From ee0913a7a2fc5f53cc49830562045ea39b172380 Mon Sep 17 00:00:00 2001
From: Mcat12 <newtoncat12@yahoo.com>
Date: Sat, 3 Dec 2016 13:40:04 -0500
Subject: [PATCH] Move enable/disable to API

Also check CORS for all API calls. With the same import, we can
enable CSRF token checking on the API.
---
 api.php             | 31 +++++++++++++++++++++----------
 header.php          | 20 +++++---------------
 js/pihole/footer.js | 25 +++++++++++++++++++++++++
 3 files changed, 51 insertions(+), 25 deletions(-)

diff --git a/api.php b/api.php
index 9a48d158..cb6cbcb2 100644
--- a/api.php
+++ b/api.php
@@ -1,18 +1,21 @@
 <?php
     $api = true;
     require "php/password.php";
+    require "php/auth.php";
+
+    check_cors();
 
     include('data.php');
     header('Content-type: application/json');
 
     $data = array();
 
-    // Works without authorization
+    // Non-Auth
+
     if (isset($_GET['summaryRaw'])) {
         $data = array_merge($data,  getSummaryData());
     }
 
-    // Works without authorization
     if (isset($_GET['summary']) || !count($_GET)) {
         $sum = getSummaryData();
         $sum['ads_blocked_today'] = number_format( $sum['ads_blocked_today']);
@@ -22,48 +25,56 @@
         $data = array_merge($data,  $sum);
     }
 
-    // Works without authorization
     if (isset($_GET['overTimeData'])) {
         $data = array_merge($data,  getOverTimeData());
     }
 
-    // Works without authorization
     if (isset($_GET['overTimeData10mins'])) {
         $data = array_merge($data,  getOverTimeData10mins());
     }
 
-    // Requires authorization
+    // Auth Required
+
     if (isset($_GET['topItems']) && $auth) {
         $data = array_merge($data,  getTopItems());
     }
 
-    // Requires authorization
     if (isset($_GET['recentItems']) && $auth) {
         if (is_numeric($_GET['recentItems'])) {
             $data = array_merge($data,  getRecentItems($_GET['recentItems']));
         }
     }
 
-    // Requires authorization
     if (isset($_GET['getQueryTypes']) && $auth) {
         $data = array_merge($data, getIpvType());
     }
 
-    // Requires authorization
     if (isset($_GET['getForwardDestinations']) && $auth) {
         $data = array_merge($data, getForwardDestinations());
     }
 
-    // Requires authorization
     if (isset($_GET['getQuerySources']) && $auth) {
         $data = array_merge($data, getQuerySources());
     }
 
-    // Requires authorization
     if (isset($_GET['getAllQueries']) && $auth) {
         $data = array_merge($data, getAllQueries());
     }
 
+    if (isset($_GET['enable']) && $auth) {
+        exec('sudo pihole enable');
+        $data = array_merge($data, Array(
+            "status" => "enabled"
+        ));
+    }
+
+    if (isset($_GET['disable']) && $auth) {
+        exec('sudo pihole disable');
+        $data = array_merge($data, Array(
+            "status" => "disabled"
+        ));
+    }
+
     function filterArray(&$a) {
 	    $sanArray = array();
 	    foreach ($a as $k=>$v) {
diff --git a/header.php b/header.php
index 8c67db6c..a262a809 100644
--- a/header.php
+++ b/header.php
@@ -4,16 +4,6 @@
 
     check_cors();
 
-    if (isset($_GET['enable']) && $auth) {
-        exec('sudo pihole enable');
-        $refer = $_SERVER['HTTP_REFERER'];
-        header("location:$refer");
-    } elseif (isset($_GET['disable']) && $auth) {
-        exec('sudo pihole disable');
-        $refer = $_SERVER['HTTP_REFERER'];
-        header("location:$refer");
-    }
-
     // Web based change of temperature unit
     if (isset($_GET['tempunit']))
     {
@@ -193,11 +183,11 @@
                     <?php
                         $pistatus = exec('sudo pihole status web');
                         if ($pistatus == "1") {
-                            echo '<a href="#"><i class="fa fa-circle" style="color:#7FFF00"></i> Active</a>';
+                            echo '<a href="#" id="status"><i class="fa fa-circle" style="color:#7FFF00"></i> Active</a>';
                         } elseif ($pistatus == "0") {
-                            echo '<a href="#"><i class="fa fa-circle" style="color:#FF0000"></i> Offline</a>';
+                            echo '<a href="#" id="status"><i class="fa fa-circle" style="color:#FF0000"></i> Offline</a>';
                         } else {
-                            echo '<a href="#"><i class="fa fa-circle" style="color:#ff9900"></i> Starting</a>';
+                            echo '<a href="#" id="status"><i class="fa fa-circle" style="color:#ff9900"></i> Starting</a>';
                         }
 
                         // CPU Temp
@@ -285,9 +275,9 @@
                 <!-- Toggle -->
                 <?php
                 if ($pistatus == "1") {
-                  echo '                <li><a href="?disable"><i class="fa fa-stop"></i> <span>Disable</span></a></li>';
+                  echo '                <li><a href="#" id="flip-status"><i class="fa fa-stop"></i> <span>Disable</span></a></li>';
                 } else {
-                  echo '                <li><a href="?enable"><i class="fa fa-play"></i> <span>Enable</span></a></li>';
+                  echo '                <li><a href="#" id="flip-status"><i class="fa fa-play"></i> <span>Enable</span></a></li>';
                 }
                 ?>
                 <!-- Logout -->
diff --git a/js/pihole/footer.js b/js/pihole/footer.js
index 2f6a8758..9c4471e1 100644
--- a/js/pihole/footer.js
+++ b/js/pihole/footer.js
@@ -8,6 +8,31 @@ $("body").on("click", function(event) {
     }
 });
 
+// Enable/Disable
+$("#flip-status").on("click", () => {
+    const btnStatus = $("#flip-status");
+    const status = $("#status");
+
+    switch(btnStatus.text().trim()) {
+        case "Enable":
+            $.getJSON("api.php?enable", (data) => {
+                if(data.status == "enabled") {
+                    btnStatus.html('<i class="fa fa-stop"></i> <span>Disable</span>');
+                    status.html('<i class="fa fa-circle" style="color:#7FFF00"></i> Active');
+                }
+            });
+            break;
+        case "Disable":
+            $.getJSON("api.php?disable", (data) => {
+                if(data.status == "disabled") {
+                    btnStatus.html('<i class="fa fa-play"></i> <span>Enable</span>');
+                    status.html('<i class="fa fa-circle" style="color:#FF0000"></i> Offline');
+                }
+            });
+            break;
+    }
+});
+
 var piholeVersion = $("#piholeVersion").html();
 var webVersion = $("#webVersion").html();