Merge branch 'devel' into TopItems

.user.php.ini

@@ -0,0 +1,2 @@
+memory_limit = 256M
+max_execution_time = 300

api.php

@@ -1,11 +1,11 @@
 <?php
     $api = true;
-    require "php/password.php";
-    require "php/auth.php";
+    require "scripts/pi-hole/php/password.php";
+    require "scripts/pi-hole/php/auth.php";
 
     check_cors();
 
-    include('data.php');
+    include('scripts/pi-hole/php/data.php');
     header('Content-type: application/json');
 
     $data = array();

gravity.php

@@ -1,5 +1,5 @@
 <?php
-    require "header.php";
+    require "scripts/pi-hole/php/header.php";
 ?>
 <!-- Title -->
 <div class="page-header">
@@ -20,8 +20,8 @@
 <pre id="output" style="width: 100%; height: 100%;" hidden="true"></pre>
 
 <?php
-    require "footer.php";
+    require "scripts/pi-hole/php/footer.php";
 ?>
 
 
-<script src="js/pihole/gravity.js"></script>
+<script src="scripts/pi-hole/js/gravity.js"></script>

help.php

@@ -1,5 +1,5 @@
 <?php
-    require "header.php";
+    require "scripts/pi-hole/php/header.php";
 
     if(strlen($pwhash) > 0)
     {
@@ -146,7 +146,5 @@
 </div>
 
 <?php
-    require "footer.php";
+    require "scripts/pi-hole/php/footer.php";
 ?>
-
-<script src="js/pihole/help.js"></script>

index.php

@@ -1,6 +1,6 @@
 <?php
     $indexpage = true;
-    require "header.php";
+    require "scripts/pi-hole/php/header.php";
 ?>
 <!-- Small boxes (Stat box) -->
 <div class="row">
@@ -213,7 +213,7 @@ else
 <!-- /.row -->
 <?php } ?>
 <?php
-    require "footer.php";
+    require "scripts/pi-hole/php/footer.php";
 ?>
 
-<script src="js/pihole/index.js"></script>
+<script src="scripts/pi-hole/js/index.js"></script>

js/pihole/help.js

@@ -1,7 +0,0 @@
-$( "#flush" ).click(function() {
-    if (confirm("Are you sure you want to flush the Pi-hole log file?")) {
-        document.location.href="help.php?flush";
-    } else {
-        // Do nothing!
-    }
-});

list.php

@@ -1,5 +1,5 @@
 <?php
-require "header.php";
+require "scripts/pi-hole/php/header.php";
 
 $list = $_GET['l'];
 
@@ -52,7 +52,7 @@ function getFullName() {
 <ul class="list-group" id="list"></ul>
 
 <?php
-require "footer.php";
+require "scripts/pi-hole/php/footer.php";
 ?>
 
-<script src="js/pihole/list.js"></script>
+<script src="scripts/pi-hole/js/list.js"></script>

queries.php

@@ -1,5 +1,5 @@
 <?php
-    require "header.php";
+    require "scripts/pi-hole/php/header.php";
 
 // Generate CSRF token
 if(empty($_SESSION['token'])) {
@@ -29,6 +29,14 @@ if(isset($setupVars["API_QUERY_LOG_SHOW"]))
 	}
 }
 
+if(isset($setupVars["API_PRIVACY_MODE"]))
+{
+	if($setupVars["API_PRIVACY_MODE"])
+	{
+		// Overwrite string from above
+		$showing = "(privacy mode enabled)";
+	}
+}
 ?>
 <!-- Send PHP info to JS -->
 <div id="token" hidden><?php echo $token ?></div>
@@ -97,7 +105,7 @@ if(isset($setupVars["API_QUERY_LOG_SHOW"]))
 <!-- /.row -->
 
 <?php
-    require "footer.php";
+    require "scripts/pi-hole/php/footer.php";
 ?>
 
-<script src="js/pihole/queries.js"></script>
+<script src="scripts/pi-hole/js/queries.js"></script>

queryads.php

@@ -1,5 +1,5 @@
 <?php
-    require "header.php";
+    require "scripts/pi-hole/php/header.php";
 ?>
 <!-- Title -->
 <div class="page-header">
@@ -18,8 +18,8 @@
 <pre id="output" style="width: 100%; height: 100%;" hidden="true"></pre>
 
 <?php
-    require "footer.php";
+    require "scripts/pi-hole/php/footer.php";
 ?>
 
 
-<script src="js/pihole/queryads.js"></script>
+<script src="scripts/pi-hole/js/queryads.js"></script>

scripts/pi-hole/js/gravity.js

@@ -2,7 +2,7 @@ function eventsource() {
     var alInfo = $("#alInfo");
     var alSuccess = $("#alSuccess");
     var ta = $("#output");
-    var source = new EventSource("php/gravity.sh.php");
+    var source = new EventSource("scripts/pi-hole/php/gravity.sh.php");
 
     ta.html("");
     ta.show();

scripts/pi-hole/js/index.js

@@ -132,14 +132,22 @@ function escapeHtml(text) {
 function updateTopClientsChart() {
     $.getJSON("api.php?summaryRaw&getQuerySources", function(data) {
         var clienttable =  $("#client-frequency").find("tbody:last");
-        var domain, percentage;
+        var domain, percentage, domainname;
         for (domain in data.top_sources) {
 
             if ({}.hasOwnProperty.call(data.top_sources, domain)){
                 // Sanitize domain
                 domain = escapeHtml(domain);
+                if(domain.indexOf("|") > -1)
+                {
+                    domainname = domain.substr(0, domain.indexOf("|"));
+                }
+                else
+                {
+                    domainname = domain;
+                }
 
-                var url = "<a href=\"queries.php?client="+domain+"\">"+domain+"</a>";
+                var url = "<a href=\"queries.php?client="+domain+"\">"+domainname+"</a>";
                 percentage = data.top_sources[domain] / data.dns_queries_today * 100;
                 clienttable.append("<tr> <td>" + url +
                     "</td> <td>" + data.top_sources[domain] + "</td> <td> <div class=\"progress progress-sm\" title=\""+percentage.toFixed(1)+"%\"> <div class=\"progress-bar progress-bar-blue\" style=\"width: " +
@@ -162,6 +170,10 @@ function updateForwardDestinations() {
         $.each(data, function(key , value) {
             v.push(value);
             c.push(colors.shift());
+            if(key.indexOf("|") > -1)
+            {
+                key = key.substr(0, key.indexOf("|"));
+            }
             forwardDestinationChart.data.labels.push(key);
         });
         // Build a single dataset with the data to be pushed
@@ -180,7 +192,6 @@ function updateTopLists() {
         var domaintable = $("#domain-frequency").find("tbody:last");
         var adtable = $("#ad-frequency").find("tbody:last");
         var url, domain, percentage;
-
         for (domain in data.top_queries) {
             if ({}.hasOwnProperty.call(data.top_queries,domain)){
                 // Sanitize domain
@@ -198,8 +209,14 @@ function updateTopLists() {
                     "</td> <td>" + data.top_queries[domain] + "</td> <td> <div class=\"progress progress-sm\" title=\""+percentage.toFixed(1)+"%\"> <div class=\"progress-bar progress-bar-green\" style=\"width: " +
                     percentage + "%\"></div> </div> </td> </tr> ");
             }
-
         }
+
+        // Remove table if there are no results (e.g. privacy mode enabled)
+        if(jQuery.isEmptyObject(data.top_queries))
+        {
+            $("#domain-frequency").parent().remove();
+        }
+
         for (domain in data.top_ads) {
             if ({}.hasOwnProperty.call(data.top_ads,domain)){
                 // Sanitize domain

scripts/pi-hole/js/list.js

@@ -10,7 +10,7 @@ function sub(index, entry) {
     var domain = $("#"+index);
     domain.hide("highlight");
     $.ajax({
-        url: "php/sub.php",
+        url: "scripts/pi-hole/php/sub.php",
         method: "post",
         data: {"domain":entry, "list":listType, "token":token},
         success: function(response) {
@@ -31,7 +31,7 @@ function refresh(fade) {
         list.fadeOut(100);
     }
     $.ajax({
-        url: "php/get.php",
+        url: "scripts/pi-hole/php/get.php",
         method: "get",
         data: {"list":listType},
         success: function(response) {
@@ -78,7 +78,7 @@ function add() {
     alSuccess.hide();
     alFailure.hide();
     $.ajax({
-        url: "php/add.php",
+        url: "scripts/pi-hole/php/add.php",
         method: "post",
         data: {"domain":domain.val(), "list":listType, "token":token},
         success: function(response) {

scripts/pi-hole/js/queries.js

@@ -36,7 +36,7 @@ function add(domain,list) {
     alSuccess.hide();
     alFailure.hide();
     $.ajax({
-        url: "php/add.php",
+        url: "scripts/pi-hole/php/add.php",
         method: "post",
         data: {"domain":domain, "list":list, "token":token},
         success: function(response) {

scripts/pi-hole/js/queryads.js

@@ -16,7 +16,7 @@ function eventsource() {
     }
 
     var host = window.location.host;
-    var source = new EventSource("http://"+host+"/admin/php/queryads.php?domain="+domain.val().toLowerCase()+"&"+exact);
+    var source = new EventSource("http://"+host+"/admin/scripts/pi-hole/php/queryads.php?domain="+domain.val().toLowerCase()+"&"+exact);
 
     // Reset and show field
     ta.empty();

scripts/pi-hole/php/add.php

@@ -1,15 +1,12 @@
 <?php
 require('auth.php');
 
-if(!isset($_POST['domain'], $_POST['list'], $_POST['token'])) {
-    log_and_die("Missing POST variables");
-}
+$type = $_POST['list'];
 
-check_cors();
-check_csrf($_POST['token']);
-check_domain();
+// All of the verification for list editing
+list_verify($type);
 
-switch($_POST['list']) {
+switch($type) {
     case "white":
         echo exec("sudo pihole -w -q ${_POST['domain']}");
         break;

scripts/pi-hole/php/auth.php

@@ -20,34 +20,42 @@ function check_cors() {
 
     // Check CORS
     $AUTHORIZED_HOSTNAMES = array(
-        'http://' . $ipv4,
-        'http://' . $_SERVER['SERVER_NAME'],
-        'http://pi.hole',
-        'http://localhost'
+        $ipv4,
+        $_SERVER["SERVER_NAME"],
+        "pi.hole",
+        "localhost"
     );
 
     # Allow user set virtual hostnames
     $virtual_host = getenv('VIRTUAL_HOST');
     if (! empty($virtual_host))
-        array_push($AUTHORIZED_HOSTNAMES, 'http://' . $virtual_host);
+        array_push($AUTHORIZED_HOSTNAMES, $virtual_host);
 
     // Since the Host header is easily manipulated, we can only check if it's wrong and can't use it
     // to validate that the client is authorized, only unauthorized.
     $server_host = $_SERVER['HTTP_HOST'];
 
     // If HTTP_HOST contains a non-standard port (!= 80) we have to strip the port
-    if(strpos($server_host,":"))
+    if(strpos($server_host, ":"))
     {
         $server_host = parse_url($_SERVER['HTTP_HOST'], PHP_URL_HOST);
     }
 
-    if(isset($_SERVER['HTTP_HOST']) && !in_array("http://".$server_host, $AUTHORIZED_HOSTNAMES)) {
+    if(isset($_SERVER['HTTP_HOST']) && !in_array($server_host, $AUTHORIZED_HOSTNAMES)) {
         log_and_die("Failed Host Check: " . $server_host .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));
     }
 
     if(isset($_SERVER['HTTP_ORIGIN'])) {
-        if(!in_array($_SERVER['HTTP_ORIGIN'], $AUTHORIZED_HOSTNAMES)) {
-            log_and_die("Failed CORS: " . $_SERVER['HTTP_ORIGIN'] .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));
+        $server_origin = $_SERVER['HTTP_ORIGIN'];
+
+        // If HTTP_ORIGIN contains a non-standard port (!= 80) we have to strip the port
+        if(strpos($server_origin, ":"))
+        {
+            $server_origin = parse_url($_SERVER['HTTP_ORIGIN'], PHP_URL_HOST);
+        }
+
+        if(!in_array($server_origin, $AUTHORIZED_HOSTNAMES)) {
+            log_and_die("Failed CORS: " . $server_origin .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));
         }
         header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
     }
@@ -97,4 +105,33 @@ function check_domain() {
         }
     }
 }
+
+function list_verify($type) {
+    if(!isset($_POST['domain']) || !isset($_POST['list']) || !(isset($_POST['pw']) || isset($_POST['token']))) {
+        log_and_die("Missing POST variables");
+    }
+
+    if(isset($_POST['token']))
+    {
+        check_cors();
+        check_csrf($_POST['token']);
+    }
+    elseif(isset($_POST['pw']))
+    {
+        require("password.php");
+        if(strlen($pwhash) == 0)
+        {
+            log_and_die("No password set - ${type}listing with password not supported");
+        }
+        elseif($wrongpassword)
+        {
+            log_and_die("Wrong password - ${type}listing of ${_POST['domain']} not permitted");
+        }
+    }
+    else
+    {
+        log_and_die("Not allowed!");
+    }
+    check_domain();
+}
 ?>

scripts/pi-hole/php/data.php

@@ -20,6 +20,15 @@
     $blackListFile = checkfile("/etc/pihole/blacklist.txt");
     $blacklist = new \SplFileObject($blackListFile);
 
+    if(isset($setupVars["API_PRIVACY_MODE"]))
+    {
+        $privacyMode = $setupVars["API_PRIVACY_MODE"];
+    }
+    else
+    {
+        $privacyMode = false;
+    }
+
     /*******   Public Members ********/
     function getSummaryData() {
         $domains_being_blocked = gravityCount();
@@ -51,6 +60,16 @@
         list($domains_over_time, $ads_over_time) = overTime($dns_queries, $gravity_domains);
 
         // Align arrays
+        $domains_over_time = overTime($dns_queries);
+        $ads_over_time = overTime($ads_blocked);
+
+        // Provide a minimal valid array if there have are no blocked
+        // queries at all. Otherwise the output of the API is inconsistent.
+        if(count($ads_blocked) == 0)
+        {
+            $ads_over_time = [1 => 0];
+        }
+
         alignTimeArrays($ads_over_time, $domains_over_time);
         return Array(
             'domains_over_time' => $domains_over_time,
@@ -71,6 +90,17 @@
         list($domains_over_time, $ads_over_time) = overTime10mins($dns_queries, $gravity_domains);
 
         // Align arrays (in case there have been hours without ad queries)
+
+        $domains_over_time = overTime10mins($dns_queries);
+        $ads_over_time = overTime10mins($ads_blocked);
+
+        // Provide a minimal valid array if there have are no blocked
+        // queries at all. Otherwise the output of the API is inconsistent.
+        if(count($ads_blocked) == 0)
+        {
+            $ads_over_time = [1 => 0];
+        }
+
         alignTimeArrays($ads_over_time, $domains_over_time);
         return Array(
             'domains_over_time' => $domains_over_time,
@@ -79,7 +109,7 @@
     }
 
     function getTopItems($argument) {
-        global $log,$setupVars;
+        global $log,$setupVars,$privacyMode;
 
         // Process log file
         $dns_domains = getDnsQueryDomains($log);
@@ -117,7 +147,7 @@
                 $topAds[$key] = $value;
                 $adcounter++;
             }
-            else if($domaincounter < $qty)
+            else if($domaincounter < $qty && !$privacyMode)
             {
                 // New entry for Top Domains
                 $topDomains[$key] = $value;
@@ -173,7 +203,7 @@
             if($hostname)
             {
                 // Generate HOST entry
-                $hostarray[$hostname] = $value;
+                $hostarray["$hostname|$key"] = $value;
             }
             else
             {
@@ -302,21 +332,33 @@
     }
 
     function getAllQueries($orderBy) {
-        global $log,$showBlocked,$showPermitted;
+        global $log,$showBlocked,$showPermitted,$privacyMode;
         $allQueries = array("data" => array());
         $dns_queries = getDnsQueries($log);
 
         // Create empty array for gravity
         $gravity_domains = getGravity();
 
+        setShowBlockedPermitted();
+
+        // Privacy mode?
+        if($privacyMode)
+        {
+            $showPermitted = false;
+        }
+
+        if(!$showBlocked && !$showPermitted)
+        {
+            // Nothing to do for us here
+            return [];
+        }
+
         foreach ($dns_queries as $query) {
             $time = date_create(substr($query, 0, 16));
             $exploded = explode(" ", trim($query));
             $domain = $exploded[count($exploded)-3];
             $tmp = $exploded[count($exploded)-4];
 
-            setShowBlockedPermitted();
-
             $status = isset($gravity_domains[$domain]) ? "Pi-holed" : "OK";
             if(($status === "Pi-holed" && $showBlocked) || ($status === "OK" && $showPermitted))
             {

scripts/pi-hole/php/footer.php

@@ -33,16 +33,16 @@
     </footer>
 </div>
 <!-- ./wrapper -->
-<script src="js/other/jquery.min.js"></script>
-<script src="js/other/jquery-ui.min.js"></script>
-<script src="bootstrap/js/bootstrap.min.js"></script>
-<script src="js/other/app.min.js"></script>
+<script src="scripts/vendor/jquery.min.js"></script>
+<script src="scripts/vendor/jquery-ui.min.js"></script>
+<script src="style/vendor/bootstrap/js/bootstrap.min.js"></script>
+<script src="scripts/vendor/app.min.js"></script>
 
-<script src="js/other/jquery.dataTables.min.js"></script>
-<script src="js/other/dataTables.bootstrap.min.js"></script>
-<script src="js/other/Chart.bundle.min.js"></script>
+<script src="scripts/vendor/jquery.dataTables.min.js"></script>
+<script src="scripts/vendor/dataTables.bootstrap.min.js"></script>
+<script src="scripts/vendor/Chart.bundle.min.js"></script>
 
-<script src="js/pihole/footer.js"></script>
+<script src="scripts/pi-hole/js/footer.js"></script>
 
 </body>
 </html>

scripts/pi-hole/php/header.php

@@ -1,6 +1,6 @@
 <?php
-    require "php/auth.php";
-    require "php/password.php";
+    require "scripts/pi-hole/php/auth.php";
+    require "scripts/pi-hole/php/password.php";
 
     check_cors();
 
@@ -142,13 +142,13 @@
     <meta name="msapplication-TileImage" content="img/logo.svg">
     <meta name="apple-mobile-web-app-capable" content="yes">
 
-    <link href="bootstrap/css/bootstrap.min.css" rel="stylesheet" type="text/css" />
-    <link href="css/font-awesome-4.5.0/css/font-awesome.min.css" rel="stylesheet" type="text/css" />
-    <link href="css/ionicons-2.0.1/css/ionicons.min.css" rel="stylesheet" type="text/css" />
-    <link href="css/dataTables.bootstrap.min.css" rel="stylesheet" type="text/css" />
+    <link href="style/vendor/bootstrap/css/bootstrap.min.css" rel="stylesheet" type="text/css" />
+    <link href="style/vendor/font-awesome-4.5.0/css/font-awesome.min.css" rel="stylesheet" type="text/css" />
+    <link href="style/vendor/ionicons-2.0.1/css/ionicons.min.css" rel="stylesheet" type="text/css" />
+    <link href="style/vendor/dataTables.bootstrap.min.css" rel="stylesheet" type="text/css" />
 
-    <link href="css/AdminLTE.min.css" rel="stylesheet" type="text/css" />
-    <link href="css/skin-blue.min.css" rel="stylesheet" type="text/css" />
+    <link href="style/vendor/AdminLTE.min.css" rel="stylesheet" type="text/css" />
+    <link href="style/vendor/skin-blue.min.css" rel="stylesheet" type="text/css" />
     <link rel="icon" type="image/png" sizes="160x160" href="img/logo.svg" />
     <style type="text/css">
         .glow { text-shadow: 0px 0px 5px #fff; }
@@ -156,20 +156,20 @@
     </style>
 
     <!--[if lt IE 9]>
-    <script src="js/other/html5shiv.min.js"></script>
-    <script src="js/other/respond.min.js"></script>
+    <script src="scripts/vendor/html5shiv.min.js"></script>
+    <script src="scripts/vendor/respond.min.js"></script>
     <![endif]-->
 </head>
 <body class="skin-blue sidebar-mini <?php if($boxedlayout){ ?>layout-boxed<?php } ?>">
 <!-- JS Warning -->
 <div>
-    <link rel="stylesheet" type="text/css" href="css/js-warn.css">
+    <link rel="stylesheet" type="text/css" href="style/vendor/js-warn.css">
     <input type="checkbox" id="js-hide" />
     <div class="js-warn" id="js-warn-exit"><h1>Javascript Is Disabled</h1><p>Javascript seems to be disabled. This will break some site features.</p>
         <p>To enable Javascript click <a href="http://www.enable-javascript.com/" target="_blank">here</a></p><label for="js-hide">Close</label></div>
 </div>
 <!-- /JS Warning -->
-<script src="js/pihole/header.js"></script>
+<script src="scripts/pi-hole/js/header.js"></script>
 <!-- Send token to JS -->
 <div id="token" hidden><?php echo $token ?></div>
 <div class="wrapper">
@@ -249,7 +249,7 @@
             <!-- Sidebar user panel -->
             <div class="user-panel">
                 <div class="pull-left image">
-                    <img src="img/logo.svg" style="width: 45px; height: 67px;" alt="Pi-hole logo" />
+                    <img src="img/logo.svg" class="img-responsive" alt="Pi-hole logo" />
                 </div>
                 <div class="pull-left info">
                     <p>Status</p>
@@ -489,7 +489,7 @@
     // If auth is required and not set, i.e. no successfully logged in,
     // we show the reduced version of the summary (index) page
     if(!$auth && (!isset($indexpage) || isset($_GET['login']))){
-        require "php/loginpage.php";
+        require "scripts/pi-hole/php/loginpage.php";
         require "footer.php";
         exit();
     }

scripts/pi-hole/php/savesettings.php

@@ -11,7 +11,7 @@ function validIP($address){
 
 // Check for existance of variable
 // and test it only if it exists
-function istrue($argument) {
+function istrue(&$argument) {
 	$ret = false;
 	if(isset($argument))
 	{
@@ -26,7 +26,7 @@ function istrue($argument) {
 // Credit: http://stackoverflow.com/a/4694816/2087442
 function validDomain($domain_name)
 {
-	$validChars = preg_match("/^([_a-z\d](-*[_a-z\d])*)(\.([_a-z\d](-*[a-z\d])*))*(\.([a-z\d])*)+$/i", $domain_name);
+	$validChars = preg_match("/^([_a-z\d](-*[_a-z\d])*)(\.([_a-z\d](-*[a-z\d])*))*(\.([a-z\d])*)*$/i", $domain_name);
 	$lengthCheck = preg_match("/^.{1,253}$/", $domain_name);
 	$labelLengthCheck = preg_match("/^[^\.]{1,63}(\.[^\.]{1,63})*$/", $domain_name);
 	return ( $validChars && $lengthCheck && $labelLengthCheck ); //length of each label
@@ -212,12 +212,26 @@ function validDomain($domain_name)
 				if(isset($_POST["querylog-permitted"]) && isset($_POST["querylog-blocked"]))
 				{
 					exec("sudo pihole -a setquerylog all");
-					$success .= "All entries will be shown in Query Log";
+					if(!isset($_POST["privacyMode"]))
+					{
+						$success .= "All entries will be shown in Query Log";
+					}
+					else
+					{
+						$success .= "Only blocked entries will be shown in Query Log";
+					}
 				}
 				elseif(isset($_POST["querylog-permitted"]))
 				{
 					exec("sudo pihole -a setquerylog permittedonly");
-					$success .= "Only permitted will be shown in Query Log";
+					if(!isset($_POST["privacyMode"]))
+					{
+						$success .= "Only permitted will be shown in Query Log";
+					}
+					else
+					{
+						$success .= "No entries will be shown in Query Log";
+					}
 				}
 				elseif(isset($_POST["querylog-blocked"]))
 				{
@@ -230,6 +244,17 @@ function validDomain($domain_name)
 					$success .= "No entries will be shown in Query Log";
 				}
 
+
+				if(isset($_POST["privacyMode"]))
+				{
+					exec("sudo pihole -a privacymode true");
+					$success .= " (privacy mode enabled)";
+				}
+				else
+				{
+					exec("sudo pihole -a privacymode false");
+				}
+
 				if(isset($_POST["resolve-forward"]))
 				{
 					exec("sudo pihole -a resolve forward true");

scripts/pi-hole/php/sub.php

@@ -1,15 +1,12 @@
 <?php
 require('auth.php');
 
-if(!isset($_POST['domain'], $_POST['list'], $_POST['token'])) {
-    log_and_die("Missing POST variables");
-}
+$type = $_POST['list'];
 
-check_cors();
-check_csrf($_POST['token']);
-check_domain();
+// All of the verification for list editing
+list_verify($type);
 
-switch($_POST['list']) {
+switch($type) {
     case "white":
         exec("sudo pihole -w -q -d ${_POST['domain']}");
         break;

settings.php

@@ -1,6 +1,6 @@
 <?php
-	require "header.php";
-	require "php/savesettings.php";
+	require "scripts/pi-hole/php/header.php";
+	require "scripts/pi-hole/php/savesettings.php";
 	// Reread ini file as things might have been changed
 	$setupVars = parse_ini_file("/etc/pihole/setupVars.conf");
 ?>
@@ -387,6 +387,14 @@
 		$queryLog = "all";
 	}
 
+	// Privacy Mode
+	if(isset($setupVars["API_PRIVACY_MODE"]))
+	{
+		$privacyMode = $setupVars["API_PRIVACY_MODE"];
+	} else {
+		$privacyMode = false;
+	}
+
 	if(istrue($setupVars["API_GET_UPSTREAM_DNS_HOSTNAME"]))
 	{
 		$resolveForward = true;
@@ -449,6 +457,10 @@
 						<div class="checkbox"><label><input type="checkbox" name="querylog-blocked" <?php if($queryLog === "blockedonly" || $queryLog === "all"){ ?>checked<?php } ?>> Show blocked queries</label></div>
 					</div>
 				</div>
+				<h4>Privacy mode</h4>
+				<div class="form-group">
+					<div class="checkbox"><label><input type="checkbox" name="privacyMode" <?php if($privacyMode){ ?>checked<?php } ?>> Don't show query results for permitted requests</label></div>
+				</div>
 			</div>
 			<div class="box-footer">
 				<input type="hidden" name="field" value="API">
@@ -546,10 +558,10 @@
 </div>
 
 <?php
-    require "footer.php";
+    require "scripts/pi-hole/php/footer.php";
 ?>
-<script src="js/other/jquery.inputmask.js"></script>
-<script src="js/other/jquery.inputmask.extensions.js"></script>
-<script src="js/other/jquery.confirm.min.js"></script>
-<script src="js/pihole/settings.js"></script>
+<script src="scripts/vendor/jquery.inputmask.js"></script>
+<script src="scripts/vendor/jquery.inputmask.extensions.js"></script>
+<script src="scripts/vendor/jquery.confirm.min.js"></script>
+<script src="scripts/pi-hole/js/settings.js"></script>
 

style/vendor/SourceSansPro/OFL.txt

@@ -1,92 +1,92 @@
-Copyright 2010, 2012 Adobe Systems Incorporated (http://www.adobe.com/), with Reserved Font Name 'Source'. All Rights Reserved. Source is a trademark of Adobe Systems Incorporated in the United States and/or other countries.
-This Font Software is licensed under the SIL Open Font License, Version 1.1.
-This license is copied below, and is also available with a FAQ at:
-http://scripts.sil.org/OFL
-
-
------------------------------------------------------------
-SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
------------------------------------------------------------
-
-PREAMBLE
-The goals of the Open Font License (OFL) are to stimulate worldwide
-development of collaborative font projects, to support the font creation
-efforts of academic and linguistic communities, and to provide a free and
-open framework in which fonts may be shared and improved in partnership
-with others.
-
-The OFL allows the licensed fonts to be used, studied, modified and
-redistributed freely as long as they are not sold by themselves. The
-fonts, including any derivative works, can be bundled, embedded, 
-redistributed and/or sold with any software provided that any reserved
-names are not used by derivative works. The fonts and derivatives,
-however, cannot be released under any other type of license. The
-requirement for fonts to remain under this license does not apply
-to any document created using the fonts or their derivatives.
-
-DEFINITIONS
-"Font Software" refers to the set of files released by the Copyright
-Holder(s) under this license and clearly marked as such. This may
-include source files, build scripts and documentation.
-
-"Reserved Font Name" refers to any names specified as such after the
-copyright statement(s).
-
-"Original Version" refers to the collection of Font Software components as
-distributed by the Copyright Holder(s).
-
-"Modified Version" refers to any derivative made by adding to, deleting,
-or substituting -- in part or in whole -- any of the components of the
-Original Version, by changing formats or by porting the Font Software to a
-new environment.
-
-"Author" refers to any designer, engineer, programmer, technical
-writer or other person who contributed to the Font Software.
-
-PERMISSION & CONDITIONS
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of the Font Software, to use, study, copy, merge, embed, modify,
-redistribute, and sell modified and unmodified copies of the Font
-Software, subject to the following conditions:
-
-1) Neither the Font Software nor any of its individual components,
-in Original or Modified Versions, may be sold by itself.
-
-2) Original or Modified Versions of the Font Software may be bundled,
-redistributed and/or sold with any software, provided that each copy
-contains the above copyright notice and this license. These can be
-included either as stand-alone text files, human-readable headers or
-in the appropriate machine-readable metadata fields within text or
-binary files as long as those fields can be easily viewed by the user.
-
-3) No Modified Version of the Font Software may use the Reserved Font
-Name(s) unless explicit written permission is granted by the corresponding
-Copyright Holder. This restriction only applies to the primary font name as
-presented to the users.
-
-4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
-Software shall not be used to promote, endorse or advertise any
-Modified Version, except to acknowledge the contribution(s) of the
-Copyright Holder(s) and the Author(s) or with their explicit written
-permission.
-
-5) The Font Software, modified or unmodified, in part or in whole,
-must be distributed entirely under this license, and must not be
-distributed under any other license. The requirement for fonts to
-remain under this license does not apply to any document created
-using the Font Software.
-
-TERMINATION
-This license becomes null and void if any of the above conditions are
-not met.
-
-DISCLAIMER
-THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
-OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
-COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
-INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
-DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
-OTHER DEALINGS IN THE FONT SOFTWARE.
+Copyright 2010, 2012 Adobe Systems Incorporated (http://www.adobe.com/), with Reserved Font Name 'Source'. All Rights Reserved. Source is a trademark of Adobe Systems Incorporated in the United States and/or other countries.
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

taillog.php

@@ -1,5 +1,5 @@
 <?php
-    require "header.php";
+    require "scripts/pi-hole/php/header.php";
 ?>
 <!-- Title -->
 <div class="page-header">
@@ -11,8 +11,8 @@
 <div class="checkbox"><label><input type="checkbox" name="active" checked id="chk2"> Automatic scrolling on update</label></div>
 
 <?php
-    require "footer.php";
+    require "scripts/pi-hole/php/footer.php";
 ?>
 
 
-<script src="js/pihole/taillog.js"></script>
+<script src="scripts/pi-hole/js/taillog.js"></script>