Review and Approve Findings

[aaronweaver]

Sometimes findings need to be peer reviewed by other reviewers. I'd like the ability to be able to assign a status to the finding of 'Under Review'. When a finding is under review that finding can be assigned to other system reviewers and will notify them that the finding needs to be reviewed. Optionally an email should be sent out notifying a reviewer that there is a finding that should be reviewed.

[devGregA]

Hmm. Status is an interesting field because it is generated on the fly based on other selections in the finding model: https://github.com/rackerlabs/django-DefectDojo/blob/master/dojo/models.py#l527.
It's probably not the best model, but that's how it evolved over time. I think the easiest way to incorporate this would be to add a boolean field to finding as under_review. Then in status add a check. What about how this would relate to the verified field? This might be a good candidate for a plugin vs core like @grendel513 did with surveys https://github.com/grendel513/defectDojo-engagement-survey

[grendel513]

@aaronweaver in looking at #62, it would have to be completed before we can move on this one. Do we think those folks would ever be assigned a Finding for review? Are we strictly sticking to Staff and Superusers as reviewers?

[grendel513]

@aaronweaver, @devGregA - should Findings under review be counted in the metrics? If yes, then no code changes are needed. If no, then I will have to dig through all the places where metrics are calculated and add the additional check.

[devGregA]

I think that findings under review are equivalent to not verified findings and could use the same boolean?

[grendel513]

@aaronweaver, @devGregA - perfect, that is the way i started coding it. As soon as it is mark for review the Active attribute will be set to false. Everything that acts on the active switch should fall in line. Thanks!

[grendel513]

@aaronweaver, @devGregA - Findings are now able to be marked for review. Users are able to select any
staff member to review the finding for accuracy. When a finding is marked
for review it is marked inactive and unverified. When reviewer clears
review, they have the option to set the findings status and must also leave
a new note to document verification.

This update requires the following commands:
./manage makemigrations dojo
./manage migrate
./manage collectstatic