pi-hole/FTL
1
0
Fork 0
mirror of https://github.com/pi-hole/FTL.git synced 2024-10-26 16:52:18 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity
4,836 Commits 20 Branches 106 Tags
f199ac2f089ed91cc20b43aacfa2b6dcda01331b
Commit Graph

51 Commits

Author SHA1 Message Date
DL6ER f199ac2f08 Automatically migrate the API password hash and the lists of clients and domains to be excluded from setupVars.conf 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-01-08 21:21:38 +01:00
DL6ER 4ac52263e9 Implement login for python API checking script 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-01-08 16:04:26 +01:00
DL6ER e145d20d28 Rewrite the entire config-related code to allow for changing data without having to restart. Hereby, we greatly reduce code duplication in the TOML routines so we won't have to touch tme in the future when adding additional options. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2023-01-07 18:06:41 +01:00
DL6ER e776e0290a Rename JSON macros 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2022-12-31 13:17:18 +01:00
DL6ER 018dc6788c Report debug setting if enabled 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-06-10 12:30:02 +02:00
DL6ER 55bf825a81 Implement TOML config file reader/writer and a converter of the pre-v6.0 config file format. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-06-10 12:11:25 +02:00
DL6ER 467c4f5a17 Use specific log routines in api/api.c and api/auth.c 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-05-27 12:08:00 +02:00
DL6ER 56f0e56b1f Merge branch 'master' into new/http 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-02-26 17:24:41 +01:00
DL6ER b40c2eb162 Set HttpOnly on sid cookie for XSS protection 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-02-04 09:49:22 +01:00
DL6ER 339749da3f Change timestamps from integer to double for (up to) nanosecond accuracy. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-02-03 12:37:59 +01:00
DL6ER fcbe840804 Also allow authentication by sending SID via HEADER 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-02-03 09:08:23 +01:00
DL6ER 195dc3cb9a Rename routes.{c,g} -> api.{c,h} and reduce locking where this is not needed to gain more speed for the API 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-02-02 12:21:36 +01:00
DL6ER dfc9dac166 Add OpenAPI schema validation (npm test) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-02-01 12:03:20 +01:00
DL6ER afb154e402 Add /api/auth documentation, change expected payload from form to JSON for consistency 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-01-30 14:00:54 +01:00
DL6ER f67becc3e1 Introduce new ftl_conn struct that makes it easier to share stuff across processing subroutines in the same thread. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-01-21 16:24:16 +01:00
DL6ER 15ba45e50f Extract payload only once 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-01-21 13:52:31 +01:00
DL6ER 992fac4bde Use SameSite=Strict as defense against some classes of cross-site request forgery (CSRF) attacks. This ensures the session cookie will only be sent in a first-party (i.e., Pi-hole) context and NOT be sent along with requests initiated by third party websites. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-01-16 12:35:05 +01:00
DL6ER 9beb006006 On 2017-08-27 (after v3.3, before v3.4), nettle changed the type of destination from uint_8t* to char* in all base64 and base16 functions (armor-signedness branch). This is a breaking change as this is a change in signedness causing issues when compiling FTL against older versions of nettle. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-01-16 11:30:25 +01:00
DL6ER 9966c84f54 Localhost should be able to request all ressources if this is set via a config option 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-01-15 19:18:08 +01:00
DL6ER 2af933ce88 Implement login as POST to /api/auth, logout as DELETE to /api/auth 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-01-15 19:18:08 +01:00
DL6ER 2c3cefe074 Ensure every auth object has the session object 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-01-15 19:18:08 +01:00
DL6ER 5b6ad3c853 Always report success when there is no password set 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-01-15 19:18:07 +01:00
DL6ER de8d8708e6 Improve used randomness generator 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-01-15 19:18:07 +01:00
DL6ER ae713a9d69 Request challange over /api/auth/login 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-01-15 19:18:07 +01:00
DL6ER c8d2e74bfb Implement challenge-response authentication 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2021-01-11 19:47:26 +01:00
DL6ER 92ec8e8d70 Update civetweb v1.12 -> v1.13 (and simplify auth-cookie handling) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-11-06 12:59:01 +01:00
DL6ER 67a0395390 Redirect PH7 errors into pihole-FTL.log (instead of showing in the browser output) and define gethostname() PHP function. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-06-02 08:52:55 +02:00
DL6ER c92a0e4bc4 Generally assume authentication to ease the development phase until we are actually able to add authentication. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-29 20:54:30 +02:00
DL6ER ef5cfe0a17 Add /api/stats/database/upstreams 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:37:16 +02:00
DL6ER c639cf9b6d Actively free expired user sessions to make room for new ones. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:28:30 +02:00
DL6ER c38285461f Automatically log in users when there is no (or an empty) password set in setupVars.conf 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:28:30 +02:00
DL6ER c389f06944 Make HTTP/API session timeout configurable through pihole-FTL.conf 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:28:30 +02:00
DL6ER 8742e140c0 Update user cookie when session is still running. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:28:30 +02:00
DL6ER 76bcef3771 Update timestamp of known client when we see them again. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:28:30 +02:00
DL6ER 2a07c992ab Add option for whether authentication is needed for localhost requests. Defaults to false. (API_AUTH_FOR_LOCALHOST) 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:26:55 +02:00
DL6ER 07285934cd Add more convenience functions and return 400 Bad Request responses when invalid parameters are given to the /api/stats endpoints. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:26:54 +02:00
DL6ER 5bb6a8e82d Add send_json_success() as yet another short convenience function. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:24:20 +02:00
DL6ER 1f78f2f276 Add new send_json_error() and send_json_unauthorized() routines everywhere we are sending an error. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:24:20 +02:00
DL6ER d9aa8bd45f Allow password-less login if WEBPASSWORD is not set or set to an empty string in setupVars.conf. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:24:20 +02:00
DL6ER 3efb39c3af Rename api/http.{c,h} to api/http-common.{c,h}. Separate routing function into api/routes.c. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:24:20 +02:00
DL6ER 0634bf363b Implement correct API response for failed auth requests. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:22:51 +02:00
DL6ER 14a2df5ae2 Print reason for Auth Failure. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:22:51 +02:00
DL6ER 004fb93bbe Add authentication requirement for most API endpoints. Some endpoints are special, e.g., /api/status where GET is allowed for anyone, however, POST is only allowed for authenticated users. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:22:51 +02:00
DL6ER d45ae84ec5 Add attribute malloc as the returned pointer cannot alias any other pointer valid when the function returns. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:22:51 +02:00
DL6ER 34c9091c4a Read actual password from setupVars.conf instead of always substituting 'A'. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:22:51 +02:00
DL6ER 243cfb0c81 Add support for adding domains through the FTL HTTP API. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:15:46 +02:00
DL6ER e51a069d48 Implement DELETE for /api/auth to allow users to actually log out. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:14:46 +02:00
DL6ER 411cf85ef7 Only allow login with correct password. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:14:46 +02:00
DL6ER 99cfb92d63 Add /api/auth/salt 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:14:46 +02:00
DL6ER 0cee19659e Implement client validation in the API. Both, the IP address and the set cookie have to be correct, otherwise the authorization is denied. We also check for the validity of the cookie before permitting the user. 
Signed-off-by: DL6ER <dl6er@dl6er.de>
 2020-05-27 00:14:46 +02:00