From cd75d7e7a3d7e416371ceec0740fafd46d6aa6e4 Mon Sep 17 00:00:00 2001
From: DL6ER <derigs@ph1.uni-koeln.de>
Date: Sun, 20 Nov 2016 15:34:03 +0100
Subject: [PATCH] Remove hash from the javascript scripts.

---
 header.php           |  1 -
 js/pihole/gravity.js |  3 +--
 js/pihole/index.js   | 15 ++++++---------
 js/pihole/queries.js |  6 +-----
 php/password.php     |  3 ++-
 5 files changed, 10 insertions(+), 18 deletions(-)

diff --git a/header.php b/header.php
index 2d6b20e1..7bf3d411 100644
--- a/header.php
+++ b/header.php
@@ -77,7 +77,6 @@
     <div class="js-warn" id="js-warn-exit"><h1>Javascript Is Disabled</h1><p>Javascript seems to be disabled. This will break some site features.</p>
         <p>To enable Javascript click <a href="http://www.enable-javascript.com/" target="_blank">here</a></p><label for="js-hide">Close</label></div>
 </div>
-<div id="hash" hidden><?php echo $pwstring; ?></div>
 <!-- /JS Warning -->
 <script src="js/pihole/header.js"></script>
 <div class="wrapper">
diff --git a/js/pihole/gravity.js b/js/pihole/gravity.js
index d1de2948..04691c1c 100644
--- a/js/pihole/gravity.js
+++ b/js/pihole/gravity.js
@@ -2,8 +2,7 @@ function eventsourcetest() {
     var alInfo = $("#alInfo");
     var alSuccess = $("#alSuccess");
     var ta = document.getElementById("output");
-    var hash = document.getElementById("hash").innerHTML;
-    var source = new EventSource("php/gravity.sh.php?"+hash);
+    var source = new EventSource("php/gravity.sh.php");
 
     alInfo.show();
     alSuccess.hide();
diff --git a/js/pihole/index.js b/js/pihole/index.js
index b73b8798..0105f61a 100644
--- a/js/pihole/index.js
+++ b/js/pihole/index.js
@@ -18,9 +18,6 @@ $(document).ready(function() {
         }
     };
 
-    // Get auth hash
-    hash = document.getElementById("hash").innerHTML;
-
     var ctx = document.getElementById("queryOverTimeChart").getContext("2d");
     timeLineChart = new Chart(ctx, {
         type: 'line',
@@ -132,7 +129,7 @@ $(document).ready(function() {
 // Functions to update data in page
 
 function updateSummaryData(runOnce) {
-    $.getJSON("api.php?summary&"+hash, function LoadSummaryData(data) {
+    $.getJSON("api.php?summary", function LoadSummaryData(data) {
         //$("h3.statistic").addClass("glow");
         if ($("h3#ads_blocked_today").text() != data.ads_blocked_today) {
             $("h3#ads_blocked_today").addClass("glow");
@@ -163,7 +160,7 @@ function updateSummaryData(runOnce) {
 }
 
 function updateQueriesOverTime() {
-    $.getJSON("api.php?overTimeData&"+hash, function(data) {
+    $.getJSON("api.php?overTimeData", function(data) {
         // Add data for each hour that is available
         // remove last data point since it not representative
         data.ads_over_time.splice(-1,1);
@@ -179,7 +176,7 @@ function updateQueriesOverTime() {
 }
 
 function updateQueryTypes() {
-    $.getJSON("api.php?getQueryTypes&"+hash, function(data) {
+    $.getJSON("api.php?getQueryTypes", function(data) {
         var colors = [];
         // Get colors from AdminLTE
         $.each($.AdminLTE.options.colors, function(key, value) { colors.push(value); });
@@ -202,7 +199,7 @@ function updateQueryTypes() {
 }
 
 function updateTopClientsChart() {
-    $.getJSON("api.php?summaryRaw&getQuerySources&"+hash, function(data) {
+    $.getJSON("api.php?summaryRaw&getQuerySources", function(data) {
         var clienttable =  $('#client-frequency').find('tbody:last');
         for (domain in data.top_sources) {
             clienttable.append('<tr> <td>' + domain +
@@ -215,7 +212,7 @@ function updateTopClientsChart() {
 }
 
 function updateForwardDestinations() {
-    $.getJSON("api.php?getForwardDestinations&"+hash, function(data) {
+    $.getJSON("api.php?getForwardDestinations", function(data) {
         var colors = [];
         // Get colors from AdminLTE
         $.each($.AdminLTE.options.colors, function(key, value) { colors.push(value); });
@@ -238,7 +235,7 @@ function updateForwardDestinations() {
 }
 
 function updateTopLists() {
-    $.getJSON("api.php?summaryRaw&topItems&"+hash, function(data) {
+    $.getJSON("api.php?summaryRaw&topItems", function(data) {
         var domaintable = $('#domain-frequency').find('tbody:last');
         var adtable = $('#ad-frequency').find('tbody:last');
 
diff --git a/js/pihole/queries.js b/js/pihole/queries.js
index aaa0ef6b..9197de91 100644
--- a/js/pihole/queries.js
+++ b/js/pihole/queries.js
@@ -1,8 +1,4 @@
-// Define global variables
-var hash;
 $(document).ready(function() {
-    // Get auth hash
-    hash = document.getElementById("hash").innerHTML;
 
     tableApi = $('#all-queries').DataTable( {
         "rowCallback": function( row, data, index ){
@@ -48,7 +44,7 @@ $(document).ready(function() {
 } );
 
 function refreshData() {
-    tableApi.ajax.url("api.php?getAllQueries&"+hash).load();
+    tableApi.ajax.url("api.php?getAllQueries").load();
 }
 
 function add(domain,list) {
diff --git a/php/password.php b/php/password.php
index 3f9b14c6..a023c0ee 100644
--- a/php/password.php
+++ b/php/password.php
@@ -3,8 +3,9 @@
     session_start();
     $pwhash =  parse_ini_file("/etc/pihole/setupVars.conf")['WEBPASSWORD'];
 
+    // If the user wants to log out, we free all session variables currently registered
     if(isset($_GET["logout"]))
-        unset($_SESSION["hash"]);
+        session_unset();
 
     // Test if password is set
     if(strlen($pwhash) > 0)