From 3a71b3e23dfddbd4757ad86ac3d52df4fce6b433 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Mon, 30 Jan 2023 20:11:31 +0100 Subject: [PATCH] Enforce authentication for all PHP files (except login.php) Signed-off-by: DL6ER --- src/api/auth.c | 2 +- src/webserver/ph7.c | 46 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 47 insertions(+), 1 deletion(-) diff --git a/src/api/auth.c b/src/api/auth.c index 7e5fdb42..c9b8f895 100644 --- a/src/api/auth.c +++ b/src/api/auth.c @@ -88,7 +88,7 @@ int check_client_auth(struct ftl_conn *api) // Is the user requesting from localhost? // This may be allowed without authentication depending on the configuration if(!config.webserver.api.localAPIauth.v.b && (strcmp(api->request->remote_addr, LOCALHOSTv4) == 0 || - strcmp(api->request->remote_addr, LOCALHOSTv6) == 0)) + strcmp(api->request->remote_addr, LOCALHOSTv6) == 0)) return API_AUTH_LOCALHOST; // Check if there is a password hash diff --git a/src/webserver/ph7.c b/src/webserver/ph7.c index fa549b3c..41e87b59 100644 --- a/src/webserver/ph7.c +++ b/src/webserver/ph7.c @@ -28,6 +28,12 @@ #include // open #include +// file_exist() +#include "files.h" +// struct ftl_conn +#include "webserver/http-common.h" +// check_client_auth() +#include "api/api.h" // Pi-hole PH7 extensions #define PH7_CORE @@ -72,6 +78,46 @@ int ph7_handler(struct mg_connection *conn, void *cbdata) full_path[webroot_len + local_uri_len + 11u] = '\0'; } + // Append "login.php" to webhome string + const size_t login_uri_len = strlen(config.webserver.paths.webhome.v.s); + char *login_uri = calloc(login_uri_len + 10, sizeof(char)); + memcpy(login_uri, config.webserver.paths.webhome.v.s, login_uri_len); + strcpy(login_uri + login_uri_len, "login.php"); + login_uri[login_uri_len + 10u] = '\0'; + + // Remove initial slash from login_uri + if(login_uri[0] == '/') + memmove(login_uri, login_uri + 1, login_uri_len + 9); + + // Every page except admin/login.php requires authentication + if(strcmp(local_uri, login_uri) != 0) + { + // Build minimal api struct to check authentication + struct ftl_conn api = { 0 }; + api.conn = conn; + api.request = req_info; + // Check if the user is authenticated + if(check_client_auth(&api) == API_AUTH_UNAUTHORIZED) + { + // User is not authenticated, redirect to login page + mg_printf(conn, "HTTP/1.1 302 Found\r\nLocation: %slogin.php\r\n\r\n", config.webserver.paths.webhome.v.s); + free(full_path); + free(login_uri); + return 302; + } + } + + // Free memory + free(login_uri); + + // Check if the file exists + if(!file_exists(full_path)) + { + // File does not exist, fall back to HTTP server to handle the 404 event + free(full_path); + return 0; + } + // Compile PHP script into byte-code // This usually takes only 1-2 msec even for larger scripts on a Raspberry // Pi 3, so there is little point in buffering the compiled script