From 3bc6474e2a198d4ea0110759a39ead131c1b89a7 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 16 Nov 2016 11:47:38 +0100 Subject: [PATCH 01/38] Add server-side password protection for the web interface --- footer.php | 1 + header.php | 56 ++++++++++++++++++++++++++++++++++++++++++++++-------- 2 files changed, 49 insertions(+), 8 deletions(-) diff --git a/footer.php b/footer.php index 2d3d6d61..975bcc10 100644 --- a/footer.php +++ b/footer.php @@ -1,3 +1,4 @@ + diff --git a/header.php b/header.php index bc31aa9e..62537afa 100644 --- a/header.php +++ b/header.php @@ -1,16 +1,29 @@ @@ -161,34 +174,34 @@
  • MAIN NAVIGATION
  • - + Main Page
  • - + Query Log
  • - + Whitelist
  • - + Blacklist
    • Disable'; + echo '
  • Disable
    • '; } else { - echo '
  • Enable
    • '; + echo '
  • Enable
    • '; } ?> @@ -205,3 +218,30 @@
    + +
    +

    Not authorized!

    +
    +
    + $value) { + $name = htmlspecialchars($name); + $value = htmlspecialchars($value); + echo ''; + } +?> + Password:   +
    + From a754c3c511ceb6aa86a95ca5b5a2326cebeb6d19 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 16 Nov 2016 12:11:44 +0100 Subject: [PATCH 02/38] Use hashed once logged in to hide the plain-text password --- header.php | 27 ++++++++++----------------- 1 file changed, 10 insertions(+), 17 deletions(-) diff --git a/header.php b/header.php index 62537afa..1898adfb 100644 --- a/header.php +++ b/header.php @@ -1,9 +1,10 @@ MAIN NAVIGATION
  • - + Main Page
  • - + Query Log
  • - + Whitelist
  • - + Blacklist
    • Disable'; + echo '
  • Disable
    • '; } else { - echo '
  • Enable
    • '; + echo '
  • Enable
    • '; } ?> @@ -229,15 +230,7 @@

    Not authorized!

    -
    - $value) { - $name = htmlspecialchars($name); - $value = htmlspecialchars($value); - echo ''; - } -?> + Password:  
    Date: Wed, 16 Nov 2016 12:14:58 +0100 Subject: [PATCH 03/38] Fixed a typo --- header.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/header.php b/header.php index 1898adfb..859d6d90 100644 --- a/header.php +++ b/header.php @@ -181,7 +181,7 @@
  • - + Query Log
    • From 72e5fc5655d8daeaac314b1d5ae148de1e1a347f Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 16 Nov 2016 12:15:44 +0100 Subject: [PATCH 04/38] Change button text to 'Login' --- header.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/header.php b/header.php index 859d6d90..80c17269 100644 --- a/header.php +++ b/header.php @@ -231,7 +231,7 @@

    Not authorized!

    - Password:   + Password:  
    Date: Wed, 16 Nov 2016 12:26:37 +0100 Subject: [PATCH 05/38] Added "Logout" button which redirects to index.php without providing the password hash --- header.php | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/header.php b/header.php index 80c17269..c72c1d58 100644 --- a/header.php +++ b/header.php @@ -211,6 +211,12 @@ Donate + +
  • + + Logout + +
    • From 7cbd9bd9dbc6d58cfba508dc1a5f0c54f3d42ece Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 16 Nov 2016 12:53:47 +0100 Subject: [PATCH 06/38] Show "Logout" only if a password is defined --- header.php | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/header.php b/header.php index c72c1d58..00ad7932 100644 --- a/header.php +++ b/header.php @@ -1,14 +1,29 @@ 0) { - $auth = true; - $pwstring = "auth=".$pwhash; + // Password set + if($_POST["pw"] == $webpw || $_GET["auth"] == $pwhash) + { + // Password (POST) correct or hash (GET) correct + $auth = true; + $pwstring = "auth=".$pwhash; + } + else + { + // Password or hash wrong + $auth = false; + $pwstring = ""; + } } else { - $auth = false; + // No password set + $auth = true; + $pwstring = ""; } if (isset($_GET['enable']) && $auth) { @@ -212,11 +227,13 @@ + 0) { ?>
  • Logout
    • + From cb874e7c696aeb9e6ed802a0c0db084c1816fdd5 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 16 Nov 2016 13:16:49 +0100 Subject: [PATCH 07/38] Show "Logout" only if (a) password is set and (b) user has successfully logged in. --- header.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/header.php b/header.php index 00ad7932..6df87956 100644 --- a/header.php +++ b/header.php @@ -227,7 +227,7 @@ - 0) { ?> + 0 && $auth) { ?>
  • Logout From b6cf46aab5fe2b78a1edfdb705ef2ff415c54ba8 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 16 Nov 2016 13:18:02 +0100 Subject: [PATCH 08/38] Undid change to footer.php --- footer.php | 1 - 1 file changed, 1 deletion(-) diff --git a/footer.php b/footer.php index 975bcc10..2d3d6d61 100644 --- a/footer.php +++ b/footer.php @@ -1,4 +1,3 @@ - From 4dfbcff97d80ebc62f05b20c4ced6f026fd666fd Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 16 Nov 2016 20:36:17 +0100 Subject: [PATCH 09/38] Hide main navigation if user is not logged in --- header.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/header.php b/header.php index 6df87956..d49a482a 100644 --- a/header.php +++ b/header.php @@ -186,6 +186,7 @@ + + From 06df8f08a247b26b78241c6d4853d3f940c0ca7b Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 16 Nov 2016 21:52:53 +0100 Subject: [PATCH 10/38] Always use only hashes for the password --- header.php | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/header.php b/header.php index d49a482a..eb339865 100644 --- a/header.php +++ b/header.php @@ -1,12 +1,11 @@ 0) + if(strlen($pwhash) > 0) { // Password set - if($_POST["pw"] == $webpw || $_GET["auth"] == $pwhash) + if(hash('sha256',$_POST["pw"]) == $pwhash || $_GET["auth"] == $pwhash) { // Password (POST) correct or hash (GET) correct $auth = true; @@ -228,7 +227,7 @@
    • - 0) { ?> + 0) { ?>
  • Logout From 6d5c90139b0e66de163801a4e048ece0a59260bd Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 16 Nov 2016 22:12:52 +0100 Subject: [PATCH 11/38] Compute double hashes to avoid rainbow table vulnerability --- header.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/header.php b/header.php index eb339865..69f1de12 100644 --- a/header.php +++ b/header.php @@ -4,8 +4,8 @@ // Test if password is set if(strlen($pwhash) > 0) { - // Password set - if(hash('sha256',$_POST["pw"]) == $pwhash || $_GET["auth"] == $pwhash) + // Password set compare with double hash + if(hash('sha256',hash('sha256',$_POST["pw"])) == $pwhash || $_GET["auth"] == $pwhash) { // Password (POST) correct or hash (GET) correct $auth = true; From 41fe76c5ac5aacb44bda4d2432089750787e372d Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 16 Nov 2016 22:29:44 +0100 Subject: [PATCH 12/38] Capitalized variable name --- header.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/header.php b/header.php index 69f1de12..68440c89 100644 --- a/header.php +++ b/header.php @@ -1,5 +1,5 @@ 0) From 8c278f38531a34a82ccfa9cad21fa1d16ebc9a54 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 16 Nov 2016 23:12:00 +0100 Subject: [PATCH 13/38] Resolve merge conflict from updateing devel branch --- header.php | 5 ----- 1 file changed, 5 deletions(-) diff --git a/header.php b/header.php index e8335823..6c50c608 100644 --- a/header.php +++ b/header.php @@ -37,14 +37,9 @@ $cmd = "echo $((`cat /sys/class/thermal/thermal_zone0/temp | cut -c1-2`))"; $output = shell_exec($cmd); -<<<<<<< HEAD - $output = str_replace(array("\r\n","\r","\n"),"", $output); - -======= $celsius = str_replace(array("\r\n","\r","\n"),"", $output); $fahrenheit = round(str_replace(["\r\n","\r","\n"],"", $output*9./5)+32); $temperatureunit = parse_ini_file("/etc/pihole/setupVars.conf")['TEMPERATUREUNIT']; ->>>>>>> devel ?> From 4372c2e25b89dfc11c6ed9390f8b84f10a9f9fdc Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 16 Nov 2016 23:35:10 +0100 Subject: [PATCH 14/38] Extend hash auth to API calls --- api.php | 5 ++++- header.php | 27 ++------------------------- js/pihole/index.js | 15 +++++++++------ js/pihole/queries.js | 7 +++++-- php/password.php | 27 +++++++++++++++++++++++++++ 5 files changed, 47 insertions(+), 34 deletions(-) create mode 100644 php/password.php diff --git a/api.php b/api.php index 85b282ea..c3db7fc4 100644 --- a/api.php +++ b/api.php @@ -1,4 +1,7 @@ diff --git a/header.php b/header.php index 6c50c608..d9c6e05f 100644 --- a/header.php +++ b/header.php @@ -1,29 +1,5 @@ 0) - { - // Password set compare with double hash - if(hash('sha256',hash('sha256',$_POST["pw"])) == $pwhash || $_GET["auth"] == $pwhash) - { - // Password (POST) correct or hash (GET) correct - $auth = true; - $pwstring = "auth=".$pwhash; - } - else - { - // Password or hash wrong - $auth = false; - $pwstring = ""; - } - } - else - { - // No password set - $auth = true; - $pwstring = ""; - } + require "php/password.php"; if (isset($_GET['enable']) && $auth) { exec('sudo pihole enable'); @@ -84,6 +60,7 @@ +
    diff --git a/js/pihole/index.js b/js/pihole/index.js index b070bd73..7e7d8b8d 100644 --- a/js/pihole/index.js +++ b/js/pihole/index.js @@ -105,6 +105,9 @@ $(document).ready(function() { } }); + // Get auth hash + hash = document.getElementById("hash").innerHTML; + // Pull in data via AJAX updateSummaryData(); @@ -123,7 +126,7 @@ $(document).ready(function() { // Functions to update data in page function updateSummaryData(runOnce) { - $.getJSON("api.php?summary", function LoadSummaryData(data) { + $.getJSON("api.php?summary&"+hash, function LoadSummaryData(data) { //$("h3.statistic").addClass("glow"); if ($("h3#ads_blocked_today").text() != data.ads_blocked_today) { $("h3#ads_blocked_today").addClass("glow"); @@ -154,7 +157,7 @@ function updateSummaryData(runOnce) { } function updateQueriesOverTime() { - $.getJSON("api.php?overTimeData", function(data) { + $.getJSON("api.php?overTimeData&"+hash, function(data) { // Add data for each hour that is available for (hour in data.ads_over_time) { // Add x-axis label @@ -168,7 +171,7 @@ function updateQueriesOverTime() { } function updateQueryTypes() { - $.getJSON("api.php?getQueryTypes", function(data) { + $.getJSON("api.php?getQueryTypes&"+hash, function(data) { var colors = []; // Get colors from AdminLTE $.each($.AdminLTE.options.colors, function(key, value) { colors.push(value); }); @@ -191,7 +194,7 @@ function updateQueryTypes() { } function updateTopClientsChart() { - $.getJSON("api.php?summaryRaw&getQuerySources", function(data) { + $.getJSON("api.php?summaryRaw&getQuerySources&"+hash, function(data) { var clienttable = $('#client-frequency').find('tbody:last'); for (domain in data.top_sources) { clienttable.append(' ' + domain + @@ -204,7 +207,7 @@ function updateTopClientsChart() { } function updateForwardDestinations() { - $.getJSON("api.php?getForwardDestinations", function(data) { + $.getJSON("api.php?getForwardDestinations&"+hash, function(data) { var colors = []; // Get colors from AdminLTE $.each($.AdminLTE.options.colors, function(key, value) { colors.push(value); }); @@ -227,7 +230,7 @@ function updateForwardDestinations() { } function updateTopLists() { - $.getJSON("api.php?summaryRaw&topItems", function(data) { + $.getJSON("api.php?summaryRaw&topItems&"+hash, function(data) { var domaintable = $('#domain-frequency').find('tbody:last'); var adtable = $('#ad-frequency').find('tbody:last'); diff --git a/js/pihole/queries.js b/js/pihole/queries.js index 736ffddf..0ea0e808 100644 --- a/js/pihole/queries.js +++ b/js/pihole/queries.js @@ -1,4 +1,7 @@ $(document).ready(function() { + // Get auth hash + hash = document.getElementById("hash").innerHTML; + tableApi = $('#all-queries').DataTable( { "rowCallback": function( row, data, index ){ if (data[4] == "Pi-holed") { @@ -11,7 +14,7 @@ $(document).ready(function() { } }, - "ajax": "api.php?getAllQueries", + "ajax": "api.php?getAllQueries&"+hash, "autoWidth" : false, "order" : [[0, "desc"]], "columns": [ @@ -42,7 +45,7 @@ $(document).ready(function() { } ); function refreshData() { - tableApi.ajax.url("api.php?getAllQueries").load(); + tableApi.ajax.url("api.php?getAllQueries&"+hash).load(); } function add(domain,list) { diff --git a/php/password.php b/php/password.php new file mode 100644 index 00000000..6f81c7f5 --- /dev/null +++ b/php/password.php @@ -0,0 +1,27 @@ + 0) + { + // Password set compare with double hash + if(hash('sha256',hash('sha256',$_POST["pw"])) == $pwhash || $_GET["auth"] == $pwhash) + { + // Password (POST) correct or hash (GET) correct + $auth = true; + $pwstring = "auth=".$pwhash; + } + else + { + // Password or hash wrong + $auth = false; + $pwstring = ""; + } + } + else + { + // No password set + $auth = true; + $pwstring = ""; + } +?> From 0df93cadaedb9442e8119297e41ebfbb1ce136c4 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Fri, 18 Nov 2016 12:36:32 +0100 Subject: [PATCH 15/38] Address codacy-bot's complaints --- js/pihole/queries.js | 2 ++ 1 file changed, 2 insertions(+) diff --git a/js/pihole/queries.js b/js/pihole/queries.js index 0ea0e808..9d248cb6 100644 --- a/js/pihole/queries.js +++ b/js/pihole/queries.js @@ -1,3 +1,5 @@ +// Define global variables +var hash; $(document).ready(function() { // Get auth hash hash = document.getElementById("hash").innerHTML; From 8ecd218908750ee9315696e09731dc14be684089 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Fri, 18 Nov 2016 21:31:30 +0100 Subject: [PATCH 16/38] Many changes that are documented in PR #197 --- api.php | 19 ++++++----- header.php | 19 ++++++++--- index.php | 5 +-- js/pihole/index.js | 85 ++++++++++++++++++++++++---------------------- 4 files changed, 72 insertions(+), 56 deletions(-) diff --git a/api.php b/api.php index c3db7fc4..dfdf9ac5 100644 --- a/api.php +++ b/api.php @@ -1,16 +1,16 @@
    - - @@ -278,9 +286,12 @@ // password is set at all, we keep the current // behavior: everything is always authorized // and will be displayed - if(!$auth){ ?> + // + // If auth is required and wrong, we show the reduced + // version of the summary (index) page + if(!$auth && (!isset($indexpage) || isset($_GET['login']))){ ?>
    -

    Not authorized!

    +

    Login required!

    Password:   diff --git a/index.php b/index.php index 270be230..c05cf15e 100644 --- a/index.php +++ b/index.php @@ -1,4 +1,5 @@ @@ -75,7 +76,7 @@ - +
    @@ -195,7 +196,7 @@
    - + diff --git a/js/pihole/index.js b/js/pihole/index.js index 2851b19e..10942e93 100644 --- a/js/pihole/index.js +++ b/js/pihole/index.js @@ -17,7 +17,10 @@ $(document).ready(function() { return (isMobile.Android() || isMobile.BlackBerry() || isMobile.iOS() || isMobile.Windows()); } }; - var animate = false; + + // Get auth hash + hash = document.getElementById("hash").innerHTML; + var ctx = document.getElementById("queryOverTimeChart").getContext("2d"); timeLineChart = new Chart(ctx, { type: 'line', @@ -69,57 +72,57 @@ $(document).ready(function() { } }); - ctx = document.getElementById("queryTypeChart").getContext("2d"); - queryTypeChart = new Chart(ctx, { - type: 'doughnut', - data: { - labels: [], - datasets: [{ data: [] }] - }, - options: { - legend: { - display: false + if(!!document.getElementById("queryTypeChart")) + { + ctx = document.getElementById("queryTypeChart").getContext("2d"); + queryTypeChart = new Chart(ctx, { + type: 'doughnut', + data: { + labels: [], + datasets: [{ data: [] }] }, - animation: { - duration: 2000 - }, - cutoutPercentage: 0 - } - }); + options: { + legend: { + display: false + }, + animation: { + duration: 2000 + }, + cutoutPercentage: 0 + } + }); + updateQueryTypes(); + } - ctx = document.getElementById("forwardDestinationChart").getContext("2d"); - forwardDestinationChart = new Chart(ctx, { - type: 'doughnut', - data: { - labels: [], - datasets: [{ data: [] }] - }, - options: { - legend: { - display: false + if(!!document.getElementById("forwardDestinationChart")) + { + ctx = document.getElementById("forwardDestinationChart").getContext("2d"); + forwardDestinationChart = new Chart(ctx, { + type: 'doughnut', + data: { + labels: [], + datasets: [{ data: [] }] }, - animation: { - duration: 2000 - }, - cutoutPercentage: 0 - } - }); - - // Get auth hash - hash = document.getElementById("hash").innerHTML; - + options: { + legend: { + display: false + }, + animation: { + duration: 2000 + }, + cutoutPercentage: 0 + } + }); + updateForwardDestinations(); + } // Pull in data via AJAX updateSummaryData(); updateQueriesOverTime(); - updateQueryTypes(); - updateTopClientsChart(); - updateForwardDestinations(); - updateTopLists(); }); From 03ea07ec49a3ed877127b53f9a4c2befc677c16f Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sat, 19 Nov 2016 12:51:52 +0100 Subject: [PATCH 17/38] api.php?summaryRaw also accessible without auth token --- api.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/api.php b/api.php index dfdf9ac5..a18652fe 100644 --- a/api.php +++ b/api.php @@ -6,7 +6,7 @@ $data = array(); - if (isset($_GET['summaryRaw']) && $auth) { + if (isset($_GET['summaryRaw'])) { $data = array_merge($data, getSummaryData()); } From e575988d3736d1ed0aa33f61d178a896452a87b4 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sat, 19 Nov 2016 12:56:50 +0100 Subject: [PATCH 18/38] Added some more comments in api.php --- api.php | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/api.php b/api.php index a18652fe..d140958f 100644 --- a/api.php +++ b/api.php @@ -6,6 +6,7 @@ $data = array(); + // Works without authorization if (isset($_GET['summaryRaw'])) { $data = array_merge($data, getSummaryData()); } @@ -25,28 +26,34 @@ $data = array_merge($data, getOverTimeData()); } + // Requires authorization if (isset($_GET['topItems']) && $auth) { $data = array_merge($data, getTopItems()); } + // Requires authorization if (isset($_GET['recentItems']) && $auth) { if (is_numeric($_GET['recentItems'])) { $data = array_merge($data, getRecentItems($_GET['recentItems'])); } } + // Requires authorization if (isset($_GET['getQueryTypes']) && $auth) { $data = array_merge($data, getIpvType()); } + // Requires authorization if (isset($_GET['getForwardDestinations']) && $auth) { $data = array_merge($data, getForwardDestinations()); } + // Requires authorization if (isset($_GET['getQuerySources']) && $auth) { $data = array_merge($data, getQuerySources()); } - + + // Requires authorization if (isset($_GET['getAllQueries']) && $auth) { $data = array_merge($data, getAllQueries()); } From aad1b65a825c1d3b8f7f1800e2b01275ea23b7cc Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sat, 19 Nov 2016 13:01:55 +0100 Subject: [PATCH 19/38] Added comments to header.php --- header.php | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/header.php b/header.php index 2d47040c..ad81e1b9 100644 --- a/header.php +++ b/header.php @@ -255,7 +255,9 @@
    • - 0) { ?> + 0) { ?>
  • Logout @@ -264,7 +266,9 @@ - 0 && !$auth) { ?> + 0 && !$auth) { ?>
  • Login @@ -287,8 +291,8 @@ // behavior: everything is always authorized // and will be displayed // - // If auth is required and wrong, we show the reduced - // version of the summary (index) page + // If auth is required and not set, i.e. no successfully logged in, + // we show the reduced version of the summary (index) page if(!$auth && (!isset($indexpage) || isset($_GET['login']))){ ?>

    Login required!

    From 77e072493eda0f2cb54d55de7aa1d51d315c39f2 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sat, 19 Nov 2016 13:04:51 +0100 Subject: [PATCH 20/38] Added comments in index.php --- index.php | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/index.php b/index.php index c05cf15e..416f2d0c 100644 --- a/index.php +++ b/index.php @@ -76,7 +76,12 @@
    - +
    From b53009ab8fd42a637c3684435bb75099d75f746e Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sat, 19 Nov 2016 13:47:54 +0100 Subject: [PATCH 21/38] Added comments to js/pihole/index.js --- js/pihole/index.js | 3 +++ 1 file changed, 3 insertions(+) diff --git a/js/pihole/index.js b/js/pihole/index.js index 10942e93..b73b8798 100644 --- a/js/pihole/index.js +++ b/js/pihole/index.js @@ -72,6 +72,7 @@ $(document).ready(function() { } }); + // Create / load "Query Types" only if authorized if(!!document.getElementById("queryTypeChart")) { ctx = document.getElementById("queryTypeChart").getContext("2d"); @@ -94,6 +95,7 @@ $(document).ready(function() { updateQueryTypes(); } + // Create / load "Forward Destinations" only if authorized if(!!document.getElementById("forwardDestinationChart")) { ctx = document.getElementById("forwardDestinationChart").getContext("2d"); @@ -115,6 +117,7 @@ $(document).ready(function() { }); updateForwardDestinations(); } + // Pull in data via AJAX updateSummaryData(); From d899293c67798c504f0081f22bc5bb40d71eb840 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sat, 19 Nov 2016 22:05:26 +0100 Subject: [PATCH 22/38] Test if POST and GET variables are set before trying to actually access them. This increases code complexity noticable, let's see if codacy complains ... --- php/password.php | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/php/password.php b/php/password.php index 6f81c7f5..517fb965 100644 --- a/php/password.php +++ b/php/password.php @@ -4,12 +4,18 @@ // Test if password is set if(strlen($pwhash) > 0) { - // Password set compare with double hash - if(hash('sha256',hash('sha256',$_POST["pw"])) == $pwhash || $_GET["auth"] == $pwhash) + // Compare doubly hashes password input with saved hash + if(isset($_POST["pw"])) { - // Password (POST) correct or hash (GET) correct - $auth = true; - $pwstring = "auth=".$pwhash; + $postinput = hash('sha256',hash('sha256',$_POST["pw"])); + if($postinput == $pwhash) + $auth = true; + } + // Compare auth hash with saved hash + else if (isset($_GET["auth"])) + { + if($_GET["auth"] == $pwhash) + $auth = true; } else { @@ -17,6 +23,10 @@ $auth = false; $pwstring = ""; } + // If authorized, then set the hash that will be + // passed through using GET + if($auth) + $pwstring = "auth=".$pwhash; } else { From 2c93be01745d4e7cba7c457e1bec161380d7fcab Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sun, 20 Nov 2016 14:52:53 +0100 Subject: [PATCH 23/38] Extended current password protection to gravity.sh page --- header.php | 2 +- php/gravity.sh.php | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/header.php b/header.php index 766b52f6..9d092e77 100644 --- a/header.php +++ b/header.php @@ -242,7 +242,7 @@
  • - + Update lists
    • diff --git a/php/gravity.sh.php b/php/gravity.sh.php index 80dcb385..257cfa3c 100644 --- a/php/gravity.sh.php +++ b/php/gravity.sh.php @@ -1,4 +1,7 @@ Date: Sun, 20 Nov 2016 14:57:24 +0100 Subject: [PATCH 24/38] Actually pass the password hash to the script that runs the update --- js/pihole/gravity.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/js/pihole/gravity.js b/js/pihole/gravity.js index 04691c1c..d1de2948 100644 --- a/js/pihole/gravity.js +++ b/js/pihole/gravity.js @@ -2,7 +2,8 @@ function eventsourcetest() { var alInfo = $("#alInfo"); var alSuccess = $("#alSuccess"); var ta = document.getElementById("output"); - var source = new EventSource("php/gravity.sh.php"); + var hash = document.getElementById("hash").innerHTML; + var source = new EventSource("php/gravity.sh.php?"+hash); alInfo.show(); alSuccess.hide(); From 02dc74120913b704cda2210848bf9e00f3d1ccb8 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sun, 20 Nov 2016 15:27:35 +0100 Subject: [PATCH 25/38] Move from GET to SESSION variables for the sake of convenience --- header.php | 16 ++++++++-------- php/password.php | 18 ++++++++++-------- 2 files changed, 18 insertions(+), 16 deletions(-) diff --git a/header.php b/header.php index 9d092e77..2d6b20e1 100644 --- a/header.php +++ b/header.php @@ -217,41 +217,41 @@
  • MAIN NAVIGATION
  • - + Main Page
  • - + Query Log
  • - + Whitelist
  • - + Blacklist
  • - + Update lists
    • Disable'; + echo '
  • Disable
    • '; } else { - echo '
  • Enable
    • '; + echo '
  • Enable
    • '; } ?> @@ -265,7 +265,7 @@ // Show Logout button if $auth is set and authorization is required if(strlen($pwhash) > 0) { ?>
  • - + Logout
    • diff --git a/php/password.php b/php/password.php index 517fb965..3f9b14c6 100644 --- a/php/password.php +++ b/php/password.php @@ -1,6 +1,11 @@ 0) { @@ -9,29 +14,26 @@ { $postinput = hash('sha256',hash('sha256',$_POST["pw"])); if($postinput == $pwhash) + { + $_SESSION["hash"] = $pwhash; $auth = true; + } } // Compare auth hash with saved hash - else if (isset($_GET["auth"])) + else if (isset($_SESSION["hash"])) { - if($_GET["auth"] == $pwhash) + if($_SESSION["hash"] == $pwhash) $auth = true; } else { // Password or hash wrong $auth = false; - $pwstring = ""; } - // If authorized, then set the hash that will be - // passed through using GET - if($auth) - $pwstring = "auth=".$pwhash; } else { // No password set $auth = true; - $pwstring = ""; } ?> From cd75d7e7a3d7e416371ceec0740fafd46d6aa6e4 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sun, 20 Nov 2016 15:34:03 +0100 Subject: [PATCH 26/38] Remove hash from the javascript scripts. --- header.php | 1 - js/pihole/gravity.js | 3 +-- js/pihole/index.js | 15 ++++++--------- js/pihole/queries.js | 6 +----- php/password.php | 3 ++- 5 files changed, 10 insertions(+), 18 deletions(-) diff --git a/header.php b/header.php index 2d6b20e1..7bf3d411 100644 --- a/header.php +++ b/header.php @@ -77,7 +77,6 @@

    Javascript Is Disabled

    Javascript seems to be disabled. This will break some site features.

    To enable Javascript click here

    -
    diff --git a/js/pihole/gravity.js b/js/pihole/gravity.js index d1de2948..04691c1c 100644 --- a/js/pihole/gravity.js +++ b/js/pihole/gravity.js @@ -2,8 +2,7 @@ function eventsourcetest() { var alInfo = $("#alInfo"); var alSuccess = $("#alSuccess"); var ta = document.getElementById("output"); - var hash = document.getElementById("hash").innerHTML; - var source = new EventSource("php/gravity.sh.php?"+hash); + var source = new EventSource("php/gravity.sh.php"); alInfo.show(); alSuccess.hide(); diff --git a/js/pihole/index.js b/js/pihole/index.js index b73b8798..0105f61a 100644 --- a/js/pihole/index.js +++ b/js/pihole/index.js @@ -18,9 +18,6 @@ $(document).ready(function() { } }; - // Get auth hash - hash = document.getElementById("hash").innerHTML; - var ctx = document.getElementById("queryOverTimeChart").getContext("2d"); timeLineChart = new Chart(ctx, { type: 'line', @@ -132,7 +129,7 @@ $(document).ready(function() { // Functions to update data in page function updateSummaryData(runOnce) { - $.getJSON("api.php?summary&"+hash, function LoadSummaryData(data) { + $.getJSON("api.php?summary", function LoadSummaryData(data) { //$("h3.statistic").addClass("glow"); if ($("h3#ads_blocked_today").text() != data.ads_blocked_today) { $("h3#ads_blocked_today").addClass("glow"); @@ -163,7 +160,7 @@ function updateSummaryData(runOnce) { } function updateQueriesOverTime() { - $.getJSON("api.php?overTimeData&"+hash, function(data) { + $.getJSON("api.php?overTimeData", function(data) { // Add data for each hour that is available // remove last data point since it not representative data.ads_over_time.splice(-1,1); @@ -179,7 +176,7 @@ function updateQueriesOverTime() { } function updateQueryTypes() { - $.getJSON("api.php?getQueryTypes&"+hash, function(data) { + $.getJSON("api.php?getQueryTypes", function(data) { var colors = []; // Get colors from AdminLTE $.each($.AdminLTE.options.colors, function(key, value) { colors.push(value); }); @@ -202,7 +199,7 @@ function updateQueryTypes() { } function updateTopClientsChart() { - $.getJSON("api.php?summaryRaw&getQuerySources&"+hash, function(data) { + $.getJSON("api.php?summaryRaw&getQuerySources", function(data) { var clienttable = $('#client-frequency').find('tbody:last'); for (domain in data.top_sources) { clienttable.append(' ' + domain + @@ -215,7 +212,7 @@ function updateTopClientsChart() { } function updateForwardDestinations() { - $.getJSON("api.php?getForwardDestinations&"+hash, function(data) { + $.getJSON("api.php?getForwardDestinations", function(data) { var colors = []; // Get colors from AdminLTE $.each($.AdminLTE.options.colors, function(key, value) { colors.push(value); }); @@ -238,7 +235,7 @@ function updateForwardDestinations() { } function updateTopLists() { - $.getJSON("api.php?summaryRaw&topItems&"+hash, function(data) { + $.getJSON("api.php?summaryRaw&topItems", function(data) { var domaintable = $('#domain-frequency').find('tbody:last'); var adtable = $('#ad-frequency').find('tbody:last'); diff --git a/js/pihole/queries.js b/js/pihole/queries.js index aaa0ef6b..9197de91 100644 --- a/js/pihole/queries.js +++ b/js/pihole/queries.js @@ -1,8 +1,4 @@ -// Define global variables -var hash; $(document).ready(function() { - // Get auth hash - hash = document.getElementById("hash").innerHTML; tableApi = $('#all-queries').DataTable( { "rowCallback": function( row, data, index ){ @@ -48,7 +44,7 @@ $(document).ready(function() { } ); function refreshData() { - tableApi.ajax.url("api.php?getAllQueries&"+hash).load(); + tableApi.ajax.url("api.php?getAllQueries").load(); } function add(domain,list) { diff --git a/php/password.php b/php/password.php index 3f9b14c6..a023c0ee 100644 --- a/php/password.php +++ b/php/password.php @@ -3,8 +3,9 @@ session_start(); $pwhash = parse_ini_file("/etc/pihole/setupVars.conf")['WEBPASSWORD']; + // If the user wants to log out, we free all session variables currently registered if(isset($_GET["logout"])) - unset($_SESSION["hash"]); + session_unset(); // Test if password is set if(strlen($pwhash) > 0) From bfdefddec634ac7180ed418f5ff0f5b23f77f9fe Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sun, 20 Nov 2016 15:35:03 +0100 Subject: [PATCH 27/38] Removed hash from Query log request --- js/pihole/queries.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/js/pihole/queries.js b/js/pihole/queries.js index 9197de91..7e52504d 100644 --- a/js/pihole/queries.js +++ b/js/pihole/queries.js @@ -12,7 +12,7 @@ $(document).ready(function() { } }, - "ajax": "api.php?getAllQueries&"+hash, + "ajax": "api.php?getAllQueries", "autoWidth" : false, "order" : [[0, "desc"]], "columns": [ From 28dd6ed75a521723fb80b701088dabbc7b21149d Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sun, 20 Nov 2016 15:38:32 +0100 Subject: [PATCH 28/38] Minor change --- js/pihole/queries.js | 1 - 1 file changed, 1 deletion(-) diff --git a/js/pihole/queries.js b/js/pihole/queries.js index 7e52504d..29d388a1 100644 --- a/js/pihole/queries.js +++ b/js/pihole/queries.js @@ -1,5 +1,4 @@ $(document).ready(function() { - tableApi = $('#all-queries').DataTable( { "rowCallback": function( row, data, index ){ if (data[4] == "Pi-holed") { From f84d54558b14255033d79aed22071a1130cb21e8 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sun, 20 Nov 2016 15:46:05 +0100 Subject: [PATCH 29/38] Allow GET hash for API calls --- api.php | 13 +++++++------ php/password.php | 6 ++++++ 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/api.php b/api.php index d140958f..8bd37a2d 100644 --- a/api.php +++ b/api.php @@ -1,4 +1,5 @@ Date: Sun, 20 Nov 2016 21:05:08 +0100 Subject: [PATCH 30/38] Added session timer --- header.php | 4 ++++ js/pihole/footer.js | 36 ++++++++++++++++++++++++++++++++++++ js/pihole/header.js | 2 +- js/pihole/index.js | 2 ++ js/pihole/queries.js | 1 + 5 files changed, 44 insertions(+), 1 deletion(-) diff --git a/header.php b/header.php index 7bf3d411..69557f7a 100644 --- a/header.php +++ b/header.php @@ -33,6 +33,9 @@ $used = $mem[2] - $mem[5] - $mem[6]; $total = $mem[1]; $memory_usage = $used/$total*100; + + // For session timer + $maxlifetime = ini_get("session.gc_maxlifetime"); ?> @@ -122,6 +125,7 @@
    Updates
    +
    Session is valid for 0){echo $maxlifetime;}else{echo "0";} ?>
  • diff --git a/js/pihole/footer.js b/js/pihole/footer.js index c47eb9ff..57950a21 100644 --- a/js/pihole/footer.js +++ b/js/pihole/footer.js @@ -55,3 +55,39 @@ $.getJSON("https://api.github.com/repos/pi-hole/AdminLTE/releases/latest", funct */ if(piholeVersion !== "vDev" && versionCompare(piholeVersion, "v2.7") < 0) alert("Pi-hole needs to be updated to at least v2.7 before you can use features such as whitelisting/blacklisting from this web interface!") + +// Session timer +var sessionvalidity = parseInt(document.getElementById("sessiontimer").textContent); +var start = new Date; + +function updateSessionTimer() +{ + start = new Date; + start.setSeconds(start.getSeconds() + sessionvalidity); +} + +if(sessionvalidity > 0) +{ + // setSeconds will correctly handle wrap-around cases + updateSessionTimer(); + + setInterval(function() { + var current = new Date; + var total_seconds = (start - current) / 1000; + + // var hours = Math.floor(total_seconds / 3600); + // total_seconds = total_seconds % 3600; + // hours = pretty_time_string(hours); + + var minutes = Math.floor(total_seconds / 60); + if(minutes < 10) minutes = "0" + minutes; + + var seconds = Math.floor(total_seconds % 60); + if(seconds < 10) seconds = "0" + seconds; + + var currentTimeString = minutes + ":" + seconds; + document.getElementById("sessiontimer").textContent = currentTimeString; + + $('.timer').text(currentTimeString); + }, 1000); +} diff --git a/js/pihole/header.js b/js/pihole/header.js index 82d112db..132f4fa2 100644 --- a/js/pihole/header.js +++ b/js/pihole/header.js @@ -1,3 +1,3 @@ // Remove JS warning var jswarn = document.getElementById("js-warn-exit"); -jswarn.parentNode.removeChild(jswarn); \ No newline at end of file +jswarn.parentNode.removeChild(jswarn); diff --git a/js/pihole/index.js b/js/pihole/index.js index 0105f61a..cc667b7d 100644 --- a/js/pihole/index.js +++ b/js/pihole/index.js @@ -148,6 +148,8 @@ function updateSummaryData(runOnce) { $("h3#ads_percentage_today").text(data.ads_percentage_today + "%"); $("h3.statistic.glow").removeClass("glow") }, 500); + + updateSessionTimer(); }).done(function() { if (runOnce !== true) { setTimeout(updateSummaryData, 10000); diff --git a/js/pihole/queries.js b/js/pihole/queries.js index 29d388a1..39e21776 100644 --- a/js/pihole/queries.js +++ b/js/pihole/queries.js @@ -44,6 +44,7 @@ $(document).ready(function() { function refreshData() { tableApi.ajax.url("api.php?getAllQueries").load(); + updateSessionTimer(); } function add(domain,list) { From 829c8544db2fac4c7283ff26ee418eb0ffa4949b Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sun, 20 Nov 2016 21:09:00 +0100 Subject: [PATCH 31/38] Completely hide session timer if there is no session (i.e. no password set) --- header.php | 2 +- js/pihole/footer.js | 8 ++++++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/header.php b/header.php index 69557f7a..cf8fde0f 100644 --- a/header.php +++ b/header.php @@ -125,7 +125,7 @@
    Updates
    -
    Session is valid for 0){echo $maxlifetime;}else{echo "0";} ?>
    +
    Session is valid for 0){echo $maxlifetime;}else{echo "0";} ?>
  • diff --git a/js/pihole/footer.js b/js/pihole/footer.js index 57950a21..8f3095f0 100644 --- a/js/pihole/footer.js +++ b/js/pihole/footer.js @@ -57,7 +57,7 @@ if(piholeVersion !== "vDev" && versionCompare(piholeVersion, "v2.7") < 0) alert("Pi-hole needs to be updated to at least v2.7 before you can use features such as whitelisting/blacklisting from this web interface!") // Session timer -var sessionvalidity = parseInt(document.getElementById("sessiontimer").textContent); +var sessionvalidity = parseInt(document.getElementById("sessiontimercounter").textContent); var start = new Date; function updateSessionTimer() @@ -86,8 +86,12 @@ if(sessionvalidity > 0) if(seconds < 10) seconds = "0" + seconds; var currentTimeString = minutes + ":" + seconds; - document.getElementById("sessiontimer").textContent = currentTimeString; + document.getElementById("sessiontimercounter").textContent = currentTimeString; $('.timer').text(currentTimeString); }, 1000); } +else +{ + document.getElementById("sessiontimer").style.display = 'none'; +} From 1cf031ab68599a0fdab294738f070cff54224738 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sun, 20 Nov 2016 21:14:34 +0100 Subject: [PATCH 32/38] Show "-- : --" if session timer has expired. Show session timer only if user is logged in. --- header.php | 2 +- js/pihole/footer.js | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/header.php b/header.php index cf8fde0f..0d7e570f 100644 --- a/header.php +++ b/header.php @@ -125,7 +125,7 @@
    Updates
    -
    Session is valid for 0){echo $maxlifetime;}else{echo "0";} ?>
    +
    Session is valid for 0){echo $maxlifetime;}else{echo "0";} ?>
  • diff --git a/js/pihole/footer.js b/js/pihole/footer.js index 8f3095f0..8b565ddc 100644 --- a/js/pihole/footer.js +++ b/js/pihole/footer.js @@ -85,8 +85,10 @@ if(sessionvalidity > 0) var seconds = Math.floor(total_seconds % 60); if(seconds < 10) seconds = "0" + seconds; - var currentTimeString = minutes + ":" + seconds; - document.getElementById("sessiontimercounter").textContent = currentTimeString; + if(total_seconds > 0) + document.getElementById("sessiontimercounter").textContent = minutes + ":" + seconds; + else + document.getElementById("sessiontimercounter").textContent = "-- : --"; $('.timer').text(currentTimeString); }, 1000); From 9e3a09270173034403e93674f37c0ff958d9a170 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Mon, 21 Nov 2016 10:51:45 +0100 Subject: [PATCH 33/38] Addressed codacy issues --- js/pihole/footer.js | 21 +++++++++------------ js/pihole/queries.js | 2 +- php/password.php | 2 ++ 3 files changed, 12 insertions(+), 13 deletions(-) diff --git a/js/pihole/footer.js b/js/pihole/footer.js index 8b565ddc..2f6a8758 100644 --- a/js/pihole/footer.js +++ b/js/pihole/footer.js @@ -73,27 +73,24 @@ if(sessionvalidity > 0) setInterval(function() { var current = new Date; - var total_seconds = (start - current) / 1000; + var totalseconds = (start - current) / 1000; - // var hours = Math.floor(total_seconds / 3600); - // total_seconds = total_seconds % 3600; - // hours = pretty_time_string(hours); + // var hours = Math.floor(totalseconds / 3600); + // totalseconds = totalseconds % 3600; - var minutes = Math.floor(total_seconds / 60); - if(minutes < 10) minutes = "0" + minutes; + var minutes = Math.floor(totalseconds / 60); + if(minutes < 10){ minutes = "0" + minutes; } - var seconds = Math.floor(total_seconds % 60); - if(seconds < 10) seconds = "0" + seconds; + var seconds = Math.floor(totalseconds % 60); + if(seconds < 10){ seconds = "0" + seconds; } - if(total_seconds > 0) + if(totalseconds > 0) document.getElementById("sessiontimercounter").textContent = minutes + ":" + seconds; else document.getElementById("sessiontimercounter").textContent = "-- : --"; - - $('.timer').text(currentTimeString); }, 1000); } else { - document.getElementById("sessiontimer").style.display = 'none'; + document.getElementById("sessiontimer").style.display = "none"; } diff --git a/js/pihole/queries.js b/js/pihole/queries.js index 39e21776..cbb76c70 100644 --- a/js/pihole/queries.js +++ b/js/pihole/queries.js @@ -44,7 +44,7 @@ $(document).ready(function() { function refreshData() { tableApi.ajax.url("api.php?getAllQueries").load(); - updateSessionTimer(); +// updateSessionTimer(); } function add(domain,list) { diff --git a/php/password.php b/php/password.php index 6c5d8c96..baa9288f 100644 --- a/php/password.php +++ b/php/password.php @@ -5,7 +5,9 @@ // If the user wants to log out, we free all session variables currently registered if(isset($_GET["logout"])) + { session_unset(); + } // Test if password is set if(strlen($pwhash) > 0) From 3dea0cf93774c2e86712ba002121e72740006d53 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Mon, 21 Nov 2016 10:52:56 +0100 Subject: [PATCH 34/38] Moved Donate item outside of $auth scope on the main menu --- header.php | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/header.php b/header.php index 0d7e570f..313253e5 100644 --- a/header.php +++ b/header.php @@ -257,12 +257,6 @@ echo '
  • Enable
    • '; } ?> - -
  • - - Donate - -
    • + +
  • + + Donate + +
    • From 4675b5ae9264187608706d03233b1c45a9209917 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Mon, 21 Nov 2016 11:01:55 +0100 Subject: [PATCH 35/38] Load "Top Domains", "Top Advertisers", and "Top Clients" only if authorized --- js/pihole/index.js | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/js/pihole/index.js b/js/pihole/index.js index 5ad729b6..df7e13eb 100644 --- a/js/pihole/index.js +++ b/js/pihole/index.js @@ -96,6 +96,12 @@ $(document).ready(function() { } }); + // Pull in data via AJAX + + updateSummaryData(); + + updateQueriesOverTime(); + // Create / load "Query Types" only if authorized if(!!document.getElementById("queryTypeChart")) { @@ -142,15 +148,20 @@ $(document).ready(function() { updateForwardDestinations(); } - // Pull in data via AJAX - - updateSummaryData(); - - updateQueriesOverTime(); - - updateTopClientsChart(); + // Create / load "Top Domains" and "Top Advertisers" only if authorized + if(!!document.getElementById("domain-frequency") + && !!document.getElementById("ad-frequency")) + { + updateTopClientsChart(); + } updateTopLists(); + + // Create / load "Top Clients" only if authorized + if(!!document.getElementById("client-frequency")) + { + updateTopClientsChart(); + } }); // Functions to update data in page From 07376ffad9648ad62be4a0349b3ff754ddc60ee8 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 23 Nov 2016 11:39:06 +0100 Subject: [PATCH 36/38] Fixed copy-and-paste error --- js/pihole/index.js | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/js/pihole/index.js b/js/pihole/index.js index df7e13eb..ffc022c5 100644 --- a/js/pihole/index.js +++ b/js/pihole/index.js @@ -152,11 +152,9 @@ $(document).ready(function() { if(!!document.getElementById("domain-frequency") && !!document.getElementById("ad-frequency")) { - updateTopClientsChart(); + updateTopLists(); } - updateTopLists(); - // Create / load "Top Clients" only if authorized if(!!document.getElementById("client-frequency")) { From 21649a2017db5643865c122d94fb0cb4bd4c3af8 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 23 Nov 2016 18:05:07 +0100 Subject: [PATCH 37/38] Extended password protection to php/queryads.php --- php/queryads.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/php/queryads.php b/php/queryads.php index eedb4a22..e77ee223 100644 --- a/php/queryads.php +++ b/php/queryads.php @@ -1,4 +1,7 @@ Date: Wed, 23 Nov 2016 18:08:19 +0100 Subject: [PATCH 38/38] Show 'Help' only if authorized --- header.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/header.php b/header.php index 436f0997..566c4b58 100644 --- a/header.php +++ b/header.php @@ -304,12 +304,14 @@ Donate +
  • Help
    • +