pi-hole/web
1
0
Fork 0
mirror of https://github.com/pi-hole/web.git synced 2024-12-06 19:36:21 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1737 from pi-hole/release/v5.4

Browse Source 
Pi-hole web v5.4
This commit is contained in:
Adam Warner
2021-02-16 19:47:51 +00:00
committed by GitHub
parent 1521dfe3f4 64b36564c5
commit 989e1ba0ca
2 changed files with 18 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/pi-hole/php/auth.php
+6 -1
View File
@@ -83,7 +83,7 @@ function check_cors() {
$server_origin = str_replace(array("[","]","http://","https://"), array("","","",""), $server_origin);
if(!in_array($server_origin, $AUTHORIZED_HOSTNAMES)) {
log_and_die("Failed CORS: " . $server_origin .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));
log_and_die("Failed CORS: " . htmlspecialchars($server_origin) .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));
}
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
}
@@ -97,6 +97,11 @@ function check_csrf($token) {
session_id() == "";
if(!$session_started) {
// Start a new PHP session (or continue an existing one)
// Prevents javascript XSS attacks aimed to steal the session ID
ini_set('session.cookie_httponly', 1);
// Prevent Session ID from being passed through URLs
ini_set('session.use_only_cookies', 1);
session_start();
}
scripts/pi-hole/php/password.php
+12 -1
View File
@@ -9,6 +9,10 @@
require_once('func.php');
// Start a new PHP session (or continue an existing one)
// Prevents javascript XSS attacks aimed to steal the session ID
ini_set('session.cookie_httponly', 1);
// Prevent Session ID from being passed through URLs
ini_set('session.use_only_cookies', 1);
session_start();
// Read setupVars.conf file
@@ -39,7 +43,7 @@
// Test if password is set
if(strlen($pwhash) > 0)
{
// Check for and authorize from persistent cookie
// Check for and authorize from persistent cookie
if (isset($_COOKIE["persistentlogin"]))
{
if (hash_equals($pwhash, $_COOKIE["persistentlogin"]))
@@ -61,6 +65,13 @@
$postinput = hash('sha256',hash('sha256',$_POST["pw"]));
if(hash_equals($pwhash, $postinput))
{
// Regenerate session ID to prevent session fixation
session_regenerate_id();
// Clear the old session
$_SESSION = array();
// Set hash in new session
$_SESSION["hash"] = $pwhash;
// Login successful, redirect the user to the homepage to discard the POST request