From 24a22bcb55c8e63b947c949bf4a50bf1f64937fb Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Sat, 2 Mar 2019 13:51:29 -0800
Subject: [PATCH] Fix security issue when using list functionality via api.php

Remote code execution could have been triggered by activating some list
functionality (add and remove) via api.php.

Thanks to Kacper Szurek for finding this bug.

Signed-off-by: Mcat12 <newtoncat12@yahoo.com>
---
 scripts/pi-hole/php/add.php  | 8 +++++++-
 scripts/pi-hole/php/auth.php | 9 ---------
 scripts/pi-hole/php/sub.php  | 8 +++++++-
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/scripts/pi-hole/php/add.php b/scripts/pi-hole/php/add.php
index d3ab2b4b..762ea2cf 100644
--- a/scripts/pi-hole/php/add.php
+++ b/scripts/pi-hole/php/add.php
@@ -10,12 +10,18 @@ require_once('auth.php');
 
 $type = $_POST['list'];
 
-// Perform all of the verification for list editing
+// Perform all of the authentication for list editing
 // when NOT invoked and authenticated from API
 if (empty($api)) {
     list_verify($type);
 }
 
+// Don't check if the added item is a valid domain for regex expressions. Regex
+// filters are validated by FTL on import and skipped if invalid
+if($type !== "regex") {
+    check_domain();
+}
+
 switch($type) {
     case "white":
         if(!isset($_POST["auditlog"]))
diff --git a/scripts/pi-hole/php/auth.php b/scripts/pi-hole/php/auth.php
index 5d832a86..69fe6b28 100644
--- a/scripts/pi-hole/php/auth.php
+++ b/scripts/pi-hole/php/auth.php
@@ -142,14 +142,5 @@ function list_verify($type) {
     {
         log_and_die("Not allowed!");
     }
-
-    // Don't check if the added item is a
-    // valid domain for regex expressions
-    // Regex filters are validated by FTL
-    // on import and skipped if invalid
-    if($_POST['list'] !== "regex")
-    {
-        check_domain();
-    }
 }
 ?>
diff --git a/scripts/pi-hole/php/sub.php b/scripts/pi-hole/php/sub.php
index 2edf8cf7..1c9bc8fe 100644
--- a/scripts/pi-hole/php/sub.php
+++ b/scripts/pi-hole/php/sub.php
@@ -10,12 +10,18 @@ require_once('auth.php');
 
 $type = $_POST['list'];
 
-// Perform all of the verification for list editing
+// Perform all of the authentication for list editing
 // when NOT invoked and authenticated from API
 if (empty($api)) {
     list_verify($type);
 }
 
+// Don't check if the added item is a valid domain for regex expressions. Regex
+// filters are validated by FTL on import and skipped if invalid
+if($type !== "regex") {
+    check_domain();
+}
+
 switch($type) {
     case "white":
         exec("sudo pihole -w -q -d ${_POST['domain']}");