diff --git a/api_db.php b/api_db.php index e40ac160..3a79508a 100644 --- a/api_db.php +++ b/api_db.php @@ -11,6 +11,7 @@ header('Content-type: application/json'); require("scripts/pi-hole/php/database.php"); require("scripts/pi-hole/php/password.php"); require("scripts/pi-hole/php/auth.php"); +require("scripts/pi-hole/php/func.php"); check_cors(); // Set maximum execution time to 10 minutes @@ -31,7 +32,7 @@ function resolveHostname($clientip, $printIP) return $clientname; } - else if(filter_var($clientip, FILTER_VALIDATE_IP)) + else if(validIP($clientip)) { // Get host name of client and convert to lower case $clientname = strtolower(gethostbyaddr($ipaddr)); diff --git a/scripts/pi-hole/php/auth.php b/scripts/pi-hole/php/auth.php index 83e51995..16a7390e 100644 --- a/scripts/pi-hole/php/auth.php +++ b/scripts/pi-hole/php/auth.php @@ -126,7 +126,7 @@ function check_csrf($token) { function check_domain(&$domains) { foreach($domains as &$domain) { - $validDomain = is_valid_domain_name($domain); + $validDomain = validDomain($domain); if(!$validDomain){ log_and_die(htmlspecialchars($domain. ' is not a valid domain')); } diff --git a/scripts/pi-hole/php/func.php b/scripts/pi-hole/php/func.php index a3e82eb1..1573e5d6 100644 --- a/scripts/pi-hole/php/func.php +++ b/scripts/pi-hole/php/func.php @@ -6,11 +6,71 @@ * This file is copyright under the latest version of the EUPL. * Please see LICENSE file for your rights under this license. */ -function is_valid_domain_name($domain_name) +// Credit: http://stackoverflow.com/a/4694816/2087442 +// Modified because of https://github.com/pi-hole/AdminLTE/pull/533 +function validDomain($domain_name) { - return (preg_match("/^((-|_)*[a-z\d]((-|_)*[a-z\d])*(-|_)*)(\.(-|_)*([a-z\d]((-|_)*[a-z\d])*))*$/i", $domain_name) && // Valid chars check - preg_match("/^.{1,253}$/", $domain_name) && // Overall length check - preg_match("/^[^\.]{1,63}(\.[^\.]{1,63})*$/", $domain_name)); // Length of each label + $validChars = preg_match("/^((-|_)*[a-z\d]((-|_)*[a-z\d])*(-|_)*)(\.(-|_)*([a-z\d]((-|_)*[a-z\d])*))*$/i", $domain_name); + $lengthCheck = preg_match("/^.{1,253}$/", $domain_name); + $labelLengthCheck = preg_match("/^[^\.]{1,63}(\.[^\.]{1,63})*$/", $domain_name); + return ( $validChars && $lengthCheck && $labelLengthCheck ); //length of each label +} + +function validDomainWildcard($domain_name) +{ + // There has to be either no or at most one "*" at the beginning of a line + $validChars = preg_match("/^((\*.)?[_a-z\d](-*[_a-z\d])*)(\.([_a-z\d](-*[a-z\d])*))*(\.([_a-z\d])*)*$/i", $domain_name); + $lengthCheck = preg_match("/^.{1,253}$/", $domain_name); + $labelLengthCheck = preg_match("/^[^\.]{1,63}(\.[^\.]{1,63})*$/", $domain_name); + return ( $validChars && $lengthCheck && $labelLengthCheck ); //length of each label +} + +function validIP($address){ + if (preg_match('/[.:0]/', $address) && !preg_match('/[1-9a-f]/', $address)) { + // Test if address contains either `:` or `0` but not 1-9 or a-f + return false; + } + return !filter_var($address, FILTER_VALIDATE_IP) === false; +} + +function validCIDRIP($address){ + // This validation strategy has been taken from ../js/groups-common.js + $isIPv6 = strpos($address, ":") !== false; + if($isIPv6) { + // One IPv6 element is 16bit: 0000 - FFFF + $v6elem = "[0-9A-Fa-f]{1,4}"; + // CIDR for IPv6 is any multiple of 4 from 4 up to 128 bit + $v6cidr = "(4"; + for ($i=8; $i <= 128; $i+=4) { + $v6cidr .= "|$i"; + } + $v6cidr .= ")"; + $validator = "/^(((?:$v6elem))((?::$v6elem))*::((?:$v6elem))((?::$v6elem))*|((?:$v6elem))((?::$v6elem)){7})\/$v6cidr$/"; + return preg_match($validator, $address); + } else { + // One IPv4 element is 8bit: 0 - 256 + $v4elem = "(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]?|0)"; + // Note that rev-server accepts only /8, /16, /24, and /32 + $allowedv4cidr = "(8|16|24|32)"; + $validator = "/^$v4elem\.$v4elem\.$v4elem\.$v4elem\/$allowedv4cidr$/"; + return preg_match($validator, $address); + } +} + +function validMAC($mac_addr) +{ + // Accepted input format: 00:01:02:1A:5F:FF (characters may be lower case) + return !filter_var($mac_addr, FILTER_VALIDATE_MAC) === false; +} + +function validEmail($email) +{ + return filter_var($email, FILTER_VALIDATE_EMAIL) + // Make sure that the email does not contain special characters which + // may be used to execute shell commands, even though they may be valid + // in an email address. If the escaped email does not equal the original + // email, it is not safe to store in setupVars. + && escapeshellcmd($email) === $email; } function get_ip_type($ip) @@ -145,7 +205,7 @@ function addCustomDNSEntry($ip="", $domain="", $json=true) if (empty($domain)) return returnError("Domain must be set", $json); - if (!is_valid_domain_name($domain)) + if (!validDomain($domain)) return returnError("Domain must be valid", $json); // Only check for duplicates if adding new records from the web UI (not through Teleporter) @@ -302,13 +362,13 @@ function addCustomCNAMEEntry($domain="", $target="", $json=true) if (empty($target)) return returnError("Target must be set", $json); - if (!is_valid_domain_name($target)) + if (!validDomain($target)) return returnError("Target must be valid", $json); // Check if each submitted domain is valid $domains = array_map('trim', explode(",", $domain)); foreach ($domains as $d) { - if (!is_valid_domain_name($d)) + if (!validDomain($d)) return returnError("Domain '$d' is not valid", $json); } diff --git a/scripts/pi-hole/php/groups.php b/scripts/pi-hole/php/groups.php index efc84815..ec27b6ef 100644 --- a/scripts/pi-hole/php/groups.php +++ b/scripts/pi-hole/php/groups.php @@ -646,7 +646,7 @@ if ($_POST['action'] == 'get_groups') { { // If adding to the exact lists, we convert the domain lower case and check whether it is valid $domain = strtolower($domain); - if(filter_var($domain, FILTER_VALIDATE_DOMAIN, FILTER_FLAG_HOSTNAME) === false) + if(validDomain($domain)) { // This is the case when idn_to_ascii() modified the string if($input !== $domain && strlen($domain) > 0) diff --git a/scripts/pi-hole/php/queryads.php b/scripts/pi-hole/php/queryads.php index f247c87a..4302d561 100644 --- a/scripts/pi-hole/php/queryads.php +++ b/scripts/pi-hole/php/queryads.php @@ -23,7 +23,7 @@ function echoEvent($datatext) { // Credit: http://stackoverflow.com/a/4694816/2087442 ini_set("pcre.recursion_limit", 1500); -function is_valid_domain_name($domain_name) +function validDomain($domain_name) { return ($domain_name[0] !== '-' // Don't allow domains to appear as command line options && preg_match("/^((-|_)*[a-z\d]((-|_)*[a-z\d])*(-|_)*)(\.(-|_)*([a-z\d]((-|_)*[a-z\d])*))*$/i", $domain_name) // Valid chars check @@ -36,7 +36,7 @@ if(isset($_GET["domain"])) { // Is this a valid domain? $url = $_GET["domain"]; - if(!is_valid_domain_name($url)) + if(!validDomain($url)) { echoEvent("Invalid domain!"); die(); diff --git a/scripts/pi-hole/php/savesettings.php b/scripts/pi-hole/php/savesettings.php index f85d5a4e..e987e27f 100644 --- a/scripts/pi-hole/php/savesettings.php +++ b/scripts/pi-hole/php/savesettings.php @@ -6,43 +6,13 @@ * This file is copyright under the latest version of the EUPL. * Please see LICENSE file for your rights under this license. */ +require_once("func.php"); + if(!in_array(basename($_SERVER['SCRIPT_FILENAME']), ["settings.php", "teleporter.php"], true)) { die("Direct access to this script is forbidden!"); } -function validIP($address){ - if (preg_match('/[.:0]/', $address) && !preg_match('/[1-9a-f]/', $address)) { - // Test if address contains either `:` or `0` but not 1-9 or a-f - return false; - } - return !filter_var($address, FILTER_VALIDATE_IP) === false; -} - -function validCIDRIP($address){ - // This validation strategy has been taken from ../js/groups-common.js - $isIPv6 = strpos($address, ":") !== false; - if($isIPv6) { - // One IPv6 element is 16bit: 0000 - FFFF - $v6elem = "[0-9A-Fa-f]{1,4}"; - // CIDR for IPv6 is any multiple of 4 from 4 up to 128 bit - $v6cidr = "(4"; - for ($i=8; $i <= 128; $i+=4) { - $v6cidr .= "|$i"; - } - $v6cidr .= ")"; - $validator = "/^(((?:$v6elem))((?::$v6elem))*::((?:$v6elem))((?::$v6elem))*|((?:$v6elem))((?::$v6elem)){7})\/$v6cidr$/"; - return preg_match($validator, $address); - } else { - // One IPv4 element is 8bit: 0 - 256 - $v4elem = "(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]?|0)"; - // Note that rev-server accepts only /8, /16, /24, and /32 - $allowedv4cidr = "(8|16|24|32)"; - $validator = "/^$v4elem\.$v4elem\.$v4elem\.$v4elem\/$allowedv4cidr$/"; - return preg_match($validator, $address); - } -} - // Check for existance of variable // and test it only if it exists function istrue(&$argument) { @@ -56,30 +26,6 @@ function istrue(&$argument) { return false; } -// Credit: http://stackoverflow.com/a/4694816/2087442 -function validDomain($domain_name) -{ - $validChars = preg_match("/^([_a-z\d](-*[_a-z\d])*)(\.([_a-z\d](-*[a-z\d])*))*(\.([_a-z\d])*)*$/i", $domain_name); - $lengthCheck = preg_match("/^.{1,253}$/", $domain_name); - $labelLengthCheck = preg_match("/^[^\.]{1,63}(\.[^\.]{1,63})*$/", $domain_name); - return ( $validChars && $lengthCheck && $labelLengthCheck ); //length of each label -} - -function validDomainWildcard($domain_name) -{ - // There has to be either no or at most one "*" at the beginning of a line - $validChars = preg_match("/^((\*.)?[_a-z\d](-*[_a-z\d])*)(\.([_a-z\d](-*[a-z\d])*))*(\.([_a-z\d])*)*$/i", $domain_name); - $lengthCheck = preg_match("/^.{1,253}$/", $domain_name); - $labelLengthCheck = preg_match("/^[^\.]{1,63}(\.[^\.]{1,63})*$/", $domain_name); - return ( $validChars && $lengthCheck && $labelLengthCheck ); //length of each label -} - -function validMAC($mac_addr) -{ - // Accepted input format: 00:01:02:1A:5F:FF (characters may be lower case) - return !filter_var($mac_addr, FILTER_VALIDATE_MAC) === false; -} - function formatMAC($mac_addr) { preg_match("/([0-9a-fA-F]{2}[:]){5}([0-9a-fA-F]{2})/", $mac_addr, $matches); @@ -88,16 +34,6 @@ function formatMAC($mac_addr) return null; } -function validEmail($email) -{ - return filter_var($email, FILTER_VALIDATE_EMAIL) - // Make sure that the email does not contain special characters which - // may be used to execute shell commands, even though they may be valid - // in an email address. If the escaped email does not equal the original - // email, it is not safe to store in setupVars. - && escapeshellcmd($email) === $email; -} - $dhcp_static_leases = array(); function readStaticLeasesFile($origin_file="/etc/dnsmasq.d/04-pihole-static-dhcp.conf") {