From 9114234d3cef1db3a76de7bb57c2fbabb66700dd Mon Sep 17 00:00:00 2001
From: Greg Elin <gregelin@govready.com>
Date: Mon, 9 Aug 2021 22:19:28 +0000
Subject: [PATCH] Feature 0.9.8 (#1680)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* test

* Add Django mgt cmd importcomponents to batch import components

Updates to generation of components to improve adherence to OSCAL
specification by removing certain keys when value for keys is None.

Added new parameter `existing_import_record` to importing and creating
components to group multiple imports under the same import record.

* Make Elements.description TextField and required

Change Elements.description to TextField and make required.
Modify component edit modal to use a textarea for description field.
Fixes to show error on problem saving edit to library component

* Use self.element.tags.exists()

* Send proper error message when editing component

* Temporarily remove controls/migrations/0051_auto

* Add back better controls/migrations/0051_auto

* fixed control and sectioning for components in system

* check for security impact level statement when updating. Readding retrieval of security impact levels. todo on separate form for levels.

* adding component_state and component_type to system component and component library display. including component_metadata template to keep styling consistent

* pulling in some of the information from statement about system. Rest would come from questionnaires. system_information_types is not used at all.

* a todo for fisma impact level renaming

* added project_security_objs_edit to edit security objectives separately from project editing.

* update changelog and some wording in the modal

* Move action-button styles from inline to style section

* two views/urls for editing component state and type

* adding component type and state to ElementForm

* adding just the display of the state and type to component library components not the ability to change.

* changelog

* FISMA IMPACT LEVEL is now SECURITY SENSITIVITY LEVEL

* Work inprogress

* Work inprogress

* Da/quick insert (#1601)

* make sure component_type not element_type is exported

* ssp versions should be floats not integers. Information types needs a uuid

* adding empty placeholders for the required keys.

* using updated for component version

* party-uuids is still a todo

* categorizations is still a todo

* parties is still a todo

* Fix system ctl detail page err; Improve creating smt from prototypes (#1602)

Refactor creating system control statements from component library
prototype statements when adding a component from the library to a system
and reduce by an order a magnitude the time it takes to add a component to system.

Rename smt.create_instance_from_prototype to smt.create_system_control_smt_from_component_prototype_smt

Fix bug breaking rendering of system's control detail page by
removing an errant login_required decorator on a function.
Add test for system control page. Will add test(s) for system control detail page.

Co-authored-by: Greg Elin <greg.elin@govready.com>

* Automatically clear, refresh output document content downloading docs

Performnce of document generation now sufficiently fast
to not require cache and manual "Refresh documents" button.

* remove comments. changelog

* Fixed an issue where statement didn't exist while exporting to oscal (#1605)

* Fixed an issue where statement didn't exist while exporting to oscal

* Update CHANGELOG

Co-authored-by: Alexander Ward <alexander.ward1@gmail.com>
Co-authored-by: Greg Elin <greg.elin@govready.com>

* Align Delete section on project settings (#1604)

Co-authored-by: Greg Elin <greg.elin@govready.com>

* Update CHANGELOG

* Ge/file upload extensions (#1607)

* Accepts file uploads with capitalized extensions, e.g. ".JPG".

Adjust file upload validator to recognize capitalized extensions
and also recognizes ".jpeg" in addition to ".jpg".

* Add tests for validating uppercase extensions on file uploads

* Add test fixture data

Co-authored-by: Greg Elin <greg.elin@govready.com>

* Batch update cntl impl smts when component_statement changes

Implemented a faster way to update status of system controls.
When user sets a system component state to "operational" all statements
associated with that component for the system get their status set to
"Implemented". Similarly, setting component’s state to "planned" batch
sets all component statements for that system to "Planned", and
"under-development" sets component statements to "Partially Implemented".

Display system component component_state and component_type when
component is listed for a system.

* More okta changes

* export a projects ssp control implementations with export form (#1611)

* export a projects ssp control implementations with export form

* remove comments

* Correct slugify import

* Security update Python 3.2.4 due to https://snyk.io/vuln/SNYK-PYTHON-DJANGO-1298665

* Polish SSP control CSV export form

Co-authored-by: Greg Elin <greg.elin@govready.com>

* Add 'Create a template' button to template library (#1610)

Co-authored-by: Greg Elin <greg.elin@govready.com>

* Content-Security-Policy header permit images (*), videos youtube, vimeo

* quick fix for auth

* quick fix for auth

* quick fix for auth

* quick fix for auth

* quick fix for auth

* Force controls csv to download to browser

* quick fix for auth

* quick fix for auth

* test

* test

* test

* test

* test

* last fix and vuln update for django

* last fix and vuln update for django

* 'Back' link to question to take user to previous question (#1612)

* 'Back' link to question to take user to previous question

* Update guidedmodules/views.py

Refactor pulling back_url into project_form

Co-authored-by: davidpofo <dampofo@umd.edu>

* Improve back-button styling

Co-authored-by: Greg Elin <Greg Elin>
Co-authored-by: davidpofo <dampofo@umd.edu>
Co-authored-by: Greg Elin <greg.elin@govready.com>

* WIP: Side-by-side comparison of components (#1620)

* created checkbox and form for submitting components for comparison. created rough start for displaying differences between prime component and rest

* for now just implementing two comparison

* click to read full text after 50 chars

* styling and added Control part

* displaying comparisons for x number of component statements against the prime component. Styling and abstracted out the comparison block into an included template

* check for pid

* removing detail/summary not really necessary

* Condense comparison listings into rows of a single table

Co-authored-by: Greg Elin <Greg Elin>

* Update CHANGELOG.md

* Rename 'compare' column to 'select' in component library (#1626)

Co-authored-by: Greg Elin <Greg Elin>

* Remove portfolio selection modal from Start a Project process

Start projects in user's default portfolio to reduce the clicks
starting a project.

Use the User.create_default_portfolio_if_missing method consistently
to consistently create the user portfolio default portfolio.

Remove the PortfolioSignupForm because registration is no longer
used in registering users.

Remove the '"project_form": AddProjectForm(request.user ...' passed
into many templates because the navbar start app option no longer
brings up the portfolio select modal.

* Update tests for default portfolio

* Bump VERSION, CHANGELOG

* Update CHANGELOG VERSION

* Add button, form to add AppSource via upload of zip file

Add button, form to App Store to provide front-end UI for
admininstrators to add an AppSource by uploading a zip file.
This simplifies setting up an AppSource for first time users.

Implementation only validates that uploaded directory is a zip
file, does not check if uploaded zip file is valid AppSource
directory structure.

Implementation assumes apps are in the 'apps' directory.

* Link to library version of component from a system's selected control component

* Display systems using a component (#1618)

* Display systems using a component

Add method controls.element.consuming_systems to produce list of systems
consuming (e.g., containing) the element.

Add tab to component library component detail page to display list of systems
containing the component.

Also, always display OSCAL tab in component library for component detail
(rather than conditional on 'enable_experimental_opencontrol' parameter).

* Show component system count in tab, better projects.exists query

* Replace list compression with query filters

Co-authored-by: Greg Elin <greg.elin@govready.com>
Co-authored-by: davidpofo <dampofo@umd.edu>

* Ge/fulltext search (#1631)

* Add fulltext smt search to component library search

* Note fulltext search in CHANGELOG

Co-authored-by: Greg Elin <Greg Elin>

* check if we are in a portfolio when starting a project. If so then use that portfolio and not the default for the user.

* fixed a bug where Elements of type system were shown in the selected components for a project

* Addressing github issue 1630 in group id matching. fixed a bug where Elements of type system were shown in the selected components for a project.

* Add YAML intermediary file for CMMC

* try/except to still do the component search for non-Postgres users. (#1633)

* Add a 'blank' project with no questions useful for batch project creation (#1634)

Co-authored-by: Greg Elin <Greg Elin>

* td not th

* Polish security objective ui

* Avoid errors when project has no root_task set

* Better project name when no root task set

* Align project name when listing project with no root task

* Support CMMC ver 1 OSCAL catalog

* Fix typo

* Add 'blank' compliance app to first_run

* Append '-dev' to version number

* Legacy Statements added as statements for import

* Updating regex

* Del size limit on speedyssp img upload

* updated column for imp statements

* Fix test shipped catalogs count

* td not th

* Revert "td not th"

This reverts commit e7e8b9c5

* these values are safe

* removing extra differences obj.

* safe and efficiency

* adding select/deselect all. checkbox container wrap.

* control structure for compare button toggle

* Maintain sort order of compare_list otherwise Django will order ascending

* adding change component button to change what the prime component of comparison is. Still has work todo

* changed to allow user passed in for parsing

* remove commented out code from template

* Add UI for legacy statement display. Also fix StatementTypeEnum. (#1644)

* [WIP] UI to display legacy control impl smts

Create a conditional display of legacy control implementation
statements in control editor page.

Also widen width of display of editor control statements
to 1250px.

* Improve display of legacy statement

* StatementTypeEnum fixes. Closes #1643

Set all `StatementTypeEnum.<LABEL>.value` to `StatementTypeEnum.<LABEL>.name`
in order for relevant label/term to show up in Django database admin interface.

Set component library detail page Systems tab to not be inactive thereby
removing the content from the System tab showing up on the Control Implementation
Statements tab.

Update controls.tests.

Co-authored-by: Greg Elin <greg.elin@govready.com>

* Update CHANGELOG

* fixing styling of portfolio table

* using django guardian ObjectPermissionChecker to prefetch permissions. Directly check permissions, to avoid N+1 query of perms with get_obj_perms

* hide_registration revert

* formatting for sid

* Use StatementEnum.*.name value

* removing change component comparison button for now.

* implemented persistent storage of checks by changing value in hidden input with jquery. Clears storage after clicking compare button or deselecting all

* Use one import record for entire file

* More OSCALize id fixes. Proper Create/Update/Del of smts

* Display other_statement count on confirm import delete

* test test_portfolio_projects

* Add project, system.root_element to import_record

Add project and system.root_element to import_record
in order to auto delete the project and system (and root element)
when the import process for importing legacy control impl smts
also creates the project.

* name not value for statement enums

* Sometimes there are not parameters and that is okay it is caught by the try/except block.

* Captialize mission for test

* name not value for enums

* captial impact... Impact

* testing parse for version

* missed one get

* is_prerelease not dev release

* using is_prerelease works for checking dev

* need to force login as authenticated user and then reset login

* url

* snyk update to avoid SQL injection vuln found in Django 3.2.4

* check if previously checked and if so then don't hide compare button.

* fix conflicting migrations detected

* systems-security-sensitivity-level

* Fix controls/0052 StatementTypeEnum migration (#1648)

Co-authored-by: Greg Elin <Greg Elin>

* Update CHANGELOG.md (#1647)

* Configure users on install

New govready_users parameter in local/environment.json
to create sample users on install.

* Add Wazuh collection form to Assessments page (#1651)

* Add Wazuh info via end-user form

* Create SecurityService class to represent Security Service

Create `sec_srvc.SecurityService` class to represent a security service
from which data could be collected.

Add form to Assessments page to collect info from Wazuh SecurityService.

* Fix sec_srvc.py

* Abstracted and made a few improvements

* Fix uuid error

* Fix testing for fields

Co-authored-by: Greg Elin <greg.elin@govready.com>
Co-authored-by: Alexander Ward <alexander.ward1@gmail.com>

* checking for dev user creation pw. Create reg users not admin.

* Add CMMC baselines, assign baselines (#1649)

* Improve CMMC links, add OSCAL methods for link content

Improve CMMC catalog links to link to NIST 800-53 in GovReady.

Add methods to OSCAL catalog, get control_part, guidance links

Add get_control_part_by_name, get_control_guidance_links,
get_guidance_related_links_by_value_in_href, and
get_guidance_related_links_text_by_value_in_href to make getting
link content easier.

* Display related controls as links in control guidance

* Properly assign CMMC baselines

* Remove debugging print statements

* Fix typo

* Properly use StatementTypeEnum when saving smts

Co-authored-by: Greg Elin <greg.elin@govready.com>
Co-authored-by: Greg Elin <Greg Elin>

* first_run finishing touch

* Fix assessment summary link to wazuh (#1653)

* Add Wazuh info via end-user form

* Create SecurityService class to represent Security Service

Create `sec_srvc.SecurityService` class to represent a security service
from which data could be collected.

Add form to Assessments page to collect info from Wazuh SecurityService.

* Fix sec_srvc.py

* Abstracted and made a few improvements

* Fix uuid error

* Fix testing for fields

* Fix assessment summary link to wazuh

Co-authored-by: Greg Elin <greg.elin@govready.com>
Co-authored-by: Alexander Ward <alexander.ward1@gmail.com>

* Da/dropnfill (#1654)

* adding drag and fill for component import

* client-side filetype checking

* client-side file size checking 5MB max. missing div.

* missing listed catalog for CMMC. Delete extra migration. adjust test for drag-n-fill. import_project_submit for import project view/test

* json_content not id_file

* spelling

* del

* hot fix for external catalogs

* Remove baseline controls based on control's catalog_key. Fixes failure to remove controls from another catalog when resetting baselines. (#1655)

Co-authored-by: Greg Elin <greg.elin@govready.com>

* Update SpeedSSP ssp template for multiple catalogs (#1656)

Co-authored-by: Greg Elin <greg.elin@govready.com>

* Update admin.py

Readded AppInput

* new line fix

* fixed bug where id doesn't exist yet in db

* pinning jinja and installing compliance-trestle with unpinning of markupsafe in order to validate oscal 1.0.0.

* revert some changes to ssp-def for now and added source to statement model.

* ensure source and uuid are added correctly to import/export of component-definition

* adding oscal-version to element model. clean up output title

* replaced component-defintion for test data with official oscal 1.0.0 example component

* lowering the amount of output for circleci

* fixing exceptions

* update example link

* WIP on updating system-security-plan definition.

* missing uuid and 2 removed

* SSP export now includes the uuid and version from the root_element object

* fixing up some module logic to include real uuid and oscal version

* uuid not id

* Import component control statement even if catalog not found

Remove test to see of control exists in control catalog when importing
a component because we may import a component that has controls from
a catalog that is not yet in GovReady.

The test on the control id being in the catalog was originally done
to avoid importing a bad control (or bad control id). But it is worse
to not be able to import the component because we don't yet have the
a control catalog mentioned by the component.

* Display component, smts even if catalog missing

Do not crash on displaying a component and component
control implementation statement when a catalog
associated with statements is missing from GovReady-Q
install.

* Ge/data grid question (#1667)

* Improve appearance of data grid question

Display datagrid question wider and with smaller fonts.
Support datgrid specifying select type cell.

* Display legacy smt in system selected controls; fix component counts

Fix count on project system's components associated with a control (avoid double counting).

Display existance of legacy statement in project system's selected controls.

* Fix typo

Co-authored-by: Greg Elin <greg.elin@govready.com>

* Adjust test to new rule of importing controls with bad catalog

* natsorting implementation statements before grouping by sid. Providing statement's uuid. Ensuring
all requirements are added to final control implementation dictionary. dealing with empty or incorrect catalogs. Fixed up smt parse.

* If no statements are created then delete empty component

* OSCAL SSP almost implemented just need to finish implemented reqs.

* OSCALSystemSecurityPlanSerializer is getting there still have some fields to fill.

* added new function OSCAL_ssp_export in order to export a system's security plan in OSCAL, this replaces the usual JSON export. Added a several fields of data for OSCAL SSP.

* Coverage 6.0b1 starts to use a modern hash algorithm (sha256) when fingerprinting for high-security environments. Updating the requirements and Changelog.

* added a proxy for parties and responsible parties for component oscal export

* a couple tweaks for comp

* todo for ssp validation with trestle

* read validate ssp  with trestle

* revert discussion test change.

* extra file

* test_path?

* delete invalid test files

* fixing up implementation and testing of validation of extension.

* remove extra addition for .doc

* var sleep?

* bad test case

* adding some comments. Better logging/messaging for schema. Fixed splitting of control id.

* Added test of OSCAL ssp export.

* explicitly login as user

* test baseline json file should be test_baselines.json not baseline

* create system

* check part correctly. test fix

* get system from self

* try/except

* last try

* done

* Remove duplicate loads of select2 in base.html

* Da/cleanup export sspcsv (#1674)

* created a de-oscalizing function and applied to selected controls on import.

* some super route way of making sure the catalogs produce 3.1.

* add test of de_oscalize_control

* Da/discussion updates (#1675)

* get task for the attached object. added some more notes

* fixed signature for getting a task for the attached object.

* Added get_discussion_autocompletes changes to get the organization from the discussion(should be 1 to 1). If another models wants to implement it they can look at the get_discussion_autocompletes in TaskAnswer

* Added get_discussion_autocompletes changes to get the organization from the discussion(should be 1 to 1). If another models wants to implement it they can look at the get_discussion_autocompletes in TaskAnswer

* addressing shell script issues for dockerfile_exec_gunicorn.sh from GH issues 1659 (#1670)

Co-authored-by: root <root@MSI.localdomain>

* Some controls have characters that we currently don't expect. However it shouldn't just return an empty string as this errors out. Also the controls are already in oscal format. (#1676)

* Auto-start a particular project (#1640)

* [WIP] Auto-start a particular project

Enable the auto-starting of a particular project, e.g.,
start a project without having to visit the compliance app
store.

Eventually, start a project and launch the first question.

* Rename auto start app variables

* Finish project auto start, auto start question, redirect actions

Complete work on automatically starting a project defined in
by a System Setting.

Allow the auto start system setting to define the project template
(e.g. compliance app) to use and even the module to automatically
start.

Also add new question actions to redirect to project page
or project component after answering a question.

TO DO:
- Add error handling (e.g., missing/incorrect project)
- Add tests

* Bump VERSION

Co-authored-by: Greg Elin <Greg Elin>
Co-authored-by: Greg Elin <greg.elin@govready.com>

* Move Catalog data into database, faster control select autocomplete (#1673)

* Move Catalog data into database, faster control select autocomplete

Move control catalog data into database so catalogs shipped
with GovReady and user added catalogs all accessed in database.
Also faster reading in containers.
Adjust first_run to load catalogs.
Speed up auocomplete by only selecting matching controls.

* Fix tests: add catalogs to db in setup

* Read baselines from database

* Sync with 0.9.7

* Fix tests

* Fix tests 2

* Use better DB query instead of closure

Co-authored-by: Greg Elin <greg.elin@govready.com>

* Ge/mvp july 2021 (#1679)

* [WIP] Auto-start a particular project

Enable the auto-starting of a particular project, e.g.,
start a project without having to visit the compliance app
store.

Eventually, start a project and launch the first question.

* Rename auto start app variables

* Provide selected ocmponent data to project page

* Finish project auto start, auto start question, redirect actions

Complete work on automatically starting a project defined in
by a System Setting.

Allow the auto start system setting to define the project template
(e.g. compliance app) to use and even the module to automatically
start.

Also add new question actions to redirect to project page
or project component after answering a question.

TO DO:
- Add error handling (e.g., missing/incorrect project)
- Add tests

* Add route for single system-component-control

* issue in bootstrap

* better styling for the drag-n-fill area

* missing carrot. reverting the removal of project import form done in 29ff7c291965862046fb32169706d6d4090724a6

* Fix skip buttons and question action crash

* Update CHANGELOG.md

* Update CHANGELOG.md

* Produce dictionary of producer_element control impl smts

* Templatetags for math

* Calculate dict of element ctl impl smts status

Co-authored-by: Greg Elin <Greg Elin>
Co-authored-by: Greg Elin <greg.elin@govready.com>
Co-authored-by: davidpofo <dampofo@umd.edu>

* Bump version to 0.9.8

* Remove commented-out, unneeded tests

Co-authored-by: davidpofo <dampofo@umd.edu>
Co-authored-by: Greg Elin <greg.elin@govready.com>
Co-authored-by: alexanderward <alexander.ward1@gmail.com>
Co-authored-by: Greg Elin <Greg Elin>
Co-authored-by: mike <mike.guelfi@gmail.com>
Co-authored-by: Mike Guelfi <52943685+mguelfi@users.noreply.github.com>
Co-authored-by: Ward <12001004185765@FEDIDCARD.GOV>
Co-authored-by: root <root@MSI.localdomain>
---
 CHANGELOG.md                                  | 25 ++++-
 VERSION                                       |  2 +-
 controls/admin.py                             |  6 +-
 controls/migrations/0057_catalogdata.py       | 33 +++++++
 .../0058_catalogdata_baselines_json.py        | 19 ++++
 controls/models.py                            | 95 ++++++++----------
 controls/oscal.py                             | 99 +++++++------------
 controls/templatetags/system_tags.py          | 12 +++
 controls/tests.py                             | 72 +-------------
 controls/urls.py                              |  2 +
 controls/views.py                             | 71 ++++++++++---
 guidedmodules/views.py                        | 26 ++++-
 siteapp/management/commands/first_run.py      | 34 ++++++-
 siteapp/settings.py                           |  2 +-
 siteapp/static/css/govready-q.css             | 19 +++-
 siteapp/templatetags/system_tags.py           | 26 +++++
 siteapp/tests.py                              | 27 +++++
 siteapp/views.py                              | 72 +++++++++++++-
 system_settings/admin.py                      |  4 +-
 .../migrations/0010_auto_20210713_1031.py     | 23 +++++
 system_settings/models.py                     | 10 +-
 templates/components/element_detail_tabs.html |  2 +-
 templates/drag-n-fill.html                    | 15 ++-
 templates/navbar.html                         |  2 +-
 templates/project-base.html                   |  4 +-
 templates/projects.html                       |  2 +-
 26 files changed, 475 insertions(+), 229 deletions(-)
 create mode 100644 controls/migrations/0057_catalogdata.py
 create mode 100644 controls/migrations/0058_catalogdata_baselines_json.py
 create mode 100644 siteapp/templatetags/system_tags.py
 create mode 100644 system_settings/migrations/0010_auto_20210713_1031.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 11b73ea78..34322b206 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,24 @@
 GovReady-Q Release Notes
 ========================
 
+v0.9.8 (August 09, 2021)
+------------------------
+
+**Developer changes**
+
+* Add SystemSettings `auto_start_project` to permit the automatic start of a particular project and automatic start of a question.
+* Add questions actions to redirect to project home page or project components.
+* Support auto start of project via global System Setting.
+* Create new route for displaying a single system component control.
+* New controls.models.System property producer_elements_control_impl_smts_dict to get dictionary of control implementation statements associated with a system element.
+* New controls.models.System property producer_elements_control_impl_smts_status_dict to get dictionary of status of control implementation statements associated with a system element.
+
+**Data changes**
+
+* Add JSONfield `value` to SystemSettings model to support specific detail values.
+* Retrieve Catalog data from database instead of file system with new controls.models.CatalogData model.
+
+
 v0.9.7 (August 06, 2021)
 ------------------------
 
@@ -12,7 +30,7 @@ v0.9.7 (August 06, 2021)
 **Developer changes**
 
 * Support datagrid specifying select type cell.
-* Added new function OSCAL_ssp_export in order to export a system's security plan in OSCAL, this replaces the usual JSON export. Added a several fields of data for OSCAL SSP. 
+* Added new function OSCAL_ssp_export in order to export a system's security plan in OSCAL, this replaces the usual JSON export. Added a several fields of data for OSCAL SSP.
 * If a component to be imported has a catalog key that is not found in the internal or external catalog list then it will be skipped and logged.
 * If no statements are created the resulting element/component is deleted.
 * Component and System Security Plan exports pass OSCAL 1.0.0 schema validation.
@@ -35,6 +53,7 @@ v0.9.6 (July 15, 2021)
 * Added a Select/Deselect button for component comparison choice.
 * Add accordion to assessment page to provide information on getting data from Wazuh.
 * Add form to Assessments page to collect Wazuh information.
+* Support auto start of project via global System Setting.
 
 **Bug fixes**
 
@@ -45,13 +64,15 @@ v0.9.6 (July 15, 2021)
 * Add custom Django command to batch import legacy control implementation statements from legacy SSPs Excel spreadsheet exports. Currently supports CSAM.
 * Added missing unit test for portfolio project endpoint.
 * Add `sec_srvc.SecurityService` class to represent a security service from which data could be collected.
+* Add SystemSettings `auto_start_project` to permit the automatic start of a particular project and automatic start of a question.
+* Add questions actions to redirect to project home page or project components.
 
 **Data changes**
 
 * Set all `StatementTypeEnum.<LABEL>.value` to `StatementTypeEnum.<LABEL>.name` in order for relevant label/term to show up in Django database admin interface.
 * Create baselines for CMMC catalog.
 * Fisma impact level is now represented as Security Sensitivity level following OSCAL's schema.
-
+* Add JSONfield `value` to SystemSettings model to support specific detail values.
 
 v0.9.5 (June 23, 2021)
 ----------------------
diff --git a/VERSION b/VERSION
index b2cf0d104..eeab19d3b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-v0.9.7
+v0.9.8
diff --git a/controls/admin.py b/controls/admin.py
index fa0d7584b..68d6c2db3 100644
--- a/controls/admin.py
+++ b/controls/admin.py
@@ -2,6 +2,7 @@
 from django.contrib import admin
 from django.http import HttpResponse
 from .models import ImportRecord, Statement, Element, ElementControl, ElementRole, System, CommonControlProvider, CommonControl, ElementCommonControl, Poam, Deployment, SystemAssessmentResult
+from .oscal import CatalogData
 from guardian.admin import GuardedModelAdmin
 from simple_history.admin import SimpleHistoryAdmin
 
@@ -89,6 +90,9 @@ class SystemAssessmentResultAdmin(admin.ModelAdmin):
     list_display = ('id', 'name', 'system', 'deployment', 'uuid')
     search_fields = ('id', 'name', 'system', 'deployment', 'uuid')
 
+class CatalogDataAdmin(admin.ModelAdmin):
+    list_display = ('catalog_key',)
+    search_fields = ('catalog_key',)
 
 admin.site.register(ImportRecord, ImportRecordAdmin)
 admin.site.register(Statement, StatementAdmin)
@@ -102,4 +106,4 @@ class SystemAssessmentResultAdmin(admin.ModelAdmin):
 admin.site.register(Poam, PoamAdmin)
 admin.site.register(Deployment, DeploymentAdmin)
 admin.site.register(SystemAssessmentResult, SystemAssessmentResultAdmin)
-
+admin.site.register(CatalogData, CatalogDataAdmin)
diff --git a/controls/migrations/0057_catalogdata.py b/controls/migrations/0057_catalogdata.py
new file mode 100644
index 000000000..198bedaed
--- /dev/null
+++ b/controls/migrations/0057_catalogdata.py
@@ -0,0 +1,33 @@
+# Generated by Django 3.2.4 on 2021-08-05 02:12
+
+from django.db import migrations, models
+import django.db.models.manager
+import jsonfield.fields
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('controls', '0056_element_oscal_version'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='CatalogData',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('catalog_key', models.CharField(help_text='Unique key for catalog', max_length=100, unique=True)),
+                ('catalog_json', jsonfield.fields.JSONField(blank=True, help_text='JSON object representing the OSCAL-formatted control catalog.', null=True)),
+                ('created', models.DateTimeField(auto_now_add=True, db_index=True)),
+                ('updated', models.DateTimeField(auto_now=True, db_index=True)),
+            ],
+            options={
+                'abstract': False,
+                'base_manager_name': 'prefetch_manager',
+            },
+            managers=[
+                ('objects', django.db.models.manager.Manager()),
+                ('prefetch_manager', django.db.models.manager.Manager()),
+            ],
+        ),
+    ]
diff --git a/controls/migrations/0058_catalogdata_baselines_json.py b/controls/migrations/0058_catalogdata_baselines_json.py
new file mode 100644
index 000000000..31145bb82
--- /dev/null
+++ b/controls/migrations/0058_catalogdata_baselines_json.py
@@ -0,0 +1,19 @@
+# Generated by Django 3.2.4 on 2021-08-05 15:19
+
+from django.db import migrations
+import jsonfield.fields
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('controls', '0057_catalogdata'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='catalogdata',
+            name='baselines_json',
+            field=jsonfield.fields.JSONField(blank=True, help_text='JSON object representing the baselines for the catalog.', null=True),
+        ),
+    ]
diff --git a/controls/models.py b/controls/models.py
index a4cd0d19c..425073a54 100644
--- a/controls/models.py
+++ b/controls/models.py
@@ -15,14 +15,13 @@
 from controls.enums.components import ComponentTypeEnum, ComponentStateEnum
 from siteapp.model_mixins.tags import TagModelMixin
 from controls.enums.statements import StatementTypeEnum
-from controls.oscal import Catalogs, Catalog, check_and_extend
+from controls.oscal import Catalogs, Catalog, CatalogData
 import uuid
 import tools.diff_match_patch.python3 as dmp_module
 from copy import deepcopy
 from django.db import transaction
 
 BASELINE_PATH = os.path.join(os.path.dirname(__file__),'data','baselines')
-EXTERNAL_BASELINE_PATH = os.path.join(f"{os.getcwd()}",'local', 'controls', 'data', 'baselines')
 ORGPARAM_PATH = os.path.join(os.path.dirname(__file__),'data','org_defined_parameters')
 
 class ImportRecord(models.Model):
@@ -582,7 +581,6 @@ def get_security_impact_level(self):
         except Statement.DoesNotExist:
             return {}
 
-
     @property
     def smts_common_controls_as_dict(self):
         common_controls = self.root_element.common_controls.all()
@@ -737,6 +735,35 @@ def get_producer_elements(self):
 
     producer_elements = cached_property(get_producer_elements)
 
+    def get_producer_elements_control_impl_smts_dict(self):
+        smts = self.root_element.statements_consumed.filter(statement_type=StatementTypeEnum.CONTROL_IMPLEMENTATION.name)
+        components_smts = {}
+        for smt in smts:
+            if smt.producer_element:
+                # components.add(smt.producer_element)
+                if smt.producer_element in components_smts:
+                    components_smts[smt.producer_element].append(smt)
+                else:
+                    components_smts[smt.producer_element] = [smt]
+        return components_smts
+
+    producer_elements_control_impl_smts_dict = cached_property(get_producer_elements_control_impl_smts_dict)
+
+    def get_producer_elements_control_impl_smts_status_dict(self):
+        components_smts = self.producer_elements_control_impl_smts_dict
+        components_smts_status = {}
+        for component in components_smts.keys():
+            cmpt_smts_status = {}
+            for smt in components_smts[component]:
+                if smt.status in cmpt_smts_status:
+                    cmpt_smts_status[smt.status] += 1
+                else:
+                    cmpt_smts_status[smt.status] = 1
+            components_smts_status[component] = cmpt_smts_status
+        return components_smts_status
+
+    producer_elements_control_impl_smts_status_dict = cached_property(get_producer_elements_control_impl_smts_status_dict)
+
     def set_component_control_status(self, element, status):
         """Batch update status of system control implementation statements for a specific element."""
 
@@ -783,9 +810,7 @@ class Baselines (object):
     def __init__(self):
 
         self.file_path = BASELINE_PATH
-        self.external_file_path = EXTERNAL_BASELINE_PATH
         self.baselines_keys = self._list_keys()
-        # self.index = self._build_index()
 
         # Usage
             # from controls.models import Baselines
@@ -796,44 +821,18 @@ def __init__(self):
             # # Returns ['ac-1', 'ac-2', 'ac-2.1', 'ac-2.2', ...]
             # bs.get_baseline_controls('NIST_SP-800-53_rev4', 'moderate')
 
-    def _list_files(self):
-        return self.extend_external_baselines([
-            'NIST_SP-800-53_rev4_baselines.json',
-            # 'NIST_SP-800-53_rev5_baselines.json',
-            'NIST_SP-800-171_rev1_baselines.json',
-            'CMMC_ver1_baselines.json'
-        ], "files")
-
-
     def _list_keys(self):
-        return self.extend_external_baselines([
-            'NIST_SP-800-53_rev4',
-            # 'NIST_SP-800-53_rev5',
-            'NIST_SP-800-171_rev1',
-            'CMMC_ver1'
-        ], "keys")
-
+        # TODO: only return keys for records that have baselines?
+        return list(CatalogData.objects.order_by('catalog_key').values_list('catalog_key', flat=True).distinct())
 
     def _load_json(self, baselines_key):
         """Read baseline file - JSON"""
-        # TODO Escape baselines_key
-        self.data_file = baselines_key + "_baselines.json"
-        data_file = os.path.join(self.file_path, self.data_file)
-        # Does file exist?
-        if not os.path.isfile(data_file):
-            # Check if there any external oscal baseline files
-            try:
-                data_file = os.path.join(self.external_file_path, self.data_file)
-            except:
-                print("ERROR: {} does not exist".format(data_file))
-                return False
-        # Load file as json
-        try:
-            with open(data_file, 'r') as json_file:
-                data = json.load(json_file)
-            return data
-        except:
-            print("ERROR: {} could not be read or could not be read as json".format(data_file))
+
+        catalog_record = CatalogData.objects.get(catalog_key=baselines_key)
+        baselines = catalog_record.baselines_json
+        if baselines:
+            return baselines
+        else:
             return False
 
     def get_baseline_controls(self, baselines_key, baseline_name):
@@ -849,22 +848,6 @@ def get_baseline_controls(self, baselines_key, baseline_name):
             print("Requested baseline name not found in baselines_key data file")
             return False
 
-    @property
-    def body(self):
-        return self.legacy_imp_smt
-
-
-    def extend_external_baselines(self, baseline_info, extendtype):
-        """
-        Add external baselines to list of baselines
-        """
-        os.makedirs(EXTERNAL_BASELINE_PATH, exist_ok=True)
-        external_baselines = [file for file in os.listdir(EXTERNAL_BASELINE_PATH) if
-                  file.endswith('.json')]
-
-        baseline_info = check_and_extend(baseline_info, external_baselines, extendtype, "_baselines")
-        return baseline_info
-
 class OrgParams(object):
     """
     Represent list of organizational defined parameters. Temporary
@@ -1016,3 +999,5 @@ def __repr__(self):
 #         # For debugging.
 #         return "<AssesmentResult %s id=%d>" % (self.statement, self.id)
 
+
+
diff --git a/controls/oscal.py b/controls/oscal.py
index 2bf44d213..a769286a8 100644
--- a/controls/oscal.py
+++ b/controls/oscal.py
@@ -6,56 +6,47 @@
 from pathlib import Path
 import sys
 
+import auto_prefetch
+from django.db import models
+from django.utils.functional import cached_property
+from jsonfield import JSONField
+
+
 CATALOG_PATH = os.path.join(os.path.dirname(__file__), 'data', 'catalogs')
-EXTERNAL_CATALOG_PATH = os.path.join(f"{os.getcwd()}",'local', 'controls', 'data', 'catalogs')
+BASELINE_PATH = os.path.join(os.path.dirname(__file__),'data','baselines')
+
+class CatalogData(auto_prefetch.Model):
+    catalog_key = models.CharField(max_length=100, help_text="Unique key for catalog", unique=True, blank=False, null=False)
+    catalog_json = JSONField(blank=True, null=True, help_text="JSON object representing the OSCAL-formatted control catalog.")
+    baselines_json = JSONField(blank=True, null=True, help_text="JSON object representing the baselines for the catalog.")
+    created = models.DateTimeField(auto_now_add=True, db_index=True)
+    updated = models.DateTimeField(auto_now=True, db_index=True)
+
+    def __str__(self):
+        return "'%s id=%d'" % (self.catalog_key, self.id)
+
+    def __repr__(self):
+        # For debugging.
+        return "'%s id=%d'" % (self.catalog_key, self.id)
 
 class Catalogs(object):
     """Represent list of catalogs"""
 
     # well known catalog identifiers
-
     NIST_SP_800_53_rev4 = 'NIST_SP-800-53_rev4'
     NIST_SP_800_53_rev5 = 'NIST_SP-800-53_rev5'
     NIST_SP_800_171_rev1 = 'NIST_SP-800-171_rev1'
     CMMC_ver1 = 'CMMC_ver1'
 
     def __init__(self):
-        self.catalog_path = CATALOG_PATH
-        # self.catalog = None
         self.catalog_keys = self._list_catalog_keys()
         self.index = self._build_index()
 
-    def extend_external_catalogs(self, catalog_info, extendtype):
-        """
-        Add external catalogs to list of catalogs
-        """
-        os.makedirs(EXTERNAL_CATALOG_PATH, exist_ok=True)
-        external_catalogs = [file for file in os.listdir(EXTERNAL_CATALOG_PATH) if
-                  file.endswith('.json')]
-        catalog_info = check_and_extend(catalog_info, external_catalogs, extendtype, "_catalog")
-
-        return catalog_info
-
-    def _list_catalog_files(self):
-        return self.extend_external_catalogs([
-            'NIST_SP-800-53_rev4_catalog.json',
-            'NIST_SP-800-53_rev5_catalog.json',
-            'NIST_SP-800-171_rev1_catalog.json',
-            'CMMC_ver1_catalog.json'
-        ], "files")
-
     def _list_catalog_keys(self):
-
-        return self.extend_external_catalogs([
-            Catalogs.NIST_SP_800_53_rev4,
-            Catalogs.NIST_SP_800_53_rev5,
-            Catalogs.NIST_SP_800_171_rev1,
-            Catalogs.CMMC_ver1
-        ], "keys")
+        return list(CatalogData.objects.order_by('catalog_key').values_list('catalog_key', flat=True).distinct())
 
     def _load_catalog_json(self, catalog_key):
         catalog = Catalog(catalog_key)
-        #print(catalog_key, catalog._load_catalog_json())
         return catalog._load_catalog_json()
 
     def _build_index(self):
@@ -76,26 +67,13 @@ def list_catalogs(self):
         """
         List catalog objects
         """
-        return [Catalog(key) for key in Catalogs()._list_catalog_keys()]
-
+        return [Catalog.GetInstance(catalog_key=key) for key in Catalogs()._list_catalog_keys()]
 
 def uhash(obj):
     """Return a positive hash code"""
     h = hash(obj)
     return h + sys.maxsize + 1
 
-def check_and_extend(values, external_values, extendtype, splitter):
-    """
-    Modularize value to extend
-    """
-    if extendtype == "keys":
-        keys = [key.split(f'{splitter}.json')[0] for key in external_values]
-        values.extend(keys)
-    elif extendtype == "files":
-        files = [file for file in external_values]
-        values.extend(files)
-    return values
-
 def de_oscalize_control(control_id):
     """
     Returns the regular control formatting from an oscalized version of the control number.
@@ -108,10 +86,10 @@ class Catalog(object):
 
     # Create a singleton instance of this class per catalog. GetInstance returns
     # that singleton instance. Instead of doing
-    # `cg = Catalog(catalog_key=Catalogs.NIST_SP_800_53_rev4)`,
-    # do `cg = Catalog.GetInstance(catalog_key=Catalogs.NIST_SP_800_53_rev4')`.
+    # `cg = Catalog(catalog_key='NIST_SP-800-53_rev4')`,
+    # do `cg = Catalog.GetInstance(catalog_key='NIST_SP-800-53_rev4')`.
     @classmethod
-    def GetInstance(cls, catalog_key=Catalogs.NIST_SP_800_53_rev4, parameter_values=dict()):
+    def GetInstance(cls, catalog_key='NIST_SP-800-53_rev4', parameter_values=dict()):
         # Create a new instance of Catalog() the first time for each
         # catalog key / parameter combo
         # this method is called. Keep it in memory indefinitely.
@@ -132,11 +110,10 @@ def _catalog_instance_key(catalog_key, parameter_values):
             catalog_instance_key += '_' + str(parameter_values_hash)
         return catalog_instance_key.replace('-', '_')
 
-    def __init__(self, catalog_key=Catalogs.NIST_SP_800_53_rev4, parameter_values=dict()):
+    def __init__(self, catalog_key='NIST_SP-800-53_rev4', parameter_values=dict()):
         self.catalog_key = catalog_key
         self.catalog_key_display = catalog_key.replace("_", " ")
         self.catalog_path = CATALOG_PATH
-        self.external_catalog_path = EXTERNAL_CATALOG_PATH
         self.catalog_file = catalog_key + "_catalog.json"
         try:
             self.oscal = self._load_catalog_json()
@@ -163,22 +140,12 @@ def __init__(self, catalog_key=Catalogs.NIST_SP_800_53_rev4, parameter_values=di
 
     def _load_catalog_json(self):
         """Read catalog file - JSON"""
-        catalog_file = os.path.join(self.catalog_path, self.catalog_file)
-        catalog_file_external = os.path.join(self.external_catalog_path, self.catalog_file)
-        # Get catalog file from internal or "external" catalog files
-        if os.path.isfile(catalog_file):
-            with open(catalog_file, 'r') as json_file:
-                data = json.load(json_file)
-                oscal = data['catalog']
-            return oscal
-        elif os.path.isfile(catalog_file_external):
-            with open(catalog_file_external, 'r') as json_file:
-                data = json.load(json_file)
-                oscal = data['catalog']
-            return oscal
-        else:
-            # Catalog file doesn't exist
-            return False
+
+        # Get catalog from database
+        # TODO: check for DB miss
+        catalog_record = CatalogData.objects.get(catalog_key=self.catalog_key)
+        oscal = catalog_record.catalog_json['catalog']
+        return oscal
 
     def find_dict_by_value(self, search_array, search_key, search_value):
         """Return the dictionary in an array of dictionaries with a key matching a value"""
diff --git a/controls/templatetags/system_tags.py b/controls/templatetags/system_tags.py
index cdb597da2..eefdf1dfb 100644
--- a/controls/templatetags/system_tags.py
+++ b/controls/templatetags/system_tags.py
@@ -24,3 +24,15 @@ def json(value):
 def get_item(dictionary, key):
     return dictionary.get(key, None)
 
+@register.filter
+def divide(value, arg):
+    if value is None:
+        value = 0
+    try:
+        return float(value) / float(arg)
+    except (ValueError, ZeroDivisionError):
+        return None
+
+@register.filter
+def multiply(value, arg):
+    return float(value) * float(arg)
\ No newline at end of file
diff --git a/controls/tests.py b/controls/tests.py
index 0aff5a12a..2f6b45d0a 100644
--- a/controls/tests.py
+++ b/controls/tests.py
@@ -29,7 +29,7 @@
 from system_settings.models import SystemSettings
 from controls.models import *
 from controls.enums.statements import StatementTypeEnum
-from controls.oscal import Catalogs, Catalog, EXTERNAL_CATALOG_PATH, de_oscalize_control
+from controls.oscal import Catalogs, Catalog, de_oscalize_control
 from siteapp.models import User, Project, Portfolio
 from system_settings.models import SystemSettings
 
@@ -41,7 +41,7 @@
 
 # Control Tests
 
-class Oscal80053Tests(TestCase):
+class Oscal80053Tests(SeleniumTest):
     # Test
     def test_catalog_load_control(self):
         cg = Catalog.GetInstance(Catalogs.NIST_SP_800_53_rev4)
@@ -140,72 +140,10 @@ def test_catalog_list(self):
         Check the catalog listing method has the 3 default catalogs
         """
 
-        os.makedirs(EXTERNAL_CATALOG_PATH, exist_ok=True)
+        # os.makedirs(EXTERNAL_CATALOG_PATH, exist_ok=True)
         catalog_list = Catalogs().list_catalogs()
         self.assertEqual(len(catalog_list), 4)
 
-    def test_extend_external_catalogs(self):
-        """
-        Extending catalog file and key list
-        """
-        os.makedirs(EXTERNAL_CATALOG_PATH, exist_ok=True)
-        with tempfile.TemporaryFile() as d:
-            temp_file_name = os.path.join(EXTERNAL_CATALOG_PATH, f'{d.name}_revtest_catalog.json')
-
-            # finding fixture data and dumping in the temp file
-            test_catalog = os.getcwd() + "/fixtures/test_catalog.json"
-            with open(test_catalog, 'r') as json_file:
-                catalog_data = json.load(json_file)
-            with open(temp_file_name, 'w') as cred:
-                json.dump(catalog_data, cred)
-
-            extended_files = Catalogs.extend_external_catalogs(self, [
-                'NIST_SP-800-53_rev4_catalog.json',
-                'NIST_SP-800-53_rev5_catalog.json',
-                'NIST_SP-800-171_rev1_catalog.json'
-            ], "files")
-
-            self.assertEqual(len(extended_files), 4)
-
-            extended_keys = Catalogs.extend_external_catalogs(self, [
-                Catalogs.NIST_SP_800_53_rev4,
-                Catalogs.NIST_SP_800_53_rev5,
-                Catalogs.NIST_SP_800_171_rev1
-            ], "keys")
-            self.assertEqual(len(extended_keys), 4)
-            # Delete temp file
-            os.remove(temp_file_name)
-
-    def test_extend_external_baseline(self):
-        """
-        Extending baseline file and key list
-        """
-        os.makedirs(EXTERNAL_BASELINE_PATH, exist_ok=True)
-        with tempfile.TemporaryFile() as d:
-            temp_file_name = os.path.join(EXTERNAL_BASELINE_PATH, f'{d.name}_revtest_baseline.json')
-
-            # finding fixture data and dumping in the temp file
-            test_baseline = os.getcwd() + "/fixtures/test_baselines.json"
-            with open(test_baseline, 'r') as json_file:
-                baseline_data = json.load(json_file)
-            with open(temp_file_name, 'w') as cred:
-                json.dump(baseline_data, cred)
-
-            extended_files = Baselines.extend_external_baselines(self, [
-            'NIST_SP-800-53_rev4_baselines.json',
-            'NIST_SP-800-171_rev1_baselines.json'
-        ], "files")
-
-            self.assertEqual(len(extended_files), 3)
-
-            extended_keys = Baselines.extend_external_baselines(self, [
-            'NIST_SP-800-53_rev4',
-            'NIST_SP-800-171_rev1'
-        ], "keys")
-
-            self.assertEqual(len(extended_keys), 3)
-        # Delete temp file
-        os.remove(temp_file_name)
 #####################################################################
 
 class ComponentUITests(OrganizationSiteFunctionalTests):
@@ -609,7 +547,7 @@ def test_component_type_state(self):
         self.assertTrue(e2.component_type == "hardware")
         self.assertTrue(e2.component_state == "disposition")
 
-class ElementControlUnitTests(TestCase):
+class ElementControlUnitTests(SeleniumTest):
 
     def test_assign_baseline(self):
 
@@ -791,7 +729,7 @@ def test_element_create(self):
         # poam.delete()
         # self.assertTrue(poam.uuid is None)
 
-class OrgParamTests(TestCase):
+class OrgParamTests(SeleniumTest):
     """Class for OrgParam Unit Tests"""
 
     def test_org_params(self):
diff --git a/controls/urls.py b/controls/urls.py
index dfec5c69e..0928b4c30 100644
--- a/controls/urls.py
+++ b/controls/urls.py
@@ -68,10 +68,12 @@
         views.system_element_download_oscal_json,
         name="system_element_download_oscal_json"),
     url(r'^(?P<system_id>.*)/component/(?P<element_id>.*)/_remove$', views.system_element_remove, name="system_element_remove"),
+    url(r'^(?P<system_id>.*)/component/(?P<element_id>.*)/(?P<catalog_key>.*)/(?P<control_id>.*)$', views.system_element_control, name="system_element_control"),
     url(r'^(?P<system_id>.*)/component/(?P<element_id>.*)$', views.system_element, name="system_element"),
     url(r'^(?P<system_id>.*)/controls/updated$', views.controls_updated, name="controls_updated"),
 
     # Component Library
+
     url(r'^components$', views.component_library, name="component_library"),
     url(r'^components/compare$', views.compare_components, name="compare_components"),
     url(r'^components/new$', views.new_element, name="new_element"),
diff --git a/controls/views.py b/controls/views.py
index d66adeb30..51f9948f3 100644
--- a/controls/views.py
+++ b/controls/views.py
@@ -765,7 +765,7 @@ def as_json(self):
                 "components": [
                    {
                         "uuid": comp_uuid,
-                       "type": self.element.component_type.lower() or "software",
+                       "type": self.element.component_type.lower() if self.element.component_type is not None else "software",
                        "title": self.element.full_name or self.element.name,
                         "description": self.element.description,
                          "responsible-roles": responsible_roles, # TODO: gathering party-uuids, just filling for now
@@ -1109,6 +1109,57 @@ def system_element(request, system_id, element_id):
         }
         return render(request, "systems/element_detail_tabs.html", context)
 
+@login_required
+def system_element_control(request, system_id, element_id, catalog_key, control_id):
+    """Display System's selected element detail view"""
+
+    # Retrieve identified System
+    system = System.objects.get(id=system_id)
+    # Retrieve related selected controls if user has permission on system
+    if request.user.has_perm('view_system', system):
+        # Retrieve primary system Project
+        # Temporarily assume only one project and get first project
+        project = system.projects.all()[0]
+
+        # Retrieve element
+        element = Element.objects.get(id=element_id)
+
+        # Retrieve impl_smts produced by element and consumed by system
+        # Get the impl_smts contributed by this component to system
+        impl_smts = element.statements_produced.filter(consumer_element=system.root_element)
+        # Get the cont
+        impl_smt_ctl = next((ctl for ctl in impl_smts if ctl.sid == control_id and ctl.sid_class == catalog_key), None)
+
+        # Retrieve control ids
+        # TODO: Only need to individual control
+        catalog_controls = Catalog.GetInstance(catalog_key=catalog_key).get_controls_all()
+        # Retrieve control
+        control = next((ctl for ctl in catalog_controls if ctl['id'] == oscalize_control_id(control_id)), None)
+
+        # Build OSCAL and OpenControl
+        oscal_string = OSCALComponentSerializer(element, impl_smts).as_json()
+        opencontrol_string = OpenControlComponentSerializer(element, impl_smts).as_yaml()
+        states = [choice_tup[1] for choice_tup in ComponentStateEnum.choices()]
+        types = [choice_tup[1] for choice_tup in ComponentTypeEnum.choices()]
+        # Return the system's element information
+        context = {
+            "states": states,
+            "types": types,
+            "system": system,
+            "project": project,
+            "element": element,
+            "impl_smts": impl_smts,
+            "impl_smt_ctl": impl_smt_ctl,
+            "catalog_controls": catalog_controls,
+            "catalog_key": catalog_key,
+            "control": control,
+            "oscal": oscal_string,
+            "enable_experimental_opencontrol": SystemSettings.enable_experimental_opencontrol,
+            "opencontrol": opencontrol_string,
+        }
+        return render(request, "systems/element_detail_control.html", context)
+
+
 def edit_component_state(request, system_id, element_id):
     """
     Edit system component state
@@ -1289,21 +1340,18 @@ def component_library_component(request, element_id):
 def api_controls_select(request):
     """Return list of controls in json for select2 options from all control catalogs"""
 
-    # Create array to hold accumulated controls
+    cl_id = request.GET.get('q', None).lower()
+    # Search control catalogs in a loop and add results to an array
     cxs = []
-    # Loop through control catalogs
     catalogs = Catalogs()
     for ck in catalogs._list_catalog_keys():
         cx = Catalog.GetInstance(catalog_key=ck)
-        # Get controls
-        ctl_list = cx.get_flattened_controls_all_as_dict()
-        # Build objects for rendering Select2 auto complete list from catalog
-        select_list = [{'id': ctl_list[ctl]['id'], 'title': ctl_list[ctl]['title'], 'class': ctl_list[ctl]['class'], 'catalog_key_display': cx.catalog_key_display, 'display_text': f"{ctl_list[ctl]['label']} - {ctl_list[ctl]['title']} - {cx.catalog_key_display}"} for ctl in ctl_list]
-        # Extend array of accumuated controls with catalog's control list
-        cxs.extend(select_list)
-    # Sort the accummulated list
+        ctr = cx.get_control_by_id(cl_id)
+        # TODO: Better representation of control ids for case-insensitive searching insteading of listing ids in both cases
+        # TODO: OSCALizing control id?
+        if ctr:
+            cxs.append({'id': ctr['id'], 'title': ctr['title'], 'class': ctr['class'], 'catalog_key_display': cx.catalog_key_display, 'display_text': f"{ctr['id']} - {ctr['title']} - {cx.catalog_key_display} - ({ctr['id'].upper()})"})
     cxs.sort(key = operator.itemgetter('id', 'catalog_key_display'))
-
     status = "success"
     message = "Sending list."
     return JsonResponse( {"status": status, "message": message, "data": {"controls": cxs} })
@@ -1880,7 +1928,6 @@ def get_editor_system(catalog_key, system_id):
     Retrieves oscalized control id and catalog key. Also system object from system id.
     """
 
-
     catalog_key = oscalize_catalog_key(catalog_key)
 
     # Retrieve identified System
diff --git a/guidedmodules/views.py b/guidedmodules/views.py
index 6c80134b0..60414f213 100644
--- a/guidedmodules/views.py
+++ b/guidedmodules/views.py
@@ -473,7 +473,7 @@ def redirect_to():
                 # The system actions are currently supported:
                 #   1. `system/assign_baseline/<value>` - Automatically sets the system baseline controls to the selected impact value
                 #   2. `system/update_system_and_project_name/<value>` - Automatically sets the system, project names
-                if a_obj == 'system':
+                if a_obj == 'system' and skipped_reason is None:
 
                     # Assign baseline set of controls to a root_element
                     if a_verb == "assign_baseline":
@@ -527,13 +527,12 @@ def redirect_to():
                         messages.add_message(request, messages.INFO,
                                                      f'I\'ve updated the system and project name.')
 
-
                 # Process element actions
                 # -----------------------------------
                 # Only two actions are currently supported:
                 #   1. `element/add_role/<role_value>` - Automatically add elements to the selected components of a system
                 #   2. `element/del_role/<role_value>` - Automatically delete elements from the selected components of a system
-                if a_obj == 'element':
+                if a_obj == 'element' and skipped_reason is None:
 
                     # Get all elements assigned role specified in the action
                     elements_with_role = Element.objects.filter(element_type="system_element").filter(roles__role=a_filter)
@@ -593,7 +592,7 @@ def redirect_to():
                                                  f'Oops. I tried adding "{producer_element.name}" to the system, but no control implementation statements were found.')
 
                     # Delete elements matching role from the selected components of a system
-                    if a_verb == "del_role":
+                    if a_verb == "del_role" and skipped_reason is None:
                         for producer_element in elements_with_role:
                             # Delete component from system
                             smts_assigned_count = len(Statement.objects.filter(producer_element_id = producer_element.id, consumer_element_id = system.root_element.id, statement_type=StatementTypeEnum.CONTROL_IMPLEMENTATION.name))
@@ -602,6 +601,25 @@ def redirect_to():
                                 messages.add_message(request, messages.INFO,
                                                      f'I\'ve deleted "{producer_element.name}" and its {smts_assigned_count} control implementation statements from the system.')
 
+                # Process project actions
+                # -----------------------------------
+                if a_obj == 'project' and skipped_reason is None:
+
+                    # Get all elements assigned role specified in the action
+                    # elements_with_role = Element.objects.filter(element_type="system_element").filter(roles__role=a_filter)
+
+                    # Add elements matching role to the selected components of a system
+                    if a_verb == "view_project":
+
+                        if a_filter == "project":
+                            # Redirect to the project's home page.
+                            response = JsonResponse({ "status": "ok", "redirect": project.get_absolute_url() })
+                            return response
+
+                        if a_filter == "components":
+                            # Redirect to the new project's components.
+                            response = JsonResponse({ "status": "ok", "redirect": f"/systems/{system_id}/components/selected" })
+                            return response
 
     # Form a JSON response to the AJAX request and indicate the
     # URL to redirect to, to load the next question.
diff --git a/siteapp/management/commands/first_run.py b/siteapp/management/commands/first_run.py
index 36828c606..e3601dcd6 100644
--- a/siteapp/management/commands/first_run.py
+++ b/siteapp/management/commands/first_run.py
@@ -1,5 +1,7 @@
 import sys
 import os.path
+import json
+
 
 from django.core.management import call_command
 from django.core.management.base import BaseCommand, CommandError
@@ -10,6 +12,7 @@
 from guidedmodules.models import AppSource, Module
 from siteapp.models import User, Organization, Portfolio
 from controls.models import Element
+from controls.oscal import CatalogData
 from django.contrib.auth.management.commands import createsuperuser
 
 import fs, fs.errors
@@ -38,8 +41,36 @@ def handle(self, *args, **options):
         if not Organization.objects.all().exists() and not Organization.objects.filter(name="main").exists():
             org = Organization.objects.create(name="main", slug="main")
 
+        # Load the default control catalogs and baselines
+        CATALOG_PATH = os.path.join(os.path.dirname(__file__),'..','..','..','controls','data','catalogs')
+        BASELINE_PATH = os.path.join(os.path.dirname(__file__),'..','..','..','controls','data','baselines')
+
+        # TODO: Check directory exists
+        catalog_files = [file for file in os.listdir(CATALOG_PATH) if file.endswith('.json')]
+        # Load catalog and baseline data into database records from source files if data records do not exist in database
+        for cf in catalog_files:
+            catalog_key = cf.replace("_catalog.json", "")
+            with open(os.path.join(CATALOG_PATH,cf), 'r') as json_file:
+                catalog_json = json.load(json_file)
+            baseline_filename = cf.replace("_catalog.json", "_baselines.json")
+            if os.path.isfile(os.path.join(BASELINE_PATH, baseline_filename)):
+                with open(os.path.join(BASELINE_PATH, baseline_filename), 'r') as json_file:
+                    baselines_json = json.load(json_file)
+            else:
+                baselines_json = {}
+
+            catalog, created = CatalogData.objects.get_or_create(
+                    catalog_key=catalog_key,
+                    catalog_json=catalog_json,
+                    baselines_json=baselines_json
+                )
+            if created:
+                print(f"{catalog_key} record created into database")
+            else:
+                print(f"{catalog_key} record found in database")
+
         # Install default AppSources and compliance apps if no AppSources installed
-        if AppSource.objects.all().exists():
+        if not AppSource.objects.filter(slug="govready-q-files-startpack").exists():
             # Create AppSources that we want.
             if os.path.exists("/mnt/q-files-host"):
                 # For our docker image.
@@ -146,7 +177,6 @@ def handle(self, *args, **options):
                         username
                     ))
 
-
         # Create the first user.
         if not User.objects.filter(is_superuser=True).exists():
             if not options['non_interactive']:
diff --git a/siteapp/settings.py b/siteapp/settings.py
index 122034db6..7288ab1bf 100644
--- a/siteapp/settings.py
+++ b/siteapp/settings.py
@@ -331,7 +331,7 @@ def make_secret_key():
 	}
 
 SILENCED_SYSTEM_CHECKS = []
-DATA_UPLOAD_MAX_MEMORY_SIZE = 2621440
+DATA_UPLOAD_MAX_MEMORY_SIZE = 10242880
 # Settings that have normal values based on the primary app
 # (the app this file resides in).
 
diff --git a/siteapp/static/css/govready-q.css b/siteapp/static/css/govready-q.css
index fcdeb470f..797a3a675 100644
--- a/siteapp/static/css/govready-q.css
+++ b/siteapp/static/css/govready-q.css
@@ -474,13 +474,15 @@ form #id_appsource_compapp { width: 100%; overflow: auto !important; }
 /*drag n fill */
 
 .file-droppable {
-  background: #d9d5ec;
-  border: dashed 2px #5b537d;
   border-radius: 5px;
   overflow: hidden;
   transition: all 1s;
   min-height: 70px;
   position: relative;
+  -moz-box-shadow: 0 0 5em #ccc;
+  -webkit-box-shadow: 0 0 5em #ccc;
+   box-shadow: 0 0 5em #ccc;
+   padding: 2em;
 }
 
 .file-droppable.filled {
@@ -532,4 +534,17 @@ form #id_appsource_compapp { width: 100%; overflow: auto !important; }
   width: 100%;
   height: 100%;
   top: 0;
+  padding-bottom: 5em;
 }
+.file-droppable button {
+  background: #136aa8 !important;
+  border-color: #136aa8 !important;
+}
+
+.glyphicon-save{
+    color:#5f6981 !important;
+}
+.upload-text {
+     font-size: .7em;
+    color: #777777;
+}
\ No newline at end of file
diff --git a/siteapp/templatetags/system_tags.py b/siteapp/templatetags/system_tags.py
new file mode 100644
index 000000000..cdb597da2
--- /dev/null
+++ b/siteapp/templatetags/system_tags.py
@@ -0,0 +1,26 @@
+from django import template
+from django.template.defaultfilters import stringfilter
+from django.utils.safestring import mark_safe
+
+register = template.Library()
+
+@register.filter(is_safe=True)
+def json(value):
+    # Encode value as JSON for inclusion within a <script></script> tag.
+    # Since we are not using |escapejs (which would only be valid within
+    # strings), we must instead ensure that the literal "</script>" doesn't
+    # occur within the JSON content since that would break out of the script
+    # tag. This could occur both in string values and in the keys of objects.
+    # Since < and > can only occur within strings (i.e. they're not valid
+    # characters otherwise), we can JSON-escape them after serialization.
+    import json
+    value = json.dumps(value, sort_keys=True)
+    value = value.replace("<", r'\u003c')
+    value = value.replace(">", r'\u003e') # not necessary but for good measure
+    value = value.replace("&", r'\u0026') # not necessary but for good measure
+    return mark_safe(value) # nosec
+
+@register.filter(is_safe=True)
+def get_item(dictionary, key):
+    return dictionary.get(key, None)
+
diff --git a/siteapp/tests.py b/siteapp/tests.py
index 56dec9086..79b93ea5b 100644
--- a/siteapp/tests.py
+++ b/siteapp/tests.py
@@ -17,6 +17,7 @@
 import tempfile
 import time
 import unittest
+import json
 
 from django.contrib.auth import authenticate
 from django.test.client import RequestFactory
@@ -35,6 +36,7 @@
 from siteapp.models import (Organization, Portfolio, Project,
                             ProjectMembership, User)
 from controls.models import Statement, Element, System
+from controls.oscal import CatalogData, Catalogs, Catalog
 from siteapp.settings import HEADLESS, DOS
 from siteapp.views import project_edit
 from tools.utils.linux_to_dos import convert_w
@@ -140,6 +142,31 @@ def tearDownClass(cls):
     def setUp(self):
         # clear the browser's cookies before each test
         self.browser.delete_all_cookies()
+        # Add catalogs to database
+        CATALOG_PATH = os.path.join(os.path.dirname(__file__),'..','controls','data','catalogs')
+        BASELINE_PATH = os.path.join(os.path.dirname(__file__),'..','controls','data','baselines')
+        catalog_files = [file for file in os.listdir(CATALOG_PATH) if file.endswith('.json')]
+        for cf in catalog_files:
+            catalog_key = cf.replace("_catalog.json", "")
+            with open(os.path.join(CATALOG_PATH,cf), 'r') as json_file:
+                catalog_json = json.load(json_file)
+            baseline_filename = cf.replace("_catalog.json", "_baselines.json")
+            if os.path.isfile(os.path.join(BASELINE_PATH, baseline_filename)):
+                with open(os.path.join(BASELINE_PATH, baseline_filename), 'r') as json_file:
+                    baselines_json = json.load(json_file)
+            else:
+                baselines_json = {}
+
+            catalog, created = CatalogData.objects.get_or_create(
+                    catalog_key=catalog_key,
+                    catalog_json=catalog_json,
+                    baselines_json=baselines_json
+                )
+            # if created:
+            #     print(f"{catalog_key} record created into database")
+            # else:
+            #     print(f"{catalog_key} record found in database")
+
 
     def navigateToPage(self, path):
         self.browser.get(self.url(path))
diff --git a/siteapp/views.py b/siteapp/views.py
index a5d0d352d..ce2c5db2a 100644
--- a/siteapp/views.py
+++ b/siteapp/views.py
@@ -532,6 +532,63 @@ def apps_catalog(request):
     # If user is superuser, enable creating new apps
     authoring_tool_enabled = request.user.has_perm('guidedmodules.change_module')
 
+    # Auto start a project if set in database
+    # Temporarily pretend values set in development
+    # TODO: Maybe refactor! This code is close duplicate to what is in `apps_catalog_item` POST section
+    if "start" in request.GET and request.GET["start"]=="true" and SystemSettings.objects.filter(setting="auto_start_project").exists():
+        setting_asp = SystemSettings.objects.get(setting="auto_start_project")
+        if setting_asp.active:
+            source_slug = setting_asp.details.get('source_slug', None)
+            app_name = setting_asp.details.get('app_name', None)
+            module = setting_asp.details.get('module', None)
+
+            # can user start the app?
+            # Is this a module the user has access to? The app store
+            # does some authz based on the organization.
+            from guidedmodules.models import AppSource
+            catalog, _ = filter_app_catalog(get_compliance_apps_catalog_for_user(request.user), request)
+            for app_catalog_info in catalog:
+                if app_catalog_info["key"] == source_slug + "/" + app_name:
+                    # We found it.
+                    break
+            else:
+                raise Http404()
+
+            # Start the most recent version of the app.
+            appver = app_catalog_info["versions"][0]
+            from guidedmodules.app_loading import ModuleDefinitionError
+            organization = Organization.objects.first() # temporary
+            folder = None
+            task = None
+            q = None
+            # Get portfolio project should be included in.
+            if request.GET.get("portfolio"):
+                portfolio = Portfolio.objects.get(id=request.GET.get("portfolio"))
+            else:
+                if not request.user.default_portfolio:
+                    request.user.create_default_portfolio_if_missing()
+                portfolio = request.user.default_portfolio
+            try:
+                project = start_app(appver, organization, request.user, folder, task, q, portfolio)
+            except ModuleDefinitionError as e:
+                error = str(e)
+
+            if module:
+                # Can the user create a task within this project?
+                if not project.can_start_task(request.user):
+                    return HttpResponseForbidden()
+
+                # Create the new subtask.
+                question_key = list(project.root_task.get_answers().answertuples)[0]
+                task = project.root_task.get_or_create_subtask(request.user, question_key)
+
+                # Redirect.
+                url = task.get_absolute_url()
+                return HttpResponseRedirect(url)
+
+            # Redirect to the new project.
+            return HttpResponseRedirect(project.get_absolute_url())
+
     return render(request, "app-store.html", {
         "apps": catalog_by_category,
         "filter_description": filter_description,
@@ -992,6 +1049,15 @@ def project(request, project):
     else:
         confidentiality, integrity, availability = None, None, None
 
+    # Retrieve components
+    model = Element
+    ordering = ['name']
+    elements = [element for element in project.system.producer_elements if element.element_type != "system"]
+
+    # Retrieve statements, smt statuses associated with system elements
+    producer_elements_control_impl_smts_dict = project.system.producer_elements_control_impl_smts_dict
+    producer_elements_control_impl_smts_status_dict = project.system.producer_elements_control_impl_smts_status_dict
+
     # Render.
     return render(request, "project.html", {
         "is_project_page": True,
@@ -1030,7 +1096,11 @@ def project(request, project):
         "class_status": Classification.objects.last(),
 
         "authoring_tool_enabled": authoring_tool_enabled,
-        "import_project_form": ImportProjectForm()
+        "import_project_form": ImportProjectForm(),
+
+        "elements": elements,
+        "producer_elements_control_impl_smts_dict": producer_elements_control_impl_smts_dict,
+        "producer_elements_control_impl_smts_status_dict": producer_elements_control_impl_smts_status_dict,
     })
 
 def project_edit(request, project_id):
diff --git a/system_settings/admin.py b/system_settings/admin.py
index 970c1a686..32b06f249 100644
--- a/system_settings/admin.py
+++ b/system_settings/admin.py
@@ -3,8 +3,8 @@
 from .models import SystemSettings, Classification, Sitename
 
 class SystemSettingsAdmin(admin.ModelAdmin):
-  list_display = ('setting', 'active')
-  fields = ('setting', 'active')
+  list_display = ('setting', 'active', 'details')
+  fields = ('setting', 'active', 'details')
 
 admin.site.register(SystemSettings, SystemSettingsAdmin)
 
diff --git a/system_settings/migrations/0010_auto_20210713_1031.py b/system_settings/migrations/0010_auto_20210713_1031.py
new file mode 100644
index 000000000..678f554d5
--- /dev/null
+++ b/system_settings/migrations/0010_auto_20210713_1031.py
@@ -0,0 +1,23 @@
+# Generated by Django 3.2.4 on 2021-07-13 10:31
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('system_settings', '0009_sitename'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='systemsettings',
+            name='details',
+            field=models.JSONField(blank=True, help_text='Value objects of System Setting in JSON', null=True),
+        ),
+        migrations.AlterField(
+            model_name='systemsettings',
+            name='setting',
+            field=models.CharField(help_text='Name of System Setting', max_length=200, unique=True),
+        ),
+    ]
diff --git a/system_settings/models.py b/system_settings/models.py
index 41fe21d16..f03f8f77f 100644
--- a/system_settings/models.py
+++ b/system_settings/models.py
@@ -1,4 +1,5 @@
 from django.db import models
+from jsonfield import JSONField
 
 # This is just a bare minimum for demo. Needs to be elaborated upon. Classified intentionally left out because it has complicated implications.
 
@@ -24,13 +25,12 @@ class Sitename(models.Model):
     def __str__(self):
         return f'{self.sitename}'
 
-
 class SystemSettings(models.Model):
   """Model for various system settings for install of GovReady"""
 
-  setting = models.CharField(max_length=200, unique=True)
+  setting = models.CharField(max_length=200, unique=True, help_text="Name of System Setting")
   active = models.BooleanField(default=False)
-
+  details = models.JSONField(blank=True, null=True, help_text="Value objects of System Setting in JSON")
 
   def __str__(self):
     return self.setting
@@ -50,3 +50,7 @@ def enable_experimental_oscal(cls):
   @classmethod
   def enable_experimental_evidence(cls):
     return cls.objects.get(setting="enable_experimental_evidence").active
+
+  @classmethod
+  def enable_auto_start_project(cls):
+    return cls.objects.get(setting="auto_start_project").active
diff --git a/templates/components/element_detail_tabs.html b/templates/components/element_detail_tabs.html
index b1ebfbf3e..1a8510eb0 100644
--- a/templates/components/element_detail_tabs.html
+++ b/templates/components/element_detail_tabs.html
@@ -342,7 +342,7 @@ <h3>Systems</h3>
                   ajax: {
                       url: '{% url 'api_controls_select' %}',
                       dataType: 'json',
-                      delay: 250,
+                      delay: 150,
                       data: function(params) {
                           return {
                               q: params.term // search term
diff --git a/templates/drag-n-fill.html b/templates/drag-n-fill.html
index 07ec0d43c..871ee0011 100644
--- a/templates/drag-n-fill.html
+++ b/templates/drag-n-fill.html
@@ -1,9 +1,14 @@
-<div class="file-droppable">
-  <div>Drag-n-drop a file here</div>
-  <span>&times;</span>
-  <input type="file" id="json_content" />
+<div id="dropContainer">
+    <div class="file-droppable" align="center">
+        <i class="glyphicon glyphicon-save fa-3x"></i>
+        <br>
+        <div class="upload-text">Select a file or drag here</div>
+        <br>
+        <button type="button" class="btn btn-info btn-lg">Select a file</button>
+        <span>&times;</span>
+        <input type="file" id="json_content"/>
+    </div>
 </div>
-
 {% block scripts %}
 <script>
 document.addEventListener("DOMContentLoaded", function() {
diff --git a/templates/navbar.html b/templates/navbar.html
index 6649271a7..40cfc7e1e 100644
--- a/templates/navbar.html
+++ b/templates/navbar.html
@@ -37,7 +37,7 @@
               <span class="glyphicon glyphicon-plus"></span>
             </a>
             <ul class="dropdown-menu">
-              <li><a id="" href="{% url 'store' %}">Start a new project&hellip;</a></li>
+              <li><a id="" href="{% url 'store' %}?start=true">Start a new project&hellip;</a></li>
               <li class="dropdown-item-text small text-muted nav-dropdown-item-text">Begin a project from the assessment library. You will be able to choose any available assessment.
               </li>
               <li><a href="/portfolios/new" id="">Create a portfolio&hellip;</a></li>
diff --git a/templates/project-base.html b/templates/project-base.html
index 6439e0b21..8fa57a4a0 100644
--- a/templates/project-base.html
+++ b/templates/project-base.html
@@ -82,7 +82,7 @@
             <button id="btn-project-home" class="btn btn-sm btn-default btn-action" onclick="window.location = '{{project.get_absolute_url}}';">
               <em class="glyphicon glyphicon-home"></em> Project Home</a>
             </button>
-            <button id="btn-controls" class="btn btn-sm btn-default btn-action" btn-default" btn-default" btn-default" onclick="window.location = '/systems/{{project.system.id}}/controls/selected';">
+            <button id="btn-controls" class="btn btn-sm btn-default btn-action" onclick="window.location = '/systems/{{project.system.id}}/controls/selected';">
               <em class="glyphicon glyphicon-list-alt"></em> Controls</a>
             </button>
             <button id="btn-components" class="btn btn-sm btn-default btn-action" onclick="window.location = '/systems/{{project.system.id}}/components/selected';">
@@ -268,7 +268,7 @@ <h1 id="project-title">
         {% endif %}
       {% endif %}
 
-      <div class="project-body-block"
+      <div class="project-body-block">
       {% block body_content %}
       {% endblock %}
       </div>
diff --git a/templates/projects.html b/templates/projects.html
index 175177770..fc5572ac6 100644
--- a/templates/projects.html
+++ b/templates/projects.html
@@ -105,7 +105,7 @@
 <div class="container">
 
 <div class="project-main">
-  <a id="new-project" href="{% url 'store' %}" class=" btn btn-success">Start a project</a>
+  <a id="new-project" href="{% url 'store' %}?start=true" class=" btn btn-success">Start a project</a>
 </div>
 
 <h2 class="">Projects</h2>