Add CORS and CSRF checks to ensure unauthorized access to the backend is not possible.

Signed-off-by: DL6ER <dl6er@dl6er.de>

scripts/pi-hole/js/groups-adlists.js

@@ -1,4 +1,6 @@
-var table, groups;
+var table;
+var groups = [];
+const token = $("#token").html();
 
 function showAlert(type, message)
 {
@@ -23,7 +25,7 @@ function showAlert(type, message)
 
 function get_groups()
 {
-    $.get("scripts/pi-hole/php/groups.php", { 'action': 'get_groups' },
+    $.post("scripts/pi-hole/php/groups.php", { 'action': 'get_groups', "token":token },
     function(data) {
         groups = data.data;
     }, "json");
@@ -52,7 +54,11 @@ $(document).ready(function() {
       });
 
     table = $("#adlistsTable").DataTable( {
-        "ajax": "scripts/pi-hole/php/groups.php?action=get_adlists",
+        "ajax": {
+            "url": "scripts/pi-hole/php/groups.php",
+            "data": {"action": "get_adlists", "token": token},
+            "type": "POST"
+        },
         order: [[ 1, 'asc' ]],
         columns: [
             { data: "address" },
@@ -135,7 +141,7 @@ function addAdlist()
         url: "scripts/pi-hole/php/groups.php",
         method: "post",
         dataType: 'json',
-        data: {"action": "add_adlist", "address": address, "comment": comment},
+        data: {"action": "add_adlist", "address": address, "comment": comment, "token":token},
         success: function(response) {
             if (response.success) {
                 showAlert('success');
@@ -166,7 +172,7 @@ function editAdlist()
         url: "scripts/pi-hole/php/groups.php",
         method: "post",
         dataType: 'json',
-        data: {"action": "edit_adlist", "id": id, "comment": comment, "status": status, "groups": groups},
+        data: {"action": "edit_adlist", "id": id, "comment": comment, "status": status, "groups": groups, "token":token},
         success: function(response) {
             if (response.success) {
                 showAlert('success');
@@ -191,7 +197,7 @@ function deleteAdlist()
         url: "scripts/pi-hole/php/groups.php",
         method: "post",
         dataType: 'json',
-        data: {"action": "delete_adlist", "id": id},
+        data: {"action": "delete_adlist", "id": id, "token":token},
         success: function(response) {
             if (response.success) {
                 showAlert('success');

scripts/pi-hole/js/groups-clients.js

@@ -1,4 +1,6 @@
-var table, groups;
+var table;
+var groups = [];
+const token = $("#token").html();
 
 function showAlert(type, message)
 {
@@ -23,7 +25,7 @@ function showAlert(type, message)
 
 function reload_client_suggestions()
 {
-    $.get("scripts/pi-hole/php/groups.php", { 'action': 'get_unconfigured_clients' },
+    $.post("scripts/pi-hole/php/groups.php", { 'action': 'get_unconfigured_clients', "token":token },
     function(data) {
         var sel = $("#select");
         sel.empty();
@@ -36,7 +38,7 @@ function reload_client_suggestions()
 
 function get_groups()
 {
-    $.get("scripts/pi-hole/php/groups.php", { 'action': 'get_groups' },
+    $.post("scripts/pi-hole/php/groups.php", { 'action': 'get_groups', "token":token },
     function(data) {
         groups = data.data;
     }, "json");
@@ -61,7 +63,11 @@ $(document).ready(function() {
       });
 
     table = $("#clientsTable").DataTable( {
-        "ajax": "scripts/pi-hole/php/groups.php?action=get_clients",
+        "ajax": {
+            "url": "scripts/pi-hole/php/groups.php",
+            "data": {"action": "get_clients", "token": token},
+            "type": "POST"
+        },
         order: [[ 1, 'asc' ]],
         columns: [
             { data: "ip" },
@@ -137,7 +143,7 @@ function addClient()
         url: "scripts/pi-hole/php/groups.php",
         method: "post",
         dataType: 'json',
-        data: {"action": "add_client", "ip": ip},
+        data: {"action": "add_client", "ip": ip, "token":token},
         success: function(response) {
             if (response.success) {
                 showAlert('success');
@@ -165,7 +171,7 @@ function editClient()
         url: "scripts/pi-hole/php/groups.php",
         method: "post",
         dataType: 'json',
-        data: {"action": "edit_client", "id": id, "groups": groups},
+        data: {"action": "edit_client", "id": id, "groups": groups, "token":token},
         success: function(response) {
             if (response.success) {
                 showAlert('success');
@@ -190,7 +196,7 @@ function deleteClient()
         url: "scripts/pi-hole/php/groups.php",
         method: "post",
         dataType: 'json',
-        data: {"action": "delete_client", "id": id},
+        data: {"action": "delete_client", "id": id, "token":token},
         success: function(response) {
             if (response.success) {
                 showAlert('success');

scripts/pi-hole/js/groups-domains.js

@@ -1,4 +1,6 @@
-var table, groups;
+var table;
+var groups = [];
+const token = $("#token").html();
 
 function showAlert(type, message)
 {
@@ -53,7 +55,11 @@ $(document).ready(function() {
       });
 
     table = $("#domainsTable").DataTable( {
-        "ajax": "scripts/pi-hole/php/groups.php?action=get_domains",
+        "ajax": {
+            "url": "scripts/pi-hole/php/groups.php",
+            "data": {"action": "get_domains", "token": token},
+            "type": "POST"
+        },
         order: [[ 1, 'asc' ]],
         columns: [
             { data: "domain" },
@@ -145,7 +151,7 @@ function addDomain()
         url: "scripts/pi-hole/php/groups.php",
         method: "post",
         dataType: 'json',
-        data: {"action": "add_domain", "domain": domain, "type": type, "comment": comment},
+        data: {"action": "add_domain", "domain": domain, "type": type, "comment": comment, "token":token},
         success: function(response) {
             if (response.success) {
                 showAlert('success');
@@ -177,7 +183,7 @@ function editDomain()
         url: "scripts/pi-hole/php/groups.php",
         method: "post",
         dataType: 'json',
-        data: {"action": "edit_domain", "id": id, "type": type, "comment": comment, "status": status, "groups": groups},
+        data: {"action": "edit_domain", "id": id, "type": type, "comment": comment, "status": status, "groups": groups, "token":token},
         success: function(response) {
             if (response.success) {
                 showAlert('success');
@@ -202,7 +208,7 @@ function deleteDomain()
         url: "scripts/pi-hole/php/groups.php",
         method: "post",
         dataType: 'json',
-        data: {"action": "delete_domain", "id": id},
+        data: {"action": "delete_domain", "id": id, "token":token},
         success: function(response) {
             if (response.success) {
                 showAlert('success');

scripts/pi-hole/js/groups.js

@@ -1,4 +1,5 @@
 var table;
+const token = $("#token").html();
 
 function showAlert(type, message)
 {
@@ -26,7 +27,11 @@ $(document).ready(function() {
     $('#btnAdd').on('click', addGroup);
 
     table = $("#groupsTable").DataTable( {
-        "ajax": "scripts/pi-hole/php/groups.php?action=get_groups",
+        "ajax": {
+            "url": "scripts/pi-hole/php/groups.php",
+            "data": {"action": "get_groups", "token": token},
+            "type": "POST"
+        },
         order: [[ 1, 'asc' ]],
         columns: [
             { data: "id", width: "60px" },

scripts/pi-hole/php/groups.php

@@ -7,25 +7,17 @@
 *  Please see LICENSE file for your rights under this license. */
 
 require_once('auth.php');
-/*
+
 // Authentication checks
 if(isset($_POST['token']))
 {
     check_cors();
     check_csrf($_POST['token']);
 }
-elseif(isset($_POST['pw']))
-{
-    require("password.php");
-    if($wrongpassword || !$auth)
-    {
-	log_and_die("Wrong password!");
-    }
-}
 else
 {
     log_and_die("Not allowed!");
-}*/
+}
 
 $reload = false;
 
@@ -44,14 +36,14 @@ function JSON_error($message = null)
 {
     header('Content-type: application/json');
     $response = array("success" => false, "message" => $message);
-    if(isset($_REQUEST['action']))
+    if(isset($_POST['action']))
     {
-        array_push($response, array("action" => $_REQUEST['action']));
+        array_push($response, array("action" => $_POST['action']));
     }
     echo json_encode($response);
 }
 
-if($_REQUEST['action'] == "get_groups")
+if($_POST['action'] == "get_groups")
 {
     // List all available groups
     try
@@ -69,7 +61,7 @@ if($_REQUEST['action'] == "get_groups")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "add_group")
+elseif($_POST['action'] == "add_group")
 {
     // Add new group
     try
@@ -103,7 +95,7 @@ elseif($_REQUEST['action'] == "add_group")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "edit_group")
+elseif($_POST['action'] == "edit_group")
 {
     // Edit group identified by ID
     try
@@ -159,7 +151,7 @@ elseif($_REQUEST['action'] == "edit_group")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "delete_group")
+elseif($_POST['action'] == "delete_group")
 {
     // Delete group identified by ID
     try
@@ -188,7 +180,7 @@ elseif($_REQUEST['action'] == "delete_group")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "get_clients")
+elseif($_POST['action'] == "get_clients")
 {
     // List all available groups
     try
@@ -225,7 +217,7 @@ elseif($_REQUEST['action'] == "get_clients")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "get_unconfigured_clients")
+elseif($_POST['action'] == "get_unconfigured_clients")
 {
     // List all available clients WITHOUT already configured clients
     try
@@ -270,7 +262,7 @@ elseif($_REQUEST['action'] == "get_unconfigured_clients")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "add_client")
+elseif($_POST['action'] == "add_client")
 {
     // Add new client
     try
@@ -299,7 +291,7 @@ elseif($_REQUEST['action'] == "add_client")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "edit_client")
+elseif($_POST['action'] == "edit_client")
 {
     // Edit client identified by ID
     try
@@ -354,7 +346,7 @@ elseif($_REQUEST['action'] == "edit_client")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "delete_client")
+elseif($_POST['action'] == "delete_client")
 {
     // Delete client identified by ID
     try
@@ -399,7 +391,7 @@ elseif($_REQUEST['action'] == "delete_client")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "get_domains")
+elseif($_POST['action'] == "get_domains")
 {
     // List all available groups
     try
@@ -436,7 +428,7 @@ elseif($_REQUEST['action'] == "get_domains")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "add_domain")
+elseif($_POST['action'] == "add_domain")
 {
     // Add new domain
     try
@@ -475,7 +467,7 @@ elseif($_REQUEST['action'] == "add_domain")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "edit_domain")
+elseif($_POST['action'] == "edit_domain")
 {
     // Edit domain identified by ID
     try
@@ -573,7 +565,7 @@ elseif($_REQUEST['action'] == "edit_domain")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "delete_domain")
+elseif($_POST['action'] == "delete_domain")
 {
     // Delete domain identified by ID
     try
@@ -618,7 +610,7 @@ elseif($_REQUEST['action'] == "delete_domain")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "get_adlists")
+elseif($_POST['action'] == "get_adlists")
 {
     // List all available groups
     try
@@ -655,7 +647,7 @@ elseif($_REQUEST['action'] == "get_adlists")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "add_adlist")
+elseif($_POST['action'] == "add_adlist")
 {
     // Add new adlist
     try
@@ -689,7 +681,7 @@ elseif($_REQUEST['action'] == "add_adlist")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "edit_adlist")
+elseif($_POST['action'] == "edit_adlist")
 {
     // Edit adlist identified by ID
     try
@@ -782,7 +774,7 @@ elseif($_REQUEST['action'] == "edit_adlist")
         return JSON_error($ex->getMessage());
     }
 }
-elseif($_REQUEST['action'] == "delete_adlist")
+elseif($_POST['action'] == "delete_adlist")
 {
     // Delete adlist identified by ID
     try