Changeset 159

Timestamp:

10/28/11 17:42:47 (13 years ago)

Author:

Kris Deugau

Message:

/trunk

Prevent out-of-domain records from being added by appending the domain

if it's not already there. Append DOMAIN for group default records.

Remove some stale ##fixme/todo comments
Remove a stray bare "return" causing record updates to not get logged

File:

• trunk/dns.cgi (modified) (5 diffs)

trunk/dns.cgi

@@ -433 +433 @@
         unless ($permissions{admin} || $permissions{record_create});
 
+    # prevent out-of-domain records from getting added by appending the domain, or DOMAIN for default records
+    my $pname = ($webvar{defrec} eq 'y' ? 'DOMAIN' : domainName($dbh,$webvar{parentid}));
+    $webvar{name} =~ s/\.*$/\.$pname/ if $webvar{name} !~ /$pname$/;
+
     my @recargs = ($dbh,$webvar{defrec},$webvar{parentid},$webvar{name},$webvar{type},$webvar{address},$webvar{ttl});
     if ($webvar{type} == $reverse_typemap{MX} or $webvar{type} == $reverse_typemap{SRV}) {
@@ -478 +482 @@
         unless ($permissions{admin} || $permissions{record_edit});
 
-# check perms to see if the record is "out of scope" for the user
     $page->param(todo           => "Update record");
     $page->param(recact         => "update");
@@ -498 +501 @@
         unless ($permissions{admin} || $permissions{record_edit});
 
+    # prevent out-of-domain records from getting added by appending the domain, or DOMAIN for default records
+    my $pname = ($webvar{defrec} eq 'y' ? 'DOMAIN' : domainName($dbh,$webvar{parentid}));
+    $webvar{name} =~ s/\.*$/\.$pname/ if $webvar{name} !~ /$pname$/;
+
+##fixme:  get current/previous record info so we can log "updated 'foo A 1.2.3.4' to 'foo A 2.3.4.5'"
+
     my ($code,$msg) = updateRec($dbh,$webvar{defrec},$webvar{id},
         $webvar{name},$webvar{type},$webvar{address},$webvar{ttl},
@@ -503 +512 @@
 
     if ($code eq 'OK') {
-##fixme:  need more magic to get proper group - if domain was fiddled
-# from search-subgroups listing, may not be "current" group
-
-# SELECT d.group_id FROM domains d INNER JOIN records r ON d.domain_id=r.domain_id WHERE r.record_id=?
-# $sth->execute($webvar{id});
-##log
       if ($webvar{defrec} eq 'y') {
         my $restr = "Updated default record '$webvar{name} $typemap{$webvar{type}} $webvar{address}', TTL $webvar{ttl}";
@@ -2006 +2009 @@
       $sql = "SELECT group_id FROM default_records WHERE record_id=?";
     } else {
-      return
       $sql = "SELECT d.group_id FROM domains d".
         " INNER JOIN records r ON d.domain_id=r.domain_id".