From 05e7ebe7dd2216d4f240cd04d985b420e079b3af Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Fri, 6 May 2016 16:14:32 -0400
Subject: [PATCH] Implement CORS

Only allows requests from http://pi.hole and http://<Pi's IP>
---
 php/add.php | 10 ++++++++--
 php/sub.php | 10 ++++++++--
 2 files changed, 16 insertions(+), 4 deletions(-)

diff --git a/php/add.php b/php/add.php
index e959fdac..8c116c2e 100644
--- a/php/add.php
+++ b/php/add.php
@@ -1,12 +1,18 @@
 <?php
 if(!isset($_POST['domain'], $_POST['list'], $_POST['token']))
-    die();
+    die("Missing POST variables");
+
+// Check CORS
+if($_SERVER['HTTP_ORIGIN'] != "http://pi.hole" && $_SERVER['HTTP_ORIGIN'] != "http://${_SERVER['SERVER_ADDR']}")
+    die("Failed CORS");
+
+header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
 
 session_start();
 
 // Check CSRF token
 if(!hash_equals($_SESSION['token'], $_POST['token']))
-    die("Wrong token!");
+    die("Wrong token");
 
 switch($_POST['list']) {
     case "white":
diff --git a/php/sub.php b/php/sub.php
index b6c616e8..d2730054 100644
--- a/php/sub.php
+++ b/php/sub.php
@@ -1,12 +1,18 @@
 <?php
 if(!isset($_POST['domain'], $_POST['list'], $_POST['token']))
-    die();
+    die("Missing POST variables");
+
+// Check CORS
+if($_SERVER['HTTP_ORIGIN'] != "http://pi.hole" && $_SERVER['HTTP_ORIGIN'] != "http://${_SERVER['SERVER_ADDR']}")
+    die("Failed CORS");
+
+header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
 
 session_start();
 
 // Check CSRF token
 if(!hash_equals($_SESSION['token'], $_POST['token']))
-    die("Wrong token!");
+    die("Wrong token");
 
 switch($_POST['list']) {
     case "white":