Changeset 545 for branches/stable/dns.cgi

Timestamp:

12/10/13 17:47:44 (11 years ago)

Author:

Kris Deugau

Message:

/branches/stable

Merge reverse DNS and location work; 2 of mumble

• from r263 through r416

Numerous conflicts due to hand-copy or partial merges

Location:

branches/stable

Files:

• . (modified) (1 prop)
• dns.cgi (modified) (79 diffs)

branches/stable/dns.cgi

@@ -3 +3 @@
 ##
 # $Id$
-# Copyright 2008-2011 Kris Deugau <kdeugau@deepnet.cx>
+# Copyright 2008-2012 Kris Deugau <kdeugau@deepnet.cx>
 # 
 #    This program is free software: you can redistribute it and/or modify
@@ -96 +96 @@
   $session->param('reclistsortby','host');
   $session->param('reclistorder','ASC');
+  $session->param('loclistsortby','description');
+  $session->param('loclistorder','ASC');
+  $session->param('logsortby','stamp');
+  $session->param('logorder','DESC');
 }
 
@@ -122 +126 @@
 $webvar{startwith} =~ s/^(0-9|[a-z]).*/$1/ if $webvar{startwith};
 # not much call for chars not allowed in domain names
-$webvar{filter} =~ s/[^a-zA-Z0-9_.:@-]//g if $webvar{filter};
+$webvar{filter} =~ s/[^a-zA-Z0-9_.:\@-]//g if $webvar{filter};
 ## only set 'y' if box is checked, no other values legal
 ## however, see https://secure.deepnet.cx/trac/dnsadmin/ticket/31
@@ -227 +231 @@
   if ($webvar{action} eq 'login') {
     # Snag ACL/permissions here too
-    my $sth = $dbh->prepare("SELECT user_id,group_id,password,firstname,lastname,status FROM users WHERE username=?");
-    $sth->execute($webvar{username});
-
-    if (my ($uid,$gid,$pass,$fname,$lname,$status) = $sth->fetchrow_array) {
-      $webvar{password} = '' if !$webvar{password};
-      if (!$status) {
-        $webvar{loginfailed} = 1;
-      } elsif ($pass =~ m|^\$1\$([A-Za-z0-9/.]+)\$|) {
-        # native passwords (crypt-md5)
-        $webvar{loginfailed} = 1 if $pass ne unix_md5_crypt($webvar{password},$1);
-      } elsif ($pass =~ /^[0-9a-f]{32}$/) {
-        # VegaDNS import (hex-coded MD5)
-        $webvar{loginfailed} = 1 if $pass ne md5_hex($webvar{password});
-      } else {
-        # plaintext (convenient now and then)
-        $webvar{loginfailed} = 1 if $pass ne $webvar{password};
-      }
+
+    my $userdata = login($dbh, $webvar{username}, $webvar{password});
+
+    if ($userdata) {
 
       # set session bits
-      $session->param('logingroup',$gid);
-      $session->param('curgroup',$gid);
-      $session->param('uid',$uid);
+      $session->param('logingroup',$userdata->{group_id});
+      $session->param('curgroup',$userdata->{group_id});
+      $session->param('uid',$userdata->{user_id});
       $session->param('username',$webvar{username});
 
-      changepage(page => "domlist") if !defined($webvar{loginfailed});
+      changepage(page => "domlist");
 
     } else {
@@ -299 +290 @@
 } # handle global webvar{action}s
 
-initPermissions($dbh,$session->param('uid'));
+# finally check if the user was disabled.  we could just leave this for logout/session expiry,
+# but if they keep the session active they'll continue to have access long after being disabled.  :/
+# Treat it as a session expiry.
+if ($session->param('uid') && !userStatus($dbh, $session->param('uid')) ) {
+  $sid = '';
+  $session->delete;     # force expiry of the session Right Away
+  $session->flush;      # make sure it hits storage
+  changepage(page=> "login", sessexpired => 1);
+}
+
+# Misc Things To Do on most pages
+initPermissions($dbh, $session->param('uid'));
+initActionLog($dbh, $session->param('uid'));
 
 $page->param(sid => $sid) unless $webvar{page} eq 'login';      # no session ID on the login page
@@ -307 +310 @@
   $page->param(loginfailed => 1) if $webvar{loginfailed};
   $page->param(sessexpired => 1) if $webvar{sessexpired};
-#  $page->param(orgname => $config{orgname}) if $config{orgname} ne 'Example Corp';
   $page->param(version => $DNSDB::VERSION);
 
@@ -316 +318 @@
 # hmm.  seeing problems in some possibly-not-so-corner cases.
 # this currently only handles "domain on", "domain off"
-  if (defined($webvar{domstatus})) {
+  if (defined($webvar{zonestatus})) {
     # security check - does the user have permission to access this entity?
     my $flag = 0;
@@ -323 +325 @@
     }
     if ($flag && ($permissions{admin} || $permissions{domain_edit})) {
-      my $stat = domStatus($dbh,$webvar{id},$webvar{domstatus});
-##fixme  switch to more consise "Enabled <domain"/"Disabled <domain>" as with users?
-      logaction($webvar{id}, $session->param("username"),
-        parentID($dbh, (id => $webvar{id}, type => 'domain', revrec => $webvar{revrec})),
-        "Changed ".domainName($dbh, $webvar{id})." state to ".($stat ? 'active' : 'inactive'));
-      $page->param(resultmsg => "Changed ".domainName($dbh, $webvar{id})." state to ".
-        ($stat ? 'active' : 'inactive'));
+      my $stat = zoneStatus($dbh,$webvar{id},'n',$webvar{zonestatus});
+      $page->param(resultmsg => $DNSDB::resultstr);
     } else {
       $page->param(errmsg => "You are not permitted to view or change the requested domain");
     }
-    $uri_self =~ s/\&amp;domstatus=[^&]*//g;    # clean up URL for stuffing into templates
-  }
-
-  if ($session->param('resultmsg')) {
-    $page->param(resultmsg => $session->param('resultmsg'));
-    $session->clear('resultmsg');
-  }
-  if ($session->param('errmsg')) {
-    $page->param(errmsg => $session->param('errmsg'));
-    $session->clear('errmsg');
-  }
+    $uri_self =~ s/\&amp;zonestatus=[^&]*//g;   # clean up URL for stuffing into templates
+  }
+
+  show_msgs();
 
   $page->param(curpage => $webvar{page});
@@ -354 +344 @@
         unless ($permissions{admin} || $permissions{domain_create});
 
-  fill_grouplist("grouplist");
+  $webvar{group} = $curgroup if !$webvar{group};
+  fill_grouplist("grouplist", $webvar{group});
+  fill_loclist();
 
   if ($session->param('add_failed')) {
@@ -362 +354 @@
     $session->clear('errmsg');
     $page->param(domain => $webvar{domain});
+    $page->param(addinactive => $webvar{makeactive} eq 'n');
   }
 
@@ -379 +372 @@
   $webvar{makeactive} = 0 if !defined($webvar{makeactive});
 
-  my ($code,$msg) = addDomain($dbh,$webvar{domain},$webvar{group},($webvar{makeactive} eq 'on' ? 1 : 0),
-        (username => $session->param("username"), id => $session->param("uid")));
+  my ($code,$msg) = addDomain($dbh,$webvar{domain},$webvar{group},($webvar{makeactive} eq 'on' ? 1 : 0));
 
   if ($code eq 'OK') {
@@ -388 +380 @@
     changepage(page => "reclist", id => $msg);
   } else {
-    logaction(0, $session->param("username"), $webvar{group}, "Failed adding domain $webvar{domain} ($msg)")
-        if $config{log_failures};
     $session->param('add_failed', 1);
 ##fixme:  domain a security risk for XSS?
-##fixme:  keep active/inactive state, group selection
-    changepage(page => "newdomain", domain => $webvar{domain}, errmsg => $msg);
+    changepage(page => "newdomain", domain => $webvar{domain}, errmsg => $msg,
+        makeactive => ($webvar{makeactive} ? 'y' : 'n'), group => $webvar{group});
   }
 
@@ -416 +406 @@
   } elsif ($webvar{del} eq 'ok') {
     my $pargroup = parentID($dbh, (id => $webvar{id}, type => 'domain', revrec => $webvar{revrec}));
-    my $dom = domainName($dbh, $webvar{id});
-    my ($code,$msg) = delDomain($dbh, $webvar{id});
+    my ($code,$msg) = delZone($dbh, $webvar{id}, $webvar{revrec});
     if ($code eq 'OK') {
-      logaction($webvar{id}, $session->param("username"), $pargroup, "Deleted domain $dom");
-      changepage(page => "domlist", resultmsg => "Deleted domain $dom");
+      changepage(page => "domlist", resultmsg => $msg);
     } else {
-      logaction($webvar{id}, $session->param("username"), $pargroup, "Failed to delete domain $dom ($msg)")
-        if $config{log_failures};
-      changepage(page => "domlist", errmsg => "Error deleting domain $dom: $msg");
+      changepage(page => "domlist", errmsg => $msg);
     }
 
@@ -435 +421 @@
 
   $webvar{revrec} = 'y';
+
+  if (defined($webvar{zonestatus})) {
+    # security check - does the user have permission to access this entity?
+    my $flag = 0;
+    foreach (@viewablegroups) {
+      $flag = 1 if isParent($dbh, $_, 'group', $webvar{id}, 'revzone');
+    }
+    if ($flag && ($permissions{admin} || $permissions{domain_edit})) {
+      my $stat = zoneStatus($dbh,$webvar{id},'y',$webvar{zonestatus});
+      $page->param(resultmsg => $DNSDB::resultstr);
+    } else {
+      $page->param(errmsg => "You are not permitted to view or change the requested reverse zone");
+    }
+    $uri_self =~ s/\&amp;zonestatus=[^&]*//g;   # clean up URL for stuffing into templates
+  }
+
+  show_msgs();
+
   $page->param(curpage => $webvar{page});
   listzones();
@@ -446 +450 @@
   fill_grouplist("grouplist");
 
-  if ($webvar{add_failed}) {
-    $page->param(add_failed => 1);
-    $page->param(errmsg => $webvar{errmsg});
+  # prepopulate revpatt with the matching default record
+# getRecByName($dbh, (revrec => $webvar{revrec}, defrec => $webvar{defrec}, host => 'string'));
+
+  if ($session->param('add_failed')) {
+    $session->clear('add_failed');
+    $page->param(errmsg => $session->param('errmsg'));
+    $session->clear('errmsg');
     $page->param(revzone => $webvar{revzone});
     $page->param(revpatt => $webvar{revpatt});
@@ -465 +473 @@
 
   my ($code,$msg) = addRDNS($dbh, $webvar{revzone}, $webvar{revpatt}, $webvar{group},
-        ($webvar{makeactive} eq 'on' ? 1 : 0),
-        (username => $session->param("username"), id => $session->param("uid")) );
+        ($webvar{makeactive} eq 'on' ? 1 : 0));
 
   if ($code eq 'OK') {
-    logaction(0, $session->param("username"), $webvar{group}, "Added reverse zone $webvar{revzone}", $msg);
     changepage(page => "reclist", id => $msg, revrec => 'y');
+  } elsif ($code eq 'WARN') {
+    changepage(page => "reclist", id => $msg, revrec => 'y', warnmsg => $DNSDB::resultstr);
   } else {
-    logaction(0, $session->param("username"), $webvar{group}, "Failed adding reverse zone $webvar{revzone} ($msg)");
-    changepage(page => "newrevzone", add_failed => 1, revzone => $webvar{revzone}, revpatt => $webvar{revpatt},
-       errmsg => $msg);
-  }
-
-#} elsif ($webvar{page} eq 'delrevzone') {
+    $session->param('add_failed', 1);
+    changepage(page => "newrevzone", revzone => $webvar{revzone}, revpatt => $webvar{revpatt}, errmsg => $msg);
+  }
+
+} elsif ($webvar{page} eq 'delrevzone') {
+
+  changepage(page => "revzones", errmsg => "You are not permitted to delete reverse zones")
+        unless ($permissions{admin} || $permissions{domain_delete});
+
+  # security check - does the user have permission to access this entity?
+  if (!check_scope(id => $webvar{id}, type => 'revzone')) {
+    changepage(page => "revzones", errmsg => "You do not have permission to delete the requested reverse zone");
+  }
+
+  $page->param(id => $webvar{id});
+
+  # first pass = confirm y/n (sorta)
+  if (!defined($webvar{del})) {
+
+    $page->param(del_getconf => 1);
+    $page->param(revzone => revName($dbh,$webvar{id}));
+
+  } elsif ($webvar{del} eq 'ok') {
+    my $pargroup = parentID($dbh, (id => $webvar{id}, type => 'revzone', revrec => $webvar{revrec}));
+    my $zone = revName($dbh, $webvar{id});
+    my ($code,$msg) = delZone($dbh, $webvar{id}, 'y');
+    if ($code eq 'OK') {
+      changepage(page => "revzones", resultmsg => $msg);
+    } else {
+      changepage(page => "revzones", errmsg => $msg);
+    }
+
+  } else {
+    # cancelled.  whee!
+    changepage(page => "revzones");
+  }
 
 } elsif ($webvar{page} eq 'reclist') {
@@ -531 +569 @@
         distance => 'Distance', weight => 'Weight', port => 'Port', ttl => 'TTL');
     } else {
-      @cols = ('host', 'type', 'val', 'ttl');
-      %colheads = (host => 'IP Address', type => 'Type', val => 'Hostname', ttl => 'TTL');
+      @cols = ('val', 'type', 'host', 'ttl');
+      %colheads = (val => 'IP Address', type => 'Type', host => 'Hostname', ttl => 'TTL');
     }
     my %custom = (id => $webvar{id}, defrec => $webvar{defrec}, revrec => $webvar{revrec});
@@ -547 +585 @@
     showzone($webvar{defrec}, $webvar{revrec}, $webvar{id});
     if ($webvar{defrec} eq 'n') {
-#      showzone('n',$webvar{id});
-##fixme:  permission for viewing logs?
-##fixme:  determine which slice of the log we view (group, domain, revzone)
       if ($webvar{revrec} eq 'n') {
         $page->param(logdom => 1);
@@ -557 +592 @@
     }
 
-    if ($session->param('resultmsg')) {
-      $page->param(resultmsg => $session->param('resultmsg'));
-      $session->clear('resultmsg');
-    }
-    if ($session->param('warnmsg')) {
-      $page->param(warnmsg => $session->param('warnmsg'));
-      $session->clear('warnmsg');
-    }
-    if ($session->param('errmsg')) {
-      $page->param(errmsg => $session->param('errmsg'));
-      $session->clear('errmsg');
-    }
+    show_msgs();
 
   } # close "you can't edit default records" check
@@ -608 +632 @@
     fill_recdata();
 
+    if ($webvar{defrec} eq 'n') {
+      my $defloc = getZoneLocation($dbh, $webvar{revrec}, $webvar{parentid});
+      fill_loclist($curgroup, $defloc);
+    }
+
   } elsif ($webvar{recact} eq 'add') {
 
@@ -613 +642 @@
         unless ($permissions{admin} || $permissions{record_create});
 
+    # location check - if user does not have record_locchg, set $webvar{location} to default location for zone
+    my $parloc = getZoneLocation($dbh, $webvar{revrec}, $webvar{parentid});
+    $webvar{location} = $parloc unless ($permissions{admin} || $permissions{record_locchg});
+
     my @recargs = ($dbh,$webvar{defrec},$webvar{revrec},$webvar{parentid},
-        \$webvar{name},\$webvar{type},\$webvar{address},$webvar{ttl});
+        \$webvar{name},\$webvar{type},\$webvar{address},$webvar{ttl},$webvar{location});
     if ($webvar{type} == $reverse_typemap{MX} or $webvar{type} == $reverse_typemap{SRV}) {
       push @recargs, $webvar{distance};
@@ -626 +659 @@
 
     if ($code eq 'OK' || $code eq 'WARN') {
-      my $restr;
-      if ($webvar{defrec} eq 'y') {
-        $restr = "Added default record '$webvar{name} $typemap{$webvar{type}}";
-        $restr .= " [distance $webvar{distance}]" if $typemap{$webvar{type}} eq 'MX';
-        $restr .= " [priority $webvar{distance}] [weight $webvar{weight}] [port $webvar{port}]"
-                if $typemap{$webvar{type}} eq 'SRV';
-        $restr .= " $webvar{address}', TTL $webvar{ttl}";
-        logaction(0, $session->param("username"), $webvar{parentid}, $restr);
-      } else {
-        $restr = "Added record '$webvar{name} $typemap{$webvar{type}}";
-        $restr .= " [distance $webvar{distance}]" if $typemap{$webvar{type}} eq 'MX';
-        $restr .= " [priority $webvar{distance}] [weight $webvar{weight}] [port $webvar{port}]"
-                if $typemap{$webvar{type}} eq 'SRV';
-        $restr .= " $webvar{address}', TTL $webvar{ttl}";
-        logaction($webvar{parentid}, $session->param("username"),
-                parentID($dbh, (id => $webvar{parentid}, type => 'domain', revrec => $webvar{revrec})), $restr);
-      }
       my %pageparams = (page => "reclist", id => $webvar{parentid},
         defrec => $webvar{defrec}, revrec => $webvar{revrec});
-      $pageparams{warnmsg} = $msg."<br><br>\n".$restr if $code eq 'WARN';
-      $pageparams{resultmsg} = $restr if $code eq 'OK';
+      $pageparams{warnmsg} = $msg."<br><br>\n".$DNSDB::resultstr if $code eq 'WARN';
+      $pageparams{resultmsg} = $DNSDB::resultstr if $code eq 'OK';
       changepage(%pageparams);
     } else {
@@ -657 +673 @@
       $page->param(id           => $webvar{id});
       fill_recdata();   # populate the form... er, mostly.
-      if ($config{log_failures}) {
-        if ($webvar{defrec} eq 'y') {
-          logaction(0, $session->param("username"), $webvar{parentid},
-                "Failed adding default record '$webvar{name} $typemap{$webvar{type}} $webvar{address}', TTL $webvar{ttl} ($msg)");
-        } else {
-          logaction($webvar{parentid}, $session->param("username"),
-                parentID($dbh, (id => $webvar{parentid}, type => 'domain', revrec => $webvar{revrec})),
-                "Failed adding record '$webvar{name} $typemap{$webvar{type}} $webvar{address}', TTL $webvar{ttl} ($msg)");
-        }
+      if ($webvar{defrec} eq 'n') {
+        fill_loclist($curgroup, $webvar{location});
       }
     }
@@ -685 +694 @@
     $page->param(port           => $recdata->{port});
     $page->param(ttl            => $recdata->{ttl});
-    $page->param(typelist       => getTypelist($dbh, $webvar{revrec}, $webvar{type}));
+    $page->param(typelist       => getTypelist($dbh, $webvar{revrec}, $recdata->{type}));
+
+    if ($webvar{defrec} eq 'n') {
+      fill_loclist($curgroup, $recdata->{location});
+    }
 
   } elsif ($webvar{recact} eq 'update') {
@@ -692 +705 @@
         unless ($permissions{admin} || $permissions{record_edit});
 
-    # prevent out-of-domain records from getting added by appending the domain, or DOMAIN for default records
-    my $pname = ($webvar{defrec} eq 'y' ? 'DOMAIN' : domainName($dbh,$webvar{parentid}));
-    $webvar{name} =~ s/\s+$//;
-    $webvar{name} =~ s/\.*$/\.$pname/ if $webvar{name} !~ /$pname$/;
-
-    # get current/previous record info so we can log "updated 'foo A 1.2.3.4' to 'foo A 2.3.4.5'"
+    # retain old location if user doesn't have permission to fiddle locations
     my $oldrec = getRecLine($dbh, $webvar{defrec}, $webvar{revrec}, $webvar{id});
-
-    my ($code,$msg) = updateRec($dbh,$webvar{defrec},$webvar{id},
-        $webvar{name},$webvar{type},$webvar{address},$webvar{ttl},
+    $webvar{location} = $oldrec->{location} unless ($permissions{admin} || $permissions{record_locchg});
+
+    my ($code,$msg) = updateRec($dbh,$webvar{defrec},$webvar{revrec},$webvar{id},$webvar{parentid},
+        \$webvar{name},\$webvar{type},\$webvar{address},$webvar{ttl},$webvar{location},
         $webvar{distance},$webvar{weight},$webvar{port});
 
-    if ($code eq 'OK') {
-##fixme: retrieve old record info for full logging of change
-      if ($webvar{defrec} eq 'y') {
-        my $restr = "Updated default record from '$oldrec->{host} $typemap{$oldrec->{type}} $oldrec->{val}', TTL $oldrec->{ttl}\n".
-                "to '$webvar{name} $typemap{$webvar{type}} $webvar{address}', TTL $webvar{ttl}";
-        logaction(0, $session->param("username"), $webvar{parentid}, $restr);
-        changepage(page => "reclist", id => $webvar{parentid}, defrec => $webvar{defrec}, resultmsg => $restr);
-      } else {
-        my $restr = "Updated record from '$oldrec->{host} $typemap{$oldrec->{type}} $oldrec->{val}', TTL $oldrec->{ttl}\n".
-                "to '$webvar{name} $typemap{$webvar{type}} $webvar{address}', TTL $webvar{ttl}";
-        logaction($webvar{parentid}, $session->param("username"),
-                parentID($dbh, (id => $webvar{id}, type => 'record', defrec => $webvar{defrec},
-                        revrec => $webvar{revrec}, partype => 'group')),
-                $restr);
-        changepage(page => "reclist", id => $webvar{parentid}, defrec => $webvar{defrec}, resultmsg => $restr);
-      }
+    if ($code eq 'OK' || $code eq 'WARN') {
+      my %pageparams = (page => "reclist", id => $webvar{parentid},
+        defrec => $webvar{defrec}, revrec => $webvar{revrec});
+      $pageparams{warnmsg} = $msg."<br><br>\n".$DNSDB::resultstr if $code eq 'WARN';
+      $pageparams{resultmsg} = $DNSDB::resultstr if $code eq 'OK';
+      changepage(%pageparams);
     } else {
       $page->param(failed       => 1);
@@ -729 +728 @@
       $page->param(id           => $webvar{id});
       fill_recdata();
-      if ($config{log_failures}) {
-        if ($webvar{defrec} eq 'y') {
-          logaction(0, $session->param("username"), $webvar{parentid},
-                "Failed updating default record '$typemap{$webvar{type}} $webvar{name} $webvar{address}', TTL $webvar{ttl} ($msg)");
-        } else {
-          logaction($webvar{parentid}, $session->param("username"),
-                parentID($dbh, (id => $webvar{parentid}, type => 'domain', revrec => $webvar{revrec})),
-                "Failed updating record '$typemap{$webvar{type}} $webvar{name} $webvar{address}', TTL $webvar{ttl} ($msg)");
-        }
-      }
     }
   }
@@ -745 +734 @@
     $page->param(dohere => "default records in group ".groupName($dbh,$webvar{parentid}));
   } else {
-    $page->param(parentid => $webvar{parentid});
     $page->param(dohere => domainName($dbh,$webvar{parentid})) if $webvar{revrec} eq 'n';
     $page->param(dohere => revName($dbh,$webvar{parentid})) if $webvar{revrec} eq 'y';
@@ -781 +769 @@
     $page->param(recval => $rec->{val});
   } elsif ($webvar{del} eq 'ok') {
-# get rec data before we try to delete it
-    my $rec = getRecLine($dbh, $webvar{defrec}, $webvar{revrec}, $webvar{id});
     my ($code,$msg) = delRec($dbh, $webvar{defrec}, $webvar{revrec}, $webvar{id});
     if ($code eq 'OK') {
-      if ($webvar{defrec} eq 'y') {
-        my $recclass = ($webvar{revrec} eq 'n' ? 'default record' : 'default reverse record');
-##fixme:  log distance for MX;  log port/weight/distance for SRV
-        my $restr = "Deleted $recclass '$rec->{host} $typemap{$rec->{type}} $rec->{val}', TTL $rec->{ttl}";
-        logaction(0, $session->param("username"), $rec->{parid}, $restr);
-        changepage(page => "reclist", id => $webvar{parentid}, defrec => $webvar{defrec},
-                revrec => $webvar{revrec}, resultmsg => $restr);
-      } else {
-        my $recclass = ($webvar{revrec} eq 'n' ? 'record' : 'reverse record');
-        my $restr = "Deleted $recclass '$rec->{host} $typemap{$rec->{type}} $rec->{val}', TTL $rec->{ttl}";
-        logaction($rec->{parid}, $session->param("username"),
-                parentID($dbh, (id => $rec->{parid}, type => 'domain', revrec => $webvar{revrec})),
-                $restr);
-        changepage(page => "reclist", id => $webvar{parentid}, defrec => $webvar{defrec},
-                revrec => $webvar{revrec}, resultmsg => $restr);
-      }
+      changepage(page => "reclist", id => $webvar{parentid}, defrec => $webvar{defrec},
+                revrec => $webvar{revrec}, resultmsg => $msg);
     } else {
 ## need to find failure mode
-      if ($config{log_failures}) {
-        if ($webvar{defrec} eq 'y') {
-          logaction(0, $session->param("username"), $rec->{parid},
-                "Failed deleting default record '$rec->{host} $typemap{$rec->{type}} $rec->{val}',".
-                " TTL $rec->{ttl} ($msg)");
-        } else {
-          logaction($rec->{parid}, $session->param("username"),
-                parentID($dbh, (id => $rec->{parid}, type => 'domain', revrec => $webvar{revrec})),
-                "Failed deleting record '$rec->{host} $typemap{$rec->{type}} $rec->{val}', TTL $rec->{ttl} ($msg)");
-        }
-      }
       changepage(page => "reclist", id => $webvar{parentid}, defrec => $webvar{defrec},
-                revrec => $webvar{revrec}, errmsg => "Error deleting record: $msg");
+                revrec => $webvar{revrec}, errmsg => $msg);
     }
   } else {
@@ -840 +801 @@
   }
 
-  fillsoa($webvar{defrec},$webvar{id});
+  fillsoa($webvar{defrec},$webvar{revrec},$webvar{id});
 
 } elsif ($webvar{page} eq 'updatesoa') {
@@ -848 +809 @@
   if (!check_scope(id => $webvar{recid}, type =>
         ($webvar{defrec} eq 'y' ? ($webvar{revrec} eq 'y' ? 'defrevrec' : 'defrec') : 'record'))) {
+##fixme:  should we redirect to the requested record list page instead of the domain list?
     changepage(page => 'domlist', errmsg => "You do not have permission to edit the requested SOA record");
   }
@@ -853 +815 @@
   if (!check_scope(id => $webvar{id}, type =>
         ($webvar{defrec} eq 'y' ? 'group' : ($webvar{revrec} eq 'y' ? 'revzone' : 'domain')))) {
-    changepage(page => 'domlist', errmsg => "You do not have permission to edit the ".
+    changepage(page => ($webvar{revrec} eq 'y' ? 'revzones' : 'domlist'),
+        errmsg => "You do not have permission to edit the ".
         ($webvar{defrec} eq 'y' ? 'default ' : '')."SOA record for the requested ".
-        ($webvar{defrec} eq 'y' ? 'group' : 'domain'));
+        ($webvar{defrec} eq 'y' ? 'group' : ($webvar{revrec} eq 'y' ? 'reverse zone' : 'domain')) );
   }
 
@@ -861 +824 @@
         unless ($permissions{admin} || $permissions{domain_edit});
 
-  # get old SOA for log
-  my %soa = getSOA($dbh,$webvar{defrec},$webvar{id});
-
-  my $sth;
-##fixme:  push SQL into DNSDB.pm
-##fixme: data validation: make sure {recid} is really the SOA for {id}
-  # no domain ID, so we're editing the default SOA for a group (we don't care which one here)
-  # plus a bit of magic to update the appropriate table
-  my $sql = "UPDATE ".($webvar{defrec} eq 'y' ? "default_records" : "records").
-        " SET host=?, val=?, ttl=? WHERE record_id=?";
-  $sth = $dbh->prepare($sql);
-  $sth->execute("$webvar{contact}:$webvar{prins}", 
-        "$webvar{refresh}:$webvar{retry}:$webvar{expire}:$webvar{minttl}",
-        $webvar{ttl},
-        $webvar{recid});
-
-  if ($sth->err) {
+  my ($code, $msg) = updateSOA($dbh, $webvar{defrec}, $webvar{revrec},
+        (contact => $webvar{contact}, prins => $webvar{prins}, refresh => $webvar{refresh},
+        retry => $webvar{retry}, expire => $webvar{expire}, minttl => $webvar{minttl},
+        ttl => $webvar{ttl}, id => $webvar{id}) );
+  if ($code eq 'OK') {
+    changepage(page => "reclist", id => $webvar{id}, defrec => $webvar{defrec}, revrec => $webvar{revrec},
+        resultmsg => "SOA record updated");
+  } else {
     $page->param(update_failed => 1);
-    $page->param(msg => $DBI::errstr);
-    fillsoa($webvar{defrec},$webvar{id});
-##fixme: faillog
-  } else {
-
-    # do this in the order of "default to most common case"
-    my $loggroup;
-    my $logdomain = $webvar{id};
-    if ($webvar{defrec} eq 'y') {
-      $loggroup = $webvar{id};
-      $logdomain = 0;
-    } else {
-      $loggroup = parentID($dbh, (id => $logdomain, type => 'domain', revrec => $webvar{revrec}));
-    }
-
-    logaction($logdomain, $session->param("username"), $loggroup,
-        "Updated ".($webvar{defrec} eq 'y' ? 'default ' : '')."SOA for ".
-        ($webvar{defrec} eq 'y' ? groupName($dbh, $webvar{id}) : domainName($dbh, $webvar{id}) ).
-        ": (ns $soa{prins}, contact $soa{contact}, refresh $soa{refresh},".
-        " retry $soa{retry}, expire $soa{expire}, minTTL $soa{minttl}, TTL $soa{ttl}) to ".
-        "(ns $webvar{prins}, contact $webvar{contact}, refresh $webvar{refresh},".
-        " retry $webvar{retry}, expire $webvar{expire}, minTTL $webvar{minttl}, TTL $webvar{ttl})");
-    changepage(page => "reclist", id => $webvar{id}, defrec => $webvar{defrec},
-        resultmsg => "SOA record updated");
+    $page->param(msg => $msg);
+    fillsoa($webvar{defrec}, $webvar{revrec}, $webvar{id}, 'w');
   }
 
@@ -914 +846 @@
   $page->param(delgrp => $permissions{admin} || $permissions{group_delete});
 
-  if ($session->param('resultmsg')) {
-    $page->param(resultmsg => $session->param('resultmsg'));
-    $session->clear('resultmsg');
-  }
-  if ($session->param('warnmsg')) {
-    $page->param(warnmsg => $session->param('warnmsg'));
-    $session->clear('warnmsg');
-  }
-  if ($session->param('errmsg')) {
-    $page->param(errmsg => $session->param('errmsg'));
-    $session->clear('errmsg');
-  }
+  show_msgs();
   $page->param(curpage => $webvar{page});
 
@@ -951 +872 @@
       }
     }
-    # force inheritance of parent group's default records with inherit flag,
-    # otherwise we end up with the hardcoded defaults from DNSDB.pm.  See
-    # https://secure.deepnet.cx/trac/dnsadmin/ticket/8 for the UI enhancement
-    # that will make this variable.
-    my ($code,$msg) = addGroup($dbh, $webvar{newgroup}, $webvar{pargroup}, \%newperms, 1);
+    # "Chained" permissions.  Some permissions imply others;  make sure they get set.
+    foreach (keys %permchains) {
+      if ($newperms{$_} && !$newperms{$permchains{$_}}) {
+        $newperms{$permchains{$_}} = 1;
+      }
+    }
+    # not gonna provide the 4th param: template-or-clone flag, just yet
+    my ($code,$msg) = addGroup($dbh, $webvar{newgroup}, $webvar{pargroup}, \%newperms);
     if ($code eq 'OK') {
-      logaction(0, $session->param("username"), $webvar{pargroup}, "Added group $webvar{newgroup}");
       if ($alterperms) {
         changepage(page => "grpman", warnmsg => 
@@ -965 +888 @@
       }
     } # fallthrough else
-    logaction(0, $session->param("username"), $webvar{pargroup}, "Failed to add group $webvar{newgroup}: $msg")
-        if $config{log_failures};
     # no point in doing extra work
     fill_permissions($page, \%newperms);
@@ -1001 +922 @@
 
   } elsif ($webvar{del} eq 'ok') {
-    my $deleteme = groupName($dbh,$webvar{id}); # get this before we delete it...
-    my $delparent = parentID($dbh, (id => $webvar{id}, type => 'group'));
     my ($code,$msg) = delGroup($dbh, $webvar{id});
     if ($code eq 'OK') {
 ##fixme: need to clean up log when deleting a major container
-      logaction(0, $session->param("username"), $delparent, "Deleted group $deleteme");
-      changepage(page => "grpman", resultmsg => "Deleted group $deleteme");
+      changepage(page => "grpman", resultmsg => $msg);
     } else {
 # need to find failure mode
-      logaction(0, $session->param("username"), $delparent, "Failed to delete group $deleteme: $msg")
-        if $config{log_failures};
-      changepage(page => "grpman", errmsg => "Error deleting group $deleteme: $msg");
+      changepage(page => "grpman", errmsg => $msg);
     }
   } else {
@@ -1030 +946 @@
   }
 
-  if ($webvar{grpaction} eq 'updperms') {
+  if ($webvar{grpaction} && $webvar{grpaction} eq 'updperms') {
     # extra safety check;  make sure user can't construct a URL to bypass ACLs
     my %curperms;
@@ -1046 +962 @@
       }
     }
+    # "Chained" permissions.  Some permissions imply others;  make sure they get set.
+    foreach (keys %permchains) {
+      if ($chperms{$_} && !$chperms{$permchains{$_}}) {
+        $chperms{$permchains{$_}} = 1;
+      }
+    }
     my ($code,$msg) = changePermissions($dbh, 'group', $webvar{gid}, \%chperms);
     if ($code eq 'OK') {
-      logaction(0, $session->param("username"), $webvar{gid},
-        "Updated default permissions in group $webvar{gid} (".groupName($dbh, $webvar{gid}).")");
       if ($alterperms) {
         changepage(page => "grpman", warnmsg =>
@@ -1055 +975 @@
                 groupName($dbh, $webvar{gid})." updated with reduced access");
       } else {
-        changepage(page => "grpman", resultmsg =>
-                "Updated default permissions in group ".groupName($dbh, $webvar{gid}));
+        changepage(page => "grpman", resultmsg => $msg);
       }
     } # fallthrough else
-    logaction(0, $session->param("username"), $webvar{gid}, "Failed to update default permissions in group ".
-        groupName($dbh, $webvar{gid}).": $msg")
-        if $config{log_failures};
     # no point in doing extra work
     fill_permissions($page, \%chperms);
@@ -1074 +990 @@
 } elsif ($webvar{page} eq 'bulkdomain') {
   # Bulk operations on domains.  Note all but group move are available on the domain list.
+##fixme:  do we care about bulk operations on revzones?  Move-to-group, activate, deactivate,
+# and delete should all be much rarer for revzones than for domains.
 
   changepage(page => "domlist", errmsg => "You are not permitted to make bulk domain changes")
@@ -1080 +998 @@
   fill_grouplist("grouplist");
 
-##fixme
-##fixme  push the SQL and direct database fiddling off into a sub in DNSDB.pm
-##fixme
-
-  my $sth = $dbh->prepare("SELECT count(*) FROM domains WHERE group_id=?");
-  $sth->execute($curgroup);
-  my ($count) = ($sth->fetchrow_array);
+  my $count = getZoneCount($dbh, (revrec => 'n', curgroup => $curgroup) );
 
   $page->param(curpage => $webvar{page});
@@ -1093 +1005 @@
   $page->param(perpage => $perpage);
 
-  my @domlist;
-  my $sql = "SELECT domain_id,domain FROM domains".
-        " WHERE group_id=?".
-        " ORDER BY domain".
-        ($offset eq 'all' ? '' : " LIMIT $perpage OFFSET ".$offset*$perpage);
-  $sth = $dbh->prepare($sql);
-  $sth->execute($curgroup);
+  my $domlist = getZoneList($dbh, (revrec => 'n', curgroup => $curgroup) );
   my $rownum = 0;
-  while (my @data = $sth->fetchrow_array) {
-    my %row;
-    $row{domid} = $data[0];
-    $row{domain} = $data[1];
-    $rownum++;  # putting this in the expression below causes failures.  *eyeroll*
-    $row{newrow} = $rownum % 5 == 0;
-    push @domlist, \%row;
-  }
-  $page->param(domtable => \@domlist);
+  foreach my $dom (@{$domlist}) {
+    delete $dom->{status};
+    delete $dom->{group};
+    $dom->{newrow} = (++$rownum) % 5 == 0;
+  }
+
+  $page->param(domtable => $domlist);
   # ACLs
   $page->param(maymove => ($permissions{admin} || ($permissions{domain_edit} && $permissions{domain_create} && $permissions{domain_delete})));
@@ -1123 +1027 @@
   }
 
+  # per-action scope checks
   if ($webvar{bulkaction} eq 'move') {
     changepage(page => "domlist", errmsg => "You are not permitted to bulk-move domains")
@@ -1128 +1033 @@
     my $newgname = groupName($dbh,$webvar{destgroup});
     $page->param(action => "Move to group $newgname");
-    my @bulkresults;
-    # nngh.  due to alpha-sorting on the previous page, we can't use domid-numeric
-    # order here, and since we don't have the domain names until we go around this
-    # loop, we can't alpha-sort them here.  :(
-    foreach (keys %webvar) {
-      my %row;
-      next unless $_ =~ /^dom_\d+$/;
-      # second security check - does the user have permission to meddle with this domain?
-      if (!check_scope(id => $webvar{$_}, type => 'domain')) {
-        $row{domerr} = "You are not permitted to make changes to the requested domain";
-        $row{domain} = $webvar{$_};
-        push @bulkresults, \%row;
-        next;
-      }
-      $row{domain} = domainName($dbh,$webvar{$_});
-      my ($code, $msg) = changeGroup($dbh, 'domain', $webvar{$_}, $webvar{destgroup});
-      if ($code eq 'OK') {
-        logaction($webvar{$_}, $session->param("username"),
-                parentID($dbh, (id => $webvar{$_}, type => 'domain', revrec => $webvar{revrec})),
-                "Moved domain ".domainName($dbh, $webvar{$_})." to group $newgname");
-        $row{domok} = ($code eq 'OK');
-      } else {
-        logaction($webvar{$_}, $session->param("username"),
-                parentID($dbh, (id => $webvar{$_}, type => 'domain', revrec => $webvar{revrec})),
-                "Failed to move domain ".domainName($dbh, $webvar{$_})." to group $newgname: $msg")
-                if $config{log_failures};
-      }
-      $row{domerr} = $msg;
-      push @bulkresults, \%row;
-    }
-    $page->param(bulkresults => \@bulkresults);
-
   } elsif ($webvar{bulkaction} eq 'deactivate' || $webvar{bulkaction} eq 'activate') {
     changepage(page => "domlist", errmsg => "You are not permitted to bulk-$webvar{bulkaction} domains")
         unless ($permissions{admin} || $permissions{domain_edit});
     $page->param(action => "$webvar{bulkaction} domains");
-    my @bulkresults;
-    foreach (keys %webvar) {
-      my %row;
-      next unless $_ =~ /^dom_\d+$/;
-      # second security check - does the user have permission to meddle with this domain?
-      if (!check_scope(id => $webvar{$_}, type => 'domain')) {
-        $row{domerr} = "You are not permitted to make changes to the requested domain";
-        $row{domain} = $webvar{$_};
-        push @bulkresults, \%row;
-        next;
-      }
-      $row{domain} = domainName($dbh,$webvar{$_});
-##fixme:  error handling on status change
-      my $stat = domStatus($dbh,$webvar{$_},($webvar{bulkaction} eq 'activate' ? 'domon' : 'domoff'));
-      logaction($webvar{$_}, $session->param("username"),
-        parentID($dbh, (id => $webvar{$_}, type => 'domain', revrec => $webvar{revrec})),
-        "Changed domain ".domainName($dbh, $webvar{$_})." state to ".($stat ? 'active' : 'inactive'));
-      $row{domok} = 1;
-#      $row{domok} = ($code eq 'OK');
-#      $row{domerr} = $msg;
-      push @bulkresults, \%row;
-    }
-    $page->param(bulkresults => \@bulkresults);
-
   } elsif ($webvar{bulkaction} eq 'delete') {
     changepage(page => "domlist", errmsg => "You are not permitted to bulk-delete domains")
         unless ($permissions{admin} || $permissions{domain_delete});
     $page->param(action => "$webvar{bulkaction} domains");
-    my @bulkresults;
-    foreach (keys %webvar) {
-      my %row;
-      next unless $_ =~ /^dom_\d+$/;
-      # second security check - does the user have permission to meddle with this domain?
-      if (!check_scope(id => $webvar{$_}, type => 'domain')) {
-        $row{domerr} = "You are not permitted to make changes to the requested domain";
-        $row{domain} = $webvar{$_};
-        push @bulkresults, \%row;
-        next;
-      }
-      $row{domain} = domainName($dbh,$webvar{$_});
-      my $pargroup = parentID($dbh, (id => $webvar{$_}, type => 'domain', revrec => $webvar{revrec}));
-      my $dom = domainName($dbh, $webvar{$_});
-      my ($code, $msg) = delDomain($dbh, $webvar{$_});
-      if ($code eq 'OK') {
-        logaction($webvar{$_}, $session->param("username"), $pargroup, "Deleted domain $dom");
-        $row{domok} = ($code eq 'OK');
-      } else {
-        logaction($webvar{$_}, $session->param("username"), $pargroup, "Failed to delete domain $dom: $msg")
-                if $config{log_failures};
-      }
+  } else {
+    # unknown action, bypass actually doing anything.  it should not be possible in
+    # normal operations, and anyone who meddles with the URL gets what they deserve.
+    goto DONEBULK;
+  } # move/(de)activate/delete if()
+
+  my @bulkresults;
+  # nngh.  due to alpha-sorting on the previous page, we can't use domid-numeric
+  # order here, and since we don't have the domain names until we go around this
+  # loop, we can't alpha-sort them here.  :(
+  foreach (keys %webvar) {
+    my %row;
+    next unless $_ =~ /^dom_\d+$/;
+    # second security check - does the user have permission to meddle with this domain?
+    if (!check_scope(id => $webvar{$_}, type => 'domain')) {
+      $row{domerr} = "You are not permitted to make changes to the requested domain";
+      $row{domain} = $webvar{$_};
+      push @bulkresults, \%row;
+      next;
+    }
+    $row{domain} = domainName($dbh,$webvar{$_});
+
+    # Do the $webvar{bulkaction}
+    my ($code, $msg);
+    ($code, $msg) = changeGroup($dbh, 'domain', $webvar{$_}, $webvar{destgroup})
+        if $webvar{bulkaction} eq 'move';
+    if ($webvar{bulkaction} eq 'deactivate' || $webvar{bulkaction} eq 'activate') {
+      my $stat = zoneStatus($dbh,$webvar{$_},'n',($webvar{bulkaction} eq 'activate' ? 'domon' : 'domoff'));
+      $code = (defined($stat) ? 'OK' : 'FAIL');
+      $msg = (defined($stat) ? $DNSDB::resultstr : $DNSDB::errstr);
+    }
+    ($code, $msg) = delZone($dbh, $webvar{$_}, 'n')
+        if $webvar{bulkaction} eq 'delete';
+
+    # Set the result output from the action
+    if ($code eq 'OK') {
+      $row{domok} = $msg;
+    } elsif ($code eq 'WARN') {
+      $row{domwarn} = $msg;
+    } else {
       $row{domerr} = $msg;
-      push @bulkresults, \%row;
-    }
-    $page->param(bulkresults => \@bulkresults);
-
-  } # move/(de)activate/delete if()
-
-  # not going to handle the unknown $webvar{action} else;  it should not be possible in normal
-  # operations, and anyone who meddles with the URL gets what they deserve.
+    }
+    push @bulkresults, \%row;
+
+  } # foreach (keys %webvar)
+  $page->param(bulkresults => \@bulkresults);
 
   # Yes, this is a GOTO target.  PTHBTTT.
@@ -1235 +1099 @@
       $flag = 1 if isParent($dbh, $_, 'group', $webvar{id}, 'user');
     }
-    if ($flag && ($permissions{admin} || $permissions{user_edit})) {
+    if ($flag && ($permissions{admin} || $permissions{user_edit} ||
+        ($permissions{self_edit} && $webvar{id} == $session->param('uid')) )) {
       my $stat = userStatus($dbh,$webvar{id},$webvar{userstatus});
-      logaction(0, $session->param("username"), parentID($dbh, (id => $webvar{id}, type => 'user')),
-        ($stat ? 'Enabled' : 'Disabled')." ".userFullName($dbh, $webvar{id}, '%u'));
-      $page->param(resultmsg => ($stat ? 'Enabled' : 'Disabled')." ".userFullName($dbh, $webvar{id}, '%u'));
+      $page->param(resultmsg => $DNSDB::resultstr);
     } else {
       $page->param(errmsg => "You are not permitted to view or change the requested user");
@@ -1255 +1118 @@
   $page->param(deluser => $permissions{admin} || $permissions{user_delete});
 
-  if ($session->param('resultmsg')) {
-    $page->param(resultmsg => $session->param('resultmsg'));
-    $session->clear('resultmsg');
-  }
-  if ($session->param('warnmsg')) {
-    $page->param(warnmsg => $session->param('warnmsg'));
-    $session->clear('warnmsg');
-  }
-  if ($session->param('errmsg')) {
-    $page->param(errmsg => $session->param('errmsg'));
-    $session->clear('errmsg');
-  }
+  show_msgs();
   $page->param(curpage => $webvar{page});
 
@@ -1293 +1145 @@
     $page->param(add => 1) if $webvar{useraction} eq 'add';
 
-    my ($code,$msg);
+    # can't re-use $code and $msg for update if we want to be able to identify separate failure states
+    my ($code,$code2,$msg,$msg2) = ('OK','OK','OK','OK');
 
     my $alterperms = 0; # flag iff we need to force custom permissions due to user's current access limits
@@ -1340 +1193 @@
         $permstring = 'i';
       }
+      # "Chained" permissions.  Some permissions imply others;  make sure they get set.
+      foreach (keys %permchains) {
+        if ($newperms{$_} && !$newperms{$permchains{$_}}) {
+          $newperms{$permchains{$_}} = 1;
+          $permstring .= ",$permchains{$_}";
+        }
+      }
       if ($webvar{useraction} eq 'add') {
         changepage(page => "useradmin", errmsg => "You do not have permission to add new users")
@@ -1347 +1207 @@
                 ($webvar{makeactive} eq 'on' ? 1 : 0), $webvar{accttype}, $permstring,
                 $webvar{fname}, $webvar{lname}, $webvar{phone});
-        logaction(0, $session->param("username"), $curgroup, "Added user $webvar{uname} (uid $msg)")
-                if $code eq 'OK';
       } else {
         changepage(page => "useradmin", errmsg => "You do not have permission to edit users")
-                unless $permissions{admin} || $permissions{user_edit};
+                unless $permissions{admin} || $permissions{user_edit} || 
+                        ($permissions{self_edit} && $session->param('uid') == $webvar{uid});
         # security check - does the user have permission to access this entity?
         if (!check_scope(id => $webvar{user}, type => 'user')) {
           changepage(page => "useradmin", errmsg => "You do not have permission to edit the requested user");
         }
-# User update is icky.  I'd really like to do this in one atomic
-# operation, but that would duplicate a **lot** of code in DNSDB.pm
+# User update is icky.  I'd really like to do this in one atomic operation,
+# but that gets hairy by either duplicating a **lot** of code in DNSDB.pm
+# or self-torture trying to not commit the transaction until we're really done.
         # Allowing for changing group, but not coding web support just yet.
         ($code,$msg) = updateUser($dbh, $webvar{uid}, $webvar{uname}, $webvar{gid}, $webvar{pass1},
@@ -1364 +1224 @@
         if ($code eq 'OK') {
           $newperms{admin} = 1 if $webvar{accttype} eq 'S';
-          ($code,$msg) = changePermissions($dbh, 'user', $webvar{uid}, \%newperms, ($permstring eq 'i'));
-          logaction(0, $session->param("username"), $curgroup,
-                "Updated uid $webvar{uid}, user $webvar{uname} ($webvar{fname} $webvar{lname})");
+          ($code2,$msg2) = changePermissions($dbh, 'user', $webvar{uid}, \%newperms, ($permstring eq 'i'));
         }
       }
     }
 
-    if ($code eq 'OK') {
-
+    if ($code eq 'OK' && $code2 eq 'OK') {
+      my %pageparams = (page => "useradmin");
       if ($alterperms) {
-        changepage(page => "useradmin", warnmsg =>
-                "You can only grant permissions you hold.  $webvar{uname} ".
-                ($webvar{useraction} eq 'add' ? 'added' : 'updated')." with reduced access.");
+        $pageparams{warnmsg} = "You can only grant permissions you hold.\nUser ".
+                ($webvar{useraction} eq 'add' ? "$webvar{uname} added" : "info updated for $webvar{uname}").
+                ".\nPermissions ".($webvar{useraction} eq 'add' ? 'added' : 'updated')." with reduced access.";
       } else {
-        changepage(page => "useradmin", resultmsg => "Successfully ".
-                ($webvar{useraction} eq 'add' ? 'added' : 'updated')." user $webvar{uname}");
+        $pageparams{resultmsg} = "$msg".($webvar{useraction} eq 'add' ? '' : "\n$msg2");
       }
+      changepage(%pageparams);
 
     # add/update failed:
@@ -1399 +1257 @@
       $page->param(pass1 => $webvar{pass1});
       $page->param(pass2 => $webvar{pass2});
-      $page->param(errmsg => $msg);
+      $page->param(errmsg => "User info updated but permissions update failed: $msg2") if $code eq 'OK';
+      $page->param(errmsg => $msg) if $code ne 'OK';
       fill_permissions($page, \%newperms);
       fill_actypelist($webvar{accttype});
       fill_clonemelist();
-      logaction(0, $session->param("username"), $curgroup, "Failed to $webvar{useraction} user ".
-        "$webvar{uname}: $msg")
-        if $config{log_failures};
     }
 
@@ -1411 +1267 @@
 
     changepage(page => "useradmin", errmsg => "You do not have permission to edit users")
-        unless $permissions{admin} || $permissions{user_edit};
+        unless $permissions{admin} || $permissions{user_edit} ||
+                ($permissions{self_edit} && $session->param('uid') == $webvar{user});
 
     # security check - does the user have permission to access this entity?
@@ -1426 +1283 @@
     fill_actypelist($userinfo->{type});
     # not using this yet, but adding it now means we can *much* more easily do so later.
-    $page->param(gid => $webvar{group_id});
+    $page->param(gid => $userinfo->{group_id});
 
     my %curperms;
@@ -1467 +1324 @@
     $page->param(user => userFullName($dbh,$webvar{id}));
   } elsif ($webvar{del} eq 'ok') {
-##fixme: find group id user is in (for logging) *before* we delete the user
-##fixme: get other user data too for log
-    my $userref = getUserData($dbh, $webvar{id});
     my ($code,$msg) = delUser($dbh, $webvar{id});
     if ($code eq 'OK') {
       # success.  go back to the user list, do not pass "GO"
-      # actions on users have a domain id of 0, always
-      logaction(0, $session->param("username"), $curgroup, "Deleted user $webvar{id}/".$userref->{username}.
-        " (".$userref->{lastname}.", ".$userref->{firstname}.")");
-      changepage(page => "useradmin", resultmsg => "Deleted user ".$userref->{username}.
-        " (".$userref->{lastname}.", ".$userref->{firstname}.")");
+      changepage(page => "useradmin", resultmsg => $msg);
     } else {
-# need to find failure mode
-      $page->param(del_failed => 1);
-      $page->param(errmsg => $msg);
-      list_users($curgroup);
-      logaction(0, $session->param("username"), $curgroup, "Failed to delete user ".
-        "$webvar{id}/".$userref->{username}.": $msg")
-        if $config{log_failures};
+      changepage(page => "useradmin", errmsg => $msg);
     }
   } else {
     # cancelled.  whee!
     changepage(page => "useradmin");
+  }
+
+} elsif ($webvar{page} eq 'loclist') {
+
+  changepage(page => "domlist", errmsg => "You are not allowed access to this function")
+        unless $permissions{admin} || $permissions{location_view};
+
+  # security check - does the user have permission to access this entity?
+#  if (!check_scope(id => $webvar{id}, type => 'loc')) {
+#    changepage(page => "loclist", errmsg => "You are not permitted to <foo> the requested location/view");
+#  }
+  list_locations();
+  show_msgs();
+
+# Permissions!
+  $page->param(addloc => $permissions{admin} || $permissions{location_create});
+  $page->param(delloc => $permissions{admin} || $permissions{location_delete});
+
+} elsif ($webvar{page} eq 'location') {
+
+  changepage(page => "domlist", errmsg => "You are not allowed access to this function")
+        unless $permissions{admin} || $permissions{location_view};
+
+  # security check - does the user have permission to access this entity?
+#  if (!check_scope(id => $webvar{id}, type => 'loc')) {
+#    changepage(page => "loclist", errmsg => "You are not permitted to <foo> the requested location/view");
+#  }
+
+  if ($webvar{locact} eq 'new') {
+    # uuhhmm....
+  } elsif ($webvar{locact} eq 'add') {
+    changepage(page => "loclist", errmsg => "You are not permitted to add locations/views", id => $webvar{parentid})
+        unless ($permissions{admin} || $permissions{location_create});
+
+    my ($code,$msg) = addLoc($dbh, $curgroup, $webvar{locname}, $webvar{comments}, $webvar{iplist});
+
+    if ($code eq 'OK' || $code eq 'WARN') {
+      my %pageparams = (page => "loclist", id => $webvar{parentid},
+        defrec => $webvar{defrec}, revrec => $webvar{revrec});
+      $pageparams{warnmsg} = $msg."<br><br>\n".$DNSDB::resultstr if $code eq 'WARN';
+      $pageparams{resultmsg} = $DNSDB::resultstr if $code eq 'OK';
+      changepage(%pageparams);
+    } else {
+      $page->param(failed       => 1);
+      $page->param(errmsg       => $msg);
+      $page->param(wastrying    => "adding");
+      $page->param(todo         => "Add location/view");
+      $page->param(locact       => "add");
+      $page->param(id           => $webvar{id});
+      $page->param(locname      => $webvar{locname});
+      $page->param(comments     => $webvar{comments});
+      $page->param(iplist       => $webvar{iplist});
+    }
+
+  } elsif ($webvar{locact} eq 'edit') {
+    changepage(page => "loclist", errmsg => "You are not permitted to edit locations/views", id => $webvar{parentid})
+        unless ($permissions{admin} || $permissions{location_edit});
+
+    my $loc = getLoc($dbh, $webvar{loc});
+    $page->param(wastrying      => "editing");
+    $page->param(todo           => "Edit location/view");
+    $page->param(locact         => "update");
+    $page->param(id             => $webvar{loc});
+    $page->param(locname        => $loc->{description});
+    $page->param(comments       => $loc->{comments});
+    $page->param(iplist         => $loc->{iplist});
+
+  } elsif ($webvar{locact} eq 'update') {
+    changepage(page => "loclist", errmsg => "You are not permitted to edit locations/views", id => $webvar{parentid})
+        unless ($permissions{admin} || $permissions{location_edit});
+
+    my ($code,$msg) = updateLoc($dbh, $webvar{id}, $curgroup, $webvar{locname}, $webvar{comments}, $webvar{iplist});
+
+    if ($code eq 'OK') {
+      changepage(page => "loclist", resultmsg => $msg);
+    } else {
+      $page->param(failed       => 1);
+      $page->param(errmsg       => $msg);
+      $page->param(wastrying    => "editing");
+      $page->param(todo         => "Edit location/view");
+      $page->param(locact       => "update");
+      $page->param(id           => $webvar{loc});
+      $page->param(locname      => $webvar{locname});
+      $page->param(comments     => $webvar{comments});
+      $page->param(iplist       => $webvar{iplist});
+    }
+  } else {
+    changepage(page => "loclist", errmsg => "You are not permitted to add locations/views", id => $webvar{parentid})
+        unless ($permissions{admin} || $permissions{location_create});
+
+    $page->param(todo => "Add location/view");
+    $page->param(locact => "add");
+    $page->param(locname => ($webvar{locname} ? $webvar{locname} : ''));
+    $page->param(iplist => ($webvar{iplist} ? $webvar{iplist} : ''));
+
+    show_msgs();
   }
 
@@ -1571 +1511 @@
   $page->param(forcettl => $webvar{forcettl}) if $webvar{forcettl};
   $page->param(newttl => $webvar{newttl}) if $webvar{newttl};
+  # This next one is arguably better on by default, but Breaking Things Is Bad, Mmmkay?
+  $page->param(mergematching => $webvar{mergematching}) if $webvar{mergematching};
   $page->param(dominactive => 1) if (!$webvar{domactive} && $webvar{doit});     # eww.
   $page->param(importdoms => $webvar{importdoms}) if $webvar{importdoms};
@@ -1589 +1531 @@
     }
 
+    # Bizarre Things Happen when you AXFR a null-named zone.
+    $webvar{importdoms} =~ s/^\s+//;
     my @domlist = split /\s+/, $webvar{importdoms};
     my @results;
@@ -1594 +1538 @@
       my %row;
       my ($code,$msg) = importAXFR($dbh, $webvar{ifrom}, $domain, $webvar{group},
-        $webvar{domstatus}, $webvar{rwsoa}, $webvar{rwns}, ($webvar{forcettl} ? $webvar{newttl} : 0) );
+        $webvar{domstatus}, $webvar{rwsoa}, $webvar{rwns}, ($webvar{forcettl} ? $webvar{newttl} : 0),
+        $webvar{mergematching});
       $row{domok} = $msg if $code eq 'OK';
       if ($code eq 'WARN') {
@@ -1605 +1550 @@
       }
       $msg = "<br />\n".$msg if $msg =~ m|<br />|;
-      logaction(domainID($dbh, $domain), $session->param("username"), $webvar{group},
-        "AXFR import $domain from $webvar{ifrom} ($code): $msg");
       $row{domain} = $domain;
       push @results, \%row;
@@ -1649 +1592 @@
 } elsif ($webvar{page} eq 'log') {
 
-##fixme put in some real log-munching stuff
-  my $sql = "SELECT user_id, email, name, entry, date_trunc('second',stamp) FROM log WHERE ";
   my $id = $curgroup;  # we do this because the group log may be called from (almost) any page,
                        # but the others are much more limited.  this is probably non-optimal.
 
   if ($webvar{ltype} && $webvar{ltype} eq 'user') {
-    $sql .= "user_id=?";
+##fixme:  where should we call this from?
     $id = $webvar{id};
     if (!check_scope(id => $id, type => 'user')) {
@@ -1663 +1604 @@
     $page->param(logfor => 'user '.userFullName($dbh,$id));
   } elsif ($webvar{ltype} && $webvar{ltype} eq 'dom') {
-    $sql .= "domain_id=?";
     $id = $webvar{id};
     if (!check_scope(id => $id, type => 'domain')) {
@@ -1671 +1611 @@
     $page->param(logfor => 'domain '.domainName($dbh,$id));
   } elsif ($webvar{ltype} && $webvar{ltype} eq 'rdns') {
-    $sql .= "rdns_id=?";
     $id = $webvar{id};
     if (!check_scope(id => $id, type => 'revzone')) {
@@ -1680 +1619 @@
   } else {
     # Default to listing curgroup log
-    $sql .= "group_id=?";
     $page->param(logfor => 'group '.groupName($dbh,$id));
     # note that scope limitations are applied via the change-group check;
     # group log is always for the "current" group
   }
+  $webvar{ltype} = 'group' if !$webvar{ltype};
+  my $lcount = getLogCount($dbh, (id => $id, logtype => $webvar{ltype})) or push @debugbits, $DNSDB::errstr;
+
+  $page->param(id => $id);
+  $page->param(ltype => $webvar{ltype});
+
+  fill_fpnla($lcount);
+  fill_pgcount($lcount, "log entries", '');
+  $page->param(curpage => $webvar{page}.($webvar{ltype} ? "&amp;ltype=$webvar{ltype}" : ''));
+
+  $sortby = 'stamp';
+  $sortorder = 'DESC';  # newest-first;  although filtering is probably going to be more useful than sorting
+# sort/order
+  $session->param($webvar{page}.'sortby', $webvar{sortby}) if $webvar{sortby};
+  $session->param($webvar{page}.'order', $webvar{order}) if $webvar{order};
+
+  $sortby = $session->param($webvar{page}.'sortby') if $session->param($webvar{page}.'sortby');
+  $sortorder = $session->param($webvar{page}.'order') if $session->param($webvar{page}.'order');
+
+  # Set up the column headings with the sort info
+  my @cols = ('fname','username','entry','stamp');
+  my %colnames = (fname => 'Name', username => 'Username/Email', entry => 'Log Entry', stamp => 'Date/Time');
+  fill_colheads($sortby, $sortorder, \@cols, \%colnames);
+
+##fixme:  increase per-page limit or use separate limit for log?  some ops give *lots* of entries...
+  my $logentries = getLogEntries($dbh, (id => $id, logtype => $webvar{ltype},
+        offset => $webvar{offset}, sortby => $sortby, sortorder => $sortorder));
+  $page->param(logentries => $logentries);
+
 ##fixme:
 # - filtering
 # - show reverse zone column?
-# - pagination/limiting number of records - put newest-first so user
-#   doesn't always need to go to the last page for recent activity?
-  my $sth = $dbh->prepare($sql);
-  $sth->execute($id);
-  my @logbits;
-  while (my ($uid, $email, $name, $entry, $stamp) = $sth->fetchrow_array) {
-    my %row;
-    $row{userfname} = $name;
-    $row{userid} = $uid;
-    $row{useremail} = $email;
-    $row{logentry} = $entry;
-    ($row{logtime}) = ($stamp =~ /^(.+)-\d\d$/);
-    push @logbits, \%row;
-  }
-  $page->param(logentries => \@logbits);
+# - on log record creation, bundle "parented" log actions (eg, "AXFR record blah for domain foo",
+#   or "Add record bar for new domain baz") into one entry (eg, "AXFR domain foo", "Add domain baz")?
+#   need a way to expand this into the complete list, and to exclude "child" entries
 
   # scope check fail target
@@ -1714 +1669 @@
 
 ##common bits
+# mostly things in the menu
 if ($webvar{page} ne 'login' && $webvar{page} ne 'badpage') {
   $page->param(username => $session->param("username"));
@@ -1724 +1680 @@
 ##fixme
   $page->param(mayrdns => 1);
+
+  $page->param(mayloc => ($permissions{admin} || $permissions{location_view}));
 
   $page->param(maydefrec => $permissions{admin});
@@ -1811 +1769 @@
   # than set them locally everywhere.
   foreach my $sessme ('resultmsg','warnmsg','errmsg') {
-    if ($params{$sessme}) {
-      $session->param($sessme, $params{$sessme});
+    if (my $tmp = $params{$sessme}) {
+      $tmp =~ s/^\n//;
+      $tmp =~ s|\n|<br />\n|g;
+      $session->param($sessme, $tmp);
       delete $params{$sessme};
     }
@@ -1830 +1790 @@
 } # end changepage
 
+# wrap up the usual suspects for result, warning, or error messages to be displayed
+sub show_msgs {
+  if ($session->param('resultmsg')) {
+    $page->param(resultmsg => $session->param('resultmsg'));
+    $session->clear('resultmsg');
+  }
+  if ($session->param('warnmsg')) {
+    $page->param(warnmsg => $session->param('warnmsg'));
+    $session->clear('warnmsg');
+  }
+  if ($session->param('errmsg')) {
+    $page->param(errmsg => $session->param('errmsg'));
+    $session->clear('errmsg');
+  }
+} # end show_msgs
+
 sub fillsoa {
-  my $def = shift;
+  my $defrec = shift;
+  my $revrec = shift;
   my $id = shift;
-  my $domname = ($def eq 'y' ? '' : "DOMAIN");
-
-  $page->param(defrec   => $def);
+  my $preserve = shift || 'd';  # Flag to use webvar fields or retrieve from database
+
+  my $domname = ($defrec eq 'y' ? '' : "DOMAIN");
+
+  $page->param(defrec   => $defrec);
+  $page->param(revrec   => $revrec);
 
 # i had a good reason to do this when I wrote it...
 #  $page->param(domain  => $domname);
 #  $page->param(group   => $DNSDB::group);
-  $page->param(isgrp => 1) if $def eq 'y';
-  $page->param(parent => ($def eq 'y' ? groupName($dbh, $DNSDB::group) : domainName($dbh, $id)) );
+  $page->param(isgrp => 1) if $defrec eq 'y';
+  $page->param(parent => ($defrec eq 'y' ? groupName($dbh, $id) :
+        ($revrec eq 'n' ? domainName($dbh, $id) : revName($dbh, $id)) ) );
 
 # defaults
@@ -1852 +1833 @@
   $page->param(defminttl        => $DNSDB::def{minttl});
 
-  # there are probably better ways to do this.  TMTOWTDI.
-  my %soa = getSOA($dbh,$def,$id);
-
   $page->param(id       => $id);
-  $page->param(recid    => $soa{recid});
-  $page->param(prins    => ($soa{prins} ? $soa{prins} : $DNSDB::def{prins}));
-  $page->param(contact  => ($soa{contact} ? $soa{contact} : $DNSDB::def{contact}));
-  $page->param(refresh  => ($soa{refresh} ? $soa{refresh} : $DNSDB::def{refresh}));
-  $page->param(retry    => ($soa{retry} ? $soa{retry} : $DNSDB::def{retry}));
-  $page->param(expire   => ($soa{expire} ? $soa{expire} : $DNSDB::def{expire}));
-  $page->param(minttl   => ($soa{minttl} ? $soa{minttl} : $DNSDB::def{minttl}));
-  $page->param(ttl      => ($soa{ttl} ? $soa{ttl} : $DNSDB::def{soattl}));
+
+  if ($preserve eq 'd') {
+    # there are probably better ways to do this.  TMTOWTDI.
+    my $soa = getSOA($dbh,$defrec,$revrec,$id);
+
+    $page->param(prins  => ($soa->{prins} ? $soa->{prins} : $DNSDB::def{prins}));
+    $page->param(contact        => ($soa->{contact} ? $soa->{contact} : $DNSDB::def{contact}));
+    $page->param(refresh        => ($soa->{refresh} ? $soa->{refresh} : $DNSDB::def{refresh}));
+    $page->param(retry  => ($soa->{retry} ? $soa->{retry} : $DNSDB::def{retry}));
+    $page->param(expire => ($soa->{expire} ? $soa->{expire} : $DNSDB::def{expire}));
+    $page->param(minttl => ($soa->{minttl} ? $soa->{minttl} : $DNSDB::def{minttl}));
+    $page->param(ttl    => ($soa->{ttl} ? $soa->{ttl} : $DNSDB::def{soattl}));
+  } else {
+    $page->param(prins  => ($webvar{prins} ? $webvar{prins} : $DNSDB::def{prins}));
+    $page->param(contact        => ($webvar{contact} ? $webvar{contact} : $DNSDB::def{contact}));
+    $page->param(refresh        => ($webvar{refresh} ? $webvar{refresh} : $DNSDB::def{refresh}));
+    $page->param(retry  => ($webvar{retry} ? $webvar{retry} : $DNSDB::def{retry}));
+    $page->param(expire => ($webvar{expire} ? $webvar{expire} : $DNSDB::def{expire}));
+    $page->param(minttl => ($webvar{minttl} ? $webvar{minttl} : $DNSDB::def{minttl}));
+    $page->param(ttl    => ($webvar{ttl} ? $webvar{ttl} : $DNSDB::def{soattl}));
+  }
 }
 
@@ -1872 +1863 @@
 
   # get the SOA first
-  my %soa = getSOA($dbh,$def,$rev,$id);
-
-  $page->param(contact  => $soa{contact});
-  $page->param(prins    => $soa{prins});
-  $page->param(refresh  => $soa{refresh});
-  $page->param(retry    => $soa{retry});
-  $page->param(expire   => $soa{expire});
-  $page->param(minttl   => $soa{minttl});
-  $page->param(ttl      => $soa{ttl});
-
-  my $foo2 = getDomRecs($dbh,$def,$rev,$id,$perpage,$webvar{offset},$sortby,$sortorder,$filter);
-
-  my $row = 0;
+  my $soa = getSOA($dbh,$def,$rev,$id);
+
+  $page->param(contact  => $soa->{contact});
+  $page->param(prins    => $soa->{prins});
+  $page->param(refresh  => $soa->{refresh});
+  $page->param(retry    => $soa->{retry});
+  $page->param(expire   => $soa->{expire});
+  $page->param(minttl   => $soa->{minttl});
+  $page->param(ttl      => $soa->{ttl});
+
+  my $foo2 = getDomRecs($dbh,(defrec => $def, revrec => $rev, id => $id, offset => $webvar{offset},
+        sortby => $sortby, sortorder => $sortorder, filter => $filter));
+
   foreach my $rec (@$foo2) {
     $rec->{type} = $typemap{$rec->{type}};
-    $rec->{row} = $row % 2;
-    $rec->{defrec} = $def;
-    $rec->{revrec} = $rev;
     $rec->{sid} = $webvar{sid};
-    $rec->{id} = $id;
     $rec->{fwdzone} = $rev eq 'n';
     $rec->{distance} = 'n/a' unless ($rec->{type} eq 'MX' || $rec->{type} eq 'SRV'); 
     $rec->{weight} = 'n/a' unless ($rec->{type} eq 'SRV'); 
     $rec->{port} = 'n/a' unless ($rec->{type} eq 'SRV');
-    $row++;
 # ACLs
     $rec->{record_edit} = ($permissions{admin} || $permissions{record_edit});
     $rec->{record_delete} = ($permissions{admin} || $permissions{record_delete});
+    $rec->{locname} = '' unless ($permissions{admin} || $permissions{location_view});
   }
   $page->param(reclist => $foo2);
@@ -1914 +1901 @@
   if ($webvar{revrec} eq 'n') {
     my $domroot = ($webvar{defrec} eq 'y' ? 'DOMAIN' : domainName($dbh,$webvar{parentid}));
-    $page->param(name   => $domroot);
+    $page->param(name   => ($webvar{name} ? $webvar{name} : $domroot));
     $page->param(address        => $webvar{address});
     $page->param(distance       => $webvar{distance})
@@ -1928 +1915 @@
   }
 # retrieve the right ttl instead of falling (way) back to the hardcoded system default
-  my %soa = getSOA($dbh,$webvar{defrec},$webvar{revrec},$webvar{parentid});
-  $page->param(ttl      => ($webvar{ttl} ? $webvar{ttl} : $soa{minttl}));
+  my $soa = getSOA($dbh,$webvar{defrec},$webvar{revrec},$webvar{parentid});
+  $page->param(ttl      => ($webvar{ttl} ? $webvar{ttl} : $soa->{minttl}));
 }
 
@@ -1949 +1936 @@
 
 sub fill_clonemelist {
-  my $sth = $dbh->prepare("SELECT username,user_id FROM users WHERE group_id=$curgroup");
-  $sth->execute;
-
   # shut up some warnings, but don't stomp on caller's state
   local $webvar{clonesrc} = 0 if !defined($webvar{clonesrc});
 
-  my @clonesrc;
-  while (my ($username,$uid) = $sth->fetchrow_array) {
-    my %row = (
-        username => $username,
-        uid => $uid,
-        selected => ($webvar{clonesrc} == $uid ? 1 : 0)
-        );
-    push @clonesrc, \%row;
-  }
-  $page->param(clonesrc => \@clonesrc);
+  my $clones = getUserDropdown($dbh, $curgroup, $webvar{clonesrc});
+  $page->param(clonesrc => $clones);
 }
 
@@ -2091 +2067 @@
   my $childlist = join(',',@childgroups);
 
-  my $sql = "SELECT count(*) FROM groups WHERE parent_group_id IN ($curgroup".($childlist ? ",$childlist" : '').")".
-        ($startwith ? " AND group_name ~* ?" : '').
-        ($filter ? " AND group_name ~* ?" : '');
-  my $sth = $dbh->prepare($sql);
-  $sth->execute(@filterargs);
-  my ($count) = ($sth->fetchrow_array);
+  my ($count) = getGroupCount($dbh, (childlist => $childlist, curgroup => $curgroup,
+        filter => ($filter ? $filter : undef), startwith => ($startwith ? $startwith : undef) ) );
 
 # fill page count and first-previous-next-last-all bits
@@ -2113 +2085 @@
 
 # set up the headers
-  my @cols = ('group','parent','nusers','ndomains');
-  my %colnames = (group => 'Group', parent => 'Parent Group', nusers => 'Users', ndomains => 'Domains');
+  my @cols = ('group','parent','nusers','ndomains','nrevzones');
+  my %colnames = (group => 'Group', parent => 'Parent Group', nusers => 'Users', ndomains => 'Domains', nrevzones => 'Reverse Zones');
   fill_colheads($sortby, $sortorder, \@cols, \%colnames);
 
@@ -2127 +2099 @@
   $sortby = 'g2.group_name' if $sortby eq 'parent';
 
-  my @grouplist;
-  $sql = "SELECT g.group_id, g.group_name, g2.group_name, ".
-        "count(distinct(u.username)) AS nusers, count(distinct(d.domain)) AS ndomains ".
-        "FROM groups g ".
-        "INNER JOIN groups g2 ON g2.group_id=g.parent_group_id ".
-        "LEFT OUTER JOIN users u ON u.group_id=g.group_id ".
-        "LEFT OUTER JOIN domains d ON d.group_id=g.group_id ".
-        "WHERE g.parent_group_id IN ($curgroup".($childlist ? ",$childlist" : '').") ".
-        ($startwith ? " AND g.group_name ~* ?" : '').
-        ($filter ? " AND g.group_name ~* ?" : '').
-        " GROUP BY g.group_id, g.group_name, g2.group_name ".
-        " ORDER BY $sortby $sortorder ".
-        ($offset eq 'all' ? '' : " LIMIT $perpage OFFSET ".$offset*$perpage);
-  $sth = $dbh->prepare($sql);
-  $sth->execute(@filterargs);
-
-  my $rownum = 0;
-  while (my @data = $sth->fetchrow_array) {
-    my %row;
-    $row{groupid} = $data[0];
-    $row{groupname} = $data[1];
-    $row{pgroup} = $data[2];
-    $row{nusers} = $data[3];
-    $row{ndomains} = $data[4];
-    $row{bg} = ($rownum++)%2;
-    $row{sid} = $sid;
-    $row{edgrp} = ($permissions{admin} || $permissions{group_edit});
-    $row{delgrp} = ($permissions{admin} || $permissions{group_delete});
-    push @grouplist, \%row;
-  }
-  $page->param(grouptable => \@grouplist);
+  my $glist = getGroupList($dbh, (childlist => $childlist, curgroup => $curgroup,
+        filter => ($filter ? $filter : undef), startwith => ($startwith ? $startwith : undef),
+        offset => $webvar{offset}, sortby => $sortby, sortorder => $sortorder) );
+
+  $page->param(grouptable => $glist);
 } # end listgroups()
 
@@ -2165 +2111 @@
   my $cur = shift || $curgroup;
 
-  my @childgroups;
-  getChildren($dbh, $logingroup, \@childgroups, 'all');
-  my $childlist = join(',',@childgroups);
-
-##fixme:  need to reorder list so that we can display a pseudotree in group dropdowns
-
-  # weesa gonna discard parent_group_id for now
-  my $sth = $dbh->prepare("SELECT group_id,parent_group_id,group_name FROM groups ".
-        "WHERE group_id IN ($logingroup".($childlist ? ",$childlist" : '').")".
-        "ORDER BY group_id");
-  $sth->execute;
+  # little recursive utility sub-sub
+  sub getgroupdrop {
+    my $root = shift;
+    my $cur = shift;    # to tag the selected group
+    my $grplist = shift;
+    my $indent = shift || '&nbsp;&nbsp;&nbsp;&nbsp;';
+
+    my @childlist;
+    getChildren($dbh,$root,\@childlist,'immediate');
+    return if $#childlist == -1;
+    foreach (@childlist) {
+      my %row;
+      $row{groupval} = $_;
+      $row{groupactive} = ($_ == $cur);
+      $row{groupname} = $indent.groupName($dbh, $_);
+      push @{$grplist}, \%row;
+      getgroupdrop($_, $cur, $grplist, $indent.'&nbsp;&nbsp;&nbsp;&nbsp;');
+    }
+  }
+
   my @grouplist;
-  while (my ($groupid,$pargroup,$groupname) = $sth->fetchrow_array()) {
-    my %row;
-    $row{groupname} = $groupname;
-    $row{groupval} = $groupid;
-##fixme: need magic
-## ... WTF?
-#    $row{defgroup} = '';
-    $row{groupactive} = 1 if $groupid == $cur;
-    push @grouplist, \%row;
-  }
+  push @grouplist, { groupval => $logingroup, groupactive => $logingroup == $curgroup,
+        groupname => groupName($dbh, $logingroup) };
+  getgroupdrop($logingroup, $curgroup, \@grouplist);
 
   $page->param("$template_var" => \@grouplist);
-
 } # end fill_grouplist()
+
+
+sub fill_loclist {
+  my $cur = shift || $curgroup;
+  my $defloc = shift || '';
+
+  return unless ($permissions{admin} || $permissions{location_view});
+
+  $page->param(location_view => ($permissions{admin} || $permissions{location_view}));
+
+  if ($permissions{admin} || $permissions{record_locchg}) {
+    my $loclist = getLocDropdown($dbh, $cur, $defloc);
+    $page->param(record_locchg => 1);
+    $page->param(loclist => $loclist);
+  } else {
+    my $loc = getLoc($dbh, $defloc);
+    $page->param(loc_name => $loc->{description});
+  }
+} # end fill_loclist()
 
 
@@ -2199 +2165 @@
   my $childlist = join(',',@childgroups);
 
-  my $sql = "SELECT count(*) FROM users WHERE group_id IN ($curgroup".($childlist ? ",$childlist" : '').")".
-        ($startwith ? " AND username ~* ?" : '').
-        ($filter ? " AND username ~* ?" : '');
-  my $sth = $dbh->prepare($sql);
-  $sth->execute(@filterargs);
-  my ($count) = ($sth->fetchrow_array);
+  my $count = getUserCount($dbh, (childlist => $childlist, curgroup => $curgroup,
+        filter => ($filter ? $filter : undef), startwith => ($startwith ? $startwith : undef) ) );
 
 # fill page count and first-previous-next-last-all bits
@@ -2229 +2191 @@
   $page->param(searchsubs => $searchsubs) if $searchsubs;
 
-# munge sortby for columns in database
-  $sortby = 'u.username' if $sortby eq 'user';
-  $sortby = 'u.type' if $sortby eq 'type';
-  $sortby = 'g.group_name' if $sortby eq 'group';
-  $sortby = 'u.status' if $sortby eq 'status';
-
-  my @userlist;
-  $sql = "SELECT u.user_id, u.username, u.firstname || ' ' || u.lastname AS fname, u.type, g.group_name, u.status ".
-        "FROM users u ".
-        "INNER JOIN groups g ON u.group_id=g.group_id ".
-        "WHERE u.group_id IN ($curgroup".($childlist ? ",$childlist" : '').")".
-        ($startwith ? " AND u.username ~* ?" : '').
-        ($filter ? " AND u.username ~* ?" : '').
-        " ORDER BY $sortby $sortorder ".
-        ($offset eq 'all' ? '' : " LIMIT $perpage OFFSET ".$offset*$perpage);
-
-  $sth = $dbh->prepare($sql);
-  $sth->execute(@filterargs);
-
-  my $rownum = 0;
-  while (my @data = $sth->fetchrow_array) {
-    no warnings "uninitialized";        # Just In Case something stupid happens and a user gets no first or last name
-    my %row;
-    $row{userid} = $data[0];
-    $row{username} = $data[1];
-    $row{userfull} = $data[2];
-    $row{usertype} = ($data[3] eq 'S' ? 'superuser' : "user");
-    $row{usergroup} = $data[4];
-    $row{active} = $data[5];
-    $row{bg} = ($rownum++)%2;
-    $row{sid} = $sid;
-    $row{eduser} = ($permissions{admin} || $permissions{user_edit});
-    $row{deluser} = ($permissions{admin} || $permissions{user_delete});
-    push @userlist, \%row;
-  }
-  $page->param(usertable => \@userlist);
+  my $ulist = getUserList($dbh, (childlist => $childlist, curgroup => $curgroup,
+        filter => ($filter ? $filter : undef), startwith => ($startwith ? $startwith : undef),
+        offset => $webvar{offset}, sortby => $sortby, sortorder => $sortorder) );
+  # Some UI things need to be done to the list (unlike other lists)
+  foreach my $u (@{$ulist}) {
+    $u->{eduser} = ($permissions{admin} ||
+        ($permissions{user_edit} && $u->{type} ne 'S') ||
+        ($permissions{self_edit} && $u->{user_id} == $session->param('uid')) );
+    $u->{deluser} = ($permissions{admin} || ($permissions{user_delete} && $u->{type} ne 'S'));
+    $u->{type} = ($u->{type} eq 'S' ? 'superuser' : 'user');
+  }
+  $page->param(usertable => $ulist);
 } # end list_users()
+
+
+sub list_locations {
+
+  my @childgroups;
+  getChildren($dbh, $curgroup, \@childgroups, 'all') if $searchsubs;
+  my $childlist = join(',',@childgroups);
+
+  my $count = getLocCount($dbh, (childlist => $childlist, curgroup => $curgroup,
+        filter => ($filter ? $filter : undef), startwith => ($startwith ? $startwith : undef) ) );
+
+# fill page count and first-previous-next-last-all bits
+  fill_pgcount($count,"locations/views",'');
+  fill_fpnla($count);
+
+  $sortby = 'user';
+# sort/order
+  $session->param($webvar{page}.'sortby', $webvar{sortby}) if $webvar{sortby};
+  $session->param($webvar{page}.'order', $webvar{order}) if $webvar{order};
+
+  $sortby = $session->param($webvar{page}.'sortby') if $session->param($webvar{page}.'sortby');
+  $sortorder = $session->param($webvar{page}.'order') if $session->param($webvar{page}.'order');
+
+# set up the headers
+  my @cols = ('description', 'iplist', 'group');
+  my %colnames = (description => 'Location/View Name', iplist => 'Permitted IPs/Ranges', group => 'Group');
+  fill_colheads($sortby, $sortorder, \@cols, \%colnames);
+
+# waffle, waffle - keep state on these as well as sortby, sortorder?
+  $page->param("start$startwith" => 1) if $startwith && $startwith =~ /^(?:[a-z]|0-9)$/;
+
+  $page->param(filter => $filter) if $filter;
+  $page->param(searchsubs => $searchsubs) if $searchsubs;
+
+  my $loclist = getLocList($dbh, (childlist => $childlist, curgroup => $curgroup,
+        filter => ($filter ? $filter : undef), startwith => ($startwith ? $startwith : undef),
+        offset => $webvar{offset}, sortby => $sortby, sortorder => $sortorder) );
+  # Some UI things need to be done to the list
+  foreach my $l (@{$loclist}) {
+    $l->{iplist} = "(All IPs)" if !$l->{iplist};
+    $l->{edloc} = ($permissions{admin} || $permissions{loc_edit});
+    $l->{delloc} = ($permissions{admin} || $permissions{loc_delete});
+  }
+  $page->param(loctable => $loclist);
+} # end list_locations()
 
 
@@ -2282 +2265 @@
   foreach my $col (@$cols) {
     my %coldata;
-    $coldata{firstcol} = 1 if $col eq $cols->[0];
     $coldata{sid} = $sid;
     $coldata{page} = $webvar{page};
@@ -2307 +2289 @@
 
 
-sub logaction {
-  my $domid = shift;
-  my $username = shift;
-  my $groupid = shift;
-  my $entry = shift;
-  my $revid = shift || 0;
-
-##fixme: push SQL into DNSDB.pm
-##fixme: add bits to retrieve group/domain name info to retain after entity is deleted?
-  my $sth = $dbh->prepare("SELECT user_id, firstname || ' ' || lastname FROM users WHERE username=?");
-  $sth->execute($username);
-  my ($user_id, $fullname) = $sth->fetchrow_array;
-
-  $sth = $dbh->prepare("INSERT INTO log (domain_id,user_id,group_id,email,name,entry,rdns_id) ".
-        "VALUES (?,?,?,?,?,?,?)") or warn $dbh->errstr;
-  $sth->execute($domid,$user_id,$groupid,$username,$fullname,$entry,$revid) or warn $sth->errstr;
-} # end logaction()
-
-
 # we have to do this in a variety of places;  let's make it consistent
 sub fill_permissions {