Changeset 95 for trunk


Ignore:
Timestamp:
04/15/11 17:53:45 (14 years ago)
Author:
Kris Deugau
Message:

/trunk

Add commented attempt to autolocate the script's full base path

for use lib; commented bits fail due to taint mode. *sigh*

Add ACL checks for domain edit, create, and delete. Generalize

error message handling so that we don't get "Error deleting
domain: You don't have permission to add a domain"-ish messages.

Trim some code after a changepage() call (since it issues a 302

redirect and exits...)

Add ACL checks for record edit, create, and delete. Apply similar

error-message handling fixups as done with domain processing.

Location:
trunk
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/dns.cgi

    r93 r95  
    2222use Data::Dumper;
    2323
     24#sub is_tainted {
     25#  # from perldoc perlsec
     26#  return ! eval { eval("#" . substr(join("", @_), 0, 0)); 1 };
     27#}
     28#use Cwd 'abs_path';
     29#use File::Basename;
     30#use lib dirname( abs_path $0 );
     31#die "argh!  tainted!" if is_tainted($0);
     32#die "argh! \@INC got tainted!" if is_tainted(@INC);
     33
     34# custom modules
    2435use lib '.';
    25 # custom modules
    2636use DNSDB qw(:ALL);
    2737
    … …  
    185195
    186196  $page->param(curpage => $webvar{page});
    187   if ($webvar{del_failed}) {
    188     $page->param(del_failed => 1);
    189     $page->param(errmsg => $webvar{errmsg});
    190   }
     197  $page->param(errmsg => $webvar{errmsg}) if $webvar{errmsg};
     198#  if ($webvar{del_failed}) {
     199#    $page->param(del_failed => 1);
     200#    $page->param(errmsg => $webvar{errmsg});
     201#  }
    191202
    192203  listdomains();
    193204
    194205} elsif ($webvar{page} eq 'newdomain') {
     206
     207  changepage(page => "domlist", errmsg => "You are not permitted to add domains")
     208        unless ($permissions{admin} || $permissions{domain_create});
    195209
    196210  # hmm.  nothing to do here?
    … …  
    204218} elsif ($webvar{page} eq 'adddomain') {
    205219
     220  changepage(page => "domlist", errmsg => "You are not permitted to add domains")
     221        unless ($permissions{admin} || $permissions{domain_create});
     222
    206223  my ($code,$msg) = addDomain($dbh,$webvar{domain},$webvar{group},($webvar{makeactive} eq 'on' ? 1 : 0));
    207224
    … …  
    216233} elsif ($webvar{page} eq 'deldom') {
    217234
     235  changepage(page => "domlist", errmsg => "You are not permitted to delete domains")
     236        unless ($permissions{admin} || $permissions{domain_delete});
     237
    218238  $page->param(id => $webvar{id});
    219239
    … …  
    232252# need to find failure mode
    233253      logaction($webvar{id}, $session->param("username"), $pargroup, "Failed to delete domain $dom ($msg)");
    234       changepage(page => "domlist", del_failed => 1, errmsg => $msg);
     254      changepage(page => "domlist", errmsg => "Error deleting domain $dom: $msg");
    235255    } else {
    236256      logaction($webvar{id}, $session->param("username"), $pargroup, "Deleted domain $dom");
    … …  
    244264
    245265} elsif ($webvar{page} eq 'reclist') {
     266
     267##fixme:  ACL needs pondering.  Does "edit domain" interact with record add/remove/etc?
     268# Note this seems to be answered "no" in Vega.
     269# ACLs
     270  $page->param(record_create    => ($permissions{admin} || $permissions{record_create}) );
     271#  $page->param(record_edit     => ($permissions{admin} || $permissions{record_edit}) );
     272  $page->param(record_delete    => ($permissions{admin} || $permissions{record_delete}) );
    246273
    247274  # Handle record list for both default records (per-group) and live domain records
    … …  
    280307  }
    281308
    282   if ($webvar{del_failed}) {
    283     $page->param(del_failed => 1);
    284     $page->param(errmsg => $webvar{errmsg});
    285   }
     309  $page->param(errmsg => $webvar{errmsg}) if $webvar{errmsg};
    286310
    287311} elsif ($webvar{page} eq 'record') {
    288312
    289313  if ($webvar{recact} eq 'new') {
     314
     315    changepage(page => "reclist", errmsg => "You are not permitted to add records", id => $webvar{parentid})
     316        unless ($permissions{admin} || $permissions{record_create});
    290317
    291318    $page->param(todo => "Add record");
    … …  
    297324
    298325  } elsif ($webvar{recact} eq 'add') {
     326
     327    changepage(page => "reclist", errmsg => "You are not permitted to add records", id => $webvar{parentid})
     328        unless ($permissions{admin} || $permissions{record_create});
    299329
    300330    my @recargs = ($dbh,$webvar{defrec},$webvar{parentid},$webvar{name},$webvar{type},$webvar{address},$webvar{ttl});
    … …  
    339369  } elsif ($webvar{recact} eq 'edit') {
    340370
     371    changepage(page => "reclist", errmsg => "You are not permitted to edit records", id => $webvar{parentid})
     372        unless ($permissions{admin} || $permissions{record_edit});
     373
    341374    $page->param(todo           => "Update record");
    342375    $page->param(recact         => "update");
    … …  
    354387
    355388  } elsif ($webvar{recact} eq 'update') {
     389
     390    changepage(page => "reclist", errmsg => "You are not permitted to edit records", id => $webvar{parentid})
     391        unless ($permissions{admin} || $permissions{record_edit});
    356392
    357393    my ($code,$msg) = updateRec($dbh,$webvar{defrec},$webvar{id},
    … …  
    402438
    403439} elsif ($webvar{page} eq 'delrec') {
     440
     441  changepage(page => "reclist", errmsg => "You are not permitted to delete records", id => $webvar{parentid})
     442        unless ($permissions{admin} || $permissions{record_delete});
    404443
    405444  $page->param(id => $webvar{id});
    … …  
    427466      }
    428467      changepage(page => "reclist", id => $webvar{parentid}, defrec => $webvar{defrec},
    429                 del_failed => 1, errmsg => $msg);
    430       $page->param(del_failed => 1);
    431       $page->param(errmsg => $msg);
    432       showdomain($webvar{defrec}, $webvar{parentid});
     468                errmsg => "Error deleting record: $msg");
     469#      $page->param(del_failed => 1);
     470#      $page->param(errmsg => $msg);
     471#      showdomain($webvar{defrec}, $webvar{parentid});
    433472    } else {
    434473      if ($webvar{defrec} eq 'y') {
    … …  
    11951234    $rec->{port} = 'n/a' unless ($rec->{type} eq 'SRV');
    11961235    $row++;
     1236# ACLs
     1237    $rec->{record_edit} = ($permissions{admin} || $permissions{record_edit});
     1238    $rec->{record_delete} = ($permissions{admin} || $permissions{record_delete});
    11971239  }
    11981240  $page->param(reclist => $foo2);
    … …  
    13191361  $filter = $session->param($webvar{page}.'filter');
    13201362  $searchsubs = $session->param($webvar{page}.'searchsubs');
     1363
     1364# ACLs
     1365  $page->param(domain_create    => ($permissions{admin} || $permissions{domain_create}) );
     1366  $page->param(domain_edit      => ($permissions{admin} || $permissions{domain_edit}) );
     1367  $page->param(domain_delete    => ($permissions{admin} || $permissions{domain_delete}) );
    13211368
    13221369##fixme:  $logingroup or $curgroup?
    … …  
    13871434    $row{sid} = $sid;
    13881435    $row{offset} = $offset;
     1436# ACLs
     1437    $row{domain_edit} = ($permissions{admin} || $permissions{domain_edit});
     1438    $row{domain_delete} = ($permissions{admin} || $permissions{domain_delete});
    13891439##fixme:  need to clean up status indicator/usage/inversion
    13901440    push @domlist, \%row;

  • trunk/templates/domlist.tmpl

    r44 r95  
    55<td align="center">
    66
    7  <TMPL_IF del_failed>
    8   <div class='errmsg'>Error deleting domain <TMPL_VAR NAME=domain>: <TMPL_VAR NAME=errmsg></div>
     7 <TMPL_IF errmsg>
     8  <div class='errmsg'><TMPL_VAR NAME=errmsg></div>
    99 </TMPL_IF>
    1010
    … …  
    1919</tr>
    2020<tr><td colspan="3" align="center"><TMPL_INCLUDE NAME="lettsearch.tmpl"></td></tr>
    21 <tr><td colspan="3" align="right"><a href="dns.cgi?sid=<TMPL_VAR NAME=sid>&amp;page=newdomain">New Domain</a></td></tr>
     21<tr><td colspan="3" align="right"><TMPL_IF domain_create><a href="dns.cgi?sid=<TMPL_VAR NAME=sid>&amp;page=newdomain">New Domain</a></TMPL_IF></td></tr>
    2222</table>
    2323
    … …  
    3131src="images/<TMPL_VAR NAME=sortorder>.png" /></TMPL_IF></td>
    3232</TMPL_LOOP>
    33         <td class="datahead_s">Change Status</td>
    34         <td class="datahead_s">Delete</td>
     33<TMPL_IF domain_edit>   <td class="datahead_s">Change Status</td></TMPL_IF>
     34<TMPL_IF domain_delete> <td class="datahead_s">Delete</td></TMPL_IF>
    3535</tr>
    3636<TMPL_IF name=domtable>
    … …  
    4040        <td><TMPL_VAR name=status></td>
    4141        <td><TMPL_VAR name=group></td>
    42         <td align="center"><a href="dns.cgi?sid=<TMPL_VAR NAME=sid>&amp;page=domlist<TMPL_IF NAME=offset>&amp;offset=<TMPL_VAR NAME=offset></TMPL_IF>&amp;id=<TMPL_VAR NAME=domainid>&amp;action=<TMPL_IF NAME=mkactive>domon<TMPL_ELSE>domoff</TMPL_IF>"><TMPL_IF NAME=mkactive>activate<TMPL_ELSE>deactivate</TMPL_IF></a></td>
    43         <td align="center"><a href="dns.cgi?sid=<TMPL_VAR NAME=sid>&amp;page=deldom&amp;id=<TMPL_VAR NAME=domainid>"><img src="images/trash2.png" alt="[ Delete ]" /></a></td>
     42<TMPL_IF domain_edit>   <td align="center"><a href="dns.cgi?sid=<TMPL_VAR NAME=sid>&amp;page=domlist<TMPL_IF NAME=offset>&amp;offset=<TMPL_VAR NAME=offset></TMPL_IF>&amp;id=<TMPL_VAR NAME=domainid>&amp;action=<TMPL_IF NAME=mkactive>domon<TMPL_ELSE>domoff</TMPL_IF>"><TMPL_IF NAME=mkactive>activate<TMPL_ELSE>deactivate</TMPL_IF></a></td></TMPL_IF>
     43<TMPL_IF domain_delete> <td align="center"><a href="dns.cgi?sid=<TMPL_VAR NAME=sid>&amp;page=deldom&amp;id=<TMPL_VAR NAME=domainid>"><img src="images/trash2.png" alt="[ Delete ]" /></a></td></TMPL_IF>
    4444</tr>
    4545</TMPL_LOOP>

  • trunk/templates/reclist.tmpl

    r76 r95  
    55<td align="center" valign="top">
    66
    7  <TMPL_IF del_failed>
    8   <div class='errmsg'>Error deleting record: <TMPL_VAR NAME=errmsg></div>
     7 <TMPL_IF errmsg>
     8  <div class='errmsg'><TMPL_VAR NAME=errmsg></div>
    99 </TMPL_IF>
    1010
    … …  
    4141<tr class="darkrowheader">
    4242        <td colspan="4">Records</td>
    43         <td align="right"><a href="dns.cgi?sid=<TMPL_VAR NAME=sid>&amp;page=record&amp;parentid=<TMPL_VAR NAME=id>&amp;defrec=<TMPL_VAR NAME=defrec>&amp;recact=new">Add record</a></td>
     43<TMPL_IF record_create> <td align="right"><a href="dns.cgi?sid=<TMPL_VAR NAME=sid>&amp;page=record&amp;parentid=<TMPL_VAR NAME=id>&amp;defrec=<TMPL_VAR NAME=defrec>&amp;recact=new">Add record</a></td></TMPL_IF>
    4444        <td align="right"><a href="dns.cgi?sid=<TMPL_VAR NAME=sid>&amp;page=log&amp;id=<TMPL_VAR NAME=id><TMPL_IF logdom>&amp;ltype=dom</TMPL_IF>">View log</a></td>
    4545</tr>
    … …  
    5656 NAME=defrec>"><TMPL_VAR NAME=colname></a><TMPL_IF NAME=sortorder>&nbsp;<img alt="<TMPL_VAR
    5757 NAME=sortorder>" src="images/<TMPL_VAR NAME=sortorder>.png" /></TMPL_IF></td></TMPL_LOOP>
    58         <td>Delete</td>
     58<TMPL_IF record_delete> <td>Delete</td></TMPL_IF>
    5959</tr>
    6060<TMPL_LOOP NAME=reclist>
    6161<tr class="row<TMPL_VAR NAME=row>">
    62         <td><a href="dns.cgi?sid=<TMPL_VAR NAME=sid>&amp;page=record&amp;parentid=<TMPL_VAR NAME=id>&amp;defrec=<TMPL_VAR NAME=defrec>&amp;recact=edit&amp;id=<TMPL_VAR NAME=record_id>"><TMPL_VAR NAME=host></a></td>
     62        <td><TMPL_IF record_edit><a href="dns.cgi?sid=<TMPL_VAR NAME=sid>&amp;page=record&amp;parentid=<TMPL_VAR NAME=id>&amp;defrec=<TMPL_VAR NAME=defrec>&amp;recact=edit&amp;id=<TMPL_VAR NAME=record_id>"><TMPL_VAR NAME=host></a><TMPL_ELSE><TMPL_VAR NAME=host></TMPL_IF></td>
    6363        <td><TMPL_VAR NAME=type></td>
    6464        <td><TMPL_VAR NAME=val></td>
    … …  
    6767        <td><TMPL_VAR NAME=port></td>
    6868        <td><TMPL_VAR NAME=ttl></td>
    69         <td align="center"><a href="dns.cgi?sid=<TMPL_VAR NAME=sid>&amp;page=delrec&amp;id=<TMPL_VAR NAME=record_id>&amp;defrec=<TMPL_VAR NAME=defrec>&amp;parentid=<TMPL_VAR NAME=id>"><img src="images/trash2.png" alt="[ Delete ]" /></a></td>
     69<TMPL_IF record_delete> <td align="center"><a href="dns.cgi?sid=<TMPL_VAR NAME=sid>&amp;page=delrec&amp;id=<TMPL_VAR NAME=record_id>&amp;defrec=<TMPL_VAR NAME=defrec>&amp;parentid=<TMPL_VAR NAME=id>"><img src="images/trash2.png" alt="[ Delete ]" /></a></td></TMPL_IF>
    7070</tr>
    7171</TMPL_LOOP>
Note: See TracChangeset for help on using the changeset viewer.