tuxis-ie/nsedit — pull request #6 by stbuehler (2014-10-05 11:37:55+00:00)
Title: Fix security bugs (missing access checks, csrf token), fix other bugs (edit records, ..), add some features (masters for slaves, ...)

- add a lot of permission checks:
zone edits were completely unchecked (after login); only list and creation were
protected.
- reduce regular expression usage
- don't use user provided names/ids/urls for requests; instead use them
to search for the zone in the list of all zones.
- rename 'label' to 'name' in template records ('name' is used in all
other places)
- make 'localhost' default $apisid
- add 'soa_edit' default
- remove gen_pw/pwgen caller; use openssl instead for random password
- fix a lot of bugs (editrecord, TXT quoting, name checking, ...)
- improve record sorting
- add CSS classes to fields
- use monospace font for field values
- min-width for record content edit field, stretch label and content
to dialog width
- max-width for record content table cell, explicit (percent) column
sizes
- text-align: right numbers
- display raw data in cells with $('').text(...)
- add DNSSEC info and masters for slave zones
- add some RR types and disable distinction from address .arpa zone;
show all types for every field
- rework session handling; add CSRF tokens and autologin

Sadly the code was in a very bad shape. I'm still not happy with index.php; mixing php, html and javascript like that is horrible.

The monospace font for the fields is just my own preference - if this is a problem I can undo it. Also jtables makes it very hard to style the column width - the CSS rules now are working on my screen, but don't scale well (test with long content, like TLSA records - a long hex string the browser doesn't like to break).

Also it might be nice to use more consistent names overall ('label' vs 'name', 'username' vs 'emailaddress', edit, update, list, ...).