pi-hole/web
1
0
Fork 0
mirror of https://github.com/pi-hole/web.git synced 2024-12-06 19:36:21 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Require CORS check on all admin pages

Browse Source 
This is mainly added so that an ad can't enable/disable the Pi-hole
by simply loading a url like `http://pi.hole/admin/index.php?disable`
This commit is contained in:
Mcat12
2016-11-07 21:10:36 -05:00
parent 91ffc9522c
commit d2fcc36341
4 changed files with 84 additions and 55 deletions
Download Patch File Download Diff File Expand all files Collapse all files
header.php
+10 -7
View File
@@ -1,12 +1,15 @@
<?php
require "php/auth.php";
check_cors();
if (isset($_GET['enable'])) {
exec('sudo pihole enable');
$refer = $_SERVER['HTTP_REFERER'];
header("location:$refer");
} elseif (isset($_GET['disable'])) {
exec('sudo pihole disable');
$refer = $_SERVER['HTTP_REFERER'];
header("location:$refer");
exec('sudo pihole enable');
$refer = $_SERVER['HTTP_REFERER'];
header("location:$refer");
}
elseif (isset($_GET['disable'])) {
exec('sudo pihole disable');
$refer = $_SERVER['HTTP_REFERER'];
header("location:$refer");
}
$cmd = "echo $((`cat /sys/class/thermal/thermal_zone0/temp | cut -c1-2`))";
$output = shell_exec($cmd);