Changeset 593 for branches/stable/cgi-bin

Timestamp:

05/14/13 18:10:22 (12 years ago)

Author:

Kris Deugau

Message:

/branches/stable

Merge /trunk r517 (merge /branches/htmlform)
Conflicts all resolved towards /trunk.
Fix a minor syntax error with "while (@data..." -> "while (my @data..."
(may cause merge conflicts later)

Location:

branches/stable

Files:

• . (modified) (1 prop)
• cgi-bin/CommonWeb.pm (deleted)
• cgi-bin/CustIDCK.pm (modified) (1 diff)
• cgi-bin/IPDB.pm (modified) (9 diffs)
• cgi-bin/MyIPDB.pm (modified) (1 diff)
• cgi-bin/admin.cgi (modified) (20 diffs)
• cgi-bin/allocate.pl (modified) (2 diffs)
• cgi-bin/combineblocks.pl (modified) (1 diff)
• cgi-bin/main.cgi (modified) (49 diffs)
• cgi-bin/newcity.cgi (modified) (2 diffs)
• cgi-bin/newnode.cgi (modified) (2 diffs)
• cgi-bin/search.cgi (modified) (13 diffs)
• cgi-bin/snCalc.cgi (modified) (4 diffs)

branches/stable/cgi-bin/CustIDCK.pm

@@ -31 +31 @@
 # the local admin on installation
 sub custid_exist {
+  my $self = shift;
   my $custid = shift;
 

branches/stable/cgi-bin/IPDB.pm

@@ -24 +24 @@
 @EXPORT_OK    = qw(
         %disp_alloctypes %list_alloctypes %def_custids @citylist @poplist @masterblocks
-        %allocated %free %routed %bigfree %IPDBacl
+        %allocated %free %routed %bigfree %IPDBacl %aclmsg
         &initIPDBGlobals &connectDB &finish &checkDBSanity &allocateBlock &addMaster
         &deleteBlock &getBlockData &mailNotify
@@ -32 +32 @@
 %EXPORT_TAGS    = ( ALL => [qw(
                 %disp_alloctypes %list_alloctypes %def_custids @citylist @poplist
-                @masterblocks %allocated %free %routed %bigfree %IPDBacl
+                @masterblocks %allocated %free %routed %bigfree %IPDBacl %aclmsg
                 &initIPDBGlobals &connectDB &finish &checkDBSanity &allocateBlock
                 &addMaster &deleteBlock &getBlockData &mailNotify
@@ -52 +52 @@
 our %bigfree;
 our %IPDBacl;
+
+# mapping table for functional-area => error message
+our %aclmsg = (
+        addmaster       => 'add a master block',
+        addblock        => 'add an allocation',
+        updateblock     => 'update a block',
+        delblock        => 'delete an allocation',
+        );
 
 our $org_name = 'Example Corp';
@@ -126 +134 @@
   }
 
+##fixme:  initialize HTML::Template env var for template path
+# something like $self->path().'/templates' ?
+#  $ENV{HTML_TEMPLATE_ROOT} = 'foo/bar';
+
   return (1,"OK");
 } # end initIPDBGlobals
@@ -174 +186 @@
 sub finish {
   my $dbh = $_[0];
-  $dbh->disconnect;
+  $dbh->disconnect if $dbh;
 } # end finish
 
@@ -360 +372 @@
       }
 
-      $sth = $dbh->prepare("update poolips set custid='$custid',".
-        "city='$city',available='n',description='$desc',notes='$notes',".
-        "circuitid='$circid',privdata='$privdata'".
-        " where ip='$cidr'");
-      $sth->execute;
+      $sth = $dbh->prepare("update poolips set custid=?,city=?,".
+        "available='n',description=?,notes=?,circuitid=?,privdata=?".
+        " where ip=?");
+      $sth->execute($custid, $city, $desc, $notes, $circid, $privdata, "$cidr");
 # node hack
       if ($nodeid && $nodeid ne '') {
@@ -413 +424 @@
           $sth = $dbh->prepare("insert into allocations".
                 " (cidr,custid,type,city,description,notes,maskbits,circuitid,privdata)".
-                " values ('$cidr','$custid','$type','$city',?,?,".
-                $cidr->masklen.",?,?)");
-          $sth->execute($desc,$notes,$circid,$privdata);
+                " values (?,?,?,?,?,?,?,?,?)");
+          $sth->execute("$cidr", $custid, $type, $city, $desc, $notes, $cidr->masklen, $circid, $privdata);
 
           # And initialize the pool, if necessary
@@ -527 +537 @@
           $sth = $dbh->prepare("insert into allocations (cidr,custid,type,city,".
                 "description,notes,maskbits,circuitid,privdata)".
-                " values ('$cidr','$custid','$type','$city',?,?,".
-                $cidr->masklen.",?,?)");
-          $sth->execute($desc,$notes,$circid,$privdata);
+                " values (?,?,?,?,?,?,?,?,?)");
+          $sth->execute("$cidr", $custid, $type, $city, $desc, $notes, $cidr->masklen, $circid, $privdata);
 
           # And initialize the pool, if necessary
@@ -653 +662 @@
     eval {
       $msg = "Unable to deallocate $disp_alloctypes{$type} $cidr";
-      $sth = $dbh->prepare("update poolips set custid='$defcustid',available='y',".
-        "city=(select city from allocations where cidr >>= '$cidr'".
+      $sth = $dbh->prepare("update poolips set custid=?,available='y',".
+        "city=(select city from allocations where cidr >>= ?".
         " order by masklen(cidr) desc limit 1),".
-        "description='',notes='',circuitid='' where ip='$cidr'");
-      $sth->execute;
+        "description='',notes='',circuitid='' where ip=?");
+      $sth->execute($defcustid, "$cidr", "$cidr");
       $dbh->commit;
     };

branches/stable/cgi-bin/MyIPDB.pm

@@ -23 +23 @@
 my $dbhost = 'ipdb-db';
 
-# Quick workaround for fixed web path.  Set this to the absolute web path to
-# your IPDB install, or leave blank for installation at the webroot.
-$IPDB::webpath = '';
+# Quick workaround for fixed web path.  Set this to the absolute web path to 
+# your IPDB install, or leave blank for installation at the webroot. 
+$IPDB::webpath = ''; 
 
 # Set some globals declared in IPDB.pm.  Most of these only affect mailNotify().

branches/stable/cgi-bin/admin.cgi

@@ -15 +15 @@
 use warnings;
 use CGI::Carp qw(fatalsToBrowser);
+use CGI::Simple;
+use HTML::Template;
 use DBI;
-use CommonWeb qw(:ALL);
 #use POSIX qw(ceil);
 use NetAddr::IP;
@@ -39 +40 @@
 
 syslog "debug", "$authuser active";
+
+# Set up the CGI object...
+my $q = new CGI::Simple;
+# ... and get query-string params as well as POST params if necessary
+$q->parse_query_string;
+
+# Convenience;  saves changing all references to %webvar
+##fixme:  tweak for handling <select multiple='y' size=3> (list with multiple selection)
+my %webvar = $q->Vars;
+
+# anyone got a better name?  :P
+my $thingroot = $ENV{SCRIPT_FILENAME};
+$thingroot =~ s|cgi-bin/admin.cgi||;
+
+# Set up some globals
+$ENV{HTML_TEMPLATE_ROOT} = $thingroot."templates";
 
 # Why not a global DB handle?  (And a global statement handle, as well...)
@@ -47 +64 @@
 ($ip_dbh,$errstr) = connectDB_My;
 if (!$ip_dbh) {
-  printAndExit("Database error: $errstr\n");
-}
-initIPDBGlobals($ip_dbh);
+  $webvar{action} = "dberr";
+} else {
+  initIPDBGlobals($ip_dbh);
+}
+
+# handle DB error output
+if ($webvar{action} eq 'dberr') {
+  my $page = HTML::Template->new(filename => "admin/dberr.tmpl");
+  $page->param(errmsg => $errstr);
+  print "Content-Type: text/html\n\n".$page->output;
+  exit;
+}
 
 if ($IPDBacl{$authuser} !~ /A/) {
-  print "Content-Type: text/html\n\n".
-        "<html>\n<head>\n\t<title>Access denied</title>\n".
-        qq(\t<link rel="stylesheet" type="text/css" href="$IPDB::webpath/ipdb.css">\n).
-        qq(\t<link rel="stylesheet" type="text/css" href="$IPDB::webpath/local.css">\n).
-        "</head>\n<body>\n".
-        qq(Access to this tool is restricted.  Contact the <a href="mailto:ipdbadmin\@example.com">IPDB administrator</a> \n).
-        "for more information.\n</body>\n</html>\n";
+  my $page = HTML::Template->new(filename => "admin/aclerr.tmpl");
+##fixme:  need params for IPDB admin email and name
+  $page->param(ipdbadmin_email => 'ipdbadmin@example.com');
+  $page->param(ipdbadmin_name => 'the IPDB administrator');
+  print "Content-Type: text/html\n\n".$page->output;
   exit;
 }
 
-my %webvar = parse_post();
-cleanInput(\%webvar);
-
-print "Content-type: text/html\n\n".
-        "<html>\n<head>\n\t<title>[IPDB admin tools]</title>\n".
-        qq(\t<link rel="stylesheet" type="text/css" href="$IPDB::webpath/ipdb.css">\n).
-        qq(\t<link rel="stylesheet" type="text/css" href="$IPDB::webpath/local.css">\n).
-        "</head>\n<body>\n".
-        "<h2>IPDB - Administrative Tools</h2>\n<hr>\n";
+my $header = HTML::Template->new(filename => "admin/header.tmpl");
 
 if(!defined($webvar{action})) {
-  $webvar{action} = "<NULL>";   #shuts up the warnings.
-
-  my $typelist = '';
+  $webvar{action} = "main";   #shuts up the warnings.
+}
+
+my $page;
+if (-e "$ENV{HTML_TEMPLATE_ROOT}/admin/$webvar{action}.tmpl") {
+  $page = HTML::Template->new(filename => "admin/$webvar{action}.tmpl");
+} else {
+  $page = HTML::Template->new(filename => "admin/dunno.tmpl");
+}
+
+# handle index page
+if ($webvar{action} eq 'main') {
+  $header->param(mainpage => 1);
+
   $sth = $ip_dbh->prepare("select type,listname from alloctypes where listorder < 900 order by listorder");
   $sth->execute;
-  my @data = $sth->fetchrow_array;
-  $typelist .= "<option value='$data[0]' selected>$data[1]</option>\n";
-  while (my @data = $sth->fetchrow_array) {
-    $typelist .= "<option value='$data[0]'>$data[1]</option>\n";
-  }
-
-  my $masterlist = '';
+
+  my @typelist;
+  my $count = 0;
+  while (my ($type,$listname) = $sth->fetchrow_array) {
+    my %row = (
+        selected => $count++,
+        type => $type,
+        dispname => $listname
+        );
+    push @typelist, \%row;
+  }
+  $page->param(typelist => \@typelist);
+
+  my @masterlist;
   $sth = $ip_dbh->prepare("select cidr,mtime from masterblocks order by cidr");
   $sth->execute;
-  while (my @data = $sth->fetchrow_array) {
-    $masterlist .= "<option value='$data[0]'>$data[0] ($data[1])</option>\n";
-  }
-
-  print qq(WARNING:  There are FAR fewer controls on what you can do here.  Use the
-main interface if at all possible.
-<hr>
-<form action="admin.cgi" method="POST">
-<input type=hidden name=action value=alloc>
-Allocate block/IP: <input name=cidr> as <select name=alloctype>$typelist</select> to <input name=custid>
-<input type=submit value=" GIMME!! "></form>
-<hr><form action="admin.cgi" method="POST">
-<input type=hidden name=action value=alloctweak>
-Manually update allocation data in this /24: <input name=allocfrom>
-<input type=submit value="Show allocations">
-</form>
-
-<hr>rWHOIS tools:
-<form action="admin.cgi" method="POST">
-<input type=hidden name=action value=touch>
-Bump "last updated" timestamp on this master: <select name=whichmaster>$masterlist</select>
-<input type=submit value="Update timestamp"> (Sets timestamp to "now")</form>
-<a href="admin.cgi?action=listcust">Edit customer data for rWHOIS</a> - data used for
-blocks with the SWIP box checkmarked.  Links to edit/add data are on this page.
-
-<hr><a href="admin.cgi?action=showpools">List IP Pools</a> for manual tweaking and updates
-
-<hr><a href="admin.cgi?action=showusers">Manage users</a> (add/remove users;  change
-internal access controls - note that this does NOT include IP-based limits)<br>
-<a href="admin.cgi?action=emailnotice">Manage email notice options</a> (pick which events
-and allocation types cause notifications;  configure recipient lists for notices)
-
-<hr>Consistency check tools<br>
-<a href="consistency-check.pl">General</a>:  Check general netblock consistency.<br>
-<a href="freespace.pl">Free space</a>:  List total and aggregate free space.  Does not 
-include private networks (192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8)
-);
-} else {
-  print qq(<a href="$IPDB::webpath/cgi-bin/admin.cgi">Back</a> to main<hr>);
-}
-
-
-## Possible actions.
-if ($webvar{action} eq 'alloc') {
-  # OK, we know what we're allocating.
-
-#  if ($webvar{cidr} !~ /^\s*(\d{1,3}\.){3}\d{1,3}(\/\d{2})?\s*$/) {
-#    printAndExit("Can't allocate something that's not a netblock/ip");
-#  }
+  while (my ($cidr,$mtime) = $sth->fetchrow_array) {
+    my %row = (
+        master => $cidr,
+        masterdate => $mtime
+        );
+    push @masterlist, \%row;
+  }
+  $page->param(masterlist => \@masterlist);
+
+}
+
+## Non-default actions.
+
+elsif ($webvar{action} eq 'alloc') {
+
+  if ($webvar{cidr} !~ /^\s*(\d{1,3}\.){3}\d{1,3}(\/\d{2})?\s*$/) {
+    $page->param(errmsg => "Can't allocate something that's not a netblock/ip");
+    goto ERRJUMP;
+  }
 
   $sth = $ip_dbh->prepare("select def_custid from alloctypes where type='$webvar{alloctype}'");
@@ -148 +152 @@
       my $status = CustIDCK->custid_exist($webvar{custid});
       if ($CustIDCK::Error) {
-        printError("Error verifying customer ID: ".$CustIDCK::ErrMsg);
-        return;
+        $page->param(errmsg => "Error verifying customer ID: ".$CustIDCK::ErrMsg);
+        goto ERRJUMP;
       }
       if (!$status) {
-        printError("Customer ID not valid.  Make sure the Customer ID ".
+        $page->param(errmsg => "Customer ID not valid.  Make sure the Customer ID ".
           "is correct.<br>\nUse STAFF for staff static IPs, and $IPDB::defcustid for any other ".
           "non-customer assignments.");
-        return;
+        goto ERRJUMP;
       }
     }
@@ -169 +173 @@
     @data = $sth->fetchrow_array;
 # User deserves errors if user can't be bothered to find the free block first.
-    printAndExit("Can't allocate from outside a free block!!\n")
-        if !$data[0];
+    if (!$data[0]) {
+      $page->param(errmsg => "Can't allocate from outside a free block!!");
+      goto ERRJUMP;
+    }
   } elsif ($webvar{alloctype} =~ /^(.)i$/) {
     $sth = $ip_dbh->prepare("select cidr from allocations where cidr >>='$cidr' and (type like '_d' or type like '_p')");
@@ -176 +182 @@
     @data = $sth->fetchrow_array;
 # User deserves errors if user can't be bothered to find the pool and a free IP first.
-    printAndExit("Can't allocate static IP from outside a pool!!\n")
-        if !$data[0];
+    if (!$data[0]) {
+      $page->param(errmsg => "Can't allocate static IP from outside a pool!!");
+      goto ERRJUMP;
+    }
   } else {
     $sth = $ip_dbh->prepare("select cidr from freeblocks where cidr >>='$cidr' and not (routed='n')");
@@ -183 +191 @@
     @data = $sth->fetchrow_array;
 # User deserves errors if user can't be bothered to find the free block first.
-    printAndExit("Can't allocate from outside a routed block!!\n")
-        if !$data[0];
+    if (!$data[0]) {
+      $page->param(errmsg => "Can't allocate from outside a routed block!!");
+      goto ERRJUMP;
+    }
   }
 
@@ -190 +200 @@
   $sth->finish;
 
-  my $cities = '';
+  my @cities;
   foreach my $city (@citylist) {
-    $cities .= "<option>$city</option>\n";
-  }
-
-  print qq(<table class=regular>
-<form method=POST action=admin.cgi>
-<tr class=color1>
-<td>Allocating:</td>
-<td>$cidr<input type=hidden name=cidr value="$cidr"></td>
-</tr><tr class=color2>
-<td>Type:</td><td>$disp_alloctypes{$webvar{alloctype}}
-<input type=hidden name=alloctype value="$webvar{alloctype}"></td>
-</tr><tr class=color1>
-<td>Allocated from:</td>
-<td>$alloc_from<input type=hidden name=alloc_from value="$alloc_from"></td>
-</tr><tr class="color2">
-<td>Customer ID:</td><td>$custid<input type=hidden name=custid value="$custid"></td>
-</tr><tr class=color1>
-<td>Customer location:</td><td>
-<select name="city"><option selected>-</option>
-$cities
-</select>
-&nbsp;<a href="javascript:popNotes('$IPDB::webpath/newcity.html')">Add new location</a>
-</td>
-</tr>
-<tr class="color2">
-<td>Circuit ID:</td><td><input name=circid size=40></td>
-</tr><tr class="color1">
-<td>Description/Name:</td><td><input name="desc" size=40></td>
-</tr><tr class="color2">
-<td>Notes:</td><td><textarea name="notes" rows="3" cols="40"></textarea></td>
-</tr><tr class="warning">
-<td colspan=2><center>WARNING:  This will IMMEDIATELY assign this block!!</center></td>
-</tr><tr class="color2">
-<td class="center" colspan="2"><input type="submit" value="  Assign  "></td>
-<input type="hidden" name="action" value="confirm">
-</form>
-</tr>
-</table>
-);
-
+     my %row = (city => $city);
+     push @cities, \%row;
+  }
+  $page->param(
+        cidr => $cidr,
+        disptype => $disp_alloctypes{$webvar{alloctype}},
+        type => $webvar{alloctype},
+        alloc_from => $alloc_from,
+        custid => $custid,
+        citylist => \@cities
+        );
 
 } elsif ($webvar{action} eq 'confirm') {
 
-  print "Assigning $webvar{cidr} to $webvar{custid} (\"$webvar{desc}\") as ".
-        "$disp_alloctypes{$webvar{alloctype}}...<br>\n";
+  $page->param(
+        cidr => $webvar{cidr},
+        custid => $webvar{custid},
+        desc => $webvar{desc},
+        disptype => $disp_alloctypes{$webvar{alloctype}}
+        );
   # Only need to check city here.
   if ($webvar{city} eq '-') {
-    printError("Invalid customer location!  Go back and select customer's location.");
+    $page->param(locerr => "Invalid customer location!  Go back and select customer's location.");
+    goto ERRJUMP;
   } else {
     if ($webvar{alloctype} =~ /^.i$/) {
@@ -247 +233 @@
       $sth->execute;
       if ($sth->err) {
-        print "Allocation failed!  DBI said:\n".$sth->errstr."\n";
+        $page->param(errmsg => $sth->errstr);
         syslog "err", "($authuser) Allocation of '$webvar{cidr}' to '$webvar{custid}' as ".
                 "'$webvar{alloctype}' failed: '".$sth->errstr."'";
       } else {
-        print "Allocation OK!\n";
         syslog "notice", "$authuser allocated '$webvar{cidr}' to '$webvar{custid}' as ".
                 "'$webvar{alloctype}'";
@@ -263 +248 @@
         $webvar{circid});
       if ($retcode eq 'OK') {
-        print "Allocation OK!\n";
         syslog "notice", "$authuser allocated '$webvar{cidr}' to '$webvar{custid}' as ".
                 "'$webvar{alloctype}'";
       } else {
-        print "Allocation failed!  IPDB::allocateBlock said:\n$msg\n";
+        $page->param(errmsg => $msg);
         syslog "err", "($authuser) Allocation of '$webvar{cidr}' to '$webvar{custid}' as ".
                 "'$webvar{alloctype}' failed: '$msg'";
@@ -276 +260 @@
 
 } elsif ($webvar{action} eq 'alloctweak') {
+
   fix_allocfrom();
   showAllocs($webvar{allocfrom});
+
 } elsif ($webvar{action} eq 'update') {
+
   update();
-} elsif ($webvar{action} eq 'assign') {
-  # Display a list of possible blocks within the requested block.
-  open (HTML, "../admin_alloc.html")
-        or croak "Could not open admin_alloc.html :$!";
-  my $html = join('', <HTML>);
-  $html =~ s/\$\$MASK\$\$/$webvar{masklen}/g;
-  $html =~ s/\$\$ALLOCFROM\$\$/$webvar{allocfrom}/g;
-
-  my $from = new NetAddr::IP $webvar{allocfrom};
-  my @blocklist = $from->split($webvar{masklen});
-  my $availblocks;
-  foreach (@blocklist) {
-    $availblocks .= qq(<tr><td colspan=2 align=center><input type=radio name=block value="$_">$_</td></tr>\n);
-  }
-  $html =~ s/\$\$BLOCKLIST\$\$/$availblocks/g;
-
-  print $html;
+
 } elsif ($webvar{action} eq 'touch') {
-  print "Touching master $webvar{whichmaster}\n";
+
+  $page->param(master => $webvar{whichmaster});
   $sth = $ip_dbh->prepare("update masterblocks set mtime=now() where cidr='$webvar{whichmaster}'");
   $sth->execute;
   if ($sth->err) {
-    print "<p>Error updating modified timestamp on master $webvar{whichmaster}: ".$sth->errstr."\n";
-  }
+    $page->param(errmsg => $sth->errstr);
+  }
+
 } elsif ($webvar{action} eq 'listcust') {
-  print qq(Add new entry:\n
-<form action=admin.cgi method=POST>
-<table border=1><tr>
-<input type=hidden name=action value=edcust>
-<input type=hidden name=newcust value=1>
-<td>CustID:</td><td><input name=custid></td>
-<td align=center><input type=submit value="Go to edit page for this custid"></td></tr>
-</form></table>
-);
-  print "<p>Click CustID to edit existing customer contact data:\n".
-        "<table border=1>\n<tr><td>CustID</td><td>Name</td><td>Tech handle</td></tr>\n";
+
   $sth = $ip_dbh->prepare("select custid,name,tech_handle from customers order by custid");
   $sth->execute;
+  my @custlist;
   while (my @data = $sth->fetchrow_array) {
-    print qq(<tr><td><a href="admin.cgi?action=edcust&custid=$data[0]">$data[0]</td>).
-        "<td>$data[1]</td><td>$data[2]</td></tr>\n";
-  }
-  print "</table>\n";
+    my %row = (
+        custid => $data[0],
+        custname => $data[1],
+        tech => $data[2]
+        );
+    push @custlist, \%row;
+  }
+  $page->param(custlist => \@custlist);
+
 } elsif ($webvar{action} eq 'edcust') {
+
   if ($webvar{newcust}) {
-    print "got here?\n";
     $sth = $ip_dbh->prepare("INSERT INTO customers (custid) VALUES (?)");
     $sth->execute($webvar{custid});
@@ -335 +304 @@
   my ($custid, $name, $street, $city, $prov, $country, $pocode, $phone, $tech, $abuse, $admin, $special) =
         $sth->fetchrow_array;
-  print qq(<form action=admin.cgi method=POST>
-<table border=1><tr>
-<input type=hidden name=action value=updcust>
-<td>CustID:</td><td>$custid<input type=hidden name=custid value=$custid></td>
-<td>Name:</td><td><input name=name value="$name"></td></tr>
-<tr><td>Street:</td><td><input name=street value="$street"></td>
-<!-- <td>Street2:</td><td><input name=street2></td> -->
-<td>City:</td><td><input name=city value="$city"></td></tr>
-<tr><td>Province/State: (2-letter code)</td><td><input name=province value="$prov" length=2 size=2></td>
-<td>Country: (2-letter code)</td><td><input name=country value="$country" length=2 size=2></td></tr>
-<tr><td>Postal/ZIP Code:</td><td><input name=pocode value="$pocode"></td>
-<td>Phone:</td><td><input name=phone value="$pocode"></td></tr>
-<!-- <td>Default rDNS:</td><td><input name=def_rdns></td></tr>
-<td>Description:</td><td><input name=description></td> -->
-<tr><td>Contacts/ARIN Handles:</td><td>
- Tech: <input name=tech_handle value="$tech"><br>
- Abuse: <input name=abuse_handle value="$abuse"><br>
- Admin: <input name=admin_handle value="$admin"><br>
-Note:  Only tech is required at the moment.
-</td>
-<td>"Special":</td><td><textarea name=special rows=4 cols=50>$special</textarea></td>
-</tr>
-<tr><td colspan=4 align=center><input type=submit value="Update"></td></tr>
-</form></table>
-<div style="margin-left:5px">
-<h3>Explanation for "Special" field:</h3>
-This is a temporary place to define the WHOIS "net name" for a block.
-It may be removed later, more likely migrated elsewhere.
-<p>It's formatted like this, one line for each custom net name:
-<pre>NetName[CIDR block]: NET-NAME</pre>
-Example:
-<pre>NetName192.168.236.0/24: MEGAWIDGET-1</pre>
-Note:
-<ul style="margin-top: 0px;">
-<li>Spacing is important - there should only be ONE space, in between the colon and the net name.
-<li>The CIDR block name nust include all four octets - no short forms are accepted.
-<li>Net names must be all uppercase, and consist only of A-Z, 0-9, and - (same as for SWIPed net names).
-</ul>
-</div>
-);
+
+  $page->param(
+        custid => $custid,
+        name => $name,
+        street => $street,
+        city => $city,
+        prov => $prov,
+        country => $country,
+        pocode => $pocode,
+        phone => $phone,
+        tech => $tech,
+        abuse => $abuse,
+        admin => $admin,
+        special => $special
+        );
 
 } elsif ($webvar{action} eq 'updcust') {
+
   $sth = $ip_dbh->prepare("UPDATE customers SET".
         " name=?, street=?, city=?, province=?, country=?, pocode=?,".
@@ -384 +329 @@
         $webvar{country}, $webvar{pocode}, $webvar{phone}, $webvar{tech_handle}, 
         $webvar{abuse_handle}, $webvar{admin_handle}, $webvar{special}, $webvar{custid});
-  print "Updated $webvar{custid}<br>\n".
-        qq(<table border=1>
-<tr><td>CustID:</td><td>$webvar{custid}</td></tr>
-<tr><td>Name:</td><td>$webvar{name}</td></tr>
-<tr><td>Street:</td><td>$webvar{street}</td></tr>
-<tr><td>City:</td><td>$webvar{city}</td></tr>
-<tr><td>Province/State:</td><td>$webvar{province}</td></tr>
-<tr><td>Country:</td><td>$webvar{country}</td></tr>
-<tr><td>Postal/ZIP Code:</td><td>$webvar{pocode}</td></tr>
-<tr><td>Phone:</td><td>$webvar{phone}</td></tr>
-<!-- <td>Default rDNS:</td><td>$webvar{def_rdns}</td></tr> -->
-<tr><td>Contacts/ARIN Handles:</td><td>
- Tech: $webvar{tech_handle}<br>
- Abuse: $webvar{abuse_handle}<br>
- Admin: $webvar{admin_handle}<br>
-</td></tr>
-<tr><td>"Special":</td><td><pre>$webvar{special}</pre></td></tr>
-</table>
-<a href="admin.cgi?action=listcust">Back</a> to rWHOIS customer list<br>\n);
+  $page->param(
+        custid => $webvar{custid},
+        name => $webvar{name},
+        street => $webvar{street},
+        city => $webvar{city},
+        prov => $webvar{province},
+        country => $webvar{country},
+        pocode => $webvar{pocode},
+        phone => $webvar{phone},
+        tech => $webvar{tech_handle},
+        abuse => $webvar{abuse_handle},
+        admin => $webvar{admin_handle},
+        special => $webvar{special}
+        );
 
 } elsif ($webvar{action} eq 'showpools') {
-  print "IP Pools currently allocated:\n".
-        "<table border=1>\n<tr><td>Pool</td><td># of free IPs</td></tr>\n";
-  $sth = $ip_dbh->prepare("select cidr from allocations where type like '%p' or type like '%d' order by cidr");
-  $sth->execute;
-  my %poolfree;
-  while (my @data = $sth->fetchrow_array) {
-    $poolfree{$data[0]} = 0;
-  }
-  $sth = $ip_dbh->prepare("select pool,ip from poolips where available='y' order by ip");
-  $sth->execute;
-  while (my @data = $sth->fetchrow_array) {
-    $poolfree{$data[0]}++;
-  }
-  foreach my $key (keys %poolfree) {
-    print qq(<tr><td><a href="admin.cgi?action=tweakpool&pool=$key">$key</a></td>).
-        "<td>$poolfree{$key}</td></tr>\n";
-  }
-  print "</table>\n";
+
+  $sth = $ip_dbh->prepare("select pool, count(*) from poolips where available='y' group by pool order by pool");
+  $sth->execute;
+  my @poollist;
+  while (my ($pool,$free) = $sth->fetchrow_array) {
+    my %row = (
+        pool => $pool,
+        free => $free
+        );
+    push @poollist, \%row;
+  }
+  $page->param(poollist => \@poollist);
+
 } elsif ($webvar{action} eq 'tweakpool') {
+
   showPool($webvar{pool});
+
 } elsif ($webvar{action} eq 'updatepool') {
 
   $sth = $ip_dbh->prepare("update poolips set custid='$webvar{custid}', ".
-        "city='$webvar{city}', type='$webvar{type}', available='".
+        "city=?, type='$webvar{type}', available='".
         (($webvar{available} eq 'y') ? 'y' : 'n').
-        "', notes='$webvar{notes}', description='$webvar{desc}' ".
+        "', notes=?, description=? ".
         "where ip='$webvar{ip}'");
-  $sth->execute;
+  $sth->execute($webvar{city},$webvar{notes},$webvar{desc});
+  $page->param(ip => $webvar{ip});
   if ($sth->err) {
-    print "Error updating pool IP $webvar{ip}: $@<hr>\n";
-    syslog "err", "$authuser could not update pool IP $webvar{ip}: $@";
-  } else {  
-    $sth = $ip_dbh->prepare("select pool from poolips where ip='$webvar{ip}'");
-    $sth->execute;
-    my @data = $sth->fetchrow_array;
-    print "$webvar{ip} in $data[0] updated\n<hr>\n";
+    $page->param(errmsg => $sth->errstr);
+    syslog "err", "$authuser could not update pool IP $webvar{ip}: ".$sth->errstr;
+  } else {
     syslog "notice", "$authuser updated pool IP $webvar{ip}";
   }
+  $sth = $ip_dbh->prepare("select pool from poolips where ip='$webvar{ip}'");
+  $sth->execute;
+  my @data = $sth->fetchrow_array;
+  $page->param(pool => $data[0]);
+
 } elsif ($webvar{action} eq 'showusers') {
-  print "Notes:<br>\n".
-        "<li>Admin users automatically get all other priviledges.\n".
-        "<li>Everyone has basic read access.\n".
-        "<hr>Add new user:<form action=admin.cgi method=POST>\n".
-        "Username: <input name=username><br>\n".
-        "Password: <input name=password> <input type=checkbox name=preenc>Password is pre-encrypted (MUST be crypt() encrypted)<br>\n".
-        "<input type=submit value='Add user'><input type=hidden name=action value=newuser></form>\n";
-
-  print "<hr>Users with access:\n<table border=1>\n";
-  print "<tr><td></td><td align=center colspan=3>General access</td></tr>\n";
-  print "<tr><td>Username</td><td>Add new</td><td>Change</td>".
-        "<td>Delete</td><td>Systems/Networking</td><td>Admin user</td></tr>\n".
-        "<form action=admin.cgi method=POST>\n";
+
   $sth = $ip_dbh->prepare("select username,acl from users order by username");
   $sth->execute;
-  while (my @data = $sth->fetchrow_array) {
-    print "<form action=admin.cgi method=POST><input type=hidden name=action value=updacl>".
-        qq(<tr><td>$data[0]<input type=hidden name=username value="$data[0]"></td><td>).
-    # Now for the fun bit.  We have to pull apart the ACL field and
-    # output a bunch of checkboxes.
-        "<input type=checkbox name=add".($data[1] =~ /a/ ? ' checked=y' : '').
-        "></td><td><input type=checkbox name=change".($data[1] =~ /c/ ? ' checked=y' : '').
-        "></td><td><input type=checkbox name=del".($data[1] =~ /d/ ? ' checked=y' : '').
-        "></td><td><input type=checkbox name=sysnet".($data[1] =~ /s/ ? ' checked=y' : '').
-        "></td><td><input type=checkbox name=admin".($data[1] =~ /A/ ? ' checked=y' : '').
-        qq(></td><td><input type=submit value="Update"></td></form>\n).
-        "<form action=admin.cgi method=POST><td><input type=hidden name=action value=deluser>".
-        "<input type=hidden name=username value=$data[0]>".
-        qq(<input type=submit value="Delete user"></tr></form>\n);
-
-  }
-  print "</table>\n";
+  my @userlist;
+  while (my ($username,$acl) = $sth->fetchrow_array) {
+##fixme: funky things happening with HTML::Template here;  shouldn't need the "logic ? iftrue : iffalse" structure
+    my %row = (
+        username => $username,
+        can_add => ($acl =~ /a/ ? 1 : 0),
+        can_change => ($acl =~ /c/ ? 1 : 0),
+        can_del => ($acl =~ /d/ ? 1 : 0),
+        sysnet => ($acl =~ /s/ ? 1 : 0),
+        is_admin => ($acl =~ /A/ ? 1 : 0),
+        acl => $acl
+        );
+    push @userlist, \%row;
+  }
+  $page->param(userlist => \@userlist);
+
 } elsif ($webvar{action} eq 'updacl') {
-  print "Updating ACL for $webvar{username}:<br>\n";
+
+  $page->param(username => $webvar{username});
   my $acl = 'b';
   if ($webvar{admin} eq 'on') {
@@ -487 +414 @@
         ($webvar{sysnet} eq 'on' ? 's' : '');
   }
-  print "New ACL: $acl<br>\n";
+  $page->param(acl => $acl);
 
   $sth = $ip_dbh->prepare("update users set acl='$acl' where username='$webvar{username}'");
   $sth->execute;
-  print "OK\n" if !$sth->err;
-
-  print qq(<hr><a href="admin.cgi?action=showusers">Back</a> to user listing\n);
+  $page->param(errmsg => $sth->errstr) if $sth->err;
 
 } elsif ($webvar{action} eq 'newuser') {
-  print "Adding user $webvar{username}...\n";
+
+  $page->param(username => $webvar{username});
   my $cr_pass = ($webvar{preenc} ? $webvar{password} :
         crypt $webvar{password}, join('',('.','/',0..9,'A'..'Z','a'..'z')[rand 64, rand 64]));
@@ -502 +428 @@
         "('$webvar{username}','$cr_pass','b')");
   $sth->execute;
-  if ($sth->err) {
-    print "<br>Error adding user: ".$sth->errstr;
-  } else {
-    print "OK\n";
-  }
-
-  print qq(<hr><a href="admin.cgi?action=showusers">Back</a> to user listing\n);
+  $page->param(errmsg => $sth->errstr) if $sth->err;
 
 } elsif ($webvar{action} eq 'deluser') {
-  print "Deleting user $webvar{username}.<br>\n";
+
+  $page->param(username => $webvar{username});
   $sth = $ip_dbh->prepare("delete from users where username='$webvar{username}'");
   $sth->execute;
-  print "OK\n" if !$sth->err;
-
-  print qq(<hr><a href="admin.cgi?action=showusers">Back</a> to user listing\n);
+  $page->param(errmsg => $sth->errstr) if $sth->err;
 
 } elsif ($webvar{action} eq 'emailnotice') {
-  print "<h4>Email notice management:</h4>\nClick the email addresses to edit that list.";
+
   $sth = $ip_dbh->prepare("SELECT action,reciplist FROM notify");
   $sth->execute;
-
-  print "<table border=1>\n";
+  my @spamlist;
   while (my ($notice_code,$reciplist) = $sth->fetchrow_array() ) {
 ##fixme: hairy mess, only a few things call mailNotify() anyway, so many possible notices won't work.
     my $action_out = dispNoticeCode($notice_code);
-    print "<tr><td>$action_out</td>".
-        qq(<td><a href="admin.cgi?action=ednotice&code=$notice_code">$reciplist</a></td>).
-        qq(<td><a href="admin.cgi?action=delnotice&code=$notice_code">Delete</a></tr>\n);
-  }
-  print qq(<tr><td colspan=2>Known "special" codes:<br>
-<ul style="margin-top: 0px; margin-bottom: 0px;">
-        <li>swi: Notify if block being updated has SWIP flag set</li>
-</ul></td></tr>
-</table>
-);
-
-# add new entries from this tangle:
-  print "<h4>Add new notification:</h4>\n".
-        "Note:  Failure notices on most conditions are not yet supported.\n";
-
-  print qq(<table border=1><form action=admin.cgi method="POST">
-<input type=hidden name=action value=addnotice>
-<tr>
-<td>Recipients</td><td colspan=3><textarea name=reciplist cols=50 rows=5></textarea></td></tr>
-<tr><td>Action</td><td>
-        <table><tr>
-                <td><input type=radio name=msgaction value=a>Add &nbsp;
-                <input type=radio name=msgaction value=u>Update &nbsp;
-                <input type=radio name=msgaction value=d>Delete &nbsp;
-                <input type=radio name=msgaction value=n>New listitem</td>
-        </tr><tr>
-                <td>
-                <input type=radio name=msgaction value=s:>Special: <input name=special>(requires code changes)
-        </td></tr></table>
-</td>
-<td>Failure?</td><td><input type=checkbox name=onfail></td></tr>
-<tr><td>Event/Allocation type:</td><td colspan=3>
-        <table>
-        <tr>
-                <td><input type=radio name=alloctype value=a>All allocations</td>
-                <td><input type=radio name=alloctype value=.i>All static IPs</td>
-                <td><input type=radio name=alloctype value=ci>New city</td>
-                <td><input type=radio name=alloctype value=no>New node</td>
-        </tr>
-        <tr>
-);
+    my %row = (
+        action => $action_out,
+        code => $notice_code,
+        recips => $reciplist
+        );
+    push @spamlist, \%row;
+  }
+  $page->param(spamlist => \@spamlist);
 
   $sth = $ip_dbh->prepare("SELECT type,dispname FROM alloctypes WHERE listorder < 500 ".
@@ -573 +458 @@
   $sth->execute;
   my $i=0;
+  my @typelist;
   while (my ($type,$disp) = $sth->fetchrow_array) {
-    print "             <td><input type=radio name=alloctype value=$type>$disp</td>";
-    $i++;
-    print "     </tr>\n\t<tr>"
-        if ($i % 4 == 0);
-  }
-
-  print qq(     </tr>
-        </table>
-</tr>
-<tr><td colspan=4 align=center><input type=submit value="Add notice"></td></tr>
-</table>
-</form>
-);
-  ## done spitting out add-new-spam-me-now table
+    my %row = (
+        type => $type,
+        disptype => $disp,
+# ahh, off-by-one counts, how we do love thee...  NOT!
+        newrow => ($i+2 > $sth->rows ? 1 : (++$i % 4)),
+        );
+    push @typelist, \%row;
+  }
+  $page->param(typelist => \@typelist);
 
 } elsif ($webvar{action} eq 'addnotice') {
+
   $webvar{alloctype} = $webvar{special} if $webvar{msgaction} eq 's:';
   if ($webvar{msgaction} && $webvar{alloctype} && $webvar{reciplist}) {
+    $page->param(cantry => 1);
     $webvar{reciplist} =~ s/[\r\n]+/,/g;
     $webvar{msgaction} = "f:$webvar{msgaction}" if $webvar{onfail};
-    print "Adding notice to $webvar{reciplist} for ".dispNoticeCode($webvar{msgaction}.$webvar{alloctype}).":\n";
+    $page->param(reciplist => $webvar{reciplist});
+    $page->param(dispnotice => dispNoticeCode($webvar{msgaction}.$webvar{alloctype}));
     $sth = $ip_dbh->prepare("INSERT INTO notify (action, reciplist) VALUES (?,?)");
 ##fixme:  automagically merge reciplists iff action already exists
     $sth->execute($webvar{msgaction}.$webvar{alloctype}, $webvar{reciplist});
-    if ($sth->err) {
-      print "Failed:  DB error: ".$sth->errstr."\n";
-    } else {
-      print "OK!<br>\n"
-    }
-  } else {
-    print "Need to specify at least one recipient, an action, and an allocation type. ".
-        qq{("Special" content is considered an allocation type).  Hit the Back button and try again.<br>\n};
-  }
-  print qq(<a href="admin.cgi?action=emailnotice">Back to email notice list</a>\n);
+    $page->param(addfailed => $sth->errstr) if $sth->err;
+  }
 
 } elsif ($webvar{action} eq 'delnotice') {
-  print "Deleting notices on ".dispNoticeCode($webvar{code}.$webvar{alloctype}).":\n";
+
+  $page->param(dispnotice => dispNoticeCode($webvar{code}.$webvar{alloctype}));
   $sth = $ip_dbh->prepare("DELETE FROM notify WHERE action=?");
   $sth->execute($webvar{code});
-  if ($sth->err) {
-    print "Failed:  DB error: ".$sth->errstr."\n";
-  } else {
-    print "OK!<br>\n"
-  }
-  print qq(<a href="admin.cgi?action=emailnotice">Back to email notice list</a>\n);
+  $page->param(delfailed => $sth->errstr) if $sth->err;
 
 } elsif ($webvar{action} eq 'ednotice') {
-  print "<h4>Editing recipient list for '".dispNoticeCode($webvar{code})."':</h4>\n";
+
+  $page->param(dispnotice => dispNoticeCode($webvar{code}));
+  $page->param(code => $webvar{code});
   $sth = $ip_dbh->prepare("SELECT reciplist FROM notify WHERE action=?");
   $sth->execute($webvar{code});
   my ($reciplist) = $sth->fetchrow_array;
   $reciplist =~ s/,/\n/g;
-  print qq(<form action=admin.cgi method=POST><input type=hidden name=code value="$webvar{code}">\n).
-        qq(<input type=hidden name=action value="updnotice"><table border=1><tr><td>).
-        qq(<textarea cols="40" rows="5" name=reciplist>$reciplist</textarea></td><td><input type=submit value="Update">\n).
-        "</td></tr></table></form>\n";
+  $page->param(reciplist => $reciplist);
+
 } elsif ($webvar{action} eq 'updnotice') {
-  print "<h4>Updating recipient list for '".dispNoticeCode($webvar{code})."':</h4>\n";
+
+  $page->param(dispnotice => dispNoticeCode($webvar{code}));
   $sth = $ip_dbh->prepare("UPDATE notify SET reciplist=? WHERE action=?");
   $webvar{reciplist} =~ s/[\r\n]+/,/g;
   $sth->execute($webvar{reciplist}, $webvar{code});
-  if ($sth->err) {
-    print "Failed:  DB error: ".$sth->errstr."\n";
-  } else {
-    print "OK!<br>\n"
-  }
-  print qq(<a href="admin.cgi?action=emailnotice">Back to email notice list</a>\n);
+  $page->param(updfailed => $sth->errstr) if $sth->err;
+
 } elsif ($webvar{action} ne '<NULL>') {
-  print "webvar{action} check failed: Don't know how to $webvar{action}";
-}
+  $page->param(dunno => $webvar{action});
+}
+
+ERRJUMP: print "Content-type: text/html\n\n".$header->output;
+print $page->output;
+
+##fixme:  make me a footer param!
+print qq(<hr><div><a href="$IPDB::webpath/">Back</a> to main interface</div>\n);
+
+# We print the footer here, so we don't have to do it elsewhere.
+my $footer = HTML::Template->new(filename => "footer.tmpl");
+# we're already in the admin tools, no need to provide a bottom link.  maybe.
+#$footer->param(adminlink => ($IPDBacl{$authuser} =~ /A/));
+
+print $footer->output;
+
+$ip_dbh->disconnect;
+
+exit;
+
 
 # Hokay.  This is a little different.  We have a few specific functions here:
@@ -649 +536 @@
 #  -> Tweak individual DB fields
 #
-
-print qq(<hr><a href="$IPDB::webpath/">Back</a> to main interface</a>\n);
-
-printFooter;
-
-$ip_dbh->disconnect;
-
-exit;
 
 
@@ -671 +550 @@
 
 
-# List free blocks in a /24 for arbitrary manual allocation
-sub showfree($) {
-  my $cidr = new NetAddr::IP $_[0];
-  print "Showing free blocks in $cidr<br>\n".
-        "<table border=1>\n";
-  $sth = $ip_dbh->prepare("select * from freeblocks where cidr <<= '$cidr' order by cidr");
-  $sth->execute;
-  while (my @data = $sth->fetchrow_array) {
-    my $temp = new NetAddr::IP $data[0];
-    print "<tr><form action=admin.cgi method=POST><input type=hidden name=action value=assign>\n".
-        qq(<td>$temp<input type=hidden name=allocfrom value="$temp"></td>\n).
-        "<td>".
-        (($temp->masklen == 30) ? '<input type=hidden name=masklen value=30>30'
-          : "<select name=masklen><option>30</option>\n<option>29</option>\n") .
-        (($temp->masklen < 29) ? "<option>28</option>\n" : '') .
-        (($temp->masklen < 28) ? "<option>27</option>\n" : '') .
-        (($temp->masklen < 27) ? "<option>26</option>\n" : '') .
-        (($temp->masklen < 26) ? "<option>25</option>\n" : '') .
-        (($temp->masklen < 25) ? "<option>24</option>\n" : '') .
-        "</td>".
-        qq(<td>$data[2]</td><td><input type=submit value="Allocate from here"></td>).
-        "\n</form></tr>\n";
-  }
-  print "</table>\n";
-}
-
-
 # Show allocations to allow editing.
-sub showAllocs($) {
-  my $cidr = new NetAddr::IP $_[0];
-  print "Edit custID, allocation type, city for allocations in ".
-        "$cidr:\n<table border=1>";
-  $sth = $ip_dbh->prepare("select * from allocations where cidr <<= '$cidr' order by cidr");
-  $sth->execute;
-  while (my @data = $sth->fetchrow_array) {
-    print "<tr><form action=admin.cgi method=POST><input type=hidden name=action value=update>\n".
-        qq(<td>$data[0]<input type=hidden value="$data[0]" name=block></td>\n).
-        qq(<td><input name=custid value="$data[1]"></td>\n).
-        "<td><select name=alloctype>";
-
+sub showAllocs {
+
+  my $within = new NetAddr::IP $_[0];
+  $page->param(within => $within);
+
+  $sth = $ip_dbh->prepare("select cidr,custid,type,city,description from allocations where cidr <<= '$within' order by cidr");
+  $sth->execute;
+  my @blocklist;
+  while (my ($cidr,$custid,$type,$city,$desc) = $sth->fetchrow_array) {
+    my %row = (
+        cidr => $cidr,
+        custid => $custid,
+        city => $city,
+        desc => $desc,
+        );
+
+##fixme:  don't wanna retrieve the whole type list *every time around the outer loop*
     my $sth2 = $ip_dbh->prepare("select type,listname from alloctypes".
         " where listorder < 500 and not (type like '_i') order by listorder");
     $sth2->execute;
-    while (my @types = $sth2->fetchrow_array) {
-      print "<option". (($data[2] eq $types[0]) ? ' selected' : '') .
-        " value='$types[0]'>$types[1]</option>\n";
+    my @typelist;
+    while (my ($listtype,$dispname) = $sth2->fetchrow_array) {
+      my %subrow = (
+        type => $listtype,
+        dispname => $dispname,
+        selected => ($listtype eq $type)
+        );
+      push @typelist, \%subrow;
     }
-
-    print qq(<td><input name=city value="$data[3]"></td>\n).
-        "<td>$data[4]</td><td>$data[5]</td>".
-        qq(<td><input type=submit value="Update"></td></form></tr>\n);
-  }
-  print "</table>\n";
-
-  # notes
-  print "<hr><b>Notes:</b>\n".
-        "<ul>\n<li>Use the main interface to update description and notes fields\n".
-        "<li>Changing the allocation type here will NOT affect IP pool data.\n".
-        "</ul>\n";
-}
+    $row{typelist} = \@typelist;
+    push @blocklist, \%row;
+  }
+  $page->param(blocklist => \@blocklist);
+} # end showAllocs()
 
 
 # Stuff updates into DB
 sub update {
-  eval {
-    # Relatively simple SQL transaction here.  Note that we're deliberately NOT
-    # updating notes/desc here as it's available through the main interface.
-    $sth = $ip_dbh->prepare("update allocations set custid='$webvar{custid}',".
-        "city='$webvar{city}',type='$webvar{alloctype}' where cidr='$webvar{block}'");
-    $sth->execute;
-    $ip_dbh->commit;
-  };
-  if ($@) {
-    carp "Transaction aborted because $@";
-    eval { $ip_dbh->rollback; };
-    syslog "err", "$authuser could not update block '$webvar{block}': '$@'";
+  # Relatively simple SQL transaction here.  Note that we're deliberately NOT
+  # updating notes/desc here as it's available through the main interface.
+  $sth = $ip_dbh->prepare("update allocations set custid='$webvar{custid}',".
+        "city=?,type='$webvar{alloctype}' where cidr='$webvar{block}'");
+  $sth->execute($webvar{city});
+
+  $page->param(block => $webvar{block});
+  if ($sth->err) {
+    $page->param(updfailed => $sth->errstr);
+    syslog "err", "$authuser could not update block '$webvar{block}': '".$sth->errstr."'";
   } else {
-    # If we get here, the operation succeeded.
     syslog "notice", "$authuser updated $webvar{block}";
-    print "Allocation $webvar{block} updated<hr>\n";
   }
   # need to get /24 that block is part of
@@ -756 +606 @@
   $bits[3] = "0/24";
   showAllocs((join ".", @bits));
-}
+} # end update()
 
 
@@ -764 +614 @@
 sub showPool($) {
   my $pool = new NetAddr::IP $_[0];
-  print qq(Listing pool $pool:\n<table border=1>
-<form action=admin.cgi method=POST>
-<input type=hidden name=action value=updatepool>
-<tr><td align=right>Customer ID:</td><td><input name=custid></td></tr>
-<tr><td align=right>Customer location:</td><td><input name=city></td></tr>
-<tr><td align=right>Type:</td><td><select name=type><option selected>-</option>\n);
 
   $sth = $ip_dbh->prepare("select type,listname from alloctypes where type like '_i' order by listorder");
   $sth->execute;
-  while (my @data = $sth->fetchrow_array) {
-    print "<option value='$data[0]'>$data[1]</option>\n";
-  }
-
-  print qq(</select></td></tr>
-<tr><td align=right>Available?</td><td><input type=checkbox value=y></td></tr>
-<tr><td align=right>Description/name:</td><td><input name=desc size=40></td></tr>
-<tr><td align=right>Notes:</td><td><textarea name=notes rows=3 cols=40></textarea></td></tr>
-<tr><td colspan=2 align=center><input type=submit value="Update"></td></tr>
-).
-        "</table>Update the following record:<table border=1>\n";
-  $sth = $ip_dbh->prepare("select pool,ip,custid,city,type,available,description,notes from poolips where pool='$pool' order by ip");
-  $sth->execute;
-  while (my @data = $sth->fetchrow_array) {
-    print qq(<tr><td><input type=radio name=ip value="$data[1]">$data[1]</td>).
-        "<td>$data[2]</td><td>$data[3]</td><td>$data[4]</td>".
-        "<td>$data[5]</td><td>$data[6]</td><td>$data[7]</td></tr>\n";
-  }
-  print "</form></table>\n";
-}
+  my @typelist;
+  while (my ($type,$dispname) = $sth->fetchrow_array) {
+    my %row = (
+        type => $type,
+        dispname => $dispname
+        );
+    push @typelist, \%row;
+  }
+  $page->param(typelist => \@typelist);
+
+  $sth = $ip_dbh->prepare("select ip,custid,city,type,available,description,notes from poolips where pool='$pool' order by ip");
+  $sth->execute;
+  my @iplist;
+  while (my ($ip,$custid,$city,$type,$avail,$desc,$notes) = $sth->fetchrow_array) {
+    my %row = (
+        ip => $ip,
+        custid => $custid,
+        city => $city,
+        type => $type,
+        avail => $avail,
+        desc => $desc,
+        notes => $notes
+        );
+    push @iplist, \%row;
+  }
+  $page->param(iplist => \@iplist);
+} # end showPool()
 
 

branches/stable/cgi-bin/allocate.pl

@@ -11 +11 @@
 use warnings;
 use DBI;
-use CommonWeb qw(:ALL);
 use NetAddr::IP;
 
@@ -38 +37 @@
 my $errstr;
 ($ip_dbh,$errstr) = connectDB_My;
-if (!$ip_dbh) {
-  printAndExit("Failed to connect to database: $errstr\n");
-}
+die "Failed to connect to database: $errstr\n"
+        if !$ip_dbh;
+
 checkDBSanity($ip_dbh);
 initIPDBGlobals($ip_dbh);

branches/stable/cgi-bin/combineblocks.pl

@@ -13 +13 @@
 #use CGI::Carp qw(fatalsToBrowser);
 use DBI;
-#use CommonWeb qw(:ALL);
 #use POSIX qw(ceil);
 use NetAddr::IP;

branches/stable/cgi-bin/main.cgi

@@ -12 +12 @@
 use warnings;   
 use CGI::Carp qw(fatalsToBrowser);
+use CGI::Simple;
+use HTML::Template;
 use DBI;
-use CommonWeb qw(:ALL);
 use POSIX qw(ceil);
 use NetAddr::IP;
@@ -26 +27 @@
 
 openlog "IPDB","pid","$IPDB::syslog_facility";
+
+## Environment.  Collect some things, process some things, set some things...
 
 # Collect the username from HTTP auth.  If undefined, we're in
@@ -36 +39 @@
 }
 
+# anyone got a better name?  :P
+my $thingroot = $ENV{SCRIPT_FILENAME};
+$thingroot =~ s|cgi-bin/main.cgi||;
+
 syslog "debug", "$authuser active, $ENV{'REMOTE_ADDR'}";
+
+##fixme there *must* be a better order to do things in so this can go back where it was
+# CGI fiddling done here so we can declare %webvar so we can alter $webvar{action}
+# to show the right page on DB errors.
+# Set up the CGI object...
+my $q = new CGI::Simple;
+# ... and get query-string params as well as POST params if necessary
+$q->parse_query_string;
+
+# Convenience;  saves changing all references to %webvar
+##fixme:  tweak for handling <select multiple='y' size=3> (list with multiple selection)
+my %webvar = $q->Vars;
 
 # Why not a global DB handle?  (And a global statement handle, as well...)
@@ -45 +64 @@
 ($ip_dbh,$errstr) = connectDB_My;
 if (!$ip_dbh) {
-  exitError("Database error: $errstr\n");
-}
-initIPDBGlobals($ip_dbh);
-
-# Headerize!  Make sure we replace the $$EXTRA0$$ bit as needed.
-printHeader('', $IPDB::webpath, ($IPDBacl{$authuser} =~ /a/ ?
-        '<td align=right><a href="'.$IPDB::webpath.'/cgi-bin/main.cgi?action=assign">Add new assignment</a>' : ''
-        ));
-
-
-# Global variables
-my %webvar = parse_post();
-cleanInput(\%webvar);
+  $webvar{action} = "dberr";
+} else {
+  initIPDBGlobals($ip_dbh);
+}
+
+# Set up some globals
+$ENV{HTML_TEMPLATE_ROOT} = $thingroot."templates";
+
+my $header = HTML::Template->new(filename => "header.tmpl");
+my $footer = HTML::Template->new(filename => "footer.tmpl");
+
+$header->param(version => $IPDB::VERSION);
+$header->param(addperm => $IPDBacl{$authuser} =~ /a/);
+$header->param(webpath => $IPDB::webpath);
+print "Content-type: text/html\n\n", $header->output;
 
 
 #main()
+my $aclerr;
 
 if(!defined($webvar{action})) {
-  $webvar{action} = "<NULL>";   #shuts up the warnings.
+  $webvar{action} = "index";    #shuts up the warnings.
+}
+
+my $page;
+if (-e "$ENV{HTML_TEMPLATE_ROOT}/$webvar{action}.tmpl") {
+  $page = HTML::Template->new(filename => "$webvar{action}.tmpl");
+} else {
+  $page = HTML::Template->new(filename => "dunno.tmpl");
 }
 
@@ -70 +99 @@
 } elsif ($webvar{action} eq 'addmaster') {
   if ($IPDBacl{$authuser} !~ /a/) {
-    printError("You shouldn't have been able to get here.  Access denied.");
+    $aclerr = 'addmaster';
+  }
+} elsif ($webvar{action} eq 'newmaster') {
+
+  if ($IPDBacl{$authuser} !~ /a/) {
+    $aclerr = 'addmaster';
   } else {
-    open HTML, "<../addmaster.html";
-    my $html = join('',<HTML>);
-    close HTML;
-    $html =~ s/\$\$WEBPATH\$\$/$IPDB::webpath/g;
-    print $html;
-  }
-} elsif ($webvar{action} eq 'newmaster') {
-
-  if ($IPDBacl{$authuser} !~ /a/) {
-    printError("You shouldn't have been able to get here.  Access denied.");
-  } else {
-
     my $cidr = new NetAddr::IP $webvar{cidr};
-
-    print "<div type=heading align=center>Adding $cidr as master block....</div>\n";
+    $page->param(cidr => "$cidr");
 
     my ($code,$msg) = addMaster($ip_dbh, $webvar{cidr});
 
     if ($code eq 'FAIL') {
-      carp "Transaction aborted because $msg";
       syslog "err", "Could not add master block '$webvar{cidr}' to database: '$msg'";
-      printError("Could not add master block $webvar{cidr} to database: $msg");
+      $page->param(err => $msg);
     } else {
-      print "<div type=heading align=center>Success!</div>\n";
       syslog "info", "$authuser added master block $webvar{cidr}";
     }
@@ -136 +155 @@
 }
 elsif ($webvar{action} eq 'nodesearch') {
-  open HTML, "<../nodesearch.html";
-  my $html = join('',<HTML>);
-  close HTML;
-  $html =~ s/\$\$WEBPATH\$\$/$IPDB::webpath/g;
-
   $sth = $ip_dbh->prepare("SELECT node_id, node_name FROM nodes ORDER BY node_type,node_id");
-  $sth->execute() or print "DEBUG: failed retrieval from nodes: ".$sth->errstr,"<br>\n";
-  my $nodes = '';
+  $sth->execute() or $page->param(errmsg => $sth->errstr);
+  my @nodelist;
   while (my ($nid,$nname) = $sth->fetchrow_array()) {
-    $nodes .= "<option value='$nid'>$nname</option>\n";
-  }
-  $html =~ s/\$\$NODELIST\$\$/$nodes/;
-
-  print $html;
-}
-
-# Default is an error.  It shouldn't be possible to easily get here.
-# The only way I can think of offhand is to just call main.cgi bare-
-# which is not in any way guaranteed to provide anything useful.
+    my %row = (nodeid => $nid, nodename => $nname);
+    push @nodelist, \%row;
+  }
+  $page->param(nodelist => \@nodelist);
+}
+
+# DB failure.  Can't do much here, really.
+elsif ($webvar{action} eq 'dberr') {
+  $page->param(errmsg => $errstr);
+}
+
+# Default is an error.  It shouldn't be possible to get here unless you're
+# randomly feeding in values for webvar{action}.
 else {
   my $rnd = rand 500;
   my $boing = sprintf("%.2f", rand 500);
-  my @excuses = ("Aether cloudy.  Ask again later.","The gods are unhappy with your sacrifice.",
-        "Because one of it's legs are both the same", "*wibble*",
-        "Hey! Stop pushing my buttons!", "I ain't done nuttin'", "9",
-        "8", "9", "10", "11", "12", "13", "14", "15", "16", "17");
-  printAndExit("Error $boing:  ".$excuses[$rnd/30.0]);
+  my @excuses = (
+        "Aether cloudy.  Ask again later about $webvar{action}.",
+        "The gods are unhappy with your sacrificial $webvar{action}.",
+        "Because one of $webvar{action}'s legs are both the same",
+        "<b>wibble</b><br>Can't $webvar{action}, the grue will get me!<br>Can't $webvar{action}, the grue will get me!",
+        "Hey, man, you've had your free $webvar{action}.  Next one's gonna...  <i>cost</i>....",
+        "I ain't done $webvar{action}",
+        "Oooo, look!  A flying $webvar{action}!",
+        "$webvar{action} too evil, avoiding.",
+        "Rocks fall, $webvar{action} dies.",
+        "Bit bucket must be emptied before I can $webvar{action}..."
+        );
+  $page->param(dunno => $excuses[$rnd/50.0]);
 }
 ## Finally! Done with that NASTY "case" emulation!
 
+
+# Switch to a different template if we've tripped on an ACL error.
+# Note that this should only be exercised in development, when
+# deeplinked, or when being attacked;  normal ACL handling should
+# remove the links a user is not allowed to click on.
+if ($aclerr) {
+  $page = HTML::Template->new(filename => "aclerror.tmpl");
+  $page->param(ipdbfunc => $aclmsg{$aclerr});
+}
 
 
@@ -171 +205 @@
 finish($ip_dbh);
 
-print qq(<div align=right style="position: absolute; right: 30px;">).
-        qq(<a href="$IPDB::webpath/cgi-bin/admin.cgi">Admin tools</a></div><br>\n)
-        if $IPDBacl{$authuser} =~ /A/;
-
-# We print the footer here, so we don't have to do it elsewhere.
-printFooter;
+## Do all our printing here so we can generate errors and stick them into the slots in the templates.
+
+# can't do this yet, too many blowups
+#print "Content-type: text/html\n\n", $header->output;
+$page->param(webpath => $IPDB::webpath);
+print $page->output;
+
+# include the admin tools link in the output?
+$footer->param(adminlink => ($IPDBacl{$authuser} =~ /A/));
+$footer->param(webpath => $IPDB::webpath);
+print $footer->output;
+
 # Just in case something waaaayyy down isn't in place
 # properly... we exit explicitly.
-exit;
-
-
-
-# args are: a reference to an array with the row to be printed and the 
-# class(stylesheet) to use for formatting.
-# if ommitting the class - call the sub as &printRow(\@array)
-sub printRow {
-  my ($rowRef,$class) = @_;
-
-  if (!$class) {
-    print "<tr>\n";
-  } else {
-    print "<tr class=\"$class\">\n";
-  }
-
-ELEMENT:  foreach my $element (@$rowRef) {
-    if (!defined($element)) {
-      print "<td></td>\n";
-      next ELEMENT;
-    }
-    $element =~ s|\n|</br>|g;
-    print "<td>$element</td>\n";
-  }
-  print "</tr>";
-} # printRow
-
-
-# Prints table headings.  Accepts any number of arguments;
-# each argument is a table heading.
-sub startTable {
-  print qq(<center><table width="98%" cellspacing="0" class="center"><tr>);
-
-  foreach(@_) {
-    print qq(<td class="heading">$_</td>);
-  }
-  print "</tr>\n";
-} # startTable
+exit 0;
 
 
 # Initial display:  Show master blocks with total allocated subnets, total free subnets
 sub showSummary {
-
-  startTable('Master netblock', 'Routed netblocks', 'Allocated netblocks',
-        'Free netblocks', 'Largest free block');
-
   my %allocated;
   my %free;
@@ -264 +263 @@
   }
 
-  # Print the data.
-  my $count=0;
+  # Assemble the data to stuff into the template.
+  my @masterlist;
+  my $rowclass=0;
   foreach my $master (@masterblocks) {
-    my @row = ("<a href=\"$IPDB::webpath/cgi-bin/main.cgi?action=showmaster&block=$master\">$master</a>",
-        $routed{"$master"}, $allocated{"$master"}, $free{"$master"}, 
-        ( ($bigfree{"$master"} eq '') ? ("&lt;NONE&gt;") : ("/".$bigfree{"$master"}) )
+    my %row = (
+        rowclass => $rowclass++ % 2,
+        master => "$master",
+        routed => $routed{"$master"},
+        allocated => $allocated{"$master"},
+        free => $free{"$master"},
+        bigfree => ( ($bigfree{"$master"} eq '') ? ("&lt;NONE&gt;") : ("/".$bigfree{"$master"}) )
         );
-
-    printRow(\@row, 'color1' ) if($count%2==0);
-    printRow(\@row, 'color2' ) if($count%2!=0);
-    $count++;
-  }
-  print "</table>\n";
-  if ($IPDBacl{$authuser} =~ /a/) {
-    print qq(<a href="$IPDB::webpath/cgi-bin/main.cgi?action=addmaster">Add new master block</a><br><br>\n);
-  }
-  print "Note:  Free blocks noted here include both routed and unrouted blocks.\n";
+    push (@masterlist, \%row);
+  }
+  $page->param(masterlist => \@masterlist);
+
+  $page->param(addmaster => ($IPDBacl{$authuser} =~ /a/) );
 
 } # showSummary
@@ -292 +291 @@
 sub showMaster {
 
-  print qq(<center><div class="heading">Summarizing routed blocks for ).
-        qq($webvar{block}:</div></center><br>\n);
+  $page->param(master => $webvar{block});
 
   my %allocated;
   my %free;
-  my %routed;
+  my %cities;
   my %bigfree;
 
@@ -315 +313 @@
     $bigfree{"$cidr"} = 128;
     # Retain the routing destination
-    $routed{"$cidr"} = $data[1];
+    $cities{"$cidr"} = $data[1];
   }
 
   # Check if there were actually any blocks routed from this master
   if ($i > 0) {
-    startTable('Routed block','Routed to','Allocated blocks',
-        'Free blocks','Largest free block');
 
     # Count the allocations
@@ -349 +345 @@
     }
 
-    # Print the data.
-    my $count=0;
+    my @routed;
+    my $rowclass = 0;
     foreach my $master (@localmasters) {
-      my @row = ("<a href=\"$IPDB::webpath/cgi-bin/main.cgi?action=showrouted&block=$master\">$master</a>",
-        $routed{"$master"}, $allocated{"$master"},
-        $free{"$master"},
-        ( ($bigfree{"$master"} eq 128) ? ("&lt;NONE&gt;") : ("/".$bigfree{"$master"}) )
-      );
-      printRow(\@row, 'color1' ) if($count%2==0);
-      printRow(\@row, 'color2' ) if($count%2!=0);
-      $count++;
-    }
-  } else {
-    # If a master block has no routed blocks, then by definition it has no
-    # allocations, and can be deleted.
-    print qq(<hr width="60%"><center><div class="heading">No allocations in ).
-        qq($master.</div>\n).
-        ($IPDBacl{$authuser} =~ /d/ ?
-                qq(<form action="$IPDB::webpath/cgi-bin/main.cgi" method=POST>\n).
-                qq(<input type=hidden name=action value="delete">\n).
-                qq(<input type=hidden name=block value="$master">\n).
-                qq(<input type=hidden name=alloctype value="mm">\n).
-                qq(<input type=submit value=" Remove this master ">\n).
-                qq(</form></center>\n) :
-                '');
+      my %row = (
+        rowclass => $rowclass++ % 2,
+        block => "$master",
+        city => $cities{"$master"},
+        nsubs => $allocated{"$master"},
+        nfree => $free{"$master"},
+        lfree => ( ($bigfree{"$master"} eq 128) ? ("&lt;NONE&gt;") : ("/".$bigfree{"$master"}) )
+        );
+      push @routed, \%row;
+    }
+    $page->param(routedlist => \@routed);
 
   } # end check for existence of routed blocks in master
 
-  print qq(</table>\n<hr width="60%">\n).
-        qq(<center><div class="heading">Unrouted blocks in $master:</div></center><br>\n);
-
-  startTable('Netblock','Range');
+  $page->param(delmaster => ($IPDBacl{$authuser} =~ /d/));
 
   # Snag the free blocks.
@@ -387 +369 @@
         "routed='n' order by cidr");
   $sth->execute();
+  my @unrouted;
+  my $rowclass = 0;
   while (my @data = $sth->fetchrow_array()) {
     my $cidr = new NetAddr::IP $data[0];
-    my @row = (
-        ($IPDBacl{$authuser} =~ /a/ ?
-                qq(<a href="$IPDB::webpath/cgi-bin/main.cgi?action=assign&block=$cidr&fbtype=n">$cidr</a>)
-                : $cidr),
-        $cidr->range);
-    printRow(\@row, 'color1' ) if($count%2==0);
-    printRow(\@row, 'color2' ) if($count%2!=0);
-    $count++;
-  }
-
-  print "</table>\n";
+    my %row = (
+        rowclass => $rowclass++ % 2,
+        fblock => "$cidr",
+        frange => $cidr->range
+        );
+    push @unrouted, \%row;
+  }
+  $page->param(unrouted => \@unrouted);
+
 } # showMaster
 
@@ -416 +398 @@
   $sth = $ip_dbh->prepare("select city from routed where cidr='$master'");
   $sth->execute;
-  my @data = $sth->fetchrow_array;
-
-  print qq(<center><div class="heading">Summarizing allocated blocks for ).
-        qq($master ($data[0]):</div></center><br>\n);
-
-  startTable('CIDR allocation','Customer Location','Type','CustID','SWIPed?','Description/Name');
+  my ($rcity) = $sth->fetchrow_array;
+
+  $page->param(master => "$master");
+  $page->param(rcity => $rcity);
 
   # Snag the allocations for this block
@@ -432 +412 @@
   my $custsth = $ip_dbh->prepare("select count(*) from customers where custid=?");
 
-  my $count=0;
-  while (my @data = $sth->fetchrow_array()) {
-    # cidr,city,type,custid,swip,description, as per the SELECT
-    my $cidr = new NetAddr::IP $data[0];
-
-    # Clean up extra spaces that are borking things.
-#    $data[2] =~ s/\s+//g;
-
-    $custsth->execute($data[3]);
+  my $rowclass = 0;
+  my @blocklist;
+  while (my ($cidr,$city,$type,$custid,$swip,$desc) = $sth->fetchrow_array()) {
+    $custsth->execute($custid);
     my ($ncust) = $custsth->fetchrow_array();
 
-    # Prefix subblocks with "Sub "
-    my @row = ( (($data[2] =~ /^.r$/) ? 'Sub ' : '').
-        qq(<a href="$IPDB::webpath/cgi-bin/main.cgi?action=edit&block=$data[0]&reallyblock=1">$data[0]</a>),
-        $data[1], $disp_alloctypes{$data[2]}, $data[3], 
-        ($data[4] eq 'y' ? ($ncust == 0 ? 'Yes<small>*</small>' : 'Yes') : 'No'), $data[5]);
-    # If the allocation is a pool, allow listing of the IPs in the pool.
-    if ($data[2] =~ /^.[pd]$/) {
-      $row[0] .= qq( &nbsp; <a href="$IPDB::webpath/cgi-bin/main.cgi?action=listpool).
-        "&pool=$data[0]\">List IPs</a>";
-    }
-
-    printRow(\@row, 'color1') if ($count%2 == 0);
-    printRow(\@row, 'color2') if ($count%2 != 0);
-    $count++;
-  }
-
-  print "</table>\n";
-
-  # If the routed block has no allocations, by definition it only has
-  # one free block, and therefore may be deleted.
-  if ($count == 0) {
-    print qq(<hr width="60%"><center><div class="heading">No allocations in ).
-        qq($master.</div></center>\n).
-        ($IPDBacl{$authuser} =~ /d/ ?
-                qq(<form action="$IPDB::webpath/cgi-bin/main.cgi" method=POST>\n).
-                qq(<input type=hidden name=action value="delete">\n).
-                qq(<input type=hidden name=block value="$master">\n).
-                qq(<input type=hidden name=alloctype value="rm">\n).
-                qq(<input type=submit value=" Remove this block ">\n).
-                qq(</form>\n) :
-                '');
-  }
-
-  print qq(<hr width="60%">\n<center><div class="heading">Free blocks within routed ).
-        qq(submaster $master</div></center>\n);
-
-  startTable('CIDR block','Range');
+    my %row = (
+        rowclass => $rowclass++ % 2,
+        block => $cidr,
+        city => $city,
+        type => $disp_alloctypes{$type},
+        custid => $custid,
+        swip => ($swip eq 'y' ? ($ncust == 0 ? 'Yes<small>*</small>' : 'Yes') : 'No'),
+        desc => $desc
+        );
+    $row{subblock} = ($type =~ /^.r$/);         # hmf.  wonder why these won't work in the hash declaration...
+    $row{listpool} = ($type =~ /^.[pd]$/);
+    push (@blocklist, \%row);
+  }
+  $page->param(blocklist => \@blocklist);
+
+  $page->param(delrouted => $IPDBacl{$authuser} =~ /d/);
 
   # Snag the free blocks.  We don't really *need* to be pedantic about avoiding
   # unrouted free blocks, but it's better to let the database do the work if we can.
-  $count = 0;
+  $rowclass = 0;
+  my @unassigned;
   $sth = $ip_dbh->prepare("select cidr,routed from freeblocks where cidr <<= '$master'".
         " order by cidr");
   $sth->execute();
-  while (my @data = $sth->fetchrow_array()) {
-    # cidr,routed
-    my $cidr = new NetAddr::IP $data[0];
-    # Include some HairyPerl(TM) to prefix subblocks with "Sub "
-    my @row = ((($data[1] ne 'y' && $data[1] ne 'n') ? 'Sub ' : '').
-        ($IPDBacl{$authuser} =~ /a/ ? qq(<a href="$IPDB::webpath/cgi-bin/main.cgi?action=assign&block=$cidr&fbtype=$data[1]">$cidr</a>) : $cidr),
-        $cidr->range);
-    printRow(\@row, 'color1') if ($count%2 == 0);
-    printRow(\@row, 'color2') if ($count%2 != 0);
-    $count++;
-  }
-
-  print "</table>\n";
+  while (my ($cidr_db,$routed) = $sth->fetchrow_array()) {
+    my $cidr = new NetAddr::IP $cidr_db;
+
+    my %row = (
+        rowclass => $rowclass++ % 2,
+        subblock => ($routed ne 'y' && $routed ne 'n'),
+        fblock => $cidr_db,
+        fbtype => $routed,
+        frange => $cidr->range,
+        );
+    push @unassigned, \%row;
+  }
+  $page->param(unassigned => \@unassigned);
+
 } # showRBlock
 
@@ -508 +464 @@
   my $cidr = new NetAddr::IP $webvar{pool};
 
-  my ($pooltype,$poolcity);
+  $page->param(block => $webvar{pool});
+  $page->param(netip => $cidr->addr);
+  $cidr++;
+  $page->param(gate => $cidr->addr);
+  $cidr--;  $cidr--;
+  $page->param(bcast => $cidr->addr);
+  $page->param(mask => $cidr->mask);
 
   # Snag pool info for heading
-  $sth = $ip_dbh->prepare("select type,city from allocations where cidr='$cidr'");
-  $sth->execute;
-  $sth->bind_columns(\$pooltype, \$poolcity);
-  $sth->fetch() || carp $sth->errstr;
-
-  print qq(<center><div class="heading">Listing pool IPs for $cidr<br>\n).
-        qq(($disp_alloctypes{$pooltype} in $poolcity)</div></center><br>\n);
+  $sth = $ip_dbh->prepare("select type,city from allocations where cidr=?");
+  $sth->execute($webvar{pool});
+  my ($pooltype, $poolcity) = $sth->fetchrow_array;
+
+  $page->param(disptype => $disp_alloctypes{$pooltype});
+  $page->param(city => $poolcity);
+
   # Only display net/gw/bcast if it's a "real" netblock and not a PPP(oE) lunacy
-  if ($pooltype =~ /^.d$/) {
-    print qq(<div class="indent"><b>Reserved IPs:</b><br>\n);
-    print qq(<div class="indent"><table><tr class=color1><td>Network IP:</td><td>).
-        $cidr->addr."</td></tr>\n";
-    $cidr++;
-    print "<tr class=color2><td>Gateway:</td><td>".$cidr->addr."</td></tr>\n";
-    $cidr--;  $cidr--;
-    print "<tr class=color1><td>Broadcast:</td><td>".$cidr->addr."</td></tr>\n".
-        "<tr><td>Netmask:</td><td>".$cidr->mask."</td></tr>\n".
-        "</table></div></div>\n";
-  }
+  $page->param(realblock => $pooltype =~ /^.d$/);
 
 # probably have to add an "edit IP allocation" link here somewhere.
 
-  startTable('IP','Customer ID','Available?','Description','');
   $sth = $ip_dbh->prepare("select ip,custid,available,description,type".
         " from poolips where pool='$webvar{pool}' order by ip");
   $sth->execute;
-  my $count = 0;
-  while (my @data = $sth->fetchrow_array) {
-    # pool,ip,custid,city,ptype,available,notes,description,circuitid
-    # ip,custid,available,description,type
-    # If desc is "null", make it not null.  <g>
-    if ($data[3] eq '') {
-      $data[3] = '&nbsp;';
-    }
-    # Some nice hairy Perl to decide whether to allow unassigning each IP
-    #   -> if $data[2] (aka poolips.available) == 'n' then we print the unassign link
-    #      else we print a blank space
-    my @row;
-    if ($data[2] eq 'y' && $IPDBacl{$authuser} =~ /a/) {
-      push @row, qq(<a href="$IPDB::webpath/cgi-bin/main.cgi?action=assign&block=$data[0]&fbtype=i">$data[0]</a>);
-    } else {
-      push @row, qq(<a href="$IPDB::webpath/cgi-bin/main.cgi?action=edit&block=$data[0]">$data[0]</a>);
-    }
-    push @row, (
-        $data[1],$data[2],$data[3],
-        ( (($data[2] eq 'n') && ($IPDBacl{$authuser} =~ /d/)) ?
-          ("<a href=\"$IPDB::webpath/cgi-bin/main.cgi?action=delete&block=$data[0]&".
-           "alloctype=$data[4]\">Unassign this IP</a>") :
-          ("&nbsp;") )
+  my @poolips;
+  my $rowclass = 0;
+  while (my ($ip,$custid,$available,$desc,$type) = $sth->fetchrow_array) {
+    my %row = (
+        rowclass => $rowclass++ % 2,
+        ip => $ip,
+        custid => $custid,
+        available => $available,
+        desc => $desc,
+        maydel => $IPDBacl{$authuser} =~ /d/,
+        delme => $available eq 'n'
         );
-    printRow(\@row, 'color1') if($count%2==0);
-    printRow(\@row, 'color2') if($count%2!=0);
-    $count++;
-  }
-  print "</table>\n";
+    push @poolips, \%row;
+  }
+  $page->param(poolips => \@poolips);
 
 } # end listPool
@@ -575 +512 @@
 
   if ($IPDBacl{$authuser} !~ /a/) {
-    printError("You shouldn't have been able to get here.  Access denied.");
+    $aclerr = 'addblock';
     return;
   }
 
-  my $html;
+  # hack pthbttt eww
+  $webvar{block} = '' if !$webvar{block};
+
+# hmm.  TMPL_IF block and TMPL_ELSE block on these instead?
+  $page->param(rowa => 'row'.($webvar{block} eq '' ? 1 : 0));
+  $page->param(rowb => 'row'.($webvar{block} eq '' ? 0 : 1));
+  $page->param(block => $webvar{block});        # fb-assign flag, if block is set, we're in fb-assign
+  $page->param(iscontained => ($webvar{fbtype} && $webvar{fbtype} ne 'y'));
 
   # New special case- block to assign is specified
   if ($webvar{block} ne '') {
-    open HTML, "../fb-assign.html"
-        or croak "Could not open fb-assign.html: $!";
-    $html = join('',<HTML>);
-    close HTML;
     my $block = new NetAddr::IP $webvar{block};
 
-    my $typelist = '';
-
-    $html =~ s|\$\$WEBPATH\$\$|$IPDB::webpath|g;
-    if ($IPDB::allowprivrange eq 'y' or $IPDB::allowprivrange eq 'on') {
-      $html =~ s/\$\$ALLOWPRIV\$\$/checked=checked/;
-    } else {
-      $html =~ s/\$\$ALLOWPRIV\$\$//;
-    }
-
+    # Handle contained freeblock allocation.
     # This is a little dangerous, as it's *theoretically* possible to
     # get fbtype='n' (aka a non-routed freeblock).  However, should
     # someone manage to get there, they get what they deserve.
-#    if ($webvar{fbtype} ne 'y') {
-#      # Snag the type of the block from the database.  We have no
-#      # convenient way to pass this in from the calling location.  :/
-#      $sth = $ip_dbh->prepare("select type from allocations where cidr >>='$block'");
-#      $sth->execute;
-#      my @data = $sth->fetchrow_array;
-#      $data[0] =~ s/c$/r/;     # Munge the type into the correct form
-#      $typelist = "$list_alloctypes{$data[0]}<input type=hidden name=alloctype value=$data[0]>\n";
-#    } else {
-if ($webvar{fbtype} eq 'n') {
-  $typelist = "Routed netblock<input type=hidden name=alloctype value=rm>\n";
-  $html =~ s|\$\$ALLOCBLOCK\$\$|<input name=block size=25 value="$block">|;
-  $html =~ s|\$\$BLOCK\$\$|$block|g;
-} elsif ($webvar{fbtype} eq 'i') {
-  my ($iptype,$pool) = $ip_dbh->selectrow_array("SELECT type,pool FROM poolips WHERE ip = ?", undef, ($block));
-  $typelist = "$list_alloctypes{$iptype}<input type=hidden name=alloctype value=$iptype>\n";
-  $html =~ s|\$\$ALLOCBLOCK\$\$|$block<input type=hidden name=block size=25 value="$block">|;
-  $html =~ s|\$\$BLOCK\$\$|$pool|g;
-} else {
-  $html =~ s|\$\$ALLOCBLOCK\$\$|<input name=block size=25 value="$block">|;
-  $html =~ s|\$\$BLOCK\$\$|$block|g;
-      $typelist .= qq(<select name="alloctype">\n);
+    if ($webvar{fbtype} ne 'y') {
+      # Snag the type of the container block from the database.
+      $sth = $ip_dbh->prepare("select type from allocations where cidr >>='$block'");
+      $sth->execute;
+      my @data = $sth->fetchrow_array;
+      $data[0] =~ s/c$/r/;      # Munge the type into the correct form
+      $page->param(fbdisptype => $list_alloctypes{$data[0]});
+      $page->param(type => $data[0]);
+    } else {
       $sth = $ip_dbh->prepare("select type,listname from alloctypes where listorder < 500 ".
         "and type not like '_i' order by listorder");
       $sth->execute;
-      my @data = $sth->fetchrow_array;
-      $typelist .= "<option value='$data[0]' selected>$data[1]</option>\n";
-      while (@data = $sth->fetchrow_array) {
-        $typelist .= "<option value='$data[0]'>$data[1]</option>\n";
+      my @typelist;
+      my $selflag = 0;
+      while (my @data = $sth->fetchrow_array) {
+        my %row = (tval => $data[0],
+                type => $data[1],
+                sel => ($selflag == 0 ? ' selected' : '')
+                );
+        push (@typelist, \%row);
+        $selflag++;
       }
-      $typelist .= "</select>\n";
-    }
-    $html =~ s|\$\$TYPELIST\$\$|$typelist|g;
+      $page->param(typelist => \@typelist);
+    }
   } else {
-    open HTML, "../assign.html"
-        or croak "Could not open assign.html: $!";
-    $html = join('',<HTML>);
-    close HTML;
-    $html =~ s|\$\$WEBPATH\$\$|$IPDB::webpath|g;
-    if ($IPDB::allowprivrange eq 'y' or $IPDB::allowprivrange eq 'on') {
-      $html =~ s/\$\$ALLOWPRIV\$\$/checked=checked/;
-    } else {
-      $html =~ s/\$\$ALLOWPRIV\$\$//;
-    }
-    my $masterlist = "<select name=allocfrom><option selected>-</option>\n";
+    my @masterlist;
     foreach my $master (@masterblocks) {
-      $masterlist .= "<option>$master</option>\n";
-    }
-    $masterlist .= "</select>\n";
-    $html =~ s|\$\$MASTERLIST\$\$|$masterlist|g;
-    my $pops = '';
+      my %row = (master => "$master");
+      push (@masterlist, \%row);
+    }
+    $page->param(masterlist => \@masterlist);
+
+    my @pops;
     foreach my $pop (@poplist) {
-      $pops .= "<option>$pop</option>\n";
-    }
-    $html =~ s|\$\$POPLIST\$\$|$pops|g;
-    my $typelist = '';
-    $sth = $ip_dbh->prepare("select type,listname from alloctypes where listorder < 900 order by listorder");
+      my %row = (pop => $pop);
+      push (@pops, \%row);
+    }
+    $page->param(pops => \@pops);
+
+    # could arguably include routing (500) in the list, but ATM it doesn't
+    # make sense, and in any case that shouldn't be structurally possible here.
+    $sth = $ip_dbh->prepare("select type,listname from alloctypes where listorder <= 500 order by listorder");
     $sth->execute;
-    my @data = $sth->fetchrow_array;
-    $typelist .= "<option value='$data[0]' selected>$data[1]</option>\n";
+    my @typelist;
+    my $selflag = 0;
     while (my @data = $sth->fetchrow_array) {
-      $typelist .= "<option value='$data[0]'>$data[1]</option>\n";
-    }
-    $html =~ s|\$\$TYPELIST\$\$|$typelist|g;
-  }
-  my $cities = '';
+      my %row = (tval => $data[0],
+        type => $data[1],
+        sel => ($selflag == 0 ? ' selected' : '')
+        );
+      push (@typelist, \%row);
+      $selflag++;
+    }
+    $page->param(typelist => \@typelist);
+  }
+
+  my @cities;
   foreach my $city (@citylist) {
-    $cities .= "<option>$city</option>\n";
-  }
-  $html =~ s|\$\$ALLCITIES\$\$|$cities|g;
+    my %row = (city => $city);
+    push (@cities, \%row);
+  }
+  $page->param(citylist => \@cities);
 
 ## node hack
   $sth = $ip_dbh->prepare("SELECT node_id, node_name FROM nodes ORDER BY node_type,node_id");
   $sth->execute() or print "DEBUG: failed retrieval from nodes: ".$sth->errstr,"<br>\n";
-  my $nodes = '';
+  my @nodes;
   while (my ($nid,$nname) = $sth->fetchrow_array()) {
-    $nodes .= "<option value='$nid'>$nname</option>\n";
-  }
-  $html =~ s/\$\$NODELIST\$\$/$nodes/;
+    my %row = (nid => $nid, nname => $nname);
+    push (@nodes, \%row);
+  }
+  $page->param(nodelist => \@nodes);
 ## end node hack
 
-  my $i = 0;
-  $i++ if $webvar{fbtype} eq 'y';
-  # Check to see if user is allowed to do anything with sensitive data
-  my $privdata = '';
-  if ($IPDBacl{$authuser} =~ /s/) {
-    $privdata = qq(<tr class="color).($i%2).qq("><td>Restricted data:</td>).
-        qq(<td class=regular><textarea rows="3" cols="64" name="privdata" class="regular">).
-        qq(</textarea></td></tr>\n);
-    $i++;
-  }
-  $html =~ s/\$\$PRIVDATA\$\$/$privdata/g;
-
-  $i = $i % 2;
-  $html =~ s/\$\$BUTTONROWCOLOUR\$\$/color$i/;
-
-  print $html;
+  $page->param(privdata => $IPDBacl{$authuser} =~ /s/);
 
 } # assignBlock
@@ -705 +615 @@
 sub confirmAssign {
   if ($IPDBacl{$authuser} !~ /a/) {
-    printError("You shouldn't have been able to get here.  Access denied.");
+    $aclerr = 'addblock';
     return;
   }
@@ -731 +641 @@
     $sth->execute;
     my $optionlist;
-    while (my @data = $sth->fetchrow_array) {
+
+    my @poollist;
+    while (my ($poolcit,$poolblock,$poolfree) = $sth->fetchrow_array) {
       # city,pool cidr,free IP count
-      if ($data[2] > 0) {
-        $optionlist .= "<option value='$data[1]'>$data[1] [$data[2] free IP(s)] in $data[0]</option>\n";
+      if ($poolfree > 0) {
+        my %row = (poolcit => $poolcit, poolblock => $poolblock, poolfree => $poolfree);
+        push (@poollist, \%row);
       }
     }
+    $page->param(staticip => 1);
+    $page->param(poollist => \@poollist);
     $cidr = "Single static IP";
-    $alloc_from = "<select name=alloc_from>".$optionlist."</select>\n";
+##fixme:  need to handle "no available pools"
 
   } else { # end show pool options
@@ -751 +666 @@
 
       if (!$webvar{maskbits}) {
-        printError("Please specify a CIDR mask length.");
+        $page->param(err => "Please specify a CIDR mask length.");
         return;
       }
@@ -789 +704 @@
             " block size for the pool.";
         } else {
+          if (!$webvar{pop}) {
+            $page->param(err => 'Please select a POP to route the block from/through.');
+            return;
+          }
           $city = $webvar{pop};
           $failmsg = "No suitable free block found.<br>\nYou will have to route another".
@@ -810 +729 @@
       my @data = $sth->fetchrow_array();
       if ($data[0] eq "") {
-        printError($failmsg);
+        $page->param(err => $failmsg);
         return;
       }
@@ -829 +748 @@
     } # check for freeblocks assignment or IPDB-controlled assignment
 
+    $alloc_from = "$cidr";
 
   } # if ($webvar{alloctype} =~ /^.i$/)
-
-  open HTML, "../confirm.html"
-        or croak "Could not open confirm.html: $!";
-  my $html = join '', <HTML>;
-  close HTML;
 
 ## node hack
@@ -842 +757 @@
     $sth->execute($webvar{node});
     my ($nodename) = $sth->fetchrow_array();
-    $html =~ s/\$\$NODENAME\$\$/$nodename/;
-    $html =~ s/\$\$NODEID\$\$/$webvar{node}/;
-  } else {
-    $html =~ s/\$\$NODENAME\$\$//;
-    $html =~ s/\$\$NODEID\$\$//;
+    $page->param(nodename => $nodename);
+    $page->param(nodeid => $webvar{node});
   }
 ## end node hack
 
-### gotta fix this in final
-  # Stick in customer info as necessary - if it's blank, it just ends
-  # up as blank lines ignored in the rendering of the page
-        my $custbits;
-  $html =~ s|\$\$CUSTBITS\$\$|$custbits|g;
-###
-
   # Stick in the allocation data
-  $html =~ s|\$\$ALLOC_TYPE\$\$|$webvar{alloctype}|g;
-  $html =~ s|\$\$TYPEFULL\$\$|$disp_alloctypes{$webvar{alloctype}}|g;
-  $html =~ s|\$\$ALLOC_FROM\$\$|$alloc_from|g;
-  $html =~ s|\$\$CIDR\$\$|$cidr|g;
-  $webvar{city} = desanitize($webvar{city});
-  $html =~ s|\$\$CITY\$\$|$webvar{city}|g;
-  $html =~ s|\$\$CUSTID\$\$|$webvar{custid}|g;
-  $webvar{circid} = desanitize($webvar{circid});
-  $html =~ s|\$\$CIRCID\$\$|$webvar{circid}|g;
-  $webvar{desc} = desanitize($webvar{desc});
-  $html =~ s|\$\$DESC\$\$|$webvar{desc}|g;
-  $webvar{notes} = desanitize($webvar{notes});
-  $html =~ s|\$\$NOTES\$\$|$webvar{notes}|g;
-  $html =~ s|\$\$ACTION\$\$|insert|g;
-
-  my $i=1;
+  $page->param(alloc_type => $webvar{alloctype});
+  $page->param(typefull => $q->escapeHTML($disp_alloctypes{$webvar{alloctype}}));
+  $page->param(alloc_from => $alloc_from);
+  $page->param(cidr => $cidr);
+  $page->param(city => $q->escapeHTML($webvar{city}));
+  $page->param(custid => $webvar{custid});
+  $page->param(circid => $q->escapeHTML($webvar{circid}));
+  $page->param(desc => $q->escapeHTML($webvar{desc}));
+
+##fixme: find a way to have the displayed copy have <br> substitutions
+# for newlines, and the <input> value have either encoded or bare newlines.
+# Also applies to privdata.
+  $page->param(notes => $q->escapeHTML($webvar{notes},'y'));
+
   # Check to see if user is allowed to do anything with sensitive data
   my $privdata = '';
-  if ($IPDBacl{$authuser} =~ /s/) {
-    $privdata = qq(<tr class="color).($i%2).qq("><td>Restricted data:</td>).
-        qq(<td class=regular>$webvar{privdata}).
-        qq(<input type=hidden name=privdata value="$webvar{privdata}"></td></tr>\n);
-    $i++;
-  }
-# We're going to abuse $$PRIVDATA$$ to stuff in some stuff for billing.
-  $privdata .= "<input type=hidden name=billinguser value=$webvar{userid}>\n"
+  $page->param(privdata => $q->escapeHTML($webvar{privdata},'y'))
+        if $IPDBacl{$authuser} =~ /s/;
+
+  # Yay!  This now has it's very own little home.
+  $page->param(billinguser => $webvar{userid})
         if $webvar{userid};
-  $html =~ s/\$\$PRIVDATA\$\$/$privdata/g;
-
-  $i = $i % 2;
-  $html =~ s/\$\$BUTTONROWCOLOUR\$\$/color$i/;
-
-  print $html;
+
+##fixme:  this is only needed iff confirm.tmpl and
+# confirmRemove.tmpl are merged (quite possible, just
+# a little tedious)
+  $page->param(action => "insert");
 
 } # end confirmAssign
@@ -898 +797 @@
 sub insertAssign {
   if ($IPDBacl{$authuser} !~ /a/) {
-    printError("You shouldn't have been able to get here.  Access denied.");
+    $aclerr = 'addblock';
     return;
   }
@@ -910 +809 @@
   # successful netblock allocation, the IP allocated for static
   # IP, or the error message if an error occurred.
+
   my ($code,$msg) = allocateBlock($ip_dbh, $webvar{fullcidr}, $webvar{alloc_from},
         $webvar{custid}, $webvar{alloctype}, $webvar{city}, $webvar{desc}, $webvar{notes},
@@ -917 +817 @@
     if ($webvar{alloctype} =~ /^.i$/) {
       $msg =~ s|/32||;
-      print qq(<div class="center"><div class="heading">The IP $msg has been allocated to customer $webvar{custid}</div>).
-        ( ($webvar{alloctype} eq 'di' && $webvar{billinguser}) ?
-                qq(<div><a href="https://billing.example.com/radius.pl?).
-                "action=new_radius_user&custid=$webvar{custid}&userid=$webvar{billinguser}".
-                qq(&ipdb=1&ip=$msg">Add this IP to RADIUS user table</a></div>)
-        : "</div>");
+      $page->param(staticip => $msg);
+      $page->param(custid => $webvar{custid});
+      $page->param(billinguser => $webvar{billinguser});
       mailNotify($ip_dbh, "a$webvar{alloctype}", "ADDED: $disp_alloctypes{$webvar{alloctype}} allocation",
         "$disp_alloctypes{$webvar{alloctype}} $msg allocated to customer $webvar{custid}\n".
@@ -928 +825 @@
     } else {
       my $netblock = new NetAddr::IP $webvar{fullcidr};
-      if ($code eq 'OK') {
-        print qq(<div class="center"><div class="heading">The block $webvar{fullcidr} was ).
-                "sucessfully added as: $disp_alloctypes{$webvar{alloctype}}</div>";
-      } else {
-        print qq(<div class="center"><div class="heading">The block $webvar{fullcidr} was ).
-                " added as $disp_alloctypes{$webvar{alloctype}} with a warning:<br>$msg</div>";
+      $page->param(fullcidr => $webvar{fullcidr});
+      $page->param(alloctype => $disp_alloctypes{$webvar{alloctype}});
+      $page->param(custid => $webvar{custid});
+      if ($webvar{alloctype} eq 'pr' && $webvar{billinguser}) {
+        $page->param(billinguser => $webvar{billinguser});
+        $page->param(custid => $webvar{custid});
+        $page->param(netaddr => $netblock->addr);
+        $page->param(masklen => $netblock->masklen);
       }
-      print ( ($webvar{alloctype} eq 'pr' && $webvar{billinguser}) ?
-                qq(<div><a href="https://billing.example.com/radius.pl?).
-                "action=new_radius_user&custid=$webvar{custid}&userid=$webvar{billinguser}".
-                "&route_subnet=".$netblock->addr."&subnet_slash=".$netblock->masklen.
-                "&include_routed_subnet=1&ipdb=1".
-                qq(">Add this netblock to RADIUS user table</a></div>)
-        : "</div>");
       mailNotify($ip_dbh, "a$webvar{alloctype}", "ADDED: $disp_alloctypes{$webvar{alloctype}} allocation",
         "$disp_alloctypes{$webvar{alloctype}} $webvar{fullcidr} allocated to customer $webvar{custid}\n".
@@ -951 +843 @@
     syslog "err", "Allocation of '$webvar{fullcidr}' to '$webvar{custid}' as ".
         "'$webvar{alloctype}' by $authuser failed: '$msg'";
-    printError("Allocation of $webvar{fullcidr} as '$disp_alloctypes{$webvar{alloctype}}'".
+    $page->param(err => "Allocation of $webvar{fullcidr} as '$disp_alloctypes{$webvar{alloctype}}'".
         " failed:<br>\n$msg\n");
   }
@@ -963 +855 @@
 sub validateInput {
   if ($webvar{city} eq '-') {
-    printError("Please choose a city.");
+    $page->param(err => 'Please choose a city');
     return;
   }
@@ -972 +864 @@
     # Danger! Danger!  alloctype should ALWAYS be set by a dropdown.  Anyone
     # managing to call things in such a way as to cause this deserves a cryptic error.
-    printError("Invalid alloctype");
+    $page->param(err => 'Invalid alloctype');
     return;
   }
@@ -980 +872 @@
   if ($def_custids{$webvar{alloctype}} eq '') {
     if (!$webvar{custid}) {
-      printError("Please enter a customer ID.");
+      $page->param(err => 'Please enter a customer ID.');
       return;
     }
@@ -989 +881 @@
       my $status = CustIDCK->custid_exist($webvar{custid});
       if ($CustIDCK::Error) {
-        printError("Error verifying customer ID: ".$CustIDCK::ErrMsg);
+        $page->param(err => "Error verifying customer ID: ".$CustIDCK::ErrMsg);
         return;
       }
       if (!$status) {
-        printError("Customer ID not valid.  Make sure the Customer ID ".
+        $page->param(err => "Customer ID not valid.  Make sure the Customer ID ".
           "is correct.<br>\nUse STAFF for staff static IPs, and $IPDB::defcustid for any other ".
           "non-customer assignments.");
@@ -1025 +917 @@
     }
   }
+
+  # if the alloctype has a restricted city/POP list as determined above,
+  # and the reqested city/POP does not match that list, complain
   if ($flag ne 'n') {
-    printError("Please choose a valid POP location $flag.  Valid ".
+    $page->param(err => "Please choose a valid POP location $flag.  Valid ".
         "POP locations are currently:<br>\n".join (" - ", @poplist));
     return;
@@ -1044 +939 @@
   # Two cases:  block is a netblock, or block is a static IP from a pool
   # because I'm lazy, we'll try to make the SELECT's bring out identical)ish) data
-  if ($webvar{block} =~ /\/32$/ && !$webvar{reallyblock}) {
+##fixme:  allow "SWIP" (publication to rWHOIS) of static IP data
+  if ($webvar{block} =~ /\/32$/) {
     $sql = "select ip,custid,type,city,circuitid,description,notes,modifystamp,privdata from poolips where ip='$webvar{block}'";
   } else {
@@ -1057 +953 @@
   # Clean up extra whitespace on alloc type
   $data[2] =~ s/\s//;
-
-  open (HTML, "../editDisplay.html")
-        or croak "Could not open editDisplay.html :$!";
-  my $html = join('', <HTML>);
 
   # We can't let the city be changed here;  this block is a part of
@@ -1067 +959 @@
 ##fixme
 # Needs thinking.  Have to allow changes to city to correct errors, no?
-  $html =~ s/\$\$BLOCK\$\$/$webvar{block}/g;
-
-  if ($IPDBacl{$authuser} =~ /c/) {
-    $html =~ s/\$\$CUSTID\$\$/<input type=text name=custid value="$data[1]" maxlength=15 class="regular">/;
-
-# Screw it.  Changing allocation types gets very ugly VERY quickly- especially
-# with the much longer list of allocation types.
-# We'll just show what type of block it is.
-
-# this has now been Requested, so here goes.
+# Also have areas where a routed block at a POP serves "many" cities/towns/named crossroads
+
+# @data: cidr,custid,type,city,circuitid,description,notes,modifystamp,privdata,swip
+
+  $page->param(block => $webvar{block});
+
+  $page->param(custid => $data[1]);
+  $page->param(city => $data[3]);
+  $page->param(circid => $data[4]);
+  $page->param(desc => $data[5]);
+  $page->param(notes => $data[6]);
 
 ##fixme The check here should be built from the database
-    if ($data[2] =~ /^.[ne]$/) {
-      # Block that can be changed
-      my $blockoptions = "<select name=alloctype><option".
-        (($data[2] eq 'me') ? ' selected' : '') ." value='me'>Dialup netblock</option>\n<option".
-        (($data[2] eq 'de') ? ' selected' : '') ." value='de'>Dynamic DSL netblock</option>\n<option".
-        (($data[2] eq 'ce') ? ' selected' : '') ." value='ce'>Dynamic cable netblock</option>\n<option".
-        (($data[2] eq 'we') ? ' selected' : '') ." value='we'>Dynamic wireless netblock</option>\n<option".
-        (($data[2] eq 'cn') ? ' selected' : '') ." value='cn'>Customer netblock</option>\n<option".
-        (($data[2] eq 'en') ? ' selected' : '') ." value='en'>End-use netblock</option>\n<option".
-        (($data[2] eq 'in') ? ' selected' : '') ." value='in'>Internal netblock</option>\n".
-        "</select>\n";
-      $html =~ s/\$\$TYPESELECT\$\$/$blockoptions/g;
-    } else {
-      $html =~ s/\$\$TYPESELECT\$\$/$disp_alloctypes{$data[2]}<input type=hidden name=alloctype value="$data[2]">/g;
-    }
+# Need to expand to support pool types too
+  if ($data[2] =~ /^.[ne]$/ && $IPDBacl{$authuser} =~ /c/) {
+    $page->param(changetype => 1);
+    $page->param(alloctype => [
+                { selme => ($data[2] eq 'me'), type => "me", disptype => "Dialup netblock" },
+                { selme => ($data[2] eq 'de'), type => "de", disptype => "Dynamic DSL netblock" },
+                { selme => ($data[2] eq 'ce'), type => "ce", disptype => "Dynamic cable netblock" },
+                { selme => ($data[2] eq 'we'), type => "we", disptype => "Dynamic wireless netblock" },
+                { selme => ($data[2] eq 'cn'), type => "cn", disptype => "Customer netblock" },
+                { selme => ($data[2] eq 'en'), type => "en", disptype => "End-use netblock" },
+                { selme => ($data[2] eq 'in'), type => "in", disptype => "Internal netblock" },
+                ]
+        );
+  } else {
+    $page->param(disptype => $disp_alloctypes{$data[2]});
+    $page->param(type => $data[2]);
+  }
+
 ## node hack
-  $sth = $ip_dbh->prepare("SELECT node_id FROM noderef WHERE block='$webvar{block}'");
+  $sth = $ip_dbh->prepare("SELECT nodes.node_id,node_name FROM nodes INNER JOIN noderef".
+        " ON nodes.node_id=noderef.node_id WHERE noderef.block='$webvar{block}'");
   $sth->execute;
-  my ($nodeid) = $sth->fetchrow_array();
-  if ($nodeid) {
-    $sth = $ip_dbh->prepare("SELECT node_id, node_name FROM nodes ORDER BY node_type,node_id");
-    $sth->execute() or print "DEBUG: failed retrieval from nodes: ".$sth->errstr,"<br>\n";
-    my $nodes = "<select name=node>\n";
-    while (my ($nid,$nname) = $sth->fetchrow_array()) {
-      $nodes .= "<option".($nodeid == $nid ? ' selected' : '')." value='$nid'>$nname</option>\n";
-    }
-    $nodes .= "</select>\n";
-    $html =~ s/\$\$NODE\$\$/$nodes/;
-  } else {
-    if ($data[2] eq 'fr' || $data[2] eq 'bi') {
+  my ($nodeid,$nodename) = $sth->fetchrow_array();
+  $page->param(havenodeid => $nodeid);
+
+  if ($data[2] eq 'fr' || $data[2] eq 'bi') {
+    $page->param(typesupportsnodes => 1);
+    $page->param(nodename => $nodename);
+
+##fixme:  this whole hack needs cleanup and generalization for all alloctypes
+##fixme:  arguably a bug that presence of a nodeid implies it can be changed..
+#  but except for manual database changes, only the two types fr and bi can
+#  (currently) have a nodeid set in the first place.
+    if ($IPDBacl{$authuser} =~ /c/) {
       $sth = $ip_dbh->prepare("SELECT node_id, node_name FROM nodes ORDER BY node_type,node_id");
-      $sth->execute() or print "DEBUG: failed retrieval from nodes: ".$sth->errstr,"<br>\n";
-      my $nodes = "<select name=node>\n<option value=>--</option>\n";
+      $sth->execute;
+      my @nodelist;
       while (my ($nid,$nname) = $sth->fetchrow_array()) {
-        $nodes .= "<option value='$nid'>$nname</option>\n";
+        my %row = (
+                selme => ($nodeid == $nid),
+                nodeid => $nid,
+                nodename => $nname,
+                );
+        push (@nodelist, \%row);
       }
-      $nodes .= "</select>\n";
-      $html =~ s/\$\$NODE\$\$/$nodes/;
-    } else {
-      $html =~ s|\$\$NODE\$\$|N/A|;
+      $page->param(nodelist => \@nodelist);
     }
   }
 ## end node hack
-    $html =~ s/\$\$CITY\$\$/<input type=text name=city value="$data[3]">/g;
-    $html =~ s/\$\$CIRCID\$\$/<input type="text" name="circid" value="$data[4]" maxlength=64 size=64 class="regular">/g;
-    $html =~ s/\$\$DESC\$\$/<input type="text" name="desc" value="$data[5]" maxlength=64 size=64 class="regular">/g;
-    $html =~ s|\$\$NOTES\$\$|<textarea rows="8" cols="64" name="notes" class="regular">$data[6]</textarea>|g;
-  } else {
-## node hack
-    if ($data[2] eq 'fr' || $data[2] eq 'bi') {
-      $sth = $ip_dbh->prepare("SELECT node_name FROM nodes INNER JOIN noderef".
-        " ON nodes.node_id=noderef.node_id WHERE noderef.block='$webvar{block}'");
-      $sth->execute() or print "DEBUG: failed retrieval from nodes: ".$sth->errstr,"<br>\n";
-      my ($node) = $sth->fetchrow_array;
-      $html =~ s/\$\$NODE\$\$/$node/;
-    } else {
-      $html =~ s|\$\$NODE\$\$|N/A|;
-    }
-## end node hack
-    $html =~ s/\$\$CUSTID\$\$/$data[1]/g;
-    $html =~ s/\$\$TYPESELECT\$\$/$disp_alloctypes{$data[2]}/g;
-    $html =~ s/\$\$CITY\$\$/$data[3]/g;
-    $html =~ s/\$\$CIRCID\$\$/$data[4]/g;
-    $html =~ s/\$\$DESC\$\$/$data[5]/g;
-    $html =~ s/\$\$NOTES\$\$/$data[6]/g;
-  }
+
   my ($lastmod,undef) = split /\s+/, $data[7];
-  $html =~ s/\$\$LASTMOD\$\$/$lastmod/g;
-
-## Hack time!  SWIP isn't going to stay, so I'm not going to integrate it with ACLs.
-if ($data[2] =~ /.i/) {
-  $html =~ s/\$\$SWIP\$\$/N\/A/;
-} else {
-  my $tmp = (($data[10] eq 'n') ? '<input type=checkbox name=swip>' : 
-        '<input type=checkbox name=swip checked=yes>');
-  $html =~ s/\$\$SWIP\$\$/$tmp/;
-}
-
-  # Allows us to "correctly" colour backgrounds in table
-  my $i=1;
+  $page->param(lastmod => $lastmod);
+
+  # not happy with the upside-down logic, but...
+  $page->param(swipable => $data[2] !~ /.i/);
+  $page->param(swip => $data[10] ne 'n');
 
   # Check to see if we can display sensitive data
-  my $privdata = '';
-  if ($IPDBacl{$authuser} =~ /s/) {
-    $privdata = qq(<tr class="color).($i%2).qq("><td class=heading>Restricted data:</td>).
-        qq(<td class=regular><textarea rows="3" cols="64" name="privdata" class="regular">).
-        qq($data[8]</textarea></td></tr>\n);
-    $i++;
-  }
-  $html =~ s/\$\$PRIVDATA\$\$/$privdata/g;
-
-  # More ACL trickery - we can live with forms that don't submit,
-  # but we can't leave the extra table rows there, and we *really*
-  # can't leave the submit buttons there.
-  my $updok = '';
-  if ($IPDBacl{$authuser} =~ /c/) {
-    $updok = qq(<tr class="color).($i%2).qq("><td colspan=2><div class="center">).
-        qq(<input type="submit" value=" Update this block " class="regular">).
-        "</div></td></tr></form>\n";
-    $i++;
-  }
-  $html =~ s/\$\$UPDOK\$\$/$updok/g;
-
-  my $delok = '';
-  if ($IPDBacl{$authuser} =~ /d/) {
-    $delok = qq(<form method="POST" action="main.cgi">
-        <tr class="color).($i%2).qq("><td colspan=2 class="regular"><div class=center>
-        <input type="hidden" name="action" value="delete">
-        <input type="hidden" name="block" value="$webvar{block}">
-        <input type="hidden" name="alloctype" value="$data[2]">
-        <input type=submit value=" Delete this block ">
-        </div></td></tr>);
-  }
-  $html =~ s/\$\$DELOK\$\$/$delok/;
-
-  print $html;
+  $page->param(nocling => $IPDBacl{$authuser} =~ /s/);
+  $page->param(privdata => $data[8]);
+
+  # ACL trickery - these two template booleans control the presence of all form/input tags
+  $page->param(maychange => $IPDBacl{$authuser} =~ /c/);
+  $page->param(maydel => $IPDBacl{$authuser} =~ /d/);
 
 } # edit()
@@ -1203 +1044 @@
 sub update {
   if ($IPDBacl{$authuser} !~ /c/) {
-    printError("You shouldn't have been able to get here.  Access denied.");
+    $aclerr = 'updateblock';
     return;
   }
@@ -1221 +1062 @@
     my $sql;
     if (my $pooltype = ($webvar{alloctype} =~ /^(.)i$/) ) {
-      $sql = "update poolips set custid='$webvar{custid}',notes='$webvar{notes}',".
-        "circuitid='$webvar{circid}',description='$webvar{desc}',city='$webvar{city}'".
+      $sql = "UPDATE poolips SET custid='$webvar{custid}',".
+        "city=?,description=?,notes=?,".
+        "circuitid='$webvar{circid}',".
         "$privdata where ip='$webvar{block}'";
     } else {
-      $sql = "update allocations set custid='$webvar{custid}',".
-        "description='$webvar{desc}',notes='$webvar{notes}',city='$webvar{city}',".
-        "type='$webvar{alloctype}',circuitid='$webvar{circid}'$privdata,".
+      $sql = "UPDATE allocations SET custid='$webvar{custid}',".
+        "city=?,description=?,notes=?,".
+        "circuitid='$webvar{circid}'$privdata,".
+        "type='$webvar{alloctype}',".
         "swip='".($webvar{swip} eq 'on' ? 'y' : 'n')."' ".
         "where cidr='$webvar{block}'";
@@ -1234 +1077 @@
     syslog "debug", $sql;
     $sth = $ip_dbh->prepare($sql);
-    $sth->execute;
+    $sth->execute($webvar{city}, $webvar{desc}, $webvar{notes});
 ## node hack
     if ($webvar{node}) {
+      # done with delete/insert so we don't have to worry about funkyness updating a node ref that isn't there
       $ip_dbh->do("DELETE FROM noderef WHERE block='$webvar{block}'");
       $sth = $ip_dbh->prepare("INSERT INTO noderef (block,node_id) VALUES (?,?)");
@@ -1246 +1090 @@
   if ($@) {
     my $msg = $@;
-    carp "Transaction aborted because $msg";
     eval { $ip_dbh->rollback; };
     syslog "err", "$authuser could not update block/IP '$webvar{block}': '$msg'";
-    printError("Could not update block/IP $webvar{block}: $msg");
+    $page->param(err => "Could not update block/IP $webvar{block}: $msg");
     return;
   }
@@ -1259 +1102 @@
 mailNotify($ip_dbh, 's:swi', "SWIPed: $disp_alloctypes{$webvar{alloctype}} $webvar{block}",
         "$webvar{block} had SWIP status changed to \"Yes\" by $authuser") if $webvar{swip} eq 'on';
-  open (HTML, "../updated.html")
-        or croak "Could not open updated.html :$!";
-  my $html = join('', <HTML>);
+
+## node hack
+  if ($webvar{node} && $webvar{node} ne '-') {
+    $sth = $ip_dbh->prepare("SELECT node_name FROM nodes WHERE node_id=?");
+    $sth->execute($webvar{node});
+    my ($nodename) = $sth->fetchrow_array();
+    $page->param(nodename => $nodename);
+  }
+## end node hack
 
   # Link back to browse-routed or list-pool page on "Update complete" page.
-  my $backlink = "$IPDB::webpath/cgi-bin/main.cgi?action=";
   my $cblock;   # to contain the CIDR of the container block we're retrieving.
   my $sql;
   if (my $pooltype = ($webvar{alloctype} =~ /^(.)i$/) ) {
+    $page->param(backpool => 1);
     $sql = "select pool from poolips where ip='$webvar{block}'";
-    $backlink .= "listpool&pool=";
   } else {
     $sql = "select cidr from routed where cidr >>= '$webvar{block}'";
-    $backlink .= "showrouted&block=";
   }
   # I define there to be no errors on this operation...  so we don't need to check for them.
@@ -1280 +1127 @@
   $sth->fetch();
   $sth->finish;
-  $backlink .= $cblock;
-
-my $swiptmp = ($webvar{swip} eq 'on' ? 'Yes' : 'No');
-  $html =~ s/\$\$BLOCK\$\$/$webvar{block}/g;
-  $webvar{city} = desanitize($webvar{city});
-  $html =~ s/\$\$CITY\$\$/$webvar{city}/g;
-  $html =~ s/\$\$ALLOCTYPE\$\$/$webvar{alloctype}/g;
-  $html =~ s/\$\$TYPEFULL\$\$/$disp_alloctypes{$webvar{alloctype}}/g;
-  $html =~ s/\$\$CUSTID\$\$/$webvar{custid}/g;
-  $html =~ s/\$\$SWIP\$\$/$swiptmp/g;
-  $webvar{circid} = desanitize($webvar{circid});
-  $html =~ s/\$\$CIRCID\$\$/$webvar{circid}/g;
-  $webvar{desc} = desanitize($webvar{desc});
-  $html =~ s/\$\$DESC\$\$/$webvar{desc}/g;
-  $webvar{notes} = desanitize($webvar{notes});
-  $html =~ s/\$\$NOTES\$\$/$webvar{notes}/g;
-  $html =~ s/\$\$BACKLINK\$\$/$backlink/g;
-  $html =~ s/\$\$BACKBLOCK\$\$/$cblock/g;
-
-  if ($IPDBacl{$authuser} =~ /s/) {
-    $privdata = qq(<tr class="color2"><td valign="top">Restricted data:</td>).
-        qq(<td class="regular">).desanitize($webvar{privdata}).qq(</td></tr>\n);
-  }
-  $html =~ s/\$\$PRIVDATA\$\$/$privdata/g;
-
-  print $html;
+  $page->param(backblock => $cblock);
+
+  $page->param(cidr => $webvar{block});
+  $page->param(city => $webvar{city});
+  $page->param(disptype => $disp_alloctypes{$webvar{alloctype}});
+  $page->param(custid => $webvar{custid});
+  $page->param(swip => $webvar{swip} eq 'on' ? 'Yes' : 'No');
+  $page->param(circid => $q->escapeHTML($webvar{circid}));
+  $page->param(desc => $q->escapeHTML($webvar{desc}));
+  $page->param(notes => $q->escapeHTML($webvar{notes}));
+  $webvar{privdata} = ($webvar{privdata} ? $q->escapeHTML($webvar{privdata}) : "&nbsp;");
+  $page->param(privdata => $webvar{privdata})
+        if $IPDBacl{$authuser} =~ /s/;
 
 } # update()
@@ -1313 +1147 @@
 sub remove {
   if ($IPDBacl{$authuser} !~ /d/) {
-    printError("You shouldn't have been able to get here.  Access denied.");
+    $aclerr = 'delblock';
     return;
   }
-
-  #show confirm screen.
-  open HTML, "../confirmRemove.html"
-        or croak "Could not open confirmRemove.html :$!";
-  my $html = join('', <HTML>);
-  close HTML;
 
   # Serves'em right for getting here...
   if (!defined($webvar{block})) {
-    printError("Error 332");
+    $page->param(err => "Can't delete a block that doesn't exist");
     return;
   }
@@ -1346 +1174 @@
     $desc = "N/A";
     $notes = "N/A";
+    $privdata = "N/A";
 
   } elsif ($webvar{alloctype} eq 'mm') {
+
     $cidr = $webvar{block};
     $city = "N/A";
@@ -1355 +1185 @@
     $desc = "N/A";
     $notes = "N/A";
+    $privdata = "N/A";
+
   } elsif ($webvar{alloctype} =~ /^.i$/) { # done with alloctype=[rm]m
 
@@ -1379 +1211 @@
   } # end cases for different alloctypes
 
-  # Munge everything into HTML
-  $html =~ s|Please confirm|Please confirm <b>removal</b> of|;
-  $html =~ s|\$\$BLOCK\$\$|$cidr|g;
-  $html =~ s|\$\$TYPEFULL\$\$|$disp_alloctypes{$alloctype}|g;
-  $html =~ s|\$\$ALLOCTYPE\$\$|$alloctype|g;
-  $html =~ s|\$\$CITY\$\$|$city|g;
-  $html =~ s|\$\$CUSTID\$\$|$custid|g;
-  $html =~ s|\$\$CIRCID\$\$|$circid|g;
-  $html =~ s|\$\$DESC\$\$|$desc|g;
-  $html =~ s|\$\$NOTES\$\$|$notes|g;
-
-  $html =~ s|\$\$ACTION\$\$|finaldelete|g;
-
-  # Set the warning text.
-  if ($alloctype =~ /^.[pd]$/) {
-    $html =~ s|<!--warn-->|<tr bgcolor="black"><td colspan="2"><div class="red">Warning: clicking confirm will remove this record entirely.<br>Any IPs allocated from this pool will also be removed!</div></td></tr>|;
-  } else {
-    $html =~ s|<!--warn-->|<tr bgcolor="black"><td colspan="2"><div class="red">Warning: clicking confirm will remove this record entirely.</div></td></tr>|;
-  }
-
-  my $i = 1;
-  # Check to see if user is allowed to do anything with sensitive data
-  if ($IPDBacl{$authuser} =~ /s/) {
-    $privdata = qq(<tr class="color).($i%2).qq("><td>Restricted data:</td>).
-        qq(<td class=regular>$privdata</td></tr>\n);
-    $i++;
-  }
-  $html =~ s/\$\$PRIVDATA\$\$/$privdata/g;
-
-  $i = ++$i % 2;
-  $html =~ s/\$\$BUTTONROWCOLOUR\$\$/color$i/;
-
-  print $html;
-} # end edit()
+  $page->param(block => $cidr);
+  $page->param(disptype => $disp_alloctypes{$alloctype});
+  $page->param(type => $alloctype);
+  $page->param(city => $city);
+  $page->param(custid => $custid);
+  $page->param(circid => $circid);
+  $page->param(desc => $desc);
+  $page->param(notes => $notes);
+  $privdata = '&nbsp;' if $privdata eq '';
+  $page->param(privdata => $privdata) if $IPDBacl{$authuser} =~ /s/;
+  $page->param(delpool => $alloctype =~ /^.[pd]$/);
+
+} # end remove()
 
 
@@ -1421 +1232 @@
 sub finalDelete {
   if ($IPDBacl{$authuser} !~ /d/) {
-    printError("You shouldn't have been able to get here.  Access denied.");
+    $aclerr = 'delblock';
     return;
   }
@@ -1430 +1241 @@
   my ($code,$msg) = deleteBlock($ip_dbh, $webvar{block}, $webvar{alloctype});
 
+  $page->param(block => $webvar{block});
   if ($code eq 'OK') {
-    print "<div class=heading align=center>Success!  $webvar{block} deallocated.</div>\n";
     syslog "notice", "$authuser deallocated '$webvar{alloctype}'-type netblock $webvar{block}".
         " $custid, $city, desc='$description'";
@@ -1438 +1249 @@
         "CustID: $custid\nCity: $city\nDescription: $description\n");
   } else {
+    $page->param(failmsg => $msg);
     if ($webvar{alloctype} =~ /^.i$/) {
       syslog "err", "$authuser could not deallocate static IP '$webvar{block}': '$msg'";
-      printError("Could not deallocate static IP $webvar{block}: $msg");
     } else {
       syslog "err", "$authuser could not deallocate netblock '$webvar{block}': '$msg'";
-      printError("Could not deallocate netblock $webvar{block}: $msg");
+      $page->param(netblock => 1);
     }
   }
 
 } # finalDelete
-
-
-sub exitError {
-  my $errStr = $_[0];
-  printHeader('', $IPDB::webpath, '');
-  print qq(<center><p class="regular"> $errStr </p>
-<input type="button" value="Back" onclick="history.go(-1)">
-</center>
-);
-  printFooter();
-  exit;
-} # errorExit
-
-
-# Just in case we manage to get here.
-exit 0;

branches/stable/cgi-bin/newcity.cgi

@@ -13 +13 @@
 use warnings;
 #use CGI::Carp qw(fatalsToBrowser);
+use CGI::Simple;
+use HTML::Template;
 use DBI;
-use CommonWeb qw(:ALL);
 #use POSIX qw(ceil);
 use NetAddr::IP;
@@ -35 +36 @@
 }
 
-my %webvar = parse_post();
-cleanInput(\%webvar);
+# Set up the CGI object...
+my $q = new CGI::Simple;
+# ... and get query-string params as well as POST params if necessary
+$q->parse_query_string;
+
+# Convenience;  saves changing all references to %webvar
+##fixme:  tweak for handling <select multiple='y' size=3> (list with multiple selection)
+my %webvar = $q->Vars;
 
 my ($dbh,$errstr) = connectDB_My;
 my $sth;
 
+$ENV{HTML_TEMPLATE_ROOT} = '../templates';
+
+my $page = HTML::Template->new(filename => "newcity.tmpl");
+
+if ($webvar{city}) {
+  if ($webvar{pop} eq 'on') {
+    $sth = $dbh->prepare("insert into cities (city,routing) values (?,'y')");
+  } else {
+    $sth = $dbh->prepare("insert into cities (city,routing) values (?,'n')");
+  }
+##fixme:  don't allow duplicate cities
+  $sth->execute($webvar{city});
+  $page->param(city => $webvar{city});
+  if ($sth->err) {
+    $page->param(err => $sth->errstr);
+    my $msg = "$authuser could not add city '$webvar{city}' to database: ".$sth->errstr;
+    mailNotify($dbh, 'f:nci', "IPDB city add failure", $msg);
+    syslog "err", $msg;
+  } else {
+    syslog "notice", "$authuser added city/location '$webvar{pop}'".
+        (($webvar{pop} eq 'on') ? ' as POP location' : '');
+  }
+}
+
 print "Content-type: text/html\n\n";
 
-if ($webvar{pop} eq 'on') {
-  $sth = $dbh->prepare("insert into cities (city,routing) values ('$webvar{city}','y')");
-} else {
-  $sth = $dbh->prepare("insert into cities (city,routing) values ('$webvar{city}','n')");
-}
-$sth->execute;
-
-if ($sth->err) {
-  print "Error adding city to database: ".$sth->errstr;
-  mailNotify($dbh, 'f:nci', "IPDB city add failure",
-        "$authuser could not add city '$webvar{city}' to database: ".$sth->errstr);
-  syslog "err", "$authuser could not add city '$webvar{city}' to database: ".$sth->errstr;
-} else {
-  print "City added.  Closing this window should refresh the page.";
-  syslog "notice", "$authuser added city/location '$webvar{pop}'".
-        (($webvar{pop} eq 'on') ? ' as POP location' : '');
-}
+print $page->output;
 
 finish($dbh);
+

branches/stable/cgi-bin/newnode.cgi

@@ -13 +13 @@
 use warnings;
 #use CGI::Carp qw(fatalsToBrowser);
+use CGI::Simple;
+use HTML::Template;
 use DBI;
-use CommonWeb qw(:ALL);
 #use POSIX qw(ceil);
 use NetAddr::IP;
@@ -34 +35 @@
 }
 
-my %webvar = parse_post();
-cleanInput(\%webvar);
+# Set up the CGI object...
+my $q = new CGI::Simple;
+# ... and get query-string params as well as POST params if necessary
+$q->parse_query_string;
+
+# Convenience;  saves changing all references to %webvar
+##fixme:  tweak for handling <select multiple='y' size=3> (list with multiple selection)
+my %webvar = $q->Vars;
 
 my ($dbh,$errstr) = connectDB_My;
 my $sth;
 
+$ENV{HTML_TEMPLATE_ROOT} = '../templates';
+
+my $page = HTML::Template->new(filename => "newnode.tmpl");
+
+if ($webvar{nodename}) {
+  $sth = $dbh->prepare("insert into nodes (node_type,node_name,node_ip) values (?,?,?)");
+  $sth->execute($webvar{type}, $webvar{nodename}, $webvar{nodeip});
+  $page->param(nodename => $webvar{nodename});
+  if ($sth->err) {
+    $page->param(err => $sth->errstr);
+    my $msg = "$authuser could not add node '$webvar{nodename}','$webvar{type}' to database: ".$sth->errstr;
+    mailNotify($dbh, 'f:nno', "IPDB node add failure", $msg);
+    syslog "err", $msg;
+  } else {
+    syslog "notice", "$authuser added node '$webvar{nodename}'";
+  }
+}
+
 print "Content-type: text/html\n\n";
 
-$sth = $dbh->prepare("insert into nodes (node_type,node_name,node_ip)".
-        " values ('$webvar{type}','$webvar{nodename}','$webvar{nodeip}')");
-$sth->execute;
-
-if ($sth->err) {
-  print "Error adding node to database: ".$sth->errstr;
-  mailNotify($dbh, 'f:nno', "IPDB node add failure",
-        "$authuser could not add node '$webvar{nodename}','$webvar{type}' to database: ".$sth->errstr);
-  syslog "err", "$authuser could not add node '$webvar{nodename}','$webvar{type}' to database: ".$sth->errstr;
-} else {
-  print "Node added.  Closing this window should refresh the page.";
-  syslog "notice", "$authuser added node '$webvar{nodename}'";
-}
+print $page->output;
 
 finish($dbh);

branches/stable/cgi-bin/search.cgi

@@ -14 +14 @@
 use warnings;   
 use CGI::Carp qw(fatalsToBrowser);
+use CGI::Simple;
+use HTML::Template;
 use DBI;
-use CommonWeb qw(:ALL);
 use POSIX qw(ceil);
 use NetAddr::IP;
@@ -38 +39 @@
 }
 
+# Global variables
+my $RESULTS_PER_PAGE = 25;
+
+# anyone got a better name?  :P
+my $thingroot = $ENV{SCRIPT_FILENAME};
+$thingroot =~ s|cgi-bin/search.cgi||;
+
+# Set up the CGI object...
+my $q = new CGI::Simple;
+# ... and get query-string params as well as POST params if necessary
+$q->parse_query_string;
+
+# Convenience;  saves changing all references to %webvar
+##fixme:  tweak for handling <select multiple='y' size=3> (list with multiple selection)
+my %webvar = $q->Vars;
+
+if (defined($webvar{rpp})) {
+  ($RESULTS_PER_PAGE) = ($webvar{rpp} =~ /(\d+)/);
+}
+
 # Why not a global DB handle?  (And a global statement handle, as well...)
 # Use the connectDB function, otherwise we end up confusing ourselves
@@ -44 +65 @@
 my $errstr;
 ($ip_dbh,$errstr) = connectDB_My;
-if (!$ip_dbh) {
-  printAndExit("Failed to connect to database: $errstr\n");
+if ($ip_dbh) {
+  checkDBSanity($ip_dbh);
+  initIPDBGlobals($ip_dbh);
 }
-checkDBSanity($ip_dbh);
-initIPDBGlobals($ip_dbh);
-
-# Global variables
-my $RESULTS_PER_PAGE = 25;
-my %webvar = parse_post();
-cleanInput(\%webvar);
-
-if (defined($webvar{rpp})) {
-  ($RESULTS_PER_PAGE) = ($webvar{rpp} =~ /(\d+)/);
-}
-
+
+# Set up some globals
+$ENV{HTML_TEMPLATE_ROOT} = $thingroot."templates";
+
+my $page;
 if (!defined($webvar{stype})) {
   $webvar{stype} = "<NULL>";   #shuts up the warnings.
+  $page = HTML::Template->new(filename => "search/compsearch.tmpl");
+} else {
+  $page = HTML::Template->new(filename => "search/sresults.tmpl");
 }
 
-# Headerize!  Make sure we replace the $$EXTRA0$$ bit as needed.
-printHeader('', $IPDB::webpath, ($IPDBacl{$authuser} =~ /a/ ?
-        '<td align=right><a href="'.$IPDB::webpath.'/cgi-bin/main.cgi?action=assign">Add new assignment</a></td>' : ''
-        ));
-
-if ($webvar{stype} eq 'q') {
+my $header = HTML::Template->new(filename => "header.tmpl");
+$header->param(version => $IPDB::VERSION);
+$header->param(addperm => $IPDBacl{$authuser} =~ /a/);
+print "Content-type: text/html\n\n", $header->output;
+
+# Handle the DB error first
+if (!$ip_dbh) {
+  $page = HTML::Template->new(filename => "dberr.tmpl");
+  $page->param(errmsg => $errstr);
+} elsif ($webvar{stype} eq 'q') {
   # Quick search.
 
@@ -111 +133 @@
     $sqlconcat = "UNION";
   } else {
-    # We can't get here.  PTHBTT!
-    printAndExit "PTHBTT!!  Your search has been rejected due to Microsoft excuse #4432: ".
-        "Not enough mana";
+    # sum-buddy tryn'a game the system.  Match "all"
+    $sqlconcat = "INTERSECT";
   }
 
@@ -190 +211 @@
         "text(cidr) like '$webvar{cidr}%')";
   } else {
-    # This shouldn't happen, but if it does, whoever gets it deserves what they get...
-    printAndExit("Invalid netblock query.");
+    # do nothing.
+    ##fixme  we'll ignore this to clear out the references to legacy code.
   } # done with CIDR query options.
 
@@ -201 +222 @@
 
   if ($count == 0) {
-    printError "No matches found.  Try eliminating one of the criteria,".
-        " or making one or more criteria more general.";
+    $page->param(errmsg => "No matches found.  Try eliminating one of the criteria,".
+        " or making one or more criteria more general.");
   } else {
     # Add the limit/offset clauses
@@ -225 +246 @@
 
   if ($count == 0) {
-    printError "No customers currently listed as connected through this node.";
+    $page->param(errmsg => "No customers currently listed as connected through this node.");
+##fixme:  still get the results table header
   } else {
     # Add the limit/offset clauses
@@ -237 +259 @@
 } else { # how script was called.  General case is to show the search criteria page.
 
-  # Display search page.  We have to do this here, because otherwise
-  # we can't retrieve data from the database for the types and cities.  >:(
-  my $html;
-  open HTML,"<../compsearch.html";
-  $html = join('',<HTML>);
-  close HTML;
-  $html =~ s/\$\$WEBPATH\$\$/$IPDB::webpath/g;
-
 # Generate table of types
-  my $typetable = "<table class=regular cellspacing=0>\n<tr>";
   $sth = $ip_dbh->prepare("select type,dispname from alloctypes where listorder <500 ".
         "order by listorder");
   $sth->execute;
   my $i=0;
-  while (my @data = $sth->fetchrow_array) {
-    $typetable .= "<td><input type=checkbox name=type[$data[0]]>$data[1]</td>";
-    $i++;
-    $typetable .= "</tr>\n<tr>"
-        if ($i % 4 == 0);
-  }
-  if ($i %4 == 0) {
-    $typetable =~ s/<tr>$//;
-  } else {
-    $typetable .= "</tr>\n";
-  }
-  $typetable .= "</table>\n";
+  my @typelist;
+  while (my ($type,$dispname) = $sth->fetchrow_array) {
+    my %row = (
+        newrow => ($i % 4 == 0),
+        type => $type,
+        dispname => $dispname,
+        endrow => ($i++ % 4 == 3)
+        );
+    push @typelist, \%row;
+  }
+  $page->param(typelist => \@typelist);
 
 # Generate table of cities
-  my $citytable = "<table class=regular cellspacing=0>\n<tr>";
   $sth = $ip_dbh->prepare("select id,city from cities order by city");
   $sth->execute;
-  my $i=0;
-  while (my @data = $sth->fetchrow_array) {
-    $citytable .= "<td><input type=checkbox name=city[$data[0]]>$data[1]</td>";
-    $i++;
-    $citytable .= "</tr>\n<tr>"
-        if ($i % 5 == 0);
-  }
-  if ($i %5 == 0) {
-    $citytable =~ s/<tr>$//;
-  } else {
-    $citytable .= "</tr>\n";
-  }
-  $citytable .= "</table>\n";
-
-  $html =~ s/\$\$TYPELIST\$\$/$typetable/;
-  $html =~ s/\$\$CITYLIST\$\$/$citytable/;
-
-  print $html;
+  $i=0;
+  my @citylist;
+  while (my ($id, $city) = $sth->fetchrow_array) {
+    my %row = (
+        newrow => ($i % 4 == 0),
+        id => $id,
+        city => $city,
+        endrow => ($i++ % 4 == 3)
+        );      
+    push @citylist, \%row;
+  }
+  $page->param(citylist => \@citylist);
+
 }
+
+print $page->output;
 
 # Shut down and clean up.
 finish($ip_dbh);
-printFooter;
+
+# We print the footer here, so we don't have to do it elsewhere.
+my $footer = HTML::Template->new(filename => "footer.tmpl");
+# include the admin tools link in the output?
+$footer->param(adminlink => ($IPDBacl{$authuser} =~ /A/));
+
+print $footer->output;
+
 # We shouldn't need to directly execute any code below here;  it's all subroutines.
 exit 0;
@@ -323 +338 @@
   if ($category eq 'all') {
 
-    print qq(<div class="heading">Showing all netblock and static-IP allocations</div><br>\n);
     $sql = "select $cols from searchme";
     my $count = countRows($sql);
@@ -331 +345 @@
   } elsif ($category eq 'cust') {
 
+##fixme:  this and other quick-search areas;  fix up page heading title similar to first grouping above
     print qq(<div class="heading">Searching for Customer IDs containing '$query'</div><br>\n);
 
@@ -394 +409 @@
     } else {
       # This shouldn't happen, but if it does, whoever gets it deserves what they get...
-      printError("Invalid query.");
+      $page->param(errmsg => "Invalid query.");
     }
   } else {
     # This shouldn't happen, but if it does, whoever gets it deserves what they get...
-    printError("Invalid searchfor.");
+    $page->param(errmsg => "Invalid searchfor.");
   }
 } # viewBy
@@ -438 +453 @@
   $sth->execute();
 
-  startTable('Allocation','CustID','Type','City','Description/Name');
+  $page->param(searchtitle => "Showing all netblock and static-IP allocations");
+
   my $count = 0;
-
-  while (my @data = $sth->fetchrow_array) {
-
-    # cidr,custid,type,city,description,notes
-    # Another bit of HairyPerl(TM) to prefix subblocks with "Sub"
-    my @row = (($data[2] =~ /^.r$/ ? 'Sub ' : '').
-        qq(<a href="$IPDB::webpath/cgi-bin/main.cgi?action=edit&block=$data[0]">$data[0]</a>),
-        $data[1], $disp_alloctypes{$data[2]}, $data[3], $data[4]);
-    # Allow listing of pool if desired/required.
-    if ($data[2] =~ /^.[pd]$/) {
-      $row[0] .= ' &nbsp; <a href="'.$IPDB::webpath.'/cgi-bin/main.cgi?action=listpool'.
-        "&pool=$data[0]\">List IPs</a>";
-    }
-    printRow(\@row, 'color1', 1) if ($count%2==0); 
-    printRow(\@row, 'color2', 1) if ($count%2!=0);
-    $count++;
-  }
+  my @sresults;
+  while (my ($block, $custid, $type, $city, $desc) = $sth->fetchrow_array) {
+    my %row = (
+        rowclass => $count++ % 2,
+        issub => ($type =~ /^.r$/ ? 1 : 0),
+        block => $block,
+        ispool => ($type =~ /^.[pd]$/ ? 1 : 0),
+        custid => $custid,
+        disptype => $disp_alloctypes{$type},
+        city => $city,
+        desc => $desc
+        );
+    push @sresults, \%row;
+  }
+  $page->param(sresults => \@sresults);
 
   # Have to think on this call, it's primarily to clean up unfetched rows from a select.
@@ -463 +477 @@
 
   my $upper = $offset+$count;
-  print "<tr><td colspan=10 bgcolor=white class=regular>Records found: $rowCount<br><i>Displaying: ".($offset+1)." - $upper</i></td></tr>\n";
-  print "</table></center>\n";
+
+  $page->param(resfound => $rowCount);
+  $page->param(resstart => $offset+1);
+  $page->param(resstop => $upper);
 
   # print the page thing..
   if ($RESULTS_PER_PAGE > 0 && $rowCount > $RESULTS_PER_PAGE) {
+    $page->param(multipage => 1);
     my $pages = ceil($rowCount/$RESULTS_PER_PAGE);
-    print qq(<div class="center"> Page: );
+    my @pagelist;
     for (my $i = 1; $i <= $pages; $i++) {
+      my %row;
+      $row{pgnum} = $i;
       if ($i == $pageNo) {
-        print "<b>$i&nbsp;</b>\n";
+        $row{thispage} = 1;
       } else {
-        print qq(<a href="$IPDB::webpath/cgi-bin/search.cgi?page=$i&stype=$webvar{stype}&);
+        $row{stype} = $webvar{stype};
         if ($webvar{stype} eq 'c') {
-          print "cidr=$webvar{cidr}&custid=$webvar{custid}&desc=$webvar{desc}&".
+          $row{extraopts} = "cidr=$webvar{cidr}&custid=$webvar{custid}&desc=$webvar{desc}&".
                 "notes=$webvar{notes}&which=$webvar{which}&alltypes=$webvar{alltypes}&".
                 "allcities=$webvar{allcities}&";
           foreach my $key (keys %webvar) {
             if ($key =~ /^(?:type|city)\[/ || $key =~ /exclude$/) {
-              print "$key=$webvar{$key}&";
+              $row{extraopts} .= "$key=$webvar{$key}&";
             }
           }
         } else {
-          print "input=$webvar{input}&";
+          $row{extraopts} = "input=$webvar{input}&";
         }
-        print qq(">$i</a>&nbsp;\n);
       }
-    }
-    print "</div>";
-  }
+      push @pagelist, \%row;
+    }
+    $page->param(pgnums => \@pagelist);
+  }
+
 } # queryResults
 

branches/stable/cgi-bin/snCalc.cgi

@@ -4 +4 @@
 use warnings;   
 use CGI::Carp qw(fatalsToBrowser);
+use CGI::Simple;
+use HTML::Template;
 use NetAddr::IP;
-use CommonWeb qw(:ALL);;
 
 #file snCalc.cgi        little subnet calculator app
 use MyIPDB;
 
-my %webvar = parse_post();
+# Set up the CGI object...
+my $q = new CGI::Simple;
+# ... and get query-string params as well as POST params if necessary
+$q->parse_query_string;
+
+# Convenience;  saves changing all references to %webvar
+##fixme:  tweak for handling <select multiple='y' size=3> (list with multiple selection)
+my %webvar = $q->Vars;
+
 my $input;
 
 print "Content-Type: text/html\n\n";
 
-open(HTML, "../startsn.html")|| die "Could not open startsn.html :$!";
-my $start = join('', <HTML>);
-close(HTML);
-$start =~ s/\$\$WEBPATH\$\$/$IPDB::webpath/g;
-print $start;
+##fixme:  need better method to find templates.
+$ENV{HTML_TEMPLATE_ROOT} = $ENV{SCRIPT_FILENAME};
+$ENV{HTML_TEMPLATE_ROOT} =~ s|cgi-bin/snCalc.cgi||;
+
+my $page = HTML::Template->new(filename => "templates/subnet-calc.tmpl");
 
 # Clean up input so we don't divide by zero or something equally silly
@@ -37 +46 @@
 my $postnet = new NetAddr::IP "0.0.0.0/$gtinput";
 
-print qq(<div class="center">
-<table align="center" cellspacing="3" cellpadding="3">
-<tr>
-        <td class="heading" align="center">Results for /$ltinput</td>
-        <td class="heading" align="center">Results for /$input</td>
-        <td class="heading" align="center">Results for /$gtinput</td>
-</tr>
-);
+$page->param(prenet => $ltinput);
+$page->param(net => $input);
+$page->param(postnet => $gtinput);
+$page->param(premask => $prenet->mask);
+$page->param(mask => $net->mask);
+$page->param(postmask => $postnet->mask);
+$page->param(prewildcard => scalar($prenet->wildcard));
+$page->param(wildcard => scalar($net->wildcard));
+$page->param(postwildcard => scalar($postnet->wildcard));
 
-print qq(<tr><td valign="top">\n).
-        qq(     <div class="mask">).$prenet->mask."</div>\n".
-        qq(     <div class="wildcard">).$prenet->wildcard."</div>\n".
-        getranges($ltinput).
-        qq(</td>\n<td valign="top" bgcolor="#d0e0e0">\n).
-        qq(     <div class="mask">).$net->mask."</div>\n".
-        qq(     <div class="wildcard">).$net->wildcard."</div>\n".
-        getranges($input).
-        qq(</td>\n<td valign="top">).
-        qq(     <div class="mask">).$postnet->mask."</div>\n".
-        qq(     <div class="wildcard">).$postnet->wildcard."</div>\n".
-        getranges($gtinput);
+my @prenets;
+foreach (getranges($ltinput)) {
+  my %row = (netrange => $_);
+  push (@prenets, \%row);
+}
+$page->param(prenets => \@prenets);
+my @nets;
+foreach (getranges($input)) {
+  my %row = (netrange => $_);
+  push (@nets, \%row);
+}
+$page->param(nets => \@nets);
+my @postnets;
+foreach (getranges($gtinput)) {
+  my %row = (netrange => $_);
+  push @postnets, \%row;
+}
+$page->param(postnets => \@postnets);
 
-print "</td></tr>\n</table>\n";
-
-print qq(<input type="button" value="Back" onclick="history.go(-1)" class="heading">
-</div>
-</body>
-</html>
-);
+print $page->output;
         
 # Just In Case
@@ -88 +98 @@
 sub getranges {
   my $masklen = shift;
-  my $ret = '';
+  my @ret;
   my $super;
   if ($masklen < 8) {
@@ -100 +110 @@
   }
   foreach my $net ($super->split($masklen)) {
-    $ret .= "\t".xrange($net,$masklen)."<br />\n";
+    push @ret, xrange($net,$masklen);
   }
-  return $ret;
+  return @ret;
 } # getranges()