pi-hole/FTL
1
0
Fork 0
mirror of https://github.com/pi-hole/FTL.git synced 2024-10-26 16:52:18 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
6,104 Commits 20 Branches 106 Tags
b9fc7da559a06ba367fc7c09a460660e94c01a67
Commit Graph
106 Commits
Author SHA1 Message Date
DL6ER 862d4922e1 Merge branch 'development-v6' into new/queryLogRegex 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-01-16 22:46:31 +01:00
DL6ER e35aa78030 Only free API data when the API was started 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-01-13 10:08:43 +01:00
DL6ER 35e1acb533 Do not accept password login when the system is configured to not require a password 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-01-07 15:26:56 +01:00
DL6ER a961a4d14f Do not accept DELETE session if no session is used (this also applies to password-less or localhost-no-auth mode) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-01-07 15:20:24 +01:00
DL6ER e5e9d11211 Fix DELETE API endpoints. They should return 204 when something was deleted and 404 is nothing was found at this resource 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-01-07 09:04:20 +01:00
Dominik 933e6f605f Merge pull request #1728 from pi-hole/tweak/query_auth 
Add authentication via query string
 2024-01-07 07:50:58 +01:00
Dominik 8eef4d81bb Merge pull request #1786 from pi-hole/tweak/session_no_ip 
Do not pin SID to a specific IP address
 2023-12-13 19:46:43 +01:00
DL6ER dc1b1d1e08 Rename src/{ => config}/setupVars.{c,h} 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-12-07 16:58:22 +01:00
DL6ER bd12616610 Do not pin SID to one specific IP address 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-11-27 13:34:00 +01:00
DL6ER 84ba6da404 max_sessions can only change across FTL restarts - not while it is running 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-11-10 20:05:06 +01:00
DL6ER 6e860f0c81 Add special reply for reused TOTP tokens 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-11-06 11:35:26 +01:00
DL6ER 28fe8dd499 Return 429 Too Many Requests with useful hint when number of available API seats is exceeded, also log currently configured number of API seats in the issues warning 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-11-06 10:38:15 +01:00
DL6ER add7ceadda Make number of maximum concurrent API sessions adjustable 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-11-04 17:00:59 +01:00
DL6ER a96c283c0c Add authentication via query string 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-11-03 19:41:08 +01:00
DL6ER 45fd5c8d36 Remove left-over debug output 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-31 19:40:33 +01:00
DL6ER e741ba4c94 Add app password support 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-23 18:13:12 +02:00
DL6ER f9a69a06ac Store sessions only momentarily in between FTL restarts 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-22 23:32:11 +02:00
DL6ER a2a8787239 Add new config option webserver.api.session.restore defaulting to true and move existing config option webserver.api.sessionTimeout -> webserver.api.session.timeout 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-22 08:51:11 +02:00
DL6ER 85b5c94858 Add save/restore of API sessions to the database to avoid a forced logout on FTL restarts. This updated the database to version 15 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-22 08:44:10 +02:00
DL6ER 64baa94395 Add new config option webserver.api.searchAPIauth defaulting to false 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-13 18:51:49 +02:00
DL6ER b60e8bdc2f Add /api/info/login and remove some parts from /api/auth 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-08 22:55:24 +02:00
DL6ER c4237f1846 Include HTTPS port (if any) in /api/auth response 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-08 09:11:32 +02:00
DL6ER 856aae1bef Add hint to login rate-limiting logging. We also remove the debug logging as there will always be a WARN 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-08 07:40:19 +02:00
DL6ER 2141db3d64 Add rate-limiting on password login attempts 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-07 19:59:32 +02:00
DL6ER 7772188498 Simplify deletion of sessions 
Signed-off-by: Dominik Derigs <dl6er@dl6er.de>
 2023-09-04 22:11:03 +02:00
DL6ER b6b08f0c55 Prefer other authentication methods over COOKIE (which needs an CORS token in addition) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-07-21 21:51:01 +02:00
DL6ER 6474c37e44 Add mg.request_info.is_authenticated to check if a user is authenticated 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-07-05 21:11:58 +02:00
DL6ER 2baa91b572 Enforece cookie auth only for API endpoints 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-31 21:13:27 +02:00
DL6ER 813509841b Accept cookie authentication only when CSRF header is provided (and correct) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-06-04 19:29:54 +02:00
DL6ER f5f0354b3c Generate and store CSRF token in the session 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-06-03 20:51:13 +02:00
Christian König 62cfc25b95 Fix spelling in v6 
Signed-off-by: Christian König <ckoenig@posteo.de>
 2023-05-30 22:42:13 +02:00
DL6ER 19c72d354e !!! BREAKING CHANGE !!! Switch to the proven memory-hard password-hashing alogorithm BALLOON. The stored password hash will be upgraded on the first successdful login. To wave the necessity to implement BALLOON with every client trying to access the API, we remove the existing challenge-response authentication in favor of allowing login straight with the password. This has been avoided in the past, however, seems now acceptable that FTL (even by default) offers secure end-to-end encryption over HTTPS. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-30 21:22:45 +02:00
DL6ER 73ae7e9474 Move password-related functions into a dedicated file 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-28 12:25:56 +02:00
DL6ER fe3ed0bb74 Add LUA pihole.needLogin(remote_addr) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-28 08:16:27 +02:00
DL6ER 7b72c762ce Add dns boolean to /api/auth signalling if the DNS server is up and running 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-24 20:25:02 +02:00
DL6ER f5cd3b00d2 Add strict_tls property to list of sessions showing if really every connection of this session happened over TLS/SSL 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-22 20:30:56 +02:00
DL6ER f06b2e5397 Add tls boolean to list of sessions to indicate whether this session was established over a secure (end-to-end encrypted) connection 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-09 10:01:05 +02:00
DL6ER b97d99ae3e Start timer thread keeping an eye on timed blocking mode changes 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-07 09:15:12 +02:00
DL6ER 9b32553a62 Add API documentation for method to delete session by ID 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-03-13 10:32:19 +01:00
DL6ER 749486273e Add method for deleteing sessions by their IDs 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-03-08 21:10:12 +01:00
DL6ER 4890e16b39 Use cryptographic randomness also for te API challenge and the SID generation 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-03-08 22:14:36 +01:00
DL6ER 9bf6176a64 Add TOTP 2FA to web interface and API 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-03-06 21:49:11 +01:00
DL6ER b0c46dc416 Sub-paths in /api/auth are not allowed (except for explicitly existing API endpoints) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-18 15:09:13 +01:00
DL6ER 4cc66df3f0 Rename /api/auth/session{ => s} 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-18 14:58:53 +01:00
DL6ER fe6093f970 Remember login timestamp of API sessions 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-18 14:54:38 +01:00
DL6ER 9eaab48405 Mark currently active session when listing active sessions 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-14 22:59:52 +01:00
DL6ER db0217f6f7 Add GET /api/auth/sessions for listing the currently active sessions 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-12 20:49:16 +01:00
DL6ER 5e436312f7 Invalidate all currently active sessions when password/pwhash are changed 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-12 20:42:04 +01:00
DL6ER 42c496e950 Add pseudo-element config->webserver.api.password which will compute and set webserver.api.pwhash to provide a convenient method of changing the password both via CLI and API 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-05 21:11:28 +01:00
DL6ER 187b0be39d Rename config.webserver.{api => }.sessionTimeout and ensure it is also used for the cookie 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-03 18:12:55 +01:00