Merge branch 'devel' into customizeadlists

php/auth.php

@@ -15,27 +15,47 @@ function log_and_die($message) {
 }
 
 function check_cors() {
+    $setupVars = parse_ini_file("/etc/pihole/setupVars.conf");
+    $ipv4 = isset($setupVars["IPV4_ADDRESS"]) ? explode("/", $setupVars["IPV4_ADDRESS"])[0] : $_SERVER['SERVER_ADDR'];
+
     // Check CORS
     $AUTHORIZED_HOSTNAMES = array(
-        'http://' . $_SERVER['SERVER_ADDR'],
-        'http://pi.hole',
-        'http://localhost'
+        $ipv4,
+        $_SERVER["SERVER_NAME"],
+        "pi.hole",
+        "localhost"
     );
 
     # Allow user set virtual hostnames
     $virtual_host = getenv('VIRTUAL_HOST');
     if (! empty($virtual_host))
-        array_push($AUTHORIZED_HOSTNAMES, 'http://' . $virtual_host);
+        array_push($AUTHORIZED_HOSTNAMES, $virtual_host);
 
     // Since the Host header is easily manipulated, we can only check if it's wrong and can't use it
     // to validate that the client is authorized, only unauthorized.
-    if(isset($_SERVER['HTTP_HOST']) && !in_array("http://".$_SERVER['HTTP_HOST'], $AUTHORIZED_HOSTNAMES)) {
-        log_and_die("Failed Host Check: " . $_SERVER['HTTP_HOST'] .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));
+    $server_host = $_SERVER['HTTP_HOST'];
+
+    // If HTTP_HOST contains a non-standard port (!= 80) we have to strip the port
+    if(strpos($server_host, ":"))
+    {
+        $server_host = parse_url($_SERVER['HTTP_HOST'], PHP_URL_HOST);
+    }
+
+    if(isset($_SERVER['HTTP_HOST']) && !in_array($server_host, $AUTHORIZED_HOSTNAMES)) {
+        log_and_die("Failed Host Check: " . $server_host .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));
     }
 
     if(isset($_SERVER['HTTP_ORIGIN'])) {
-        if(!in_array($_SERVER['HTTP_ORIGIN'], $AUTHORIZED_HOSTNAMES)) {
-            log_and_die("Failed CORS: " . $_SERVER['HTTP_ORIGIN'] .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));
+        $server_origin = $_SERVER['HTTP_ORIGIN'];
+
+        // If HTTP_ORIGIN contains a non-standard port (!= 80) we have to strip the port
+        if(strpos($server_origin, ":"))
+        {
+            $server_origin = parse_url($_SERVER['HTTP_ORIGIN'], PHP_URL_HOST);
+        }
+
+        if(!in_array($server_origin, $AUTHORIZED_HOSTNAMES)) {
+            log_and_die("Failed CORS: " . $server_origin .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));
         }
         header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
     }

php/func.php

@@ -7,4 +7,16 @@ function is_valid_domain_name($domain_name)
         preg_match("/^[^\.]{1,63}(\.[^\.]{1,63})*$/", $domain_name)); //length of each label
 }
 
-?>
+function checkfile($filename) {
+    if(is_readable($filename))
+    {
+        return $filename;
+    }
+    else
+    {
+        // substitute dummy file
+        return "/dev/null";
+    }
+}
+
+?>

php/get.php

@@ -7,7 +7,9 @@ $type = $_GET['list'];
 if($type !== "white" && $type !== "black")
     die("Invalid list parameter");
 
-$rawList = file_get_contents("/etc/pihole/${type}list.txt");
+require "func.php";
+
+$rawList = file_get_contents(checkfile("/etc/pihole/${type}list.txt"));
 $list = explode("\n", $rawList);
 
 // Get rid of empty lines
@@ -16,16 +18,16 @@ for($i = sizeof($list)-1; $i >= 0; $i--) {
         unset($list[$i]);
 }
 
-function filterArray(&$a) {
-    $sanArray = array();
-    foreach ($a as $k=>$v) {
-        if (is_array($v)) {
-            $sanArray[htmlspecialchars($k)] = filterArray($v);
+function filterArray(&$inArray) {
+    $outArray = array();
+    foreach ($inArray as $key=>$value) {
+        if (is_array($value)) {
+            $outArray[htmlspecialchars($key)] = filterArray($value);
         } else {
-            $sanArray[htmlspecialchars($k)] = htmlspecialchars($v);
+            $outArray[htmlspecialchars($key)] = htmlspecialchars($value);
         }
     }
-    return $sanArray;
+    return $outArray;
 }
 
 // Protect against XSS attacks

php/loginpage.php

@@ -0,0 +1,54 @@
+<div class="mainbox col-md-6 col-md-offset-3 col-sm-6 col-sm-offset-3">
+  <div class="panel panel-default">
+    <div class="panel-heading">
+      <div style="text-align: center;"><img src="img/logo.svg" width="<?php if ($boxedlayout) { ?>50%<?php } else { ?>30%<?php } ?>"></div><br>
+
+      <div class="panel-title text-center"><span class="logo-lg" style="font-size: 25px;"><b>Pi</b>-hole</span></div>
+      <p class="login-box-msg">Sign in to start your session</p>
+      <?php if ($wrongpassword) { ?>
+        <div class="form-group has-error login-box-msg">
+          <label class="control-label"><i class="fa fa-times-circle-o"></i> Wrong password!</label>
+        </div>
+      <?php } ?>
+    </div>
+
+    <div class="panel-body">
+      <form action="" method="post">
+        <div class="form-group has-feedback <?php if ($wrongpassword) { ?>has-error<?php } ?> ">
+          <input type="password" name="pw" class="form-control" placeholder="Password" autofocus>
+          <span class="glyphicon glyphicon-lock form-control-feedback"></span>
+        </div>
+        <div class="row">
+          <div class="col-xs-4 col-xs-offset-8">
+            <button type="submit" href="#" class="btn btn-primary pull-right"><i class="glyphicon glyphicon-log-in"></i>&nbsp;&nbsp;&nbsp;Log in</button>
+          </div>
+        </div>
+        <br>
+        <div class="row">
+          <div class="col-xs-12">
+            <div class="box box-<?php if (!$wrongpassword) { ?>info<?php } else { ?>danger<?php }
+            if (!$wrongpassword) { ?> collapsed-box<?php } ?> box-solid">
+              <div class="box-header with-border">
+                <h3 class="box-title">Forgot password</h3>
+
+                <div class="box-tools pull-right">
+                  <button type="button" class="btn btn-box-tool" data-widget="collapse"><i
+                      class="fa <?php if ($wrongpassword) { ?>fa-minus<?php } else { ?>fa-plus<?php } ?>"></i>
+                  </button>
+                </div>
+              </div>
+              <div class="box-body">
+                After installing Pi-Hole for the first time, a password is generated and displayed to the user. The
+                password cannot be retrived later on, but it is possible to set a new password (or explicitly disable
+                the
+                password by setting an empty password) using the command
+                <pre>sudo pihole -a -p newpassword</pre>
+              </div>
+            </div>
+          </div>
+        </div>
+      </form>
+
+    </div>
+  </div>
+</div>

php/password.php

@@ -20,6 +20,8 @@
         session_unset();
     }
 
+    $wrongpassword = false;
+
     // Test if password is set
     if(strlen($pwhash) > 0)
     {
@@ -32,6 +34,10 @@
                 $_SESSION["hash"] = $pwhash;
                 $auth = true;
             }
+            else
+            {
+                $wrongpassword = true;
+            }
         }
         // Compare auth hash with saved hash
         else if (isset($_SESSION["hash"]))

php/savesettings.php

@@ -9,10 +9,24 @@ function validIP($address){
 	return !filter_var($address, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) === false;
 }
 
+// Check for existance of variable
+// and test it only if it exists
+function istrue(&$argument) {
+	$ret = false;
+	if(isset($argument))
+	{
+		if($argument)
+		{
+			$ret = true;
+		}
+	}
+	return $ret;
+}
+
 // Credit: http://stackoverflow.com/a/4694816/2087442
 function validDomain($domain_name)
 {
-	$validChars = preg_match("/^([a-z\d](-*[a-z\d])*)(\.([a-z\d](-*[a-z\d])*))*$/i", $domain_name);
+	$validChars = preg_match("/^([_a-z\d](-*[_a-z\d])*)(\.([_a-z\d](-*[a-z\d])*))*(\.([a-z\d])*)+$/i", $domain_name);
 	$lengthCheck = preg_match("/^.{1,253}$/", $domain_name);
 	$labelLengthCheck = preg_match("/^[^\.]{1,63}(\.[^\.]{1,63})*$/", $domain_name);
 	return ( $validChars && $lengthCheck && $labelLengthCheck ); //length of each label
@@ -95,7 +109,14 @@ function readAdlists(&$list, $listname)
 				// Get secondary DNS server IP address
 				if($secondaryDNS === "Custom")
 				{
-					$secondaryIP = $_POST["DNS2IP"];
+					if(strlen($_POST["DNS2IP"]) > 0)
+					{
+						$secondaryIP = $_POST["DNS2IP"];
+					}
+					else
+					{
+						$secondaryIP = "none";
+					}
 				}
 				else
 				{
@@ -103,7 +124,7 @@ function readAdlists(&$list, $listname)
 				}
 
 				// Validate secondary IP
-				if (!validIP($secondaryIP) && strlen($secondaryIP) > 0)
+				if (!validIP($secondaryIP) && $secondaryIP != "none" && strlen($secondaryIP) > 0)
 				{
 					$error .= "Secondary IP (".$secondaryIP.") is invalid!<br>";
 				}
@@ -235,22 +256,42 @@ function readAdlists(&$list, $listname)
 				}
 				else
 				{
-					exec("sudo pihole -a setquerylog none");
+					exec("sudo pihole -a setquerylog nothing");
 					$success .= "No entries will be shown in Query Log";
 				}
 
+				if(isset($_POST["resolve-forward"]))
+				{
+					exec("sudo pihole -a resolve forward true");
+				}
+				else
+				{
+					exec("sudo pihole -a resolve forward false");
+				}
+
+				if(isset($_POST["resolve-clients"]))
+				{
+					exec("sudo pihole -a resolve clients true");
+				}
+				else
+				{
+					exec("sudo pihole -a resolve clients false");
+				}
+
 				break;
 
 			case "webUI":
 				if($_POST["tempunit"] == "F")
 				{
 					exec('sudo pihole -a -f');
-					$success .= "The webUI settings have been updated";
+				}
+				elseif($_POST["tempunit"] == "K")
+				{
+					exec('sudo pihole -a -k');
 				}
 				else
 				{
 					exec('sudo pihole -a -c');
-					$success .= "The webUI settings have been updated";
 				}
 				if(isset($_POST["boxedlayout"]))
 				{
@@ -260,6 +301,7 @@ function readAdlists(&$list, $listname)
 				{
 					exec('sudo pihole -a layout traditional');
 				}
+				$success .= "The webUI settings have been updated";
 				break;
 
 			case "reboot":