Edit an overwritten rule

[jesusgn90]

Hi team,

When we try to edit a custom rule that has been overwritten, the detail that is loaded is the detail of the original rule, so we can't edit it.

When we perform a GET /rules/:id we get the two, and we take the first one.

{
  "error": 0,
  "data": {
    "items": [
      {
        "level": 3,
        "pci": [
          "10.2.5"
        ],
        "id": 5715,
        "details": {
          "match": "^Accepted|authenticated.$",
          "if_sid": "5700"
        },
        "gdpr": [
          "IV_32.2"
        ],
        "groups": [
          "authentication_success",
          "gpg13_7.1",
          "gpg13_7.2",
          "syslog",
          "sshd"
        ],
        "status": "enabled",
        "description": "sshd: authentication success.",
        "path": "ruleset/rules",
        "file": "0095-sshd_rules.xml"
      },
      {
        "level": 3,
        "pci": [],
        "id": 5715,
        "details": {
          "overwrite": "yes",
          "if_sid": "5700",
          "options": "alert_by_email",
          "match": "^Accepted|authenticated.$"
        },
        "gdpr": [],
        "groups": [
          "authentication_success",
          "local",
          "syslog",
          "sshd"
        ],
        "status": "enabled",
        "description": "SSHD authentication success.",
        "path": "etc/rules",
        "file": "local_rules.xml"
      }
    ],
    "totalItems": 2
  }
}

We need to fix it.

Regards.

[juankaromo]

Solved here 29b797c