Changeset 244

Timestamp:

02/24/12 17:59:45 (13 years ago)

Author:

Kris Deugau

Message:

/trunk

Scope check cleanup for rdns, should be complete. Some checks
seem to have been wrong (eg default record delete) and may be
candidates for backporting to a stable release. See #26.

Location:

trunk

Files:

• DNSDB.pm (modified) (5 diffs)
• dns.cgi (modified) (5 diffs)

trunk/DNSDB.pm

@@ -2118 +2118 @@
 
   # Reference hashes.
-  my %par_tbl = (
+my %par_tbl = (
                 group   => 'groups',
                 user    => 'users',
                 defrec  => 'default_records',
+                defrevrec       => 'default_rev_records',
                 domain  => 'domains',
+                revzone => 'revzones',
                 record  => 'records'
         );
-  my %id_col = (
+my %id_col = (
                 group   => 'group_id',
                 user    => 'user_id',
                 defrec  => 'record_id',
+                defrevrec       => 'record_id',
                 domain  => 'domain_id',
+                revzone => 'rdns_id',
                 record  => 'record_id'
         );
-  my %par_col = (
+my %par_col = (
                 group   => 'parent_group_id',
                 user    => 'group_id',
                 defrec  => 'group_id',
+                defrevrec       => 'group_id',
                 domain  => 'group_id',
+                revzone => 'group_id',
                 record  => 'domain_id'
         );
-  my %par_type = (
+my %par_type = (
                 group   => 'group',
                 user    => 'group',
                 defrec  => 'group',
+                defrevrec       => 'group',
                 domain  => 'group',
+                revzone => 'group',
                 record  => 'domain'
         );
@@ -2231 +2239 @@
 
   # Return false on invalid types
-  return 0 if !grep /^$type1$/, ('record','defrec','user','domain','group');
-  return 0 if !grep /^$type2$/, ('record','defrec','user','domain','group');
+  return 0 if !grep /^$type1$/, ('record','defrec','defrevrec','user','domain','revzone','group');
+  return 0 if !grep /^$type2$/, ('record','defrec','defrevrec','user','domain','revzone','group');
 
   # Return false on impossible relations
   return 0 if $type1 eq 'record';       # nothing may be a child of a record
   return 0 if $type1 eq 'defrec';       # nothing may be a child of a record
+  return 0 if $type1 eq 'defrevrec';    # nothing may be a child of a record
   return 0 if $type1 eq 'user';         # nothing may be child of a user
   return 0 if $type1 eq 'domain' && $type2 ne 'record'; # domain may not be a parent of anything other than a record
+  return 0 if $type1 eq 'revzone' && $type2 ne 'record';# reverse zone may not be a parent of anything other than a record
 
   # ennnhhhh....  if we're passed an id of 0, it will never be found.  usual
   # case would be the UI creating a new <thing>, and so we don't have an ID for
   # <thing> to look up yet.  in that case the UI should check the parent as well.
-  # argument for returning 1 is
   return 0 if $id1 == 0;        # nothing can have a parent id of 0
   return 1 if $id2 == 0;        # anything could have a child id of 0 (or "unknown")
@@ -2253 +2262 @@
   return 1 if $type1 eq 'group' && $type2 eq 'group' && $id1 == $id2;
 
-# almost the same loop as getParents() above
   my $id = $id2;
   my $type = $type2;
   my $foundparent = 0;
 
+  # Records are the only entity with two possible parents.  We need to split the parent checks on
+  # domain/rdns.
+  if ($type eq 'record') {
+    my ($dom,$rdns) = $dbh->selectrow_array("SELECT domain_id,rdns_id FROM records WHERE record_id=?",
+        undef, ($id));
+    # check immediate parent against request
+    return 1 if $type1 eq 'domain' && $id1 == $dom;
+    return 1 if $type1 eq 'revzone' && $id1 == $rdns;
+    # if request is group, check *both* parents.  Only check if the parent is nonzero though.
+    return 1 if $dom && isParent($dbh, $id1, $type1, $dom, 'domain');
+    return 1 if $rdns && isParent($dbh, $id1, $type1, $rdns, 'revzone');
+    # exit here since we've executed the loop below by proxy in the above recursive calls.
+    return 0;
+  }
+
+# almost the same loop as getParents() above
   my $limiter = 0;
   while (1) {
@@ -2265 +2289 @@
     if (!$result) {
       $limiter++;
-##fixme:  how often will this happen on a live site?
+##fixme:  how often will this happen on a live site?  fail at max limiter <n>?
       warn "no results looking for $sql with id $id (depth $limiter)\n";
       last;
@@ -2274 +2298 @@
     } else {
 ##fixme: do we care about trying to return a "no such record/domain/user/group" error?
+# should be impossible to create an inconsistent DB just with API calls.
       warn $dbh->errstr." $sql, $id" if $dbh->errstr;
     }

trunk/dns.cgi

@@ -429 +429 @@
 
   # security check - does the user have permission to view this entity?
-  if (!check_scope(id => $webvar{id}, type => ($webvar{defrec} eq 'y' ? 'group' : 'domain'))) {
+  if (!check_scope(id => $webvar{id}, type =>
+        ($webvar{defrec} eq 'y' ? 'group' : ($webvar{revrec} eq 'y' ? 'revzone' : 'domain')))) {
     $page->param(errmsg => "You are not permitted to view or change the requested ".
-        ($webvar{defrec} eq 'y' ? "group's default records" : "domain's records"));
+        ($webvar{defrec} eq 'y' ? "group's default records" :
+                ($webvar{revrec} eq 'y' ? "reverse zone's records" : "domain's records")));
     $page->param(perm_err => 1);        # this causes the template to skip the record listing output.
     goto DONERECLIST;   # and now we skip filling in the content which is not printed due to perm_err above
@@ -520 +522 @@
 
   # security check - does the user have permission to access this entity?
-  if (!check_scope(id => $webvar{id}, type => ($webvar{defrec} eq 'y' ? 'defrec' : 'record'))) {
+  if (!check_scope(id => $webvar{id}, type =>
+        ($webvar{defrec} eq 'y' ? ($webvar{revrec eq 'y' ? 'defrevrec' : 'defrec') : 'record'))) {
     $page->param(perm_err => "You are not permitted to edit the requested record");
     goto DONEREC;
   }
   # round 2, check the parent.
-  if (!check_scope(id => $webvar{parentid}, type => ($webvar{defrec} eq 'y' ? 'group' : 'domain'))) {
+  if (!check_scope(id => $webvar{parentid}, type =>
+        ($webvar{defrec} eq 'y' ? 'group' : ($webvar{revrec} eq 'y' ? 'revzone' : 'domain')))) {
     my $msg = ($webvar{defrec} eq 'y' ?
         "You are not permitted to add or edit default records in the requested group" :
-        "You are not permitted to add or edit records in the requested domain");
+        "You are not permitted to add or edit records in the requested domain/zone");
     $page->param(perm_err => $msg);
     goto DONEREC;
@@ -696 +700 @@
 
   changepage(page => "reclist", errmsg => "You are not permitted to delete records", id => $webvar{parentid},
-                revrec => $webvar{revrec})
+                defrec => $webvar{defrec}, revrec => $webvar{revrec})
         unless ($permissions{admin} || $permissions{record_delete});
 
-  if (!check_scope(id => $webvar{id}, type => ($webvar{defrec} eq 'y' ? 'group' : 'domain'))) {
+  if (!check_scope(id => $webvar{id}, type =>
+        ($webvar{defrec} eq 'y' ? ($webvar{revrec} eq 'y' ? 'defrevrec' : 'defrec') : 'record'))) {
+    # redirect to domlist because we don't have permission for the entity requested
     changepage(page => 'domlist', errmsg => "You do not have permission to delete records in the requested ".
         ($webvar{defrec} eq 'y' ? 'group' : 'domain'));
@@ -753 +759 @@
 
   # security check - does the user have permission to view this entity?
-  if (!check_scope(id => $webvar{id}, type => ($webvar{defrec} eq 'y' ? 'group' : 'domain'))) {
+  # id is domain/revzone/group id
+  if (!check_scope(id => $webvar{id}, type =>
+        ($webvar{defrec} eq 'y' ? 'group' : ($webvar{revrec} eq 'y' ? 'revzone' : 'domain'))) {
     changepage(page => 'domlist', errmsg => "You do not have permission to edit the ".
         ($webvar{defrec} eq 'y' ? 'default ' : '')."SOA record for the requested ".
@@ -773 +781 @@
   # security check - does the user have permission to view this entity?
   # pass 1, record ID
-  if (!check_scope(id => $webvar{recid}, type => ($webvar{defrec} eq 'y' ? 'defrec' : 'record'))) {
+  if (!check_scope(id => $webvar{recid}, type =>
+        ($webvar{defrec} eq 'y' ? ($webvar{revrec} eq 'y' ? 'defrevrec' : 'defrec') : 'record'))) {
     changepage(page => 'domlist', errmsg => "You do not have permission to edit the requested SOA record");
   }
   # pass 2, parent (group or domain) ID
-  if (!check_scope(id => $webvar{id}, type => ($webvar{defrec} eq 'y' ? 'group' : 'domain'))) {
+  if (!check_scope(id => $webvar{id}, type =>
+        ($webvar{defrec} eq 'y' ? 'group' : ($webvar{revrec} eq 'y' ? 'revzone' : 'domain')))) {
     changepage(page => 'domlist', errmsg => "You do not have permission to edit the ".
         ($webvar{defrec} eq 'y' ? 'default ' : '')."SOA record for the requested ".