From 9185d11b02c8fdc1860121944e7e5004a5b3c514 Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Thu, 29 Dec 2016 22:51:54 +0000
Subject: [PATCH 1/9] Allow whitelisting when correct passwort is given via
 POST

---
 php/add.php | 35 +++++++++++++++++++++++++----------
 1 file changed, 25 insertions(+), 10 deletions(-)

diff --git a/php/add.php b/php/add.php
index 2077af0a..3fddcb26 100644
--- a/php/add.php
+++ b/php/add.php
@@ -1,21 +1,36 @@
 <?php
 require('auth.php');
 
-if(!isset($_POST['domain'], $_POST['list'], $_POST['token'])) {
-    log_and_die("Missing POST variables");
+if(!isset($_POST['domain'], $_POST['list'], $_POST['token']) || !isset($_POST['domain'], $_POST['list'], $_POST['pw'])) {
+	log_and_die("Missing POST variables");
 }
 
-check_cors();
-check_csrf($_POST['token']);
+if(isset($_POST['token']))
+{
+	check_cors();
+	check_csrf($_POST['token']);
+}
+elseif(isset($_POST['pw']) && $_POST['list'] == "white")
+{
+	require("password.php");
+	if(strlen($pwhash) == 0)
+	{
+		log_and_die("No password specified - whitelisting with password not supported");
+	}
+	elseif($wrongpassword)
+	{
+		log_and_die("Wrong password - whitelisting of ${_POST['domain']} not permitted");
+	}
+}
 check_domain();
 
 switch($_POST['list']) {
-    case "white":
-        echo exec("sudo pihole -w -q ${_POST['domain']}");
-        break;
-    case "black":
-        echo exec("sudo pihole -b -q ${_POST['domain']}");
-        break;
+	case "white":
+		echo exec("sudo pihole -w -q ${_POST['domain']}");
+		break;
+	case "black":
+		echo exec("sudo pihole -b -q ${_POST['domain']}");
+		break;
 }
 
 ?>

From 3fbd96e3991c245504c47ba030a2b17738f4b7fe Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Thu, 29 Dec 2016 18:55:34 -0500
Subject: [PATCH 2/9] Change wording of error msg with no set password

---
 php/add.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/php/add.php b/php/add.php
index 3fddcb26..74c85704 100644
--- a/php/add.php
+++ b/php/add.php
@@ -15,7 +15,7 @@ elseif(isset($_POST['pw']) && $_POST['list'] == "white")
 	require("password.php");
 	if(strlen($pwhash) == 0)
 	{
-		log_and_die("No password specified - whitelisting with password not supported");
+		log_and_die("No password set - whitelisting with password not supported");
 	}
 	elseif($wrongpassword)
 	{

From aabbc51e6741553db66bed0dbb7e2a32eddc82d2 Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Thu, 29 Dec 2016 20:29:44 -0500
Subject: [PATCH 3/9] Fix variable check

---
 php/add.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/php/add.php b/php/add.php
index 74c85704..8749c214 100644
--- a/php/add.php
+++ b/php/add.php
@@ -1,7 +1,7 @@
 <?php
 require('auth.php');
 
-if(!isset($_POST['domain'], $_POST['list'], $_POST['token']) || !isset($_POST['domain'], $_POST['list'], $_POST['pw'])) {
+if(!isset($_POST['domain'], $_POST['list'], $_POST['token']) && !isset($_POST['domain'], $_POST['list'], $_POST['pw'])) {
 	log_and_die("Missing POST variables");
 }
 

From 1e2bb69efa2647c0f1d20ca1ba2edb7654d045b1 Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Thu, 29 Dec 2016 20:34:00 -0500
Subject: [PATCH 4/9] Restructure variable check

---
 php/add.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/php/add.php b/php/add.php
index 8749c214..1ebec0d5 100644
--- a/php/add.php
+++ b/php/add.php
@@ -1,7 +1,7 @@
 <?php
 require('auth.php');
 
-if(!isset($_POST['domain'], $_POST['list'], $_POST['token']) && !isset($_POST['domain'], $_POST['list'], $_POST['pw'])) {
+if(!isset($_POST['domain'], $_POST['list']) && !(isset($_POST['pw']) || isset($_POST['token']))) {
 	log_and_die("Missing POST variables");
 }
 

From 769525342b908b3414ee568d389f01e58d76fb0c Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Fri, 30 Dec 2016 11:52:48 +0000
Subject: [PATCH 5/9] Add fallback kill option

---
 php/add.php | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/php/add.php b/php/add.php
index 1ebec0d5..0f080c27 100644
--- a/php/add.php
+++ b/php/add.php
@@ -22,8 +22,13 @@ elseif(isset($_POST['pw']) && $_POST['list'] == "white")
 		log_and_die("Wrong password - whitelisting of ${_POST['domain']} not permitted");
 	}
 }
+else
+{
+	log_and_die("Not allowed!");
+}
 check_domain();
 
+
 switch($_POST['list']) {
 	case "white":
 		echo exec("sudo pihole -w -q ${_POST['domain']}");

From 5ab9f75e45aad61d3d98d1018e9ba9c7d514a41b Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Fri, 30 Dec 2016 11:49:39 -0500
Subject: [PATCH 6/9] Condense list verification and use in both add and sub

---
 php/add.php  | 31 ++++---------------------------
 php/auth.php | 29 +++++++++++++++++++++++++++++
 php/sub.php  | 11 ++++-------
 3 files changed, 37 insertions(+), 34 deletions(-)

diff --git a/php/add.php b/php/add.php
index 0f080c27..3f62fd0d 100644
--- a/php/add.php
+++ b/php/add.php
@@ -1,35 +1,12 @@
 <?php
 require('auth.php');
 
-if(!isset($_POST['domain'], $_POST['list']) && !(isset($_POST['pw']) || isset($_POST['token']))) {
-	log_and_die("Missing POST variables");
-}
+$type = $_POST['list'];
 
-if(isset($_POST['token']))
-{
-	check_cors();
-	check_csrf($_POST['token']);
-}
-elseif(isset($_POST['pw']) && $_POST['list'] == "white")
-{
-	require("password.php");
-	if(strlen($pwhash) == 0)
-	{
-		log_and_die("No password set - whitelisting with password not supported");
-	}
-	elseif($wrongpassword)
-	{
-		log_and_die("Wrong password - whitelisting of ${_POST['domain']} not permitted");
-	}
-}
-else
-{
-	log_and_die("Not allowed!");
-}
-check_domain();
+// All of the verification for list editing
+list_verify($type);
 
-
-switch($_POST['list']) {
+switch($type) {
 	case "white":
 		echo exec("sudo pihole -w -q ${_POST['domain']}");
 		break;
diff --git a/php/auth.php b/php/auth.php
index d2345ca4..c445ebc4 100644
--- a/php/auth.php
+++ b/php/auth.php
@@ -105,4 +105,33 @@ function check_domain() {
         }
     }
 }
+
+function list_verify($type) {
+    if(!isset($_POST['domain'], $_POST['list']) && !(isset($_POST['pw']) || isset($_POST['token']))) {
+        log_and_die("Missing POST variables");
+    }
+
+    if(isset($_POST['token']))
+    {
+        check_cors();
+        check_csrf($_POST['token']);
+    }
+    elseif(isset($_POST['pw']) && $_POST['list'] == "white")
+    {
+        require("password.php");
+        if(strlen($pwhash) == 0)
+        {
+            log_and_die("No password set - ${type}listing with password not supported");
+        }
+        elseif($wrongpassword)
+        {
+            log_and_die("Wrong password - ${type}listing of ${_POST['domain']} not permitted");
+        }
+    }
+    else
+    {
+        log_and_die("Not allowed!");
+    }
+    check_domain();
+}
 ?>
diff --git a/php/sub.php b/php/sub.php
index 56019664..fb670f3a 100644
--- a/php/sub.php
+++ b/php/sub.php
@@ -1,15 +1,12 @@
 <?php
 require('auth.php');
 
-if(!isset($_POST['domain'], $_POST['list'], $_POST['token'])) {
-    log_and_die("Missing POST variables");
-}
+$type = $_POST['list'];
 
-check_cors();
-check_csrf($_POST['token']);
-check_domain();
+// All of the verification for list editing
+list_verify($type);
 
-switch($_POST['list']) {
+switch($type) {
     case "white":
         exec("sudo pihole -w -q -d ${_POST['domain']}");
         break;

From da1ea9c2f29cfa0dd3b0bc3993ea549693f9808b Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Fri, 30 Dec 2016 11:54:38 -0500
Subject: [PATCH 7/9] Tabs to spaces

---
 php/add.php | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/php/add.php b/php/add.php
index 3f62fd0d..ffffccec 100644
--- a/php/add.php
+++ b/php/add.php
@@ -7,12 +7,12 @@ $type = $_POST['list'];
 list_verify($type);
 
 switch($type) {
-	case "white":
-		echo exec("sudo pihole -w -q ${_POST['domain']}");
-		break;
-	case "black":
-		echo exec("sudo pihole -b -q ${_POST['domain']}");
-		break;
+    case "white":
+        echo exec("sudo pihole -w -q ${_POST['domain']}");
+        break;
+    case "black":
+        echo exec("sudo pihole -b -q ${_POST['domain']}");
+        break;
 }
 
 ?>

From 5e0bef54c4635d8c15ec883404d047fa74d763ed Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Fri, 30 Dec 2016 12:44:33 -0500
Subject: [PATCH 8/9] Fix parameter check

---
 php/auth.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/php/auth.php b/php/auth.php
index c445ebc4..9eb026b3 100644
--- a/php/auth.php
+++ b/php/auth.php
@@ -107,7 +107,7 @@ function check_domain() {
 }
 
 function list_verify($type) {
-    if(!isset($_POST['domain'], $_POST['list']) && !(isset($_POST['pw']) || isset($_POST['token']))) {
+    if(!isset($_POST['domain']) || !isset($_POST['list']) || !(isset($_POST['pw']) || isset($_POST['token']))) {
         log_and_die("Missing POST variables");
     }
 

From 7c322cc54249636272948f45e69b47acab981ebc Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Fri, 30 Dec 2016 12:48:25 -0500
Subject: [PATCH 9/9] Don't limit list verification to only whitelist

---
 php/auth.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/php/auth.php b/php/auth.php
index 9eb026b3..f6757ffa 100644
--- a/php/auth.php
+++ b/php/auth.php
@@ -116,7 +116,7 @@ function list_verify($type) {
         check_cors();
         check_csrf($_POST['token']);
     }
-    elseif(isset($_POST['pw']) && $_POST['list'] == "white")
+    elseif(isset($_POST['pw']))
     {
         require("password.php");
         if(strlen($pwhash) == 0)