jira push error reasons should not be propagated to all channels

[valentijnscholten]

Description

Historically the current notification system always propagates all messages to all channels configured for the notification type / source.
Some messages however are not relevant for all channels, for example reasons why findings cannot be pushed to JIRA.
But we do need to display these alerts in the UI because that's the only place where users can see feedback of these errors/warnings.
This PR introduces an alert_only flag to indicate that notifications should only be an alert.
It does reuse all the existing NotificationManager logic around System vs Personal notifications, templating and recipients.

This PR also fixes a bug where the "See All Alerts / Clear All Alerts" buttons where not shown due to a Javascript error.

Fixes #11575

Test results
Creating a unit test for this is currently not possible, unless I create a whole bunch of code to Mock more things.
I'm not sure if that's worth it for this small corner case situation.
I did test the different scenario's, and can still create JIRA issues: https://defectdojo.atlassian.net/browse/DOJOTEST-24

[dryrunsecurity]

DryRun Security Summary

The code changes in DefectDojo encompass improvements to the notification system, user interface, and Jira integration, focusing on enhanced security features, better usability, and more reliable integration capabilities through selective notification handling, improved UI functionality, and enhanced Jira synchronization.

Expand for full summary

Summary:

The provided code changes cover several improvements and enhancements to the DefectDojo application, with a focus on the notification system, user interface, and Jira integration. From an application security perspective, these changes introduce several positive improvements:

1. Selective Notification Handling: The addition of the alert_only parameter in the notification system allows critical security-related notifications to be sent as alerts, ensuring they are not missed even if other notification channels are temporarily unavailable or misconfigured.
2. Improved UI and Functionality: The changes to the user interface and navigation menus provide users with better access to key features, such as managing findings, engagements, and product settings. The improved HTML escaping function also helps prevent potential cross-site scripting (XSS) vulnerabilities.
3. Enhanced Jira Integration: The changes to the Jira integration, including improved error handling, status synchronization, and attachment handling, help ensure that the integration between DefectDojo and Jira is more reliable and provides better visibility into any issues that may arise.

Overall, these code changes appear to be focused on improving the security, usability, and reliability of the DefectDojo application, which is an important tool for managing application security processes.

Files Changed:

1. dojo/notifications/helper.py: This file was updated to introduce a new alert_only parameter in the create_notification function, allowing certain notifications to be sent as alerts only. This helps ensure that critical security-related notifications are not missed.
2. dojo/templates/base.html: The changes in this file focus on improving the user interface and navigation, providing users with better access to key features such as managing findings, engagements, and product settings. The updated htmlEscape function also helps prevent potential XSS vulnerabilities.
3. dojo/finding/views.py: The changes in this file improve the logging and error reporting for issues related to pushing findings to Jira, providing more specific information about why a finding or finding group could not be pushed.
4. dojo/jira_link/helper.py: This file was updated to improve the Jira integration, including conditional Jira pushes, Jira issue metadata retrieval, status synchronization, attachment handling, and error handling and notification. These changes help ensure the reliability and visibility of the Jira integration.

Code Analysis

We ran 9 analyzers against 4 files and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[mtesauro]

Approved