pi-hole/FTL
1
0
Fork 0
mirror of https://github.com/pi-hole/FTL.git synced 2024-10-26 16:52:18 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
5,508 Commits 20 Branches 106 Tags
c4237f1846bbc34bb2e78e7afe3f62fdb768bc15
Commit Graph

85 Commits

Author SHA1 Message Date
DL6ER c4237f1846 Include HTTPS port (if any) in /api/auth response 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-08 09:11:32 +02:00
DL6ER 856aae1bef Add hint to login rate-limiting logging. We also remove the debug logging as there will always be a WARN 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-08 07:40:19 +02:00
DL6ER 2141db3d64 Add rate-limiting on password login attempts 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-07 19:59:32 +02:00
DL6ER 7772188498 Simplify deletion of sessions 
Signed-off-by: Dominik Derigs <dl6er@dl6er.de>
 2023-09-04 22:11:03 +02:00
DL6ER b6b08f0c55 Prefer other authentication methods over COOKIE (which needs an CORS token in addition) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-07-21 21:51:01 +02:00
DL6ER 6474c37e44 Add mg.request_info.is_authenticated to check if a user is authenticated 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-07-05 21:11:58 +02:00
DL6ER 2baa91b572 Enforece cookie auth only for API endpoints 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-31 21:13:27 +02:00
DL6ER 813509841b Accept cookie authentication only when CSRF header is provided (and correct) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-06-04 19:29:54 +02:00
DL6ER f5f0354b3c Generate and store CSRF token in the session 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-06-03 20:51:13 +02:00
Christian König 62cfc25b95 Fix spelling in v6 
Signed-off-by: Christian König <ckoenig@posteo.de>
 2023-05-30 22:42:13 +02:00
DL6ER 19c72d354e !!! BREAKING CHANGE !!! Switch to the proven memory-hard password-hashing alogorithm BALLOON. The stored password hash will be upgraded on the first successdful login. To wave the necessity to implement BALLOON with every client trying to access the API, we remove the existing challenge-response authentication in favor of allowing login straight with the password. This has been avoided in the past, however, seems now acceptable that FTL (even by default) offers secure end-to-end encryption over HTTPS. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-30 21:22:45 +02:00
DL6ER 73ae7e9474 Move password-related functions into a dedicated file 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-28 12:25:56 +02:00
DL6ER fe3ed0bb74 Add LUA pihole.needLogin(remote_addr) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-28 08:16:27 +02:00
DL6ER 7b72c762ce Add dns boolean to /api/auth signalling if the DNS server is up and running 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-24 20:25:02 +02:00
DL6ER f5cd3b00d2 Add strict_tls property to list of sessions showing if really every connection of this session happened over TLS/SSL 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-22 20:30:56 +02:00
DL6ER f06b2e5397 Add tls boolean to list of sessions to indicate whether this session was established over a secure (end-to-end encrypted) connection 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-09 10:01:05 +02:00
DL6ER b97d99ae3e Start timer thread keeping an eye on timed blocking mode changes 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-07 09:15:12 +02:00
DL6ER 9b32553a62 Add API documentation for method to delete session by ID 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-03-13 10:32:19 +01:00
DL6ER 749486273e Add method for deleteing sessions by their IDs 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-03-08 21:10:12 +01:00
DL6ER 4890e16b39 Use cryptographic randomness also for te API challenge and the SID generation 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-03-08 22:14:36 +01:00
DL6ER 9bf6176a64 Add TOTP 2FA to web interface and API 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-03-06 21:49:11 +01:00
DL6ER b0c46dc416 Sub-paths in /api/auth are not allowed (except for explicitly existing API endpoints) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-18 15:09:13 +01:00
DL6ER 4cc66df3f0 Rename /api/auth/session{ => s} 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-18 14:58:53 +01:00
DL6ER fe6093f970 Remember login timestamp of API sessions 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-18 14:54:38 +01:00
DL6ER 9eaab48405 Mark currently active session when listing active sessions 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-14 22:59:52 +01:00
DL6ER db0217f6f7 Add GET /api/auth/sessions for listing the currently active sessions 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-12 20:49:16 +01:00
DL6ER 5e436312f7 Invalidate all currently active sessions when password/pwhash are changed 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-12 20:42:04 +01:00
DL6ER 42c496e950 Add pseudo-element config->webserver.api.password which will compute and set webserver.api.pwhash to provide a convenient method of changing the password both via CLI and API 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-05 21:11:28 +01:00
DL6ER 187b0be39d Rename config.webserver.{api => }.sessionTimeout and ensure it is also used for the cookie 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-02-03 18:12:55 +01:00
DL6ER 3a71b3e23d Enforce authentication for all PHP files (except login.php) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-01-30 20:11:31 +01:00
DL6ER 48fc06d46b Add POST /api/teleporter to upload and install backed up configuration 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-01-25 21:51:12 +01:00
DL6ER 13168c377b Add GET /api/teleporter 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-01-23 21:56:11 +01:00
DL6ER 6afab76dcc Give hint about where the JSON parser failed when passing invalid JSON. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-01-23 21:26:11 +01:00
DL6ER 88e8ab9fd5 !!! BREAKING CHANGE !!! Redesign TOML config structure 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-01-22 12:32:10 +01:00
DL6ER f199ac2f08 Automatically migrate the API password hash and the lists of clients and domains to be excluded from setupVars.conf 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-01-08 21:21:38 +01:00
DL6ER 4ac52263e9 Implement login for python API checking script 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-01-08 16:04:26 +01:00
DL6ER e145d20d28 Rewrite the entire config-related code to allow for changing data without having to restart. Hereby, we greatly reduce code duplication in the TOML routines so we won't have to touch tme in the future when adding additional options. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-01-07 18:06:41 +01:00
DL6ER e776e0290a Rename JSON macros 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2022-12-31 13:17:18 +01:00
DL6ER 018dc6788c Report debug setting if enabled 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-06-10 12:30:02 +02:00
DL6ER 55bf825a81 Implement TOML config file reader/writer and a converter of the pre-v6.0 config file format. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-06-10 12:11:25 +02:00
DL6ER 467c4f5a17 Use specific log routines in api/api.c and api/auth.c 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-05-27 12:08:00 +02:00
DL6ER 56f0e56b1f Merge branch 'master' into new/http 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-02-26 17:24:41 +01:00
DL6ER b40c2eb162 Set HttpOnly on sid cookie for XSS protection 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-02-04 09:49:22 +01:00
DL6ER 339749da3f Change timestamps from integer to double for (up to) nanosecond accuracy. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-02-03 12:37:59 +01:00
DL6ER fcbe840804 Also allow authentication by sending SID via HEADER 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-02-03 09:08:23 +01:00
DL6ER 195dc3cb9a Rename routes.{c,g} -> api.{c,h} and reduce locking where this is not needed to gain more speed for the API 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-02-02 12:21:36 +01:00
DL6ER dfc9dac166 Add OpenAPI schema validation (npm test) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-02-01 12:03:20 +01:00
DL6ER afb154e402 Add /api/auth documentation, change expected payload from form to JSON for consistency 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-01-30 14:00:54 +01:00
DL6ER f67becc3e1 Introduce new ftl_conn struct that makes it easier to share stuff across processing subroutines in the same thread. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-01-21 16:24:16 +01:00
DL6ER 15ba45e50f Extract payload only once 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-01-21 13:52:31 +01:00