From a96c283c0cc19ccce2504cff11e79bbfe2c603f3 Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Fri, 3 Nov 2023 19:25:21 +0100
Subject: [PATCH] Add authentication via query string

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 src/api/auth.c          | 16 ++++++++++++++++
 test/api/libs/FTLAPI.py | 13 ++++++++++---
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/src/api/auth.c b/src/api/auth.c
index d48d171b..2f95b337 100644
--- a/src/api/auth.c
+++ b/src/api/auth.c
@@ -140,6 +140,7 @@ int check_client_auth(struct ftl_conn *api, const bool is_api)
 		}
 	}
 
+	// If not, does the client provide a session ID via COOKIE?
 	bool cookie_auth = false;
 	if(!sid_avail)
 	{
@@ -151,7 +152,22 @@ int check_client_auth(struct ftl_conn *api, const bool is_api)
 			// Mark SID as available
 			sid_avail = true;
 		}
+	}
 
+	// If not, does the client provide a session ID via URI?
+	if(!sid_avail && api->request->query_string && GET_VAR("sid", sid, api->request->query_string) > 0)
+	{
+		// "+" may have been replaced by " ", undo this here
+		for(unsigned int i = 0; i < SID_SIZE; i++)
+			if(sid[i] == ' ')
+				sid[i] = '+';
+
+		// Zero terminate SID string
+		sid[SID_SIZE-1] = '\0';
+		// Mention source of SID
+		sid_source = "URI";
+		// Mark SID as available
+		sid_avail = true;
 	}
 
 	if(!sid_avail)
diff --git a/test/api/libs/FTLAPI.py b/test/api/libs/FTLAPI.py
index a71bcec2..c8d19e8b 100644
--- a/test/api/libs/FTLAPI.py
+++ b/test/api/libs/FTLAPI.py
@@ -15,6 +15,7 @@ import requests
 from typing import List
 import json
 from hashlib import sha256
+import urllib.parse
 
 url = "http://pi.hole/api/auth"
 
@@ -23,6 +24,7 @@ class AuthenticationMethods(Enum):
 	HEADER = 1
 	BODY = 2
 	COOKIE = 3
+	QUERY_STR = 4
 
 # Class to query the FTL API
 class FTLAPI():
@@ -103,13 +105,18 @@ class FTLAPI():
 	def GET(self, uri: str, params: List[str] = [], expected_mimetype: str = "application/json", authenticate: AuthenticationMethods = AuthenticationMethods.BODY):
 		self.errors = []
 		try:
+			# Get json_data, headers and cookies
+			json_data, headers, cookies = self.get_jsondata_headers_cookies(authenticate)
+
+			# Add session ID to the request if authenticating via query string
+			if self.auth_method == AuthenticationMethods.QUERY_STR.name:
+				encoded_sid = urllib.parse.quote(self.session['sid'], safe='')
+				params.append("sid=" + encoded_sid)
+
 			# Add parameters to the URI (if any)
 			if len(params) > 0:
 				uri = uri + "?" + "&".join(params)
 
-			# Get json_data, headers and cookies
-			json_data, headers, cookies = self.get_jsondata_headers_cookies(authenticate)
-
 			if self.verbose:
 				print("GET " + self.api_url + uri + " with json_data: " + json.dumps(json_data))