pi-hole/FTL
1
0
Fork 0
mirror of https://github.com/pi-hole/FTL.git synced 2024-10-26 16:52:18 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
6,807 Commits 20 Branches 106 Tags
d15e02fc35da3eada2ea92c370c28c68bc6bc9cf
Commit Graph

115 Commits

Author SHA1 Message Date
DL6ER 64144a960c Add session.x_forwarded_for property to API sessions 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-07-24 08:39:44 +02:00
DL6ER 069cc309b0 Remove webserver.api.localAPIauth option 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-06-19 22:07:18 +02:00
DL6ER 784e119892 Add CLI password generation 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-06-19 22:01:13 +02:00
DL6ER 950fc60ed3 Limit app password permissions by default. Add new app_sudo mode for users to remove this new limitation if they really need to 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-06-14 19:10:58 +02:00
DL6ER 14ea246f9a Always include timezone in human-readable timestamps 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-06-02 10:19:26 +02:00
DL6ER 306710e74a Add timezone information where this is appropriate. We do not include this in the log files to not needlessly change for format. Open for discussion 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-05-30 19:53:53 +02:00
Dominik 44377ad893 Address review comments 
Co-authored-by: RD WebDesign <github@rdwebdesign.com.br>
Signed-off-by: Dominik <DL6ER@users.noreply.github.com>
 2024-04-27 06:38:39 +02:00
DL6ER 49a5a0c60c Provide human-readable message about the session status when authenticating 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-04-25 21:14:05 +02:00
DL6ER 05867e20f2 Ensure cJSON is used in a thread-safe manner and add CI tests ensuring this. Also ensure every JSON parsing is doing error checking and reduce some code duplication. No functional change. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-03-24 08:55:12 +01:00
DL6ER 862d4922e1 Merge branch 'development-v6' into new/queryLogRegex 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-01-16 22:46:31 +01:00
DL6ER e35aa78030 Only free API data when the API was started 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-01-13 10:08:43 +01:00
DL6ER 35e1acb533 Do not accept password login when the system is configured to not require a password 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-01-07 15:26:56 +01:00
DL6ER a961a4d14f Do not accept DELETE session if no session is used (this also applies to password-less or localhost-no-auth mode) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-01-07 15:20:24 +01:00
DL6ER e5e9d11211 Fix DELETE API endpoints. They should return 204 when something was deleted and 404 is nothing was found at this resource 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2024-01-07 09:04:20 +01:00
Dominik 933e6f605f Merge pull request #1728 from pi-hole/tweak/query_auth 
Add authentication via query string
 2024-01-07 07:50:58 +01:00
Dominik 8eef4d81bb Merge pull request #1786 from pi-hole/tweak/session_no_ip 
Do not pin SID to a specific IP address
 2023-12-13 19:46:43 +01:00
DL6ER dc1b1d1e08 Rename src/{ => config}/setupVars.{c,h} 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-12-07 16:58:22 +01:00
DL6ER bd12616610 Do not pin SID to one specific IP address 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-11-27 13:34:00 +01:00
DL6ER 84ba6da404 max_sessions can only change across FTL restarts - not while it is running 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-11-10 20:05:06 +01:00
DL6ER 6e860f0c81 Add special reply for reused TOTP tokens 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-11-06 11:35:26 +01:00
DL6ER 28fe8dd499 Return 429 Too Many Requests with useful hint when number of available API seats is exceeded, also log currently configured number of API seats in the issues warning 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-11-06 10:38:15 +01:00
DL6ER add7ceadda Make number of maximum concurrent API sessions adjustable 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-11-04 17:00:59 +01:00
DL6ER a96c283c0c Add authentication via query string 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-11-03 19:41:08 +01:00
DL6ER 45fd5c8d36 Remove left-over debug output 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-31 19:40:33 +01:00
DL6ER e741ba4c94 Add app password support 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-23 18:13:12 +02:00
DL6ER f9a69a06ac Store sessions only momentarily in between FTL restarts 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-22 23:32:11 +02:00
DL6ER a2a8787239 Add new config option webserver.api.session.restore defaulting to true and move existing config option webserver.api.sessionTimeout -> webserver.api.session.timeout 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-22 08:51:11 +02:00
DL6ER 85b5c94858 Add save/restore of API sessions to the database to avoid a forced logout on FTL restarts. This updated the database to version 15 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-22 08:44:10 +02:00
DL6ER 64baa94395 Add new config option webserver.api.searchAPIauth defaulting to false 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-13 18:51:49 +02:00
DL6ER b60e8bdc2f Add /api/info/login and remove some parts from /api/auth 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-08 22:55:24 +02:00
DL6ER c4237f1846 Include HTTPS port (if any) in /api/auth response 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-08 09:11:32 +02:00
DL6ER 856aae1bef Add hint to login rate-limiting logging. We also remove the debug logging as there will always be a WARN 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-08 07:40:19 +02:00
DL6ER 2141db3d64 Add rate-limiting on password login attempts 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-10-07 19:59:32 +02:00
DL6ER 7772188498 Simplify deletion of sessions 
Signed-off-by: Dominik Derigs <dl6er@dl6er.de>
 2023-09-04 22:11:03 +02:00
DL6ER b6b08f0c55 Prefer other authentication methods over COOKIE (which needs an CORS token in addition) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-07-21 21:51:01 +02:00
DL6ER 6474c37e44 Add mg.request_info.is_authenticated to check if a user is authenticated 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-07-05 21:11:58 +02:00
DL6ER 2baa91b572 Enforece cookie auth only for API endpoints 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-31 21:13:27 +02:00
DL6ER 813509841b Accept cookie authentication only when CSRF header is provided (and correct) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-06-04 19:29:54 +02:00
DL6ER f5f0354b3c Generate and store CSRF token in the session 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-06-03 20:51:13 +02:00
Christian König 62cfc25b95 Fix spelling in v6 
Signed-off-by: Christian König <ckoenig@posteo.de>
 2023-05-30 22:42:13 +02:00
DL6ER 19c72d354e !!! BREAKING CHANGE !!! Switch to the proven memory-hard password-hashing alogorithm BALLOON. The stored password hash will be upgraded on the first successdful login. To wave the necessity to implement BALLOON with every client trying to access the API, we remove the existing challenge-response authentication in favor of allowing login straight with the password. This has been avoided in the past, however, seems now acceptable that FTL (even by default) offers secure end-to-end encryption over HTTPS. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-30 21:22:45 +02:00
DL6ER 73ae7e9474 Move password-related functions into a dedicated file 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-28 12:25:56 +02:00
DL6ER fe3ed0bb74 Add LUA pihole.needLogin(remote_addr) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-28 08:16:27 +02:00
DL6ER 7b72c762ce Add dns boolean to /api/auth signalling if the DNS server is up and running 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-24 20:25:02 +02:00
DL6ER f5cd3b00d2 Add strict_tls property to list of sessions showing if really every connection of this session happened over TLS/SSL 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-22 20:30:56 +02:00
DL6ER f06b2e5397 Add tls boolean to list of sessions to indicate whether this session was established over a secure (end-to-end encrypted) connection 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-09 10:01:05 +02:00
DL6ER b97d99ae3e Start timer thread keeping an eye on timed blocking mode changes 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-05-07 09:15:12 +02:00
DL6ER 9b32553a62 Add API documentation for method to delete session by ID 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-03-13 10:32:19 +01:00
DL6ER 749486273e Add method for deleteing sessions by their IDs 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-03-08 21:10:12 +01:00
DL6ER 4890e16b39 Use cryptographic randomness also for te API challenge and the SID generation 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-03-08 22:14:36 +01:00