From 5d1761b19d5b2f618d76862d4cc0d24ab5bd7bfe Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Sun, 28 Feb 2016 14:52:54 -0500
Subject: [PATCH] Implemented password checking Currently allows anything for
 the password. This will be updated when I implment passwords on the main
 repo.

---
 list.php          | 66 +++++++++++++++++++++++++++++++++++++++--------
 php/add.php       |  7 ++++-
 php/checkPass.php | 10 +++++++
 php/functions.php |  5 ++++
 php/sub.php       |  7 ++++-
 5 files changed, 82 insertions(+), 13 deletions(-)
 create mode 100644 php/checkPass.php
 create mode 100644 php/functions.php

diff --git a/list.php b/list.php
index c0a0cf52..8087f20f 100644
--- a/list.php
+++ b/list.php
@@ -47,14 +47,17 @@ function getFullName() {
             </div>
             <div class="modal-body">
                 Please enter your Pi-hole password to proceed.
+                <div id="alPassword" class="alert alert-danger" role="alert" hidden="true">
+                    Wrong Password! Please try again.
+                </div>
                 <div class="form-group">
                     <label for="passInput">Password:</label>
                     <input id="passInput" type="password" class="form-control">
                 </div>
             </div>
             <div class="modal-footer">
-                <button type="button" class="btn btn-default" data-dismiss="modal">Cancel</button>
-                <button id="passBtn" type="button" class="btn btn-primary" data-dismiss="modal">Enter</button>
+                <button type="button" class="btn btn-default" data-dismiss="modal" onclick="$('#alPassword').hide()">Cancel</button>
+                <button id="passBtn" type="button" class="btn btn-primary">Enter</button>
             </div>
         </div>
     </div>
@@ -115,8 +118,10 @@ require "footer.php";
             $.ajax({
                 url: "php/add.php",
                 method: "get",
-                data: {"domain":domain, "list":"<?php echo $list ?>"},
+                data: {"domain":domain, "list":"<?php echo $list ?>", "pass":password},
                 success: function(response) {
+                    if(response.length !== 0)
+                        return;
                     document.getElementById("alSuccess").hidden = false;
                     refresh();
                 },
@@ -133,8 +138,10 @@ require "footer.php";
             $.ajax({
                 url: "php/sub.php",
                 method: "get",
-                data: {"domain":entry, "list":"<?php echo $list ?>"},
+                data: {"domain":entry, "list":"<?php echo $list ?>", "pass":password},
                 success: function(response) {
+                    if(response.length !== 0)
+                        return;
                     document.getElementById("list").removeChild(document.getElementById(index));
                 },
                 error: function(jqXHR, exception) {
@@ -145,24 +152,61 @@ require "footer.php";
     }
     
     function getPassword(callback) {
-        // Return if we already have the password
+        // Check password and return
         if(password.length !== 0) {
-            callback();
+            $.ajax({
+                url: "php/checkPass.php",
+                method: "get",
+                data: {"pass":password},
+                success: function(response) {
+                    if(response === "Correct")
+                        callback();
+                },
+                error: function(jqXHR, exception) {
+                    alert("Failed to check password!");
+                }
+            });
             return;
         }
         
         // Prompt the user for password
-        $("#passModal").modal();
+        var modal = $("#passModal");
+        modal.modal();
         
         // Handle enter button
         $("#passBtn").on("click", function() {
             var passInput = $("#passInput");
+            var passAlert = $("#alPassword");
             password = passInput.val();
-            passInput.html("");
             
-            // Execute callback if password was entered
-            if(password.length !== 0)
-                callback();
+            // Execute callback if entered
+            if(password.length !== 0) {
+                // Check if password is correct
+                $.ajax({
+                    url: "php/checkPass.php",
+                    method: "get",
+                    data: {"pass":password},
+                    success: function(response) {
+                        if(response === "Correct") {
+                            passInput.html("");
+                            passAlert.hide();
+                            modal.modal("hide");
+                            callback();
+                        }
+                        else {
+                            passAlert.show();
+                            password = "";
+                        }
+                    },
+                    error: function(jqXHR, exception) {
+                        alert("Failed to check password!");
+                        password = "";
+                    }
+                });
+            }
+            else {
+                passAlert.show()
+            }
         });
     }
 </script>
diff --git a/php/add.php b/php/add.php
index 95585ee7..c602119d 100644
--- a/php/add.php
+++ b/php/add.php
@@ -1,7 +1,12 @@
 <?php
-if(!isset($_GET['domain'], $_GET['list']))
+if(!isset($_GET['domain'], $_GET['list'], $_GET['pass']))
     die();
 
+include "functions.php";
+
+if(!checkPass($_GET['pass']))
+    die("Wrong Password");
+
 switch($_GET['list']) {
     case "white":
         exec("/usr/local/bin/whitelist.sh -q ${_GET['domain']}");
diff --git a/php/checkPass.php b/php/checkPass.php
new file mode 100644
index 00000000..6288d761
--- /dev/null
+++ b/php/checkPass.php
@@ -0,0 +1,10 @@
+<?php
+if(!isset($_GET['pass']))
+    die("No password entered");
+
+include "functions.php";
+
+if(checkPass($_GET['pass']))
+    echo "Correct";
+else
+    echo "Wrong";
\ No newline at end of file
diff --git a/php/functions.php b/php/functions.php
new file mode 100644
index 00000000..97c7700a
--- /dev/null
+++ b/php/functions.php
@@ -0,0 +1,5 @@
+<?php
+function checkPass($pass) {
+    // Check password
+    return true;
+}
\ No newline at end of file
diff --git a/php/sub.php b/php/sub.php
index 2b13b975..9c5862e9 100644
--- a/php/sub.php
+++ b/php/sub.php
@@ -1,7 +1,12 @@
 <?php
-if(!isset($_GET['domain'], $_GET['list']))
+if(!isset($_GET['domain'], $_GET['list'], $_GET['pass']))
     die();
 
+include "functions.php";
+
+if(!checkPass($_GET['pass']))
+    die("Wrong Password");
+
 switch($_GET['list']) {
     case "white":
         exec("/usr/local/bin/whitelist.sh -q -d ${_GET['domain']}");