Changeset 244 for trunk/dns.cgi

Timestamp:

02/24/12 17:59:45 (13 years ago)

Author:

Kris Deugau

Message:

/trunk

Scope check cleanup for rdns, should be complete. Some checks
seem to have been wrong (eg default record delete) and may be
candidates for backporting to a stable release. See #26.

File:

• trunk/dns.cgi (modified) (5 diffs)

trunk/dns.cgi

@@ -429 +429 @@
 
   # security check - does the user have permission to view this entity?
-  if (!check_scope(id => $webvar{id}, type => ($webvar{defrec} eq 'y' ? 'group' : 'domain'))) {
+  if (!check_scope(id => $webvar{id}, type =>
+        ($webvar{defrec} eq 'y' ? 'group' : ($webvar{revrec} eq 'y' ? 'revzone' : 'domain')))) {
     $page->param(errmsg => "You are not permitted to view or change the requested ".
-        ($webvar{defrec} eq 'y' ? "group's default records" : "domain's records"));
+        ($webvar{defrec} eq 'y' ? "group's default records" :
+                ($webvar{revrec} eq 'y' ? "reverse zone's records" : "domain's records")));
     $page->param(perm_err => 1);        # this causes the template to skip the record listing output.
     goto DONERECLIST;   # and now we skip filling in the content which is not printed due to perm_err above
@@ -520 +522 @@
 
   # security check - does the user have permission to access this entity?
-  if (!check_scope(id => $webvar{id}, type => ($webvar{defrec} eq 'y' ? 'defrec' : 'record'))) {
+  if (!check_scope(id => $webvar{id}, type =>
+        ($webvar{defrec} eq 'y' ? ($webvar{revrec eq 'y' ? 'defrevrec' : 'defrec') : 'record'))) {
     $page->param(perm_err => "You are not permitted to edit the requested record");
     goto DONEREC;
   }
   # round 2, check the parent.
-  if (!check_scope(id => $webvar{parentid}, type => ($webvar{defrec} eq 'y' ? 'group' : 'domain'))) {
+  if (!check_scope(id => $webvar{parentid}, type =>
+        ($webvar{defrec} eq 'y' ? 'group' : ($webvar{revrec} eq 'y' ? 'revzone' : 'domain')))) {
     my $msg = ($webvar{defrec} eq 'y' ?
         "You are not permitted to add or edit default records in the requested group" :
-        "You are not permitted to add or edit records in the requested domain");
+        "You are not permitted to add or edit records in the requested domain/zone");
     $page->param(perm_err => $msg);
     goto DONEREC;
@@ -696 +700 @@
 
   changepage(page => "reclist", errmsg => "You are not permitted to delete records", id => $webvar{parentid},
-                revrec => $webvar{revrec})
+                defrec => $webvar{defrec}, revrec => $webvar{revrec})
         unless ($permissions{admin} || $permissions{record_delete});
 
-  if (!check_scope(id => $webvar{id}, type => ($webvar{defrec} eq 'y' ? 'group' : 'domain'))) {
+  if (!check_scope(id => $webvar{id}, type =>
+        ($webvar{defrec} eq 'y' ? ($webvar{revrec} eq 'y' ? 'defrevrec' : 'defrec') : 'record'))) {
+    # redirect to domlist because we don't have permission for the entity requested
     changepage(page => 'domlist', errmsg => "You do not have permission to delete records in the requested ".
         ($webvar{defrec} eq 'y' ? 'group' : 'domain'));
@@ -753 +759 @@
 
   # security check - does the user have permission to view this entity?
-  if (!check_scope(id => $webvar{id}, type => ($webvar{defrec} eq 'y' ? 'group' : 'domain'))) {
+  # id is domain/revzone/group id
+  if (!check_scope(id => $webvar{id}, type =>
+        ($webvar{defrec} eq 'y' ? 'group' : ($webvar{revrec} eq 'y' ? 'revzone' : 'domain'))) {
     changepage(page => 'domlist', errmsg => "You do not have permission to edit the ".
         ($webvar{defrec} eq 'y' ? 'default ' : '')."SOA record for the requested ".
@@ -773 +781 @@
   # security check - does the user have permission to view this entity?
   # pass 1, record ID
-  if (!check_scope(id => $webvar{recid}, type => ($webvar{defrec} eq 'y' ? 'defrec' : 'record'))) {
+  if (!check_scope(id => $webvar{recid}, type =>
+        ($webvar{defrec} eq 'y' ? ($webvar{revrec} eq 'y' ? 'defrevrec' : 'defrec') : 'record'))) {
     changepage(page => 'domlist', errmsg => "You do not have permission to edit the requested SOA record");
   }
   # pass 2, parent (group or domain) ID
-  if (!check_scope(id => $webvar{id}, type => ($webvar{defrec} eq 'y' ? 'group' : 'domain'))) {
+  if (!check_scope(id => $webvar{id}, type =>
+        ($webvar{defrec} eq 'y' ? 'group' : ($webvar{revrec} eq 'y' ? 'revzone' : 'domain')))) {
     changepage(page => 'domlist', errmsg => "You do not have permission to edit the ".
         ($webvar{defrec} eq 'y' ? 'default ' : '')."SOA record for the requested ".