+
+  /**
+   * External definition
+   *
+   * @var string
+   */
+  protected $ext_def = '';
+
+  /**
+   * External definition operator
+   *
+   * @var string
+   */
+  protected $ext_def_op = '';
+
+  /**
+   * Array of oval references
+   *
+   * @var multitype:oval_ref
+   */
+  protected $oval_ref = array();
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_pdi_id_in
+   * @param string $str_oval_id_in
+   * @param string $str_title_in
+   * @param string $str_desc_in
+   * @param string $str_platform_in
+   * @param string $str_ext_def_in
+   * @param string $str_ext_def_op_in
+   */
+  public function __construct($int_pdi_id_in, $str_oval_id_in, $str_title_in, $str_desc_in,
+                              $str_platform_in, $str_ext_def_in, $str_ext_def_op_in) {
+    $this->pdi_id = $int_pdi_id_in;
+    $this->oval_id = $str_oval_id_in;
+    $this->title = $str_title_in;
+    $this->desc = $str_desc_in;
+    $this->platform = $str_platform_in;
+    $this->ext_def = $str_ext_def_in;
+    $this->ext_def_op = $str_ext_def_op_in;
+  }
+
+  /**
+   * Get pdi id
+   *
+   * @return integer
+   */
+  public function get_PDI_ID() {
+    return $this->pdi_id;
+  }
+
+  /**
+   * Set pdi id
+   *
+   * @param integer $int_pdi_id_in
+   */
+  public function set_PDI_ID($int_pdi_id_in) {
+    $this->pdi_id = $int_pdi_id_in;
+  }
+
+  /**
+   * Get oval id
+   *
+   * @return string
+   */
+  public function get_Oval_ID() {
+    return $this->oval_id;
+  }
+
+  /**
+   * Set oval id
+   *
+   * @param string $str_oval_id_in
+   */
+  public function set_Oval_ID($str_oval_id_in) {
+    $this->oval_id = $str_oval_id_in;
+  }
+
+  /**
+   * Get definition title
+   *
+   * @return string
+   */
+  public function get_Title() {
+    return $this->title;
+  }
+
+  /**
+   * Set definition title
+   *
+   * @param string $str_title_in
+   */
+  public function set_Title($str_title_in) {
+    $this->title = $str_title_in;
+  }
+
+  /**
+   * Get the definition description
+   *
+   * @return string
+   */
+  public function get_Description() {
+    return $this->desc;
+  }
+
+  /**
+   * Set the definition description
+   *
+   * @param string $str_desc_in
+   */
+  public function set_Description($str_desc_in) {
+    $this->desc = $str_desc_in;
+  }
+
+  /**
+   * Get the platform that is affected by this definition
+   *
+   * @return string
+   */
+  public function get_Platform() {
+    return $this->platform;
+  }
+
+  /**
+   * Set the platform that is affected by this definition
+   *
+   * @param string $str_platform_in
+   */
+  public function set_Platform( $str_platform_in) {
+    $this->platform = $str_platform_in;
+  }
+
+  /**
+   * Get the external definition
+   *
+   * @return string
+   */
+  public function get_External_Definition() {
+    return $this->ext_def;
+  }
+
+  /**
+   * Set the external definition
+   *
+   * @param string $str_ext_def_in
+   */
+  public function set_External_Definition($str_ext_def_in) {
+    $this->ext_def = $str_ext_def_in;
+  }
+
+  /**
+   * Get the external definition operator
+   *
+   * @return string
+   */
+  public function get_External_Definition_Operator() {
+    return $this->ext_def_op;
+  }
+
+  /**
+   * Set the external definition operator
+   *
+   * @param string $str_ext_def_op_in
+   */
+  public function set_External_Definition_Operator($str_ext_def_op_in) {
+    $this->ext_def_op = $str_ext_def_op_in;
+  }
+
+  /**
+   * Return the array of Oval References
+   *
+   * @return multitype:oval_ref
+   */
+  public function get_References() {
+    return $this->oval_ref;
+  }
+
+  /**
+   * Add a reference to the oval_ref variable
+   *
+   * @param oval_ref $oval_ref_in
+   */
+  public function add_Reference($oval_ref_in) {
+    $this->oval_ref[] = $oval_ref_in;
+  }
+
+  /**
+   * Function to clear the oval reference array
+   */
+  public function clear_References() {
+    $this->oval_ref = array();
+  }
+}

classes/oval_ref.inc

@@ -0,0 +1,139 @@
+<?php
+/**
+ * File: oval_ref.inc
+ * Author: Ryan Prather
+ * Purpose: Represents an oval reference
+ * Created: Sep 26, 2013
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 26, 2013 - File created
+ */
+
+/**
+ * Represents an Oval Reference
+ *
+ * @author Ryan Prather
+ *
+ */
+class oval_ref {
+  /**
+   * Oval ID
+   *
+   * @var string
+   */
+  protected $oval_id = '';
+
+  /**
+   * Source
+   *
+   * @var string
+   */
+  protected $source = '';
+
+  /**
+   * URL
+   *
+   * @var string
+   */
+  protected $url = '';
+
+  /**
+   * Reference ID
+   *
+   * @var string
+   */
+  protected $ref_id = '';
+
+  /**
+   * Constructor
+   *
+   * @param string $str_oval_id_in
+   * @param string $str_source_in
+   * @param string $str_url_in
+   * @param string $str_ref_id_in
+   */
+  public function __construct($str_oval_id_in, $str_source_in, $str_url_in, $str_ref_id_in) {
+    $this->oval_id = $str_oval_id_in;
+    $this->source = $str_source_in;
+    $this->url = $str_url_in;
+    $this->ref_id = $str_ref_id_in;
+  }
+
+  /**
+   * Get the oval id
+   *
+   * @return string
+   */
+  public function get_Oval_ID() {
+    return $this->oval_id;
+  }
+
+  /**
+   * Set the Oval ID
+   *
+   * @param string $str_oval_id_in
+   */
+  public function set_Oval_ID($str_oval_id_in) {
+    $this->oval_id = $str_oval_id_in;
+  }
+
+  /**
+   * Get the source
+   *
+   * @return string
+   */
+  public function get_Source() {
+    return $this->source;
+  }
+
+  /**
+   * Set the source
+   *
+   * @param string $str_source_in
+   */
+  public function set_Source($str_source_in) {
+    $this->source = $str_source_in;
+  }
+
+  /**
+   * Get the URL
+   *
+   * @return string
+   */
+  public function get_URL() {
+    return $this->url;
+  }
+
+  /**
+   * Set the URL
+   *
+   * @param string $str_url_in
+   */
+  public function set_URL($str_url_in) {
+    $this->url = $str_url_in;
+  }
+
+  /**
+   * Get the reference id
+   *
+   * @return string
+   */
+  public function get_Reference_ID() {
+    return $this->ref_id;
+  }
+
+  /**
+   * Set the reference id
+   *
+   * @param string $str_ref_id_in
+   */
+  public function set_Reference_ID($str_ref_id_in) {
+    $this->ref_id = $str_ref_id_in;
+  }
+}

classes/pdi_catalog.inc

@@ -0,0 +1,283 @@
+<?php
+
+/**
+ * File: pdi_catalog.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a PDI catalog item
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ *  - Jun 27, 2017 - Added truncation for short title if longer than 255 characters
+ *  - Oct 23, 2017 - Updated file header, added fix text and group title to class, and deleted SQL insert method
+ */
+
+/**
+ * Represent a Potential Descrepancy Item (PDI)
+ * @author Ryan Prather
+ *
+ */
+class pdi {
+
+  /**
+   * ID
+   *
+   * @var integer
+   */
+  protected $id = 0;
+
+  /**
+   * Category level
+   *
+   * @var integer
+   */
+  protected $cat_lvl = 0;
+
+  /**
+   * Update DateTime
+   *
+   * @var DateTime
+   */
+  protected $update;
+
+  /**
+   * Check Contents
+   *
+   * @var string
+   */
+  protected $chk_content = '';
+
+  /**
+   * Fix Text
+   *
+   * @var string
+   */
+  protected $fix_text = null;
+
+  /**
+   * Group Title
+   *
+   * @var string
+   */
+  protected $group_title = null;
+
+  /**
+   * Short title
+   *
+   * @var string
+   */
+  protected $short_title = null;
+
+  /**
+   * Description
+   *
+   * @var string
+   */
+  protected $description = '';
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_ID
+   * @param integer:string $Cat_Lvl
+   * @param string $dt_Update
+   */
+  public function __construct($int_ID, $Cat_Lvl, $dt_Update) {
+    $this->id = $int_ID;
+    if (is_string($dt_Update)) {
+      $this->update = new DateTime($dt_Update);
+    }
+    elseif (is_a($dt_Update, 'DateTime')) {
+      $this->update = $dt_Update;
+    }
+    else {
+      $this->update = new DateTime();
+    }
+
+    if ($Cat_Lvl && $Cat_Lvl != '' && !is_null($Cat_Lvl)) {
+      if (is_numeric($Cat_Lvl)) {
+        $this->cat_lvl = $Cat_Lvl;
+      }
+      else {
+        $this->cat_lvl = substr_count($Cat_Lvl, "I");
+      }
+    }
+    else {
+      $this->cat_lvl = 2;
+      $this->description = "Defaulted Cat" . PHP_EOL . $this->description;
+    }
+  }
+
+  /**
+   * Getter function for PDI ID
+   *
+   * @return integer
+   */
+  public function get_ID() {
+    return $this->id;
+  }
+
+  /**
+   * Setter function for PDI ID
+   *
+   * @param integer $id
+   */
+  public function set_ID($id) {
+    $this->id = $id;
+  }
+
+  /**
+   * Getter function for category level
+   *
+   * @return integer
+   */
+  public function get_Category_Level() {
+    return $this->cat_lvl;
+  }
+
+  /**
+   * Gettr function for category level string
+   *
+   * @return string
+   */
+  public function get_Category_Level_String() {
+    return implode("", array_fill(0, $this->cat_lvl, "I"));
+  }
+
+  /**
+   * Setter function for category level
+   *
+   * @param integer:string $Cat_Lvl
+   */
+  public function set_Catetgory_Level($Cat_Lvl) {
+    if (is_numeric($Cat_Lvl)) {
+      $this->cat_lvl = $Cat_Lvl;
+    }
+    else {
+      $this->cat_lvl = substr_count($Cat_Lvl, 'I');
+    }
+  }
+
+  /**
+   * Getter function for last update
+   *
+   * @return DateTime
+   */
+  public function get_Last_Update() {
+    return $this->update;
+  }
+
+  /**
+   * Setter function for last update
+   *
+   * @param string $dt_Update
+   */
+  public function set_Update($dt_Update) {
+    $this->update = new DateTime($dt_Update);
+  }
+
+  /**
+   * Getter function for check contents
+   *
+   * @return string
+   */
+  public function get_Check_Contents() {
+    return $this->chk_content;
+  }
+
+  /**
+   * Setter function for check contents
+   *
+   * @param string $str_Check_Content
+   */
+  public function set_Check_Contents($str_Check_Content) {
+    $this->chk_content = $str_Check_Content;
+  }
+
+  /**
+   * Getter function for the fix text
+   *
+   * @return string
+   */
+  public function get_Fix_Text() {
+    return $this->fix_text;
+  }
+
+  /**
+   * Setter function for the fix text
+   *
+   * @param string $fix_text_in
+   */
+  public function set_Fix_Text($fix_text_in) {
+    if (is_array($fix_text_in) && count($fix_text_in) > 1) {
+      $this->fix_text = implode("\n", $fix_text_in);
+    }
+    else {
+      $this->fix_text = $fix_text_in;
+    }
+  }
+
+  /**
+   * Getter function for group title
+   *
+   * @return string
+   */
+  public function get_Group_Title() {
+    return $this->group_title;
+  }
+
+  /**
+   * Setter function for group title
+   *
+   * @param string $group_title_in
+   */
+  public function set_Group_Title($group_title_in) {
+    $this->group_title = $group_title_in;
+  }
+
+  /**
+   * Getter function for short title
+   *
+   * @return string
+   */
+  public function get_Short_Title() {
+    return $this->short_title;
+  }
+
+  /**
+   * Setter function for short title
+   *
+   * @param string $str_Short_Title
+   */
+  public function set_Short_Title($str_Short_Title) {
+    $this->short_title = $str_Short_Title;
+  }
+
+  /**
+   * Getter function for description
+   *
+   * @return string
+   */
+  public function get_Description() {
+    return $this->description;
+  }
+
+  /**
+   * Setter function for description
+   *
+   * @param string $str_Description
+   */
+  public function set_Description($str_Description) {
+    $this->description = $str_Description;
+  }
+
+}

classes/people.inc

@@ -0,0 +1,36 @@
+<?php
+
+/**
+ * File: people.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a person
+ * Created: Dec 8, 2014
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Dec 8, 2014 - File created
+ *  - Sep 1, 2016 - Updated Copyright and added comments
+ */
+
+/**
+ * Represents the people that will be working on an assessment
+ *
+ * @author Ryan Prather
+ */
+class people {
+
+  public $id = 0;
+  public $name = '';
+  public $org = '';
+  public $phone = '';
+  public $position = '';
+
+}

classes/port.inc

@@ -0,0 +1,254 @@
+<?php
+
+/**
+ * File: ports.inc
+ * Author: Ryan Prather
+ * Purpose: Represents an open TCP or UDP port on an interface
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ *  - Sep 1, 2016 - Copyright updated
+ *  - Oct 24, 2016 - Updated relationship between tcp/udp_port and port classes
+ */
+
+/**
+ * Represents a generic port
+ *
+ * @author Ryan Prather
+ */
+class port {
+
+  /**
+   * port ID
+   *
+   * @var integer
+   */
+  protected $id = 0;
+
+  /**
+   * port number
+   *
+   * @var integer
+   */
+  protected $port = 0;
+
+  /**
+   * Name as defined by IANA
+   *
+   * @var string
+   */
+  protected $iana_name = '';
+
+  /**
+   * Banner
+   *
+   * @var string
+   */
+  protected $banner = '';
+
+  /**
+   * Port notes
+   *
+   * @var string
+   */
+  protected $notes = '';
+
+  /**
+   * Getter function for port Id
+   *
+   * @return integer
+   */
+  public function get_ID() {
+    return $this->id;
+  }
+
+  /**
+   * Getter function for port number
+   *
+   * @return integer
+   */
+  public function get_Port() {
+    return $this->port;
+  }
+
+  /**
+   * Getter function for port name
+   *
+   * @return string
+   */
+  public function get_IANA_Name() {
+    return $this->iana_name;
+  }
+
+  /**
+   * Setter function for port name
+   *
+   * @return string
+   */
+  public function set_IANA_Name($str_New_Name) {
+    $this->iana_name = $str_New_Name;
+  }
+
+  /**
+   * Geeter function for port banner
+   *
+   * @return string
+   */
+  public function get_Banner() {
+    return $this->banner;
+  }
+
+  /**
+   * Setter function for port notes
+   *
+   * @param
+   *        $str_New_Banner
+   */
+  public function set_Banner($str_New_Banner) {
+    $this->banner = $str_New_Banner;
+  }
+
+  /**
+   * Getter function for port notes
+   *
+   * @return string
+   */
+  public function get_Notes() {
+    return $this->notes;
+  }
+
+  /**
+   * Setter function for port notes
+   *
+   * @param string $str_New_Notes
+   */
+  public function set_Notes($str_New_Notes) {
+    $this->notes = $str_New_Notes;
+  }
+
+  /**
+   * Setter function that will append new notes instead of overwriting
+   *
+   * @param string $str_New_Notes
+   */
+  public function append_Notes($str_New_Notes) {
+    $this->notes .= $str_New_Notes;
+  }
+
+}
+
+/**
+ * Represents a TCP port/service
+ *
+ * @author Ryan Prather
+ *
+ */
+class tcp_ports extends port {
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_ID
+   * @param integer $int_Port
+   * @param string $str_IANA_Name
+   * @param string $str_Banner
+   * @param string $str_Notes
+   */
+  public function __construct($int_ID, $int_Port, $str_IANA_Name, $str_Banner, $str_Notes) {
+    $this->id = $int_ID;
+    $this->port = $int_Port;
+    $this->iana_name = $str_IANA_Name;
+    $this->banner = $str_Banner;
+    $this->notes = $str_Notes;
+  }
+
+  /**
+   * Getter function for preformated table row
+   *
+   * @return string
+   */
+  public function get_Table_Data($intface_IP, $intface_ID, $Odd_Row) {
+    $ret = "<div class='pps-row " . ($Odd_Row ? "odd" : "even") . "_row'>" .
+        "<span class='pps'>" .
+        "<input type='hidden' name='tcp_port[$intface_ID][$this->id]' value='$this->port' />$this->port" . "/tcp" .
+        "</span>" .
+        "<span class='listen'>$intface_IP</span>" .
+        "<span class='iana-name'>" .
+        "<input type='text' class='auto-update-text' style='width: 150px;' name='iana_name[$intface_ID][$this->id]' value='$this->iana_name'/>" .
+        "</span>" .
+        "<span class='banner'>" .
+        "<textarea class='auto-update-text' style='width: 300px; vertical-align: bottom' rows='2' name='banner[$intface_ID][$this->id]'>$this->banner</textarea>" .
+        "</span>" .
+        "<span class='pps-notes'>" .
+        "<textarea class='auto-update-text' style='width: 450px; vertical-align: bottom' rows='3' name='notes[$intface_ID][$this->id]'>$this->notes</textarea>" .
+        "</span>" .
+        "</div>";
+
+    return $ret;
+  }
+
+}
+
+/**
+ * Represents a UDP port/service
+ *
+ * @author Ryan Prather
+ *
+ */
+class udp_ports extends port {
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_ID
+   * @param integer $int_Port
+   * @param string $str_IANA_Name
+   * @param string $str_Banner
+   * @param string $str_Notes
+   */
+  public function __construct($int_ID, $int_Port, $str_IANA_Name, $str_Banner, $str_Notes) {
+    $this->id = $int_ID;
+    $this->port = $int_Port;
+    $this->iana_name = $str_IANA_Name;
+    $this->banner = $str_Banner;
+    $this->notes = $str_Notes;
+  }
+
+  /**
+   * Getter function for preformated tabel row
+   *
+   * @param string $intface_IP
+   * @param integer $intface_ID
+   * @param boolean $Odd_Row
+   * @return string
+   */
+  public function get_Table_Data($intface_IP, $intface_ID, $Odd_Row) {
+    $ret = "<div class='pps-row " . ($Odd_Row ? "odd" : "even") . "_row'>" .
+        "<span class='pps'>" .
+        "<input type='hidden' name='udp_port[$intface_ID][$this->id]' value='$this->port' />$this->port" . "/udp" .
+        "</span>" .
+        "<span class='listen'>$intface_IP</span>" .
+        "<span class='iana-name'>" .
+        "<input type='text' class='auto-update-text' style='width: 150px;' name='iana_name[$intface_ID][$this->id]' value='$this->iana_name'/>" .
+        "</span>" .
+        "<span class='banner'>" .
+        "<textarea class='auto-update-text' style='width: 300px; vertical-align: bottom' rows='2' name='banner[$intface_ID][$this->id]'>$this->banner</textarea>" .
+        "</span>" .
+        "<span class='pps-notes'>" .
+        "<textarea class='auto-update-text' style='width: 450px; vertical-align: bottom' rows='3' name='notes[$intface_ID][$this->id]'>$this->notes</textarea>" .
+        "</span>" .
+        "</div>";
+
+    return $ret;
+  }
+
+}

classes/proc_ia_controls.inc

@@ -0,0 +1,758 @@
+<?php
+
+/**
+ * File: proc_ia_controls.inc
+ * Author: Ryan Prather
+ * Purpose: Contain all classes that have to do with a procedural IA control
+ * Created: Mar 17, 2014
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Mar 17, 2014 - File created
+ *  - Sep 1, 2016 - Updated Copyright and a couple comments
+ */
+
+/**
+ * Procedural IA Controls
+ *
+ * @author Ryan Prather
+ *
+ */
+class proc_ia_controls {
+
+  /**
+   * Array for status
+   *
+   * @var myltitype:string
+   */
+  private $STATUS = array(
+    "Not Reviewed"   => 4,
+    "Non-Compliant"  => 3,
+    "Compliant"      => 2,
+    "Not Applicable" => 1
+  );
+
+  /**
+   * Reverses the status array
+   *
+   * @var multitype:integer
+   */
+  private $FLIPPED = array(
+    4 => "Not Reviewed",
+    3 => "Non-Compliant",
+    2 => "Compliant",
+    1 => "Not Applicable"
+  );
+
+  /**
+   * Control ID
+   *
+   * @var string
+   */
+  protected $control_id = '';
+
+  /**
+   * Name
+   *
+   * @var string
+   */
+  protected $name = '';
+
+  /**
+   * Subject area
+   *
+   * @var string
+   */
+  protected $sub_area = '';
+
+  /**
+   * Description
+   *
+   * @var string
+   */
+  protected $desc = '';
+
+  /**
+   * Threat/vulnerability/countermeasures
+   *
+   * @var string
+   */
+  protected $tvcm = '';
+
+  /**
+   * General implementation guide
+   *
+   * @var string
+   */
+  protected $gimpg = '';
+
+  /**
+   * Resource guide
+   *
+   * @var string
+   */
+  protected $guide = '';
+
+  /**
+   * Impact
+   *
+   * @var string
+   */
+  protected $impact = '';
+
+  /**
+   * Array of sub ia controls
+   *
+   * @var multitype:proc_sub_ia_controls
+   */
+  protected $subs = array();
+
+  /**
+   * Control Finding
+   *
+   * @var control_finding
+   */
+  public $finding = null;
+
+  /**
+   * Constructor
+   *
+   * @param string $str_control_id_in
+   * @param string $str_name_in
+   * @param string $str_sub_area_in
+   * @param string $str_desc_in
+   * @param string $str_tvcm_in
+   * @param string $str_gimpg_in
+   * @param string $str_guide_in
+   * @param string $str_impact_in
+   */
+  public function __construct($str_control_id_in, $str_name_in, $str_sub_area_in, $str_desc_in, $str_tvcm_in, $str_gimpg_in, $str_guide_in, $str_impact_in) {
+    $this->control_id = $str_control_id_in;
+    $this->desc = $str_desc_in;
+    $this->name = $str_name_in;
+    $this->sub_area = $str_sub_area_in;
+    $this->tvcm = $str_tvcm_in;
+    $this->gimpg = $str_gimpg_in;
+    $this->guide = $str_guide_in;
+    $this->impact = $str_impact_in;
+
+    $this->finding = new control_finding();
+  }
+
+  /**
+   * Function to get the status
+   *
+   * @param string|integer $val
+   * @return multitype:integer|myltitype:string
+   */
+  public function get_Status($val) {
+    if (is_numeric($val)) {
+      return $this->FLIPPED[$val];
+    }
+    else {
+      return $this->STATUS[$val];
+    }
+  }
+
+  /**
+   * Getter function for control ID
+   *
+   * @return string
+   */
+  public function get_Control_ID() {
+    return $this->control_id;
+  }
+
+  /**
+   * Setter function for control id
+   *
+   * @param string $str_control_id_in
+   */
+  public function set_Control_ID($str_control_id_in) {
+    $this->control_id = $str_control_id_in;
+  }
+
+  /**
+   * Getter function for name
+   *
+   * @return string
+   */
+  public function get_Name() {
+    return $this->name;
+  }
+
+  /**
+   * Setter function for name
+   *
+   * @param string $str_name_in
+   */
+  public function set_Name($str_name_in) {
+    $this->name = $str_name_in;
+  }
+
+  /**
+   * Getter function for subject area
+   *
+   * @return string
+   */
+  public function get_Subject_Area() {
+    return $this->sub_area;
+  }
+
+  /**
+   * Setter function for subject area
+   *
+   * @param string $str_sub_area_in
+   */
+  public function set_Subject_Area($str_sub_area_in) {
+    $this->sub_area = $str_sub_area_in;
+  }
+
+  /**
+   * Getter function for description
+   *
+   * @return string
+   */
+  public function get_Description() {
+    return $this->desc;
+  }
+
+  /**
+   * Setter function for description
+   *
+   * @param string $str_desc_in
+   */
+  public function set_Description($str_desc_in) {
+    $this->desc = $str_desc_in;
+  }
+
+  /**
+   * Getter function for threat/vulnerability/countermeasures
+   *
+   * @return string
+   */
+  public function get_Threat_Vul_CM() {
+    return $this->tvcm;
+  }
+
+  /**
+   * Setter function for threat/vulnerability/countermeasures
+   *
+   * @param string $str_tvcm_in
+   */
+  public function set_Threat_Vul_CM($str_tvcm_in) {
+    $this->tvcm = $str_tvcm_in;
+  }
+
+  /**
+   * Getter function for implementation guide
+   *
+   * @return string
+   */
+  public function get_General_Implementation_Guide() {
+    return $this->gimpg;
+  }
+
+  /**
+   * Setter function for implementation guide
+   *
+   * @param string $str_gimpg_in
+   */
+  public function set_General_Implementation_Guide($str_gimpg_in) {
+    $this->gimpg = $str_gimpg_in;
+  }
+
+  /**
+   * Getter function for resource guide
+   *
+   * @return string
+   */
+  public function get_Resource_Guide() {
+    return $this->guide;
+  }
+
+  /**
+   * Setter function for resource guide
+   *
+   * @param string $str_guide_in
+   */
+  public function set_Resourse_Guide($str_guide_in) {
+    $this->guide = $str_guide_in;
+  }
+
+  /**
+   * Getter function for impact
+   *
+   * @return string
+   */
+  public function get_Impact() {
+    return $this->impact;
+  }
+
+  /**
+   * Setter function for impact
+   *
+   * @param string $str_impact_in
+   */
+  public function set_Impact($str_impact_in) {
+    $this->impact = $str_impact_in;
+  }
+
+  /**
+   * Getter function for sub controls
+   *
+   * @return multitype:proc_sub_ia_controls
+   */
+  public function get_Subs() {
+    return $this->subs;
+  }
+
+  /**
+   * Function to add new sub controls
+   *
+   * @param proc_sub_ia_controls $sub_in
+   */
+  public function add_Sub($sub_in) {
+    $this->subs[] = $sub_in;
+  }
+
+  /**
+   * Function to generate a display for procedural ops page
+   *
+   * @return string
+   */
+  public function get_Ops_Display($odd = true) {
+    $status_count = array(
+      'Not Reviewed'   => 0,
+      'Non-Compliant'  => 0,
+      'Compliant'      => 0,
+      'Not Applicable' => 0
+    );
+
+    $current_status = 0;
+    foreach ($this->subs as $key => $sub) {
+      if ($this->STATUS[$sub->finding->status] > $current_status) {
+        $current_status = $this->STATUS[$sub->finding->status];
+      }
+      $status_count[$sub->finding->status] ++;
+    }
+
+    $class = strtolower(str_replace(' ', '_', str_replace('-', '_', $this->FLIPPED[$current_status])));
+    $parent_name = str_replace('-', '_', $this->control_id);
+    $ret = "<tr>" .
+        "<td class='cat_header' colspan='4'>" .
+        "<span style='width:115px;cursor:pointer;' onclick=\"$('.$parent_name').toggle(300);\">" . $this->control_id . "</span>" .
+        "<span style='width:310px;'>" . $this->name . "</span>" .
+        "<span class='$class' id='$parent_name" . "_disp'>" . $this->FLIPPED[$current_status] . "</span>" .
+        "<span class='override_status' id='" . $parent_name . "_or'>" .
+        "Override: <input type='checkbox' onclick=\"$('#" . $parent_name . "_status').toggle();\" />" .
+        "<select id='" . $parent_name . "_status' style='display:none;' onchange='field_id=\"$parent_name" . "_status\";update_status(\"$parent_name" . "_status\");'>" .
+        "<option />" .
+        "<option" . ($this->FLIPPED[$current_status] == 'Not Reviewed' ? ' selected' : '') . ">Not Reviewed</option>" .
+        "<option" . ($this->FLIPPED[$current_status] == 'Non-Compliant' ? ' selected' : '') . ">Non-Compliant</option>" .
+        "<option" . ($this->FLIPPED[$current_status] == 'Compliant' ? ' selected' : '') . ">Compliant</option>" .
+        "<option" . ($this->FLIPPED[$current_status] == 'Not Applicable' ? ' selected' : '') . ">Not Applicable</option>" .
+        "</select>" .
+        "</span>" .
+        "<span id='$parent_name" . "_Compliant' class='compliant' style='width:25px;text-align:center;'>" . $status_count['Compliant'] . "</span>" .
+        "<span id='$parent_name" . "_Not_Reviewed' class='not_reviewed' style='width:25px;text-align:center;'>" . $status_count['Not Reviewed'] . "</span>" .
+        "<span id='$parent_name" . "_Non_Compliant' class='non_compliant' style='width:25px;text-align:center;'>" . $status_count['Non-Compliant'] . "</span>" .
+        "<span id='$parent_name" . "_Not_Applicable' class='not_applicable' style='width:25px;text-align:center;'>" . $status_count['Not Applicable'] . "</span>" .
+        "</td>" .
+        "</tr>" .
+        "<tr class='" . ($odd ? 'odd' : 'even') . "_row $parent_name'>" .
+        "<td style='width:117px;'>" . $this->control_id . "<br />" . $this->name . "</td>" .
+        "<td style='width:150px;'>" . nl2br($this->desc) . "</td>" .
+        "<td style='width:450px;'>" . nl2br($this->gimpg) . "</td>" .
+        "<td>" .
+        "Vulnerability Description:<br />" .
+        "<textarea name='$parent_name" . "_vul_desc' id='$parent_name" . "_vul_desc'>" . $this->finding->vul_desc . "</textarea><br />" .
+        "Mitigations:<br />" .
+        "<textarea name='$parent_name" . "_mit' id='$parent_name" . "_mit'>" . $this->finding->mitigations . "</textarea><br />" .
+        "References:<br />" .
+        "<textarea name='$parent_name" . "_ref' id='$parent_name" . "_ref'>" . $this->finding->reference . "</textarea><br />" .
+        "Notes:<br />" .
+        "<textarea name='$parent_name" . "_notes' id='$parent_name" . "_notes'>" . $this->finding->notes . "</textarea>" .
+        "</td>" .
+        "</tr>";
+
+    foreach ($this->subs as $key => $sub) {
+      $odd = !$odd;
+      $name = str_replace('-', '_', $sub->get_Sub_Control_ID());
+      $ret .= "<tr class='" . ($odd ? 'odd' : 'even') . "_row $parent_name'>" .
+          "<td style='width:117px;'>" . $sub->get_Sub_Control_ID() . "<br />" .
+          "<input type='hidden' id='$name" . "_status_old' value='" . $sub->finding->status . "' />" .
+          "<select name='$name" . "_status' id='$name" . "_status' style='width:95px;' onchange='field_id=\"$name" . "_status\";update_status();'>" .
+          "<option" . ($sub->finding->status == 'Not Reviewed' ? ' selected' : '') . ">Not Reviewed</option>" .
+          "<option" . ($sub->finding->status == 'Compliant' ? ' selected' : '') . ">Compliant</option>" .
+          "<option" . ($sub->finding->status == 'Not Applicable' ? ' selected' : '') . ">Not Applicable</option>" .
+          "<option" . ($sub->finding->status == 'Non-Compliant' ? ' selected' : '') . ">Non-Compliant</option>" .
+          "</select>" .
+          $sub->get_Name() . "</td>" .
+          "<td style='width:150px;'>" . nl2br($sub->get_Objective()) . "</td>" .
+          "<td style='width:450px;'>" . nl2br($sub->get_Script()) . "</td>" .
+          "<td>" .
+          "Test Result:<br />" .
+          "<textarea name='$name" . "_test_result' id='$name" . "_test_result'>" . $sub->finding->test_result . "</textarea><br />" .
+          "Mitigations:<br />" .
+          "<textarea name='$name" . "_mit' id='$name" . "_mit'>" . $sub->finding->mitigation . "</textarea><br />" .
+          "Milestones:<br />" .
+          "<textarea name='$name" . "_milestone' id='$name" . "_milestone'>" . $sub->finding->milestone . "</textarea><br />" .
+          "References:<br />" .
+          "<textarea name='$name" . "_ref' id='$name" . "_ref'>" . $sub->finding->reference . "</textarea><br />" .
+          "Notes:<br />" .
+          "<textarea name='$name" . "_notes' id='$name" . "_notes'>" . $sub->finding->notes . "</textarea>" .
+          "</td>" .
+          "</tr>";
+    }
+
+    return $ret;
+  }
+
+  /**
+   *
+   * @return string
+   */
+  public function get_Worst_Status_String() {
+    $current_status = 0;
+
+    foreach ($this->subs as $key => $sub) {
+      if ($this->STATUS[$sub->finding->status] > $current_status) {
+        $current_status = $this->STATUS[$sub->finding->status];
+        if ($current_status == $this->STATUS['Not Reviewed']) {
+          break;
+        }
+      }
+    }
+
+    return $this->FLIPPED[$current_status];
+  }
+
+}
+
+/**
+ * Control Findings
+ *
+ * @author Ryan Prather
+ */
+class control_finding {
+
+  /**
+   * DB ID
+   *
+   * @var integer
+   */
+  public $id = 0;
+
+  /**
+   * Associated ST&E ID
+   *
+   * @var integer
+   */
+  public $ste_id = 0;
+
+  /**
+   * Control ID
+   *
+   * @var string
+   */
+  public $control_id = '';
+
+  /**
+   * Vulnerability description
+   *
+   * @var string
+   */
+  public $vul_desc = '';
+
+  /**
+   * Control mitigations
+   *
+   * @var string
+   */
+  public $mitigations = '';
+
+  /**
+   * Control references
+   *
+   * @var string
+   */
+  public $reference = '';
+  public $risk_analysis = '';
+
+  /**
+   * Notes
+   *
+   * @var string
+   */
+  public $notes = '';
+
+  /**
+   * Tells the system that this control review is complete
+   *
+   * @var boolean
+   */
+  public $done = false;
+
+}
+
+/**
+ * Procedural Sub IA Controls
+ *
+ * @author Ryan Prather
+ *
+ */
+class proc_sub_ia_controls {
+
+  /**
+   * Sub control id
+   *
+   * @var string
+   */
+  protected $sub_control_id = '';
+
+  /**
+   * Name
+   *
+   * @var string
+   */
+  protected $name = '';
+
+  /**
+   * Objectives
+   *
+   * @var string
+   */
+  protected $objective = '';
+
+  /**
+   * Preparation
+   *
+   * @var string
+   */
+  protected $prep = '';
+
+  /**
+   * Script
+   *
+   * @var script
+   */
+  protected $script = '';
+
+  /**
+   * Expected Results
+   *
+   * @var string
+   */
+  protected $expected_results = '';
+
+  /**
+   * Procedural finding with notes
+   *
+   * @var proc_finding
+   */
+  public $finding = null;
+
+  /**
+   * Constructor
+   *
+   * @param string $str_sub_control_id_in
+   * @param string $str_name_in
+   * @param string $str_obj_in
+   * @param string $str_prep_in
+   * @param string $str_script_in
+   * @param string $str_exp_results_in
+   */
+  public function __construct($str_sub_control_id_in, $str_name_in, $str_obj_in, $str_prep_in, $str_script_in, $str_exp_results_in) {
+    $this->sub_control_id = $str_sub_control_id_in;
+    $this->name = $str_name_in;
+    $this->objective = $str_obj_in;
+    $this->prep = $str_prep_in;
+    $this->script = $str_script_in;
+    $this->expected_results = $str_exp_results_in;
+    $this->finding = new proc_finding();
+  }
+
+  /**
+   * Getter function for sub control id
+   *
+   * @return string
+   */
+  public function get_Sub_Control_ID() {
+    return $this->sub_control_id;
+  }
+
+  /**
+   * Setter function for sub control id
+   *
+   * @param string $str_sub_control_id_in
+   */
+  public function set_Sub_Control_ID($str_sub_control_id_in) {
+    $this->sub_control_id = $str_sub_control_id_in;
+  }
+
+  /**
+   * Getter function for name
+   *
+   * @return string
+   */
+  public function get_Name() {
+    return $this->name;
+  }
+
+  /**
+   * Setter function for name
+   *
+   * @param string $str_name_in
+   */
+  public function set_Name($str_name_in) {
+    $this->name = $str_name_in;
+  }
+
+  /**
+   * Getter function for objectives
+   *
+   * @return string
+   */
+  public function get_Objective() {
+    return $this->objective;
+  }
+
+  /**
+   * Setter function for objective
+   *
+   * @param string $str_obj_in
+   */
+  public function set_Objective($str_obj_in) {
+    $this->objective = $str_obj_in;
+  }
+
+  /**
+   * Getter function for preparations
+   *
+   * @return string
+   */
+  public function get_Preparation() {
+    return $this->prep;
+  }
+
+  /**
+   * Setter function fore preparations
+   *
+   * @param string $str_prep_in
+   */
+  public function set_Preparation($str_prep_in) {
+    $this->prep = $str_prep_in;
+  }
+
+  /**
+   * Getter function for script
+   *
+   * @return string
+   */
+  public function get_Script() {
+    return $this->script;
+  }
+
+  /**
+   * Setter function for script
+   *
+   * @param string $str_script_in
+   */
+  public function set_Script($str_script_in) {
+    $this->script = $str_script_in;
+  }
+
+  /**
+   * Getter function for expected results
+   *
+   * @return string
+   */
+  public function get_Expected_Results() {
+    return $this->expected_results;
+  }
+
+  /**
+   * Setter function for expected results
+   *
+   * @param string $str_exp_results_in
+   */
+  public function set_Expected_Results($str_exp_results_in) {
+    $this->expected_results = $str_exp_results_in;
+  }
+
+}
+
+/**
+ * Procedural findings
+ *
+ * @author Ryan Prather
+ *
+ */
+class proc_finding {
+
+  /**
+   * Finding ST&E ID
+   *
+   * @var integer
+   */
+  public $ste_id = 0;
+
+  /**
+   * Finding control id
+   *
+   * @var string
+   */
+  public $control_id = '';
+
+  /**
+   * Finding Status
+   *
+   * @var string
+   */
+  public $status = '';
+
+  /**
+   * Finding compliance statement
+   *
+   * @var string
+   */
+  public $test_result = '';
+
+  /**
+   * Finding mitigations
+   *
+   * @var string
+   */
+  public $mitigation = '';
+
+  /**
+   * Finding milestones
+   *
+   * @var string
+   */
+  public $milestone = '';
+
+  /**
+   * Finding reference
+   *
+   * @var string
+   */
+  public $reference = '';
+
+  /**
+   * Finding notes
+   *
+   * @var string
+   */
+  public $notes = '';
+
+}

classes/question.inc

@@ -0,0 +1,72 @@
+<?php
+
+/**
+ * File: question.inc
+ * Author: Ryan Prather
+ * Purpose: Represent a interview question
+ * Created: Aug 25, 2014
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Aug 25, 2014 - File created
+ *  - Sep 1, 2016 - Updated Copyright and comments
+ */
+
+/**
+ * Represent a category interview question
+ *
+ * @author Ryan Prather
+ */
+class question {
+
+  /**
+   * The database ID of the question
+   *
+   * @var int
+   */
+  public $id = 0;
+
+  /**
+   * The category ID of the question
+   *
+   * @var int
+   */
+  public $cat = 0;
+
+  /**
+   * The unique key for the question
+   *
+   * @var string
+   */
+  public $key = '';
+
+  /**
+   * The question
+   *
+   * @var string
+   */
+  public $question = '';
+
+  /**
+   * The database ID of the answer
+   *
+   * @var int
+   */
+  public $answer = 0;
+
+  /**
+   * Constructor
+   */
+  public function __construct() {
+
+  }
+
+}

classes/retina.inc

@@ -0,0 +1,87 @@
+<?php
+/**
+ * File: retina.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a Retina scan
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ */
+
+/**
+ * Represents a Retina scan
+ *
+ * @author Ryan Prather
+ *
+ */
+class retina {
+
+  /**
+   * PDI ID
+   *
+   * @var integer
+   */
+  protected $pdi_id = 0;
+
+  /**
+   * Retina ID
+   *
+   * @var string
+   */
+  protected $retina_id = '';
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_PDI_ID
+   * @param string $str_Retina_ID
+   */
+  public function __construct($int_PDI_ID, $str_Retina_ID) {
+    $this->pdi_id = $int_PDI_ID;
+    $this->retina_id = $str_Retina_ID;
+  }
+
+  /**
+   * Getter function for PDI ID
+   *
+   * @return integer
+   */
+  public function get_PDI_ID() {
+    return $this->pdi_id;
+  }
+
+  /**
+   * Setter function for PDI ID
+   *
+   * @param integer $int_PDI_ID
+   */
+  public function set_PDI_ID($int_PDI_ID) {
+    $this->pdi_id = $int_PDI_ID;
+  }
+
+  /**
+   * Getter function for Retina ID
+   *
+   * @return string
+   */
+  public function get_Retina_ID() {
+    return $this->retina_id;
+  }
+
+  /**
+   * Setter function for Retina ID
+   *
+   * @param string $str_Retina_ID
+   */
+  public function set_Retina_ID($str_Retina_ID) {
+    $this->retina_id = $str_Retina_ID;
+  }
+
+}

classes/rmf_control.inc

@@ -0,0 +1,461 @@
+<?php
+
+/**
+ * File: rmf_control.inc
+ * Author: Ryan Prather
+ * Purpose: Represent an NIST RMF IA control
+ * Created: Jan 28, 2015
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Jan 28, 2015 - File created
+ *  - Sep 1, 2016 - Updated Copyright and added a few comments
+ */
+
+/**
+ * Represent the RMF control family
+ *
+ * @author Ryan Prather
+ */
+class rmf_family {
+
+  /**
+   * Family abbreviation
+   *
+   * @var string
+   */
+  protected $abbr;
+
+  /**
+   * Family name
+   *
+   * @var string
+   */
+  protected $name;
+
+  /**
+   * Constructor
+   */
+  public function __construct() {
+
+  }
+
+  /**
+   * Getter function for the family abbreviation
+   *
+   * @return string
+   */
+  public function get_Abbr() {
+    return $this->abbr;
+  }
+
+  /**
+   * Setter function for the family abbreviation
+   *
+   * @param string $abbr_in
+   */
+  public function set_Abbr($abbr_in) {
+    $this->abbr = $abbr_in;
+  }
+
+  /**
+   * Getter function for the family name
+   *
+   * @return string
+   */
+  public function get_Name() {
+    return $this->name;
+  }
+
+  /**
+   * Setter function for the family name
+   *
+   * @param string $name_in
+   */
+  public function set_Name($name_in) {
+    $this->name = $name_in;
+  }
+
+}
+
+/**
+ * Represent the RMF control itself
+ *
+ * @author Ryan Prather
+ *
+ */
+class rmf_control {
+
+  /**
+   * Control family
+   *
+   * @var rmf_family
+   */
+  public $family;
+
+  /**
+   * Control id
+   *
+   * @var string
+   */
+  protected $control_id;
+
+  /**
+   * Control Name
+   *
+   * @var string
+   */
+  protected $name;
+
+  /**
+   * Control priority (0-3)
+   *
+   * @var int
+   */
+  protected $priority;
+
+  /**
+   * Control statement
+   *
+   * @var string
+   */
+  protected $statement;
+
+  /**
+   * Control supplemental guidance
+   *
+   * @var string
+   */
+  protected $guidance;
+
+  /**
+   * Which impact baseline this control applies to<br />
+   *    When the object is created this will start out as an array with all elements being false
+   *
+   * @var array
+   */
+  protected $baseline;
+
+  /**
+   * Other RMF controls that relate to this one
+   *
+   * @var array:string
+   */
+  protected $related;
+
+  /**
+   * An array of enhancements to this control
+   *
+   * @var array:rmf_control_enhancements
+   */
+  protected $enh_controls;
+
+  /**
+   * Constructor
+   */
+  public function __construct() {
+    $this->family = new rmf_family();
+    $this->baseline = array("low" => false, "moderate" => false, "high" => false);
+  }
+
+  /**
+   * Getter function for the control id
+   *
+   * @return string
+   */
+  public function get_Control_ID() {
+    return $this->control_id;
+  }
+
+  /**
+   * Setter function for the control id
+   *
+   * @param string $ctrl_id_in
+   */
+  public function set_Control_ID($ctrl_id_in) {
+    $this->control_id = $ctrl_id_in;
+  }
+
+  /**
+   * Getter function for the control name
+   *
+   * @return string
+   */
+  public function get_Name() {
+    return $this->name;
+  }
+
+  /**
+   * Setter function for the control name
+   *
+   * @param string $name_in
+   */
+  public function set_Name($name_in) {
+    $this->name = $name_in;
+  }
+
+  /**
+   * Getter function for the control priority
+   *
+   * @return int
+   */
+  public function get_Priority() {
+    return $this->priority;
+  }
+
+  /**
+   * Setter function for the control priority
+   *
+   * @param int $pri_in
+   */
+  public function set_Priority($pri_in) {
+    $this->priority = $pri_in;
+  }
+
+  /**
+   * Getter function for the control statement
+   *
+   * @return string
+   */
+  public function get_Statement() {
+    return $this->statement;
+  }
+
+  /**
+   * Setter function for the control statement
+   *
+   * @param string $statement_in
+   */
+  public function set_Statement($statement_in) {
+    $this->statement = $statement_in;
+  }
+
+  /**
+   * Getter function for control guidance
+   *
+   * @return string
+   */
+  public function get_Guidance() {
+    return $this->guidance;
+  }
+
+  /**
+   * Setter function for the control guidance
+   *
+   * @param string $guidance_in
+   */
+  public function set_Guidance($guidance_in) {
+    $this->guidance = $guidance_in;
+  }
+
+  /**
+   * Function to set the usage for a particular baseline
+   *
+   * @param string $impact
+   * @param boolean $setting
+   */
+  public function set_Baseline($impact, $setting) {
+    if (in_array($impact, array("low", "moderate", "high"))) {
+      $this->baseline[$impact] = $setting;
+    }
+  }
+
+  /**
+   * Function to return if a control is being used on a certain baseline
+   *
+   * @param string $impact
+   *
+   * @return boolean
+   */
+  public function get_Baseline($impact) {
+    if (in_array($impact, array("low", "moderate", "high"))) {
+      return $this->baseline[$impact];
+    }
+
+    return false;
+  }
+
+  /**
+   * Function to get the worst baseline that is assigned to the control
+   *
+   * @return string|boolean
+   */
+  public function get_Worst_Baseline() {
+    if ($this->baseline['high']) {
+      return "high";
+    }
+    elseif ($this->baseline['moderate']) {
+      return "moderate";
+    }
+    elseif ($this->baseline['low']) {
+      return "low";
+    }
+
+    return false;
+  }
+
+  /**
+   * Getter function for all the related controls
+   *
+   * @return array:string
+   */
+  public function get_Related_Controls() {
+    return $this->related;
+  }
+
+  /**
+   * Functio to add a control as a related control to this control
+   *
+   * @param string $ctrl_id_in
+   */
+  public function add_Related_Control($ctrl_id_in) {
+    if (!in_array($ctrl_id_in, $this->related)) {
+      $this->related[] = $ctrl_id_in;
+    }
+  }
+
+  /**
+   * Getter function to return all control enhancements
+   *
+   * @return array:rmf_control_enhancements
+   */
+  public function get_Enhanced_Controls() {
+    return $this->enh_controls;
+  }
+
+  /**
+   * Function to add a control enhancement
+   *
+   * @param rmf_control_enhancements $enh_in
+   */
+  public function add_Enhanced_Control($enh_in) {
+    if (!in_array($enh_id, $this->enh_controls)) {
+      $this->enh_controls[] = $enh_in;
+    }
+  }
+
+}
+
+/**
+ * Represents any control enhancements
+ *
+ * @author Ryan Prather
+ */
+class rmf_control_enhancements {
+
+  /**
+   * Enhanced control ID
+   *
+   * @var string
+   */
+  protected $enh_id;
+
+  /**
+   * Enhanced control name
+   *
+   * @var string
+   */
+  protected $name;
+
+  /**
+   * Enhanced control statements
+   *
+   * @var string
+   */
+  protected $statement;
+
+  /**
+   * Enhanced control guidance
+   *
+   * @var string
+   */
+  protected $guidance;
+
+  /**
+   * Constructor
+   */
+  public function __construct() {
+
+  }
+
+  /**
+   * Getter function for the enhanced control ID
+   *
+   * @return string
+   */
+  public function get_Enhanced_ID() {
+    return $this->enh_id;
+  }
+
+  /**
+   * Setter function for the enhanced control ID
+   *
+   * @param string $enh_id_in
+   */
+  public function set_Enhanced_ID($enh_id_in) {
+    $this->enh_id = $enh_id_in;
+  }
+
+  /**
+   * Getter function for the enhanced control name
+   *
+   * @return string
+   */
+  public function get_Name() {
+    return $this->name;
+  }
+
+  /**
+   * Setter function for the enhanced control name
+   *
+   * @param string $name_in
+   */
+  public function set_Name($name_in) {
+    $this->name = $name_in;
+  }
+
+  /**
+   * Getter function for enhanced control statements
+   *
+   * @return string
+   */
+  public function get_Statement() {
+    return $this->statement;
+  }
+
+  /**
+   * Setter function for enhanced control statements
+   *
+   * @param string $statement_in
+   */
+  public function set_Statement($statement_in) {
+    $this->statement = $statement_in;
+  }
+
+  /**
+   * Getter function for enhanced control guidance
+   *
+   * @return string
+   */
+  public function get_Guidance() {
+    return $this->guidance;
+  }
+
+  /**
+   * Setter function for enhanced control guidance
+   *
+   * @param string $guidance_in
+   */
+  public function set_Guidance($guidance_in) {
+    $this->guidance = $guidance_in;
+  }
+
+}

classes/scan.inc

@@ -0,0 +1,612 @@
+<?php
+/**
+ * File: scan.inc
+ * Author: Ryan Prather
+ * Purpose: Represents an imported scan
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ *  - Sep 1, 2016 - Updated Copyright and Merge result_script & scan classes
+ *  - Oct 24, 2016 - Updated function headers and format
+ *  - Nov 7, 2016 - Make sure get_Total_Host_Count() returns an integer
+ *  - Apr 5, 2017 - Formatting
+ *  - Jan 16, 2018 - Updated to use host_list class
+ */
+define("IN_QUEUE", "IN QUEUE");
+define("RUNNING", "RUNNING");
+define("COMPLETE", "COMPLETE");
+define("ERROR", "ERROR");
+define("TERMINIATED", "TERMINATED");
+
+require_once 'host_list.inc';
+
+/**
+ * Represents an imported scan
+ *
+ * @author Ryan Prather
+ */
+class scan
+{
+
+    /**
+     * Scan ID
+     *
+     * @var integer
+     */
+    protected $id = 0;
+
+    /**
+     * Source
+     *
+     * @var source
+     */
+    protected $src = null;
+
+    /**
+     * ST&E
+     *
+     * @var ste
+     */
+    protected $ste = null;
+
+    /**
+     * Interation (in case the same scan is imported multiple times)
+     *
+     * @var integer
+     */
+    protected $itr = 0;
+
+    /**
+     * File name of the imported file
+     *
+     * @var string
+     */
+    protected $file_name = '';
+
+    /**
+     * File date of the imported file (for configuration management)
+     *
+     * @var string
+     */
+    protected $file_date = '';
+
+    /**
+     * Array of hosts
+     *
+     * @var array
+     */
+    protected $host_list = array();
+
+    /**
+     * Scan notes
+     *
+     * @var string
+     */
+    protected $notes = '';
+
+    /**
+     * Process ID (PID) of the executing script
+     *
+     * @var integer
+     */
+    protected $pid = 0;
+
+    /**
+     * Enum defining the type of script
+     *
+     * @var file_types
+     */
+    protected $type = null;
+
+    /**
+     * Date/time the script started
+     *
+     * @var DateTime
+     */
+    protected $start_time = null;
+
+    /**
+     * Date/time the script was updated
+     *
+     * @var DateTime
+     */
+    protected $last_update = null;
+
+    /**
+     * Enum script status
+     *
+     * @var string
+     */
+    protected $status = 0;
+
+    /**
+     * Percentage of completion
+     *
+     * @var float
+     */
+    protected $perc_comp = 0.0;
+
+    /**
+     * The last host that was imported
+     *
+     * @var string
+     */
+    protected $last_host = '';
+
+    /**
+     * Number of hosts that have been completely imported
+     *
+     * @var integer
+     */
+    protected $host_complete_count = 0;
+
+    /**
+     * Number of hosts in the result file
+     *
+     * @var integer
+     */
+    protected $host_count = 0;
+
+    /**
+     * Variable to store if there is an error in a given scan
+     *
+     * @var boolean
+     */
+    protected $scanner_error = false;
+
+    /**
+     * Constructor
+     *
+     * @param integer $int_ID
+     * @param source $src_in
+     * @param ste $ste_in
+     * @param integer $int_Itr
+     * @param string $str_File_Name
+     * @param string $str_File_Date
+     */
+    public function __construct($int_ID, $src_in, $ste_in, $int_Itr, $str_File_Name, $str_File_Date)
+    {
+        $this->id        = $int_ID;
+        $this->src       = $src_in;
+        $this->ste       = $ste_in;
+        $this->itr       = $int_Itr;
+        $this->file_date = $str_File_Date;
+        $this->file_name = $str_File_Name;
+    }
+
+    /**
+     * Getter function for Id
+     *
+     * @return integer
+     */
+    public function get_ID()
+    {
+        return $this->id;
+    }
+
+    /**
+     * Setter function for the scan ID
+     *
+     * @param integer $int_ID
+     */
+    public function set_ID($int_ID)
+    {
+        $this->id = $int_ID;
+    }
+
+    /**
+     * Getter function for source
+     *
+     * @return source
+     */
+    public function get_Source()
+    {
+        return $this->src;
+    }
+
+    /**
+     * Getter function for STE
+     *
+     * @return ste
+     */
+    public function get_STE()
+    {
+        return $this->ste;
+    }
+
+    /**
+     * Getter function for iteration
+     *
+     * @return integer
+     */
+    public function get_Itr()
+    {
+        return $this->itr;
+    }
+
+    /**
+     * Setter function to increase the iteration for this scan
+     */
+    public function inc_Itr()
+    {
+        $this->itr++;
+    }
+
+    /**
+     * Getter function for file name
+     *
+     * @return string
+     */
+    public function get_File_Name()
+    {
+        return $this->file_name;
+    }
+
+    /**
+     * Getter function for file date
+     *
+     * @return string
+     */
+    public function get_File_Date()
+    {
+        return $this->file_date;
+    }
+
+    /**
+     * Getter function for file date in DateTime
+     *
+     * @return DateTime
+     */
+    public function get_File_DateTime()
+    {
+        return new DateTime($this->file_date);
+    }
+
+    /**
+     * Setter function for file date
+     *
+     * @param string|DateTime $dt_in
+     */
+    public function set_File_DateTime($dt_in)
+    {
+        if (is_string($dt_in)) {
+            $this->file_date = $dt_in;
+        }
+        else {
+            $this->file_date = $dt_in->format("Y-m-d H:i:s");
+        }
+    }
+
+    /**
+     * Getter method for scanner error
+     *
+     * @return bool
+     */
+    public function isScanError()
+    {
+        return $this->scanner_error;
+    }
+
+    /**
+     * Setter method for scanner error
+     *
+     * @param bool $scanError
+     */
+    public function setScanError(bool $scanError)
+    {
+        $this->scanner_error = $scanError;
+    }
+
+    /**
+     * Function to add a target and finding count to the host list
+     *
+     * @param host_list $hl
+     */
+    public function add_Target_to_Host_List($hl)
+    {
+        $this->host_list[$hl->getTargetId()] = $hl;
+    }
+
+    /**
+     * Function to replace the host list array
+     *
+     * @param host_list:array $host_list_in
+     */
+    public function add_Target_Array_to_Host_List($host_list_in)
+    {
+        $this->host_list = $host_list_in;
+    }
+
+    /**
+     * Getter function for host list array
+     *
+     * @return array
+     */
+    public function get_Host_List()
+    {
+        return $this->host_list;
+    }
+
+    /**
+     * Getter function for scan notes
+     *
+     * @return string
+     */
+    public function get_Notes()
+    {
+        return $this->notes;
+    }
+
+    /**
+     * Setter function for scan notes
+     *
+     * @param string $notes_in
+     */
+    public function set_Notes($notes_in)
+    {
+        $this->notes = $notes_in;
+    }
+
+    /**
+     * Getter function to retrieve number of hosts in the host list array
+     *
+     * @return integer
+     */
+    public function get_Host_List_Count()
+    {
+        return count($this->host_list);
+    }
+
+    /**
+     * Getter function for pre-formatted host list table row
+     *
+     * @return string
+     */
+    public function get_Host_List_Table()
+    {
+        $ret      = '';
+        $count    = 0;
+        $findings = 0;
+        foreach ($this->host_list as $host) {
+            $count++;
+            $findings += $host->getFindingCount();
+
+            $ret .= "<tr>" .
+                "<td>{$count}</td>" .
+                "<td>{$host->getTargetName()}</td>" .
+                "<td>{$host->getFindingCount()}</td>" .
+                "<td>{$host->getTargetIp()}</td>" .
+                "<td>" . ($host->getScanError() ? "<img src='/img/error.png' class='checklist_image' title='{$host->getScanError()}' />" : "") . "</td>" .
+                "</tr>";
+        }
+
+        return [
+            $findings,
+            $ret
+        ];
+    }
+
+    /**
+     * Getter function for the process ID
+     *
+     * @return int
+     */
+    public function get_PID()
+    {
+        return ($this->pid ? $this->pid : 0);
+    }
+
+    /**
+     * Setter function for the process ID
+     *
+     * @param int $pid_in
+     */
+    public function set_PID($pid_in)
+    {
+        $this->pid = $pid_in;
+    }
+
+    /**
+     * Getter function for the scan type
+     *
+     * @return file_types
+     */
+    public function get_Type()
+    {
+        return $this->type;
+    }
+
+    /**
+     * Setter function for the scan type
+     *
+     * @param file_types $type_in
+     */
+    public function set_Type($type_in)
+    {
+        $this->type = $type_in;
+    }
+
+    /**
+     * Getter function for the start date/time of the script
+     *
+     * @return DateTime
+     */
+    public function get_Start_Time()
+    {
+        if (!is_a($this->start_time, "DateTime")) {
+            return new DateTime();
+        }
+        return $this->start_time;
+    }
+
+    /**
+     * Setter function for the start date/time of the script
+     *
+     * @param DateTime $start_time_in
+     */
+    public function set_Start_Time($start_time_in)
+    {
+        if (is_a($start_time_in, "DateTime")) {
+            $this->start_time = $start_time_in;
+        }
+        else {
+            $this->start_time = new DateTime($start_time_in);
+        }
+    }
+
+    /**
+     * Getter function for the last update of the script
+     *
+     * @return DateTime
+     */
+    public function get_Last_Update()
+    {
+        if (!is_a($this->last_update, "DateTime")) {
+            return new DateTime();
+        }
+        return $this->last_update;
+    }
+
+    /**
+     * Setter function for the last update DateTime the script was updated
+     *
+     * @param DateTime $last_update_in
+     */
+    public function set_Last_Update($last_update_in)
+    {
+        if (is_a($last_update_in, "DateTime")) {
+            $this->last_update = $last_update_in;
+        }
+        else {
+            $this->last_update = new DateTime($last_update_in);
+        }
+    }
+
+    /**
+     * Getter function for the script status
+     *
+     * @return string
+     */
+    public function get_Status()
+    {
+        return $this->status;
+    }
+
+    /**
+     * Setter function for the script status
+     *
+     * @param string $status_in
+     */
+    public function set_Status($status_in)
+    {
+        $this->status = $status_in;
+    }
+
+    /**
+     * Getter function for the percentage the script has completed
+     *
+     * @return float
+     */
+    public function get_Percentage_Complete()
+    {
+        return number_format($this->perc_comp, 2);
+    }
+
+    /**
+     * Setter function for the percentage the script has completed
+     *
+     * @param float $perc_comp_in
+     */
+    public function set_Percentage_Complete($perc_comp_in)
+    {
+        $this->perc_comp = $perc_comp_in;
+    }
+
+    /**
+     * Getter function for the last host the scan completed parsing
+     *
+     * @return string
+     */
+    public function get_Last_Host()
+    {
+        return $this->last_host;
+    }
+
+    /**
+     * Setter function for the last host that the scan completed
+     *
+     * @param string $last_host_in
+     */
+    public function set_Last_Host($last_host_in)
+    {
+        $this->last_host = $last_host_in;
+    }
+
+    /**
+     * Getter function for the number of hosts complete
+     *
+     * @return int
+     */
+    public function get_Host_Complete_Count()
+    {
+        return $this->host_complete_count;
+    }
+
+    /**
+     * Increment the number of hosts complete
+     */
+    public function inc_Host_Complete_Count()
+    {
+        $this->host_complete_count++;
+    }
+
+    /**
+     * Getter function for the number of hosts in the scan file
+     *
+     * @return int
+     */
+    public function get_Total_Host_Count()
+    {
+        return ($this->host_count ? $this->host_count : 0);
+    }
+
+    /**
+     * Setter function for the total host in the scan file
+     *
+     * @param int $total_host_count_in
+     */
+    public function set_Total_Host_Count($total_host_count_in)
+    {
+        $this->host_count = $total_host_count_in;
+    }
+
+    /**
+     * Function to return string of the td row for the upload progress page
+     *
+     * @return string
+     */
+    public function get_Task_Row()
+    {
+        $ret = "<tr id='" . str_replace([" ", "(", ")"], ["_", "", ""], $this->file_name) . "'>" .
+            "<td>{$this->src->get_Name()}</td>" .
+            "<td>{$this->file_name}</td>" .
+            "<td>{$this->start_time->format("H:i:s")}</td>" .
+            "<td>{$this->last_update->format("H:i:s")}</td>" .
+            "<td>{$this->status}</td>" .
+            "<td><progress max='100' value='{$this->perc_comp}' data-value='{$this->perc_comp}'></progress></td>" .
+            "<td></td>" .
+            "</tr>";
+
+        return $ret;
+    }
+}

classes/script.inc

@@ -0,0 +1,275 @@
+<?php
+
+/**
+ * File: script.inc
+ * Author: Ryan Prather
+ * Purpose: To instantiate a script object that can run on the system
+ * Created: Sep 27, 2013
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 27, 2013 - File created
+ *  - Sep 1, 2016 - Updated Copyright and removed result_script and script_type classes due to merger with scan class
+ */
+
+/**
+ *
+ * @author Ryan Prather
+ *
+ */
+class script {
+
+  /**
+   * ID
+   *
+   * @var integer
+   */
+  protected $id = 0;
+
+  /**
+   * Script name
+   *
+   * @var string
+   */
+  protected $name = '';
+
+  /**
+   * Script file name
+   *
+   * @var string
+   */
+  protected $file_name = '';
+
+  /**
+   * Script arguments
+   *
+   * @var array:string
+   */
+  protected $args = array();
+
+  /**
+   * Last update
+   *
+   * @var DateTime
+   */
+  protected $updated;
+
+  /**
+   * Script path
+   *
+   * @var string
+   */
+  protected $path = '';
+
+  /**
+   * Script version
+   *
+   * @var string
+   */
+  protected $version = '';
+
+  /**
+   * Call back function
+   *
+   * @var string
+   */
+  protected $function = '';
+
+  /**
+   * Script type
+   *
+   * @var string
+   */
+  protected $type = '';
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_ID
+   * @param string $str_Name
+   * @param string $str_File_Name
+   * @param string $str_Args
+   * @param string $dt_Updated
+   * @param string $str_Path
+   * @param string $str_Version
+   * @param string $str_Function
+   * @param string $str_Type
+   */
+  public function __construct($int_ID, $str_Name, $str_File_Name, $str_Args, $dt_Updated, $str_Path, $str_Version, $str_Function, $str_Type) {
+    $this->id = $int_ID;
+    $this->name = $str_Name;
+    $this->file_name = $str_File_Name;
+    $this->args = unserialize($str_Args);
+    $this->updated = new DateTime($dt_Updated);
+    $this->path = $str_Path;
+    $this->version = $str_Version;
+    $this->function = $str_Function;
+    $this->type = $str_Type;
+  }
+
+  /**
+   * Getter function for ID
+   *
+   * @return integer
+   */
+  public function get_ID() {
+    return $this->id;
+  }
+
+  /**
+   * Getter function for name
+   *
+   * @return string
+   */
+  public function get_Name() {
+    return $this->name;
+  }
+
+  /**
+   * Getter function for file name
+   *
+   * @return string
+   */
+  public function get_File_Name() {
+    return $this->file_name;
+  }
+
+  /**
+   * Getter function for script arguments
+   *
+   * @return multitype:string
+   */
+  public function get_Args() {
+    return $this->args;
+  }
+
+  /**
+   * Getter function for update
+   *
+   * @return DateTime
+   */
+  public function get_Update() {
+    return $this->updated;
+  }
+
+  /**
+   * Getter function for path
+   *
+   * @return string
+   */
+  public function get_Path() {
+    return $this->path;
+  }
+
+  /**
+   * Getter function for script version
+   *
+   * @return string
+   */
+  public function get_Version() {
+    return $this->version;
+  }
+
+  /**
+   * Getter function for callback function
+   *
+   * @return string
+   */
+  public function get_Function() {
+    return $this->function;
+  }
+
+  /**
+   * Getter function for script type
+   *
+   * @return string
+   */
+  public function get_Type() {
+    return $this->type;
+  }
+
+  /**
+   * Getter function for preformated &lt;option&gt; tag
+   *
+   * @param boolean $selected_script
+   * @return string
+   */
+  public function get_Option($selected_script = null) {
+    return "<option value='$this->id' " . ($selected_script == $this->id ? 'selected' : '') .
+        ">$this->name</option>";
+  }
+
+}
+
+/**
+ * Class to define a catalog parsing script
+ *
+ * @author Ryan Prather
+ */
+class catalog_script {
+
+  /**
+   * The file name that the script is parsing
+   *
+   * @var string
+   */
+  public $file_name = '';
+
+  /**
+   * The process ID of the script that is running
+   *
+   * @var integer
+   */
+  public $pid = 0;
+
+  /**
+   * The time the script started
+   *
+   * @var string
+   */
+  public $start_time = '';
+
+  /**
+   * The time the script was last updated
+   *
+   * @var string
+   */
+  public $last_update = '';
+
+  /**
+   * The status of the script
+   *
+   * @var integer
+   */
+  public $status = 0;
+
+  /**
+   * The percentage that the script has completed
+   *
+   * @var float
+   */
+  public $perc_comp = 0.0;
+
+  /**
+   * The number of STIGs in the catalog file
+   *
+   * @var integer
+   */
+  public $stig_count = 0;
+
+  /**
+   * Constructor
+   */
+  public function __construct() {
+
+  }
+
+}

classes/sites.inc

@@ -0,0 +1,319 @@
+<?php
+
+/**
+ * File: sites.inc
+ * Author: Ryan Prather
+ * Purpose: This file will instantiate a site object
+ * Created: Sep 16, 2013
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 16, 2013 - File created
+ *  - Sep 1, 2016 - Updated Copyright and added comments
+ */
+
+/**
+ * Represents a physical site location where the ST&E is taking place
+ *
+ * @author Ryan Prather
+ *
+ */
+class site {
+
+  /**
+   * Site ID
+   *
+   * @var integer
+   */
+  protected $id = 0;
+
+  /**
+   * Site Name
+   *
+   * @var string
+   */
+  protected $name = '';
+
+  /**
+   * Site address
+   *
+   * @var string
+   */
+  protected $add = '';
+
+  /**
+   * Site city
+   *
+   * @var string
+   */
+  protected $city = '';
+
+  /**
+   * Site state
+   *
+   * @var string
+   */
+  protected $state = '';
+
+  /**
+   * Site zip
+   *
+   * @var string
+   */
+  protected $zip = '';
+
+  /**
+   * Site country
+   *
+   * @var string
+   */
+  protected $country = '';
+
+  /**
+   * Site POC Name
+   *
+   * @var string
+   */
+  protected $poc_name = '';
+
+  /**
+   * Site POC E-mail
+   *
+   * @var string
+   */
+  protected $poc_email = '';
+
+  /**
+   * Site POC Phone
+   *
+   * @var string
+   */
+  protected $poc_phone = '';
+
+  /**
+   * Constructor
+   *
+   * @param int $intId
+   * @param string $strName
+   * @param string $strAdd
+   * @param string $strCity
+   * @param string $strState
+   * @param string $strZip
+   * @param string $strCountry
+   * @param string $strPOC_Name
+   * @param string $strPOC_Email
+   * @param string $strPOC_Phone
+   */
+  public function __construct($intId, $strName, $strAdd, $strCity, $strState, $strZip, $strCountry, $strPOC_Name, $strPOC_Email, $strPOC_Phone) {
+    $this->id = $intId;
+    $this->name = $strName;
+    $this->add = $strAdd;
+    $this->city = $strCity;
+    $this->state = $strState;
+    $this->zip = $strZip;
+    $this->country = $strCountry;
+    $this->poc_email = $strPOC_Email;
+    $this->poc_name = $strPOC_Name;
+    $this->poc_phone = $strPOC_Phone;
+  }
+
+  /**
+   * Getter function for the site id
+   *
+   * @return integer
+   */
+  public function get_Id() {
+    return $this->id;
+  }
+
+  /**
+   * Setter function for site ID
+   *
+   * @param integer $id_in
+   */
+  public function set_ID($id_in) {
+    $this->id = $id_in;
+  }
+
+  /**
+   * Getter function for the site name
+   *
+   * @return string
+   */
+  public function get_Name() {
+    return $this->name;
+  }
+
+  /**
+   * Setter function for the site name
+   *
+   * @param string $str_Name
+   */
+  public function set_Name($str_Name) {
+    $this->name = $str_Name;
+  }
+
+  /**
+   * Getter function for the site address
+   *
+   * @return string
+   */
+  public function get_Address() {
+    return $this->add;
+  }
+
+  /**
+   * Setter function for the site address
+   *
+   * @param string $str_Address
+   */
+  public function set_Address($str_Address) {
+    $this->add = $str_Address;
+  }
+
+  /**
+   * Getter function for the site city
+   *
+   * @return string
+   */
+  public function get_City() {
+    return $this->city;
+  }
+
+  /**
+   * Setter function for the site city
+   *
+   * @param string $str_City
+   */
+  public function set_City($str_City) {
+    $this->city = $str_City;
+  }
+
+  /**
+   * Getter function for the site state
+   *
+   * @return string
+   */
+  public function get_State() {
+    return $this->state;
+  }
+
+  /**
+   * Setter function for the site state
+   *
+   * @param string $str_State
+   */
+  public function set_State($str_State) {
+    $this->state = $str_State;
+  }
+
+  /**
+   * Getter function for the site zip
+   *
+   * @return string
+   */
+  public function get_Zip() {
+    return $this->zip;
+  }
+
+  /**
+   * Setter function for the site zip
+   *
+   * @param string $str_Zip
+   */
+  public function set_Zip($str_Zip) {
+    $this->zip = $str_Zip;
+  }
+
+  /**
+   * Getter function for the site country
+   *
+   * @return string
+   */
+  public function get_Country() {
+    return $this->country;
+  }
+
+  /**
+   * Setter function for the site country
+   *
+   * @param string $str_Country
+   */
+  public function set_Country($str_Country) {
+    $this->country = $str_Country;
+  }
+
+  /**
+   * Getter function for the POC E-mail
+   *
+   * @return string
+   */
+  public function get_POC_Email() {
+    return $this->poc_email;
+  }
+
+  /**
+   * Setter function for the POC Email
+   *
+   * @param string $str_POC_Email
+   */
+  public function set_POC_Email($str_POC_Email) {
+    $this->poc_email = $str_POC_Email;
+  }
+
+  /**
+   * Getter function for the POC Name
+   *
+   * @return string
+   */
+  public function get_POC_Name() {
+    return $this->poc_name;
+  }
+
+  /**
+   * Setter for the POC Name
+   *
+   * @param string $str_POC_Name
+   */
+  public function set_POC_Name($str_POC_Name) {
+    $this->poc_name = $str_POC_Name;
+  }
+
+  /**
+   * Getter for the POC Phone
+   *
+   * @return string
+   */
+  public function get_POC_Phone() {
+    return $this->poc_phone;
+  }
+
+  /**
+   * Setter for the POC Phone
+   *
+   * @param string $str_POC_Phone
+   */
+  public function set_POC_Phone($str_POC_Phone) {
+    $this->poc_phone = $str_POC_Phone;
+  }
+
+  /**
+   * Getter function for preformated &lt;option&gt; tag
+   *
+   * @param boolean $selectedSite
+   * @return string
+   */
+  public function get_Option($selectedSite = null) {
+    return "<option value='" . $this->id . "'" . ($selectedSite ? " selected" : "") .
+        ">" . $this->name . "</option>";
+  }
+
+}

classes/software.inc

@@ -0,0 +1,707 @@
+<?php
+
+/**
+ * File: software.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a software package that can be installed on target
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ *  - Sep 1, 2016 - Updated Copyright, added a few comments, and refined the reduce_CPE functionality
+ *  - Oct 24, 2016 - Update identify_Software function replaced $chk_id with $sw_in
+ *  - Nov 7, 2016 - Removed a couple print statements
+ *  - Nov 9, 2016 - Formatting, added get_Reduce_Count function,
+ *                  Added check in identify_Software to see if $sw_in is a CPE already
+ *  - Dec 12, 2016 - Added software reduction if version contains '-'
+ *  - Mar 3, 2017 - Bug fixes to reduce_CPE method
+ */
+
+/**
+ * Represents a software package that can be installed on a target
+ *
+ * @author Ryan Prather
+ *
+ */
+class software {
+
+  /**
+   * Software ID
+   *
+   * @var integer
+   */
+  public $id = 0;
+
+  /**
+   * Software manufacturer
+   *
+   * @var string
+   */
+  public $man = '';
+
+  /**
+   * Software name
+   *
+   * @var string
+   */
+  public $name = '';
+
+  /**
+   * Software version
+   *
+   * @var string
+   */
+  public $ver = '';
+
+  /**
+   * Software build string
+   *
+   * @var string
+   */
+  public $build = '';
+
+  /**
+   * Software build date
+   *
+   * @var DateTime
+   */
+  public $date;
+
+  /**
+   * Software architecture
+   *
+   * @var string
+   *    x86, x64, ia64
+   */
+  private $arch = '';
+
+  /**
+   * Manual
+   *
+   * @var boolean
+   */
+  public $manual = false;
+
+  /**
+   * Is this software an operating system
+   *
+   * @var boolean
+   */
+  public $os = false;
+
+  /**
+   * Software service pack
+   *
+   * @var string
+   */
+  public $sp = '';
+
+  /**
+   * CPE string
+   *
+   * @var string
+   */
+  private $cpe = '';
+
+  /**
+   * CPE v2.3 string
+   *
+   * @var string
+   */
+  private $cpe23 = '';
+
+  /**
+   * The software string
+   *
+   * @var string
+   */
+  private $sw_string = '';
+
+  /**
+   * Shortened software string
+   *
+   * @var string
+   */
+  private $short_sw_string = '';
+
+  /**
+   * Variable to know how many times this software has been reduced
+   *
+   * @var int
+   */
+  private $reduce_count = 0;
+
+  /**
+   * Constructor
+   *
+   * @param string $cpe
+   * @param string $cpe23
+   */
+  public function __construct($cpe, $cpe23) {
+    $this->cpe = $cpe;
+    $this->cpe23 = $cpe23;
+
+    if (!empty($this->cpe23)) {
+      $arr = explode(":", $this->cpe23);
+
+      $this->os = ($arr[2] == 'o' ? true : false);
+      $this->man = (isset($arr[3]) ? ucwords(str_replace("_", " ", $arr[3])) : "*");
+      $this->name = (isset($arr[4]) ? ucwords(str_replace("_", " ", $arr[4])) : "*");
+      $this->ver = (isset($arr[5]) ? ucwords(str_replace("_", " ", $arr[5])) : "-");
+      $this->sp = (isset($arr[6]) ? ucwords(str_replace("_", " ", $arr[6])) : "");
+    }
+
+    if (!empty($this->cpe)) {
+      $arr = explode(":", $this->cpe);
+
+      if (empty($cpe23)) {
+        $this->os = ($arr[1] == '/o' ? true : false);
+        $this->man = (isset($arr[2]) ? ucwords(str_replace("_", " ", $arr[2])) : "*");
+        $this->name = (isset($arr[3]) ? ucwords(str_replace("_", " ", $arr[3])) : "*");
+        $this->ver = (isset($arr[4]) ? ucwords(str_replace("_", " ", $arr[4])) : "-");
+        $this->sp = (isset($arr[5]) ? ucwords(str_replace("_", " ", $arr[5])) : "");
+
+        $this->cpe23 = "cpe:2.3:" .
+            ($arr[1] == '/o' ? 'o' : 'a') . ":" .
+            $this->man . ":" .
+            $this->name . ":" .
+            $this->ver . ":" .
+            (!empty($this->sp) ? $this->sp : "*") . ":*:*:*:*:*:*";
+
+        $this->cpe23 = strtolower(str_replace(" ", "_", $this->cpe23));
+      }
+    }
+
+    $this->reduce_count = 0;
+  }
+
+  /**
+   * Getter function for Software ID
+   *
+   * @return integer
+   */
+  public function get_ID() {
+    return $this->id;
+  }
+
+  /**
+   * Setter function for Software ID
+   *
+   * @param integer $sw_id_in
+   *    Value to set the ID to
+   */
+  public function set_ID($sw_id_in) {
+    $this->id = $sw_id_in;
+  }
+
+  /**
+   * Getter function for manufacturer
+   *
+   * @return string
+   */
+  public function get_Man() {
+    return $this->man;
+  }
+
+  /**
+   * Setter function for manufacturer
+   *
+   * @param string $str_Man
+   */
+  public function set_Man($str_Man) {
+    $this->man = $str_Man;
+  }
+
+  /**
+   * Getter function for name
+   *
+   * @return string
+   */
+  public function get_Name() {
+    return $this->name;
+  }
+
+  /**
+   * Setter function for name
+   *
+   * @param string $str_Name
+   */
+  public function set_Name($str_Name) {
+    $this->name = $str_Name;
+  }
+
+  /**
+   * Getter function for version
+   *
+   * @return string
+   */
+  public function get_Version() {
+    return $this->ver;
+  }
+
+  /**
+   * Setter function for version
+   *
+   * @param string $str_Version
+   */
+  public function set_Version($str_Version) {
+    $this->ver = $str_Version;
+  }
+
+  /**
+   * Getter function for build string
+   *
+   * @return string
+   */
+  public function get_Build() {
+    return $this->build;
+  }
+
+  /**
+   * Setter function for build string
+   *
+   * @param string $str_Build
+   */
+  public function set_Build($str_Build) {
+    $this->build = $str_Build;
+  }
+
+  /**
+   * Getter funciton for build date
+   *
+   * @return DateTime
+   */
+  public function get_Build_Date() {
+    return $this->date;
+  }
+
+  /**
+   * Setter function for build date
+   *
+   * @param string $dt_Build_Date
+   */
+  public function set_Build_Date($dt_Build_Date) {
+    $this->date = new DateTime($dt_Build_Date);
+  }
+
+  /**
+   * Getter function for manual
+   *
+   * @return boolean
+   */
+  public function is_Manual() {
+    return $this->manual;
+  }
+
+  /**
+   * Setter function for manual
+   *
+   * @param boolean $bln_Manual
+   */
+  public function set_Manual($bln_Manual) {
+    $this->manual = $bln_Manual;
+  }
+
+  /**
+   * Getter function for operation system
+   *
+   * @return boolean
+   */
+  public function is_OS() {
+    return $this->os;
+  }
+
+  /**
+   * Setter function for operating system
+   *
+   * @param boolean $bln_OS
+   */
+  public function set_OS($bln_OS) {
+    $this->os = $bln_OS;
+  }
+
+  /**
+   * Getter function for service pack
+   *
+   * @return string
+   */
+  public function get_SP() {
+    return $this->sp;
+  }
+
+  /**
+   * Setter fucntion for service pack
+   *
+   * @param string $str_SP
+   */
+  public function set_SP($str_SP) {
+    $this->sp = $str_SP;
+  }
+
+  /**
+   * Getter function for software string
+   *
+   * @return string
+   */
+  public function get_SW_String() {
+    return $this->sw_string;
+  }
+
+  /**
+   * Setter function for software string
+   *
+   * @param string $sw_string_in
+   */
+  public function set_SW_String($sw_string_in) {
+    $this->sw_string = $sw_string_in;
+  }
+
+  /**
+   * To get the shortened software string
+   *
+   * @return string
+   */
+  public function get_Shortened_SW_String() {
+    return $this->short_sw_string;
+  }
+
+  /**
+   * To set the shortened software string
+   *
+   * @param string $sw_string_in
+   */
+  public function set_Shortened_SW_String($sw_string_in) {
+    $this->short_sw_string = $sw_string_in;
+  }
+
+  /**
+   * Getter function for the CPE string
+   *
+   * @return string
+   */
+  public function get_CPE($refresh = false) {
+    if ($refresh) {
+      $cpe = "cpe:" .
+          ($this->os ? "/o" : "/a") . ":" .
+          (isset($this->man) ? $this->man : "*") . ":" .
+          (isset($this->name) ? $this->name : "*") . ":" .
+          (isset($this->ver) ? $this->ver : "") .
+          (!empty($this->sp) ? ":" . $this->sp : "");
+
+      $this->cpe = strtolower(str_replace(" ", "_", $cpe));
+
+      $cpe23 = "cpe:2.3:" .
+          ($this->os ? "o" : "a") . ":" .
+          (isset($this->man) ? $this->man : "*") . ":" .
+          (isset($this->name) ? $this->name : "*") . ":" .
+          (isset($this->ver) ? $this->ver : "-") .
+          (!empty($this->sp) ? ":" . $this->sp : "") . ":*:*:*:*:*:*";
+
+      $this->cpe23 = strtolower(str_replace(" ", "_", $cpe23));
+    }
+
+    return $this->cpe;
+  }
+
+  /**
+   * Setter function for the CPE string
+   *
+   * @param string $cpe_in
+   */
+  public function set_CPE($cpe_in) {
+    $this->cpe = $cpe_in;
+  }
+
+  /**
+   * Getter function for the CPE v2.3 string
+   *
+   * @return string
+   */
+  public function get_CPE23() {
+    return $this->cpe23;
+  }
+
+  /**
+   * Setter function for the CPE v2.3 string
+   *
+   * @param string $cpe23_in
+   */
+  public function set_CPE23($cpe23_in) {
+    $this->cpe23 = $cpe23_in;
+  }
+
+  /**
+   * Getter function for the software architecture
+   *
+   * @return string
+   */
+  public function get_Arch() {
+    return $this->arch;
+  }
+
+  /**
+   * Setter function for the software architecture
+   *
+   * @param string $arch_in
+   */
+  public function set_Arch($arch_in) {
+    $this->arch = $arch_in;
+  }
+
+  /**
+   * Getter function for the reducing count
+   */
+  public function get_Reduce_Count() {
+    return $this->reduce_count;
+  }
+
+  /**
+   * Getter function for preformated option tag
+   *
+   * @return string
+   */
+  public function print_Option() {
+    return "<option value='" . $this->id . "' " .
+        "title='$this->sw_string' " .
+        ">$this->sw_string</option>";
+  }
+
+  /**
+   * Function to take the CPE from specific to generic
+   *
+   * @return boolean
+   */
+  public function reduce_CPE() {
+    switch ($this->reduce_count) {
+      case 0:
+        // this is to reduce the CPE for Cisco
+        if (($pos = strpos($this->ver, "%")) !== false) {
+          $this->ver = substr($this->ver, 0, $pos);
+        }
+        break;
+      case 1:
+        // this simply allows the removal of the SP/update
+        if (!is_null($this->sp)) {
+          $this->sp = null;
+          break;
+        }
+        if (($pos = strpos($this->ver, '-')) !== false) {
+          $this->ver = substr($this->ver, 0, ($pos > 0 ? $pos : $pos + 1));
+        }
+        break;
+      case 2:
+        // this reduces the version to remove any . so that 11.2 becomes 11
+        if (($pos = strpos($this->ver, ".")) !== false) {
+          $this->ver = substr($this->ver, 0, ($pos > 0 ? $pos : $pos + 1));
+        }
+        break;
+      case 3:
+        // this removes the version since the SP is already null
+        $this->ver = null;
+        break;
+    }
+
+    $this->cpe = (substr($this->get_CPE(true), -1) == '-' ? substr($this->get_CPE(true), 0, -1) : $this->get_CPE(true));
+
+    $this->reduce_count++;
+
+    return (is_null($this->sp) && is_null($this->ver) ? true : false);
+  }
+
+  /**
+   * Function to return the software object for this CPE string
+   *
+   * @param array $sw_in
+   *
+   * @return array:software
+   */
+  public static function toSoftwareFromArray($sw_in) {
+    $sw = array();
+    foreach ($sw_in as $s) {
+      $cpe_str = "cpe:" .
+          ($s['type'] ? "/o" : "/a") . ":" .
+          (isset($s['man']) ? $s['man'] : "*") . ":" .
+          (isset($s['name']) ? $s['name'] : "*") . ":" .
+          (isset($s['ver']) ? $s['ver'] : "-") .
+          (isset($s['sp']) && !empty($s['sp']) ? ":" . $s['sp'] : "");
+
+      $cpe_str = strtolower(
+          str_replace(
+              array(" ", "(", ")"), array("_", "%28", "%29"), $cpe_str
+          )
+      );
+
+      $sw[] = new software($cpe_str, null);
+    }
+
+    return $sw;
+  }
+
+  /**
+   * Function to attempt to identify the software
+   *
+   * @param array $regex_arr
+   *    Array of regular expressions to evaluate the software against
+   * @param string $sw_in
+   *    The string software to evaluate
+   * @param boolean $return_obj [optional]
+   *    Boolean to decide if we are returning a software object instead of an array
+   *
+   * @return array
+   */
+  public static function identify_Software($regex_arr, $sw_in, $return_obj = false) {
+    $looking = true;
+    $match = array();
+    $ret = array();
+    $start = $sw = array(
+      'man'   => null,
+      'name'  => null,
+      'ver'   => null,
+      'type'  => false,
+      'sp'    => null,
+      'build' => null
+    );
+
+    if (substr($sw_in, 0, 7) == 'cpe:2.3') {
+      return new software(null, $sw_in);
+    }
+    elseif (substr($sw_in, 0, 3) == 'cpe') {
+      return new software($sw_in, null);
+    }
+    else {
+      $end = end($regex_arr);
+      while ($looking) {
+        foreach ($regex_arr as $regex) {
+          if (preg_match("/{$regex['rgx']}/i", $sw_in)) {
+            $sw['man'] = $regex['man'];
+            $start['man'] = $regex['man'];
+
+            foreach ($regex['name'] as $regex2) {
+              if ($regex2['name_match'] || $regex2['ver_match'] || $regex2['update_match']) {
+                if (preg_match("/{$regex2['rgx']}/i", $sw_in, $match)) {
+                  $sw['name'] = $regex2['name'];
+                  if (!empty($regex2['man_override'])) {
+                    $sw['man'] = $regex2['man_override'];
+                  }
+
+                  if ($regex2['name_match']) {
+                    foreach (explode(",", $regex2['name_match']) as $idx) {
+                      if (isset($match[$idx])) {
+                        $sw['name'] .= " " . $match[$idx];
+                      }
+                    }
+                  }
+
+                  if ($regex2['ver_match']) {
+                    foreach (explode(",", $regex2['ver_match']) as $idx) {
+                      if (isset($match[$idx])) {
+                        $sw['ver'] .= $match[$idx] . " ";
+                      }
+                    }
+
+                    $sw['ver'] = str_replace("_", ".", trim($sw['ver']));
+
+                    if ($sw['man'] == 'Oracle' && $sw['name'] == 'JRE') {
+                      $sw['ver'] = "1.{$sw['ver']}.0";
+                    }
+                    elseif (substr($sw['ver'], -1) == '.') {
+                      $sw['ver'] = substr($sw['ver'], 0, -1);
+                    }
+                  }
+
+                  if (empty($sw['ver'])) {
+                    if (!empty($regex2['ver'])) {
+                      $sw['ver'] = $regex2['ver'];
+                    }
+                    else {
+                      $sw['ver'] = "-";
+                    }
+                  }
+
+                  if ($regex2['update_match']) {
+                    foreach (explode(",", $regex2['update_match']) as $idx) {
+                      if (isset($match[$idx]) && !empty($match[$idx])) {
+                        if (preg_match("/service pack [\d]+/i", $match[$idx])) {
+                          $sw['sp'] .= preg_replace("/service pack ([\d]+)/i", "sp$1", $match[$idx]) . " ";
+                        }
+                        elseif ($sw['man'] == 'Oracle' && $sw['name'] == 'JRE') {
+                          $sw['sp'] .= "update_" . $match[$idx];
+                        }
+                        else {
+                          $sw['sp'] .= $match[$idx] . " ";
+                        }
+                      }
+                    }
+
+                    $sw['sp'] = trim($sw['sp']);
+
+                    if (substr($sw['sp'], -1) == '.') {
+                      $sw['sp'] = substr($sw['sp'], 0, -1);
+                    }
+                  }
+                  else {
+                    $sw['sp'] = null;
+                  }
+
+                  $sw['type'] = $regex2['is_os'];
+                  $ret[] = $sw;
+
+                  if (!$regex2['multiple'])
+                    break;
+
+                  $sw = $start;
+                }
+              }
+              else {
+                if (preg_match("/{$regex2['rgx']}/i", $sw_in)) {
+                  $sw['name'] = $regex2['name'];
+                  if (!empty($regex2['man_override'])) {
+                    $sw['man'] = $regex2['man_override'];
+                  }
+
+                  if (!empty($regex2['ver'])) {
+                    $sw['ver'] = $regex2['ver'];
+                  }
+                  else {
+                    $sw['ver'] = "-";
+                  }
+                  $sw['type'] = $regex2['is_os'];
+                  $ret[] = $sw;
+
+                  if (!$regex2['multiple'])
+                    break;
+
+                  $sw = $start;
+                }
+              }
+            }
+
+            $looking = false;
+            break;
+          }
+
+          if ($regex == $end) {
+            $looking = false;
+            break;
+          }
+        }
+      }
+    }
+
+    if ($return_obj) {
+      $ret = software::toSoftwareFromArray($ret);
+    }
+
+    return $ret;
+  }
+
+}

classes/sources.inc

@@ -0,0 +1,109 @@
+<?php
+
+/**
+ * File: sources.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a scan source
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ *  - Sep 25, 2013 - added functions to access scan database items
+ *  - Sep 1, 2016 - Updated Copyright and added functionality for an icon for the source
+ */
+
+/**
+ * Represents a scan source
+ *
+ * @author Ryan Prather
+ *
+ */
+class source {
+
+  /**
+   * Source Id
+   *
+   * @var integer
+   */
+  protected $id = 0;
+
+  /**
+   * Source name
+   *
+   * @var string
+   */
+  protected $name = '';
+
+  /**
+   * Source icon
+   *
+   * @var string
+   */
+  protected $icon = '';
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_ID
+   * @param string $str_Name
+   */
+  public function __construct($int_ID, $str_Name) {
+    $this->id = $int_ID;
+    $this->name = $str_Name;
+  }
+
+  /**
+   * Getter function for source ID
+   *
+   * @return integer
+   */
+  public function get_ID() {
+    return $this->id;
+  }
+
+  /**
+   * Getter function for source name
+   *
+   * @return string
+   */
+  public function get_Name() {
+    return $this->name;
+  }
+
+  /**
+   * Settr function for source name
+   *
+   * @param string $str_Name
+   */
+  public function set_Name($str_Name) {
+    $this->name = $str_Name;
+  }
+
+  /**
+   * Getter function for source icon
+   *
+   * @return string
+   */
+  public function get_Icon() {
+    return $this->icon;
+  }
+
+  /**
+   * Setter function for source icon
+   *
+   * @param string $icon_in
+   */
+  public function set_Icon($icon_in) {
+    $this->icon = $icon_in;
+  }
+
+}

classes/ste.inc

@@ -0,0 +1,432 @@
+<?php
+
+/**
+ * File: ste.inc
+ * Author: Ryan Prather
+ * Purpose: Represents an ST&E
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ *  - Sep 1, 2016 - Updated Copyright and added comments
+ *  - Jan 10, 2018 - Changed $site and $system to class objects instead of ID's
+ */
+include_once 'people.inc';
+
+/**
+ * Represents the ST&E itself
+ *
+ * @author Ryan Prather
+ */
+class ste {
+
+  /**
+   * STE ID
+   *
+   * @var integer
+   */
+  protected $id = 0;
+
+  /**
+   * System ID
+   *
+   * @var site
+   */
+  protected $system = 0;
+
+  /**
+   * Site ID
+   *
+   * @var site
+   */
+  protected $site = 0;
+
+  /**
+   * Evaluation start date
+   *
+   * @var DateTime
+   */
+  protected $eval_start;
+
+  /**
+   * Evaluation end date
+   *
+   * @var DateTime
+   */
+  protected $eval_end;
+
+  /**
+   * Does this ST&amp;E contain multiple systems
+   *
+   * @var boolean
+   */
+  protected $multiple = false;
+
+  /**
+   * What is the primary ST&amp;E
+   *
+   * @var integer
+   */
+  protected $primary = 0;
+
+  /**
+   * What is the scope of the ST&amp;E
+   *
+   * @var string
+   */
+  protected $scope = '';
+
+  /**
+   * ST&amp;E Assumptions
+   *
+   * @var string
+   */
+  protected $assumptions = '';
+
+  /**
+   * ST&amp;E Constraints
+   *
+   * @var string
+   */
+  protected $constraints = '';
+
+  /**
+   * ST&amp;E Recommendations
+   *
+   * @var string
+   */
+  protected $recommendations = '';
+
+  /**
+   * Residual risk
+   *
+   * @var string
+   */
+  protected $residual_risk = '';
+
+  /**
+   * Deviations from the ST&amp;E plan
+   *
+   * @var string
+   */
+  protected $deviations = '';
+
+  /**
+   * Final conclusions of the ST&amp;E
+   *
+   * @var string
+   */
+  protected $conclusions = '';
+
+  /**
+   * Final status of the system
+   *
+   * @var string
+   */
+  protected $status = '';
+
+  /**
+   * Individual approving official
+   *
+   * @var string
+   */
+  protected $ao = '';
+
+  /**
+   * Members of the ST&E team
+   *
+   * @var array:people
+   */
+  protected $ste_team = array();
+
+  /**
+   *
+   * @param integer $id
+   * @param system $system
+   * @param site $site
+   * @param string $eval_Start
+   * @param string $eval_End
+   * @param boolean $multiple_in
+   * @param integer $primary_in
+   */
+  public function __construct($id, $system, $site, $eval_Start, $eval_End, $multiple_in, $primary_in) {
+    $this->id = $id;
+    $this->system = $system;
+    $this->site = $site;
+    $this->eval_end = new DateTime($eval_End);
+    $this->eval_start = new DateTime($eval_Start);
+    $this->multiple = $multiple_in;
+    $this->primary = $primary_in;
+  }
+
+  /**
+   * Getter function for STE ID
+   *
+   * @return integer
+   */
+  public function get_ID() {
+    return $this->id;
+  }
+
+  /**
+   * Setter function for STE ID
+   *
+   * @param integer $id_in
+   */
+  public function set_ID($id_in) {
+    $this->id = $id_in;
+  }
+
+  /**
+   * Getter function for System Id
+   *
+   * @return integer
+   */
+  public function get_System() {
+    return $this->system;
+  }
+
+  /**
+   * Getter function for Site ID
+   *
+   * @return integer
+   */
+  public function get_Site() {
+    return $this->site;
+  }
+
+  /**
+   * Getter function for evaluation start date
+   *
+   * @return DateTime
+   */
+  public function get_Eval_Start_Date() {
+    return $this->eval_start;
+  }
+
+  /**
+   * Getter function for evaluation end date
+   *
+   * @return DateTime
+   */
+  public function get_Eval_End_Date() {
+    return $this->eval_end;
+  }
+
+  /**
+   * Does this ST&E have multiple systems
+   *
+   * @return boolean
+   */
+  public function is_Multiple() {
+    return $this->multiple;
+  }
+
+  /**
+   * Getter function for primary ID
+   *
+   * @return integer
+   */
+  public function get_Primary_ID() {
+    return $this->primary;
+  }
+
+  /**
+   * Setter function for primary ID
+   *
+   * @param integer $primary_in
+   */
+  public function set_Primary_ID($primary_in) {
+    $this->primary = $primary_in;
+  }
+
+  /**
+   * Getter function for ST&amp;E Scope
+   *
+   * @return string
+   */
+  public function get_Scope() {
+    return $this->scope;
+  }
+
+  /**
+   * Setter function for ST&amp;E Scope
+   *
+   * @param string $scope_in
+   */
+  public function set_Scope($scope_in) {
+    $this->scope = $scope_in;
+  }
+
+  /**
+   * Getter function for ST&amp;E Assumptions
+   *
+   * @return string
+   */
+  public function get_Assumptions() {
+    return $this->assumptions;
+  }
+
+  /**
+   * Setter function for ST&amp;E Assumptions
+   *
+   * @param string $assumptions_in
+   */
+  public function set_Assumptions($assumptions_in) {
+    $this->assumptions = $assumptions_in;
+  }
+
+  /**
+   * Getter function for ST&amp;E Constraints
+   *
+   * @return string
+   */
+  public function get_Constraints() {
+    return $this->constraints;
+  }
+
+  /**
+   * Setter function for ST&amp;E Constraints
+   *
+   * @param string $constraints_in
+   */
+  public function set_Constraints($constraints_in) {
+    $this->constraints = $constraints_in;
+  }
+
+  /**
+   * Getter function for ST&amp;E Deviations
+   *
+   * @return string
+   */
+  public function get_Deviations() {
+    return $this->deviations;
+  }
+
+  /**
+   * Setter function for ST&amp;E Deviations
+   *
+   * @param string $deviation_in
+   */
+  public function set_Deviations($deviation_in) {
+    $this->deviations = $deviation_in;
+  }
+
+  /**
+   * Getter functions for ST&amp;E Recommendations
+   *
+   * @return string
+   */
+  public function get_Recommendations() {
+    return $this->recommendations;
+  }
+
+  /**
+   * Setter function for ST&amp;E Recommendations
+   *
+   * @param string $recommendations_in
+   */
+  public function set_Recommendations($recommendations_in) {
+    $this->recommendations = $recommendations_in;
+  }
+
+  /**
+   * Getter function for ST&amp;E Residual Risk
+   *
+   * @return string
+   */
+  public function get_Residual_Risk() {
+    return $this->residual_risk;
+  }
+
+  /**
+   * Setter function for ST&amp;E Residual Risk
+   *
+   * @param string $residual_risk_in
+   */
+  public function set_Residual_Risk($residual_risk_in) {
+    $this->residual_risk = $residual_risk_in;
+  }
+
+  /**
+   * Getter function for ST&amp;E Conclusions
+   *
+   * @return string
+   */
+  public function get_Conclusions() {
+    return $this->conclusions;
+  }
+
+  /**
+   * Setter function for ST&amp;E Conclusions
+   *
+   * @param string $conclusions_in
+   */
+  public function set_Conclusions($conclusions_in) {
+    $this->conclusions = $conclusions_in;
+  }
+
+  /**
+   * Getter function for the ST&amp;E status
+   *
+   * @return string
+   */
+  public function get_Status() {
+    return $this->status;
+  }
+
+  /**
+   * Setter function for the ST&amp;E status
+   *
+   * @param string $str_status
+   */
+  public function set_Status($str_status) {
+    $this->status = $str_status;
+  }
+
+  /**
+   * Getter function for the approving official
+   *
+   * @return string
+   */
+  public function get_AO() {
+    return $this->ao;
+  }
+
+  /**
+   * Setter function for the approving official
+   *
+   * @param string $str_ao
+   */
+  public function set_AO($str_ao) {
+    $this->ao = $str_ao;
+  }
+
+  /**
+   * Getter function for the ST&amp;E team members
+   *
+   * @return array:people
+   */
+  public function get_STE_Team() {
+    return $this->ste_team;
+  }
+
+  /**
+   * Function to add team members to the ST&amp;E
+   *
+   * @param people $people
+   */
+  public function add_STE_Team_Member($people) {
+    $this->ste_team[] = $people;
+  }
+
+}

classes/ste_cat.inc

@@ -0,0 +1,445 @@
+<?php
+/**
+ * File: ste_cat.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a category that is assigned to an ST&E
+ * Created: Sep 16, 2013
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 16, 2013 - File created
+ *  - Sep 1, 2016 - Updated Copyright, added category editing,
+ * 					Added functionality for expected sources in this category,
+ * 					Converted category row to use div tags,
+ * 					Added vertical menu to accessing other functionality
+ * - Nov 21, 2016 - Added exclusion for Unassigned category so that the export button is not displayed
+ * - Dec 7, 2016 - Disabled eChecklist export on Unassigned category
+ * - Jan 30, 2017 - Removed eChecklist export for the Unassigned category and added autocategorization for Unassigned category
+ * - Feb 15, 2017 - Added Export CKL link in vertical menu.  Need to add functionality to do that.
+ * - Feb 21, 2017 - Removed above Export CKL link in favor of writing a command script
+ * - Apr 5, 2017 - Removed "Rename Cat" vertical menu item, formatting, and expanded functionality of the add_Sources method
+ * - Apr 7, 2017 - Removed vertical menu for "Unassigned" category
+ * - Apr 11, 2017 - Make "Add target" open in new tab
+ * - May 13, 2017 - Added "Export CKL" to category header dropdown
+ * - Jan 10, 2018 - Formatting, added getSTECatRow method for /ste/stats.php and getSourceIDs method
+ */
+
+/**
+ * Represents the ST&E categories
+ *
+ * @author Ryan Prather
+ */
+class ste_cat
+{
+
+    /**
+     * category ID
+     *
+     * @var integer
+     */
+    protected $id = 0;
+
+    /**
+     * STE ID
+     *
+     * @var integer
+     */
+    protected $ste_id = 0;
+
+    /**
+     * category name
+     *
+     * @var string
+     */
+    protected $name = '';
+
+    /**
+     * Analyst in charge of category
+     *
+     * @var string
+     */
+    protected $analyst = '';
+
+    /**
+     * Array of sources that are expected in the category
+     *
+     * @var array:sources
+     */
+    protected $sources = [];
+
+    /**
+     * Variable to store count of Open findings in all targets in this category
+     *
+     * @var integer
+     */
+    public $open = 0;
+
+    /**
+     * Variable to store count of Not a Finding findings in all targets in this category
+     *
+     * @var integer
+     */
+    public $nf = 0;
+
+    /**
+     * Variable to store count of Not Reviewed findings in all targets in this category
+     *
+     * @var integer
+     */
+    public $nr = 0;
+
+    /**
+     * Variable to store count of Not Applicable findings in all targets in this category
+     *
+     * @var integer
+     */
+    public $na = 0;
+
+    /**
+     * Variable to store total number of PDIs
+     *
+     * @var integer
+     */
+    public $total = 0;
+
+    /**
+     * Variable to store target count
+     *
+     * @var integer
+     */
+    public $tgt_count = 0;
+
+    /**
+     * Constructor
+     *
+     * @param integer $int_ID
+     * @param integer $int_STE_ID
+     * @param string $str_Name
+     * @param string $str_Analyst
+     */
+    public function __construct($int_ID, $int_STE_ID, $str_Name, $str_Analyst)
+    {
+        $this->id      = $int_ID;
+        $this->ste_id  = $int_STE_ID;
+        $this->name    = $str_Name;
+        $this->analyst = $str_Analyst;
+    }
+
+    /**
+     * Getter function for ID
+     *
+     * @return integer
+     */
+    public function get_ID()
+    {
+        return $this->id;
+    }
+
+    /**
+     * Setter function for ID
+     *
+     * @param integer $id_in
+     */
+    public function set_ID($id_in)
+    {
+        $this->id = $id_in;
+    }
+
+    /**
+     * Getter function for STE ID
+     *
+     * @return integer
+     */
+    public function get_STE_ID()
+    {
+        return $this->ste_id;
+    }
+
+    /**
+     * Getter function for name
+     *
+     * @return string
+     */
+    public function get_Name()
+    {
+        return $this->name;
+    }
+
+    /**
+     * Getter function for analyst
+     *
+     * @return string
+     */
+    public function get_Analyst()
+    {
+        return $this->analyst;
+    }
+
+    /**
+     * Getter function for the expected scan source array
+     *
+     * @return array:source
+     */
+    public function get_Sources()
+    {
+        return $this->sources;
+    }
+
+    /**
+     * Getter function to return array of source IDs
+     *
+     * @return array:integer
+     */
+    public function getSourceIDs()
+    {
+        $ret = [];
+        if (is_array($this->sources) && count($this->sources)) {
+            foreach ($this->sources as $s) {
+                $ret[] = $s->get_ID();
+            }
+        }
+
+        return $ret;
+    }
+
+    /**
+     * Function to add an expected scan source to the category
+     * @param source $src
+     */
+    public function add_Source($src)
+    {
+        if (is_array($src) && count($src) && isset($src[0]) && is_a($src[0], 'source')) {
+            $this->sources[$src[0]->get_ID()] = $src[0];
+        }
+        elseif (is_a($src, 'source')) {
+            $this->sources[$src->get_ID()] = $src;
+        }
+    }
+
+    /**
+     * Function to remove an expected scan source from the category
+     *
+     * @param source $src
+     */
+    public function remove_Source($src)
+    {
+        unset($this->sources[$src->get_ID()]);
+    }
+
+    /**
+     * Getter function for preformated option tag
+     *
+     * @return string
+     */
+    public function get_Option()
+    {
+        return "<option value='" . $this->id . "'>" . $this->name . "</option>";
+    }
+
+    /**
+     * Getter function for preformated table row
+     *
+     * @param integer$intCount
+     * @param mixed$status_count
+     *
+     * @return string
+     */
+    public function get_Table_Row($intCount = 0, $status_count = null)
+    {
+        $nf   = 0;
+        $open = 0;
+        $na   = 0;
+        if (!is_null($status_count)) {
+            if (isset($status_count['nf'])) {
+                $nf = $status_count['nf'];
+            }
+
+            if (isset($status_count['na'])) {
+                $na = $status_count['na'];
+            }
+
+            if (isset($status_count['open'])) {
+                $open = $status_count['open'];
+            }
+        }
+
+        $cat_sources = array();
+        if (is_array($this->sources) && count($this->sources)) {
+            foreach ($this->sources as $src) {
+                $cat_sources[] = $src->get_ID();
+            }
+        }
+
+        $sources   = json_encode($cat_sources);
+        $link      = ($this->name != 'Unassigned' ? "<a href='javascript:void(0);' onclick='open_echecklist({$this->id});'>{$this->name}</a>" : $this->name);
+        $analyst   = ($this->analyst ? "&nbsp;&nbsp;({$this->analyst})" : "");
+        $export    = ($this->name != 'Unassigned' ?
+            "<a href='/ste/export.php?cat={$this->id}' target='_new'>" .
+            "<img src='/img/export.jpg' class='cat_icons' title='Export eChecklist' />" .
+            "</a>" :
+            "<img src='/img/move.jpg' class='cat_icons' title='Autocategorize targets' onclick='javascript:auto_cat();' />"
+            );
+        $vert_menu = ($this->name != 'Unassigned' ? $this->get_Vert_Option_Menu() : '');
+
+        return <<<EOC
+<div class='table-cat' id='cat_{$this->id}'>
+    <input type='hidden' id='cat_{$this->id}_dl' value='0' />
+    <input type='hidden' id='cat_sources_{$this->id}' value='{$sources}' />
+    <span class='cat-cell' style='width:200px;'>
+        <span class='cat-cell' style=''>
+            <i class='far toggler fa-plus-square' id='collapse_{$this->id}' data-id='{$this->id}' title='Expand/Collapse All'></i>
+        </span>
+        <span class='cat-cell' style=''>
+            <img src='/img/select_all.png' class='cat_icons' title='Select All/None' onclick='javascript:select("{$this->id}");' />
+        </span>
+        <span class='nf cat-cell' style='min-width:25px;' title='Not a Finding'>{$nf}</span>
+        <span class='open cat-cell' style='min-width:25px;' title='Open'>{$open}</span>
+        <span class='na cat-cell' style='min-width:25px;' title='Not Applicable'>{$na}</span>
+    </span>
+    <span class='cat-cell' style='width:800px;' id='cat_name_{$this->id}'>
+        {$link} ({$intCount}){$analyst}
+    </span>
+    <span class='cat-cell' style='width:200px;'>
+        <span class='cat-cell' style=''>
+            $export
+        </span>
+        <span class='cat-cell' style=''>
+            <form method='post' style='display: inline;' action='index.php' id='assign_{$this->id}'>
+                <input type='hidden' name='action' value='assign' />
+                <input type='hidden' name='ste' value='{$this->ste_id}' />
+                <input type='hidden' name='cat_id' value='{$this->id}' />
+                <input type='hidden' name='analyst' id='analyst_{$this->id}' value='' />
+                <img src='/img/assign-to.png' class='cat_icons' title='Assign category to analyst' onclick='assign("{$this->id}");' />
+            </form>
+        </span>
+        $vert_menu
+    </span>
+</div>
+
+EOC;
+    }
+
+    /**
+     * Getter function for preformated table row
+     *
+     * @param mixed $status_count
+     *
+     * @return string
+     */
+    public function getSTECatRow($status_count = null)
+    {
+        $nf   = "0%";
+        $nr   = "0%";
+        $na   = "0%";
+        $open = "0%";
+        if (!is_null($status_count)) {
+            if (isset($status_count['nf'])) {
+                $nf = number_format(($status_count['nf'] / $this->total) * 100, 0) . "%";
+            }
+
+            if (isset($status_count['na'])) {
+                $na = number_format(($status_count['na'] / $this->total) * 100, 0) . "%";
+            }
+
+            if (isset($status_count['open'])) {
+                $open = number_format(($status_count['open'] / $this->total) * 100, 0) . "%";
+            }
+
+            if (isset($status_count['nr'])) {
+                $nr = number_format(($status_count['nr'] / $this->total) * 100, 0) . "%";
+            }
+        }
+        else {
+            if ($this->total - $this->nr > 0) {
+                $nf   = ($this->total ? number_format(($this->nf / ($this->total - $this->nr)) * 100, 0) . "%" : "0%");
+                $na   = ($this->total ? number_format(($this->na / ($this->total - $this->nr)) * 100, 0) . "%" : "0%");
+                $open = ($this->total ? number_format(($this->open / ($this->total - $this->nr) * 100), 0) . "%" : "0%");
+            }
+            $nr = ($this->total ? number_format(($this->nr / $this->total) * 100, 0) . "%" : "0%");
+        }
+
+        $cat_sources = [];
+        if (is_array($this->sources) && count($this->sources)) {
+            foreach ($this->sources as $src) {
+                $cat_sources[] = $src->get_ID();
+            }
+        }
+
+        $sources   = json_encode($cat_sources);
+        $link      = ($this->name != 'Unassigned' ? "<a href='javascript:void(0);' onclick='open_echecklist({$this->id});'>{$this->name}</a>" : $this->name);
+        $analyst   = ($this->analyst ? "&nbsp;&nbsp;({$this->analyst})" : "");
+        $export    = ($this->name != 'Unassigned' ?
+            "<a href='/ste/export.php?cat={$this->id}' target='_new'>" .
+            "<img src='/img/export.jpg' class='cat_icons' title='Export eChecklist' />" .
+            "</a>" :
+            "<img src='/img/move.jpg' class='cat_icons' title='Autocategorize targets' onclick='javascript:auto_cat();' />"
+            );
+        $vert_menu = ($this->name != 'Unassigned' ? $this->get_Vert_Option_Menu() : '');
+        return <<<EOC
+<div class='table-cat' id='cat_{$this->id}'>
+    <input type='hidden' id='cat_{$this->id}_dl' value='0' />
+    <input type='hidden' id='cat_sources_{$this->id}' value='{$sources}' />
+    <span class='cat-cell' style='width:250px;'>
+        <span class='cat-cell'>
+            <i class='far toggler fa-plus-square' id='collapse_{$this->id}' data-id='{$this->id}' title='Expand/Collapse All'> </i>
+        </span>
+        <span class='cat-cell'>
+            <img src='/img/select_all.png' class='cat_icons' title='Select All/None' onclick='javascript:select("{$this->id}");' />
+        </span>
+        <span class='open cat-cell' style='width:50px;' title='Open'>{$open}</span>
+        <span class='nf cat-cell' style='width:50px;' title='Not a Finding'>{$nf}</span>
+        <span class='na cat-cell' style='width:50px;' title='Not Applicable'>{$na}</span>
+        <span class='nr cat-cell' style='width:50px;' title='Not Reviewed'>{$nr}</span>
+    </span>
+    <span class='cat-cell' style='width:700px;' id='cat_name_{$this->id}'>$link&nbsp;&nbsp;({$this->tgt_count})$analyst</span>
+    <span class='cat-cell' style='width:250px;'>
+        <span class='cat-cell' style=''>{$export}</span>
+        <span class='cat-cell' style=''>
+            <form method='post' style='display: inline;' action='index.php' id='assign_{$this->id}'>
+                <input type='hidden' name='action' value='assign' />
+                <input type='hidden' name='ste' value='{$this->ste_id}' />
+                <input type='hidden' name='cat_id' value='{$this->id}' />
+                <input type='hidden' name='analyst' id='analyst_{$this->id}' value='' />
+                <img src='/img/assign-to.png' class='cat_icons' title='Assign category to analyst' onclick='assign("{$this->id}");' />
+            </form>
+        </span>
+        $vert_menu
+    </span>
+</div>
+EOC;
+    }
+
+    /**
+     * Function to create vertical menu
+     *
+     * @return string
+     */
+    public function get_Vert_Option_Menu()
+    {
+        return <<<EOC
+<dl id='menu'>
+    <dt onmouseover='javascript:montre("smenu{$this->id}");'>
+        <img src='/img/options.png' style='width:20px;vertical-align:middle;' />
+    </dt>
+    <dd id='smenu{$this->id}' onmouseover='javascript:montre("smenu{$this->id}");' onmouseout='javascript:montre();'>
+        <ul>
+            <li><a href='/ste/target.php?ste={$this->ste_id}&cat={$this->id}' target='_blank'>Add Target</a></li>
+            <li><a href='javascript:void(0);' onclick='javascript:edit_cat({$this->id});'>Edit Category</a></li>
+            <li><a href='javascript:void(0);' onclick='javascript:delete_cat({$this->id});'>Delete Category</a></li>
+            <li><a href='interview.php?cat={$this->id}' target='_new'>Category Interview</a></li>
+            <li><a href='bulk_edit.php?cat={$this->id}'>Bulk Edit</a></li>
+            <li><a href='javascript:void(0);' onclick='javascript:export_ckl({$this->id});'>Export CKL</a></li>
+        </ul>
+    </dd>
+</dl>
+EOC;
+    }
+}

classes/stigs.inc

@@ -0,0 +1,132 @@
+<?php
+
+/**
+ * File: stigs.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a DISA Security Technical Implementation Guide (STIG) item
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ */
+
+/**
+ * Represents a DISA STIG scan
+ *
+ * @author Ryan Prather
+ *
+ */
+class stig {
+
+  /**
+   * PDI ID
+   *
+   * @var integer
+   */
+  protected $pdi_id = 0;
+
+  /**
+   * STIG ID
+   *
+   * @var string
+   */
+  protected $stig_id = '';
+
+  /**
+   * Description
+   *
+   * @var string
+   */
+  protected $description = '';
+
+  /**
+   * Tweak data function content
+   *
+   * @var string
+   */
+  protected $function = '';
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_PDI_ID
+   * @param string $str_STIG_ID
+   * @param string $str_Description
+   * @param string $str_Value
+   */
+  public function __construct($int_PDI_ID, $str_STIG_ID, $str_Description, $str_Value = null) {
+    $this->pdi_id = $int_PDI_ID;
+    $this->stig_id = $str_STIG_ID;
+    $this->description = $str_Description;
+  }
+
+  /**
+   * Getter function for PDI ID
+   *
+   * @return integer
+   */
+  public function get_PDI_ID() {
+    return $this->pdi_id;
+  }
+
+  /**
+   * Getter function for STIG ID
+   *
+   * @return string
+   */
+  public function get_ID() {
+    return $this->stig_id;
+  }
+
+  /**
+   * Setter function for STIG ID
+   *
+   * @param string $str_STIG_ID
+   */
+  public function set_ID($str_STIG_ID) {
+    $this->stig_id = $str_STIG_ID;
+  }
+
+  /**
+   * Getter function for description
+   *
+   * @return string
+   */
+  public function get_Description() {
+    return $this->description;
+  }
+
+  /**
+   * Setter function for description
+   *
+   * @param string $str_Description
+   */
+  public function set_Description($str_Description) {
+    $this->description = $str_Description;
+  }
+
+  /**
+   * Getter function for the tweak data function content
+   *
+   * @return string
+   */
+  public function get_Function() {
+    return $this->function;
+  }
+
+  /**
+   * Setter function for the tweak data function content
+   *
+   * @param string $str_Function_In
+   */
+  public function set_Function($str_Function_In) {
+    $this->function = $str_Function_In;
+  }
+
+}

classes/sv_rule.inc

@@ -0,0 +1,82 @@
+<?php
+
+/**
+ * File: sv_rule.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a DISA SV_Rule which are STIG/Software dependent
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ *  - Sep 1, 2016 - Updated Copyright and added comments
+ */
+
+/**
+ * Represents a DISA SV Rule
+ *
+ * @author Ryan Prather
+ */
+class sv_rule {
+
+  /**
+   * PDI ID
+   *
+   * @var integer
+   */
+  protected $pdi_id = 0;
+
+  /**
+   * SV Rule
+   *
+   * @var string
+   */
+  protected $sv_rule = '';
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_PDI_ID
+   * @param string $str_SV_Rule
+   */
+  public function __construct($int_PDI_ID, $str_SV_Rule) {
+    $this->pdi_id = $int_PDI_ID;
+    $this->sv_rule = $str_SV_Rule;
+  }
+
+  /**
+   * Getter function for PDI ID
+   *
+   * @return integer
+   */
+  public function get_PDI_ID() {
+    return $this->pdi_id;
+  }
+
+  /**
+   * Getter function for SV Rule
+   *
+   * @return string
+   */
+  public function get_SV_Rule() {
+    return $this->sv_rule;
+  }
+
+  /**
+   * Setter function for SV Rule
+   *
+   * @param string $str_SV_Rule
+   */
+  public function set_SV_Rule($str_SV_Rule) {
+    $this->sv_rule = $str_SV_Rule;
+  }
+
+}

classes/system.inc

@@ -0,0 +1,326 @@
+<?php
+
+/**
+ * File: system.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a system
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ *  - Sep 1, 2016 - Updated Copyright and added comments
+ */
+
+/**
+ * Represents the different accredidation types
+ *
+ * @author Ryan Prather
+ */
+class accrediation_types {
+
+  const DIACAP = 0;
+  const RMF = 1;
+  const PCI = 2;
+  const NISPOM = 3;
+  const HIPAA = 4;
+  const SOX = 5;
+  const COBIT = 6;
+
+}
+
+/**
+ * Represent a the system being tested
+ *
+ * @author Ryan Prather
+ */
+class system {
+
+  /**
+   * System ID
+   *
+   * @var integer
+   */
+  protected $id = 0;
+
+  /**
+   * System Name
+   *
+   * @var string
+   */
+  protected $name = '';
+
+  /**
+   * System name abbreviation
+   *
+   * @var string
+   */
+  protected $abbr = '';
+
+  /**
+   * System MAC level
+   *
+   * @var integer
+   */
+  protected $mac = 0;
+
+  /**
+   * System classification
+   *
+   * @var string
+   */
+  protected $classification = '';
+
+  /**
+   * System accrediation type
+   *
+   * @var accrediation_types
+   */
+  protected $accred_type = null;
+
+  /**
+   * System description
+   *
+   * @var string
+   */
+  protected $description = '';
+
+  /**
+   * System mitigations
+   *
+   * @var string
+   */
+  protected $mitigations = '';
+
+  /**
+   * System executive summary
+   *
+   * @var string
+   */
+  protected $executive_summary = '';
+
+  /**
+   * System diagram
+   *
+   * @var binary
+   */
+  protected $diagram = null;
+
+  /**
+   * Constructor
+   *
+   * @param integer $int_ID
+   * @param string $str_Name
+   * @param integer $int_MAC
+   * @param string $str_Class
+   */
+  public function __construct($int_ID, $str_Name, $int_MAC, $str_Class) {
+    $this->id = $int_ID;
+    $this->name = $str_Name;
+    $this->mac = $int_MAC;
+    $this->classification = $str_Class;
+  }
+
+  /**
+   * Getter function for System Id
+   *
+   * @return integer
+   */
+  public function get_ID() {
+    return $this->id;
+  }
+
+  /**
+   * Setter function for system ID
+   *
+   * @param integer $id_in
+   */
+  public function set_ID($id_in) {
+    $this->id = $id_in;
+  }
+
+  /**
+   * Getter function for system name
+   *
+   * @return string
+   */
+  public function get_Name() {
+    return $this->name;
+  }
+
+  /**
+   * Setter function for system name
+   *
+   * @param string $str_Name
+   */
+  public function set_Name($str_Name) {
+    $this->name = $str_Name;
+  }
+
+  /**
+   * Getter function for system abbreviation
+   *
+   * @return string
+   */
+  public function get_Abbreviation() {
+    return $this->abbr;
+  }
+
+  /**
+   * Setter function for system abbreviation
+   *
+   * @param string $abbr_in
+   */
+  public function set_Abbreviation($abbr_in) {
+    $this->abbr = $abbr_in;
+  }
+
+  /**
+   * Getter function for MAC
+   *
+   * @return integer
+   */
+  public function get_MAC() {
+    return $this->mac;
+  }
+
+  /**
+   * Setter function for MAC
+   *
+   * @param integer $int_MAC
+   */
+  public function set_MAC($int_MAC) {
+    $this->mac = $int_MAC;
+  }
+
+  /**
+   * Getter function for classification
+   *
+   * @return string
+   */
+  public function get_Classification() {
+    return $this->classification;
+  }
+
+  /**
+   * Settr function for classification
+   *
+   * @param string $str_Class
+   */
+  public function set_Classification($str_Class) {
+    $this->classification = $str_Class;
+  }
+
+  /**
+   * Getter function for system accrediation type
+   *
+   * @return accrediation_types
+   */
+  public function get_Accreditation_Type() {
+    return $this->accred_type;
+  }
+
+  /**
+   * Setter function for system accrediation type
+   *
+   * @param accrediation_types $accred_type_in
+   */
+  public function set_Accreditation_Type($accred_type_in) {
+    $this->accred_type = $accred_type_in;
+  }
+
+  /**
+   * Getter function for system description
+   *
+   * @return string
+   */
+  public function get_Description() {
+    return $this->description;
+  }
+
+  /**
+   * Setter function for system description
+   *
+   * @param string $str_desc_in
+   */
+  public function set_Description($str_desc_in) {
+    $this->description = $str_desc_in;
+  }
+
+  /**
+   * Getter function for system mitigations
+   *
+   * @return string
+   */
+  public function get_Mitigations() {
+    return $this->mitigations;
+  }
+
+  /**
+   * Setter function for system mitigations
+   *
+   * @param string $str_mit_in
+   */
+  public function set_Mitigations($str_mit_in) {
+    $this->mitigations = $str_mit_in;
+  }
+
+  /**
+   * Getter function for system executive summary
+   *
+   * @return string
+   */
+  public function get_Executive_Summary() {
+    return $this->executive_summary;
+  }
+
+  /**
+   * Setter function for system executive summary
+   *
+   * @param string $exec_sum_in
+   */
+  public function set_Executive_Summary($exec_sum_in) {
+    $this->executive_summary = $exec_sum_in;
+  }
+
+  /**
+   * Getter function for system diagram
+   *
+   * @return binary
+   */
+  public function get_Diagram() {
+    return $this->diagram;
+  }
+
+  /**
+   * Setter function for system diagram
+   *
+   * @param binary $bin_diag_in
+   */
+  public function set_Diagram($bin_diag_in) {
+    $this->diagram = $bin_diag_in;
+  }
+
+  /**
+   * Getter function for preformated option tag
+   *
+   * @param boolean $selected_System
+   * @param integer $ste_id
+   * @return string
+   */
+  public function get_Option($selected_System = null, $ste_id = null) {
+    return "<option value='" . $this->id . "" .
+        (!is_null($ste_id) ? "_$ste_id'" : "'") .
+        ($selected_System ? " selected" : "") .
+        ">" . $this->name . "</option>";
+  }
+
+}

classes/uuid.inc

@@ -0,0 +1,127 @@
+<?php
+
+/**
+ * File: uuid.inc
+ * Author: Andrew Moore (http://php.net/manual/en/function.uniqid.php#94959)
+ * Integrated by: Matt Shuter
+ * Purpose: Generates VALID RFC 4211 COMPLIANT Universally Unique IDentifiers (UUID) version 3, 4 and 5.
+ * Version 3 and 5 UUIDs are named based. They require a namespace (another valid UUID) and a value (the name).
+ * Given the same namespace and name, the output is always the same.
+ * Version 4 UUIDs are pseudo-random.
+ * UUIDs generated below validates using OSSP UUID Tool, and output for named-based UUIDs are exactly the same.
+ * Created: Feb 20, 2017
+ *
+ * Copyright 2017: Cyber Perspective, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Oct 16, 2017 - File created
+ */
+/* Usage
+ *
+ * Named-based UUID.
+ * $v3uuid = UUID::v3('1546058f-5a25-4334-85ae-e68f2a44bbaf', 'SomeRandomString');
+ * $v5uuid = UUID::v5('1546058f-5a25-4334-85ae-e68f2a44bbaf', 'SomeRandomString');
+ *
+ * Pseudo-random UUID
+ * $v4uuid = UUID::v4();
+ */
+
+class UUID {
+
+  public static function v3($namespace, $name) {
+    if (!self::is_valid($namespace))
+      return false;
+
+    // Get hexadecimal components of namespace
+    $nhex = str_replace(array('-', '{', '}'), '', $namespace);
+
+    // Binary Value
+    $nstr = '';
+
+    // Convert Namespace UUID to bits
+    for ($i = 0; $i < strlen($nhex); $i += 2) {
+      $nstr .= chr(hexdec($nhex[$i] . $nhex[$i + 1]));
+    }
+
+    // Calculate hash value
+    $hash = md5($nstr . $name);
+
+    return sprintf('%08s-%04s-%04x-%04x-%12s',
+        // 32 bits for "time_low"
+        substr($hash, 0, 8),
+        // 16 bits for "time_mid"
+        substr($hash, 8, 4),
+        // 16 bits for "time_hi_and_version",
+        // four most significant bits holds version number 3
+        (hexdec(substr($hash, 12, 4)) & 0x0fff) | 0x3000,
+        // 16 bits, 8 bits for "clk_seq_hi_res",
+        // 8 bits for "clk_seq_low",
+        // two most significant bits holds zero and one for variant DCE1.1
+        (hexdec(substr($hash, 16, 4)) & 0x3fff) | 0x8000,
+        // 48 bits for "node"
+        substr($hash, 20, 12)
+    );
+  }
+
+  public static function v4() {
+    return sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
+        // 32 bits for "time_low"
+        mt_rand(0, 0xffff), mt_rand(0, 0xffff),
+        // 16 bits for "time_mid"
+        mt_rand(0, 0xffff),
+        // 16 bits for "time_hi_and_version",
+        // four most significant bits holds version number 4
+        mt_rand(0, 0x0fff) | 0x4000,
+        // 16 bits, 8 bits for "clk_seq_hi_res",
+        // 8 bits for "clk_seq_low",
+        // two most significant bits holds zero and one for variant DCE1.1
+        mt_rand(0, 0x3fff) | 0x8000,
+        // 48 bits for "node"
+        mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff)
+    );
+  }
+
+  public static function v5($namespace, $name) {
+    if (!self::is_valid($namespace))
+      return false;
+
+    // Get hexadecimal components of namespace
+    $nhex = str_replace(array('-', '{', '}'), '', $namespace);
+
+    // Binary Value
+    $nstr = '';
+
+    // Convert Namespace UUID to bits
+    for ($i = 0; $i < strlen($nhex); $i += 2) {
+      $nstr .= chr(hexdec($nhex[$i] . $nhex[$i + 1]));
+    }
+
+    // Calculate hash value
+    $hash = sha1($nstr . $name);
+
+    return sprintf('%08s-%04s-%04x-%04x-%12s',
+        // 32 bits for "time_low"
+        substr($hash, 0, 8),
+        // 16 bits for "time_mid"
+        substr($hash, 8, 4),
+        // 16 bits for "time_hi_and_version",
+        // four most significant bits holds version number 5
+        (hexdec(substr($hash, 12, 4)) & 0x0fff) | 0x5000,
+        // 16 bits, 8 bits for "clk_seq_hi_res",
+        // 8 bits for "clk_seq_low",
+        // two most significant bits holds zero and one for variant DCE1.1
+        (hexdec(substr($hash, 16, 4)) & 0x3fff) | 0x8000,
+        // 48 bits for "node"
+        substr($hash, 20, 12)
+    );
+  }
+
+  public static function is_valid($uuid) {
+    return preg_match('/^\{?[0-9a-f]{8}\-?[0-9a-f]{4}\-?[0-9a-f]{4}\-?' .
+            '[0-9a-f]{4}\-?[0-9a-f]{12}\}?$/i', $uuid) === 1;
+  }
+
+}

classes/vul.inc

@@ -0,0 +1,17 @@
+<?php
+/**
+ * File: vul.inc
+ * Author: Ryan Prather
+ * Purpose: Represents a Vul check
+ * Created: Sep 12, 2013
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 12, 2013 - File created
+ */
+

conf/httpd-ssl.conf

@@ -0,0 +1,251 @@
+#
+# This is the Apache server configuration file providing SSL support.
+# It contains the configuration directives to instruct the server how to
+# serve pages over an https connection. For detailed information about these 
+# directives see <URL:http://httpd.apache.org/docs/2.4/mod/mod_ssl.html>
+# 
+# Do NOT simply read the instructions in here without understanding
+# what they do.  They're here only as hints or reminders.  If you are unsure
+# consult the online docs. You have been warned.  
+#
+# Required modules: mod_log_config, mod_setenvif, mod_ssl,
+#          socache_shmcb_module (for default value of SSLSessionCache)
+
+#
+# Pseudo Random Number Generator (PRNG):
+# Configure one or more sources to seed the PRNG of the SSL library.
+# The seed data should be of good random quality.
+# WARNING! On some platforms /dev/random blocks if not enough entropy
+# is available. This means you then cannot use the /dev/random device
+# because it would lead to very long connection times (as long as
+# it requires to make more entropy available). But usually those
+# platforms additionally provide a /dev/urandom device which doesn't
+# block. So, if available, use this one instead. Read the mod_ssl User
+# Manual for more details.
+#
+#SSLRandomSeed startup file:/dev/random  512
+#SSLRandomSeed startup file:/dev/urandom 512
+#SSLRandomSeed connect file:/dev/random  512
+#SSLRandomSeed connect file:/dev/urandom 512
+
+
+#
+# When we also provide SSL we have to listen to the 
+# standard HTTP port (see above) and to the HTTPS port
+#
+# Note: Configurations that use IPv6 but not IPv4-mapped addresses need two
+#       Listen directives: "Listen [::]:443" and "Listen 0.0.0.0:443"
+#
+#Listen localhost:443
+
+##
+##  SSL Global Context
+##
+##  All SSL configuration in this context applies both to
+##  the main server and all SSL-enabled virtual hosts.
+##
+
+#   SSL Cipher Suite:
+#   List the ciphers that the client is permitted to negotiate.
+#   See the mod_ssl documentation for a complete list.
+SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
+
+#   Speed-optimized SSL Cipher configuration:
+#   If speed is your main concern (on busy HTTPS servers e.g.),
+#   you might want to force clients to specific, performance
+#   optimized ciphers. In this case, prepend those ciphers
+#   to the SSLCipherSuite list, and enable SSLHonorCipherOrder.
+#   Caveat: by giving precedence to RC4-SHA and AES128-SHA
+#   (as in the example below), most connections will no longer
+#   have perfect forward secrecy - if the server's key is
+#   compromised, captures of past or future traffic must be
+#   considered compromised, too.
+#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5
+#SSLHonorCipherOrder on 
+
+#   Pass Phrase Dialog:
+#   Configure the pass phrase gathering process.
+#   The filtering dialog program (`builtin' is an internal
+#   terminal dialog) has to provide the pass phrase on stdout.
+SSLPassPhraseDialog  builtin
+
+#   Inter-Process Session Cache:
+#   Configure the SSL Session Cache: First the mechanism 
+#   to use and second the expiring timeout (in seconds).
+#SSLSessionCache "shmcb:C:/xampp/apache/logs/ssl_scache(512000)"
+SSLSessionCache "shmcb:C:/xampp/apache/logs/ssl_scache(512000)"
+SSLSessionCacheTimeout  300
+
+##
+## SSL Virtual Host Context
+##
+
+<VirtualHost _default_:443>
+
+#   General setup for the virtual host
+DocumentRoot "C:/xampp/htdocs"
+ServerName www.example.com:443
+ServerAdmin admin@example.com
+ErrorLog "C:/xampp/apache/logs/error.log"
+TransferLog "C:/xampp/apache/logs/access.log"
+
+#   SSL Engine Switch:
+#   Enable/Disable SSL for this virtual host.
+SSLEngine on
+
+#   Server Certificate:
+#   Point SSLCertificateFile "conf/ssl.crt/server.crt"
+#   the certificate is encrypted, then you will be prompted for a
+#   pass phrase.  Note that a kill -HUP will prompt again.  Keep
+#   in mind that if you have both an RSA and a DSA certificate you
+#   can configure both in parallel (to also allow the use of DSA
+#   ciphers, etc.)
+#   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
+#   require an ECC certificate which can also be configured in
+#   parallel.
+SSLCertificateFile "conf/ssl.crt/server.crt"
+#SSLCertificateFile "conf/ssl.crt/server.crt"
+#SSLCertificateFile "conf/ssl.crt/server.crt"
+
+#   Server Private Key:
+#   If the key is not combined with the certificate, use this
+#   directive to point at the key file.  Keep in mind that if
+#   you've both a RSA and a DSA private key you can configure
+#   both in parallel (to also allow the use of DSA ciphers, etc.)
+#   ECC keys, when in use, can also be configured in parallel
+SSLCertificateKeyFile "conf/ssl.key/server.key"
+#SSLCertificateKeyFile "conf/ssl.key/server.key"
+#SSLCertificateKeyFile "conf/ssl.key/server.key"
+
+#   Server Certificate Chain:
+#   Point SSLCertificateChainFile at a file containing the
+#   concatenation of PEM encoded CA certificates which form the
+#   certificate chain for the server certificate. Alternatively
+#   the referenced file can be the same as SSLCertificateFile "conf/ssl.crt/server.crt"
+#   certificate for convenience.
+#SSLCertificateChainFile "c:/Apache24/conf/server-ca.crt"
+
+#   Certificate Authority (CA):
+#   Set the CA certificate verification path where to find CA
+#   certificates for client authentication or alternatively one
+#   huge file containing all of them (file must be PEM encoded)
+#   Note: Inside SSLCACertificatePath you need hash symlinks
+#         to point to the certificate files. Use the provided
+#         Makefile to update the hash symlinks after changes.
+#SSLCACertificatePath "c:/Apache24/conf/ssl.crt"
+#SSLCACertificateFile "c:/Apache24/conf/ssl.crt/ca-bundle.crt"
+
+#   Certificate Revocation Lists (CRL):
+#   Set the CA revocation path where to find CA CRLs for client
+#   authentication or alternatively one huge file containing all
+#   of them (file must be PEM encoded).
+#   The CRL checking mode needs to be configured explicitly
+#   through SSLCARevocationCheck (defaults to "none" otherwise).
+#   Note: Inside SSLCARevocationPath you need hash symlinks
+#         to point to the certificate files. Use the provided
+#         Makefile to update the hash symlinks after changes.
+#SSLCARevocationPath "c:/Apache24/conf/ssl.crl"
+#SSLCARevocationFile "c:/Apache24/conf/ssl.crl/ca-bundle.crl"
+#SSLCARevocationCheck chain
+
+#   Client Authentication (Type):
+#   Client certificate verification type and depth.  Types are
+#   none, optional, require and optional_no_ca.  Depth is a
+#   number which specifies how deeply to verify the certificate
+#   issuer chain before deciding the certificate is not valid.
+#SSLVerifyClient require
+#SSLVerifyDepth  10
+
+#   TLS-SRP mutual authentication:
+#   Enable TLS-SRP and set the path to the OpenSSL SRP verifier
+#   file (containing login information for SRP user accounts). 
+#   Requires OpenSSL 1.0.1 or newer. See the mod_ssl FAQ for
+#   detailed instructions on creating this file. Example:
+#   "openssl srp -srpvfile c:/Apache24/conf/passwd.srpv -add username"
+#SSLSRPVerifierFile "c:/Apache24/conf/passwd.srpv"
+
+#   Access Control:
+#   With SSLRequire you can do per-directory access control based
+#   on arbitrary complex boolean expressions containing server
+#   variable checks and other lookup directives.  The syntax is a
+#   mixture between C and Perl.  See the mod_ssl documentation
+#   for more details.
+#<Location />
+#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
+#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
+#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
+#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
+#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
+#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
+#</Location>
+
+#   SSL Engine Options:
+#   Set various options for the SSL engine.
+#   o FakeBasicAuth:
+#     Translate the client X.509 into a Basic Authorisation.  This means that
+#     the standard Auth/DBMAuth methods can be used for access control.  The
+#     user name is the `one line' version of the client's X.509 certificate.
+#     Note that no password is obtained from the user. Every entry in the user
+#     file needs this password: `xxj31ZMTZzkVA'.
+#   o ExportCertData:
+#     This exports two additional environment variables: SSL_CLIENT_CERT and
+#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
+#     server (always existing) and the client (only existing when client
+#     authentication is used). This can be used to import the certificates
+#     into CGI scripts.
+#   o StdEnvVars:
+#     This exports the standard SSL/TLS related `SSL_*' environment variables.
+#     Per default this exportation is switched off for performance reasons,
+#     because the extraction step is an expensive operation and is usually
+#     useless for serving static content. So one usually enables the
+#     exportation for CGI and SSI requests only.
+#   o StrictRequire:
+#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
+#     under a "Satisfy any" situation, i.e. when it applies access is denied
+#     and no other module can change it.
+#   o OptRenegotiate:
+#     This enables optimized SSL connection renegotiation handling when SSL
+#     directives are used in per-directory context. 
+#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
+<FilesMatch "\.(cgi|shtml|phtml|php)$">
+    SSLOptions +StdEnvVars
+</FilesMatch>
+<Directory "C:/xampp/apache/cgi-bin">
+    SSLOptions +StdEnvVars
+</Directory>
+
+#   SSL Protocol Adjustments:
+#   The safe and default but still SSL/TLS standard compliant shutdown
+#   approach is that mod_ssl sends the close notify alert but doesn't wait for
+#   the close notify alert from client. When you need a different shutdown
+#   approach you can use one of the following variables:
+#   o ssl-unclean-shutdown:
+#     This forces an unclean shutdown when the connection is closed, i.e. no
+#     SSL close notify alert is sent or allowed to be received.  This violates
+#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
+#     this when you receive I/O errors because of the standard approach where
+#     mod_ssl sends the close notify alert.
+#   o ssl-accurate-shutdown:
+#     This forces an accurate shutdown when the connection is closed, i.e. a
+#     SSL close notify alert is send and mod_ssl waits for the close notify
+#     alert of the client. This is 100% SSL/TLS standard compliant, but in
+#     practice often causes hanging connections with brain-dead browsers. Use
+#     this only for browsers where you know that their SSL implementation
+#     works correctly. 
+#   Notice: Most problems of broken clients are also related to the HTTP
+#   keep-alive facility, so you usually additionally want to disable
+#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
+#   Similarly, one has to force some clients to use HTTP/1.0 to workaround
+#   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
+#   "force-response-1.0" for this.
+BrowserMatch "MSIE [2-5]" \
+         nokeepalive ssl-unclean-shutdown \
+         downgrade-1.0 force-response-1.0
+
+#   Per-Server Logging:
+#   The home of a custom SSL log file. Use this when you want a
+#   compact non-error SSL logfile on a virtual host basis.
+CustomLog "C:/xampp/apache/logs/ssl_request.log" \
+          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
+
+</VirtualHost>                                  

conf/httpd-xampp.conf

@@ -0,0 +1,126 @@
+#
+# XAMPP settings
+#
+
+<IfModule env_module>
+    SetEnv MIBDIRS "C:/xampp/php/extras/mibs"
+    SetEnv MYSQL_HOME "\\xampp\\mysql\\bin"
+    SetEnv OPENSSL_CONF "C:/xampp/apache/bin/openssl.cnf"
+    SetEnv PHP_PEAR_SYSCONF_DIR "\\xampp\\php"
+    SetEnv PHPRC "\\xampp\\php"
+    SetEnv TMP "\\xampp\\tmp"
+</IfModule>
+
+#
+# PHP-Module setup
+#
+PHPIniDir "C:/xampp/php"
+LoadFile "C:/xampp/php/php7ts.dll"
+LoadFile "C:/xampp/php/libpq.dll"
+LoadModule php7_module "C:/xampp/php/php7apache2_4.dll"
+
+<FilesMatch "\.php$">
+    SetHandler application/x-httpd-php
+</FilesMatch>
+<FilesMatch "\.phps$">
+    SetHandler application/x-httpd-php-source
+</FilesMatch>
+
+#
+# PHP-CGI setup
+#
+#<FilesMatch "\.php$">
+#    SetHandler application/x-httpd-php-cgi
+#</FilesMatch>
+#<IfModule actions_module>
+#    Action application/x-httpd-php-cgi "/php-cgi/php-cgi.exe"
+#</IfModule>
+
+
+<IfModule php7_module="">
+    PHPINIDir "C:/xampp/php"
+</IfModule>
+
+<IfModule mime_module>
+    AddType text/html .php .phps
+</IfModule>
+
+ScriptAlias /php-cgi/ "C:/xampp/php/"
+<Directory "C:/xampp/php">
+    AllowOverride None
+    Options None
+    Require all denied
+    <Files "php-cgi.exe">
+          Require all granted
+    </Files>
+</Directory>
+
+<Directory "C:/xampp/cgi-bin">
+    <FilesMatch "\.php$">
+        SetHandler cgi-script
+    </FilesMatch>
+    <FilesMatch "\.phps$">
+        SetHandler None
+    </FilesMatch>
+</Directory>
+
+<Directory "C:/xampp/htdocs/xampp">
+    <IfModule php7_module="">
+    	<Files "status.php">
+    		php_admin_flag safe_mode off
+    	</Files>
+    </IfModule>
+    AllowOverride AuthConfig
+</Directory>
+
+<IfModule alias_module>
+    Alias /security "C:/xampp/security/htdocs/"
+    <Directory "C:/xampp/security/htdocs">
+        <IfModule php7_module="">
+    		<Files "xamppsecurity.php">
+    			php_admin_flag safe_mode off
+    		</Files>
+        </IfModule>
+        AllowOverride AuthConfig
+        Require all granted
+   </Directory>
+
+    Alias /licenses "C:/xampp/licenses/"
+    <Directory "C:/xampp/licenses">
+        Options +Indexes
+        <IfModule autoindex_color_module>
+            DirectoryIndexTextColor  "#000000"
+            DirectoryIndexBGColor "#f8e8a0"
+            DirectoryIndexLinkColor "#bb3902"
+            DirectoryIndexVLinkColor "#bb3902"
+            DirectoryIndexALinkColor "#bb3902"
+        </IfModule>
+        Require all granted
+   </Directory>
+
+    Alias /phpmyadmin "C:/xampp/phpMyAdmin/"
+    <Directory "C:/xampp/phpMyAdmin">
+        AllowOverride AuthConfig
+        Require all granted
+    </Directory>
+
+    Alias /webalizer "C:/xampp/webalizer/"
+    <Directory "C:/xampp/webalizer">
+        <IfModule php7_module="">
+    		<Files "webalizer.php">
+    			php_admin_flag safe_mode off
+    		</Files>
+        </IfModule>
+        AllowOverride AuthConfig
+        Require all granted
+    </Directory>
+</IfModule>
+
+#
+# New XAMPP security concept
+#
+#<LocationMatch "^/(?i:(?:xampp|security|licenses|phpmyadmin|webalizer|server-status|server-info))">
+#        Require local
+#	ErrorDocument 403 /error/XAMPP_FORBIDDEN.html.var
+#</LocationMatch>
+

conf/httpd.conf

@@ -0,0 +1,582 @@
+#
+# This is the main Apache HTTP server configuration file.  It contains the
+# configuration directives that give the server its instructions.
+# See <URL:http://httpd.apache.org/docs/2.4/> for detailed information.
+# In particular, see 
+# <URL:http://httpd.apache.org/docs/2.4/mod/directives.html>
+# for a discussion of each configuration directive.
+#
+# Do NOT simply read the instructions in here without understanding
+# what they do.  They're here only as hints or reminders.  If you are unsure
+# consult the online docs. You have been warned.  
+#
+# Configuration and logfile names: If the filenames you specify for many
+# of the server's control files begin with "/" (or "drive:/" for Win32), the
+# server will use that explicit path.  If the filenames do *not* begin
+# with "/", the value of ServerRoot is prepended -- so "logs/access_log"
+# with ServerRoot set to "/usr/local/apache2" will be interpreted by the
+# server as "/usr/local/apache2/logs/access_log", whereas "/logs/access_log" 
+# will be interpreted as '/logs/access_log'.
+#
+# NOTE: Where filenames are specified, you must use forward slashes
+# instead of backslashes (e.g., "c:/apache" instead of "c:\apache").
+# If a drive letter is omitted, the drive on which httpd.exe is located
+# will be used by default.  It is recommended that you always supply
+# an explicit drive letter in absolute paths to avoid confusion.
+
+#
+# ServerRoot: The top of the directory tree under which the server's
+# configuration, error, and log files are kept.
+#
+# Do not add a slash at the end of the directory path.  If you point
+# ServerRoot at a non-local disk, be sure to specify a local disk on the
+# Mutex directive, if file-based mutexes are used.  If you wish to share the
+# same ServerRoot for multiple httpd daemons, you will need to change at
+# least PidFile.
+#
+ServerRoot "C:/xampp/apache"
+
+#
+# Mutex: Allows you to set the mutex mechanism and mutex file directory
+# for individual mutexes, or change the global defaults
+#
+# Uncomment and change the directory if mutexes are file-based and the default
+# mutex file directory is not on a local disk or is not appropriate for some
+# other reason.
+#
+# Mutex default:logs
+
+#
+# Listen: Allows you to bind Apache to specific IP addresses and/or
+# ports, instead of the default. See also the <VirtualHost>
+# directive.
+#
+# Change this to Listen on specific IP addresses as shown below to 
+# prevent Apache from glomming onto all bound IP addresses.
+#
+#Listen 12.34.56.78:80
+Listen 127.0.0.1:80
+
+#
+# Dynamic Shared Object (DSO) Support
+#
+# To be able to use the functionality of a module which was built as a DSO you
+# have to place corresponding `LoadModule' lines at this location so the
+# directives contained in it are actually available _before_ they are used.
+# Statically compiled modules (those listed by `httpd -l') do not need
+# to be loaded here.
+#
+# Example:
+# LoadModule foo_module modules/mod_foo.so
+#
+LoadModule access_compat_module modules/mod_access_compat.so
+#LoadModule actions_module modules/mod_actions.so
+LoadModule alias_module modules/mod_alias.so
+#LoadModule allowmethods_module modules/mod_allowmethods.so
+#LoadModule asis_module modules/mod_asis.so
+#LoadModule auth_basic_module modules/mod_auth_basic.so
+#LoadModule auth_digest_module modules/mod_auth_digest.so
+#LoadModule authn_anon_module modules/mod_authn_anon.so
+#LoadModule authn_core_module modules/mod_authn_core.so
+#LoadModule authn_dbd_module modules/mod_authn_dbd.so
+#LoadModule authn_dbm_module modules/mod_authn_dbm.so
+#LoadModule authn_file_module modules/mod_authn_file.so
+#LoadModule authn_socache_module modules/mod_authn_socache.so
+#LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
+LoadModule authz_core_module modules/mod_authz_core.so
+#LoadModule authz_dbd_module modules/mod_authz_dbd.so
+#LoadModule authz_dbm_module modules/mod_authz_dbm.so
+#LoadModule authz_groupfile_module modules/mod_authz_groupfile.so
+#LoadModule authz_host_module modules/mod_authz_host.so
+#LoadModule authz_owner_module modules/mod_authz_owner.so
+#LoadModule authz_user_module modules/mod_authz_user.so
+#LoadModule autoindex_module modules/mod_autoindex.so
+#LoadModule buffer_module modules/mod_buffer.so
+#LoadModule cache_module modules/mod_cache.so
+#LoadModule cache_disk_module modules/mod_cache_disk.so
+#LoadModule cern_meta_module modules/mod_cern_meta.so
+LoadModule cgi_module modules/mod_cgi.so
+#LoadModule charset_lite_module modules/mod_charset_lite.so
+#LoadModule data_module modules/mod_data.so
+#LoadModule dav_module modules/mod_dav.so
+#LoadModule dav_fs_module modules/mod_dav_fs.so
+#LoadModule dav_lock_module modules/mod_dav_lock.so
+#LoadModule dbd_module modules/mod_dbd.so
+#LoadModule deflate_module modules/mod_deflate.so
+LoadModule dir_module modules/mod_dir.so
+#LoadModule dumpio_module modules/mod_dumpio.so
+#LoadModule env_module modules/mod_env.so
+#LoadModule expires_module modules/mod_expires.so
+#LoadModule ext_filter_module modules/mod_ext_filter.so
+#LoadModule file_cache_module modules/mod_file_cache.so
+#LoadModule filter_module modules/mod_filter.so
+#LoadModule headers_module modules/mod_headers.so
+#LoadModule heartbeat_module modules/mod_heartbeat.so
+#LoadModule heartmonitor_module modules/mod_heartmonitor.so
+#LoadModule ident_module modules/mod_ident.so
+#LoadModule imagemap_module modules/mod_imagemap.so
+#LoadModule include_module modules/mod_include.so
+#LoadModule info_module modules/mod_info.so
+#LoadModule isapi_module modules/mod_isapi.so
+#LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
+#LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
+#LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
+#LoadModule lbmethod_heartbeat_module modules/mod_lbmethod_heartbeat.so
+#LoadModule ldap_module modules/mod_ldap.so
+#LoadModule logio_module modules/mod_logio.so
+LoadModule log_config_module modules/mod_log_config.so
+#LoadModule log_debug_module modules/mod_log_debug.so
+#LoadModule log_forensic_module modules/mod_log_forensic.so
+#LoadModule lua_module modules/mod_lua.so
+#LoadModule cache_disk_module modules/mod_cache_disk.so
+LoadModule mime_module modules/mod_mime.so
+#LoadModule mime_magic_module modules/mod_mime_magic.so
+#LoadModule negotiation_module modules/mod_negotiation.so
+#LoadModule proxy_module modules/mod_proxy.so
+#LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
+#LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
+#LoadModule proxy_connect_module modules/mod_proxy_connect.so
+#LoadModule proxy_express_module modules/mod_proxy_express.so
+#LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
+#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
+#LoadModule proxy_html_module modules/mod_proxy_html.so
+#LoadModule proxy_http_module modules/mod_proxy_http.so
+#LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
+#LoadModule ratelimit_module modules/mod_ratelimit.so
+#LoadModule reflector_module modules/mod_reflector.so
+#LoadModule remoteip_module modules/mod_remoteip.so
+#LoadModule request_module modules/mod_request.so
+#LoadModule reqtimeout_module modules/mod_reqtimeout.so
+#LoadModule rewrite_module modules/mod_rewrite.so
+#LoadModule sed_module modules/mod_sed.so
+#LoadModule session_module modules/mod_session.so
+#LoadModule session_cookie_module modules/mod_session_cookie.so
+#LoadModule session_crypto_module modules/mod_session_crypto.so
+#LoadModule session_dbd_module modules/mod_session_dbd.so
+LoadModule setenvif_module modules/mod_setenvif.so
+#LoadModule slotmem_plain_module modules/mod_slotmem_plain.so
+#LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
+#LoadModule socache_dbm_module modules/mod_socache_dbm.so
+#LoadModule socache_memcache_module modules/mod_socache_memcache.so
+#LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
+#LoadModule speling_module modules/mod_speling.so
+#LoadModule ssl_module modules/mod_ssl.so
+#LoadModule status_module modules/mod_status.so
+#LoadModule substitute_module modules/mod_substitute.so
+#LoadModule unique_id_module modules/mod_unique_id.so
+#LoadModule userdir_module modules/mod_userdir.so
+#LoadModule usertrack_module modules/mod_usertrack.so
+#LoadModule version_module modules/mod_version.so
+#LoadModule vhost_alias_module modules/mod_vhost_alias.so
+#LoadModule watchdog_module modules/mod_watchdog.so
+#LoadModule xml2enc_module modules/mod_xml2enc.so
+
+<IfModule unixd_module>
+#
+# If you wish httpd to run as a different user or group, you must run
+# httpd as root initially and it will switch.  
+#
+# User/Group: The name (or #number) of the user/group to run httpd as.
+# It is usually good practice to create a dedicated user and group for
+# running httpd, as with most system services.
+#
+User daemon
+Group daemon
+
+</IfModule>
+
+# 'Main' server configuration
+#
+# The directives in this section set up the values used by the 'main'
+# server, which responds to any requests that aren't handled by a
+# <VirtualHost> definition.  These values also provide defaults for
+# any <VirtualHost> containers you may define later in the file.
+#
+# All of these directives may appear inside <VirtualHost> containers,
+# in which case these default settings will be overridden for the
+# virtual host being defined.
+#
+
+#
+# ServerAdmin: Your address, where problems with the server should be
+# e-mailed.  This address appears on some server-generated pages, such
+# as error documents.  e.g. admin@your-domain.com
+#
+ServerAdmin postmaster@localhost
+
+#
+# ServerName gives the name and port that the server uses to identify itself.
+# This can often be determined automatically, but we recommend you specify
+# it explicitly to prevent problems during startup.
+#
+# If your host doesn't have a registered DNS name, enter its IP address here.
+#
+ServerName localhost:80
+
+#
+# Deny access to the entirety of your server's filesystem. You must
+# explicitly permit access to web content directories in other 
+# <Directory> blocks below.
+#
+<Directory />
+	Order deny,allow
+	#Deny from all
+	Options none
+    AllowOverride none
+    Require all denied
+</Directory>
+
+#
+# Turn Trace Off
+#
+TraceEnable off
+
+#
+# Request Limits
+#
+LimitRequestFields 32767
+LimitRequestFieldSize 8190
+LimitRequestLine 8190
+
+#
+# Set ServerToken
+#
+ServerTokens Prod
+
+#
+# set timeout
+#
+TimeOut 300
+
+#
+# Note that from this point forward you must specifically allow
+# particular features to be enabled - so if something's not working as
+# you might expect, make sure that you have specifically enabled it
+# below.
+#
+
+#
+# DocumentRoot: The directory out of which you will serve your
+# documents. By default, all requests are taken from this directory, but
+# symbolic links and aliases may be used to point to other locations.
+#
+DocumentRoot "C:/xampp/www"
+<Directory "C:/xampp/www">
+    #
+    # Possible values for the Options directive are "None", "All",
+    # or any combination of:
+    #   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews
+    #
+    # Note that "MultiViews" must be named *explicitly* --- "Options All"
+    # doesn't give it to you.
+    #
+    # The Options directive is both complicated and important.  Please see
+    # http://httpd.apache.org/docs/2.4/mod/core.html#options
+    # for more information.
+    #
+    Options None
+
+    #
+    # AllowOverride controls what directives may be placed in .htaccess files.
+    # It can be "All", "None", or any combination of the keywords:
+    #   AllowOverride FileInfo AuthConfig Limit
+    #
+    AllowOverride None
+
+    #
+    # Controls who can get stuff from this server.
+    #
+    Require all granted
+	
+	#
+	# Limit request body
+	#
+	LimitRequestBody 250000000
+</Directory>
+
+#
+# DirectoryIndex: sets the file that Apache will serve if a directory
+# is requested.
+#
+<IfModule dir_module>
+    DirectoryIndex index.php index.html
+</IfModule>
+
+#
+# The following lines prevent .htaccess and .htpasswd files from being 
+# viewed by Web clients. 
+#
+<Files ".ht*">
+    Require all denied
+</Files>
+
+#
+# ErrorLog: The location of the error log file.
+# If you do not specify an ErrorLog directive within a <VirtualHost>
+# container, error messages relating to that virtual host will be
+# logged here.  If you *do* define an error logfile for a <VirtualHost>
+# container, that host's errors will be logged there and not here.
+#
+ErrorLog "logs/error.log"
+
+#
+# LogLevel: Control the number of messages logged to the error_log.
+# Possible values include: debug, info, notice, warn, error, crit,
+# alert, emerg.
+#
+LogLevel warn
+
+<IfModule log_config_module>
+    #
+    # The following directives define some format nicknames for use with
+    # a CustomLog directive (see below).
+    #
+    LogFormat "%a %A %h %H %l %m %s %t %u %U \"%{Referer}i\"" combined
+    LogFormat "%h %l %u %t \"%r\" %>s %b" common
+
+    <IfModule logio_module>
+      # You need to enable mod_logio.c to use %I and %O
+      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
+    </IfModule>
+
+    #
+    # The location and format of the access logfile (Common Logfile Format).
+    # If you do not define any access logfiles within a <VirtualHost>
+    # container, they will be logged here.  Contrariwise, if you *do*
+    # define per-<VirtualHost> access logfiles, transactions will be
+    # logged therein and *not* in this file.
+    #
+    #CustomLog "logs/access.log" common
+
+    #
+    # If you prefer a logfile with access, agent, and referer information
+    # (Combined Logfile Format) you can use the following directive.
+    #
+    CustomLog "logs/access.log" combined
+</IfModule>
+
+<IfModule alias_module>
+    #
+    # Redirect: Allows you to tell clients about documents that used to 
+    # exist in your server's namespace, but do not anymore. The client 
+    # will make a new request for the document at its new location.
+    # Example:
+    # Redirect permanent /foo http://www.example.com/bar
+
+    #
+    # Alias: Maps web paths into filesystem paths and is used to
+    # access content that does not live under the DocumentRoot.
+    # Example:
+    # Alias /webpath /full/filesystem/path
+    #
+    # If you include a trailing / on /webpath then the server will
+    # require it to be present in the URL.  You will also likely
+    # need to provide a <Directory> section to allow access to
+    # the filesystem path.
+
+    #
+    # ScriptAlias: This controls which directories contain server scripts. 
+    # ScriptAliases are essentially the same as Aliases, except that
+    # documents in the target directory are treated as applications and
+    # run by the server when requested rather than as documents sent to the
+    # client.  The same rules about trailing "/" apply to ScriptAlias
+    # directives as to Alias.
+    #
+    ScriptAlias "/cgi-bin/" "C:/xampp/cgi-bin/"
+
+</IfModule>
+
+<IfModule cgid_module>
+    #
+    # ScriptSock: On threaded servers, designate the path to the UNIX
+    # socket used to communicate with the CGI daemon of mod_cgid.
+    #
+    #Scriptsock cgisock
+</IfModule>
+
+#
+# "C:/xampp/cgi-bin" should be changed to whatever your ScriptAliased
+# CGI directory exists, if you have that configured.
+#
+<Directory "C:/xampp/cgi-bin">
+    AllowOverride All
+    Options +ExecCGI
+    Require all granted
+</Directory>
+
+<IfModule mime_module>
+    #
+    # TypesConfig points to the file containing the list of mappings from
+    # filename extension to MIME-type.
+    #
+    TypesConfig conf/mime.types
+
+    #
+    # AddType allows you to add to or override the MIME configuration
+    # file specified in TypesConfig for specific file types.
+    #
+    #AddType application/x-gzip .tgz
+    #
+    # AddEncoding allows you to have certain browsers uncompress
+    # information on the fly. Note: Not all browsers support this.
+    #
+    #AddEncoding x-compress .Z
+    #AddEncoding x-gzip .gz .tgz
+    #
+    # If the AddEncoding directives above are commented-out, then you
+    # probably should define those extensions to indicate media types:
+    #
+    AddType application/x-compress .Z
+    AddType application/x-gzip .gz .tgz
+
+    #
+    # AddHandler allows you to map certain file extensions to "handlers":
+    # actions unrelated to filetype. These can be either built into the server
+    # or added with the Action directive (see below)
+    #
+    # To use CGI scripts outside of ScriptAliased directories:
+    # (You will also need to add "ExecCGI" to the "Options" directive.)
+    #
+    AddHandler cgi-script .cgi
+
+    # For type maps (negotiated resources):
+    #AddHandler type-map var
+
+    #
+    # Filters allow you to process content before it is sent to the client.
+    #
+    # To parse .shtml files for server-side includes (SSI):
+    # (You will also need to add "Includes" to the "Options" directive.)
+    #
+    AddType text/html .shtml
+    AddOutputFilter INCLUDES .shtml
+</IfModule>
+
+#
+# The mod_mime_magic module allows the server to use various hints from the
+# contents of the file itself to determine its type.  The MIMEMagicFile
+# directive tells the module where the hint definitions are located.
+#
+<IfModule mime_magic_module>
+    #
+    # The mod_mime_magic module allows the server to use various hints from the
+    # contents of the file itself to determine its type.  The MIMEMagicFile
+    # directive tells the module where the hint definitions are located.
+    #
+    MIMEMagicFile "conf/magic"
+</IfModule>
+
+
+#
+# Customizable error responses come in three flavors:
+# 1) plain text 2) local redirects 3) external redirects
+#
+# Some examples:
+#ErrorDocument 500 "The server made a boo boo."
+#ErrorDocument 404 /missing.html
+#ErrorDocument 404 "/cgi-bin/missing_handler.pl"
+#ErrorDocument 402 http://www.example.com/subscription_info.html
+#
+
+#
+# MaxRanges: Maximum number of Ranges in a request before
+# returning the entire resource, or one of the special
+# values 'default', 'none' or 'unlimited'.
+# Default setting is to accept 200 Ranges.
+#MaxRanges unlimited
+
+#
+# EnableMMAP and EnableSendfile: On systems that support it, 
+# memory-mapping or the sendfile syscall may be used to deliver
+# files.  This usually improves server performance, but must
+# be turned off when serving from networked-mounted 
+# filesystems or if support for these functions is otherwise
+# broken on your system.
+# Defaults: EnableMMAP On, EnableSendfile Off
+#
+#EnableMMAP off
+#EnableSendfile off
+
+# Supplemental configuration
+#
+# The configuration files in the conf/extra/ directory can be 
+# included to add extra features or to modify the default configuration of 
+# the server, or you may simply copy their contents here and change as 
+# necessary.
+
+# Server-pool management (MPM specific)
+Include conf/extra/httpd-mpm.conf
+
+# Multi-language error messages
+Include conf/extra/httpd-multilang-errordoc.conf
+
+# Fancy directory listings
+Include conf/extra/httpd-autoindex.conf
+
+# Language settings
+Include conf/extra/httpd-languages.conf
+
+# User home directories
+Include conf/extra/httpd-userdir.conf
+
+# Real-time info on requests and configuration
+Include conf/extra/httpd-info.conf
+
+# Virtual hosts
+Include conf/extra/httpd-vhosts.conf
+
+# Local access to the Apache HTTP Server Manual
+#Include conf/extra/httpd-manual.conf
+
+# Distributed authoring and versioning (WebDAV)
+#Attention! WEB_DAV is a security risk without a new userspecific configuration for a secure authentifcation 
+#Include conf/extra/httpd-dav.conf
+
+# Various default settings
+#Include conf/extra/httpd-default.conf
+# Implements a proxy/gateway for Apache.
+Include "conf/extra/httpd-proxy.conf"
+# Various default settings
+Include "conf/extra/httpd-default.conf"
+# XAMPP settings
+Include "conf/extra/httpd-xampp.conf"
+
+# Configure mod_proxy_html to understand HTML4/XHTML1
+<IfModule proxy_html_module>
+Include conf/extra/proxy-html.conf
+</IfModule>
+
+# Secure (SSL/TLS) connections
+#Include conf/extra/httpd-ssl.conf
+#
+# Note: The following must must be present to support
+#       starting without SSL on platforms with no /dev/random equivalent
+#       but a statically compiled-in mod_ssl.
+#
+<IfModule ssl_module>
+SSLRandomSeed startup builtin
+SSLRandomSeed connect builtin
+</IfModule>
+#
+# uncomment out the below to deal with user agents that deliberately
+# violate open standards by misusing DNT (DNT *must* be a specific
+# end-user choice)
+#
+#<IfModule setenvif_module>
+#BrowserMatch "MSIE 10.0;" bad_DNT
+#</IfModule>
+#<IfModule headers_module>
+#RequestHeader unset DNT env=bad_DNT
+#</IfModule>
+
+# XAMPP: We disable operating system specific optimizations for a listening
+# socket by the http protocol here. IE 64 bit make problems without this.
+
+AcceptFilter http none
+
+# AJP13 Proxy
+<IfModule mod_proxy.c>
+<IfModule mod_proxy_ajp.c>
+Include "conf/extra/httpd-ajp.conf"
+</IfModule>
+</IfModule>

conf/my.ini

@@ -0,0 +1,187 @@
+# Example MySQL config file for small systems.
+#
+# This is for a system with little memory (<= 64M) where MySQL is only used
+# from time to time and it's important that the mysqld daemon
+# doesn't use much resources.
+#
+# You can copy this file to
+# C:/xampp/mysql/bin/my.cnf to set global options,
+# mysql-data-dir/my.cnf to set server-specific options (in this
+# installation this directory is C:/xampp/mysql/data) or
+# ~/.my.cnf to set user-specific options.
+#
+# In this file, you can use all long options that a program supports.
+# If you want to know which options a program supports, run the program
+# with the "--help" option.
+
+# The following options will be passed to all MySQL clients
+[client] 
+# password       = your_password 
+port            = 3306 
+socket          = "C:/xampp/mysql/mysql.sock"
+
+
+# Here follows entries for some specific programs 
+
+# The MySQL server
+[mysqld]
+port= 3306
+socket = "C:/xampp/mysql/mysql.sock"
+basedir = "C:/xampp/mysql" 
+tmpdir = "C:/xampp/tmp" 
+datadir = "C:/xampp/mysql/data"
+pid_file = "mysql.pid"
+# enable-named-pipe
+key_buffer = 16M
+max_allowed_packet = 1M
+sort_buffer_size = 512K
+net_buffer_length = 8K
+read_buffer_size = 256K
+read_rnd_buffer_size = 512K
+myisam_sort_buffer_size = 8M
+log_error = "mysql_error.log"
+general_log=1
+log_output=TABLE
+
+# set default timeouts
+connect_timeout=28800
+interactive_timeout=28800
+wait_timeout=28800
+
+# Change here for bind listening
+bind-address="127.0.0.1" 
+# bind-address = ::1          # for ipv6
+
+# Where do all the plugins live
+plugin_dir = "C:/xampp/mysql/lib/plugin/" 
+
+# Don't listen on a TCP/IP port at all. This can be a security enhancement,
+# if all processes that need to connect to mysqld run on the same host.
+# All interaction with mysqld must be made via Unix sockets or named pipes.
+# Note that using this option without enabling named pipes on Windows
+# (via the "enable-named-pipe" option) will render mysqld useless!
+# 
+# commented in by lampp security
+#skip-networking
+#skip-federated
+
+# Replication Master Server (default)
+# binary logging is required for replication
+# log-bin deactivated by default since XAMPP 1.4.11
+#log-bin=mysql-bin
+
+# required unique id between 1 and 2^32 - 1
+# defaults to 1 if master-host is not set
+# but will not function as a master if omitted
+server-id	= 1
+
+# Replication Slave (comment out master section to use this)
+#
+# To configure this host as a replication slave, you can choose between
+# two methods :
+#
+# 1) Use the CHANGE MASTER TO command (fully described in our manual) -
+#    the syntax is:
+#
+#    CHANGE MASTER TO MASTER_HOST=<host>, MASTER_PORT=<port>,
+#    MASTER_USER=<user>, MASTER_PASSWORD=<password> ;
+#
+#    where you replace <host>, <user>, <password> by quoted strings and
+#    <port> by the master's port number (3306 by default).
+#
+#    Example:
+#
+#    CHANGE MASTER TO MASTER_HOST='125.564.12.1', MASTER_PORT=3306,
+#    MASTER_USER='joe', MASTER_PASSWORD='secret';
+#
+# OR
+#
+# 2) Set the variables below. However, in case you choose this method, then
+#    start replication for the first time (even unsuccessfully, for example
+#    if you mistyped the password in master-password and the slave fails to
+#    connect), the slave will create a master.info file, and any later
+#    change in this file to the variables' values below will be ignored and
+#    overridden by the content of the master.info file, unless you shutdown
+#    the slave server, delete master.info and restart the slaver server.
+#    For that reason, you may want to leave the lines below untouched
+#    (commented) and instead use CHANGE MASTER TO (see above)
+#
+# required unique id between 2 and 2^32 - 1
+# (and different from the master)
+# defaults to 2 if master-host is set
+# but will not function as a slave if omitted
+#server-id       = 2
+#
+# The replication master for this slave - required
+#master-host     =   <hostname>
+#
+# The username the slave will use for authentication when connecting
+# to the master - required
+#master-user     =   <username>
+#
+# The password the slave will authenticate with when connecting to
+# the master - required
+#master-password =   <password>
+#
+# The port the master is listening on.
+# optional - defaults to 3306
+#master-port     =  <port>
+#
+# binary logging - not required for slaves, but recommended
+#log-bin=mysql-bin
+
+
+# Point the following paths to different dedicated disks
+#tmpdir = "C:/xampp/tmp"
+#log-update = /path-to-dedicated-directory/hostname
+
+# Uncomment the following if you are using BDB tables
+#bdb_cache_size = 4M
+#bdb_max_lock = 10000
+
+# Comment the following if you are using InnoDB tables
+#skip-innodb
+innodb_data_home_dir = "C:/xampp/mysql/data"
+innodb_data_file_path = ibdata1:10M:autoextend
+innodb_log_group_home_dir = "C:/xampp/mysql/data"
+#innodb_log_arch_dir = "C:/xampp/mysql/data"
+## You can set .._buffer_pool_size up to 50 - 80 %
+## of RAM but beware of setting memory usage too high
+innodb_buffer_pool_size = 16M
+innodb_additional_mem_pool_size = 2M
+## Set .._log_file_size to 25 % of buffer pool size
+innodb_log_file_size = 5M
+innodb_log_buffer_size = 8M
+innodb_flush_log_at_trx_commit = 1
+innodb_lock_wait_timeout = 50
+
+## UTF 8 Settings
+#init-connect=\'SET NAMES utf8\'
+#collation_server=utf8_unicode_ci
+#character_set_server=utf8
+#skip-character-set-client-handshake
+#character_sets-dir="C:/xampp/mysql/share/charsets"
+
+[mysqldump]
+quick
+max_allowed_packet = 16M
+
+[mysql]
+no-auto-rehash
+# Remove the next comment character if you are not familiar with SQL
+#safe-updates
+
+[isamchk]
+key_buffer = 20M
+sort_buffer_size = 20M
+read_buffer = 2M
+write_buffer = 2M
+
+[myisamchk]
+key_buffer = 20M
+sort_buffer_size = 20M
+read_buffer = 2M
+write_buffer = 2M
+
+[mysqlhotcopy]
+interactive-timeout

config.inc

@@ -0,0 +1,341 @@
+<?php
+// @new
+/**
+ * Constant defining a debug log level
+ *
+ * @var int
+ */
+define('E_DEBUG', 65535);
+/**
+ * System paths
+ */
+define('DOC_ROOT', '{DOC_ROOT}');
+define('PWD_FILE', '{PWD_FILE}');
+define('TMP', '{TMP_PATH}');
+define('VER', '1.3.1');
+define('REL_DATE', '2018-02-28');
+define('LOG_LEVEL', '{E_ERROR}');
+define('LOG_PATH', '{LOG_PATH}');
+define('SALT', '{SALT}');
+define('ALGORITHM', '{ALGORITHM}');
+
+/**
+ * 3rd party tool paths
+ */
+define('PHP_BIN', '{PHP_BIN}');
+define('PHP_CONF', '{PHP_CONF}');
+define('NMAP_PATH', '{NMAP_PATH}');
+define('NESSUS_SVR', '{NESSUS_SVR}');
+
+/**
+ * Database config
+ */
+define('DB_SERVER', '{DB_SERVER}');
+define('DB_BIN', '{DB_BIN}');
+
+/**
+ * Application constants
+ */
+define('FLATTEN', '{FLATTEN}');
+define('WRAP_TEXT', '{WRAP_TEXT}');
+define('NOTIFICATIONS', '{NOTIFICATIONS}');
+define('PORT_LIMIT', '{PORT_LIMIT}');
+define('MAX_RESULTS', '{MAX_RESULTS}');
+define('ECHECKLIST_FORMAT', '{ECHECKLIST_FORMAT}');
+
+/**
+ * Company variables
+ */
+define('COMPANY', '{COMPANY}');
+define('COMP_ADD', '{COMP_ADD}');
+define('LAST_MODIFIED_BY', '{LAST_MODIFIED_BY}');
+define('CREATOR', '{CREATOR}');
+define('SYSTEM_CLASS', '{SYSTEM_CLASS}');
+define('CLASSIFIED_BY', '{CLASSIFIED_BY}');
+define('SCG', '{SCG}');
+define('DERIVED_ON', '{DERIVED_ON}');
+define('DECLASSIFY_ON', '{DECLASSIFY_ON}');
+
+/**
+ * Constant to define MySQL's DateTime format
+ *
+ * @var string
+ */
+define('MYSQL_DT_FORMAT', "Y-m-d H:i:s");
+
+/**
+ * Constant to define MySQL's Date format
+ *
+ * @var string
+ */
+define('MYSQL_D_FORMAT', "Y-m-d");
+
+/**
+ * Constant to define JSON header return
+ *
+ * @var string
+ */
+define('JSON', 'application/json');
+
+// {{{ UNSUPPORTED
+/**
+ * Constant that is default for file detection
+ *
+ * @var string
+ */
+define('UNSUPPORTED', 'UNSUPPORTED');
+// }}}
+// {{{ XML
+/**
+ * Constant for SCC XCCDF files
+ *
+ * @var string
+ */
+define('SCC_XCCDF', 'SCC_XCCDF');
+
+/**
+ * Constant for SCC OVAL files
+ *
+ * @var string
+ */
+define('SCC_OVAL', 'SCC_OVAL');
+
+/**
+ * Constant for DISA STIG XML files
+ *
+ * @var string
+ */
+define('DISA_STIG_XML', 'DISA_STIG_XML');
+
+/**
+ * Constant for DISA STIG OVAL XML files
+ *
+ * @var string
+ */
+define('DISA_STIG_OVAL', 'DISA_STIG_OVAL');
+
+/**
+ * Constant for Golddisk result files
+ *
+ * @var string
+ */
+define('GOLDDISK', 'GOLDDISK');
+
+/**
+ * Constant for NMap XML files
+ *
+ * @var string
+ */
+define('NMAP_XML', 'NMAP_XML');
+
+/**
+ * Constant for MBSA XML result files
+ *
+ * @var string
+ */
+define('MBSA_XML', 'MBSA_XML');
+
+/**
+ * Constant for MSSQL XML result files from script
+ *
+ * @var string
+ */
+define('MSSQL_XML', 'MSSQL_XML');
+
+/**
+ * Constant for unsupported XML files
+ *
+ * @var string
+ */
+define('UNSUPPORTED_XML', 'UNSUPPORTED_XML');
+// }}}
+// {{{ NESSUS
+/**
+ * Constant for NESSUS result files
+ *
+ * @var string
+ */
+define('NESSUS', 'NESSUS');
+
+/**
+ * Constant for Nessus messages log file
+ *
+ * @var string
+ */
+define('NESSUS_MESSAGES', 'NESSUS_MESSAGES');
+
+/**
+ * Constant for GZipped Nessus plugin file
+ *
+ * @var string
+ */
+define('NESSUS_PLUGIN_GZIP', 'NESSUS_PLUGIN_GZIP');
+
+/**
+ * Constant for Nessus plugin .nasl file
+ *
+ * @var string
+ */
+define('NESSUS_PLUGIN_NASL', 'NESSUS_PLUGIN_NASL');
+
+/**
+ * Constant for unsupported Nessus binary files
+ *
+ * @var string
+ */
+define('UNSUPPORTED_NESSUS_NBE', 'UNSUPPORTED_NESSUS_NBE');
+// }}}
+// {{{ .txt
+/**
+ * Constant for unsupported SCC text result files
+ *
+ * @var string
+ */
+define('UNSUPPORTED_SCC_TEXT', 'UNSUPPORTED_SCC_TEXT');
+
+/**
+ * Constant for unsupported SCC error log file
+ *
+ * @var string
+ */
+define('UNSUPPORTED_SCC_ERROR', 'UNSUPPORTED_SCC_ERROR');
+
+/**
+ * Constant for NMap text result files
+ *
+ * @var string
+ */
+define('NMAP_TEXT', 'NMAP_TEXT');
+
+/**
+ * Constant for NMap greppable text files
+ *
+ * @var string
+ */
+define('NMAP_GREPABLE', 'NMAP_GREPABLE');
+
+/**
+ * Constant for NMap Network Device result file
+ *
+ * @var string
+ */
+define('NMAP_NETWORK_DEVICE', 'NMAP_NETWORK_DEVICE');
+
+/**
+ * Constant for MBSA result text file
+ *
+ * @var string
+ */
+define('MBSA_TEXT', 'MBSA_TEXT');
+
+/**
+ * Constant for any other unsupported text file
+ *
+ * @var string
+ */
+define('UNSUPPORTED_TEXT', 'UNSUPPORTED TEXT');
+
+/**
+ * Constant for data files from host collection scripts
+ *
+ * @var string
+ */
+define('HOST_DATA_COLLECTION', 'HOST_DATA_COLLECTION');
+// }}}
+// {{{ .csv
+/**
+ * Constant for PDI catalog (not really used)
+ *
+ * @var string
+ */
+define('PDI_CATALOG', 'PDI_CATALOG');
+
+/**
+ * Constant for CSV echecklist file
+ *
+ * @var string
+ */
+define('ECHECKLIST_CSV', 'ECHECKLIST_CSV');
+
+/**
+ * Constant for unsupported retina CSV file format
+ *
+ * @var string
+ */
+define('UNSUPPORTED_RETINA_CSV', 'UNSUPPORTED_RETINA_CSV');
+
+/**
+ * Constant for any other unsupported CSV file format
+ *
+ * @var string
+ */
+define('UNSUPPORTED_CSV', 'UNSUPPORTED_CSV');
+// }}}
+// {{{ .xlsx|.xls
+/**
+ * Constant for an Excel technical echecklist file
+ *
+ * @var string
+ */
+define('TECH_ECHECKLIST_EXCEL', 'TECH_ECHECKLIST_EXCEL');
+
+/**
+ * Constant for an Excel procedural echecklist file
+ *
+ * @var string
+ */
+define('PROC_ECHECKLIST_EXCEL', 'PROC_ECHECKLIST_EXCEL');
+
+/**
+ * Constant for any other unsupported Excel file
+ *
+ * @var string
+ */
+define('UNSUPPORTED_EXCEL', 'UNSUPPORTED_EXCEL');
+// }}}
+// {{{ .zip
+/**
+ * Constant for DISA STIG benchmark ZIP file
+ *
+ * @var string
+ */
+define('DISA_STIG_BENCHMARK_ZIP', 'DISA_STIG_BENCHMARK');
+
+/**
+ * Constant for DISA STIG compilation library zip file
+ *
+ * @var string
+ */
+define('DISA_STIG_LIBRARY_ZIP', 'DISA_STIG_LIBRARY_ZIP');
+// }}}
+// {{{ .ckl
+/**
+ * Constant for STIG Viewer CKL extension file
+ *
+ * @var string
+ */
+define('STIG_VIEWER_CKL', 'STIG_VIEWER_CKL');
+// }}}
+// {{{ .Result|.log|.Examples
+/**
+ * Constant for unsupported UNIX SRR result file
+ *
+ * @var string
+ */
+define('UNSUPPORTED_UNIX_SRR', 'UNSUPPORTED_UNIX_SRR');
+// }}}
+
+/**
+ * Constant to designate file is a directory
+ *
+ * @var string
+ */
+define('DIRECTORY', 'DIRECTORY');
+
+/**
+ * Constant to designate an unsupported ini file (desktop.ini)
+ *
+ * @var string
+ */
+define('UNSUPPORTED_INI', 'UNSUPPORTED_INI');
+

data/compare.php

@@ -0,0 +1,97 @@
+<?php
+/**
+ * File: compare.php
+ * Author: Ryan Prather
+ * Purpose: Performs a high-level ST&E comparison
+ * Created: Dec 9, 2014
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Dec 9, 2014 - File created
+ */
+
+include_once 'database.inc';
+include_once 'header.inc';
+
+$db = new db();
+
+$left_ste = $db->get_STE($_REQUEST['left_ste'])[0];
+$right_ste = $db->get_STE($_REQUEST['right_ste'])[0];
+
+$left_tgts = $db->get_Target_Details($_REQUEST['left_ste']);
+$right_tgts = $db->get_Target_Details($_REQUEST['right_ste']);
+
+$left_cnt = (is_array($left_tgts) ? count($left_tgts) : 0);
+$right_cnt = (is_array($right_tgts) ? count($right_tgts) : 0);
+
+$left_cats = $db->get_STE_Category_List($left_ste->get_ID());
+$right_cats = $db->get_STE_Category_List($right_ste->get_ID());
+
+$left_cat_1 = 0;$left_cat_2 = 0;$left_cat_3 = 0;$left_nf = 0;$left_na = 0;$left_nr = 0;
+$right_cat_1 = 0;$right_cat_2 = 0;$right_cat_3 = 0;$right_nf = 0;$right_na = 0;$right_nr = 0;
+
+foreach($left_cats as $key => $cat) {
+  $left_cat_1 += $db->get_Finding_Count_By_Status($cat->get_ID(), "Open", "1");
+  $left_cat_2 += $db->get_Finding_Count_By_Status($cat->get_ID(), "Open", "2");
+  $left_cat_3 += $db->get_Finding_Count_By_Status($cat->get_ID(), "Open", "3");
+  $left_nf += $db->get_Finding_Count_By_Status($cat->get_ID(), "Not a Finding");
+  $left_na += $db->get_Finding_Count_By_Status($cat->get_ID(), "Not Applicable");
+  $left_nr += $db->get_Finding_Count_By_Status($cat->get_ID(), "Not Reviewed");
+}
+
+foreach($right_cats as $key => $cat) {
+  $right_cat_1 += $db->get_Finding_Count_By_Status($cat->get_ID(), "Open", "1");
+  $right_cat_2 += $db->get_Finding_Count_By_Status($cat->get_ID(), "Open", "2");
+  $right_cat_3 += $db->get_Finding_Count_By_Status($cat->get_ID(), "Open", "3");
+  $right_nf += $db->get_Finding_Count_By_Status($cat->get_ID(), "Not a Finding");
+  $right_na += $db->get_Finding_Count_By_Status($cat->get_ID(), "Not Applicable");
+  $right_nr += $db->get_Finding_Count_By_Status($cat->get_ID(), "Not Reviewed");
+}
+
+?>
+
+<table style='width:600px;'>
+  <tr>
+    <th>ST&amp;E</th>
+    <th>Target Count</th>
+    <th class='cat_I'>I</th>
+    <th class='cat_II'>II</th>
+    <th class='cat_III'>III</th>
+    <th class='nf'>NF</th>
+    <th class='na'>NA</th>
+    <th class='nr'>NR</th>
+    <th>Charts?</th>
+  </tr>
+  <tr>
+    <td><?php print $left_ste->get_System()->get_Name()." ".$left_ste->get_Site()->get_Name()." ".$left_ste->get_Eval_Start_Date()->format("Y-m-d")."-".$left_ste->get_Eval_End_Date()->format("Y-m-d") ?></td>
+    <td><?php print $left_cnt; ?></td>
+    <td class='cat_I'><?php print $left_cat_1; ?></td>
+    <td class='cat_II'><?php print $left_cat_2; ?></td>
+    <td class='cat_III'><?php print $left_cat_3; ?></td>
+    <td class='nf'><?php print $left_nf; ?></td>
+    <td class='na'><?php print $left_na; ?></td>
+    <td class='nr'><?php print $left_nr; ?></td>
+    <td>&nbsp;</td>
+  </tr>
+  <tr>
+    <td><?php print $right_ste->get_System()->get_Name()." ".$right_ste->get_Site()->get_Name()." ".$right_ste->get_Eval_Start_Date()->format("Y-m-d")."-".$right_ste->get_Eval_End_Date()->format("Y-m-d") ?></td>
+    <td><?php print $right_cnt; ?></td>
+    <td class='cat_I'><?php print $right_cat_1; ?></td>
+    <td class='cat_II'><?php print $right_cat_2; ?></td>
+    <td class='cat_III'><?php print $right_cat_3; ?></td>
+    <td class='nf'><?php print $right_nf; ?></td>
+    <td class='na'><?php print $right_na; ?></td>
+    <td class='nr'><?php print $right_nr; ?></td>
+    <td>&nbsp;</td>
+  </tr>
+</table>
+<form method="post" action="compare_targets.php">
+  <input type="hidden" name="left_ste" value="<?php print $_REQUEST['left_ste']; ?>" />
+  <input type="hidden" name="right_ste" value="<?php print $_REQUEST['right_ste']; ?>" />
+  <input type="submit" name="action" value="Compare Targets" />
+</form>

data/compare_host.php

@@ -0,0 +1,170 @@
+<?php
+/**
+ * File: compare_host.php
+ * Author: Ryan Prather
+ * Purpose: Allow the comparaison between 2 targets
+ * Created: Dec 16, 2014
+ *
+ * Portions Copyright 2016: Cyber Perspectives, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Dec 16, 2014 - File created
+ *  - Sep 1, 2016 - Updated copyright and file purpose
+ */
+
+include_once 'database.inc';
+include_once 'header.inc';
+
+$db = new db();
+
+$left_tgt = $db->get_Target_Details($_REQUEST['left_ste'], $_REQUEST['left_tgt'])[0];
+$right_tgt = $db->get_Target_Details($_REQUEST['right_ste'], $_REQUEST['right_tgt'])[0];
+
+$findings = $db->get_Finding_Comparrison($left_tgt, $right_tgt);
+?>
+
+<style type='text/css'>
+.none {
+  background-color: #808080;
+}
+.header {
+  color: #000;
+}
+td, th {
+  border: solid 1px black;
+}
+</style>
+
+<div id="wrapper">
+  <div id="main-wrapper">
+    <div class="12u" id="main-content">
+      <div class="5grid-layout" style="text-align: right;">
+        <div class="row">
+          <div class="12u">
+            <table style="width:100%;">
+              <thead>
+                <tr>
+                  <th class='header'>STIG ID</th>
+                  <th class='header'>CAT</th>
+                  <th class='header'>IA Controls</th>
+                  <th class='header'>Left Status</th>
+                  <th class='header'>Right Status</th>
+                  <th class='header'>Left Notes</th>
+                  <th class='header'>Right Notes</th>
+                </tr>
+              </thead>
+
+              <tbody>
+<?php
+$odd = true;
+foreach($findings['left'] as $stig_id => $find) {
+?>
+                <tr class="<?php print ($odd ? "odd" : "even"); ?>_row">
+                  <td><?php print $stig_id; ?></td>
+<?php
+  $str = "";
+  $diff = false;
+  if(is_null($find)) {
+    $str .= "&nbsp;";
+  }
+  else {
+    $str .= str_repeat("I", $find['cat']);
+  }
+
+  if(isset($findings['right'][$stig_id])) {
+    $str .= " / ".str_repeat("I", $findings['right'][$stig_id]['cat']);
+    if($find['cat'] != $findings['right'][$stig_id]['cat']) {
+      $diff = true;
+    }
+  }
+  else {
+    $str .= " /";
+  }
+
+  if($diff) {
+    print "<td style='background-color:#FFF200;'>".$str."</td>";
+  }
+  else {
+    print "<td>".$str."</td>";
+  }
+
+  $str = "";
+  $diff = false;
+  if(is_null($find)) {
+    $str .= "&nbsp;";
+  }
+  else {
+    $str .= $find['ia_controls'];
+  }
+
+  if(isset($findings['right'][$stig_id])) {
+    $str .= " / ".$findings['right'][$stig_id]['ia_controls'];
+    if($find['ia_controls'] != $findings['right'][$stig_id]['ia_controls']) {
+      $diff = true;
+    }
+  }
+  else {
+    $str .= " /";
+  }
+
+  if($diff) {
+    print "<td style='background-color:#FFF200;'>".$str."</td>";
+  }
+  else {
+    print "<td>".$str."</td>";
+  }
+
+  $str = "";
+  if(is_null($find)) {
+    $str .= "<td class='nr'>Not Reviewed</td>";
+  }
+  else {
+    $status = strtolower(str_replace(" ", "_", $find['status']));
+    $str .= "<td class='$status'>".$find['status']."</td>";
+  }
+
+  if(isset($findings['right'][$stig_id])) {
+    $status = strtolower(str_replace(" ", "_", $findings['right'][$stig_id]['status']));
+    $str .= "<td class='$status'>".$findings['right'][$stig_id]['status']."</td>";
+  }
+  else {
+    $str .= "<td class='nr'>Not Reviewed</td>";
+  }
+
+  print $str;
+
+  $str = "";
+  if(is_null($find)) {
+    $str .= "<td>&nbsp;</td>";
+  }
+  else {
+    $str .= "<td>".$find['notes']."</td>";
+  }
+
+  if(isset($findings['right'][$stig_id])) {
+    $str .= "<td>".$findings['right'][$stig_id]['notes']."</td>";
+  }
+  else {
+    $str .= "<td>&nbsp;</td>";
+  }
+
+  print $str;
+
+  $odd = !$odd;
+}
+?>
+              </tbody>
+            </table>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>

data/compare_targets.php

@@ -0,0 +1,155 @@
+<?php
+/**
+ * File: compare_targets.php
+ * Author: Ryan Prather
+ * Purpose: Compares two targets
+ * Created: Dec 15, 2014
+ *
+ * Portions Copyright 2016: Cyber Perspectives, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Dec 15, 2014 - File created
+ *  - Sep 1, 2016 - Copyright updated and file purpose
+ */
+
+include_once 'database.inc';
+include_once 'header.inc';
+
+$db = new db();
+
+$left_ste = $db->get_STE($_REQUEST['left_ste'])[0];
+$right_ste = $db->get_STE($_REQUEST['right_ste'])[0];
+
+$tgt_compare = $db->get_Target_Comparison($left_ste, $right_ste);
+?>
+
+<style type='text/css'>
+.none {
+  background-color: #808080;
+}
+.header {
+  color: #000;
+}
+td, th {
+  border: solid 1px black;
+}
+</style>
+
+<div id="wrapper">
+  <div id="main-wrapper">
+    <div class="12u" id="main-content">
+      <div class="5grid-layout" style="text-align: right;">
+        <div class="row">
+          <div class="12u">
+
+<table style='width:600px;'>
+  <thead>
+    <tr>
+      <th class='header'>Target</th>
+      <th class='cat_I'>I</th>
+      <th class='cat_II'>II</th>
+      <th class='cat_III'>III</th>
+      <th class='nf'>NF</th>
+      <th class='na'>NA</th>
+      <th class='nr'>NR</th>
+      <th class='none'>&nbsp;</th>
+      <th class='cat_I'>I</th>
+      <th class='cat_II'>II</th>
+      <th class='cat_III'>III</th>
+      <th class='nf'>NF</th>
+      <th class='na'>NA</th>
+      <th class='nr'>NR</th>
+    </tr>
+  </thead>
+
+  <tbody>
+
+<?php
+$odd = true;
+foreach($tgt_compare['left'] as $name => $left_tgt) {
+?>
+    <tr>
+<?php
+  if(is_null($left_tgt)) {
+?>
+      <td class="<?php print ($odd ? "odd" : "even"); ?>_row">
+        <form method="post" action="compare_host.php">
+          <input type='hidden' name='left_ste' value='<?php print $_REQUEST['left_ste']; ?>' />
+          <input type='hidden' name='left_tgt' value='null' />
+          <input type='hidden' name='right_ste' value='<?php print $_REQUEST['right_ste']; ?>' />
+          <input type='hidden' name='right_tgt' value='<?php print $tgt_compare['right'][$name]->get_ID(); ?>' />
+          <input type='submit' name='submit' value='<?php print $name; ?>' />
+        </form>
+      </td>
+      <td class='none'>&nbsp;</td>
+      <td class='none'>&nbsp;</td>
+      <td class='none'>&nbsp;</td>
+      <td class='none'>&nbsp;</td>
+      <td class='none'>&nbsp;</td>
+      <td class='none'>&nbsp;</td>
+      <td class='none'>&nbsp;</td>
+<?php
+  }
+  else {
+?>
+      <td class="<?php print ($odd ? "odd" : "even"); ?>_row">
+        <form method="post" action="compare_host.php">
+          <input type='hidden' name='left_ste' value='<?php print $_REQUEST['left_ste']; ?>' />
+          <input type='hidden' name='left_tgt' value='<?php print $left_tgt->get_ID(); ?>' />
+          <input type='hidden' name='right_ste' value='<?php print $_REQUEST['right_ste']; ?>' />
+          <input type='hidden' name='right_tgt' value='<?php print isset($tgt_compare['right'][$name]) ? $tgt_compare['right'][$name]->get_ID() : 'null'; ?>' />
+          <input type='submit' name='submit' value='<?php print $name; ?>' />
+        </form>
+      </td>
+      <td class='cat_I'><?php print $db->get_Host_Finding_Count_By_Status($left_tgt, "Open", 1); ?></td>
+      <td class='cat_II'><?php print $db->get_Host_Finding_Count_By_Status($left_tgt, "Open", 2); ?></td>
+      <td class='cat_III'><?php print $db->get_Host_Finding_Count_By_Status($left_tgt, "Open", 3); ?></td>
+      <td class='nf'><?php print $db->get_Host_Finding_Count_By_Status($left_tgt, "Not a Finding"); ?></td>
+      <td class='na'><?php print $db->get_Host_Finding_Count_By_Status($left_tgt, "Not Applicable"); ?></td>
+      <td class='nr'><?php print $db->get_Host_Finding_Count_By_Status($left_tgt, "Not Reviewed") ;?></td>
+      <td class='none'>&nbsp;</td>
+<?php
+  }
+
+  if(!isset($tgt_compare['right'][$name])) {
+?>
+      <td class='none'>&nbsp;</td>
+      <td class='none'>&nbsp;</td>
+      <td class='none'>&nbsp;</td>
+      <td class='none'>&nbsp;</td>
+      <td class='none'>&nbsp;</td>
+      <td class='none'>&nbsp;</td>
+<?php
+  }
+  else {
+?>
+      <td class='cat_I'><?php print $db->get_Host_Finding_Count_By_Status($tgt_compare['right'][$name], "Open", 1); ?></td>
+      <td class='cat_II'><?php print $db->get_Host_Finding_Count_By_Status($tgt_compare['right'][$name], "Open", 2); ?></td>
+      <td class='cat_III'><?php print $db->get_Host_Finding_Count_By_Status($tgt_compare['right'][$name], "Open", 3); ?></td>
+      <td class='nf'><?php print $db->get_Host_Finding_Count_By_Status($tgt_compare['right'][$name], "Not a Finding"); ?></td>
+      <td class='na'><?php print $db->get_Host_Finding_Count_By_Status($tgt_compare['right'][$name], "Not Applicable"); ?></td>
+      <td class='nr'><?php print $db->get_Host_Finding_Count_By_Status($tgt_compare['right'][$name], "Not Reviewed") ;?></td>
+<?php
+  }
+?>
+    </tr>
+<?php
+  $odd = !$odd;
+}
+?>
+
+  </tbody>
+</table>
+          </div>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>

data/findsearch.inc

@@ -0,0 +1,18 @@
+<?php
+/**
+ * File: findsearch.inc
+ * Author: Ryan
+ * Purpose: File to establish a filter searching for findings
+ * Created: Sep 7, 2016
+ *
+ * Copyright 2016: Cyber Perspectives, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 7, 2016 - File created
+ */
+
+$finding_filter_width = 990;
+include_once 'finding-filter.inc';

data/index.php

@@ -0,0 +1,877 @@
+<?php
+/**
+ * File: index.php
+ * Author: Ryan Prather
+ * Purpose: Index page for Data Management
+ * Created: Sep 16, 2013
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 16, 2013 - File created
+ *  - Sep 1, 2016 - Copyright updated and added new searching filters
+ *  - Oct 10, 2016 - Added declaration and initialization for variables (bug #5)
+ *  - Oct 24, 2016 - Removed onmouseover and onmouseout attributes to left nav buttons and added JS to add them after load
+ * 					 Commented out reference, scan, and finding filter buttons
+ *  - Nov 7, 2016 - Changed includes to include_once
+ *  - Dec 12, 2016 - Added parsing for new constants (COMPANY, COMP_ADD, CREATOR, and LAST_MODIFIED_BY),
+ *                   ensured all configuration elements are present, and updated jquery 1.10.2 to 1.11.3
+ *  - Feb 15, 2017 - Formatting
+ *  - Mar 22, 2017 - Changed catalog table to use DataTables instead of tablesorter JS library
+ *  - May 13, 2017 - Added support for STIG checklist editing
+ *                   Added support for editing the default output format for eChecklist exports
+ *  - May 19, 2017 - Formatting, added saving audible results complete notification, added filtering to site, system, and STE saving
+ *  - May 25, 2017 - Fixed search functionality
+ *  - May 26, 2017 - Restored Enter key press for search execution
+ *  - Jun 3, 2017 - Changed table stripping to use consistent classes across the system
+ *  - Jan 20, 2018 - Fixed bug with system and site datatype for new ST&E
+ */
+include_once 'config.inc';
+include_once 'helper.inc';
+include_once 'database.inc';
+include_once 'import.inc';
+
+$db = new db();
+
+/**
+ * @todo add reset.php to left nav
+ */
+$action = filter_input(INPUT_POST, 'action', FILTER_SANITIZE_STRING);
+$ste = filter_input(INPUT_COOKIE, 'ste', FILTER_VALIDATE_INT);
+if (!$ste) {
+  $ste = filter_input(INPUT_POST, 'ste', FILTER_VALIDATE_INT);
+}
+$page = filter_input(INPUT_GET, 'p', FILTER_SANITIZE_STRING);
+
+$ste_mgmt = '';
+$ms_mgmt = '';
+$cat_mgmt = '';
+$site_mgmt = '';
+$search = '';
+$settings = '';
+$tgt_search = '';
+$ref_search = '';
+$scan_search = '';
+$find_search = '';
+
+if (isset($action)) {
+  if ($action == 'save-ste') {
+    $defaults = array(
+      'filter' => FILTER_SANITIZE_STRING,
+      'flag'   => FILTER_NULL_ON_FAILURE
+    );
+
+    $args = array(
+      'ste'         => array(
+        'filter' => FILTER_VALIDATE_INT,
+        'flag'   => FILTER_NULL_ON_FAILURE
+      ),
+      'system'      => array(
+        'filter' => FILTER_VALIDATE_INT,
+        'flag'   => FILTER_NULL_ON_FAILURE
+      ),
+      'site'        => array(
+        'filter' => FILTER_VALIDATE_INT,
+        'flag'   => FILTER_NULL_ON_FAILURE
+      ),
+      'start_date'  => $defaults,
+      'end_date'    => $defaults,
+      'assumptions' => $defaults,
+      'constraints' => $defaults,
+      'scope'       => $defaults,
+      'ao'          => $defaults
+    );
+
+    $params = filter_input_array(INPUT_POST, $args);
+
+    $sys = $db->get_System($params['system'])[0];
+    $site = $db->get_Site($params['site'])[0];
+
+    $ste = new ste($params['ste'], $sys, $site, $params['start_date'], $params['end_date'], null, null);
+    $ste->set_Assumptions($params['assumptions']);
+    $ste->set_Constraints($params['constraints']);
+    $ste->set_Scope($params['scope']);
+    $ste->set_AO($params['ao']);
+
+    $db->save_STE($ste);
+  }
+  elseif ($action == 'save-system') {
+    $defaults = array(
+      'filter' => FILTER_SANITIZE_STRING,
+      'flag'   => FILTER_NULL_ON_FAILURE
+    );
+
+    $args = array(
+      'system'      => array(
+        'filter' => FILTER_VALIDATE_INT,
+        'flag'   => FILTER_NULL_ON_FAILURE
+      ),
+      'name'        => $defaults,
+      'mac'         => $defaults,
+      'class'       => $defaults,
+      'description' => $defaults,
+      'abbr'        => $defaults,
+      'accred_type' => $defaults
+    );
+
+    $params = filter_input_array(INPUT_POST, $args);
+
+    $system = new system($params['system'], $params['name'], $params['mac'], $params['class']);
+    $system->set_Description($params['description']);
+    $system->set_Abbreviation($params['abbr']);
+
+    switch ($params['accred_type']) {
+      case 'diacap':
+        $system->set_Accreditation_Type(accrediation_types::DIACAP);
+        break;
+      case 'rmf':
+        $system->set_Accreditation_Type(accrediation_types::RMF);
+        break;
+      case 'pci':
+        $system->set_Accreditation_Type(accrediation_types::PCI);
+        break;
+      case 'nispom':
+        $system->set_Accreditation_Type(accrediation_types::NISPOM);
+        break;
+      case 'hipaa':
+        $system->set_Accreditation_Type(accrediation_types::HIPAA);
+        break;
+      case 'cobit':
+        $system->set_Accreditation_Type(accrediation_types::COBIT);
+        break;
+      case 'sox':
+        $system->set_Accreditation_Type(accrediation_types::SOX);
+        break;
+      default:
+        $system->set_Accreditation_Type(accrediation_types::DIACAP);
+    }
+
+    $db->save_System($system);
+    ?>
+
+    <script src="/style/5grid/jquery-1.11.3.min.js"></script>
+    <script type='text/javascript'>
+      $(function () {
+        if (confirm("Would you like to move on to site management?")) {
+          location.href = "index.php?p=SiteMgmt";
+        }
+      });
+    </script>
+
+    <?php
+  }
+  elseif ($action == 'save-site') {
+    $defaults = array(
+      'filter' => FILTER_SANITIZE_STRING,
+      'flag'   => FILTER_NULL_ON_FAILURE
+    );
+    $params = array(
+      'site'      => array(
+        'filter' => FILTER_VALIDATE_INT,
+        'flag'   => FILTER_NULL_ON_FAILURE
+      ),
+      'name'      => $defaults,
+      'address'   => $defaults,
+      'city'      => $defaults,
+      'state'     => $defaults,
+      'zip'       => $defaults,
+      'country'   => $defaults,
+      'poc_name'  => $defaults,
+      'poc_phone' => $defaults,
+      'poc_email' => $defaults
+    );
+    $p = filter_input_array(INPUT_POST, $params);
+
+    $site = new site($p['site'], $p['name'], $p['address'], $p['city'], $p['state'], $p['zip'], $p['country'], $p['poc_name'], $p['poc_email'], $p['poc_phone']);
+    $db->save_Site($site);
+    ?>
+
+    <script src="/style/5grid/jquery-1.11.3.min.js"></script>
+    <script type="text/javascript">
+      $(function () {
+        if (confirm("Would you like to move on to ST&E management?")) {
+          location.href = "index.php?p=STEMgmt";
+        }
+      });
+    </script>
+
+    <?php
+  }
+  elseif ($action == 'Save Settings') {
+    $params = array(
+      'filter' => FILTER_SANITIZE_STRING,
+      'flag'   => FILTER_NULL_ON_FAILURE
+    );
+    $args = array(
+      'company'            => $params,
+      'comp_add'           => $params,
+      'last_modified_by'   => $params,
+      'creator'            => $params,
+      'log_level'          => $params,
+      'flatten_echecklist' => array(
+        'filter' => FILTER_VALIDATE_BOOLEAN
+      ),
+      'wrap_text'          => array(
+        'filter' => FILTER_VALIDATE_BOOLEAN
+      ),
+      'notifications'      => array(
+        'filter' => FILTER_VALIDATE_BOOLEAN
+      ),
+      'port_limit'         => array(
+        'filter'  => FILTER_VALIDATE_INT,
+        'flag'    => FILTER_REQUIRE_ARRAY,
+        'options' => array('max_range' => 10000)
+      ),
+      'max_result_import'  => array(
+        'filter'  => FILTER_VALIDATE_INT,
+        'flag'    => FILTER_REQUIRE_ARRAY,
+        'options' => array('max_range' => 20)
+      ),
+      'output_format'      => array(
+        'filter'  => FILTER_VALIDATE_REGEXP,
+        'flag'    => FILTER_NULL_ON_FAILURE,
+        'options' => array('regexp' => "/xlsx|xls|html|csv|pdf|ods/")
+      )
+    );
+    $fields = filter_input_array(INPUT_POST, $args);
+  }
+}
+
+if ($page) {
+  if ($page == 'STEMgmt' || $page == 'EditSTE') {
+    $all_systems = $db->get_System();
+    $all_sites = $db->get_Site();
+    $title_prefix = "ST&amp;E Mgmt";
+    $ste_mgmt = "style='color:#FFF;'";
+  }
+  elseif ($page == 'MSMgmt' || $page == 'EditMS') {
+    $ms_mgmt = "style='color:#FFF;'";
+    $title_prefix = "System Mgmt";
+    $all_systems = $db->get_System();
+  }
+  elseif ($page == 'SiteMgmt' || $page == 'EditSite') {
+    $site_mgmt = "style='color:#FFF;'";
+    $title_prefix = "Site Mgmt";
+    $all_sites = $db->get_Site();
+  }
+  elseif ($page == 'CatMgmt') {
+    $cat_mgmt = "style='color:#FFF;'";
+    $title_prefix = "Catalog Mgmt";
+  }
+  elseif ($page == 'Settings') {
+    $settings = "style='color:#FFF;'";
+    $title_prefix = "Settings";
+  }
+  elseif ($page == 'TgtSearch') {
+    $tgt_search = "style='color:#fff;'";
+    $title_prefix = "Target Search";
+  }
+  elseif ($page == 'RefSearch') {
+    $ref_search = "style='color:#fff;'";
+    $title_prefix = "Reference Search";
+  }
+  elseif ($page == 'ScanSearch') {
+    $scan_search = "style='color:#fff;'";
+    $title_prefix = "Scan Search";
+  }
+  elseif ($page == 'FindSearch') {
+    $find_search = "style='color:#fff;'";
+    $title_prefix = "Finding Search";
+  }
+  elseif ($page == 'Search') {
+    $title_prefix = "Search";
+    $search = "style='color:#FFF;'";
+  }
+}
+
+include_once 'header.inc';
+?>
+
+<style type="text/css">
+  nav {
+    width: 15%;
+    float: left;
+  }
+
+  nav div {
+    width: 93%;
+    background-color: #3992e7;
+    margin: 2px 0;
+    padding-left: 5px;
+    border-radius: 5px;
+  }
+
+  .sub {
+    color: #041e4d;
+    text-decoration: none;
+    width: 170px;
+    margin: 4px 0;
+    padding-left: 5px;
+    border-radius: 5px;
+    background-image: -webkit-gradient(linear, 0% 0%, 0% 100%, from(#8FBFEE),
+      to(#5B7CC2));
+    background-image: -moz-linear-gradient(top, #8FBFEE, #5B7CC2);
+    background-image: -ms-linear-gradient(top, #8FBFEE, #5B7CC2);
+    background-image: -o-linear-gradient(top, #8FBFEE, #5B7CC2);
+    box-shadow: inset 0px 0px 0px 2px #FFF, 0px 2px 2px 0px;
+    display: block;
+  }
+
+  .sub_mouseover {
+    background-image: -webkit-gradient(linear, 0% 0%, 0% 100%, from(#7198BE),
+      to(#1B449B));
+    background-image: -moz-linear-gradient(top, #7198BE, #1B449B);
+    background-image: -ms-linear-gradient(top, #7198BE, #1B449B);
+    background-image: -o-linear-gradient(top, #7198BE, #1B449B);
+  }
+
+  #content {
+    width: 82%;
+    float: left;
+    border: solid 3px #AFB5BB;
+    border-radius: 7px;
+    height: 650px;
+    padding: 0 10px;
+    overflow-y: scroll;
+  }
+</style>
+
+<div id='wrapper'>
+  <div id='main-wrapper'>
+    <div class='12u' id='main-content'>
+      <div class='5grid-layout'>
+        <nav class="mobileUI-site-nav">
+          <a href="/data/?p=MSMgmt"
+             class="sub" <?php print $ms_mgmt; ?>>System Management</a>
+          <a href="/data/?p=SiteMgmt"
+             class="sub" <?php print $site_mgmt; ?>>Site Management</a>
+          <a href="/data/?p=STEMgmt"
+             class="sub" <?php print $ste_mgmt; ?>>ST&amp;E Management</a>
+          <a href="/data/?p=CatMgmt"
+             class="sub" <?php print $cat_mgmt; ?>>Catalog Management</a>
+          <a href="/data/?p=Settings"
+             class="sub" <?php print $settings; ?>>Settings</a>
+          <a href="/data/?p=TgtSearch"
+             class="sub" <?php print $tgt_search; ?>>Target Search</a>
+          <!--
+                    <a href="/data/?p=RefSearch"
+                      class="sub" <?php print $ref_search; ?>>Reference Search</a>
+                    <a href="/data/?p=ScanSearch"
+                      class="sub" <?php print $scan_search; ?>>Scan Search</a>
+                    <a href="/data/?p=FindSearch"
+                      class="sub" <?php print $find_search; ?>>Finding Searcch</a>
+          -->
+          <a href="/data/?p=Search" class="sub" <?php print $search; ?>>Search</a>
+        </nav>
+        <div id='content' style='<?php
+        if ($page == 'Search') {
+          print 'position:relative;';
+        }
+        ?>'>
+               <?php
+               if ($page == 'STEMgmt' || $page == 'EditSTE') {
+                 include_once 'stemgmt.inc';
+               }
+               elseif ($page == 'MSMgmt' || $page == 'EditMS') {
+                 include_once 'sysmgmt.inc';
+               }
+               elseif ($page == 'SiteMgmt' || $page == 'EditSite') {
+                 include_once 'sitemgmt.inc';
+               }
+               elseif ($page == 'TgtSearch') {
+                 include_once 'tgtsearch.inc';
+               }
+               elseif ($page == 'RefSearch') {
+                 include_once 'refsearch.inc';
+               }
+               elseif ($page == 'ScanSearch') {
+                 include_once 'scansearch.inc';
+                 print "<div id='scan-filter-results'></div>" .
+                     "<div id='load-more'>" .
+                     "<a href='javascript:void(0);' onclick='load_more=true;execute_filter();'>Load More...</a>" .
+                     "</div>";
+               }
+               elseif ($page == 'FindSearch') {
+                 include_once 'findsearch.inc';
+               }
+               elseif ($page == 'Settings') {
+                 include_once 'settings.inc';
+               }
+               elseif ($page == 'CatMgmt') {
+                 ?>
+            <script src='/script/datatables/DataTables-1.10.9/js/jquery.dataTables.min.js'></script>
+            <link rel="stylesheet" href="/script/datatables/DataTables-1.10.9/css/jquery.dataTables.min.css" />
+            <link rel='stylesheet' href='/script/jquery-ui-1.11.4/jquery-ui.min.css' />
+
+            <style type='text/css'>
+              #availableSoftware {
+                height: 227px;
+                width: 240px;
+                overflow-x: scroll;
+                font-size: 14px;
+                line-height: 1.25em;
+              }
+
+              .swmouseover {
+                background-color: #1D57A0;
+                color: #fff;
+                cursor: pointer;
+              }
+            </style>
+            <script type='text/javascript'>
+    $(function () {
+      $('#catalog').DataTable({
+        'stripeClasses': ['odd_row', 'even_row']
+      });
+      $('.close, .backdrop').click(function () {
+        close_box();
+      });
+      $('#release-date').datepicker();
+    });
+
+    function close_box() {
+      $('.backdrop, .box').animate({
+        'opacity': '0'
+      }, 300, 'linear', function () {
+        $('.backdrop, .box').css('display', 'none');
+      });
+    }
+
+    function view_box() {
+      $('.backdrop').animate({
+        'opacity': '.5'
+      }, 300, 'linear');
+      $('.backdrop').css('display', 'block');
+    }
+
+    function get_cat_data(fname) {
+      $('#popup').animate({
+        'opacity': '1.00'
+      }, 300, 'linear');
+      $('#popup').css('display', 'block');
+      view_box();
+
+      $.ajax('/ajax.php', {
+        data: {
+          action: 'get-cat-data',
+          'fname': fname
+        },
+        beforeSend: function () {
+          $('#id').val('');
+          $('#checklist-id').text('');
+          $('#name').val('');
+          $('#description').val('');
+          $('#version').text('');
+          $('#release').text('');
+          $('#icon').val('');
+          $('#type').text('');
+          $('#software option').remove();
+          $('#cpe').val('');
+        },
+        success: function (data) {
+          $('#id').val(data.id);
+          $('#checklist-id').text(data.checklist_id);
+          $('#name').val(data.name);
+          $('#description').val(data.description);
+          $('#version').text(data.ver);
+          $('#release').text(data.release);
+          $('#icon').val(data.icon);
+          $('#type').text(data.type);
+
+          var dt = new Date(data.date.date);
+          $('#release-date').val(dt.getMonth() + "/" + dt.getDate() + '/' + dt.getFullYear());
+
+          for (var x in data.sw) {
+            $('#software').append("<option id='" + data.sw[x].id + "'>" +
+                    data.sw[x].man + " " + data.sw[x].name + " " + data.sw[x].ver +
+                    "</option>");
+          }
+
+          $('#software option').dblclick(remove_Software);
+        },
+        error: function (xhr, status, error) {
+          console.error(error);
+        },
+        timeout: 3000,
+        method: 'post',
+        dataType: 'json'
+      });
+    }
+
+    function remove_Software() {
+      $.ajax("/ajax.php", {
+        data: {
+          action: 'checklist-remove-software',
+          chk_id: $('#id').val(),
+          sw_id: $(this).attr('id')
+        },
+        success: function (data) {
+          if (data.error) {
+            alert(data.error);
+          }
+          else if (data.success) {
+            alert(data.success);
+          }
+        },
+        error: function (xhr, status, error) {
+          console.error(error);
+        },
+        dataType: 'json',
+        timeout: 3000,
+        method: 'post'
+      });
+
+      $(this).remove();
+    }
+
+    function autocomplete_software() {
+      if ($('#cpe').val().length < 3) {
+        return;
+      }
+
+      $.ajax('/ajax.php', {
+        data: {
+          action: ($('#os').is(":checked") ? 'os_filter' : 'sw_filter'),
+          filter: $('#cpe').val()
+        },
+        success: function (data) {
+          $('#availableSoftware div').remove();
+          for (var x in data) {
+            $('#availableSoftware').append("<div sw_id='" + data[x].sw_id + "' cpe='" + data[x].cpe + "'>" + data[x].sw_string + "</div>");
+          }
+          $('#availableSoftware').show();
+
+          $('#availableSoftware div').each(function () {
+            $(this).on("mouseover", function () {
+              $(this).addClass("swmouseover");
+            });
+            $(this).on("mouseout", function () {
+              $(this).removeClass("swmouseover");
+            });
+            $(this).on("click", function () {
+              add_software($(this).attr('sw_id'));
+              $('#software').append("<option value='" + $(this).attr('sw_id') + "' ondblclick='remove_Software();$(this).remove();'>" + $(this).html() + "</option>");
+              $(this).remove();
+            });
+          });
+        },
+        error: function (xhr, status, error) {
+          console.error(error);
+        },
+        dataType: 'json',
+        method: 'post',
+        timeout: 5000
+      });
+    }
+
+    function add_software(sw_id) {
+      $.ajax('/ajax.php', {
+        data: {
+          action: 'checklist-add-software',
+          'sw_id': sw_id,
+          chk_id: $('#id').val()
+        },
+        success: function (data) {
+          alert(data.status);
+        },
+        error: function (xhr, status, error) {
+          console.error(error);
+        },
+        dataType: 'json',
+        method: 'post',
+        timeout: 3000
+      });
+    }
+            </script>
+            <style type="text/css">
+              thead {
+                background-image: linear-gradient(to bottom, #ECECEC, rgba(177,177,177,0.72));
+                color: #4c4c4c;
+              }
+            </style>
+
+            <div>
+              <table id='catalog' class='display'>
+                <thead>
+                  <tr>
+                    <th>File Name</th>
+                    <th>Status</th>
+                    <th>Start Time</th>
+                    <th>% Complete</th>
+                    <th>STIG Count</th>
+                  </tr>
+                </thead>
+
+                <tbody>
+                  <?php
+                  $cat_scripts = $db->get_Catalog_Script();
+                  $odd = true;
+                  foreach ($cat_scripts as $key => $cat_script) {
+                    print "<tr>" .
+                        "<td onclick='javascript:get_cat_data(\"{$cat_script->file_name}\");'><a href='javascript:void(0);'>{$cat_script->file_name}</a></td>" .
+                        "<td>{$cat_script->status}</td>" .
+                        "<td>{$cat_script->start_time->format("Y-m-d H:i:s")}</td>" .
+                        "<td>{$cat_script->perc_comp}</td>" .
+                        "<td>{$cat_script->stig_count}</td>" .
+                        "</td>";
+                  }
+                  ?>
+                </tbody>
+              </table>
+            </div>
+
+            <div id='popup' class='box'>
+              <div style='display:inline-block;width:49%;vertical-align:top;'>
+                <input type='hidden' id='id' />
+                Checklist ID: <span id='checklist-id'></span><br />
+                Name: <input type='text' id='name' /><br />
+                Description: <input type='text' id='description' /><br />
+                Version: <span id='version'></span><br />
+                Release: <span id='release'></span><br />
+                Release Date: <input type='text' id='release-date' /><br />
+                Icon: <input type='text' id='icon' /><br />
+                Type: <span id='type'></span>
+              </div>
+
+              <div style='display:inline-block;width:49%;'>
+                <select id='software' multiple size='10'></select><br />
+
+                Add CPE: <input type='text' id='cpe' onkeyup='javascript:autocomplete_software();' />&nbsp;&nbsp;
+                <label for='os'>OS?</label>
+                <input type='checkbox' id='os' /><br />
+                <div id="availableSoftware"></div>
+              </div>
+            </div>
+
+            <div class="backdrop"></div>
+            <?php
+          }
+          elseif ($page == 'Search') {
+            $q = filter_input(INPUT_POST, 'q', FILTER_SANITIZE_STRING, FILTER_NULL_ON_FAILURE);
+            $type = '';
+
+            if (strpos($q, '=') !== false) {
+              list($type, $q) = explode("=", $q);
+            }
+            ?>
+
+            <script src='/script/datatables/DataTables-1.10.9/js/jquery.dataTables.min.js'></script>
+            <link rel="stylesheet" href="/script/datatables/DataTables-1.10.9/css/jquery.dataTables.min.css" />
+            <link rel='stylesheet' href='/script/jquery-ui-1.11.4/jquery-ui.min.css' />
+            <script type='text/javascript'>
+                  var default_headers = [
+                    {'title': 'STIG ID', 'data': 'stig_id'},
+                    {'title': 'VMS ID', 'data': 'vms_id'},
+                    {'title': 'Checklist Name', 'data': 'name'},
+                    {'title': 'Type', 'data': 'type'},
+                    {'title': 'PDI', 'data': 'pdi_id'},
+                    {'title': 'File Name', 'data': 'file'}
+                  ];
+
+                  var cve_headers = [
+                    {'title': 'PDI ID', 'data': 'pdi_id'},
+                    {'title': 'CVE ID', 'data': 'cve_id'},
+                    {'title': 'Description', 'data': 'desc'},
+                    {'title': 'Status', 'data': 'status'},
+                    {'title': 'Reference', 'data': 'ref'}
+                  ];
+
+                  var cpe_headers = [
+                    {'title': 'Man', 'data': 'man'},
+                    {'title': 'Name', 'data': 'name'},
+                    {'title': 'Ver', 'data': 'ver'},
+                    {'title': 'CPE', 'data': 'cpe'},
+                    {'title': 'String', 'data': 'sw_string'}
+                  ];
+
+                  var iavm_headers = [
+                    {'title': 'PDI ID', 'data': 'pdi_id'},
+                    {'title': 'IAVM Notice', 'data': 'iavm'},
+                    {'title': 'Title', 'data': 'title'},
+                    {'title': 'Category', 'data': 'cat'},
+                    {'title': 'Link', 'data': 'link'}
+                  ];
+                  var start = 0;
+                  var table = null;
+                  $(function () {
+                    $('.close, .backdrop').click(function () {
+                      close_box();
+                    });
+                    $('#q').keyup(function (e) {
+                      start = 0;
+                      var code = e.which;
+                      if (code == 13)
+                        query();
+                    });
+                    if ($('#q').val()) {
+                      query();
+                    }
+                  });
+
+                  function query() {
+                    if (table) {
+                      table.destroy();
+                    }
+                    if ($('#type').val() == 'cve')
+                      headers = cve_headers;
+                    else if ($('#type').val() == 'cpe')
+                      headers = cpe_headers;
+                    else if ($('#type').val() == 'iavm')
+                      headers = iavm_headers;
+                    else
+                      headers = default_headers;
+
+                    table = $('#results').DataTable({
+                      pageLength: 100,
+                      serverSide: true,
+                      stripeClasses: ['odd_row', 'even_row'],
+                      columns: headers,
+                      ajax: {
+                        beforeSend: function () {
+                          $('body').addClass('loading');
+                        },
+                        url: '/search.php',
+                        method: 'POST',
+                        data: {
+                          type: $('#type').val(),
+                          q: $('#q').val()
+                        },
+                        complete: function () {
+                          $('body').removeClass('loading');
+                        }
+                      }
+                    });
+                  }
+
+                  function open_stig(file, id) {
+                    $('#search_result').attr('src', '../reference/stigs/stig.php?file=' + file + '&vms=' + id);
+                    $('#search_result').animate({'opacity': '1.00'}, 300, 'linear');
+                    $('#search_result').css('display', 'block');
+                    view_box();
+                  }
+
+                  function open_pdi(pdi) {
+                    $('#search_result').attr('src', 'pdi.php?pdi=' + pdi);
+                    $('#search_result').animate({'opacity': '1.00'}, 300, 'linear');
+                    $('#search_result').css('display', 'block');
+                    view_box();
+                  }
+
+                  function view_box() {
+                    $('.backdrop').animate({
+                      'opacity': '.5'
+                    }, 300, 'linear');
+                    $('.backdrop').css('display', 'block');
+                    $('html, body').css({
+                      'overflow': 'hidden',
+                      'height': '100%'
+                    });
+                  }
+
+                  function close_box() {
+                    $('.backdrop, .box').animate({
+                      'opacity': '0'
+                    }, 300, 'linear', function () {
+                      $('.backdrop, .box').css('display', 'none');
+                    });
+                    $('html, body').css({
+                      'overflow': 'auto',
+                      'height': '100%'
+                    });
+                  }
+            </script>
+
+            <?php
+            $waiting = rand(1, 7);
+            ?>
+
+            <style type='text/css'>
+              #search_tip {
+                display: none;
+                z-index: 1000;
+                background-color: #FFE681;
+                color: #000;
+                width: 200px;
+                font-size: 16px;
+                padding: 4px;
+                border: solid 1px black;
+                line-height: 1em;
+                position: absolute;
+              }
+              body.loading {
+                overflow: hidden;
+              }
+              body.loading .modal {
+                display: block;
+              }
+              .modal {
+                display: none;
+                position: fixed;
+                z-index: 1000;
+                top: 0;
+                left: 0;
+                height: 100%;
+                width: 100%;
+                background: rgba( 255, 255, 255, .8 ) url('/img/waiting/waiting_<?php print $waiting; ?>.gif') 50% 50% no-repeat;
+                background-size: 256px;
+              }
+            </style>
+
+            <form method='post' action='#' onsubmit='return false;'>
+              <select id='type'>
+                <option value=''>Filter</option>
+                <option value='cpe' <?php print (strtolower($type) == 'cpe' ? 'selected' : ''); ?>>CPE</option>
+                <option value='cve' <?php print (strtolower($type) == 'cve' ? 'selected' : ''); ?>>CVE</option>
+                <option value='ia' <?php print (strtolower($type) == 'ia' ? 'selected' : ''); ?>>IA Controls</option>
+                <option value='iavm' <?php print (strtolower($type) == 'iavm' ? 'selected' : ''); ?>>IAVM</option>
+                <option value='nessus' <?php print (strtolower($type) == 'nessus' ? 'selected' : ''); ?>>Nessus</option>
+                <option value='stig' <?php print (strtolower($type) == 'stig' ? 'selected' : ''); ?>>STIG</option>
+                <option value='vms' <?php print (strtolower($type) == 'vms' ? 'selected' : ''); ?>>VMS</option>
+              </select>
+              <input type='text' name='q' id='q' <?php print ($q ? "value='$q'" : ""); ?> placeholder='Search...' /><br />
+
+              <input type='button' class='button' name='search' value='Search' onclick='javascript:query();' />
+            </form>
+
+            <div>
+              <table id='results' class='display'>
+                <thead></thead>
+                <tbody></tbody>
+              </table>
+            </div>
+
+            <?php
+          }
+          ?>
+        </div>
+      </div>
+    </div>
+  </div>
+</div>
+
+<script type='text/javascript'>
+  $(function () {
+    $('.sub').mouseover(function () {
+      $(this).addClass('sub_mouseover');
+    });
+    $('.sub').mouseout(function () {
+      $(this).removeClass('sub_mouseover');
+    });
+  });
+</script>
+
+<iframe id='search_result' class='box' style='width: 80%; height: 80%; top: 10%; left: 10%;'></iframe>
+
+<div class="backdrop"></div>
+
+<div class='modal'></div>
+
+<?php
+include_once 'footer.inc';

data/pdi.php

@@ -0,0 +1,59 @@
+<?php
+/**
+ * File: pdi.php
+ * Author: Ryan Prather
+ * Purpose: Get a PDI and display all associated information
+ * Created: Feb 13, 2014
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Feb 13, 2014 - File created
+ */
+include_once 'config.inc';
+include_once 'helper.inc';
+include_once 'database.inc';
+
+$pdi_id = filter_input(INPUT_GET, 'pdi', FILTER_VALIDATE_INT, FILTER_NULL_ON_FAILURE);
+
+if (!$pdi_id) {
+  die("Need a valid PDI");
+}
+
+$db = new db();
+
+$pdi = $db->get_PDI($pdi_id);
+$pdi_catalog = $db->get_PDI_Catalog($pdi_id);
+$stigs = $db->get_STIG_By_PDI($pdi_id);
+$gds = $db->get_GoldDisk_By_PDI($pdi_id);
+$ias = $db->get_IA_Controls_By_PDI($pdi_id);
+?>
+
+<!doctype HTML>
+
+<html>
+  <body>
+    <table>
+      <tr>
+        <td><?php print (is_a($stigs, 'stig') ? $stigs->get_ID() : null); ?></td>
+        <td><?php foreach ($gds as $key => $gd) : print $gd->get_ID() . " "; endforeach; ?></td>
+        <td>Cat <?php print $pdi->get_Category_Level_String(); ?></td>
+        <td><?php foreach ($ias as $key => $ia): print $ia->get_Type() . "-" . $ia->get_Type_ID() . " "; endforeach; ?></td>
+        <td>PDI ID: <?php print $pdi->get_ID(); ?></td>
+      </tr>
+      <tr>
+        <td colspan=5><span style="font-weight:bold;">Short Title:</span> <?php print nl2br($pdi->get_Short_Title()); ?></td>
+      </tr>
+      <tr>
+        <td colspan=5><span style="font-weight:bold;">Description:</span><br /><?php print nl2br($pdi->get_Description()); ?></td>
+      </tr>
+      <tr>
+        <td colspan=5><span style="font-weight:bold;">Check Contents:</span><br /><?php print nl2br($pdi->get_Check_Contents()); ?></td>
+      </tr>
+    </table>
+  </body>
+</html>

data/refsearch.inc

@@ -0,0 +1,18 @@
+<?php
+/**
+ * File: refsearch.inc
+ * Author: Ryan
+ * Purpose: Search for references
+ * Created: Sep 7, 2016
+ *
+ * Copyright 2016: Cyber Perspectives, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 7, 2016 - File created
+ */
+
+$reference_filter_width = 990;
+include_once 'reference-filter.inc';

data/reset.php

@@ -0,0 +1,87 @@
+<?php
+
+/**
+ * File: reset.php
+ * Author: Ryan Prather
+ * Purpose: Reset or change the password for the web mysql user
+ * Created: Oct 16, 2014
+ *
+ * Portions Copyright 2016: Cyber Perspectives, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Oct 16, 2014 - File created
+ *  - Jun 3, 2015 - Copyright updated and added constants
+ *  - Nov 7, 2016 - Fixed bug with resetting web user password, commented out calling Perl encrypt.pl script
+ */
+include_once 'config.inc';
+include_once 'helper.inc';
+
+if (isset($_REQUEST['reset'])) {
+  chdir(DOC_ROOT);
+  $db = new mysqli(DB_SERVER, $_REQUEST['uname'], $_REQUEST['pwd'], "mysql");
+  if ($db->connect_error) {
+    include_once "header.inc";
+    die($db->connect_error);
+  }
+
+  if (in_array(DB_SERVER, array("localhost", "127.0.0.1"))) {
+    $host = "localhost";
+  }
+  else {
+    $host = '%';
+  }
+
+  if (!$db->real_query("SET PASSWORD FOR 'web'@'$host' = PASSWORD('" . $_REQUEST['web_pwd'] . "')")) {
+    include_once "header.inc";
+    die("DB Password change unsuccessful, ceasing further operation" . PHP_EOL . $db->error);
+  }
+
+  $pwd = $_REQUEST['web_pwd'];
+  /* ---------------------------------
+   * 	CREATE DB PASSWORD FILE
+   * --------------------------------- */
+  $enc_pwd = my_encrypt($pwd);
+
+  if (!file_put_contents(DOC_ROOT . "/" . PWD_FILE, $enc_pwd)) {
+    die("Failed to save password");
+  }
+  die($enc_pwd);
+
+  print "Password change successful<br />";
+  print "<a href='/'>Home</a>";
+}
+else {
+  ?>
+
+  <script src='/style/5grid/jquery-1.10.2.min.js' type='text/javascript'></script>
+  <script type='text/javascript'>
+    function chk_pwd() {
+      if ($('#pwd').val() != $('#conf').val()) {
+        $('#msg').text("Passwords do not match");
+        $('#msg').css('color', 'red');
+      }
+      else {
+        $('#msg').text("Passwords match");
+        $('#msg').css('color', 'green');
+      }
+    }
+  </script>
+
+  <form method='post' action='reset.php'>
+    MySQL Admin User Name: <input type="text" name="uname" /><br />
+    Password: <input type="password" name="pwd" /><br />
+    <br />
+    New Web User Password: <input type="password" name="web_pwd" id="pwd" /><br />
+    Confirm Password: <input type="password" name="conf_pwd" id="conf" onkeyup='javascript:chk_pwd();' /> <span id='msg'></span><br />
+
+    <input type="submit" name="reset" value="Reset Password" />
+  </form>
+
+<?php } ?>

data/scansearch.inc

@@ -0,0 +1,18 @@
+<?php
+/**
+ * File: scansearch.inc
+ * Author: Ryan
+ * Purpose: File to show scan filter
+ * Created: Sep 7, 2016
+ *
+ * Copyright 2016: Cyber Perspectives, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 7, 2016 - File created
+ */
+
+$scan_filter_width = 990;
+include_once 'scan-filter.inc';

data/settings.inc

@@ -0,0 +1,114 @@
+<?php
+/**
+ * File: settings.inc
+ * Author: Ryan Prather
+ * Purpose: Allows the changing of system settings
+ * Created: Jan 6, 2015
+ *
+ * Portions Copyright 2016: Cyber Perspectives, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Jan 6, 2015 - File created
+ *  - Sep 1, 2016 - Copyright updated
+ *      Added max # of results scans to import simultaneously
+ *  - Oct 24, 2016 - Fixed MAX_IMPORT constant and added PHP_CONF constant
+ *  - Nov 16, 2016 - Changed LOG_LEVEL to check for E_* constants instead of strings
+ *  - Dec 12, 2016 - Ensured all configuration items are populated here, added company data for eChecklist exports
+ *  - Feb 15, 2017 - Formatting and changed NESSUS constant
+ *  - May 13, 2017 - Added support for editing the default output format for E-Checklist exports
+ *  - May 19, 2017 - Added audible notification setting
+ *  - May 25, 2017 - Fixed typo
+ */
+$db = new db();
+$settings = $db->get_Settings(['cpe-load-date', 'cve-load-date', 'stig-load-date', 'nasl-load-date']);
+$cpe_date = (isset($settings['cpe-load-date']) ? new DateTime($settings['cpe-load-date']) : null);
+$cve_date = (isset($settings['cve-load-date']) ? new DateTime($settings['cve-load-date']) : null);
+$stig_date = (isset($settings['stig-load-date']) ? new DateTime($settings['stig-load-date']) : null);
+$nasl_date = (isset($settings['nasl-load-date']) ? new DateTime($settings['nasl-load-date']) : null);
+?>
+
+<div style="width:49%;display:inline-block;">
+  <form action="index.php/?p=Settings" method="post">
+    <input type='hidden' name='action' value='Save Settings' />
+    <?php
+    if (isset($settings_saved)) {
+      print $settings_saved;
+    }
+    ?>
+    Company: <input type="text" name="company" value="<?php print COMPANY; ?>" /><br />
+    Company Address: <input type="text" name="comp_add" value="<?php print COMP_ADD; ?>" /><br />
+    Last Modified By: <input type="text" name="last_modified_by" value="<?php print LAST_MODIFIED_BY; ?>" /><br />
+    Creator: <input type="text" name="creator" value="<?php print CREATOR; ?>" /><br /><br />
+
+    Log level:
+    <select name="log_level">
+      <option <?php print (LOG_LEVEL == E_DEBUG) ? "selected" : null; ?>>DEBUG</option>
+      <option <?php print (LOG_LEVEL == E_NOTICE) ? "selected" : null; ?>>NOTICE</option>
+      <option <?php print (LOG_LEVEL == E_WARNING) ? "selected" : null; ?>>WARNING</option>
+      <option <?php print (LOG_LEVEL == E_ERROR) ? "selected" : null; ?>>ERROR</option>
+    </select><br /><br />
+
+    Flatten eChecklist: <input type="checkbox" name="flatten_echecklist" <?php print (FLATTEN ? "checked" : null); ?> /><br />
+    Wrap eChecklist Check Contents: <input type="checkbox" name="wrap_text" <?php print (WRAP_TEXT ? "checked" : null); ?> /><br />
+    Audible Notifications: <input type='checkbox' name='notifications' <?php print (NOTIFICATIONS ? "checked" : null); ?> /><br /><br />
+
+    Port Ingestion Limit: <input type="number" name="port_limit" value="<?php print PORT_LIMIT; ?>" min="0" max="10000" /><br />
+    Max # of Result Scans: <input type="number" name="max_result_import" value="<?php print MAX_RESULTS; ?>" min="1" max="20" /><br />
+    Output Format:
+    <select name="output_format">
+      <option value="xlsx" <?php print (ECHECKLIST_FORMAT == 'xlsx' ? "selected" : null); ?>>Microsoft Excel 2007+ (.xlsx)</option>
+      <option value="xls"<?php print (ECHECKLIST_FORMAT == 'xls' ? "selected" : null); ?>>Microsoft Excel 95-2003 (.xls)</option>
+      <option value="ods"<?php print (ECHECKLIST_FORMAT == 'ods' ? "selected" : null); ?>>OpenDocument Format (.ods)</option>
+      <?php /*
+        <option value="html"<?php print (ECHECKLIST_FORMAT == 'html' ? "selected" : null); ?>>HTML (.html)</option>
+        <option value="pdf"<?php print (ECHECKLIST_FORMAT == 'pdf' ? "selected" : null); ?>>Post-script Document (.pdf)</option>
+        <option value="csv"<?php print (ECHECKLIST_FORMAT == 'csv' ? "selected" : null); ?>>Comma-separated files (.csv)</option>
+       */ ?>
+    </select>
+
+    <br />
+
+    <!--
+      Nessus server: <input type="text" name="nessus_server" value="<?php print NESSUS_SVR; ?>" /><br />
+      NMap binary path: <input type="text" name="nmap_path" value="<?php print NMAP_PATH; ?>" /><br />
+    -->
+
+    <input type="button" class='button' value="Save Settings" onclick='this.form.submit();' />
+  </form>
+</div>
+
+<div style="width:49%;display:inline-block;">
+  <table id="system-dates" style='width:100%;vertical-align:top;'>
+    <thead>
+      <tr>
+        <th>Type</th>
+        <th>Date</th>
+      </tr>
+    </thead>
+    <tbody>
+      <tr>
+        <td>CPE's</td>
+        <td><?php print (is_a($cpe_date, 'DateTime') && $cpe_date != new DateTime("1970-01-01 00:00:00") ? $cpe_date->format("M j, Y") : "Not Loaded"); ?></td>
+      </tr>
+      <tr>
+        <td>CVE's</td>
+        <td><?php print (is_a($cve_date, 'DateTime') && $cve_date != new DateTime("1970-01-01 00:00:00") ? $cve_date->format("M j, Y") : "Not Loaded"); ?></td>
+      </tr>
+      <tr>
+        <td>STIG's</td>
+        <td><?php print (is_a($stig_date, 'DateTime') && $stig_date != new DateTime("1970-01-01 00:00:00") ? $stig_date->format("M j, Y") : "Not Loaded"); ?></td>
+      </tr>
+      <tr>
+        <td>NASL</td>
+        <td><?php print (is_a($nasl_date, 'DateTime') && $nasl_date != new DateTime("1970-01-01 00:00:00") ? $nasl_date->format("M j, Y") : "Not Loaded"); ?></td>
+      </tr>
+    </tbody>
+  </table>
+</div>

data/sitemgmt.inc

@@ -0,0 +1,139 @@
+<?php
+/**
+ * File: sitemgmt.inc
+ * Author: Ryan Prather
+ * Purpose: For adding or editing sites
+ * Created: Oct 21, 2014
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Oct 21, 2014 - File created
+ *  - May 19, 2017 - Migrated to filtering and changed save button to match buttons throughout
+ */
+$page = filter_input(INPUT_GET, 'p', FILTER_SANITIZE_STRING, FILTER_NULL_ON_FAILURE);
+$site_id = filter_input(INPUT_POST, 'site', FILTER_VALIDATE_INT, FILTER_NULL_ON_FAILURE);
+
+if ($page == 'SiteMgmt') {
+  ?>
+
+  <form method='post' action='?p=EditSite'>
+    Select Site:<br />
+    <select name='site' onchange="this.form.submit();">
+      <option value='0'>-- Please Select A Site --</option>
+      <?php
+      foreach ($all_sites as $site) :
+        print $site->get_Option();
+      endforeach
+      ;
+      ?>
+      <option value='new'>New...</option>
+    </select>
+  </form>
+
+  <?php
+}
+elseif ($page == 'EditSite' && $site_id) {
+  $selected_site = $db->get_Site($site_id);
+  if (is_array($selected_site) && count($selected_site) && isset($selected_site[0]) && is_a($selected_site[0], 'site')) {
+    $selected_site = $selected_site[0];
+  }
+  else {
+    die("Couldn't find the selected site");
+  }
+  ?>
+
+  <form method='post' action='?p=EditSite'>
+    Select Site: <select name='site' onchange="this.form.submit();">
+      <option value='0'>-- Please Select A Site --</option>
+      <?php
+      foreach ($all_sites as $site) :
+        $selected = $site_id == $site->get_Id() ? true : false;
+        print $site->get_Option($selected);
+      endforeach
+      ;
+      ?>
+      <option value='new'>New...</option>
+    </select>
+  </form>
+
+  <form method='post' action='?p=SiteMgmt'>
+    <input type='hidden' name='site' value='<?php print $site_id; ?>' />
+    <input type='hidden' name='action' value='save-site' />
+    Name:
+    <input type='text' name='name'
+           value='<?php print $selected_site->get_Name(); ?>' /><br />
+    Address:
+    <input type='text' name='address'
+           value='<?php print $selected_site->get_Address(); ?>' /><br />
+    City:
+    <input type='text' name='city'
+           value='<?php print $selected_site->get_City(); ?>' /><br />
+    State:
+    <select name='state'>
+      <?php
+      foreach ($STATES as $key => $val) {
+        print "<option value='$key'" . ($key == $selected_site->get_State() ? " selected" : "") . ">$val</option>";
+      }
+      ?>
+    </select><br />
+    Postal Code: <input type='text' name='zip'
+                        value='<?php print $selected_site->get_Zip(); ?>' /><br />
+    Country: <select name='country'>
+      <?php
+      foreach ($Countries as $key => $val) {
+        print "<option value='$key'" . ($key == $selected_site->get_Country() ? " selected" : "") . ">$val</option>";
+      }
+      ?>
+    </select><br />
+    POC Name:
+    <input type='text' name='poc_name'
+           value='<?php print $selected_site->get_POC_Name(); ?>' /><br />
+    POC E-mail:
+    <input type='text' name='poc_email'
+           value='<?php print $selected_site->get_POC_Email(); ?>' /><br />
+    POC Phone:
+    <input type='text' name='poc_phone'
+           value='<?php print $selected_site->get_POC_Phone(); ?>' /><br />
+
+    <input type='button' class='button' value='Save Site' onclick='this.form.submit();' />
+  </form>
+
+  <?php
+}
+elseif ($page == 'EditSite' && !$site_id) {
+  ?>
+
+  <form method='post' action='?p=SiteMgmt'>
+    <input type='hidden' name='action' value='save-site' />
+    Name: <input type='text' name='name' /><br />
+    Address: <input type='text' name='address' /><br />
+    City: <input type='text' name='city' /><br />
+    State: <select name='state'>
+      <?php
+      foreach ($STATES as $key => $val): print "<option value='$key'>$val</option>";
+      endforeach;
+      ?>
+    </select><br />
+    Postal Code: <input type='text' name='zip' /><br />
+    Country: <select name='country'>
+      <?php
+      foreach ($Countries as $key => $val): print "<option value='$key'>$val</option>";
+      endforeach;
+      ?>
+    </select><br />
+    POC Name: <input type='text' name='poc_name' /><br />
+    POC E-mail: <input type='text' name='poc_email' /><br />
+    POC Phone: <input type='text' name='poc_phone' /><br />
+    <input type='button' class='button' value='Save Site' onclick='this.form.submit();' />
+  </form>
+
+  <?php
+}

data/ste_export_import.php

@@ -0,0 +1,592 @@
+<?php
+
+/**
+ * File: ste_export_import.php
+ * Author: Ryan Prather
+ * Purpose: Export ST&E data
+ * Created: Feb 11, 2014
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Feb 11, 2014 - File created
+ *  - Sep 1, 2016 - Updated copyright and update scan constructor to use source object instead of source ID
+ *  - Nov 7, 2016 - Fix bug with reading source ID
+ *  - Apr 5, 2017 - Formatting
+ *  - Dec 19, 2017 - Converted from XML to JSON format export/import
+ *  - Jan 16, 2018 - Updated to use host_list class
+ *
+ *  @TODO - Change to export and import CPE
+ */
+include_once 'config.inc';
+include_once 'helper.inc';
+include_once 'database.inc';
+
+$db = new db();
+
+$cmd = getopt("f::", array("import::"));
+
+if (isset($_REQUEST['export'])) {
+  if (!isset($_REQUEST['ste'])) {
+    print "You must select an ST&amp;E <a href='javascript:void(0);' onclick='javascript:history.go(-1);'>Back</a>";
+    exit;
+  }
+
+  if ($_REQUEST['export'] == 'Export STE') {
+    export_STE();
+  }
+  elseif ($_REQUEST['export'] == 'Export Host List') {
+    export_Host_List();
+  }
+}
+elseif (isset($cmd['import'])) {
+  import_STE();
+}
+else {
+  print "Usage: php ste_export_import.php -f=\"{path_to_ste_import_file}\" --import" . PHP_EOL;
+}
+
+/**
+ * Function to export an ST&amp;E
+ */
+function export_STE() {
+  set_time_limit(0);
+  global $db;
+
+  $log = new Sagacity_Error("STE_Export.log");
+
+  $ste = $db->get_STE($_REQUEST['ste'])[0];
+  $json = [
+    'ste'           => [
+      'id'         => $ste->get_ID(),
+      'system_id'  => $ste->get_System()->get_ID(),
+      'site_id'    => $ste->get_Site()->get_ID(),
+      'eval_start' => $ste->get_Eval_Start_Date()->format("Y-m-d"),
+      'eval_end'   => $ste->get_Eval_End_Date()->format("Y-m-d")
+    ],
+    'systems'       => [],
+    'site'          => [],
+    'ste_cats'      => [],
+    'targets'       => [],
+    'scans'         => [],
+    'tech_findings' => [],
+    'proc_findings' => []
+  ];
+
+  $system_arr = $db->get_System($ste->get_System()->get_ID());
+  foreach ($system_arr as $key => $sys) {
+    $json['systems'][] = [
+      'id'                => $sys->get_ID(),
+      'name'              => $sys->get_Name(),
+      'mac'               => $sys->get_MAC(),
+      'classification'    => $sys->get_Classification(),
+      'abbr'              => $sys->get_Abbreviation(),
+      'exec-summary'      => $sys->get_Executive_Summary(),
+      'accrediation-type' => $sys->get_Accreditation_Type(),
+      'desc'              => $sys->get_Description(),
+      'mitigations'       => $sys->get_Mitigations()
+    ];
+  }
+
+  $json['site'] = [
+    'id'      => $ste->get_Site()->get_ID(),
+    'name'    => $ste->get_Site()->get_Name(),
+    'address' => $ste->get_Site()->get_Address(),
+    'city'    => $ste->get_Site()->get_City(),
+    'state'   => $ste->get_Site()->get_State(),
+    'zip'     => $ste->get_Site()->get_Zip(),
+    'country' => $ste->get_Site()->get_Country(),
+    'poc'     => $ste->get_Site()->get_POC_Name(),
+    'email'   => $ste->get_Site()->get_POC_Email(),
+    'phone'   => $ste->get_Site()->get_POC_Phone()
+  ];
+
+  $cat_arr = $db->get_STE_Cat_List($ste->get_ID());
+  foreach ($cat_arr as $key => $cat) {
+    $json['ste_cats'][] = [
+      'id'      => $cat->get_ID(),
+      'ste_id'  => $cat->get_STE_ID(),
+      'name'    => $cat->get_Name(),
+      'analyst' => $cat->get_Analyst()
+    ];
+  }
+
+  $all_findings = [];
+  $targets_arr = $db->get_Target_Details($ste->get_ID());
+  $used_cats = [];
+  if (empty($targets_arr)) {
+    $log->script_log("There are no targets in the ST&E", E_ERROR);
+  }
+  foreach ($targets_arr as $key => $tgt) {
+    if (!in_array($tgt->get_Cat_ID(), $used_cats)) {
+      $all_findings = array_merge($all_findings, $db->get_Category_Findings($tgt->get_Cat_ID()));
+      $used_cats[] = $tgt->get_Cat_ID();
+    }
+    $os = $db->get_Software($tgt->get_OS_ID())[0];
+
+    $tgt_node = [
+      'id'              => $tgt->get_ID(),
+      'ste_id'          => $tgt->get_STE_ID(),
+      'cat_id'          => $tgt->get_Cat_ID(),
+      'os_id'           => $tgt->get_OS_ID(),
+      'os_string'       => $tgt->get_OS_String(),
+      'os_man'          => $os->get_Man(),
+      'os_name'         => $os->get_Name(),
+      'os_ver'          => $os->get_Version(),
+      'name'            => $tgt->get_Name(),
+      'location'        => $tgt->get_Location(),
+      'source'          => $tgt->get_Source(),
+      'pp_flag'         => '0',
+      'pp_off'          => '1',
+      'login'           => $tgt->get_Login(),
+      'class'           => $tgt->classification,
+      'status'          => [
+        'auto'    => $tgt->get_Auto_Status_ID(),
+        'manual'  => $tgt->get_Man_Status_ID(),
+        'data'    => $tgt->get_Data_Status_ID(),
+        'fp_cat1' => $tgt->get_FP_Cat1_Status_ID()
+      ],
+      'notes'           => $tgt->get_Notes(),
+      'netstat'         => $tgt->get_Netstat_Connections(),
+      'missing_patches' => $tgt->get_Missing_Patches(),
+      'interfaces'      => [],
+      'software_list'   => [],
+      'checklist_list'  => []
+    ];
+
+    foreach ($tgt->interfaces as $int) {
+      $int_node = [
+        'id'        => $int->get_ID(),
+        'name'      => $int->get_Name(),
+        'ipv4'      => $int->get_IPv4(),
+        'ipv6'      => $int->get_IPv6(),
+        'hostname'  => $int->get_Hostname(),
+        'fqdn'      => $int->get_FQDN(),
+        'desc'      => $int->get_Description(),
+        'tcp_ports' => [],
+        'udp_ports' => []
+      ];
+
+      foreach ($int->get_TCP_Ports() as $tcp) {
+        $int_node['tcp_ports'][] = [
+          'number' => $tcp->get_Port(),
+          'name'   => $tcp->get_IANA_Name(),
+          'banner' => $tcp->get_Banner(),
+          'notes'  => $tcp->get_Notes()
+        ];
+      }
+
+      foreach ($int->get_UDP_Ports() as $udp) {
+        $int_node['udp_ports'][] = [
+          'number' => $udp->get_Port(),
+          'name'   => $udp->get_IANA_Name(),
+          'banner' => $udp->get_Banner(),
+          'notes'  => $udp->get_Notes()
+        ];
+      }
+
+      $tgt_node['interfaces'][] = $int_node;
+    }
+
+    foreach ($tgt->software as $sw) {
+      $tgt_node['software_list'][] = [
+        'id'           => $sw->get_ID(),
+        'man'          => $sw->get_Man(),
+        'name'         => $sw->get_Name(),
+        'ver'          => $sw->get_Version(),
+        'string'       => $sw->get_SW_String(),
+        'short_string' => $sw->get_Shortened_SW_String()
+      ];
+    }
+
+    foreach ($tgt->checklists as $chk) {
+      $tgt_node['checklist_list'][] = [
+        'id'           => $chk->get_ID(),
+        'checklist_id' => $chk->get_Checklist_ID(),
+        'type'         => $chk->get_type(),
+        'class'        => $chk->get_Classification(),
+        'version'      => $chk->get_Version(),
+        'release'      => $chk->get_Release()
+      ];
+    }
+
+    $json['targets'][] = $tgt_node;
+  }
+
+  if (!is_null($scan_arr = $db->get_ScanData($ste->get_ID()))) {
+    foreach ($scan_arr as $scan) {
+      $scan_node = [
+        'id'        => $scan->get_ID(),
+        'ste_id'    => $scan->get_STE()->get_ID(),
+        'src_id'    => $scan->get_Source()->get_ID(),
+        'itr'       => $scan->get_Itr(),
+        'file_name' => $scan->get_File_Name(),
+        'file_date' => $scan->get_File_Date(),
+        'host_list' => []
+      ];
+
+      foreach ($scan->get_Host_List() as $host) {
+        $scan_node['host_list'][] = [
+          'tgt_id'   => $host['target']->get_ID(),
+          'tgt_name' => $host['target']->get_Name(),
+          'count'    => $host['count']
+        ];
+      }
+
+      $json['scans'][] = $scan_node;
+    }
+  }
+
+  foreach ($all_findings as $worksheet_name => $data) {
+    foreach ($data['stigs'] as $stig_id => $data2) {
+      $stig = $db->get_Stig($stig_id);
+      if (is_array($stig) && count($stig) && isset($stig[0]) && is_a($stig[0], 'stig')) {
+        $stig = $stig[0];
+      }
+      else {
+        continue;
+      }
+
+      $ec = $db->get_eChecklist($stig, $data2['chk_id']);
+
+      $find_node = [
+        'stig_id'        => $stig->get_ID(),
+        'vms_id'         => $ec->get_VMS_ID(),
+        'cat'            => $ec->get_Cat_Level_String(),
+        'short_title'    => $ec->get_Short_Title(),
+        'check_contents' => $ec->get_Check_Contents(),
+        'notes'          => $data2['notes'],
+        'target_status'  => [],
+        'ia_controls'    => []
+      ];
+
+      foreach ($data['target_list'] as $host_name => $col_id) {
+        $tgt = $db->get_Target_Details($ste->get_ID(), $host_name)[0];
+        $finding = $db->get_Finding($tgt, $stig)[0];
+
+        if (is_null($finding)) {
+          continue;
+        }
+
+        $find_node['target_status'][] = [
+          'tgt_name' => $host_name,
+          'status'   => (isset($data2[$host_name]) ? $data2[$host_name] : 'Not Applicable'),
+          'scan_id'  => $finding->get_Scan_ID()
+        ];
+      }
+
+      foreach ($data2['ia_control'] as $ia) {
+        $find_node['ia_controls'] = $ia;
+      }
+
+      $json['tech_findings'][] = $find_node;
+    }
+  }
+
+  header(JSON);
+  header('Content-disposition: attachment; filename="' . $sys->get_Name() . '-' . $ste->get_Site()->get_Name() . '-ste-export.json"');
+  print json_encode($json, JSON_PRETTY_PRINT);
+}
+
+/**
+ * Function to export the hosts in an ST&amp;E
+ */
+function export_Host_List() {
+  global $db;
+  $csv = "Target ID,Name,HostName,IPv4,FQDN,OS" . PHP_EOL;
+
+  $ste = $db->get_STE($_REQUEST['ste'])[0];
+
+  $tgts = $db->get_Target_Details($_REQUEST['ste']);
+
+  foreach ($tgts as $key => $tgt) {
+    $csv .= $tgt->get_ID() . "," . $tgt->get_Name() . ",";
+
+    $int_str = '';
+    $fqdn_str = '';
+    $host_str = '';
+    foreach ($tgt->interfaces as $key2 => $int) {
+      if (false) {
+        $int = new interfaces();
+      }
+      $host_str .= $int->get_Hostname() . ",";
+      $int_str .= $int->get_IPv4() . ",";
+      $fqdn_str .= $int->get_FQDN() . ",";
+    }
+    $host_str = substr($host_str, 0, -1);
+    $int_str = substr($int_str, 0, -1);
+    $fqdn_str = substr($fqdn_str, 0, -1);
+
+    $csv .= "\"$host_str\",\"$int_str\",\"$fqdn_str\",";
+
+    $os = $db->get_Software($tgt->get_OS_ID())[0];
+    $csv .= $os->get_Man() . " " . $os->get_Name() . " " . $os->get_Version() . PHP_EOL;
+  }
+
+  header('Content-type: plain/text');
+  header('Content-disposition: attachment; filename="' . $ste->get_System()->get_Name() . '-' . $ste->get_Site()->get_Name() . '-host-list.csv"');
+  print $csv;
+}
+
+/**
+ * Function to import an ST&amp;E
+ */
+function import_STE() {
+  global $cmd, $db;
+  set_time_limit(0);
+  $base_name = basename($cmd['f']);
+  include_once 'helper.inc';
+  $log = new Sagacity_Error($cmd['f']);
+
+  if (!file_exists($cmd['f'])) {
+    $log->script_log("File not found", E_ERROR);
+  }
+
+  $xml = new DOMDocument();
+  $ste_cat_arr = array();
+  $all_scans = array();
+  $all_tgts = array();
+
+  if (!$xml->load($cmd['f'])) {
+    $log->script_log("Error loading XML", E_ERROR);
+  }
+
+  $site_node = getValue($xml, "/root/site", null, true);
+
+  if ($site_node->length) {
+    $site_node = $site_node->item(0);
+    $site = $db->get_Site($site_node->getAttribute("name"));
+    if (is_array($site) && count($site)) {
+      $site = $site[0];
+      print "Existing site " . $site->get_Name() . PHP_EOL;
+    }
+    else {
+      print "Adding new site " . $site_node->getAttribute("name") . PHP_EOL;
+      $site = new site(null, $site_node->getAttribute("name"), $site_node->getAttribute("address"), $site_node->getAttribute("city"), $site_node->getAttribute("state"), $site_node->getAttribute("zip"), $site_node->getAttribute("country"), $site_node->getAttribute("poc_name"), $site_node->getAttribute("poc_email"), $site_node->getAttribute("poc_phone"));
+
+      $site->set_ID($db->save_Site($site));
+    }
+  }
+  else {
+    $log->script_log("No site associated with this ST&E", E_ERROR);
+  }
+
+  $sys_nodes = getValue($xml, "/root/systems/system", null, true);
+
+  if ($sys_nodes->length) {
+    foreach ($sys_nodes as $node) {
+      $sys = $db->get_System($node->getAttribute("name"));
+      if (is_array($sys) && count($sys)) {
+        $sys = $sys[0];
+        print "Existing system " . $sys->get_Name() . PHP_EOL;
+      }
+      else {
+        print "Adding new system " . $node->getAttribute("name") . PHP_EOL;
+        $sys = new system(null, $node->getAttribute("name"), $node->getAttribute("mac"), $node->getAttribute("classified"));
+
+        $sys->set_ID($db->save_System($sys));
+      }
+    }
+  }
+  else {
+    $log->script_log("No system associated with this ST&E", E_ERROR);
+  }
+
+  $ste_node = getValue($xml, "/root/ste", null, true);
+
+  if ($ste_node->length) {
+    print "Adding new ST&E" . PHP_EOL;
+    $ste_node = $ste_node->item(0);
+    $old_ste_id = $ste_node->getAttribute("id");
+
+    $ste = new ste(null, $sys->get_ID(), $site->get_Id(), $ste_node->getAttribute("eval_start"), $ste_node->getAttribute("eval_end"), false, 0);
+
+    $ste->set_ID($db->save_STE($ste));
+  }
+  else {
+    $log->script_log("No ST&E in this export file", E_ERROR);
+  }
+
+  $cat_nodes = getValue($xml, "/root/ste_cats/cat", null, true);
+
+  if ($cat_nodes->length) {
+    foreach ($cat_nodes as $node) {
+      print "Adding new category " . $node->getAttribute("name") . PHP_EOL;
+      $id = $node->getAttribute('id');
+      $ste_cat_arr[$id] = new ste_cat(null, $ste->get_ID(), $node->getAttribute("name"), $node->getAttribute("analysts"));
+
+      $ste_cat_arr[$id]->set_ID($db->save_Category($ste_cat_arr[$id]));
+    }
+  }
+  else {
+    $log->script_log("There are no categories in this ST&E", E_ERROR);
+  }
+
+  $tgt_nodes = getValue($xml, "/root/targets/target", null, true);
+
+  if ($tgt_nodes->length) {
+    foreach ($tgt_nodes as $node) {
+      print "Adding new target " . $node->getAttribute("name") . PHP_EOL;
+      $cat_id = $node->getAttribute("cat_id");
+
+      $os = $db->get_Software([
+        'man'  => $node->getAttribute("os_man"),
+        'name' => $node->getAttribute("os_name"),
+        'ver'  => $node->getAttribute("os_ver")
+      ]);
+
+      if (is_array($os) && count($os)) {
+        $os = $os[0];
+      }
+      else {
+        $os = $db->getSoftware(array(
+              'man'  => 'Generic',
+              'name' => 'Generic',
+              'ver'  => 'N/A'
+                ), false)[0];
+      }
+
+      $statuses = getValue($xml, "status", $node, true)->item(0);
+      $notes = getValue($xml, "notes", $node);
+      $netstat = getValue($xml, "netstat_connection", $node);
+      $patches = getValue($xml, "missing_patches", $node);
+      $os_string = getValue($xml, "os_string", $node);
+
+      $tgt = new target($node->getAttribute("name"));
+      $tgt->set_STE_ID($ste->get_ID());
+      $tgt->set_Cat_ID($ste_cat_arr[$cat_id]->get_ID());
+      $tgt->set_OS_ID($os->get_ID());
+      $tgt->set_OS_String($node->getAttribute("os_string"));
+      $tgt->set_Auto_Status_ID($statuses->getAttribute("auto"));
+      $tgt->set_Man_Status_ID($statuses->getAttribute("manual"));
+      $tgt->set_Data_Status_ID($statuses->getAttribute("data"));
+      $tgt->set_FP_Cat1_Status_ID($statuses->getAttribute("fp_cat1"));
+      $tgt->set_Location($node->getAttribute("location"));
+      $tgt->set_Notes($notes);
+      $tgt->set_Netstat_Connections($netstat);
+      $tgt->set_Login($node->getAttribute("login"));
+      $tgt->set_Missing_Patches($patches);
+      $tgt->set_PP_Flag($node->getAttribute("pp_flag"));
+      $tgt->set_PP_Suspended($node->getAttribute("pp_off"));
+
+      $ints = getValue($xml, "interfaces/interface", $node, true);
+      foreach ($ints as $int_node) {
+        $int = new interfaces(null, null, $int_node->getAttribute("name"), $int_node->getAttribute("ipv4"), $int_node->getAttribute("ipv6"), $int_node->getAttribute("hostname"), $int_node->getAttribute("fqdn"), getValue($xml, "description", $int_node));
+
+        $tcp_nodes = getValues($xml, "tcp_ports/port", $int_node, true);
+        foreach ($tcp_nodes as $tcp) {
+          $int->add_TCP_Ports(new tcp_ports(null, $tcp->getAttribute("number"), $tcp->getAttribute("name"), getValue($xml, "banner", $tcp), getValue($xml, "notes", $tcp)));
+        }
+
+        $udp_nodes = getValues($xml, "udp_ports/port", $int_node, true);
+        foreach ($udp_nodes as $udp) {
+          $int->add_UDP_Ports(new udp_ports(null, $udp->getAttribute("number"), $udp->getAttribute("name"), getValue($xml, "banner", $udp), getValue($xml, "notes", $udp)));
+        }
+
+        $tgt->interfaces[] = $int;
+      }
+
+      $sw_nodes = getValue($xml, "software_list/software", $node, true);
+      foreach ($sw_nodes as $sw) {
+        $tgt->software[] = $db->get_Software(array(
+              'man'  => $sw->getAttribute("sw_man"),
+              'name' => $sw->getAttribute("sw_name"),
+              'ver'  => $sw->getAttribute("sw_ver")
+            ))[0];
+      }
+
+      $chk_nodes = getValue($xml, "checklist_list/checklist", $node, true);
+      foreach ($chk_nodes as $chk) {
+        $tgt->checklists[] = $db->get_Checklist(array(
+              'checklist_id' => $chk->getAttribute('checklist_id'),
+              'type'         => $chk->getAttribute('type'),
+              'version'      => $chk->getAttribute('version'),
+              'release'      => $chk->getAttribute('release')
+            ))[0];
+      }
+
+      $tgt->set_ID($db->save_Target($tgt));
+      $all_tgts[$node->getAttribute("id")] = $tgt;
+    }
+  }
+  else {
+    $log->script_log("No targets were found on this ST&E", E_ERROR);
+  }
+
+  $scan_nodes = getValue($xml, "/root/scans/scan", null, true);
+  if ($scan_nodes->length) {
+    foreach ($scan_nodes as $node) {
+      $src = $db->get_Sources($node->getAttribute("src_id"));
+      print "Adding new scan result file " . $node->getAttribute("file_name") . PHP_EOL;
+      $scan = new scan(null, $src, $ste, $node->getAttribute('itr'), $node->getAttribute("file_name"), $node->getAttribute('file_date'));
+
+      $host_list_nodes = getValue($xml, "host_list", $node, true);
+      foreach ($host_list_nodes as $host) {
+        $scan_tgt = $db->get_Target_Details($ste->get_ID(), $host->getAttribute('tgt_name'))[0];
+        $hl = new host_list();
+        $hl->setTargetId($scan_tgt->get_ID());
+        $hl->setTargetName($scan_tgt->get_Name());
+        $hl->setFindingCount($host->getAttribute("count"));
+        $hl->setScanError(false);
+
+        $scan->add_Target_to_Host_List($hl);
+      }
+
+      $scan->set_ID($db->save_Scan($scan));
+      $all_scans[$node->getAttribute("id")] = $scan;
+    }
+  }
+  else {
+    $log->script_log("No scan result files were found in this ST&E", E_ERROR);
+  }
+
+  $x = 1;
+  $finding_nodes = getValue($xml, "/root/tech_findings/finding", null, true);
+  if ($finding_nodes->length) {
+    print "Adding findings (total " . $finding_nodes->length . ")" . PHP_EOL;
+    foreach ($finding_nodes as $node) {
+      print ".";
+      if ($x % 100 == 0) {
+        print "\t$x" . PHP_EOL;
+      }
+
+      $ia_nodes = getValue($xml, "ia_control", $node, true);
+      $ia_arr = array();
+      foreach ($ia_nodes as $ia) {
+        $ia_arr[] = $ia->textContent;
+      }
+
+      $cc = getValue($xml, "check_contents", $node);
+
+      $tgt_status_nodes = getValue($xml, "target_status", $node, true);
+      foreach ($tgt_status_nodes as $status_node) {
+        $notes = getValue($xml, "notes", $status_node);
+        $tgt = $db->get_Target_Details($ste->get_ID(), $status_node->getAttribute("tgt_name"))[0];
+        $finding = array(
+          0 => $node->getAttribute("stig_id"),
+          1 => $node->getAttribute("vms_id"),
+          2 => $node->getAttribute("cat"),
+          3 => implode(' ', $ia_arr),
+          4 => $node->getAttribute("short_title"),
+          5 => $status_node->getAttribute("status"),
+          6 => $notes,
+          7 => $cc,
+          8 => ''
+        );
+
+        $db->add_Finding($all_scans[$status_node->getAttribute("scan_id")], $tgt, $finding);
+      }
+      $x++;
+    }
+  }
+  else {
+    $log->script_log("No findings were recorded in this ST&E", E_WARNING);
+  }
+}

data/stemgmt.inc

@@ -0,0 +1,526 @@
+<?php
+/**
+ * File: stemgmt.inc
+ * Author: Ryan Prather
+ * Purpose: For adding or editing ST&Es
+ * Created: Oct 21, 2014
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Oct 21, 2014 - File created
+ *  - Sep 1, 2016 - Copyright updated and updated file purpose
+ *  - Apr 5, 2017 - Formatting
+ *  - May 19, 2017 - Migrated to filtering and changed save button to match buttons throughout
+ *  - Jun 3, 2017 - Fixed bug #230 and changed table stripping to be consistent across the system
+ *  - Jan 20, 2018 - Removed CKEditor fields
+ */
+$page   = filter_input(INPUT_GET, 'p', FILTER_SANITIZE_STRING);
+$ste_id = filter_input(INPUT_POST, 'ste', FILTER_SANITIZE_STRING, FILTER_NULL_ON_FAILURE);
+if (!$ste_id) {
+    $ste_id = filter_input(INPUT_COOKIE, 'ste', FILTER_SANITIZE_STRING, FILTER_NULL_ON_FAILURE);
+}
+
+$stes = $db->get_STE();
+
+?>
+
+<script type="text/javascript" src="/script/datatables/DataTables-1.10.9/js/jquery.dataTables.min.js"></script>
+
+<link rel="stylesheet" type="text/css" href="/script/jQueryUI/css/ui-lightness/jquery-ui-1.10.3.custom.min.css" />
+<link type='text/css' rel='stylesheet' href="/script/datatables/DataTables-1.10.9/css/jquery.dataTables.min.css" />
+
+<?php
+if ($page == 'STEMgmt') {
+
+    ?>
+
+    <form method='post' action='?p=EditSTE'>
+        Select ST&amp;E:<br />
+        <select name='ste' onchange="this.form.submit();">
+            <option value='0'> -- Select ST&amp;E -- </option>
+            <option value='new'>New...</option>
+            <?php
+            if (is_array($stes) && count($stes)) {
+                foreach ($stes as $ste) {
+                    print "<option value='{$ste->get_ID()}'>" .
+                        "{$ste->get_System()->get_Name()}, {$ste->get_Site()->get_Name()}, {$ste->get_Eval_Start_Date()->format("M j, Y")}" .
+                        "</option>";
+                }
+            }
+
+            ?>
+        </select>
+    </form>
+
+    <?php
+}
+elseif ($page == 'EditSTE' && is_numeric($ste_id) && $ste_id > 0) {
+    $ste = $db->get_STE($ste_id);
+
+    if (is_array($ste) && count($ste) && isset($ste[0]) && is_a($ste[0], 'ste')) {
+        $ste = $ste[0];
+    }
+    else {
+        die("Couldn't find the selected ST&amp;E");
+    }
+
+    ?>
+
+    <style type='text/css'>
+        #cke_scope, #cke_assumptions, #cke_constraints {
+            display:none;
+        }
+    </style>
+
+    <script type='text/javascript'>
+        $(function () {
+          $('#start_date').datepicker({
+            dateFormat: "yy-mm-dd",
+            minDate: 0,
+            onSelect: function (date) {
+              var dt2 = $('#end_date');
+              var startDate = $(this).datepicker('getDate');
+              var minDate = $(this).datepicker('getDate');
+              startDate.setDate(startDate.getDate() + 30);
+              //sets dt2 maxDate to the last day of 30 days window
+              dt2.datepicker('option', 'maxDate', startDate);
+              dt2.datepicker('option', 'minDate', minDate);
+              //$(this).datepicker('option', 'minDate', minDate);
+            }
+          });
+          $('#end_date').datepicker({dateFormat: "yy-mm-dd"});
+
+          $('#host_table').DataTable({
+            'stripeClasses': ['odd_row', 'even_row']
+          });
+    <?php /*
+      CKEDITOR.replace('scope', {height: '100px', width: '675px', toolbar: [
+      {name: 'document', items: ['Source']},
+      {name: 'editor', items: ['Cut', 'Copy', 'Paste', 'PasteText', 'PastFromWord', '-', 'Undo', 'Redo']},
+      {name: 'basicstyles', groups: ['basicstyles', 'cleanup'], items: ['Bold', 'Italic', 'Underline', '-', 'RemoveFormat']},
+      {name: 'paragraph', groups: ['list', 'indent', 'blocks', 'align'], items: ['NumberedList', 'BulletedList', '-', 'Outdent', 'Indent', '-', 'JustifyLeft', 'JustifyCenter', 'JustifyRight', 'JustifyBlock']}
+      ]});
+      CKEDITOR.replace('assumptions', {height: '100px', width: '675px', toolbar: [
+      {name: 'document', items: ['Source']},
+      {name: 'editor', items: ['Cut', 'Copy', 'Paste', 'PasteText', 'PastFromWord', '-', 'Undo', 'Redo']},
+      {name: 'basicstyles', groups: ['basicstyles', 'cleanup'], items: ['Bold', 'Italic', 'Underline', '-', 'RemoveFormat']},
+      {name: 'paragraph', groups: ['list', 'indent', 'blocks', 'align'], items: ['NumberedList', 'BulletedList', '-', 'Outdent', 'Indent', '-', 'JustifyLeft', 'JustifyCenter', 'JustifyRight', 'JustifyBlock']}
+      ]});
+      CKEDITOR.replace('constraints', {height: '100px', width: '675px', toolbar: [
+      {name: 'document', items: ['Source']},
+      {name: 'editor', items: ['Cut', 'Copy', 'Paste', 'PasteText', 'PastFromWord', '-', 'Undo', 'Redo']},
+      {name: 'basicstyles', groups: ['basicstyles', 'cleanup'], items: ['Bold', 'Italic', 'Underline', '-', 'RemoveFormat']},
+      {name: 'paragraph', groups: ['list', 'indent', 'blocks', 'align'], items: ['NumberedList', 'BulletedList', '-', 'Outdent', 'Indent', '-', 'JustifyLeft', 'JustifyCenter', 'JustifyRight', 'JustifyBlock']}
+      ]});
+     */ ?>
+        });
+
+        function validate_Edit_STE() {
+          if ($('#action') == 'Delete STE') {
+            return confirm("Are you sure you want to delete this ST&E");
+          }
+
+          var ret = true;
+
+          if ($('#start_date').val() > $('#end_date').val()) {
+            alert("Your start date can't after the end date");
+            ret = false;
+          }
+
+          if (!$('#start_date').val()) {
+            alert("You must select a start date for this ST&E");
+            ret = false;
+          }
+
+          if (!$('#end_date').val()) {
+            alert("You must select an end date for this ST&E");
+            ret = false;
+          }
+
+          if ($('#system').val() == "0") {
+            alert("You must select a system for this ST&E");
+            ret = false;
+          }
+
+          if ($('#site').val() == "0") {
+            alert("You must select a site where this ST&E will be performed");
+            ret = false;
+          }
+
+          return ret;
+        }
+
+        function show_subsystems() {
+          if ($('#system').val() == '0') {
+            alert('Select a primary system');
+            $('#system').focus();
+            return;
+          }
+
+          if ($('#add_subsystems').is(':checked'))
+            $('#subsystem_container').show();
+          else
+            $('#subsystem_container').hide();
+
+          $('#subsystems option').each(function () {
+            if ($(this).val() == $('#system').val()) {
+              $(this).remove();
+              return;
+            }
+          });
+        }
+    </script>
+
+    <form method='post' action='?p=EditSTE'>
+        ST&amp;E:<br />
+        <select name='ste' onchange="this.form.submit();">
+            <option value='0'> -- Select ST&amp;E -- </option>
+            <option value='new'>New...</option>
+            <?php
+            if (is_array($stes) && count($stes)) {
+                foreach ($stes as $s) {
+                    print "<option value='{$s->get_ID()}'" . ($ste_id == $s->get_ID() ? " selected" : "") . ">" .
+                        "{$s->get_System()->get_Name()}, {$s->get_Site()->get_Name()}, {$s->get_Eval_Start_Date()->format("M j, Y")}" .
+                        "</option>";
+                }
+            }
+
+            ?>
+        </select>
+    </form>
+
+    <form method='post' action='?p=STEMgmt' onsubmit="return validate_Edit_STE();">
+        <div style='width:30%;float:left;'>
+            <input type='hidden' name='ste' value='<?php print $ste_id; ?>' />
+            <input type='hidden' name='action' value='save-ste' />
+            Eval Start Date:
+            <input type='text' name='start_date' id='start_date' value='<?php print $ste->get_Eval_Start_Date()->format('Y-m-d'); ?>' /><br />
+            Eval End Date:
+            <input type='text' name='end_date' id='end_date' value='<?php print $ste->get_Eval_End_Date()->format('Y-m-d'); ?>' /><br />
+            <?php print "<script>console.log('" . json_encode($ste->get_System()) . "');</script>"; ?>
+            System: <select name='system' id='system'>
+                <?php
+                foreach ($all_systems as $key => $sys) :
+                    $selected = $ste->get_System()->get_ID() == $sys->get_ID() ? true : false;
+                    print $sys->get_Option($selected);
+                endforeach;
+
+                ?>
+            </select><br />
+            <label for='add_subsystems'>Subsystems:</label>
+            <input type='checkbox' name='add_subsystems' id='add_subsystems' value='1' onclick='javascript:show_subsystems();' <?php print $ste->is_Multiple() ? 'checked' : ''; ?> /><br />
+            <div id='subsystem_container' <?php print $ste->is_Multiple() ? '' : "style='display: none;'"; ?>>
+                <select name='subsystems[]' id='subsystems' multiple size='5' style='width:150px;'>
+                    <?php
+                    $substes = $db->get_Subsystems($ste);
+                    $sub_sys = [];
+                    $subs    = [];
+
+                    foreach ($substes as $key => $sub_ste) :
+                        $sub_sys[]                              = $sub_ste->get_System()->get_ID();
+                        $subs[$sub_ste->get_System()->get_ID()] = $sub_ste->get_ID();
+                    endforeach;
+
+                    $all_stes = $db->get_STE();
+
+                    foreach ($all_stes as $key => $current) {
+                        $subs[$current->get_System()->get_ID()] = $current->get_ID();
+                    }
+
+                    foreach ($all_systems as $key => $sys) :
+                        $selected = in_array($sys->get_ID(), $sub_sys) ? true : false;
+                        $my_ste   = (isset($subs[$sys->get_ID()]) ? $subs[$sys->get_ID()] : $ste->get_ID());
+                        print $ste->get_System()->get_ID() != $sys->get_ID() ? $sys->get_Option($selected, $my_ste) : '';
+                    endforeach;
+
+                    ?>
+                </select>
+                <br />
+            </div>
+            Site: <select name='site' id='site'>
+                <?php
+                foreach ($all_sites as $key => $s) :
+                    $selected = $ste->get_Site()->get_ID() == $s->get_Id() ? true : false;
+                    print $s->get_Option($selected);
+                endforeach;
+
+                ?>
+            </select><br />
+            Approving Official: <input type='text' name='ao' title='The office or individual that is going to approve or disapprove the system' value='<?php print $ste->get_AO(); ?>' /><br />
+            <input type='button' class='button' name='action' value='Save STE' onclick='this.form.submit();' />
+        </div>
+        <div style='width:70%;float:left;'>
+            <input type='hidden' name='scope' id='scope' value='' />
+            <input type='hidden' name='assumptions' id='assumptions' value='' />
+            <input type='hidden' name='constraints' id='constraints' value='' />
+            <?php /*
+            <label for="s">Scope:</label> <input type='checkbox' id='s' onclick="$('#cke_scope').toggle();" /><br />
+            <textarea name='scope' id='scope' rows='5' cols='80'><?php print $ste->get_Scope(); ?></textarea><br />
+            <label for="a">Assumptions:</label><input type='checkbox' id='a' onclick="$('#cke_assumptions').toggle();" /><br />
+            <textarea name='assumptions' id='assumptions' rows='5' cols='80'><?php print $ste->get_Assumptions(); ?></textarea><br />
+            <label for="cd">Constraints &amp; Dependencies:</label><input type='checkbox' id='cd' onclick="$('#cke_constraints').toggle();" /><br />
+            <textarea name='constraints' id='constraints' rows='5' cols='80'><?php print $ste->get_Constraints(); ?></textarea>
+             */ ?>
+        </div>
+    </form>
+    <form method='post' action='ste_export_import.php' style='display:inline;'>
+        <input type='hidden' name='ste' value='<?php print $ste_id; ?>' />
+        <input type='submit' name='export' value='Export STE' />
+        <?php
+        $tgts = $db->get_Target_Details($ste_id);
+        if (is_array($tgts) && count($tgts)) {
+
+            ?>
+            <input type='submit' name='export' value='Export Host List' />
+        <?php } ?>
+    </form>
+
+    <form method='post' action='compare.php' style='display:inline;'>
+        <input type='hidden' name='left_ste' value='<?php print $ste_id; ?>' />
+        <select name='right_ste'>
+            <option value='0'> -- Select ST&amp;E -- </option>
+            <?php
+            if (is_array($stes) && count($stes)) {
+                foreach ($stes as $ste) {
+                    print "<option value='{$ste->get_ID()}'>" .
+                        "{$ste->get_System()->get_Name()}, {$ste->get_Site()->get_Name()}, {$ste->get_Eval_Start_Date()->format("M j, Y")}" .
+                        "</option>";
+                }
+            }
+
+            ?>
+        </select>
+        <input type='submit' name='compare' value='Compare ST&E' />
+    </form>
+
+    <table id='host_table' class='display'>
+        <thead>
+            <tr>
+                <th style='width:50px;'>ID</th>
+                <th style='width:200px;'>Hostname</th>
+                <th style='width:150px;'>IPv4</th>
+                <th style='width:250px;'>FQDN</th>
+                <th style='width:200px;'>Operating System</th>
+            </tr>
+        </thead>
+        <tbody>
+            <?php
+            $odd = true;
+            if (is_array($tgts) && count($tgts) && isset($tgts['id'])) {
+                $tgts = array(0 => $tgts);
+            }
+            if (is_array($tgts) && count($tgts) && isset($tgts[0]) && is_a($tgts[0], 'target')) {
+                foreach ($tgts as $key => $tgt) {
+                    $interfaces = '';
+                    $fqdn       = '';
+                    $odd        = !$odd;
+
+                    $os = $db->get_Software($tgt->get_OS_ID())[0];
+
+                    foreach ($tgt->interfaces as $key2 => $int) {
+                        $interfaces .= $int->get_IPv4() . ", ";
+                        $fqdn       .= $int->get_FQDN() . ", ";
+                    }
+
+                    print "<tr>" . // class='".($odd ? 'odd' : 'even')."'>".
+                        "<td>{$tgt->get_ID()}</td>" .
+                        "<td>{$tgt->get_Name()}</td>" .
+                        "<td>" . substr($interfaces, 0, -2) . "</td>" .
+                        "<td>" . substr($fqdn, 0, -2) . "</td>" .
+                        "<td>{$tgt->get_OS_String()}</td>" .
+                        "</tr>";
+                }
+            }
+
+            ?>
+        </tbody>
+    </table>
+
+    <?php
+}
+elseif ($page == 'EditSTE' && $ste_id == 'new') {
+
+    ?>
+
+    <style type='text/css'>
+        #cke_scope, #cke_assumptions, #cke_constraints {
+            display:none;
+        }
+    </style>
+
+    <script type='text/javascript'>
+        $(function () {
+          $('#start_date').datepicker({
+            dateFormat: "yy-mm-dd",
+            minDate: -30,
+            onSelect: function (date) {
+              var dt2 = $('#end_date');
+              var startDate = $(this).datepicker('getDate');
+              var minDate = $(this).datepicker('getDate');
+              startDate.setDate(startDate.getDate() + 30);
+              //sets dt2 maxDate to the last day of 30 days window
+              dt2.datepicker('option', 'maxDate', startDate);
+              dt2.datepicker('option', 'minDate', minDate);
+              //$(this).datepicker('option', 'minDate', minDate);
+            }
+          });
+          $('#end_date').datepicker({dateFormat: "yy-mm-dd"});
+    <?php /*
+      CKEDITOR.replace('scope', {height: '100px', width: '675px', toolbar: [
+      {name: 'document', items: ['Source']},
+      {name: 'editor', items: ['Cut', 'Copy', 'Paste', 'PasteText', 'PastFromWord', '-', 'Undo', 'Redo']},
+      {name: 'basicstyles', groups: ['basicstyles', 'cleanup'], items: ['Bold', 'Italic', 'Underline', '-', 'RemoveFormat']},
+      {name: 'paragraph', groups: ['list', 'indent', 'blocks', 'align'], items: ['NumberedList', 'BulletedList', '-', 'Outdent', 'Indent', '-', 'JustifyLeft', 'JustifyCenter', 'JustifyRight', 'JustifyBlock']}
+      ]});
+      CKEDITOR.replace('assumptions', {height: '100px', width: '675px', toolbar: [
+      {name: 'document', items: ['Source']},
+      {name: 'editor', items: ['Cut', 'Copy', 'Paste', 'PasteText', 'PastFromWord', '-', 'Undo', 'Redo']},
+      {name: 'basicstyles', groups: ['basicstyles', 'cleanup'], items: ['Bold', 'Italic', 'Underline', '-', 'RemoveFormat']},
+      {name: 'paragraph', groups: ['list', 'indent', 'blocks', 'align'], items: ['NumberedList', 'BulletedList', '-', 'Outdent', 'Indent', '-', 'JustifyLeft', 'JustifyCenter', 'JustifyRight', 'JustifyBlock']}
+      ]});
+      CKEDITOR.replace('constraints', {height: '100px', width: '675px', toolbar: [
+      {name: 'document', items: ['Source']},
+      {name: 'editor', items: ['Cut', 'Copy', 'Paste', 'PasteText', 'PastFromWord', '-', 'Undo', 'Redo']},
+      {name: 'basicstyles', groups: ['basicstyles', 'cleanup'], items: ['Bold', 'Italic', 'Underline', '-', 'RemoveFormat']},
+      {name: 'paragraph', groups: ['list', 'indent', 'blocks', 'align'], items: ['NumberedList', 'BulletedList', '-', 'Outdent', 'Indent', '-', 'JustifyLeft', 'JustifyCenter', 'JustifyRight', 'JustifyBlock']}
+      ]});
+     */ ?>
+        });
+
+        function validate_Add_STE() {
+          var ret = true;
+
+          if ($('#start_date').val() > $('#end_date').val()) {
+            alert("Your start date can't be after the end date");
+            ret = false;
+          }
+
+          if (!$('#start_date').val()) {
+            alert("You must select a start date for this ST&E");
+            ret = false;
+          }
+
+          if (!$('#end_date').val()) {
+            alert("You must select an end date for this ST&E");
+            ret = false;
+          }
+
+          if ($('#system').val() == "0") {
+            alert("You must select a system for this ST&E");
+            ret = false;
+          }
+
+          if ($('#site').val() == "0") {
+            alert("You must select a site where this ST&E will be performed");
+            ret = false;
+          }
+
+
+          if (ret) {
+            $('#action').prop("disabled", true);
+          }
+          return ret;
+        }
+
+        function show_subsystems() {
+          if ($('#system').val() == '0') {
+            alert('Select a primary system');
+            $('#system').focus();
+            return;
+          }
+
+          if ($('#add_subsystems').is(':checked'))
+            $('#subsystem_container').show();
+          else
+            $('#subsystem_container').hide();
+
+          $('#subsystems option').each(function () {
+            if ($(this).val() == $('#system').val()) {
+              $(this).remove();
+              return;
+            }
+          });
+        }
+    </script>
+
+    <form method='post' action='?p=STEMgmt' onsubmit="return validate_Add_STE();">
+        <input type='hidden' name='action' value='save-ste' />
+        <div style='width:30%;float:left;'>
+            Eval Start Date:
+            <input type='text' name='start_date' id='start_date' /><br />
+            Eval End Date:
+            <input type='text' name='end_date' id='end_date' /><br />
+            System:
+            <select name='system' id='system'>
+                <option value='0'>-- Please Select A System --</option>
+                <?php
+                foreach ($all_systems as $key => $sys):print $sys->get_Option();
+                endforeach;
+
+                ?>
+            </select><br />
+            <label for='add_subsystems'>Subsystems:</label>
+            <input type='checkbox' name='add_subsystems' id='add_subsystems' value='1' onclick='javascript:show_subsystems();' /><br />
+            <div id='subsystem_container' style='display:none;'>
+                <select name='subsystems[]' id='subsystems' multiple size='5' style='width:150px;'>
+                    <?php
+                    foreach ($all_systems as $key => $sys):print $sys->get_Option();
+                    endforeach;
+
+                    ?>
+                </select><br />
+            </div>
+            Site:
+            <select name='site' id='site'>
+                <option value='0'>-- Please Select A Site --</option>
+                <?php
+                foreach ($all_sites as $key => $s):print $s->get_Option();
+                endforeach;
+
+                ?>
+            </select><br />
+            Approving Official: <input type='text' name='ao' title='The office or individual that will approve or disapprove the system' /><br />
+            <input type='button' class='button' id='action' value='Save STE' onclick='this.form.submit();' />
+        </div>
+        <div style='width:70%;float:left;'>
+            <input type='hidden' name='scope' id='scope' value='' />
+            <input type='hidden' name='assumptions' id='assumptions' value='' />
+            <input type='hidden' name='constraints' id='constraints' value='' />
+            <?php /*
+              <label for="s">Scope:</label> <input type='checkbox' id='s' onclick="$('#cke_scope').toggle();" /><br />
+              <textarea name='scope' id='scope' rows='5' cols='80'>
+              [describe the scope of the testing, including systems tested and excluded (and reason for exclusions)]
+              </textarea><br />
+              <label for="a">Assumptions:</label><input type='checkbox' id='a' onclick="$('#cke_assumptions').toggle();" /><br />
+              <textarea name='assumptions' id='assumptions' rows='5' cols='80'>
+              (<span style="color:green;">U</span>) The following assumptions were made during planning and execution of the ST&amp;E:
+              <ul style="list-style-type:disc;">
+              <li>(<span style="color:green;">FOUO</span>) Adequate access to the system and required personnel will be provided prior to conduct of ST&amp;E to support development and dry run testing of the ST&amp;E procedures.</li>
+              <li>(<span style="color:green;">FOUO</span>) The system will be up and fully operational in the specified configuration at the time of testing.</li>
+              <li>(<span style="color:green;">FOUO</span>) All required personnel will be available for the duration of the ST&amp;E.</li>
+              <li>(<span style="color:green;">FOUO</span>) [insert other assumptions as necessary]</li>
+              </ul>
+              </textarea><br />
+              <label for="cd">Constraints &amp; Dependencies:</label><input type='checkbox' id='cd' onclick="$('#cke_constraints').toggle();" /><br />
+              <textarea name='constraints' id='constraints' rows='5' cols='80'>
+              (<span style="color:green;">U</span>) The following potential constraints and dependencies were encountered that could affect the accuracy and completeness of the results.
+              <ul style="list-style-type:disc;">
+              <li>(<span style="color:green;">FOUO</span>) The accuracy and completeness of the ST&amp;E results is dependent on the accuracy and completeness of the information provided to the ST&amp;E team before and during the testing.</li>
+              <li>(<span style="color:green;">FOUO</span>) [insert other issues encountered during testing]</li>
+              </ul>
+              (<span style="color:green;">U</span>) These constraints and dependencies had minimal impact on providing complete and accurate results.
+              </textarea>
+             */ ?>
+        </div>
+    </form>
+
+    <?php
+}

data/sysmgmt.inc

@@ -0,0 +1,173 @@
+<?php
+/**
+ * File: sysmgmt.inc
+ * Author: Ryan Prather
+ * Purpose: For adding or editing systems
+ * Created: Oct 21, 2014
+ *
+ * Portions Copyright 2016-2017: Cyber Perspectives, LLC, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Oct 21, 2014 - File created
+ *  - Sep 1, 2016 - Copyright updated and updated file purpose
+ *  - May 19, 2017 - Migrated to filtering and changed save button to match buttons throughout
+ */
+$page = filter_input(INPUT_GET, 'p', FILTER_SANITIZE_STRING, FILTER_NULL_ON_FAILURE);
+$sys_id = filter_input(INPUT_POST, 'system', FILTER_VALIDATE_INT, FILTER_NULL_ON_FAILURE);
+
+if ($page == 'MSMgmt') {
+  ?>
+
+  <form method='post' action='?p=EditMS'>
+    Select System:<br />
+    <select name='system' onchange="this.form.submit();">
+      <option value='0'>-- Please Select System --</option>
+      <?php
+      foreach ($all_systems as $key => $sys) :
+        print $sys->get_Option();
+      endforeach
+      ;
+      ?>
+      <option value='0'>New...</option>
+    </select>
+  </form>
+
+  <?php
+}
+elseif ($page == 'EditMS' && $sys_id) {
+  $system = $db->get_System($sys_id);
+  if (is_array($system) && count($system) && isset($system[0]) && is_a($system[0], 'system')) {
+    $system = $system[0];
+  }
+  else {
+    die("Couldn't find the selected system");
+  }
+
+  $mac = $system->get_MAC();
+  $class = $system->get_Classification();
+  $acred_type = $system->get_Accreditation_Type();
+  ?>
+
+  <script src='/script/ckeditor/ckeditor.js'></script>
+  <script type='text/javascript'>
+      $(function () {
+        CKEDITOR.replace('description', {height: '100px', width: '950px', toolbar: [
+            {name: 'document', items: ['Source']},
+            {name: 'editor', items: ['Cut', 'Copy', 'Paste', 'PasteText', 'PastFromWord', '-', 'Undo', 'Redo']},
+            {name: 'basicstyles', groups: ['basicstyles', 'cleanup'], items: ['Bold', 'Italic', 'Underline', '-', 'RemoveFormat']},
+            {name: 'paragraph', groups: ['list', 'indent', 'blocks', 'align'], items: ['NumberedList', 'BulletedList', '-', 'Outdent', 'Indent', '-', 'JustifyLeft', 'JustifyCenter', 'JustifyRight', 'JustifyBlock']}
+          ]});
+      });
+  </script>
+
+  <form method='post' action='?p=EditMS'>
+    Select System:<br />
+    <select name='system' onchange="this.form.submit();">
+      <option value='0'>-- Please Select System --</option>
+      <?php
+      foreach ($all_systems as $key => $sys) :
+        $selected = $sys_id == $sys->get_ID() ? true : false;
+        print $sys->get_Option($selected);
+      endforeach
+      ;
+      ?>
+      <option value='0'>New...</option>
+    </select>
+  </form>
+
+  <form method='post' action='?p=MSMgmt'>
+    <input type='hidden' name='action' value='save-system' />
+    <input type='hidden' name='system' value='<?php print $system->get_ID(); ?>' />
+    Name:
+    <input type='text' name='name' id='name'
+           value='<?php print $system->get_Name(); ?>' /><br />
+    Abbr:
+    <input type='text' name='abbr' id='abbr'
+           value='<?php print $system->get_Abbreviation(); ?>' /><br />
+    MAC:
+    <select name='mac' id='mac'>
+      <option value='0'>-- Select MAC --</option>
+      <option value='1' <?php print ($mac == 1 ? " selected" : ""); ?>>Level 1</option>
+      <option value='2' <?php print ($mac == 2 ? " selected" : ""); ?>>Level 2</option>
+      <option value='3' <?php print ($mac == 3 ? " selected" : ""); ?>>Level 3</option>
+    </select><br />
+    Classification:
+    <select name='class' id='class'>
+      <option value='0'>-- Select Classification --</option>
+      <option value='Public'
+              <?php print ($class == 'Public' ? ' selected' : ''); ?>>Public</option>
+      <option value='Sensitive'
+              <?php print ($class == 'Sensitive' ? ' selected' : ''); ?>>Sensitive</option>
+      <option value='Classified'
+              <?php print ($class == 'Classified' ? ' selected' : ''); ?>>Classified</option>
+    </select><br />
+    Accreditation Type:
+    <select name="accred_type" id="accred_type">
+      <option value='0'>-- Select Accreditation --</option>
+      <option value='diacap'
+              <?php print ($acred_type == accrediation_types::DIACAP ? ' selected' : ''); ?>>DIACAP</option>
+      <option value='rmf'
+              <?php print ($acred_type == accrediation_types::RMF ? ' selected' : ''); ?>>RMF</option>
+    </select><br />
+    System Description:<br />
+    <textarea name='description' id='description' cols='1' rows='1'><?php print $system->get_Description(); ?></textarea>
+    <input type='button' class='button' name='action' value='Save System' onclick='this.form.submit();' />
+  </form>
+
+  <?php
+}
+elseif ($page == 'EditMS' && !$sys_id) {
+  ?>
+
+  <script src='/script/ckeditor/ckeditor.js'></script>
+  <script type='text/javascript'>
+      $(function () {
+        CKEDITOR.replace('description', {height: '100px', width: '950px', toolbar: [
+            {name: 'document', items: ['Source']},
+            {name: 'editor', items: ['Cut', 'Copy', 'Paste', 'PasteText', 'PastFromWord', '-', 'Undo', 'Redo']},
+            {name: 'basicstyles', groups: ['basicstyles', 'cleanup'], items: ['Bold', 'Italic', 'Underline', '-', 'RemoveFormat']},
+            {name: 'paragraph', groups: ['list', 'indent', 'blocks', 'align'], items: ['NumberedList', 'BulletedList', '-', 'Outdent', 'Indent', '-', 'JustifyLeft', 'JustifyCenter', 'JustifyRight', 'JustifyBlock']}
+          ]});
+      });
+  </script>
+
+  <form method='post' action='?p=MSMgmt'>
+    <input type='hidden' name='action' value='save-system' />
+    Name:
+    <input type='text' name='name' id='name' /><br />
+    Abbr:
+    <input type='text' name='abbr' id='abbr' /><br />
+    MAC:
+    <select name='mac' id='mac'>
+      <option value='0'>-- Select MAC --</option>
+      <option value='1'>Level 1</option>
+      <option value='2'>Level 2</option>
+      <option value='3'>Level 3</option>
+    </select><br />
+    Classification:
+    <select name='class' id='class'>
+      <option value='0'>-- Select Classification --</option>
+      <option value='Public'>Public</option>
+      <option value='Sensitive'>Sensitive</option>
+      <option value='Classified'>Classified</option>
+    </select><br />
+    Accreditation Type:
+    <select name="accred_type" id="accred_type">
+      <option value='0'>-- Select Accreditation --</option>
+      <option value='diacap'>DIACAP</option>
+      <option value='rmf'>RMF</option>
+    </select><br />
+    System Description:<br />
+    <textarea name='description' id='description' cols='1' rows='1'>[paste system description here]</textarea>
+    <input type='button' class='button' name='action' value='Save System' onclick='this.form.submit();' />
+  </form>
+
+<?php
+}

data/tgtsearch.inc

@@ -0,0 +1,25 @@
+<?php
+/**
+ * File: tgtsearch.inc
+ * Author: Ryan
+ * Purpose: includes the target filter fields
+ * Created: Sep 7, 2016
+ *
+ * Copyright 2016: Cyber Perspectives, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 7, 2016 - File created
+ *  - Mar 8, 2017 - Added auto open of the target filter box
+ */
+$target_filter_width = 990;
+include_once 'target-filter.inc';
+?>
+
+<script type='text/javascript'>
+  $(function () {
+    collapse_expand_data('cat-filter');
+  });
+</script>

docs/Contributors.txt

@@ -0,0 +1,33 @@
+Sagacity is a project with a long history.  It began at SAIC in 2008 as a set of Perl scripts, text and CSV files and a spreadsheet used to reduce weeks of boredom, manually copying STIG results from paper checklists to a computer.  At Salient Federal Solutions in 2012 it gained a web interface and a database.  In 2016, thanks to foresighted Air Force personnel who decided to release it, it is an open source, collaborative effort, designed to save hundreds of man-hours assessing STIG and RMF compliance.  Cyber Perspectives, LLC is managing the Sagacity project in the hope that it will be a huge benefit to many in the DoD, Federal and commercial Cyber Security communities.
+
+The following individuals have contributed code or ideas to Sagacity, the original ST&E Manager or its components.  We are very grateful for everyone's vision and hard work.
+
+Jeff Odegard:  SAIC, Salient Federal Solutions, Engility Corporation, Cyber Perspectives, LLC
+	- Mastermind, ST&E process optimization, E-checklist and Perl script creator, parsers, tweak functions.  Lead hack.
+Ryan Prather:  Salient Federal Solutions, Cyber Perspectives, LLC
+	- Lead Developer, UI design and coding, database guru, the one responsible for the darn thing actually working.
+Matt Shuter:  SAIC, Salient Federal Solutions, Engility Corporation, UCCS Master's Project
+	- E-checklist design, script usability and bug hunting.  UI usability consultant
+Dan Hans:  BTAS, Salient Federal Solutions, Engility Corporation
+	- One of the best bug hunters we've ever known.  E-checklist design, script feedback.  Breaking the UI and demonstrating its shortcomings.
+George Sipos:  SAIC, 2SOPS/MAF, SMC/GPLI
+	- Mastermind behind FIFI, the Gold Disk parser.  E-Checklist feedback, script bug hunter and code consultation.  Asker of why we didn't write this in Python.
+Brian Copeland:  SAIC
+	- E-Checklist design, script usage feedback
+Scott Welker:  Quantech, Booz-Allen Hamilton
+	- Script and E-Checklist feedback, database SRR rewrite.  Convinced us of the need to use XAMPP and not tie ourselves to expensive Microsoft or Adobe products.
+Paul Porter:  Salient Federal Solutions
+	- Page layouts and design, reporting stylesheets, UI coding
+Teresa Campos:  STS Systems Integration
+	- Software design documentation, page layouts
+Douglas Rothnie:  The Aerospace Corporation
+	- Script and E-Checklist feedback, Perl programming support
+Ken Elliott:  The Aerospace Corporation
+	- Script and E-Checklist layout ideas
+Michael Cole:  The Aerospace Corporation
+	- SCAP handling ideas, script and E-Checklist feedback
+	- Procedural E-Checklist modifications to adapt to EMASS
+Erik Wohlgemuth:  Raytheon
+	- Fixes for Linux data collection script
+Jason Gagnon: Raytheon
+	- Fixes for Windows data collection script

docs/Copyright.txt

@@ -0,0 +1,14 @@
+Sagacity is Portions Copyright (c) 2016-2017 Cyber Perspectives, LLC.  All rights reserved.
+
+Sagacity is licensed under the Apache 2.0 license.  See license.txt or http://www.apache.org/licenses/ for details.
+
+Sagacity is a rebranded, much improved release of the ST&E Manager.
+
+ST&E Manager is Copyright (c) 2012-2015 Salient Federal Solutions.
+Portions Copyright (c) 2008-2011 SAIC.
+
+See copyright statement in individual files for author and attribution information.
+
+The ST&E Manager was written entirely by contractors on government contracted time using government funds.  Per DFARS 252.227-7013, the companies (Salient Federal Solutions and SAIC/Leidos) hold the copyrights, but per DFARS 252.227-7014(b)(1), the government has unlimited rights for licensing and distribution.
+
+The ST&E Manager was licensed, per government direction, under the Modified BSD (3 Clause) License.  See license.txt for details.

docs/license.txt

@@ -0,0 +1,84 @@
+Portions Copyright (c) 2016-2017, Cyber Perspectives, LLC.
+
+Sagacity is licensed under the Apache 2.0 license.  See below or http://www.apache.org/licenses/ for details.
+
+Sagacity is a rebranded release of the ST&E Manager.  The Modified BSD (3 Clause) and Apache 2.0 licenses are compatible open source licenses with similar, non-conflicting requirements.
+
+Portions Copyright (c) 2012-2015, Salient Federal Solutions
+Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+
+The ST&E Manager was licensed, per government direction, under the Modified BSD (3 Clause) License.  
+
+ST&E Manager was created by Salient Federal Solutions and Science Applications International Corporation under Contracts W91260-09-D-0006-1201 and FA8823-07-D-0004.  Under those contracts, Salient Federal Solutions and SAIC (now Leidos) own the copyright to their respective portions of that software, and the United States Government acquired unlimited rights to that computer software (48 C.F.R. 252.227-7014(a)(16)).
+
+*** Sagacity Apache 2.0 License ***
+Version 2.0, January 2004
+
+http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities that control, are controlled by, or are under common control with that entity. For the purposes of this definition, "control" means (i) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including but not limited to software source code, documentation source, and configuration files.
+
+"Object" form shall mean any form resulting from mechanical transformation or translation of a Source form, including but not limited to compiled object code, generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form, made available under the License, as indicated by a copyright notice that is included in or attached to the work (an example is provided in the Appendix below).
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that is based on (or derived from) the Work and for which the editorial revisions, annotations, elaborations, or other modifications represent, as a whole, an original work of authorship. For the purposes of this License, Derivative Works shall not include works that remain separable from, or merely link (or bind by name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version of the Work and any modifications or additions to that Work or Derivative Works thereof, that is intentionally submitted to Licensor for inclusion in the Work by the copyright owner or by an individual or Legal Entity authorized to submit on behalf of the copyright owner. For the purposes of this definition, "submitted" means any form of electronic, verbal, or written communication sent to the Licensor or its representatives, including but not limited to communication on electronic mailing lists, source code control systems, and issue tracking systems that are managed by, or on behalf of, the Licensor for the purpose of discussing and improving the Work, but excluding communication that is conspicuously marked or otherwise designated in writing by the copyright owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf of whom a Contribution has been received by Licensor and subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare Derivative Works of, publicly display, publicly perform, sublicense, and distribute the Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License, each Contributor hereby grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work, where such license applies only to those patent claims licensable by such Contributor that are necessarily infringed by their Contribution(s) alone or by combination of their Contribution(s) with the Work to which such Contribution(s) was submitted. If You institute patent litigation against any entity (including a cross-claim or counterclaim in a lawsuit) alleging that the Work or a Contribution incorporated within the Work constitutes direct or contributory patent infringement, then any patent licenses granted to You under this License for that Work shall terminate as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or Derivative Works thereof in any medium, with or without modifications, and in Source or Object form, provided that You meet the following conditions:
+
+	a. You must give any other recipients of the Work or Derivative Works a copy of this License; and
+	b. You must cause any modified files to carry prominent notices stating that You changed the files; and
+	c. You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works; and
+	d. If the Work includes a "NOTICE" text file as part of its distribution, then any Derivative Works that You distribute must include a readable copy of the attribution notices contained within such NOTICE file, excluding those notices that do not pertain to any part of the Derivative Works, in at least one of the following places: within a NOTICE text file distributed as part of the Derivative Works; within the Source form or documentation, if provided along with the Derivative Works; or, within a display generated by the Derivative Works, if and wherever such third-party notices normally appear. The contents of the NOTICE file are for informational purposes only and do not modify the License. You may add Your own attribution notices within Derivative Works that You distribute, alongside or as an addendum to the NOTICE text from the Work, provided that such additional attribution notices cannot be construed as modifying the License. 
+
+You may add Your own copyright statement to Your modifications and may provide additional or different license terms and conditions for use, reproduction, or distribution of Your modifications, or for any such Derivative Works as a whole, provided Your use, reproduction, and distribution of the Work otherwise complies with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any Contribution intentionally submitted for inclusion in the Work by You to the Licensor shall be under the terms and conditions of this License, without any additional terms or conditions. Notwithstanding the above, nothing herein shall supersede or modify the terms of any separate license agreement you may have executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names, trademarks, service marks, or product names of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in writing, Licensor provides the Work (and each Contributor provides its Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are solely responsible for determining the appropriateness of using or redistributing the Work and assume any risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall any Contributor be liable to You for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising as a result of this License or out of the use or inability to use the Work (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if such Contributor has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or Derivative Works thereof, You may choose to offer, and charge a fee for, acceptance of support, warranty, indemnity, or other liability obligations and/or rights consistent with this License. However, in accepting such obligations, You may act only on Your own behalf and on Your sole responsibility, not on behalf of any other Contributor, and only if You agree to indemnify, defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against, such Contributor by reason of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+*** End of Sagacity Apache 2.0 License ***
+
+*** ST&E Manager BSD 3 Clause License ***
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+    1.Redistributions of source code must retain the above copyright
+      notice, this list of conditions and the following disclaimer.
+    2.Redistributions in binary form must reproduce the above copyright
+      notice, this list of conditions and the following disclaimer in the
+      documentation and/or other materials provided with the distribution.
+    3.Neither the name of Salient Federal Solutions, Science Applications  International Corporation, the United States Government, or the names of 
+      its contributors, may be used to endorse or promote products derived from 
+      this computer software without specific prior written permission.
+
+
+THIS COMPUTER SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ARE DISCLAIMED.  IN NO EVENT SHALL SALIENT FEDERAL SOLUTIONS, SCIENCE APPLICATIONS INTERNATIONAL CORPOORATION (NOW LEIDOS), OR THE UNITED STATES GOVERNMENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING BUT NOT LIMITED TO PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWERVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS COMPUTER SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+*** End of ST&E Manager BSD 3 Clause License ***

docs/sample-host-list.csv

@@ -0,0 +1,4 @@
+name,hostname,ip,category,os
+Win7,test1.example.com,192.168.0.1,Win Client,Microsoft Windows 7
+Win2K8Svr,"test2.example.com,test2.example.com","192.168.0.2,192.168.0.3",,cpe:/o:microsoft:windows_server_2008:r2
+RHEL5,test3.example.com,192.168.0.4,Linux Svr,cpe:/o:redhat:enterprise_linux:5

dump.php

@@ -0,0 +1,59 @@
+<?php
+/**
+ * File: dump.php
+ * Author: Ryan Prather
+ * Purpose: Dump database so can start clean
+ * Created: Sep 20, 2013
+ *
+ * Portions Copyright 2016: Cyber Perspectives, All rights reserved
+ * Released under the Apache v2.0 License
+ *
+ * Portions Copyright (c) 2012-2015, Salient Federal Solutions
+ * Portions Copyright (c) 2008-2011, Science Applications International Corporation (SAIC)
+ * Released under Modified BSD License
+ *
+ * See license.txt for details
+ *
+ * Change Log:
+ *  - Sep 20, 2013 - File created
+ *  - Sep 01, 2016 - Copyright updated and converted to constants
+ *  - Feb 21, 2017 - Added processing for view elements in db_schema.xml
+ */
+include_once 'config.inc';
+include_once 'helper.inc';
+include_once 'database.inc';
+
+if (isset($_REQUEST['pwd'])) {
+  set_time_limit(0);
+  $successful = true;
+  // attempt to create a new database connection
+  $conn = new mysqli(DB_SERVER, $_REQUEST['uname'], $_REQUEST['pwd']);
+  $db = new db_helper($conn);
+
+  $json = json_decode(file_get_contents(DOC_ROOT . "/db_schema.json"));
+  $json->tables = array_reverse($json->tables);
+
+  foreach ($json->tables as $table) {
+    print "Dropping {$table->schema}.{$table->name}<br />";
+    $db->drop($table->schema, $table->name);
+  }
+
+  print "<a href='/update.php'>Update</a>";
+}
+?>
+
+<!DOCTYPE HTML>
+<html>
+  <head>
+    <title>Dump Sagacity Database</title>
+  </head>
+
+  <body>
+    <h1 style='color:#f00;'>DUMP DATABASE!</h1>
+    <form method='post' action='#'>
+      MySQL User Name: <input type='text' name='uname' /><br />
+      Password: <input type='password' name='pwd' /><br />
+      <input type='submit' name='submit' value='DUMP' />
+    </form>
+  </body>
+</html>

exec/Target Host Tools/Unix/linux-data-collection.sh

@@ -0,0 +1,182 @@
+#!/bin/bash
+# Script to collect the major security configuration files on a Linux system
+# RUN AS ROOT!
+# tested on RHEL 5.2, SUSE 11
+
+# Jeff A. Odegard, CISSP, CPT, CEH
+# AFSPC SMC/GPEVA
+# 20 Aug 13
+# Rewritten 16 Sep 14
+# Update 31 Mar 15:  Use find -xdev to limit the ffile-permissions.txt to local filesystems only.
+	# Erik Wohlgemuth (Raytheon) and Jeff Odegard
+
+# Add to this list as necessary (get copies of these files)
+FILELIST="/.cshrc
+/.profile
+/etc/aide.conf
+/etc/apache
+/etc/apache2
+/etc/audit/audit.rules
+/etc/audit/auditd.conf
+/etc/cron.allow
+/etc/cron.d
+/etc/cron.deny
+/etc/crontab
+/etc/default
+/etc/ftpusers
+/etc/gshadow
+/etc/hosts
+/etc/hosts.allow
+/etc/hosts.deny
+/etc/hosts.equiv
+/etc/httpd
+/etc/inetd.conf
+/etc/inittab
+/etc/motd
+/etc/newsyslog.conf
+/etc/nsswitch.conf
+/etc/ntp.conf
+/etc/ntp.conf
+/etc/pam.conf
+/etc/pam.d
+/etc/passwd
+/etc/profile
+/etc/redhat-release
+/etc/resolv.conf
+/etc/securetty
+/etc/security
+/etc/shells
+/etc/ssh_config
+/etc/sshd_config
+/etc/ssh/ssh_config
+/etc/ssh/sshd_config
+/etc/SuSE-brand
+/etc/SuSE-release
+/etc/syslog-ng
+/etc/sysconfig/apache2
+/etc/sysconfig/selinux
+/etc/sysctl.conf
+/etc/syslog.conf
+/etc/syslog-ng
+/etc/xinetd.conf
+/etc/xinetd.d
+/proc/cmdline
+/root/.cshrc
+/root/.profile"
+
+
+#HOSTNAME=`uname -a | cut -d" " -f2`
+HOSTNAME=`hostname`
+DIR="$HOSTNAME-baseline"
+echo ""
+echo "Results will be in ./$DIR"
+mkdir -p $DIR
+cd $DIR
+FILEDIR="system-files"
+echo "System files will be in ./$DIR/system-files"
+mkdir -p system-files
+rm -f $HOSTNAME-errors.txt
+echo "Linux Data collection started on `date`" >> $HOSTNAME-errors.txt
+echo ""
+echo "Collecting some system information..."
+echo "	uname -a"
+uname -a > uname.txt
+echo "	ifconfig -a"
+ifconfig -a > ifconfig.txt
+echo "	netstat -nr"
+netstat -nr > netstat-nr.txt
+echo "	netstat -nap"
+netstat -nap > netstat-nap.txt
+echo "	ps aux"
+ps aux > ps-aux.txt
+echo "	last -a"
+last -a -i > last-a-i.txt
+echo "	who -a"
+who -a > who-a.txt
+echo "	df -ak"
+df -ak > df-ak.txt
+echo "	mount"
+mount > mount.txt
+echo "	rpcinfo -p"
+rpcinfo -p > rpcinfo-p.txt
+if [ `grep "nfs" rpcinfo-p.txt` ] ; then
+	echo "	showmount"
+	showmount 2>showmount.txt > showmount.txt
+	echo "	showmount -e"
+	showmount -e 2>showmount.txt > showmount-e.txt
+else
+	echo "	Skipping showmount. NFS does not appear in rpcinfo."
+	echo "	NFS does not appear in rpcinfo.  Skipping showmount." >> $HOSTNAME-errors.txt
+fi
+
+echo "	rpm -qa -last"
+rpm -qa -last > rpm-qa-last.txt
+echo "	crontab -l"
+crontab -l 2>crontab-l.txt > crontab-l.txt
+echo "	pwck -r"
+pwck -r > pwck-r.txt
+
+echo ""
+echo "Gathering file listing/permissions for STIG checks"
+echo "   NOTE: find errors are normal"
+rm -f file-permissions.txt
+FSTYPE=`mount | egrep "on \/ type" | awk '{print $5}'`
+for MOUNTPT in `mount | grep $FSTYPE | awk '{print $3}'`; do
+	find $MOUNTPT -xdev -fstype $FSTYPE -ls >> file-permissions.txt
+done
+FILESIZE=`ls -sh file-permissions.txt | cut -d" " -f1`
+if [ $FILESIZE -eq "0" ]; then # SuSE Linux 
+	echo "  Hmmm, might be a SuSE Linux system"
+	find / -fstype rootfs -ls > file-permissions.txt
+fi
+ls -sh file-permissions.txt
+
+echo ""
+echo "Collecting some security configuration files and folders."
+echo "   NOTE: Inability to find some files is normal":
+for FILE in $FILELIST ; do
+   if [ -f  $FILE -o -d $FILE ] ; then
+	DEST=`echo $FILE | sed "s/\//\-/g" | sed "s/^\-//"`
+      echo " cp -af $FILE ./$FILEDIR/$DEST"
+      cp -af $FILE ./$FILEDIR/$DEST
+   else
+	#egrep "\/passwd$" ehud-baseline/file-permissions.txt | awk '{print $11}'
+     echo "	  Could not find $FILE" >> $HOSTNAME-errors.txt
+     echo "	  Could not find $FILE"
+   fi
+done
+
+# We don't want to collect password hashes, but need to know if the accounts are locked.
+# Note: this "for LINE in" hack only works because there are no spaces in /etc/shadow... :o}
+
+rm -f shadow-trimmed
+echo ""
+echo "Trimming /etc/shadow for safety..."
+for LINE in `cat /etc/shadow` ; do
+   HASH=`echo $LINE | cut -d":" -f2`
+   # Typical password hash is 34 characters
+   if [ ${#HASH} -lt 13 ] ; then
+	echo $LINE >> shadow-trimmed.txt
+   elif [ ${#HASH} -lt 34 ] ; then
+	echo $LINE | awk -F':' 'BEGIN{ OFS=":"; } { print $1,"SHORT/WEAK HASH",$3,$4,$5,$6,$7,$8,$9 }' >> shadow-trimmed.txt
+   else
+        echo $LINE | awk -F':' 'BEGIN{ OFS=":"; } { print $1,"FILTERED",$3,$4,$5,$6,$7,$8,$9 }' >> shadow-trimmed.txt
+   fi
+done
+
+echo ""
+echo "Please review to ensure hashes are filtered"
+echo ""
+cat shadow-trimmed.txt
+echo ""
+echo "Linux Data collection ended on `date`" >> $HOSTNAME-errors.txt
+cd ..
+echo "Tarring and Gzipping the results"
+tar -zcvf $DIR.tgz ./$DIR
+
+echo ""
+echo "All packaged up and ready to go in $DIR.tgz"
+ls -sh $DIR.tgz
+echo "Have a nice day!"
+echo ""
+

exec/Target Host Tools/Unix/solaris-data-collection.sh

@@ -0,0 +1,165 @@
+#!/bin/ksh
+# Script to collect the major security configuration files on a Solaris system
+# RUN AS ROOT!
+# tested on Solaris 10
+
+# Jeff A. Odegard, CISSP
+# AFSPC SMC/GPEA
+# 20 Aug 13
+# Updated 4 Sep 14
+
+# Add to this list as necessary (get copies of these files)
+FILELIST="/.cshrc
+/.profile
+/etc/access.conf
+/etc/apache
+/etc/apache2
+/etc/cron.allow
+/etc/cron.d
+/etc/cron.deny
+/etc/default
+/etc/dfs
+/etc/ftpd
+/etc/ftpusers
+/etc/hosts
+/etc/hosts.allow
+/etc/hosts.deny
+/etc/hosts.equiv
+/etc/httpd
+/etc/inet/inetd.conf
+/etc/inet/ntp.conf
+/etc/inetd.conf
+/etc/issue
+/etc/issue.net
+/etc/motd
+/etc/nsswitch.conf
+/etc/ntp.conf
+/etc/pam.conf
+/etc/passwd
+/etc/passwd
+/etc/profile
+/etc/resolv.conf
+/etc/securetty
+/etc/security
+/etc/shells
+/etc/snmp/conf/snmpd.conf
+/etc/snmpd.conf
+/etc/syslog.conf
+/etc/system
+/noshell"
+
+#HOSTNAME=`uname -a | cut -d" " -f2`
+HOSTNAME=`hostname`
+DIR="$HOSTNAME-baseline"
+echo ""
+echo "Results will be in ./$DIR"
+mkdir -p $DIR
+cd $DIR
+FILEDIR="system-files"
+echo "System files will be in ./$DIR/system-files"
+mkdir -p system-files
+rm -f $HOSTNAME-errors
+
+echo ""
+echo "Collecting some system information..."
+echo "	uname -a"
+uname -a > uname.txt
+echo "	ifconfig -a"
+ifconfig -a > ifconfig.txt
+echo "	netstat -nr"
+netstat -nr > netstat-nr.txt
+echo "	netstat -nap"
+netstat -nap > netstat-nap.txt
+echo "	ps -eaf"
+ps -eaf > ps-eaf.txt
+echo "	last -a"
+last -a > last-a.txt
+echo "	who -a"
+who -a > who-a.txt
+echo "	df -ak"
+df -ak > df-ak.txt
+echo "	mount -p"
+mount -p > mount-p.txt
+echo "	rpcinfo -p"
+rpcinfo -p >rpcinfo-p.txt
+if [ `grep "nfs" rpcinfo-p.txt` ] ; then
+	echo "	showmount"
+	showmount 2>&1 > showmount.txt
+	echo "	showmount -e"
+	showmount -e 2>&1 > showmount-e.txt
+else
+	echo "	Skipping showmount. NFS does not appear in rpcinfo."
+	echo "	NFS does not appear in rpcinfo.  Skipping showmount." >> $HOSTNAME-errors.log
+fi
+echo "	pkginfo -l"
+pkginfo -l > pkginfo-l.txt
+echo "	crontab -l"
+crontab -l > crontab-l.txt
+echo "	showrev -a"
+showrev -a > showrev-a.txt
+echo "	xhost"
+xhost 2>&1 1>xhost.txt
+echo "	eeprom security-mode"
+eeprom security-mode 2>&1 1>eeprom-security-mode.txt
+echo "	prtconf -D"
+prtconf -D 2>&1 1>prtconf-D.txt
+
+echo ""
+echo "Gathering file listing/permissions for STIG checks"
+echo "   NOTE: find errors are normal"
+rm -f file-permissions.txt
+# Get FStype for /
+#FSTYPE=`mount -p | egrep " \/ [a-z]+" | awk '{print $4}'`
+find / -local -ls > file-permissions.txt
+ls -sh file-permissions.txt
+
+echo ""
+echo "Collecting some security configuration files and folders."
+echo "   NOTE: Inability to find some files is normal":
+# use cp -R - cron.d has a named pipe
+for FILE in $FILELIST ; do
+   if [ -f  $FILE -o -d $FILE ] ; then
+	  DEST=`echo $FILE | sed "s/\//\-/g" | sed "s/^\-//"`
+      echo "cp -R $FILE ./$FILEDIR/$DEST"
+      cp -R $FILE ./$FILEDIR/$DEST
+   else
+     echo "   Could not find $FILE" >> $HOSTNAME-errors.log
+     echo "   Could not find $FILE"
+   fi
+done
+
+# We don't want to collect password hashes, but need to know if the accounts are locked.
+# Note: this "for LINE in" hack only works because there are no spaces in /etc/shadow... :o}
+
+rm -f shadow-trimmed
+echo ""
+echo "Trimming /etc/shadow for safety..."
+for LINE in `cat /etc/shadow` ; do
+   HASH=`echo $LINE | cut -d":" -f2`
+   # Typical password hash is 34 characters
+   if [ ${#HASH} -lt 13 ] ; then
+	echo $LINE >> shadow-trimmed.txt
+   elif [ ${#HASH} -lt 34 ] ; then
+        echo $LINE | awk -F':' 'BEGIN{ OFS=":"; } { print $1,"SHORT/WEAK HASH",$3,$4,$5,$6,$7,$8,$9 }' >> shadow-trimmed.txt
+   else
+        echo $LINE | awk -F':' 'BEGIN{ OFS=":"; } { print $1,"FILTERED",$3,$4,$5,$6,$7,$8,$9 }' >> shadow-trimmed.txt
+   fi
+done
+
+echo ""
+echo "Please review to ensure hashes are filtered"
+echo ""
+cat shadow-trimmed.txt
+echo ""
+
+cd ..
+echo "Tarring and Gzipping the results"
+tar -cvf $DIR.tar ./$DIR
+gzip $DIR.tar
+
+echo ""
+echo "All packaged up and ready to go in $DIR.tar.gz"
+ls -sh $DIR.tar.gz
+echo "Have a nice day!"
+echo ""
+

exec/Target Host Tools/Windows/Windows Data Collection/files-to-version.txt

@@ -0,0 +1,4 @@
+C:\Windows\system32\notepad.exe
+C:\Program Files (x86)\Notepad++\notepad++.exe
+c:\Windows\system32\EnPasFltV2x86.dll
+c:\Windows\system32\EnPasFltV2x64.dll

exec/Target Host Tools/Windows/Windows Data Collection/filever.vbs

@@ -0,0 +1,10 @@
+Set fso = WScript.CreateObject("Scripting.FileSystemObject")
+Set objArgs = WScript.Arguments
+if objArgs.Count<>1 then WScript.Quit()
+if NOT fso.FileExists(objArgs(0)) then WScript.Echo("File " & objArgs(0) & " does not exist") & WScript.Quit()
+set f = fso.GetFile(objArgs(0))
+WScript.Echo objArgs(0) & "," & fso.GetFileVersion(objArgs(0)) & "," & f.DateLastModified
+
+rem to call the script just use
+rem cscript -nologo filever.vbs "c:\WINNT\system32\notepad.exe" 
+

exec/Target Host Tools/Windows/Windows Data Collection/reg-perms-to-check.txt

@@ -0,0 +1,2 @@
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf

exec/Target Host Tools/Windows/Windows Data Collection/reg-values-to-check.txt

@@ -0,0 +1,175 @@
+HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa,RestrictAnonymous
+HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa,RestrictAnonymousSAM
+HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa,LmCompatibilityLevel
+HEKY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa,DisableDomainCreds
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa,ForceGuest
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa,SCENoApplyLegacyAuditPolicy
+hkey_local_machine\system\CurrentControlSet\control\lsa,usemachineid
+hkey_local_machine\system\CurrentControlSet\control\lsa\msv1_0,allownullsessionfallback
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0,NTLMMinClientSec
+hkey_local_machine\system\CurrentControlSet\Control\lsa\pku2u,AllowOnlineID
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths,Machine
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager,SafeDllSearchMode
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths,Machine
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Security,WarningLevel
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\IPSEC,NoDefaultExempt
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters,DisablePasswordChange
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters,MaximumPasswordAge
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionShares
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters,NullSessionPipes
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters,RequireSecuritySignature
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Lanmanserver\Parameters,Hidden
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters,SmbServerNameHardeningLevel
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters,AutoDisconnect
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LDAP,LDAPClientIntegrity
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Netbt\Parameters,NoNameReleaseOnDemand
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters,DisableIPSourceRouting
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters,EnableICMPRedirect
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters,KeepAliveTime
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters,PerformRouterDiscovery
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters,TcpMaxDataRetransmissions
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip6\Parameters,DisableIpSourceRouting
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip6\Parameters,TcpMaxDataRetransmissions
+HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip6\Parameters,DisabledComponents
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon,AutoAdminLogon
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon,ScreenSaverGracePeriod
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole,SecurityLevel
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf,(Default)
+hkey_local_machine\Software\Policies\Microsoft\EMET\SysSettings,ASLR
+hkey_local_machine\Software\Policies\Microsoft\EMET\SysSettings,DEP
+hkey_local_machine\Software\Policies\Microsoft\EMET\SysSettings,SEHOP
+hkey_local_machine\Software\Policies\Microsoft\EMET\Defaults,IE
+hkey_local_machine\Software\Policies\Microsoft\EMET\Defaults
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Messenger\Client,CEIP
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SearchCompanion,DisableContentFileUpdates
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers,DisbleHTTPPrinting
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Printers,DisableWebPnPDownload
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc,RestrictRemoteClients
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Rpc,EnableAuthEpResolution
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services,fAllowToGetHelp
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services,fAllowUnsolicited
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services,fPromptForPassword
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services,fDenyTSConnections
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services,fDisableCdm
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services,MinEncryptionLevel
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services,PerSessionTempDir
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services,DeleteTempDirsOnExit
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services,MaxDisconnectionTime
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services,MaxIdleTime
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services,DisablePasswordSaving
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\PCHealth\ErrorReporting,DoReport
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Peernet,Disabled
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Settings,AllowRemoteRPC
+hkey_local_machine\Software\Policies\Microsoft\Windows\Explorer,NoDataExecutionPrevention
+hkey_local_machine\Software\Policies\Microsoft\Windows\EventLog\Application,MaxSize
+hkey_local_machine\Software\Policies\Microsoft\Windows\EventLog\Security,MaxSize
+hkey_local_machine\Software\Policies\Microsoft\Windows\EventLog\Setup,MaxSize
+hkey_local_machine\Software\Policies\Microsoft\Windows\EventLog\System,MaxSize
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOONdomain
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD,AllowLLTDIOOnPublicNet
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD,EnableLLTDIO
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD,ProhibitLLTDIOOnPrivateNet
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOndomain
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD,AllowRspndrOnPublicNet
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD,EnableRspndr
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\LLTD,ProhibitRspndrOnPrivateNet
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Network Connections,NC_AllowNetBridge_NLA
+hkey_local_machine\Software\Policies\Microsoft\Windows\TCPIP\v6Transition,6to4_State
+hkey_local_machine\Software\Policies\Microsoft\Windows\TCPIP\v6Transition,ISATAP_State
+hkey_local_machine\Software\Policies\Microsoft\Windows\TCPIP\v6Transition,Teredo_State
+hkey_local_machine\Software\Policies\Microsoft\Windows\TCPIP\v6Transition\IPHTTPS\IPHTTPSInterface,IPHTTPS_ClientState
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars,DisableFlashConfigRegistrar
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars,DisableInBand802DOT11Registrar
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars,DisableUPnPRegistrar
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars,DisableWPDRegistrar
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\Registrars,EnableRegistrars
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WCN\UI,DisableWcnUi
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Group Policy\{35378EAC-683F-11D2-A89A-00C04FBBCFA2},NoGPOListChanges
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsMediaPlayer,DisableAutoupdate
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\CredUI,EnumerateAdministrators
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer,NoDriveTypeAutorun
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoPublishingWizard
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoWebServices
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInternetOpenWith
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoOnlinePrintsWizard
+hkey_local_machine\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,PreXPSP2ShellProtocolBehavior
+hkey_local_machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoAutorun
+hkey_local_machine\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\WAU,Disabled
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System,FilterAdministratorToken
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System,ConsentPromptBehaviorAdmin
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System,EnableSecurityUIAPaths
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System,PromptOnSecureDesktop
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System,ValidateAdminCodeSignatures
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system,DisableBkGndGroupPolicy
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\system,LogonType
+hkey_local_machine\Software\Microsoft\Windows\CurrentVersion\Policies\System,ReportControllerMissing
+hkey_local_machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,LocalAccountTokenFilterPolicy
+HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters,SupportedEncryptionTypes
+hkey_local_machine\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar,TurnOffUnsignedGadgets
+hkey_local_machine\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar,OverrideMoreGadgetsLink
+hkey_local_machine\Software\Microsoft\Windows\CurrentVersion\Policies\Windows\Sidebar,TurnOffUserInstalledGadgets
+hkey_local_machine\Software\Microsoft\Windows NT\CurrentVersion\Winlogon,AllocateCDRoms
+HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components
+HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EventViewer,MicrosoftEventVwrDisableLinks
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Feeds,DisableEnclosureDownload
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,DCSettingIndex
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Power\PowerSettings\0e796bdb-100d-47d6-a2d5-f7d2daa51f51,ACSettingIndex
+hkey_local_machine\Software\Policies\Microsoft\SQMClient\Windows,CEIPEnable
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\SystemCertificates\AuthRoot,DisableRootAutoUpdate
+hkey_local_machine\Software\Policies\Microsoft\WMDRM,DisableOnline
+hkey_local_machine\Software\Policies\Microsoft\Windows\AppCompat,DisableInventory
+HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings,WarnOnBadCertRecving
+HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3,1E05
+HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4,1E05
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DriverSearching,DontSearchWindowsUpdate
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DriverSearching,DontPromptForWindowsUpdate
+hkey_local_machine\Software\Policies\Microsoft\Windows\DriverSearching,SearchOrderConfig
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Settings,DisableSystemRestore
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\DeviceInstall\Settings,DisableSendGenericDriverNotFoundToWER
+hkey_local_machine\Software\Policies\Microsoft\Windows\Device Metadata,PreventDeviceMetadataFromNetwork
+hkey_local_machine\Software\Policies\Microsoft\Windows\Explorer,NoHeapTerminationOnCorruption
+hkey_local_machine\Software\Policies\Microsoft\Windows\Explorer,NoAutoplayfornonVolume
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\GameUX,DownloadGameInfo
+hkey_local_machine\Software\Policies\Microsoft\Windows\GameUX,GameUpdateOptions
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\HandwritingErrorReports,PreventHandwritingErrorReports
+hkey_local_machine\Software\Policies\Microsoft\Windows\Homegroup,DisableHomeGroup
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Internet Connection Wizard,ExitOnMSICW
+HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer,AlwaysInstallElevated
+hkey_local_machine\Software\Policies\Microsoft\Windows\Installer,SafeForScripting
+hkey_local_machine\Software\Policies\Microsoft\Windows\Installer,EnableUserControl
+hkey_local_machine\Software\Policies\Microsoft\Windows\Installer,DisableLUAPatching
+hkey_local_machine\Software\Policies\Microsoft\Windows\Network Connections,NC_StdDomainUserSetInstaller
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Registration Wizard Control,NoRegistration
+hkey_local_machine\Software\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,DisableQueryRemoteServer
+hkey_local_machine\Software\Policies\Microsoft\Windows\ScriptedDiagnosticsProvider\Policy,EnableQueryRemoteServer
+hkey_local_machine\Software\Policies\Microsoft\Windows\TabletPC,PreventHandwritingDataSharing
+hkey_local_machine\Software\Policies\Microsoft\Windows\TCPIP\v6Transition,Force_Tunneling
+hkey_local_machine\Software\Policies\Microsoft\Windows\WDI\{9c5a40da-b965-4fc3-8781-88dd50a6299d},ScenarioExecutionEnabled
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Windows Error Reporting,LoggingDisabled
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Windows Error Reporting,Disabled
+hkey_local_machine\Software\Policies\Microsoft\Windows\Windows Error Reporting,DontSendAdditionalData
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Windows Search,AllowIndexingEncryptedStoresOrItems
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Windows Search,PreventIndexingUncachedExchangeFolders
+HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU,NoAutoUpdate
+HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate,WUServer
+hkey_local_machine\Software\Policies\Microsoft\WindowsMediaPlayer,GroupPrivacyAcceptance
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows Defender\Spynet,SpyNetReporting
+hkey_local_machine\Software\Policies\Microsoft\Windows NT\Printers,DoNotInstallCompatibleDriverFromWindowsUpdate
+HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Terminal Services,LoggingEnabled
+HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\W32Time\Parameters,Type
+HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\W32Time\Parameters,NTPServer
+HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main,Use FormSuggest
+HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions,NoExternalBranding
+HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main,FormSuggest Passwords
+HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Control Panel\Desktop,ScreenSaveActive
+HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Control Panel\Desktop,ScreenSaverIsSecure
+HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Control Panel\Desktop,ScreenSaveTimeOut
+HKEY_CURRENT_USER\Software\Policies\Microsoft\Assistance\Client\1.0,NoImplicitFeedback
+HKEY_CURRENT_USER\Software\Policies\Microsoft\Assistance\Client\1.0,NoExplicitFeedback
+HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing
+HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,SaveZoneInformation
+HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,HideZoneInfoOnProperties
+HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Attachments,ScanWithAntiVirus
+HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,NoInPlaceSharing
+HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings,SecureProtocols

exec/Target Host Tools/Windows/Windows Data Collection/tee.cmd

@@ -0,0 +1,27 @@
+::tee.cmd, by Ken Henderson
+:: http://blogs.msdn.com/khen1234/archive/2005/10/27/486031.aspx
+:: modified to append the file rather than over-write
+@echo off
+
+IF (%1)==() GOTO help
+
+::Overwrite the file (W2K/XP require /Y)
+:: SET slash_y=
+:: ver ¦ find "Windows NT" >nul
+:: if ERRORLEVEL 1 set slash_y=/Y
+
+:: ::Overwrite the file
+:: copy %slash_y% nul %1 >nul 2>&1
+
+for /f "tokens=1* delims=]" %%A in ('find /V /N ""') do (
+ >con echo.%%B
+ >>%1 echo.%%B
+)
+
+GOTO :eof
+
+:help
+ECHO.
+ECHO Pipe text to the console and redirect to a file simultaneously
+ECHO.
+ECHO Usage:  command | tee filename

exec/Target Host Tools/Windows/Windows Data Collection/windows-data-collection.bat

@@ -0,0 +1,299 @@
+@echo off
+REM ########################################################################
+REM windows-data-collection.bat - collects ST&E relevant data
+REM Jeff A. Odegard, CISSP  15 May 13
+REM 
+REM ########################################################################
+
+HOSTNAME >HOSTNAME.txt
+for /F "eol=; tokens=1* delims= " %%i in (HOSTNAME.txt) do @set HOSTNAME=%%i
+set OUTDIR=C:\temp\%HOSTNAME%
+mkdir %OUTDIR% >nul 2>&1
+set originaldir=%cd%
+echo.
+echo Results will be in %OUTDIR%
+echo.
+echo  Admin privilege required.  Checking access
+net session >nul 2>&1
+if %errorlevel% NEQ 0 (
+	echo.
+	echo.     ERROR:  Script must run with administrative privileges!
+	goto end_of_script
+) 
+echo.   - Success
+echo.
+set VERSION="0.1, 15 May 13"
+echo. | date /t >C:\temp\%HOSTNAME%\date.txt
+echo. | time /t >C:\temp\%HOSTNAME%\time.txt
+set dt=
+set tm=
+for /F "eol=; tokens=* delims= " %%i in (C:\temp\%HOSTNAME%\date.txt) do @set dt=%%i
+for /F "eol=; tokens=5 delims= " %%i in (C:\temp\%HOSTNAME%\time.txt) do @set tm=%%i
+rem This is the way you do string substitution in Batch...
+set dt=%dt:/=-%
+set dt=%dt: =%
+REM set tm=%tm =%
+REM set tm=%tm: =%
+
+del /F C:\temp\%HOSTNAME%\date.txt C:\temp\%HOSTNAME%\time.txt HOSTNAME.txt
+set OUTBASE=%HOSTNAME%.txt
+set SUMMARYFILE=%OUTDIR%\%HOSTNAME%-data-collection-summary-%dt%.txt
+set CHECKSUMS=%OUTDIR%\%HOSTNAME%-checksums-%dt%.txt
+setlocal enableextensions enabledelayedexpansion
+REM ########################################################################
+REM Data Gathering Starts Here
+REM ########################################################################
+
+del /f /q c:\temp\%HOSTNAME%\*
+
+echo User List  | tee.cmd %SUMMARYFILE%
+wmic useraccount get name,sid 2>&1 > %OUTDIR%\user_list.txt
+
+echo Windows Registry Permissions
+REM This produces a 60Meg file.  Need to modify to only pull perms required for STIG
+echo   * DUMPSEC.exe /rpt=registry=HKEY_LOCAL_MACHINE /outfile=%OUTDIR%\HKLM-permissions.csv /saveas=csv >> %SUMMARYFILE%
+echo   * dumpsec.exe HKEY_LOCAL_MACHINE to HKLM-permissions.csv
+DUMPSEC.exe /rpt=registry=HKEY_LOCAL_MACHINE /outfile=%OUTDIR%\HKLM-permissions.csv /saveas=csv
+echo   * DUMPSEC.exe /rpt=registry=HKEY_USERS /outfile=%OUTDIR%\HKU-permissions.csv /saveas=csv >> %SUMMARYFILE%
+echo   * dumpsec.exe HKEY_USERS to HKU-permissions.csv
+DUMPSEC.exe /rpt=registry=HKEY_USERS /outfile=%OUTDIR%\HKU-permissions.csv /saveas=csv
+echo.
+
+echo   * 1.006, net localgroup "Administrators" | tee.cmd %OUTDIR%\admin_group.txt
+echo     -- net localgroup "Administrators" | tee.cmd %SUMMARYFILE%
+net localgroup "Administrators" > %OUTDIR%\admin_group.txt
+echo.
+
+echo   * 1.007, Backup Operators Group | tee.cmd %OUTDIR%\backup_group.txt
+echo     -- net localgroup "Backup Operators" | tee.cmd %SUMMARYFILE%
+net localgroup "Backup Operators" > %OUTDIR%\backup_group.txt
+echo.
+
+echo   * 2.001, Log File Permissions | tee.cmd %OUTDIR%\log_permissions.txt
+echo     -- icacls C:\Windows\System32\winevt\Logs\Application.evtx | tee.cmd %SUMMARYFILE%
+icacls C:\Windows\System32\winevt\Logs\Application.evtx > %OUTDIR%\log_permissions.txt
+echo     -- icacls C:\Windows\System32\winevt\Logs\Security.evtx | tee.cmd %SUMMARYFILE%
+icacls C:\Windows\System32\winevt\Logs\Security.evtx >> %OUTDIR%\log_permissions.txt
+echo     -- icacls C:\Windows\System32\winevt\Logs\System.evtx | tee.cmd %SUMMARYFILE%
+icacls C:\Windows\System32\winevt\Logs\System.evtx >> %OUTDIR%\log_permissions.txt
+echo.
+
+echo   * 2.008 NTFS Requirement | tee.cmd %OUTDIR%\disk_partitions.txt
+echo list volume > listvol.scr
+echo     -- diskpart /s listvol.scr | tee.cmd %SUMMARYFILE%
+diskpart /s listvol.scr > %OUTDIR%\disk_partitions.txt
+del listvol.scr
+
+echo   * 2.015 File Share ACLs | tee.cmd %OUTDIR%\net_shares.txt
+echo     -- net share | tee.cmd %SUMMARYFILE%
+net share > %OUTDIR%\net_shares.txt
+for /F "eol=; tokens=1 delims= " %%i in (%OUTDIR%\net_shares.txt) do (
+	set mytest=foo
+	if %%i == "2.015" set mytest=bar 
+	if "%%i" == "Share" set mytest=bar
+	if "%%i" == "The" set mytest=bar
+	if "%%i" == "-------------------------------------------------------------------------------" set mytest=bar
+	if '%%i' == '*' set mytest =bar
+	if "!mytest!"=="foo" (
+		echo.    - Permissions for %%i
+		echo    - net share %%i >> %SUMMARYFILE%
+		net share %%i >> %OUTDIR%\net_shares.txt 2>&1
+	)
+)
+echo.
+
+echo   * 2.005, Unsupported Service Packs | tee.cmd %OUTDIR%\os_info.txt
+echo     -- systeminfo OS Name, Version, Type, Domain, Logon Server | tee.cmd %SUMMARYFILE%
+systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"System Type" /C:"Domain" /C:"Logon Server" > %OUTDIR%\os_info.txt
+echo.
+
+echo   * 2.019 Security Related Software Patches | tee.cmd %OUTDIR%\hotfixes.txt
+echo     -- wmic /output:hotfixes.txt qfe list | tee.cmd %SUMMARYFILE%
+wmic qfe list > %OUTDIR%\hotfixes.txt
+echo.
+
+echo   * 2.021, Software Certificate Installation Files | tee.cmd %OUTDIR%\hotfixes.txt
+echo     -- dir /s /b *.p12 *.pfs (C:\) | tee.cmd %SUMMARYFILE%
+cd C:\
+dir /s /b *.p12 *.pfs > %OUTDIR%\hotfixes.txt
+cd %originaldir%
+echo.
+
+REM Miscellaneous info
+echo Miscellaneous Information | tee.cmd %SUMMARYFILE%
+echo   * tasklist.exe - process list | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\tasklist.txt
+echo     -- tasklist.exe | tee.cmd %SUMMARYFILE%
+tasklist.exe > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo   * net.exe start - Running Windows Services | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\net-start.txt
+echo     -- net.exe start | tee.cmd %SUMMARYFILE%
+net.exe start > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo   * tasklist /svc - Services Associated with Processes | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\tasklist-svc.txt
+echo     -- tasklist.exe /svc | tee.cmd %SUMMARYFILE%
+tasklist.exe /svc > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo   * wmic process list full - detailed process information  | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\wmic-process-list-full.txt
+echo     -- wmic.exe process list full | tee.cmd %SUMMARYFILE%
+wmic.exe process list full > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo   * wmic startup list full - List all startup tasks | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\wmic-startup-list-full.txt
+echo     -- wmic.exe startup list full | tee.cmd %SUMMARYFILE%
+wmic.exe startup list full > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo   * reg query  - list contents of startup registry keys | tee.cmd %SUMMARYFILE%
+echo      - reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
+echo      - reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run >> %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\reg-query-Run.txt
+echo     -- reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\Run | tee.cmd %SUMMARYFILE%
+reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\Run  2>&1 > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo      - reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Runonce | tee.cmd %SUMMARYFILE% 
+set OUTFILE=%OUTDIR%\reg-query-Runonce.txt
+echo     -- reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\Runonce | tee.cmd %SUMMARYFILE%
+reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\Runonce 2>&1 > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+ 
+echo      - reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunonceEx | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\reg-query-Runonce-Ex.txt
+echo     -- reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\RunonceEx | tee.cmd %SUMMARYFILE%
+reg.exe query HKLM\Software\Microsoft\Windows\CurrentVersion\RunonceEx 2>&1 > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo   * netstat -naob - list network services, connections and processes | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\netstat-naob.txt
+echo     -- netstat -naob | tee.cmd %SUMMARYFILE%
+netstat -naob > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+ 
+echo   * nbtstat -S - record active NetBIOS connections | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\nbtstat-S.txt
+echo     -- nbtstat -S | tee.cmd %SUMMARYFILE%
+nbtstat -S > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo   * nbtstat -c - record cached NetBIOS connections | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\nbtstat-c.txt
+echo     -- nbtstat -c | tee.cmd %SUMMARYFILE%
+nbtstat -c > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo   * arp -a - record Arp Table  | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\arp-a.txt
+echo     -- arp -a | tee.cmd %SUMMARYFILE%
+arp -a > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo   * ipconfig /all - List all network devices | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\ipconfig-all.txt
+echo     -- ipconfig /all | tee.cmd %SUMMARYFILE%
+ipconfig /all > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo   * net view \\127.0.0.1  - list file shares | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\file-shares.txt
+echo     -- net view \\127.0.0.1 | tee.cmd %SUMMARYFILE%
+net view \\127.0.0.1 > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo   * net sessions - list open NetBIOS sessions | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\net-sessions.txt
+echo     -- net sessions | tee.cmd %SUMMARYFILE%
+net sessions > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo   * netsh firewall show config - display firewall configuration | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\netsh-firewall-show-config.txt
+echo     -- netsh firewall show config | tee.cmd %SUMMARYFILE%
+netsh firewall show config > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo   * net user - list system users | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\system-users.txt
+echo     -- net user | tee.cmd %SUMMARYFILE%
+net user > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo   * net localgroup administrators - list local system administrator accounts | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\local-administrators.txt
+echo     -- net localgroup administrator | tee.cmd %SUMMARYFILE%
+net localgroup administrators > %OUTFILE%
+fciv.exe -both "%OUTFILE%" >> %CHECKSUMS%
+
+echo   * Installed Software | tee.cmd %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\installed-software.csv
+echo     -- wmic product /format:csv get name,version | tee.cmd %SUMMARYFILE%
+wmic product get /format:csv name,version > %OUTFILE%
+
+echo   * Query the registry for values | tee.cmd  %SUMMARYFILE%
+for /F "eol=; tokens=1,2 delims=," %%i in (reg-values-to-check.txt) do (
+	echo     - reg query "%%i" | tee.cmd  %SUMMARYFILE%
+	if "%%j" NEQ "" (
+		if "%%j" EQU "(Default)" (reg query "%%i" /v 2>&1 >> %OUTDIR%\registry-values.txt
+		) else (reg query "%%i" /v "%%j" 2>&1 >> %OUTDIR%\registry-values.txt)
+	) else (reg query "%%i" 2>&1 >> %OUTDIR%\registry-values.txt)
+)
+
+echo   * Gather file version information | tee.cmd  %SUMMARYFILE%
+for /F "eol=; tokens=* delims= " %%i in (files-to-version.txt) do (
+	echo     -- filever.vbs %%i | tee.cmd  %SUMMARYFILE%
+	cscript -nologo "%originaldir%\filever.vbs" "%%i" >> %OUTDIR%\file-version-results.txt
+)
+
+echo   * Gather auditing information | tee.cmd  %SUMMARYFILE%
+set OUTFILE=%OUTDIR%\audit_information.csv
+echo     -- auditpol /get /category:* /r
+auditpol /get /category:* /r > %OUTFILE%
+
+echo   * Gather Security Policy Information | tee.cmd %SUMMARYFILE%
+echo     -- secedit /export /cfg security_policy.inf /areas SECURITYPOLICY
+secedit /export /cfg %OUTDIR%\security_policy.inf /areas SECURITYPOLICY /quiet
+
+REM Do this last, so they can save off the policy, zip everything up and finish the script.
+REM echo Security Policy Checks | tee.cmd  %SUMMARYFILE%
+REM echo   gpedit.msc will open.
+REM echo      Expand: Computer Configuration 
+REM echo                       - Windows Settings 
+REM echo                                 -- Security Settings 
+REM echo                                             --- Local Policies
+REM echo.
+REM echo   * Audit Policy - single click, right click - export list, 
+REM echo      -- save as audit_policy.txt
+REM echo   * User Rights - single click, right click - export list, 
+REM echo      -- save as user_rights.txt
+REM echo   * Security Options - single click, right click - export list, 
+REM echo      -- save as security_options.txt
+REM echo   * Under Account Policies, save Password Policies and Account Lockout Policies
+REM echo      -- save as password_policy.txt
+REM echo      -- save as account_policy.txt
+REM echo.
+REM echo   Close the Policy editor when you're finished.
+REM echo   * gpedit.msc | tee.cmd %SUMMARYFILE%
+REM gpedit.msc 
+REM echo. 
+
+REM ########################################################################
+REM End Data Gathering
+REM ########################################################################
+
+echo Windows data collection complete.  Normality has been restored...
+REM echo Zip and copy %OUTDIR% to the PTL for further analysis.
+REM dir %OUTDIR%
+REM PAUSE
+
+7z u -y -tzip DataCollection.zip %OUTDIR%
+
+cd %originaldir%
+:end_of_script
+cd !originaldir!

exec/Target Host Tools/Windows/Windows-Manual-Tools/Fport-readme.txt

@@ -0,0 +1,38 @@
+Readme for fport v2.0
+
+fport supports Windows NT4, Windows 2000 and Windows XP
+
+fport reports all open TCP/IP and UDP ports and maps them to the owning application.
+This is the same information you would see using the 'netstat -an' command, but it also
+maps those ports to running processes with the PID, process name and path.  Fport can be
+used to quickly identify unknown open ports and their associated applications.
+
+Usage:  
+C:\>fport
+FPort v2.0 - TCP/IP Process to Port Mapper
+Copyright 2000 by Foundstone, Inc.
+http://www.foundstone.com
+Pid   Process            Port  Proto Path
+392   svchost        ->  135   TCP   C:\WINNT\system32\svchost.exe
+8     System         ->  139   TCP
+8     System         ->  445   TCP
+508   MSTask         ->  1025  TCP   C:\WINNT\system32\MSTask.exe
+
+392   svchost        ->  135   UDP   C:\WINNT\system32\svchost.exe
+8     System         ->  137   UDP
+8     System         ->  138   UDP
+8     System         ->  445   UDP
+224   lsass          ->  500   UDP   C:\WINNT\system32\lsass.exe
+212   services       ->  1026  UDP   C:\WINNT\system32\services.exe
+
+The program contains five (5) switches.  The switches may be utilized using either a '/' 
+or a '-' preceding the switch.  The switches are;
+
+Usage:
+	/?	 usage help
+        /p       sort by port
+        /a       sort by application
+        /i       sort by pid
+        /ap      sort by application path
+
+For updates visit:  www.foundstone.com

exec/Target Host Tools/Windows/Windows-Manual-Tools/tee.cmd

@@ -0,0 +1,28 @@
+::tee.cmd, by Ken Henderson
+:: http://blogs.msdn.com/khen1234/archive/2005/10/27/486031.aspx
+:: modified to append the file rather than over-write
+@echo off
+
+IF (%1)==() GOTO help
+IF (%1)==(-a) (SET FILE=%2) || (SET FILE=%1)
+
+::Overwrite the file (W2K/XP require /Y)
+:: SET slash_y=
+:: ver ¦ find "Windows NT" >nul
+:: if ERRORLEVEL 1 set slash_y=/Y
+
+:: ::Overwrite the file
+:: copy %slash_y% nul %1 >nul 2>&1
+
+for /f "tokens=1* delims=]" %%A in ('find /V /N ""') do (
+ >con echo.%%B
+ >>%FILE% echo.%%B
+)
+
+GOTO :eof
+
+:help
+ECHO.
+ECHO Pipe text to the console and redirect to a file simultaneously
+ECHO.
+ECHO Usage:  command | tee filename