anti/DECNET
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ui): surface attacker date_hdr in mail table and drawer

Browse Source 
MailDrawer was reading fields.date / from_addr / message_id —
all wrong; actual log field names are date_hdr, from_hdr,
message_id_hdr, to_hdr.  The mail table in AttackerDetail
showed only DECNET capture time and used from_addr instead
of from_hdr.  Add a DATE (attacker) column so the attacker-
supplied Date header (including timezone) is visible at a
glance — useful for correlating campaigns like the Tiscali
run where IPs used distinct TZs (+0800 vs -0700).
This commit is contained in:
anti
2026-04-30 14:11:08 -04:00
parent d0b07bdf52
commit 72498f81b2
2 changed files with 12 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
decnet_web/src/components/MailDrawer.tsx
View File

@@ -81,9 +81,9 @@ const MailDrawer: React.FC<MailDrawerProps> = ({ decky, storedAs, fields, onClos
}
};
const recipients = Array.isArray(fields.rcpts)
? fields.rcpts.join(', ')
: (typeof fields.rcpts === 'string' ? fields.rcpts : null);
const recipients = fields.to_hdr
|| (Array.isArray(fields.rcpts) ? fields.rcpts.join(', ') : null)
|| (typeof fields.rcpts === 'string' ? fields.rcpts : null);
return (
<div
@@ -156,10 +156,10 @@ const MailDrawer: React.FC<MailDrawerProps> = ({ decky, storedAs, fields, onClos
HEADERS
</h3>
<Row label="Subject" value={fields.subject} />
<Row label="From" value={fields.from_addr ?? fields.from} />
<Row label="From" value={fields.from_hdr || fields.from_addr || fields.from} />
<Row label="To" value={recipients} />
<Row label="Date" value={fields.date} />
<Row label="Message-ID" value={fields.message_id} />
<Row label="Date" value={fields.date_hdr || fields.date} />
<Row label="Message-ID" value={fields.message_id_hdr || fields.message_id} />
<Row label="Mail from" value={fields.mail_from} />
</section>