Commit graph

154 commits

Author SHA1 Message Date
Khanh Ngo ccd2d8c31a Code adjustment as LGTM.com 2018-09-06 11:35:54 +07:00
Khanh Ngo 67dd626c65
Fix the user role checking in History routes 2018-09-04 17:58:13 +07:00
Khanh Ngo 902e63a64e
Fixing typo 2018-09-04 13:10:55 +07:00
Khanh Ngo fe07030487
Only Administrator users can remove the history 2018-09-04 13:02:19 +07:00
Khanh Ngo 26c2b5e169
Adjustment in setting handler to work without initial DB. Discussed in #350 2018-09-03 17:27:09 +07:00
Khanh Ngo c7689e7ce7
Fix domain template record modification #346 2018-09-02 17:01:43 +07:00
Khanh Ngo 615413ae90
Add record_quick_edit config to DB 2018-09-02 08:03:01 +07:00
Khanh Ngo 3481af149b
Add option to allow user to create domain 2018-09-01 17:53:05 +07:00
Khanh Ngo e6f82160c1
Fix python code as suggestion from LGTM 2018-08-31 18:00:41 +07:00
Khanh Ngo 3457d9214a Adding Operator role 2018-08-31 11:57:06 +07:00
Khanh Ngo 5e6806cc0f Fix domain account setting 2018-08-30 11:36:54 +07:00
Khanh Ngo 07e1bcdc47
Bug fixes. Adjustment in user input validation 2018-08-25 14:53:10 +07:00
Khanh Ngo 32dcc6482f
Fix db migration issue 2018-08-23 09:23:21 +07:00
Khanh Ngo 421ea627d8
#237. Allow LDAP user to use OTP 2018-08-22 09:43:33 +07:00
Khanh Ngo 9506315a46 manage records_allow_to_edit setting in DB 2018-08-22 08:36:53 +07:00
Khanh Ngo 74a7b5a3b7 Migrate more config values to db 2018-08-21 13:26:27 +07:00
Khanh Ngo 0b7580c82f
Read powerdns api setting from DB 2018-08-20 09:59:19 +07:00
Khanh Ngo f8f4ddcc85
Add validation for authentication setting form 2018-08-19 22:08:14 +07:00
Khanh Ngo babf62bae0
Fix Github/Google oAuth 2018-08-19 15:29:50 +07:00
Khanh Ngo ada6f844ff
Read LDAP config from DB instead of file. Adjustment in site titles 2018-08-18 22:42:18 +07:00
Khanh Ngo 4b9349c83e
Create DB config for pdns and authentication setting 2018-08-18 18:41:59 +07:00
Thomas M Steenholdt 0ac33aa3c4 Add option to edit users from the comfort of the UI
Update user management feature to allow editing user details directly in the admin user interface.

Also added an option to reset the two factor authentication data of a user, for when that's needed (lost device, technical issues etc).

(cherry picked from commit 3139616282a18c11463c6ecf78888417b2ac1c35)
2018-08-12 07:47:37 -02:00
Khanh Ngo 47d5858fc6 Merge branch 'fix-saml' 2018-08-07 09:09:34 +07:00
Khanh Ngo 96a9c12300 Log user's ip address when they login 2018-07-05 14:25:05 +07:00
Ian Bobbitt 480989e86a Manage Account memebership for SAML Users 2018-06-25 12:18:42 +00:00
Ian Bobbitt 765351c5e9 Emit audit history when SAML assertions promote or demote a user. 2018-06-24 23:54:29 +00:00
Ian Bobbitt 17a61d04b5 Merge remote-tracking branch 'upstream/master' into fix-saml
Cleaning up conflicts with upstream changes.
2018-06-24 22:31:54 +00:00
Thomas M Steenholdt 31305a3048 Add setting to allow/disallow quick editing of records
Adds an `allow_quick_edit` setting, using the improved setting handling logic from PR #287 to toggle whether records are editable by simply clicking the row or not.

Aims to fix #288
2018-06-24 00:25:33 -02:00
Thomas M Steenholdt 6c8a3ac36c Move setting definitions into code (rather than database).
For a setting to be useful, the code has to be able to make sense of it anyway. For this reason it makes sense, that the available settings are defined within the code, rather than in the database, where a missing row has previously caused problems. Instead, settings are now written to the database, when they are changed.

So instead of relying on the database initialization process to create all available settings for us in the database, the supported settings and their defaults are now in a `defaults` dict in the Setting class. With this in place, we can stop populating the `setting` table as a part of database initialization and it will be much easier to support new settings in the future (we no longer need to do anything to the database, to achieve that).

Another benefit is that any changes to default values will take effect automatically, unless the admin has already modified that setting to his/her liking.

To make it easier to get the value of a setting, falling back to defaults etc, a new function `get` has been added to the Setting class. Call it as `Setting().get('setting_name'), and it will take care of returning a setting from the database or return the default value for that setting, if nothing was found.

The `get` function returns `None`, if the setting passed to the function, does not exist in the `Setting.defaults` dict - Indicating that we don't know of a setting by that name.
2018-06-21 22:06:38 -02:00
Khanh Ngo 585985e4f0
Merge changes from master, PR #280 and resolve conflicts 2018-06-13 11:05:53 +07:00
Khanh Ngo c2df132040 Merge remote-tracking branch 'kaechele/use-webassets' 2018-06-13 09:58:15 +07:00
Khanh Ngo 8a22e030cd
Merge and resolve the conflicts from master 2018-06-13 09:35:19 +07:00
Khanh Ngo aa6909065d Merge remote-tracking branch 'tmuncks/initial-accounts' 2018-06-12 16:17:55 +07:00
Felix Kaechele 1bf869f508 Add webassets support
Also updates AdminLTE to latest stable version.

Signed-off-by: Felix Kaechele <felix@kaechele.ca>
2018-06-11 21:16:28 +02:00
Khanh Ngo b7dac8a565 Merge remote-tracking branch 'ProviderNL/feature/bg_domain_updates' 2018-06-11 16:52:03 +07:00
Jeroen Boonstra 39d3a4d6ac add bg settings for button 2018-06-08 13:22:03 +02:00
Jeroen Boonstra 8b2083be77 Add domain refresh endpoint 2018-06-08 13:21:17 +02:00
Jeroen Boonstra 734a6d5b32 Enable bg updates 2018-06-08 11:46:17 +02:00
Khanh Ngo ecdb9b9328
Merge pull request #275 from tmuncks/dont-revoke-your-own-rights
Fix user deletion
2018-06-08 09:16:49 +07:00
Thomas M Steenholdt 90f08ee92e Fix user deletion
An improper check causes problems when trying to delete a user. This fixes that error.

(cherry picked from commit 3c838cc0e4a2d4904d0fc919fb88c58ebd4fe4bd)
2018-06-07 15:34:28 -02:00
Khanh Ngo 2958ae663c
Validate user role and DNSSEC_ADMINS_ONLY config on DNSSEC related routes 2018-06-07 09:28:14 +07:00
Khanh Ngo 6f54b1a9de Merge remote-tracking branch 'tmuncks/dnssec-admin-only' 2018-06-07 08:53:01 +07:00
Khanh Ngo 2c5a98aca4
Merge pull request #273 from tmuncks/dont-revoke-your-own-rights
Restrict certain admin changes on the current user
2018-06-07 08:48:44 +07:00
Thomas M Steenholdt 5d40c42bbf Fix OTP validation
The result from the form is never an int but rather a string of digits, so that's what we should be checking for.

This fixes OTP validation

(cherry picked from commit 5fe3c8b9f92665db54d74dc6b2334666c318bf0c)
2018-06-06 09:19:30 -02:00
Thomas M Steenholdt ccec6c37b4 Restrict certain admin changes on the current user
Disable the admin toggle and delete operations from the current user, to avoid accidents.

(cherry picked from commit b0f5ac6df5d31f612dc833a88cfca8936c4137d7)
2018-06-06 09:15:25 -02:00
Thomas M Steenholdt 10f47039ec Add config option to allow DNSSEC changes only for admins
DNSSEC requires changes to the parent domain, which in many cases requires special access to a registry or the like.
For that reason, especially the option to disable DNSSEC can be dangerous - if DNSSEC is disabled in PowerDNS but not in the registry, the domain stops working.

For this reason, adding an option to disable DNSSEC changes for non-admins seems reasonable.

(cherry picked from commit 5cdfc0263b07f4658d51cf7c038fea9a8911152a)
2018-06-06 08:53:44 -02:00
Thomas M Steenholdt a4af4ad4b3 Implement per account domain access
Added the possibility for assigning users to an account, providing access to all domains associated with that account automatically.

This makes management easier, especially in installations with lots of domains and lots of managing entities.

The old style per-domain permissions are still there and working as usual. The two methods work perfectly side-by-side and are analogous to "user" (per-domain) and "group" (account) permissions as we know them from Active Directory and such places.

(cherry picked from commit 34fbc634d2848a7f76dc89a03dd8c0604068cc17)
2018-06-05 16:42:44 -02:00
Thomas M Steenholdt a3a58f16a5 Initial support for Accounts
This adds initial support for accounts a concept meant to signify a customer, a department or any other entity that somehow owns or manages one or more domains.

The purpose is to be able to assign an account to any number of domains, making it easy to track who owns or manages a domain, significantly improving manageability in setups with a large number of domains.

An account consists of a mandatory, unique `name` and optional `description`, `contact` name and `mail` address. The account `name` is stripped of spaces and symbols, and lower cased before getting stored in the database and in PowerDNS, to help ensure some type of predictability and uniqueness in the database.

The term *account* is actually taken from the PowerDNS database, where the `domains.account` column is used to store the account relationship, in in the form of the account `name`.

The link to a domain in PowerDNS-Admin is done through the `domain.account_id` FOREIGN KEY, that is linked to the `account.id` PRIMARY KEY.

(cherry picked from commits 4e95f33dfb0676d1c401a033c28bca3be7d6ec26, da0d596bd019a339549e2c59630a8fdee65d0e22, 7f06e6aaf4fd8011c784f24b7bbbba5f52aef319, 1c624dad8749024033d1d15dd6242ca52b39f135)
2018-06-04 13:10:02 -02:00
Khanh Ngo 4daf6f72a7
Merge pull request #256 from rene-dekkers/nonint_error
Fail when non-numeric otp token was inserted
2018-05-18 10:43:26 +07:00
René Dekkers 08335cdedc Fail when non-numeric otp token was inserted 2018-05-07 15:32:15 +02:00