From 0e63757d19b88cfe5b0f4364f1852af40b88454c Mon Sep 17 00:00:00 2001 From: Mark Schouten Date: Mon, 3 Apr 2017 09:47:38 +0200 Subject: [PATCH 1/9] Implement CAA-records. Please note that pdns requires quotes around the third field: https://github.com/PowerDNS/pdns/issues/4937. Closes #141 --- index.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/index.php b/index.php index ea7e841..301478d 100644 --- a/index.php +++ b/index.php @@ -146,6 +146,7 @@ if ($blocklogin === TRUE) { +
Content: @@ -616,6 +617,7 @@ $(document).ready(function () { 'SRV': 'SRV', 'SSHFP': 'SSHFP', 'TLSA': 'TLSA', + 'CAA': 'CAA', 'DNAME': 'DNAME', 'DS': 'DS' }; @@ -637,6 +639,7 @@ $(document).ready(function () { 'SRV': 'SRV', 'SSHFP': 'SSHFP', 'TLSA': 'TLSA', + 'CAA': 'CAA', 'TXT': 'TXT', }; }, From 4d4e536d52d93cf41b25bbfe530775dd10c51df9 Mon Sep 17 00:00:00 2001 From: Mark Schouten Date: Thu, 20 Apr 2017 11:45:33 +0200 Subject: [PATCH 2/9] Deduplicate the api-url --- includes/class/ApiHandler.php | 1 + 1 file changed, 1 insertion(+) diff --git a/includes/class/ApiHandler.php b/includes/class/ApiHandler.php index aa349b4..f21a0ac 100644 --- a/includes/class/ApiHandler.php +++ b/includes/class/ApiHandler.php @@ -91,6 +91,7 @@ class ApiHandler { break; } + $this->url = str_replace($this->apiurl, '', $this->url); curl_setopt($this->curlh, CURLOPT_URL, $this->baseurl().$this->url); //print "Here we go:\n"; From 9d27a140d79a14da7872c20bccc9305c1ec18208 Mon Sep 17 00:00:00 2001 From: Mark Schouten Date: Thu, 20 Apr 2017 11:46:55 +0200 Subject: [PATCH 3/9] Fix proto in logo url --- includes/misc.inc.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/includes/misc.inc.php b/includes/misc.inc.php index e56b55d..274b638 100644 --- a/includes/misc.inc.php +++ b/includes/misc.inc.php @@ -35,7 +35,7 @@ if (isset($defaults['primaryns'])) { } if (!isset($logo) or empty($logo)) { - $logo = 'http://www.tuxis.nl/uploads/images/nsedit.png'; + $logo = 'https://www.tuxis.nl/uploads/images/nsedit.png'; } From f67fa04d8519f1a5122f443b51be7aabe5fbe3ee Mon Sep 17 00:00:00 2001 From: Mark Schouten Date: Fri, 28 Apr 2017 12:32:01 +0200 Subject: [PATCH 4/9] This fixes the issues with the newer pdns, which suddenly includes the whole API url in the returned json. Closes #145. In response to https://github.com/tuxis-ie/nsedit/commit/4d4e536d52d93cf41b25bbfe530775dd10c51df9 --- includes/class/ApiHandler.php | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/includes/class/ApiHandler.php b/includes/class/ApiHandler.php index f21a0ac..07b6cdf 100644 --- a/includes/class/ApiHandler.php +++ b/includes/class/ApiHandler.php @@ -91,15 +91,8 @@ class ApiHandler { break; } - $this->url = str_replace($this->apiurl, '', $this->url); curl_setopt($this->curlh, CURLOPT_URL, $this->baseurl().$this->url); - //print "Here we go:\n"; - //print "Request: ".$this->method.' '.$this->baseurl().$this->url."\n"; - //if ($this->content != '') { - // print "Content: ".$this->content."\n"; - //} - $return = curl_exec($this->curlh); $code = curl_getinfo($this->curlh, CURLINFO_HTTP_CODE); $json = json_decode($return, 1); @@ -117,12 +110,11 @@ class ApiHandler { } public function call() { - if (substr($this->url, 0, 1) == '/') { - $this->apiurl(); - } else { - $this->apiurl = '/'; + if (substr($this->url, 0, 1) != '/') { + $this->url = '/'.$this->url; } - + $this->apiurl(); + $this->url = str_replace($this->apiurl, '', $this->url); $this->go(); } } From 6be5f2f29c48756017d29c867f64ffe395a2d995 Mon Sep 17 00:00:00 2001 From: Mark Schouten Date: Fri, 28 Apr 2017 13:09:31 +0200 Subject: [PATCH 5/9] Fix updating the password, and store if we have local auth, we can't change passwords if we don't have local auth --- includes/session.inc.php | 22 ++++++++++++++++++---- index.php | 5 ++++- 2 files changed, 22 insertions(+), 5 deletions(-) diff --git a/includes/session.inc.php b/includes/session.inc.php index 996f052..9b359c3 100644 --- a/includes/session.inc.php +++ b/includes/session.inc.php @@ -9,11 +9,13 @@ global $current_user; $current_user = false; // session startup -function _set_current_user($username, $is_admin = false, $has_csrf_token = false, $is_api = false) { +function _set_current_user($username, $userid, $localauth = true, $is_admin = false, $has_csrf_token = false, $is_api = false) { global $current_user; $current_user = array( 'username' => $username, + 'id' => $userid, + 'localauth' => $localauth, 'is_admin' => $is_admin, 'has_csrf_token' => $has_csrf_token, 'is_api' => $is_api, @@ -177,7 +179,7 @@ function _try_login($username, $password) { writelog("Failed to find user!", $username); return false; } else { - _set_current_user($username, (bool) $user['isadmin']); + _set_current_user($username, $user['id'], (bool) $do_local_auth, (bool) $user['isadmin']); if (session_id()) { session_unset(); @@ -187,6 +189,8 @@ function _try_login($username, $password) { session_regenerate_id(true) or die('session failure: regenerated id failed'); session_unset(); $_SESSION['username'] = $username; + $_SESSION['localauth'] = $do_local_auth; + $_SESSION['userid'] = $user['id']; # requires session: _check_csrf_token($user); @@ -206,7 +210,7 @@ function _check_session() { and $_POST['adminapikey'] === $adminapikey) { # Allow this request, fake that we're logged in as user. - return _set_current_user('admin', true, true, true); + return _set_current_user('admin', 1, false, true, true, true); } else { @@ -222,7 +226,7 @@ function _check_session() { session_destroy(); session_unset(); } else { - _set_current_user($_SESSION['username'], (bool) $user['isadmin']); + _set_current_user($_SESSION['username'], $_SESSION['userid'], (bool) $_SESSION['localauth'], (bool) $user['isadmin']); _check_csrf_token($user); return; } @@ -281,6 +285,16 @@ function get_sess_user() { return $current_user ? $current_user['username'] : null; } +function get_sess_userid() { + global $current_user; + return $current_user ? $current_user['id'] : null; +} + +function has_local_auth() { + global $current_user; + return $current_user ? $current_user['localauth'] : null; +} + function logout() { @session_destroy(); @session_unset(); diff --git a/index.php b/index.php index 301478d..be46ae4 100644 --- a/index.php +++ b/index.php @@ -20,7 +20,7 @@ if (!is_logged_in() and isset($_POST['formname']) and $_POST['formname'] === "lo if (is_logged_in() and isset($_POST['formname']) and $_POST['formname'] === "changepwform") { if (get_sess_user() == $_POST['username']) { - if (!update_user(get_sess_user(), is_adminuser(), $_POST['password'])) { + if (!update_user(get_sess_userid(), is_adminuser(), $_POST['password'])) { $errormsg = "Unable to update password!\n"; } } else { @@ -208,6 +208,7 @@ if ($blocklogin === TRUE) { +

Hi . You can change your password here.

@@ -232,9 +233,11 @@ if ($blocklogin === TRUE) { +
+