From 9f6fac65cbab628e1c0aa35d22aff63624a9dd04 Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Wed, 20 Jul 2016 20:43:18 -0400
Subject: [PATCH 1/3] Fix possible XSS attack through white/black lists

---
 php/get.php | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/php/get.php b/php/get.php
index 55b6dc7f..d6385794 100644
--- a/php/get.php
+++ b/php/get.php
@@ -12,4 +12,18 @@ for($i = sizeof($list)-1; $i >= 0; $i--) {
         unset($list[$i]);
 }
 
-echo json_encode(array_values($list));
\ No newline at end of file
+function filterArray(&$a) {
+    $sanArray = array();
+    foreach ($a as $k=>$v) {
+        if (is_array($v)) {
+            $sanArray[htmlspecialchars($k)] = filterArray($v);
+        } else {
+            $sanArray[htmlspecialchars($k)] = htmlspecialchars($v);
+        }
+    }
+    return $sanArray;
+}
+
+// Protect against XSS attacks
+$list = filterArray($list);
+echo json_encode(array_values($list));

From 72654054240b2c1ccbd3f939aa2b63980f77c694 Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Tue, 16 Aug 2016 15:17:28 -0400
Subject: [PATCH 2/3] Fix possible list param exploit

Sanitize list parameter, so that only the whitelist or blacklist are able to be read.
---
 php/get.php | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/php/get.php b/php/get.php
index 55b6dc7f..b67bc11f 100644
--- a/php/get.php
+++ b/php/get.php
@@ -3,6 +3,10 @@ if(!isset($_GET['list']))
     die();
 
 $type = $_GET['list'];
+
+if($type !== "white" || $type !== "black")
+    die("Invalid list parameter");
+
 $rawList = file_get_contents("/etc/pihole/${type}list.txt");
 $list = explode("\n", $rawList);
 
@@ -12,4 +16,4 @@ for($i = sizeof($list)-1; $i >= 0; $i--) {
         unset($list[$i]);
 }
 
-echo json_encode(array_values($list));
\ No newline at end of file
+echo json_encode(array_values($list));

From c41d377eb37fa3559d80cfb0c9c110b5abb76784 Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Tue, 16 Aug 2016 15:55:41 -0400
Subject: [PATCH 3/3] Fix always returning invalid parameter

---
 php/get.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/php/get.php b/php/get.php
index b67bc11f..a09ae2f3 100644
--- a/php/get.php
+++ b/php/get.php
@@ -4,7 +4,7 @@ if(!isset($_GET['list']))
 
 $type = $_GET['list'];
 
-if($type !== "white" || $type !== "black")
+if($type !== "white" && $type !== "black")
     die("Invalid list parameter");
 
 $rawList = file_get_contents("/etc/pihole/${type}list.txt");