From d956c35c24902be2909315417b9198521277a537 Mon Sep 17 00:00:00 2001 From: Mcat12 Date: Sun, 2 Apr 2017 19:20:05 -0400 Subject: [PATCH 1/5] Expose a CSRF token when logged in --- scripts/pi-hole/php/header.php | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/scripts/pi-hole/php/header.php b/scripts/pi-hole/php/header.php index cb56f1e5..40bc494a 100644 --- a/scripts/pi-hole/php/header.php +++ b/scripts/pi-hole/php/header.php @@ -12,6 +12,12 @@ check_cors(); + // Generate CSRF token + if(empty($_SESSION['token'])) { + $_SESSION['token'] = base64_encode(openssl_random_pseudo_bytes(32)); + } + $token = $_SESSION['token']; + // Try to get temperature value from different places (OS dependent) if(file_exists("/sys/class/thermal/thermal_zone0/temp")) { @@ -196,6 +202,11 @@

To enable Javascript click here

+$token"; +} +?> From 4d9d9dc949be177099c0e6a9eebf83c24f78bb93 Mon Sep 17 00:00:00 2001 From: Mcat12 Date: Sun, 2 Apr 2017 19:23:03 -0400 Subject: [PATCH 2/5] Require CSRF token for debug log generation --- scripts/pi-hole/js/debug.js | 7 ++++--- scripts/pi-hole/php/debug.php | 12 ++++++++++++ 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/scripts/pi-hole/js/debug.js b/scripts/pi-hole/js/debug.js index c0db2ce0..0a6b3ab1 100644 --- a/scripts/pi-hole/js/debug.js +++ b/scripts/pi-hole/js/debug.js @@ -29,20 +29,21 @@ function eventsource() { var ta = $("#output"); var upload = $( "#upload" ); var checked = ""; + var token = encodeURIComponent($("#token").html()); if(upload.prop("checked")) { - checked = "upload"; + checked = "upload"; } // IE does not support EventSource - load whole content at once if (typeof EventSource !== "function") { - httpGet(ta,"/admin/scripts/pi-hole/php/debug.php?IE&"+checked); + httpGet(ta,"/admin/scripts/pi-hole/php/debug.php?IE&token="+token+"&"+checked); return; } var host = window.location.host; - var source = new EventSource("/admin/scripts/pi-hole/php/debug.php?"+checked); + var source = new EventSource("/admin/scripts/pi-hole/php/debug.php?&token="+token+"&"+checked); // Reset and show field ta.empty(); diff --git a/scripts/pi-hole/php/debug.php b/scripts/pi-hole/php/debug.php index 93ae3166..39d5c8ea 100644 --- a/scripts/pi-hole/php/debug.php +++ b/scripts/pi-hole/php/debug.php @@ -5,6 +5,18 @@ ob_implicit_flush(true); header('Content-Type: text/event-stream'); header('Cache-Control: no-cache'); +require "password.php"; +require "auth.php"; + +if(!$auth) { + die("Unauthorized"); +} + +check_cors(); + +$token = isset($_GET["token"]) ? $_GET["token"] : ""; +check_csrf($token); + function echoEvent($datatext) { if(!isset($_GET["IE"])) echo "data: ".implode("\ndata: ", explode("\n", $datatext))."\n\n"; From fe7f3d3873aa89c3fa698070147ff2ff03de63cd Mon Sep 17 00:00:00 2001 From: Mcat12 Date: Sun, 2 Apr 2017 20:04:39 -0400 Subject: [PATCH 3/5] Require CSRF token when changing settings --- scripts/pi-hole/php/savesettings.php | 3 +++ settings.php | 9 +++++++++ 2 files changed, 12 insertions(+) diff --git a/scripts/pi-hole/php/savesettings.php b/scripts/pi-hole/php/savesettings.php index 5c759c6d..e78411e1 100644 --- a/scripts/pi-hole/php/savesettings.php +++ b/scripts/pi-hole/php/savesettings.php @@ -130,6 +130,9 @@ function isinserverlist($addr) { if(isset($_POST["field"])) { + // Handle CSRF + check_csrf(isset($_POST["token"]) ? $_POST["token"] : ""); + // Process request switch ($_POST["field"]) { // Set DNS server diff --git a/settings.php b/settings.php index 29b0f91b..f7130b8a 100644 --- a/settings.php +++ b/settings.php @@ -392,6 +392,7 @@
+
@@ -588,6 +589,7 @@
+
@@ -629,6 +631,7 @@
+ @@ -713,6 +716,7 @@
+
@@ -764,6 +768,7 @@
+
@@ -795,12 +800,15 @@
+
+
+
@@ -863,6 +871,7 @@ if($FTL)

Upload only Pi-hole backup files.

+ From 1e748446df43cd086124a19fbfbd4bba060f9706 Mon Sep 17 00:00:00 2001 From: Mcat12 Date: Tue, 4 Apr 2017 21:02:48 -0400 Subject: [PATCH 4/5] Require CSRF token for Teleporter --- scripts/pi-hole/php/teleporter.php | 4 +++- settings.php | 4 ++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/scripts/pi-hole/php/teleporter.php b/scripts/pi-hole/php/teleporter.php index 43092806..0965d109 100644 --- a/scripts/pi-hole/php/teleporter.php +++ b/scripts/pi-hole/php/teleporter.php @@ -7,11 +7,13 @@ * Please see LICENSE file for your rights under this license. */ require "password.php"; +require "auth.php"; // Also imports func.php + if (php_sapi_name() !== "cli") { if(!$auth) die("Not authorized"); + check_csrf(isset($_POST["token"]) ? $_POST["token"] : ""); } -require('func.php'); function process_zip($name) { global $zip; diff --git a/settings.php b/settings.php index 23b15644..41d1eef2 100644 --- a/settings.php +++ b/settings.php @@ -1,4 +1,4 @@ -
+

Export your Pi-hole lists as downloadable ZIP file

@@ -871,7 +872,6 @@ if($FTL)

Upload only Pi-hole backup files.

-
From 3d0a3506d44173179c69cbb80d552190d66e093b Mon Sep 17 00:00:00 2001 From: Mcat12 Date: Tue, 4 Apr 2017 21:03:23 -0400 Subject: [PATCH 5/5] Small HTML compatibility change: to --- settings.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/settings.php b/settings.php index 41d1eef2..d8ae81c1 100644 --- a/settings.php +++ b/settings.php @@ -877,7 +877,7 @@ if($FTL) -

The PHP extension zip is not loaded. Please ensure it is installed and loaded if you want to use the Pi-hole teleporter.

+

The PHP extension zip is not loaded. Please ensure it is installed and loaded if you want to use the Pi-hole teleporter.