From 8ce2c289198db25c5eae331a458b112e549670f2 Mon Sep 17 00:00:00 2001
From: diginc <adam@diginc.us>
Date: Thu, 16 Jun 2016 22:49:29 -0500
Subject: [PATCH] same changes to sub as last add commit

---
 php/sub.php | 48 ++++++++++++++++++++++++++++++++++++------------
 1 file changed, 36 insertions(+), 12 deletions(-)

diff --git a/php/sub.php b/php/sub.php
index cee19723..36082ac2 100644
--- a/php/sub.php
+++ b/php/sub.php
@@ -1,26 +1,50 @@
 <?php
-if(!isset($_POST['domain'], $_POST['list'], $_POST['token']))
-    die("Missing POST variables");
+function pi_log($message) {
+    error_log($message . "\n", 3, '/var/log/lighttpd/pihole_php.log');
+}
+
+function die_and_log($message) {
+    pi_log($message);
+    die($message);
+}
+
+if(!isset($_POST['domain'], $_POST['list'], $_POST['token'])) {
+    die_and_log("Missing POST variables");
+}
+
+$SERVER_SIDE_IDS = [
+    $_SERVER['SERVER_ADDR'],
+    $_SERVER['SERVER_NAME'],
+    'pi.hole'
+];
 
 // Check CORS
-if($_SERVER['HTTP_ORIGIN'] == "http://pi.hole" || $_SERVER['HTTP_ORIGIN'] == "http://${_SERVER['SERVER_ADDR']}")
-    header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
-else if($_SERVER['HTTP_HOST'] == $_SERVER['SERVER_ADDR'] || $_SERVER['HTTP_HOST'] == "pi.hole")
-    header("Access-Control-Allow-Origin: ${_SERVER['HTTP_HOST']}");
-else
-    die("Failed CORS");
+$CORS_ALLOW_ORIGIN = false;
+if(in_array($_SERVER['HTTP_ORIGIN'], $SERVER_SIDE_IDS)) {
+    $CORS_ALLOW_ORIGIN = $_SERVER['HTTP_ORIGIN'];
+} else if(in_array($_SERVER['HTTP_HOST'], $SERVER_SIDE_IDS)) {
+    $CORS_ALLOW_ORIGIN = $_SERVER['HTTP_HOST'];
+}
+ 
+if (!$CORS_ALLOW_ORIGIN)
+    die_and_log("Failed CORS");
+
+header("Access-Control-Allow-Origin: $CORS_ALLOW_ORIGIN");
 
 session_start();
 
 // Check CSRF token
 if(!hash_equals($_SESSION['token'], $_POST['token']))
-    die("Wrong token");
+    die_and_log("Wrong token");
+
 
 switch($_POST['list']) {
-    case "white":
-        exec("sudo pihole -w -q -d ${_POST['domain']}");
+    case "white":        
+        exec("sudo pihole -w -q ${_POST['domain']}");
         break;
     case "black":
-        exec("sudo pihole -b -q -d ${_POST['domain']}");
+        exec("sudo pihole -b -q ${_POST['domain']}");
         break;
 }
+
+?>