From cea17a476658f0a3c7ccbe8e61ca9c55272bd5f2 Mon Sep 17 00:00:00 2001 From: Mcat12 Date: Sat, 7 Oct 2017 16:51:22 -0400 Subject: [PATCH 1/2] Allow whitelisting/blacklist even if there is no password set --- scripts/pi-hole/php/auth.php | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/scripts/pi-hole/php/auth.php b/scripts/pi-hole/php/auth.php index b3fe6a64..0964a275 100644 --- a/scripts/pi-hole/php/auth.php +++ b/scripts/pi-hole/php/auth.php @@ -144,11 +144,7 @@ function list_verify($type) { elseif(isset($_POST['pw'])) { require("password.php"); - if(strlen($pwhash) == 0) - { - log_and_die("No password set - ".htmlspecialchars($type)."listing without password not supported"); - } - elseif($wrongpassword) + if($wrongpassword || !$auth) { log_and_die("Wrong password - ".htmlspecialchars($type)."listing of ${_POST['domain']} not permitted"); } From c60b703680f0fe7f8bff7e35e47a08d228a89c81 Mon Sep 17 00:00:00 2001 From: Mcat12 Date: Sat, 7 Oct 2017 17:09:49 -0400 Subject: [PATCH 2/2] Appease codacy --- scripts/pi-hole/php/auth.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/pi-hole/php/auth.php b/scripts/pi-hole/php/auth.php index 0964a275..85d38f8f 100644 --- a/scripts/pi-hole/php/auth.php +++ b/scripts/pi-hole/php/auth.php @@ -131,7 +131,7 @@ function check_domain() { } function list_verify($type) { - global $pwhash, $wrongpassword; + global $pwhash, $wrongpassword, $auth; if(!isset($_POST['domain']) || !isset($_POST['list']) || !(isset($_POST['pw']) || isset($_POST['token']))) { log_and_die("Missing POST variables"); }