pi-hole/web
1
0
Fork 0
mirror of https://github.com/pi-hole/web.git synced 2024-12-06 19:36:21 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix query string authentication for API calls (#2329)

Browse Source
This commit is contained in:
Adam Warner
2022-09-04 13:27:26 +01:00
committed by GitHub
parent b0472ad749 a55ae95330
commit d68d5eee9a
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/pi-hole/php/password.php
+3 -3
View File
@@ -26,7 +26,7 @@ if (isset($setupVars['WEBPASSWORD'])) {
$pwhash = '';
}
function verifyPassword($pwhash)
function verifyPassword($pwhash, $use_api = false)
{
$validpassword = true;
@@ -86,7 +86,7 @@ function verifyPassword($pwhash)
if (hash_equals($pwhash, $_SESSION['hash'])) {
$_SESSION['auth'] = true;
}
} elseif (isset($api) && isset($_GET['auth'])) {
} elseif ($use_api && isset($_GET['auth'])) {
// API can use the hash to get data without logging in via plain-text password
if (hash_equals($pwhash, $_GET['auth'])) {
$_SESSION['auth'] = true;
@@ -103,5 +103,5 @@ function verifyPassword($pwhash)
return $validpassword;
}
$wrongpassword = !verifyPassword($pwhash);
$wrongpassword = !verifyPassword($pwhash, isset($api));
$auth = $_SESSION['auth'];