From 1d7086dc6c17afe541d83e6694c5f1963e901b7e Mon Sep 17 00:00:00 2001 From: Maurice Meyer Date: Wed, 8 Mar 2017 11:23:15 +0100 Subject: [PATCH 01/15] Added drop and readd of foreign key on user ->userid (#33) This fixes the issue that the upgrade seems to work but the change from permissions.user to permissions.userid is not applied because of the foreign key. --- api/upgrade.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/api/upgrade.php b/api/upgrade.php index dcbcb67..c7ca7ec 100644 --- a/api/upgrade.php +++ b/api/upgrade.php @@ -131,8 +131,11 @@ if(isset($input->action) && $input->action == "requestUpgrade") { } if($currentVersion < 4) { $sql["mysql"] = " + ALTER TABLE permissions DROP FOREIGN KEY permissions_ibfk_2; RENAME TABLE user TO users; ALTER TABLE permissions CHANGE user userid INT(11); + ALTER TABLE permissions + ADD CONSTRAINT permissions_ibfk_2 FOREIGN KEY (userid) REFERENCES users (id) ON DELETE CASCADE; ALTER TABLE users ADD CONSTRAINT UNIQUE KEY user_name_index (name); From f922f19fd3290f44a194c2bf68301dcd0e4355b4 Mon Sep 17 00:00:00 2001 From: Emilien Devos Date: Sun, 9 Apr 2017 12:15:46 +0200 Subject: [PATCH 02/15] Add powerdns 4.0 record types (#35) --- js/edit-master.js | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/js/edit-master.js b/js/edit-master.js index 144a397..238bc64 100644 --- a/js/edit-master.js +++ b/js/edit-master.js @@ -22,12 +22,12 @@ var sort = { var domainName = ""; var recordTypes = [ - "A","AAAA","AFSDB","CERT","CNAME","DHCID", - "DLV","DNSKEY","DS","EUI48","EUI64","HINFO", - "IPSECKEY","KEY","KX","LOC","MINFO","MR", - "MX","NAPTR","NS","NSEC","NSEC3","NSEC3PARAM", - "OPT","PTR","RKEY","RP","RRSIG","SPF", - "SRV","SSHFP","TLSA","TSIG","TXT","WKS" + "A","A6","AAAA","AFSDB","ALIAS","CAA","CDNSKEY","CDS","CERT","CNAME","DHCID", + "DLV","DNAME","DNSKEY","DS","EUI48","EUI64","HINFO", + "IPSECKEY","KEY","KX","LOC","MAILA","MAILB","MINFO","MR", + "MX","NAPTR","NS","NSEC","NSEC3","NSEC3PARAM","OPENPGPKEY", + "OPT","PTR","RKEY","RP","RRSIG","SIG","SPF", + "SRV","TKEY","SSHFP","TLSA","TSIG","TXT","WKS","MBOXFW","URL" ]; $(document).ready(function() { @@ -476,4 +476,4 @@ function shake(element){ } $(element).animate({ left: 0},interval); -} \ No newline at end of file +} From 2bb00ea0ba9bbf640b21d94bf20cf87d3a8a4b85 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jens=20Mei=C3=9Fner?= Date: Mon, 22 May 2017 11:08:05 +0200 Subject: [PATCH 03/15] Change dbPort when dbType is changed during install. (#39) --- js/install.js | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/js/install.js b/js/install.js index 3351d95..c486010 100644 --- a/js/install.js +++ b/js/install.js @@ -21,6 +21,14 @@ $(document).ready(function() { checkSettings(); }); + $('#dbType').change(function() { + if($(this).val() == 'mysql') { + $('#dbPort').val(3306); + } else if($(this).val() == 'pgsql') { + $('#dbPort').val(5432); + } + }); + $('#adminPassword2').bind("change keyup paste", function() { if($('#adminPassword').val() == $('#adminPassword2').val()) { $(this).parent().removeClass("has-error"); From ccc423291cb0e6f8c58849f71821e7425b7c030e Mon Sep 17 00:00:00 2001 From: Lukas Metzger Date: Thu, 29 Jun 2017 15:18:45 +0200 Subject: [PATCH 04/15] Fixing possible remote code executuin vulnerability introduced by commit 3bf4e2874a0120d99ae02a1a9f4a6e74094c7dc1 Thanks to RedTeam Pentesting for pointing out this issue --- api/install.php | 8 +++++--- config/config-default.php | 2 +- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/api/install.php b/api/install.php index 9cac649..4e2c448 100644 --- a/api/install.php +++ b/api/install.php @@ -184,16 +184,18 @@ INSERT INTO options(name,value) VALUES ('schema_version', 4); "; try { - $db = new PDO("$input->type:dbname=$input->database;host=$input->host;port=$input->port", $input->user, $input->password); + $db = new PDO("$input->type:dbname=$input->database;host=$input->host;port=" . intval($input->port), $input->user, $input->password); } catch (PDOException $e) { $retval['status'] = "error"; $retval['message'] = serialize($e); } -$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); + if (!isset($retval)) { + $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); + $passwordHash = password_hash($input->userPassword, PASSWORD_DEFAULT); $queries = explode(";", $sql[$input->type]); @@ -220,7 +222,7 @@ if (!isset($retval)) { $configFile[] = '$config[\'db_user\'] = \'' . addslashes($input->user) . "';"; $configFile[] = '$config[\'db_password\'] = \'' . addslashes($input->password) . "';"; $configFile[] = '$config[\'db_name\'] = \'' . addslashes($input->database) . "';"; - $configFile[] = '$config[\'db_port\'] = ' . addslashes($input->port) . ";"; + $configFile[] = '$config[\'db_port\'] = ' . intval($input->port) . ";"; $configFile[] = '$config[\'db_type\'] = \'' . addslashes($input->type) . "';"; $retval['status'] = "success"; diff --git a/config/config-default.php b/config/config-default.php index e4f0d57..7e5154b 100644 --- a/config/config-default.php +++ b/config/config-default.php @@ -30,4 +30,4 @@ $config['nonce_lifetime'] = 15; //Number of rows in domain overview $config['domain_rows'] = 15; -include 'config-user.php'; +require 'config-user.php'; From 39dd3f86c68e26b7acfb6ccf929a37ede748550a Mon Sep 17 00:00:00 2001 From: Maurice Meyer Date: Thu, 20 Jul 2017 16:18:32 +0200 Subject: [PATCH 05/15] Moved to enable setting of headers --- index.php | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/index.php b/index.php index c1e93d2..f5adbb2 100644 --- a/index.php +++ b/index.php @@ -1,3 +1,13 @@ + - PDNS Manager From b1a06a8684aa2502c91b1b31af48847cbbf42ba2 Mon Sep 17 00:00:00 2001 From: Maurice Meyer Date: Thu, 20 Jul 2017 16:22:46 +0200 Subject: [PATCH 06/15] Removed spaces from empty lines --- README.md | 6 --- add-domain.php | 13 ------ api/add-domain.php | 15 ------- api/domains.php | 34 ---------------- api/edit-master.php | 57 --------------------------- api/edit-remote.php | 24 ----------- api/edit-user.php | 30 -------------- api/index.php | 10 ----- api/install.php | 38 ------------------ api/password.php | 7 ---- api/remote.php | 25 ------------ api/upgrade.php | 30 -------------- api/users.php | 21 ---------- config/config-default.php | 5 --- domains.php | 12 ------ edit-master.php | 15 ------- edit-remote.php | 13 ------ edit-user.php | 16 -------- include/custom.css | 7 ---- index.php | 8 ---- install.php | 16 -------- js/add-domain.js | 15 ------- js/domains.js | 37 ----------------- js/edit-master.js | 83 --------------------------------------- js/edit-remote.js | 40 ------------------- js/edit-user.js | 37 ----------------- js/index.js | 6 --- js/install.js | 11 ------ js/password.js | 12 ------ js/upgrade.js | 6 --- js/users.js | 24 ----------- lib/checkversion.php | 5 --- lib/database.php | 2 - lib/headers.php | 2 - lib/session.php | 4 -- lib/soa-mail.php | 7 ---- lib/update-serial.php | 15 ------- logout.php | 7 ---- make-release.sh | 2 - password.php | 12 ------ upgrade.php | 17 -------- users.php | 10 ----- 42 files changed, 756 deletions(-) diff --git a/README.md b/README.md index 380b94e..da2bc95 100644 --- a/README.md +++ b/README.md @@ -1,22 +1,16 @@ # PDNS Manager - [PDNS Manager](https://pdnsmanager.lmitsystems.de) is a simple yet powerful free administration tool for the Powerdns authoritative nameserver. It supports master and native zones. - PNDS Manager was developed from scratch to achieve a user-friendly and pretty looking interface. - PDNS Manager also features a powerful API to set records programatically. This can be used e.g. for a dynamic DNS service, but also to obtain certificates from [Let's Encrypt](https://letsencrypt.org/) via the dns-01 challenge. - PDNS Manager is written in PHP using [Bootstrap](http://getbootstrap.com/) and [jQuery](http://jquery.com/). The backend uses a MySQL/Maria DB or Postgres database. The database is also used by Powerdns using the pdns-backend-mysql or pdns-backend-pgsql backend. - ## More information You can find more information and documentation as well as contact information on [pdnsmanager.lmitsystems.de](https://pdnsmanager.lmitsystems.de). There are also some tutorials to get you quickly up and running. - ## Contribute If you are looking for a new feature or you found a bug, feel free to create a pull request or open a issue. diff --git a/add-domain.php b/add-domain.php index 89a87b6..d39dd94 100644 --- a/add-domain.php +++ b/add-domain.php @@ -1,13 +1,10 @@ - PDNS Manager - Domains diff --git a/domains.php b/domains.php index d126bf8..fb8aacb 100644 --- a/domains.php +++ b/domains.php @@ -1,3 +1,7 @@ + - PDNS Manager - Domains diff --git a/edit-master.php b/edit-master.php index bc11571..798b340 100644 --- a/edit-master.php +++ b/edit-master.php @@ -1,3 +1,7 @@ + - PDNS Manager - Domains diff --git a/edit-remote.php b/edit-remote.php index ce54668..7a6ce31 100644 --- a/edit-remote.php +++ b/edit-remote.php @@ -1,3 +1,7 @@ + - PDNS Manager - Remotes diff --git a/edit-user.php b/edit-user.php index 7eac887..a6ac67d 100644 --- a/edit-user.php +++ b/edit-user.php @@ -1,3 +1,7 @@ + - PDNS Manager - Users diff --git a/install.php b/install.php index 35ec7ed..a8bcde2 100644 --- a/install.php +++ b/install.php @@ -1,3 +1,9 @@ + - PDNS Manager - Domains diff --git a/logout.php b/logout.php index 999e6fb..4a1ec1d 100644 --- a/logout.php +++ b/logout.php @@ -1,3 +1,9 @@ + - PDNS Manager diff --git a/password.php b/password.php index 858e0a3..8d4f223 100644 --- a/password.php +++ b/password.php @@ -1,3 +1,7 @@ + - PDNS Manager - Password diff --git a/upgrade.php b/upgrade.php index 0b5b9f4..0e4e9be 100644 --- a/upgrade.php +++ b/upgrade.php @@ -1,3 +1,12 @@ + - PDNS Manager - Upgrade diff --git a/users.php b/users.php index 9c5d14f..d76b087 100644 --- a/users.php +++ b/users.php @@ -1,3 +1,7 @@ + - PDNS Manager - Users From 921b30e47dd7464075dabe1b580dc7ab5cdc16cf Mon Sep 17 00:00:00 2001 From: Maurice Meyer Date: Fri, 21 Jul 2017 17:21:17 +0200 Subject: [PATCH 08/15] Fixed PHP Fatal error when config-user.php missing --- config/config-default.php | 6 +++++- lib/database.php | 2 +- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/config/config-default.php b/config/config-default.php index fa8ad51..38bae70 100644 --- a/config/config-default.php +++ b/config/config-default.php @@ -25,4 +25,8 @@ $config['db_name'] = "pdnsmanager"; $config['nonce_lifetime'] = 15; //Number of rows in domain overview $config['domain_rows'] = 15; -require 'config-user.php'; + +// If config-user.php does not exist, redirect to the setup page +if(!(include 'config-user.php')) { + Header("Location: install.php"); +} diff --git a/lib/database.php b/lib/database.php index 3ca4790..b871cce 100644 --- a/lib/database.php +++ b/lib/database.php @@ -18,5 +18,5 @@ try { $db = new PDO($config['db_type'].":dbname=".$config['db_name'].";host=".$config['db_host'].";port=".strval($config['db_port']), $config['db_user'], $config['db_password']); } catch (PDOException $e) { - die("Connection to database failed"); + die("Connection to the database failed. There is an error in the database configuration."); } From 31d7ecfdf3c3dbff12fbdcf30bba2381ffd79c52 Mon Sep 17 00:00:00 2001 From: Maurice Meyer Date: Fri, 21 Jul 2017 17:22:03 +0200 Subject: [PATCH 09/15] Improved readability --- config/config-default.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/config/config-default.php b/config/config-default.php index 38bae70..fe95ef6 100644 --- a/config/config-default.php +++ b/config/config-default.php @@ -1,5 +1,5 @@ . * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -14,6 +14,7 @@ * See the License for the specific language governing permissions and * limitations under the License. */ + //Database settings $config['db_type'] = "mysql"; $config['db_host'] = "localhost"; @@ -21,8 +22,10 @@ $config['db_user'] = "root"; $config['db_password'] = ""; $config['db_port'] = 3306; $config['db_name'] = "pdnsmanager"; + //Remote update $config['nonce_lifetime'] = 15; + //Number of rows in domain overview $config['domain_rows'] = 15; From 4c4269c1fa03b8ebe0250666de959b2400ea5efc Mon Sep 17 00:00:00 2001 From: Maurice Meyer Date: Fri, 21 Jul 2017 17:48:53 +0200 Subject: [PATCH 10/15] Fix #34, now showing an error message --- api/install.php | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/api/install.php b/api/install.php index 795b3a5..25626f3 100644 --- a/api/install.php +++ b/api/install.php @@ -18,6 +18,13 @@ if(file_exists("../config/config-user.php")) { echo "Permission denied!"; exit(); } + +if(!(is_writable("../config"))) { + $retval['status'] = "error"; + $retval['message'] = "Can't write to the config directory, please check the file system permissions"; + die(json_encode($retval)); +} + //Get input $input = json_decode(file_get_contents('php://input')); //Database command From 016183f244eb09be1711559976bbe939a783a42c Mon Sep 17 00:00:00 2001 From: Maurice Meyer Date: Fri, 21 Jul 2017 17:50:09 +0200 Subject: [PATCH 11/15] Now displaying error when admin user can't be created --- api/install.php | 58 +++++++++++++++++++++++++++---------------------- 1 file changed, 32 insertions(+), 26 deletions(-) diff --git a/api/install.php b/api/install.php index 25626f3..b236d82 100644 --- a/api/install.php +++ b/api/install.php @@ -1,5 +1,5 @@ . * * Licensed under the Apache License, Version 2.0 (the "License"); @@ -166,38 +166,44 @@ DELETE FROM options where name='schema_version'; INSERT INTO options(name,value) VALUES ('schema_version', 4); "; try { - $db = new PDO("$input->type:dbname=$input->database;host=$input->host;port=" . intval($input->port), $input->user, $input->password); + $db = new PDO("$input->type:dbname=$input->database;host=$input->host;port=" . intval($input->port), $input->user, $input->password); } catch (PDOException $e) { $retval['status'] = "error"; $retval['message'] = serialize($e); } if (!isset($retval)) { - $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); - $passwordHash = password_hash($input->userPassword, PASSWORD_DEFAULT); - $queries = explode(";", $sql[$input->type]); - $db->beginTransaction(); - foreach ($queries as $query) { - if (preg_replace('/\s+/', '', $query) != '') { - $db->exec($query); - } - } - $db->commit(); - $stmt = $db->prepare("INSERT INTO users(name,password,type) VALUES (:user,:hash,'admin')"); - $stmt->bindValue(':user', $input->userName, PDO::PARAM_STR); - $stmt->bindValue(':hash', $passwordHash, PDO::PARAM_STR); - $stmt->execute(); - $configFile = Array(); - $configFile[] = 'host) . "';"; - $configFile[] = '$config[\'db_user\'] = \'' . addslashes($input->user) . "';"; - $configFile[] = '$config[\'db_password\'] = \'' . addslashes($input->password) . "';"; - $configFile[] = '$config[\'db_name\'] = \'' . addslashes($input->database) . "';"; - $configFile[] = '$config[\'db_port\'] = ' . intval($input->port) . ";"; - $configFile[] = '$config[\'db_type\'] = \'' . addslashes($input->type) . "';"; - $retval['status'] = "success"; try { - file_put_contents("../config/config-user.php", implode("\n", $configFile)); + $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); + $passwordHash = password_hash($input->userPassword, PASSWORD_DEFAULT); + $queries = explode(";", $sql[$input->type]); + $db->beginTransaction(); + foreach ($queries as $query) { + if (preg_replace('/\s+/', '', $query) != '') { + $db->exec($query); + } + } + $db->commit(); + $stmt = $db->prepare("INSERT INTO users(name,password,type) VALUES (:user,:hash,'admin')"); + $stmt->bindValue(':user', $input->userName, PDO::PARAM_STR); + $stmt->bindValue(':hash', $passwordHash, PDO::PARAM_STR); + $stmt->execute(); + $configFile = Array(); + $configFile[] = 'host) . "';"; + $configFile[] = '$config[\'db_user\'] = \'' . addslashes($input->user) . "';"; + $configFile[] = '$config[\'db_password\'] = \'' . addslashes($input->password) . "';"; + $configFile[] = '$config[\'db_name\'] = \'' . addslashes($input->database) . "';"; + $configFile[] = '$config[\'db_port\'] = ' . intval($input->port) . ";"; + $configFile[] = '$config[\'db_type\'] = \'' . addslashes($input->type) . "';"; + $retval['status'] = "success"; + try { + file_put_contents("../config/config-user.php", implode("\n", $configFile)); + } + catch (Exception $e) { + $retval['status'] = "error"; + $retval['message'] = serialize($e); + } } catch (Exception $e) { $retval['status'] = "error"; From 058cafb6d7a101ac4f27653445df684203e37420 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jens=20Mei=C3=9Fner?= Date: Tue, 29 Aug 2017 12:00:52 +0200 Subject: [PATCH 12/15] Keep input data after adding records to ease adding of several similar records. --- js/edit-master.js | 5 ----- 1 file changed, 5 deletions(-) diff --git a/js/edit-master.js b/js/edit-master.js index 328cbf0..fea27e4 100644 --- a/js/edit-master.js +++ b/js/edit-master.js @@ -304,11 +304,6 @@ function addRecord() { $('#table-records>tbody>tr').last().find('span.glyphicon-trash').click(trashClicked); $('#table-records>tbody>tr').last().find('span.glyphicon-share').click(remoteClicked); requestSerial(); - $('#addName').val(""); - $('#addType').val("A").change(); - $('#addContent').val(""); - $('#addPrio').val(""); - $('#addTtl').val(""); }, "json" ); From 00c3a32de8137248ae7ecef3de776e5900bddd3e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jens=20Mei=C3=9Fner?= Date: Tue, 29 Aug 2017 12:25:37 +0200 Subject: [PATCH 13/15] Set default record type to PTR if a reverse zone is detected. --- js/edit-master.js | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/js/edit-master.js b/js/edit-master.js index fea27e4..5ce59df 100644 --- a/js/edit-master.js +++ b/js/edit-master.js @@ -339,11 +339,20 @@ function requestDomainName() { $('#domain-name').text(data.name); $('#add-domain-name').text("." + data.name); domainName = data.name; + setDefaultRecordType(); $('#addButton').unbind().click(addRecord); }, "json" ); } +function setDefaultRecordType() { + var reverseZone = false; + if(domainName.endsWith('.in-addr.arpa')) reverseZone = true; + if(domainName.endsWith('.ip6.arpa')) reverseZone = true; + if(reverseZone) { + $('#addType').val('PTR').change(); + } +} function enableFilter(enable) { if(enable) { $('#searchName').prop("disabled", false); From e0c12809e905210b112e544220db44d83dd9623a Mon Sep 17 00:00:00 2001 From: Eugen Ganshorn Date: Sun, 24 Sep 2017 11:56:01 +0200 Subject: [PATCH 14/15] fixed bindColumn --- api/remote.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/api/remote.php b/api/remote.php index 85620a1..85b3f65 100644 --- a/api/remote.php +++ b/api/remote.php @@ -64,8 +64,8 @@ if(filter_input(INPUT_SERVER, "REQUEST_METHOD") == "GET") { $stmt = $db->prepare("SELECT E.name,E.id FROM remote R JOIN records E ON R.record = E.id WHERE R.id=:id LIMIT 1"); $stmt->bindValue(':id', $input->id, PDO::PARAM_INT); $stmt->execute(); - $stmt->bindColumn('E.name', $domainName); - $stmt->bindColumn('E.id', $record); + $stmt->bindColumn('name', $domainName); + $stmt->bindColumn('id', $record); $stmt->fetch(PDO::FETCH_BOUND); if($domainName != $input->domain) { $return['status'] = "error"; From c3250e58fcf818f40fa58f78216c5cdacb472c13 Mon Sep 17 00:00:00 2001 From: Maurice Meyer Date: Sun, 24 Sep 2017 16:51:02 +0200 Subject: [PATCH 15/15] Fixed mail handling in SOA records. Fixes #51 --- lib/soa-mail.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/soa-mail.php b/lib/soa-mail.php index 5bacffd..abaa94f 100644 --- a/lib/soa-mail.php +++ b/lib/soa-mail.php @@ -24,5 +24,5 @@ function mail_to_soa($mail) { $parts = explode("@", $mail); $parts[0] = str_replace(".", "\.", $parts[0]); $parts[] = ""; - return implode(".", $parts); -} \ No newline at end of file + return rtrim(implode(".", $parts), "."); +}