From fff54aef3f6f913b8ff270d1ffc59abbb023852d Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Fri, 3 Feb 2023 19:09:52 +0100
Subject: [PATCH] Remove further obsolete PHP code

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 login.php                                    |  1 -
 scripts/pi-hole/js/login.js                  | 86 ++++++++++++++++++++
 scripts/pi-hole/php/footer.php               | 12 +--
 scripts/pi-hole/php/header.php               |  3 +-
 scripts/pi-hole/php/header_authenticated.php |  5 +-
 scripts/pi-hole/php/theme.php                | 55 -------------
 settings.php                                 |  2 +-
 7 files changed, 91 insertions(+), 73 deletions(-)
 create mode 100644 scripts/pi-hole/js/login.js
 delete mode 100644 scripts/pi-hole/php/theme.php

diff --git a/login.php b/login.php
index e837e336..8ca6e955 100644
--- a/login.php
+++ b/login.php
@@ -9,7 +9,6 @@
 */
 
 $wrongpassword = false;
-require 'scripts/pi-hole/php/theme.php';
 require 'scripts/pi-hole/php/header.php';
 
 ?>
diff --git a/scripts/pi-hole/js/login.js b/scripts/pi-hole/js/login.js
new file mode 100644
index 00000000..fe9890a5
--- /dev/null
+++ b/scripts/pi-hole/js/login.js
@@ -0,0 +1,86 @@
+/* Pi-hole: A black hole for Internet advertisements
+ *  (c) 2023 Pi-hole, LLC (https://pi-hole.net)
+ *  Network-wide ad blocking via your own hardware.
+ *
+ *  This file is copyright under the latest version of the EUPL.
+ *  Please see LICENSE file for your rights under this license. */
+
+/* global sha256:false */
+
+function getParams() {
+  var GETDict = {};
+  window.location.search
+    .substr(1)
+    .split("&")
+    .forEach(function (item) {
+      GETDict[item.split("=")[0]] = item.split("=")[1];
+    });
+  return GETDict;
+}
+
+function computeResponse(password, challenge) {
+  // Compute password hash twice to mitigate rainbow
+  // table vulnerability
+  return sha256(challenge + ":" + sha256(sha256(password)));
+}
+
+function redirect() {
+  // Login succeeded or not needed (empty password)
+  // Default: Send back to index.php (dashboard)
+  var target = "index.php";
+
+  // If specified: Send to requested page
+  var GETDict = getParams();
+  if ("target" in GETDict) {
+    target = GETDict.target;
+  }
+
+  // Redirect to target
+  window.location.replace(target);
+}
+
+function doLogin(response) {
+  $.ajax({
+    url: "/api/auth",
+    method: "POST",
+    data: JSON.stringify({ response: response }),
+  })
+    .done(function () {
+      redirect();
+    })
+    .fail(function (data) {
+      if (data.status === 401) {
+        // Login failed
+        $("#pw-field").addClass("has-error");
+        $("#error-label").show();
+      }
+    });
+}
+
+$("#loginform").submit(function (e) {
+  // Cancel the native submit event (prevent the form from being
+  // submitted) because we want to do a two-step challenge-response login
+  e.preventDefault();
+
+  // Get challenge
+  $.ajax({
+    url: "/api/auth",
+    method: "GET",
+  }).done(function (data) {
+    if ("challenge" in data) {
+      var response = computeResponse($("#loginpw").val(), data.challenge);
+      doLogin(response);
+    } else if (data.session.valid === true)
+      // Password may have been remove meanwhile
+      redirect();
+  });
+});
+
+$(function () {
+  // Check if we need to login at all
+  $.ajax({
+    url: "/api/auth",
+  }).done(function (data) {
+    if (data.session.valid === true) redirect();
+  });
+});
diff --git a/scripts/pi-hole/php/footer.php b/scripts/pi-hole/php/footer.php
index c4a0bf0f..8a333efd 100644
--- a/scripts/pi-hole/php/footer.php
+++ b/scripts/pi-hole/php/footer.php
@@ -40,16 +40,6 @@
         </div>
     </div> <!-- /.content-wrapper -->
 
-<?php
-// Flushes the system write buffers of PHP. This attempts to push everything we have so far all the way to the client's browser.
-flush();
-
-if (isset($core_commit) || isset($web_commit) || isset($FTL_commit)) {
-    $list_class = 'list-unstyled';
-} else {
-    $list_class = 'list-inline';
-}
-?>
     <footer class="main-footer">
         <div class="row row-centered text-center">
             <div class="col-xs-12 col-sm-6">
@@ -59,7 +49,7 @@ if (isset($core_commit) || isset($web_commit) || isset($FTL_commit)) {
 
         <div class="row row-centered text-center version-info">
             <div class="col-xs-12 col-sm-12 col-md-10">
-                <ul class="<?php echo $list_class; ?>" id="versions"></ul>
+                <ul class="list-inline" id="versions"></ul>
                 <p style="margin: 15px 0 0;" id="update-hint"></p>
             </div>
         </div>
diff --git a/scripts/pi-hole/php/header.php b/scripts/pi-hole/php/header.php
index bfbd9c01..809fc1ff 100644
--- a/scripts/pi-hole/php/header.php
+++ b/scripts/pi-hole/php/header.php
@@ -32,7 +32,8 @@ $hostname = gethostname() ? gethostname() : '';
     <meta name="msapplication-TileImage" content="img/favicons/mstile-150x150.png">
 
     <!-- Theme styles -->
-<?php if ($theme == 'default-light') { ?>
+<?php $theme = webtheme(); $darkmode = true; ?>
+<?php if ($theme == 'default-light') { $darkmode = false; ?>
     <meta name="theme-color" content="#367fa9">
 <?php } elseif ($theme == 'default-dark') { ?>
     <meta name="theme-color" content="#272c30">
diff --git a/scripts/pi-hole/php/header_authenticated.php b/scripts/pi-hole/php/header_authenticated.php
index c7b1cdfc..98805870 100644
--- a/scripts/pi-hole/php/header_authenticated.php
+++ b/scripts/pi-hole/php/header_authenticated.php
@@ -8,7 +8,6 @@
 *  Please see LICENSE file for your rights under this license.
 */
 
-require 'scripts/pi-hole/php/theme.php';
 require 'header.php';
 ?>
     <link rel="stylesheet" href="<?php echo fileversion('style/vendor/datatables.min.css'); ?>">
@@ -35,9 +34,7 @@ require 'header.php';
 </noscript>
 
 <!-- Send token to JS -->
-<div id="enableTimer" hidden><?php if (file_exists('../custom_disable_timer')) {
-    echo file_get_contents('../custom_disable_timer');
-} ?></div>
+<div id="enableTimer" hidden></div>
 <div class="wrapper">
     <header class="main-header">
         <!-- Logo -->
diff --git a/scripts/pi-hole/php/theme.php b/scripts/pi-hole/php/theme.php
deleted file mode 100644
index 5c44a6cf..00000000
--- a/scripts/pi-hole/php/theme.php
+++ /dev/null
@@ -1,55 +0,0 @@
-<?php
-/* Pi-hole: A black hole for Internet advertisements
-*  (c) 2020 Pi-hole, LLC (https://pi-hole.net)
-*  Network-wide ad blocking via your own hardware.
-*
-*  This file is copyright under the latest version of the EUPL.
-*  Please see LICENSE file for your rights under this license.
-*/
-
-// Array of available themes and their description
-$available_themes = array();
-/* Array key = name used internally, not shown to the user
-*  Array[0] = Description
-*  Array[1] = Is this a dark mode theme? (Sets background to black during page reloading to avoid white "flashing")
-*  Array[2] = Style sheet name
-*/
-$available_themes['default-light'] = array('Pi-hole default theme (light, default)', false, 'default-light');
-$available_themes['default-dark'] = array('Pi-hole midnight theme (dark)', true, 'default-dark');
-$available_themes['default-darker'] = array('Pi-hole deep-midnight theme (dark)', true, 'default-darker');
-// Option to have the theme go with the device dark mode setting, always set the background to black to avoid flashing
-$available_themes['default-auto'] = array('Pi-hole auto theme (light/dark)', true, 'default-auto');
-$available_themes['lcars'] = array('Star Trek LCARS theme (dark)', true, 'lcars');
-
-$webtheme = '';
-// Try to load theme settings from setupVars.conf
-if (isset($setupVars['WEBTHEME'])) {
-    $webtheme = $setupVars['WEBTHEME'];
-}
-
-// May be overwritten by settings tab
-if (isset($_POST['field'])
-    && $_POST['field'] === 'webUI'
-    && isset($_POST['webtheme'])) {
-    $webtheme = $_POST['webtheme'];
-}
-
-if (!array_key_exists($webtheme, $available_themes)) {
-    // Fallback to default (light) theme is property is not set
-    // or requested theme is not among the available
-    $webtheme = 'default-auto';
-}
-
-$darkmode = $available_themes[$webtheme][1];
-$theme = $available_themes[$webtheme][2];
-
-function theme_selection()
-{
-    global $available_themes, $webtheme;
-    foreach ($available_themes as $key => $value) {
-        ?><div><input type="radio" name="webtheme" value="<?php echo $key; ?>" id="webtheme_<?php echo $key; ?>" <?php if ($key === $webtheme) { ?>checked<?php } ?>>
-        <label for="webtheme_<?php echo $key; ?>"><strong><?php echo $value[0]; ?></strong></label></div>
-<?php
-    }
-}
-?>
diff --git a/settings.php b/settings.php
index 1560fc90..173ff261 100644
--- a/settings.php
+++ b/settings.php
@@ -39,7 +39,7 @@ if (isset($_GET['tab']) && in_array($_GET['tab'], array('sysadmin', 'dns', 'piho
                     <a href="#teleporter" aria-controls="teleporter" aria-expanded="<?php echo $tab === 'teleporter' ? 'true' : 'false'; ?>" role="tab" data-toggle="tab">Teleporter</a>
                 </li>
             </ul>
-            <div class="tab-content">
+            <div class="tab-content" id="settings-tabs">
                 <!-- ######################################################### System admin ######################################################### -->
                 <div id="sysadmin" class="tab-pane fade<?php if ($tab === 'sysadmin') { ?> in active<?php } ?>">
                     <div class="row">