pi-hole/web
1
0
Fork 0
mirror of https://github.com/pi-hole/web.git synced 2024-12-06 19:36:21 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Implement CORS

Browse Source 
Only allows requests from http://pi.hole and http://<Pi's IP>
This commit is contained in:
Mcat12
2016-05-06 16:14:32 -04:00
parent 283f4b7978
commit 05e7ebe7dd
2 changed files with 16 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
php/add.php
+8 -2
View File
@@ -1,12 +1,18 @@
<?php
if(!isset($_POST['domain'], $_POST['list'], $_POST['token']))
die();
die("Missing POST variables");
// Check CORS
if($_SERVER['HTTP_ORIGIN'] != "http://pi.hole" && $_SERVER['HTTP_ORIGIN'] != "http://${_SERVER['SERVER_ADDR']}")
die("Failed CORS");
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
session_start();
// Check CSRF token
if(!hash_equals($_SESSION['token'], $_POST['token']))
die("Wrong token!");
die("Wrong token");
switch($_POST['list']) {
case "white":
php/sub.php
+8 -2
View File
@@ -1,12 +1,18 @@
<?php
if(!isset($_POST['domain'], $_POST['list'], $_POST['token']))
die();
die("Missing POST variables");
// Check CORS
if($_SERVER['HTTP_ORIGIN'] != "http://pi.hole" && $_SERVER['HTTP_ORIGIN'] != "http://${_SERVER['SERVER_ADDR']}")
die("Failed CORS");
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
session_start();
// Check CSRF token
if(!hash_equals($_SESSION['token'], $_POST['token']))
die("Wrong token!");
die("Wrong token");
switch($_POST['list']) {
case "white":