jostreff/nsedit
1
0
Fork 0
mirror of https://github.com/tuxis-ie/nsedit.git synced 2025-04-20 20:13:40 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix some inputvalidation and functionnames

Browse source
This commit is contained in:
Mark Schouten 2014-06-23 09:55:52 +02:00
parent 59183064da
commit aa37139301
4 changed files with 55 additions and 38 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
includes/misc.inc.php
View file

@ -2,7 +2,7 @@
include('config.inc.php'); include('config.inc.php');
function _get_db() { function get_db() {
global $authdb; global $authdb;
$db = new SQLite3($authdb, SQLITE3_OPEN_READWRITE); $db = new SQLite3($authdb, SQLITE3_OPEN_READWRITE);
@ -17,7 +17,7 @@ function gen_pw() {
} }
function get_all_users() { function get_all_users() {
$db = _get_db(); $db = get_db();
$r = $db->query('SELECT id, emailaddress, isadmin FROM users'); $r = $db->query('SELECT id, emailaddress, isadmin FROM users');
$ret = array(); $ret = array();
while ($row = $r->fetchArray()) { while ($row = $r->fetchArray()) {
@ -29,7 +29,7 @@ function get_all_users() {
} }
function get_pw($username) { function get_pw($username) {
$db = _get_db(); $db = get_db();
$pw = $db->querySingle("SELECT password FROM users WHERE emailaddress = '".$username."'"); $pw = $db->querySingle("SELECT password FROM users WHERE emailaddress = '".$username."'");
$db->close(); $db->close();
return $pw; return $pw;
@ -43,7 +43,7 @@ function add_user($username, $isadmin = '0', $password = FALSE) {
$password = crypt($password, '$6$'.$salt); $password = crypt($password, '$6$'.$salt);
} }
$db = _get_db(); $db = get_db();
$ret = $db->exec("INSERT OR REPLACE INTO users (emailaddress, password, isadmin) VALUES ('".$username."', '".$password."', $isadmin)"); $ret = $db->exec("INSERT OR REPLACE INTO users (emailaddress, password, isadmin) VALUES ('".$username."', '".$password."', $isadmin)");
$db->close(); $db->close();
@ -51,14 +51,14 @@ function add_user($username, $isadmin = '0', $password = FALSE) {
} }
function delete_user($id) { function delete_user($id) {
$db = _get_db(); $db = get_db();
$ret = $db->exec("DELETE FROM users WHERE id = $id"); $ret = $db->exec("DELETE FROM users WHERE id = $id");
$db->close(); $db->close();
return $ret; return $ret;
} }
function _jtable_respond($records, $method = 'multiple', $msg = 'Undefined errormessage') { function jtable_respond($records, $method = 'multiple', $msg = 'Undefined errormessage') {
$jTableResult = array(); $jTableResult = array();
if ($method == 'error') { if ($method == 'error') {
$jTableResult['Result'] = "ERROR"; $jTableResult['Result'] = "ERROR";
@ -81,4 +81,10 @@ function _jtable_respond($records, $method = 'multiple', $msg = 'Undefined error
print json_encode($jTableResult); print json_encode($jTableResult);
exit(0); exit(0);
} }
function valid_user($name) {
return ( bool ) preg_match( "/^[a-z0-9@_.-]+$/i" , $name );
}
?> ?>

5
includes/session.inc.php
View file

@ -40,7 +40,10 @@ function logout() {
function try_login() { function try_login() {
if (isset($_POST['username']) and isset($_POST['password'])) { if (isset($_POST['username']) and isset($_POST['password'])) {
$db = _get_db(); if (valid_user($_POST['username']) === FALSE) {
return FALSE;
}
$db = get_db();
$userinfo = $db->querySingle("SELECT * FROM users WHERE emailaddress = '".$_POST['username']."'", 1); $userinfo = $db->querySingle("SELECT * FROM users WHERE emailaddress = '".$_POST['username']."'", 1);
if (isset($userinfo['password']) and (crypt($_POST['password'], $userinfo['password']) == $userinfo['password'])) { if (isset($userinfo['password']) and (crypt($_POST['password'], $userinfo['password']) == $userinfo['password'])) {
set_logged_in($_POST['username']); set_logged_in($_POST['username']);

25
users.php
View file

@ -8,36 +8,35 @@ if (!is_logged_in()) {
header("Location: index.php"); header("Location: index.php");
} }
if (!is_adminuser()) {
jtable_respond(null, 'error', "You need adminprivileges to get here");
}
if (isset($_GET['action'])) { if (isset($_GET['action'])) {
$action = $_GET['action']; $action = $_GET['action'];
} else { } else {
_jtable_respond(null, 'error', 'No action given'); jtable_respond(null, 'error', 'No action given');
} }
function _valid_user($name) {
return ( bool ) preg_match( "/^[a-z0-9@_.-]+$/i" , $name );
}
if ($action == "list") { if ($action == "list") {
$users = get_all_users(); $users = get_all_users();
_jtable_respond($users); jtable_respond($users);
} elseif ($action == "create" or $action == "update") { } elseif ($action == "create" or $action == "update") {
if (_valid_user($_POST['emailaddress']) === FALSE) { if (valid_user($_POST['emailaddress']) === FALSE) {
_jtable_respond(null, 'error', "Please only use ^[a-z0-9@_.-]+$ for usernames"); jtable_respond(null, 'error', "Please only use ^[a-z0-9@_.-]+$ for usernames");
} }
$isadmin = $_POST['isadmin'] ? $_POST['isadmin'] : '0'; $isadmin = $_POST['isadmin'] ? $_POST['isadmin'] : '0';
if (add_user($_POST['emailaddress'], $isadmin, $_POST['password']) === TRUE) { if (add_user($_POST['emailaddress'], $isadmin, $_POST['password']) === TRUE) {
unset($_POST['password']); unset($_POST['password']);
_jtable_respond($_POST, 'single'); jtable_respond($_POST, 'single');
} else { } else {
_jtable_respond(null, 'error', 'Could not add/change this user'); jtable_respond(null, 'error', 'Could not add/change this user');
} }
} elseif ($action == "delete") { } elseif ($action == "delete") {
if (delete_user($_POST['id']) === TRUE) { if (delete_user($_POST['id']) === TRUE) {
_jtable_respond(null, 'delete'); jtable_respond(null, 'delete');
} else { } else {
_jtable_respond(null, 'error', 'Could not delete this user'); jtable_respond(null, 'error', 'Could not delete this user');
} }
} }

45
zones.php
View file

@ -35,7 +35,7 @@ function _do_curl($method, $opts = null, $type = 'post') {
$return = curl_exec($ch); $return = curl_exec($ch);
$json = json_decode($return, 1); $json = json_decode($return, 1);
if (isset($json['error'])) { if (isset($json['error'])) {
_jtable_respond(null, 'error', 'API Responds: '.$json['error']); jtable_respond(null, 'error', 'API Responds: '.$json['error']);
} else { } else {
return $return; return $return;
} }
@ -51,10 +51,10 @@ function _create_record($name, $records, $input, $zoneurl) {
$content = ($input['type'] == "TXT") ? '"'.$input['content'].'"' : $input['content']; $content = ($input['type'] == "TXT") ? '"'.$input['content'].'"' : $input['content'];
if (_valid_label($input['name']) === FALSE) { if (_valid_label($input['name']) === FALSE) {
_jtable_respond(null, 'error', "Please only use [a-z0-9_/.-]"); jtable_respond(null, 'error', "Please only use [a-z0-9_/.-]");
} }
if (is_ascii($content) === FALSE or is_ascii($input['name']) === FALSE) { if (is_ascii($content) === FALSE or is_ascii($input['name']) === FALSE) {
_jtable_respond(null, 'error', "Please only use ASCII-characters in your fields"); jtable_respond(null, 'error', "Please only use ASCII-characters in your fields");
} }
if (preg_match('/^TXT$/', $input['type'])) { if (preg_match('/^TXT$/', $input['type'])) {
@ -111,13 +111,22 @@ function zonesort($a, $b) {
} }
function add_db_zone($zone, $owner) { function add_db_zone($zone, $owner) {
$db = _get_db(); if (valid_user($owner) === FALSE) {
jtable_respond(null, 'error', "$owner is not a valid username");
}
if (_valid_label($zone) === FALSE) {
jtable_respond(null, 'error', "$zone is not a valid zonename");
}
$db = get_db();
$zoneinfo = $db->querySingle("INSERT OR REPLACE INTO zones (zone, owner) VALUES ('".$zone."', (SELECT id FROM users WHERE emailaddress = '".$owner."'))"); $zoneinfo = $db->querySingle("INSERT OR REPLACE INTO zones (zone, owner) VALUES ('".$zone."', (SELECT id FROM users WHERE emailaddress = '".$owner."'))");
$db->close(); $db->close();
} }
function get_zone_owner($zone) { function get_zone_owner($zone) {
$db = _get_db(); if (_valid_label($zone) === FALSE) {
jtable_respond(null, 'error', "$zone is not a valid zonename");
}
$db = get_db();
$zoneinfo = $db->querySingle("SELECT u.emailaddress FROM users u, zones z WHERE z.owner = u.id AND z.zone = '".$zone."'", 1); $zoneinfo = $db->querySingle("SELECT u.emailaddress FROM users u, zones z WHERE z.owner = u.id AND z.zone = '".$zone."'", 1);
$db->close(); $db->close();
if (isset($zoneinfo['emailaddress']) && $zoneinfo['emailaddress'] != NULL ) { if (isset($zoneinfo['emailaddress']) && $zoneinfo['emailaddress'] != NULL ) {
@ -160,7 +169,7 @@ function check_owner($zone) {
if (isset($_GET['action'])) { if (isset($_GET['action'])) {
$action = $_GET['action']; $action = $_GET['action'];
} else { } else {
_jtable_respond(null, 'error', 'No action given'); jtable_respond(null, 'error', 'No action given');
} }
if ($action == "list" or $action== "listslaves") { if ($action == "list" or $action== "listslaves") {
@ -182,13 +191,13 @@ if ($action == "list" or $action== "listslaves") {
} }
} }
usort($return, "zonesort"); usort($return, "zonesort");
_jtable_respond($return); jtable_respond($return);
} elseif ($action == "create") { } elseif ($action == "create") {
if (_valid_label($_POST['name']) === FALSE) { if (_valid_label($_POST['name']) === FALSE) {
_jtable_respond(null, 'error', "Please only use [a-z0-9_/.-]"); jtable_respond(null, 'error', "Please only use [a-z0-9_/.-]");
} }
if (is_ascii($_POST['name']) === FALSE) { if (is_ascii($_POST['name']) === FALSE) {
_jtable_respond(null, 'error', "Please only use ASCII-characters in your domainname"); jtable_respond(null, 'error', "Please only use ASCII-characters in your domainname");
} }
if ($_POST['kind'] != null and $_POST['name'] != null) { if ($_POST['kind'] != null and $_POST['name'] != null) {
$nameservers = array(); $nameservers = array();
@ -199,7 +208,7 @@ if ($action == "list" or $action== "listslaves") {
array_push($nameservers, $_POST['nameserver2']); array_push($nameservers, $_POST['nameserver2']);
} }
} else { } else {
_jtable_respond(null, 'error', "Not enough data: ".print_r($_POST, 1)); jtable_respond(null, 'error', "Not enough data: ".print_r($_POST, 1));
} }
$vars['soa_edit_api'] = $defaults['soa_edit_api']; $vars['soa_edit_api'] = $defaults['soa_edit_api'];
} }
@ -231,9 +240,9 @@ if ($action == "list" or $action== "listslaves") {
$vars = $_POST; $vars = $_POST;
$vars['serial'] = 0; $vars['serial'] = 0;
$vars['records'] = array(); $vars['records'] = array();
_jtable_respond($vars, 'single'); jtable_respond($vars, 'single');
} else { } else {
_jtable_respond(null, 'error', "Not enough data: ".print_r($_POST, 1)); jtable_respond(null, 'error', "Not enough data: ".print_r($_POST, 1));
} }
} elseif ($action == "listrecords" && $_GET['zoneurl'] != null) { } elseif ($action == "listrecords" && $_GET['zoneurl'] != null) {
$rows = json_decode(_do_curl($_GET['zoneurl']), 1); $rows = json_decode(_do_curl($_GET['zoneurl']), 1);
@ -254,10 +263,10 @@ if ($action == "list" or $action== "listslaves") {
} }
$ret = array_merge($soa, $ns, $mx, $any); $ret = array_merge($soa, $ns, $mx, $any);
_jtable_respond($ret); jtable_respond($ret);
} elseif ($action == "delete") { } elseif ($action == "delete") {
_do_curl("/servers/:serverid:/zones/".$_POST['id'], array(), 'delete'); _do_curl("/servers/:serverid:/zones/".$_POST['id'], array(), 'delete');
_jtable_respond(null, 'delete'); jtable_respond(null, 'delete');
} elseif ($action == "createrecord" or $action == "editrecord") { } elseif ($action == "createrecord" or $action == "editrecord") {
$name = (!preg_match("/\.".$_POST['domain']."\.?$/", $_POST['name'])) ? $_POST['name'].'.'.$_POST['domain'] : $_POST['name']; $name = (!preg_match("/\.".$_POST['domain']."\.?$/", $_POST['name'])) ? $_POST['name'].'.'.$_POST['domain'] : $_POST['name'];
$name = preg_replace("/\.$/", "", $name); $name = preg_replace("/\.$/", "", $name);
@ -268,7 +277,7 @@ if ($action == "list" or $action== "listslaves") {
} }
$records =_create_record($name, $records, $_POST, $_GET['zoneurl']); $records =_create_record($name, $records, $_POST, $_GET['zoneurl']);
_jtable_respond($records[sizeof($records)-1], 'single'); jtable_respond($records[sizeof($records)-1], 'single');
} elseif ($action == "deleterecord") { } elseif ($action == "deleterecord") {
$todel = json_decode($_POST['id'], 1); $todel = json_decode($_POST['id'], 1);
$records = getrecords_by_name_type($_GET['zoneurl'], $todel['name'], $todel['type']); $records = getrecords_by_name_type($_GET['zoneurl'], $todel['name'], $todel['type']);
@ -294,11 +303,11 @@ if ($action == "list" or $action== "listslaves") {
'type' => $todel['type'], 'type' => $todel['type'],
'name' => $todel['name'])); 'name' => $todel['name']));
_do_curl($_GET['zoneurl'], $patch, 'patch'); _do_curl($_GET['zoneurl'], $patch, 'patch');
_jtable_respond(null, 'delete'); jtable_respond(null, 'delete');
} elseif ($action == "update") { } elseif ($action == "update") {
add_db_zone($_POST['name'], $_POST['owner']); add_db_zone($_POST['name'], $_POST['owner']);
_jtable_respond($_POST, 'single'); jtable_respond($_POST, 'single');
} else { } else {
_jtable_respond(null, 'error', 'No such action'); jtable_respond(null, 'error', 'No such action');
} }
?> ?>