From dd73ad544cbfa811cbc8dacf83a5fec1144310e0 Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Wed, 9 Jun 2021 09:06:29 -0400
Subject: [PATCH] Rename PATH var to avoid collision with OS PATH var; wrapped
 password var in quotes to support spaces in Fleet/TheHive passwords

---
 salt/common/tools/sbin/so-elasticsearch-query | 4 ++--
 salt/common/tools/sbin/so-user                | 5 +++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/salt/common/tools/sbin/so-elasticsearch-query b/salt/common/tools/sbin/so-elasticsearch-query
index c56f5671f..80dd6ee2e 100644
--- a/salt/common/tools/sbin/so-elasticsearch-query
+++ b/salt/common/tools/sbin/so-elasticsearch-query
@@ -31,7 +31,7 @@ if [[ $# -lt 1 ]]; then
   exit 1
 fi
 
-PATH=$1
+QUERYPATH=$1
 shift
 
-{{ ELASTICCURL }} -s -k -L -H "Content-Type: application/json" "https://localhost:9200/${PATH}" "$@"
+{{ ELASTICCURL }} -s -k -L -H "Content-Type: application/json" "https://localhost:9200/${QUERYPATH}" "$@"
diff --git a/salt/common/tools/sbin/so-user b/salt/common/tools/sbin/so-user
index d21ecc58c..0f36deae2 100755
--- a/salt/common/tools/sbin/so-user
+++ b/salt/common/tools/sbin/so-user
@@ -165,6 +165,7 @@ function syncElasticSystemRole() {
 }
 
 function syncElastic() {
+  echo "Syncing users between SOC and Elastic..."
   usersTmpFile="${elasticUsersFile}.tmp"
   rolesTmpFile="${elasticRolesFile}.tmp"
   createElasticFile "${usersTmpFile}"
@@ -331,8 +332,8 @@ case "${operation}" in
     createUser "$email"
     syncAll
     echo "Successfully added new user to SOC"
-    check_container thehive && echo $password | so-thehive-user-add "$email"
-    check_container fleet && echo $password | so-fleet-user-add "$email"
+    check_container thehive && echo "$password" | so-thehive-user-add "$email"
+    check_container fleet && echo "$password" | so-fleet-user-add "$email"
     ;;
 
   "list")