' . $pwhash . "'.$pwhash.'';
} else {
- echo "No password set
"; + echo 'No password set
'; } } else { - echo "Not authorized!
"; + echo 'Not authorized!
'; } ?> diff --git a/scripts/pi-hole/php/auth.php b/scripts/pi-hole/php/auth.php index 44b2bc76..a3120924 100644 --- a/scripts/pi-hole/php/auth.php +++ b/scripts/pi-hole/php/auth.php @@ -7,7 +7,7 @@ * Please see LICENSE file for your rights under this license. */ -require_once('func.php'); +require_once 'func.php'; $ERRORLOG = getenv('PHP_ERROR_LOG'); if (empty($ERRORLOG)) { @@ -22,35 +22,41 @@ if (empty($ERRORLOG)) { } } -function pi_log($message) { - error_log(date('Y-m-d H:i:s') . ': ' . $message . "\n", 3, $GLOBALS['ERRORLOG']); +function pi_log($message) +{ + error_log(date('Y-m-d H:i:s').': '.$message."\n", 3, $GLOBALS['ERRORLOG']); } -function log_and_die($message) { +function log_and_die($message) +{ pi_log($message); - die($message); + + exit($message); } -function check_cors() { +function check_cors() +{ $ip = $_SERVER['SERVER_ADDR']; // Check CORS $AUTHORIZED_HOSTNAMES = array( $ip, - str_replace(array("[","]"), array("",""), $_SERVER["SERVER_NAME"]), - "pi.hole", - "localhost" + str_replace(array('[', ']'), array('', ''), $_SERVER['SERVER_NAME']), + 'pi.hole', + 'localhost', ); - # Allow user set virtual hostnames + // Allow user set virtual hostnames $virtual_host = getenv('VIRTUAL_HOST'); - if (! empty($virtual_host)) + if (!empty($virtual_host)) { array_push($AUTHORIZED_HOSTNAMES, $virtual_host); + } - # Allow user set CORS + // Allow user set CORS $cors_hosts = getenv('CORS_HOSTS'); - if (! empty($cors_hosts)) - array_push($AUTHORIZED_HOSTNAMES, ...explode(",", $cors_hosts)); + if (!empty($cors_hosts)) { + array_push($AUTHORIZED_HOSTNAMES, ...explode(',', $cors_hosts)); + } // Since the Host header is easily manipulated, we can only check if it's wrong and can't use it // to validate that the client is authorized, only unauthorized. @@ -64,43 +70,42 @@ function check_cors() { // Don't use parse_url for IPv6 addresses, since it does not support them // see PHP bug report: https://bugs.php.net/bug.php?id=72811 - if(strpos($server_host, ":") && !strpos($server_host, "[") && !strpos($server_host, "]")) - { + if (strpos($server_host, ':') && !strpos($server_host, '[') && !strpos($server_host, ']')) { $server_host = parse_url($_SERVER['HTTP_HOST'], PHP_URL_HOST); } // Remove "[" ... "]" - $server_host = str_replace(array("[","]"), array("",""), $server_host); + $server_host = str_replace(array('[', ']'), array('', ''), $server_host); - if(isset($_SERVER['HTTP_HOST']) && !in_array($server_host, $AUTHORIZED_HOSTNAMES)) { - log_and_die("Failed Host Check: " . $server_host .' vs '. htmlspecialchars(join(', ', $AUTHORIZED_HOSTNAMES))); + if (isset($_SERVER['HTTP_HOST']) && !in_array($server_host, $AUTHORIZED_HOSTNAMES)) { + log_and_die('Failed Host Check: '.$server_host.' vs '.htmlspecialchars(join(', ', $AUTHORIZED_HOSTNAMES))); } - if(isset($_SERVER['HTTP_ORIGIN'])) { + if (isset($_SERVER['HTTP_ORIGIN'])) { $server_origin = $_SERVER['HTTP_ORIGIN']; // Detect colon in $_SERVER['HTTP_ORIGIN'] (see comment above) - if(strpos($server_origin, ":") && !strpos($server_origin, "[") && !strpos($server_origin, "]")) - { + if (strpos($server_origin, ':') && !strpos($server_origin, '[') && !strpos($server_origin, ']')) { $server_origin = parse_url($_SERVER['HTTP_ORIGIN'], PHP_URL_HOST); } // Remove "[", "]","http://", and "https://" - $server_origin = str_replace(array("[","]","http://","https://"), array("","","",""), $server_origin); + $server_origin = str_replace(array('[', ']', 'http://', 'https://'), array('', '', '', ''), $server_origin); - if(!in_array($server_origin, $AUTHORIZED_HOSTNAMES)) { - log_and_die("Failed CORS: " . htmlspecialchars($server_origin) .' vs '. htmlspecialchars(join(', ', $AUTHORIZED_HOSTNAMES))); + if (!in_array($server_origin, $AUTHORIZED_HOSTNAMES)) { + log_and_die('Failed CORS: '.htmlspecialchars($server_origin).' vs '.htmlspecialchars(join(', ', $AUTHORIZED_HOSTNAMES))); } header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}"); } // If there's no HTTP_ORIGIN, CORS should not be used } -function check_csrf($token) { +function check_csrf($token) +{ // Check CSRF token - $session_started = function_exists("session_status") ? - session_status() == PHP_SESSION_ACTIVE : - session_id() == ""; + $session_started = function_exists('session_status') ? + PHP_SESSION_ACTIVE == session_status() : + '' == session_id(); - if(!$session_started) { + if (!$session_started) { // Start a new PHP session (or continue an existing one) // Prevents javascript XSS attacks aimed to steal the session ID ini_set('session.cookie_httponly', 1); @@ -109,26 +114,25 @@ function check_csrf($token) { session_start(); } - if(!isset($_SESSION['token'])) { - log_and_die("Session expired! Please re-login on the Pi-hole dashboard."); + if (!isset($_SESSION['token'])) { + log_and_die('Session expired! Please re-login on the Pi-hole dashboard.'); } - if(empty($token)) { - log_and_die("Empty token! Check if cookies are enabled on your system."); + if (empty($token)) { + log_and_die('Empty token! Check if cookies are enabled on your system.'); } - if(!hash_equals($_SESSION['token'], $token)) { - log_and_die("Wrong token! Please re-login on the Pi-hole dashboard."); + if (!hash_equals($_SESSION['token'], $token)) { + log_and_die('Wrong token! Please re-login on the Pi-hole dashboard.'); } } -function check_domain(&$domains) { - foreach($domains as &$domain) - { +function check_domain(&$domains) +{ + foreach ($domains as &$domain) { $validDomain = validDomain($domain); - if(!$validDomain){ - log_and_die(htmlspecialchars($domain. ' is not a valid domain')); + if (!$validDomain) { + log_and_die(htmlspecialchars($domain.' is not a valid domain')); } } } -?> diff --git a/scripts/pi-hole/php/customcname.php b/scripts/pi-hole/php/customcname.php index 814a83a0..7b89dfe7 100644 --- a/scripts/pi-hole/php/customcname.php +++ b/scripts/pi-hole/php/customcname.php @@ -1,6 +1,7 @@ diff --git a/scripts/pi-hole/php/customdns.php b/scripts/pi-hole/php/customdns.php index 5a0216af..351781c4 100644 --- a/scripts/pi-hole/php/customdns.php +++ b/scripts/pi-hole/php/customdns.php @@ -1,6 +1,7 @@ diff --git a/scripts/pi-hole/php/database.php b/scripts/pi-hole/php/database.php index 5fdc32c9..57efcf14 100644 --- a/scripts/pi-hole/php/database.php +++ b/scripts/pi-hole/php/database.php @@ -10,68 +10,52 @@ function getGravityDBFilename() { // Get possible non-standard location of FTL's database - $FTLsettings = parse_ini_file("/etc/pihole/pihole-FTL.conf"); - if(isset($FTLsettings["GRAVITYDB"])) - { - return $FTLsettings["GRAVITYDB"]; - } - else - { - return "/etc/pihole/gravity.db"; + $FTLsettings = parse_ini_file('/etc/pihole/pihole-FTL.conf'); + if (isset($FTLsettings['GRAVITYDB'])) { + return $FTLsettings['GRAVITYDB']; } + + return '/etc/pihole/gravity.db'; } function getQueriesDBFilename() { // Get possible non-standard location of FTL's database - $FTLsettings = parse_ini_file("/etc/pihole/pihole-FTL.conf"); - if(isset($FTLsettings["DBFILE"])) - { - return $FTLsettings["DBFILE"]; - } - else - { - return "/etc/pihole/pihole-FTL.db"; + $FTLsettings = parse_ini_file('/etc/pihole/pihole-FTL.conf'); + if (isset($FTLsettings['DBFILE'])) { + return $FTLsettings['DBFILE']; } + + return '/etc/pihole/pihole-FTL.db'; } function SQLite3_connect_try($filename, $mode, $trytoreconnect) { - try - { + try { // connect to database return new SQLite3($filename, $mode); - } - catch (Exception $exception) - { + } catch (Exception $exception) { // sqlite3 throws an exception when it is unable to connect, try to reconnect after 3 seconds - if($trytoreconnect) - { + if ($trytoreconnect) { sleep(3); + return SQLite3_connect_try($filename, $mode, false); } - else - { - // If we should not try again (or are already trying again!), we return the exception string - // so the user gets it on the dashboard - return $filename.": ".$exception->getMessage(); - } + // If we should not try again (or are already trying again!), we return the exception string + // so the user gets it on the dashboard + return $filename.': '.$exception->getMessage(); } } -function SQLite3_connect($filename, $mode=SQLITE3_OPEN_READONLY) +function SQLite3_connect($filename, $mode = SQLITE3_OPEN_READONLY) { - if(strlen($filename) > 0) - { + if (strlen($filename) > 0) { $db = SQLite3_connect_try($filename, $mode, true); + } else { + exit('No database available'); } - else - { - die("No database available"); - } - if(is_string($db)) - { - die("Error connecting to database\n".$db); + if (is_string($db)) { + exit("Error connecting to database\n".$db); } // Add busy timeout so methods don't fail immediately when, e.g., FTL is currently reading from the DB @@ -80,9 +64,8 @@ function SQLite3_connect($filename, $mode=SQLITE3_OPEN_READONLY) return $db; } - /** - * Add domains to a given table + * Add domains to a given table. * * @param $db object The SQLite3 database connection object * @param $table string The target table @@ -90,233 +73,218 @@ function SQLite3_connect($filename, $mode=SQLITE3_OPEN_READONLY) * @param $wildcardstyle boolean Whether to format the input domains in legacy wildcard notation * @param $returnnum boolean Whether to return an integer or a string * @param $type integer The target type (0 = exact whitelist, 1 = exact blacklist, 2 = regex whitelist, 3 = regex blacklist) + * @param mixed|null $comment + * * @return string Success/error and number of processed domains */ -function add_to_table($db, $table, $domains, $comment=null, $wildcardstyle=false, $returnnum=false, $type=-1) +function add_to_table($db, $table, $domains, $comment = null, $wildcardstyle = false, $returnnum = false, $type = -1) { - if(!is_int($type)) - { - return "Error: Argument type has to be of type integer (is ".gettype($type).")"; + if (!is_int($type)) { + return 'Error: Argument type has to be of type integer (is '.gettype($type).')'; } // Begin transaction - if(!$db->exec("BEGIN TRANSACTION;")) - { - if($returnnum) + if (!$db->exec('BEGIN TRANSACTION;')) { + if ($returnnum) { return 0; - else - return "Error: Unable to begin transaction for $table table."; + } + + return "Error: Unable to begin transaction for {$table} table."; } // To which column should the record be added to? - if ($table === "adlist") - { - $field = "address"; - } - else - { - $field = "domain"; + if ('adlist' === $table) { + $field = 'address'; + } else { + $field = 'domain'; } // Get initial count of domains in this table - if($type === -1) - { - $countquery = "SELECT COUNT(*) FROM $table;"; - } - else - { - $countquery = "SELECT COUNT(*) FROM $table WHERE type = $type;"; + if (-1 === $type) { + $countquery = "SELECT COUNT(*) FROM {$table};"; + } else { + $countquery = "SELECT COUNT(*) FROM {$table} WHERE type = {$type};"; } $initialcount = intval($db->querySingle($countquery)); // Prepare INSERT SQLite statement $bindcomment = false; - if($table === "domain_audit") { - $querystr = "INSERT OR IGNORE INTO $table ($field) VALUES (:$field);"; - } elseif($type === -1) { - $querystr = "INSERT OR IGNORE INTO $table ($field,comment) VALUES (:$field, :comment);"; + if ('domain_audit' === $table) { + $querystr = "INSERT OR IGNORE INTO {$table} ({$field}) VALUES (:{$field});"; + } elseif (-1 === $type) { + $querystr = "INSERT OR IGNORE INTO {$table} ({$field},comment) VALUES (:{$field}, :comment);"; $bindcomment = true; } else { - $querystr = "REPLACE INTO $table ($field,comment,type) VALUES (:$field, :comment, $type);"; + $querystr = "REPLACE INTO {$table} ({$field},comment,type) VALUES (:{$field}, :comment, {$type});"; $bindcomment = true; } $stmt = $db->prepare($querystr); // Return early if we failed to prepare the SQLite statement - if(!$stmt) - { - if($returnnum) + if (!$stmt) { + if ($returnnum) { return 0; - else - return "Error: Failed to prepare statement for $table table (type = $type, field = $field)."; + } + + return "Error: Failed to prepare statement for {$table} table (type = {$type}, field = {$field})."; } // Loop over domains and inject the lines into the database $num = 0; - foreach($domains as $domain) - { + foreach ($domains as $domain) { // Limit max length for a domain entry to 253 chars - if(strlen($domain) > 253) + if (strlen($domain) > 253) { continue; - - if($wildcardstyle) - $domain = "(\\.|^)".str_replace(".","\\.",$domain)."$"; - - $stmt->bindValue(":$field", htmlentities($domain), SQLITE3_TEXT); - if($bindcomment) { - $stmt->bindValue(":comment", htmlentities($comment), SQLITE3_TEXT); } - if($stmt->execute() && $stmt->reset()) - $num++; - else - { + if ($wildcardstyle) { + $domain = '(\\.|^)'.str_replace('.', '\\.', $domain).'$'; + } + + $stmt->bindValue(":{$field}", htmlentities($domain), SQLITE3_TEXT); + if ($bindcomment) { + $stmt->bindValue(':comment', htmlentities($comment), SQLITE3_TEXT); + } + + if ($stmt->execute() && $stmt->reset()) { + ++$num; + } else { $stmt->close(); - if($returnnum) + if ($returnnum) { return $num; - else - { - if($num === 1) - $plural = ""; - else - $plural = "s"; - return "Error: ".$db->lastErrorMsg().", added ".$num." domain".$plural; } + if (1 === $num) { + $plural = ''; + } else { + $plural = 's'; + } + + return 'Error: '.$db->lastErrorMsg().', added '.$num.' domain'.$plural; } } // Close prepared statement and return number of processed rows $stmt->close(); - $db->exec("COMMIT;"); + $db->exec('COMMIT;'); - if($returnnum) + if ($returnnum) { return $num; - else - { - $finalcount = intval($db->querySingle($countquery)); - $modified = $finalcount - $initialcount; - - // If we add less domains than the user specified, then they wanted to add duplicates - if($modified !== $num) - { - $delta = $num - $modified; - $extra = " (skipped ".$delta." duplicates)"; - } - else - { - $extra = ""; - } - - if($num === 1) - $plural = ""; - else - $plural = "s"; - return "Success, added ".$modified." of ".$num." domain".$plural.$extra; } + $finalcount = intval($db->querySingle($countquery)); + $modified = $finalcount - $initialcount; + + // If we add less domains than the user specified, then they wanted to add duplicates + if ($modified !== $num) { + $delta = $num - $modified; + $extra = ' (skipped '.$delta.' duplicates)'; + } else { + $extra = ''; + } + + if (1 === $num) { + $plural = ''; + } else { + $plural = 's'; + } + + return 'Success, added '.$modified.' of '.$num.' domain'.$plural.$extra; } /** - * Remove domains from a given table + * Remove domains from a given table. * * @param $db object The SQLite3 database connection object * @param $table string The target table * @param $domains array Array of domains (strings) to be removed from the table * @param $returnnum boolean Whether to return an integer or a string * @param $type integer The target type (0 = exact whitelist, 1 = exact blacklist, 2 = regex whitelist, 3 = regex blacklist) + * * @return string Success/error and number of processed domains */ -function remove_from_table($db, $table, $domains, $returnnum=false, $type=-1) +function remove_from_table($db, $table, $domains, $returnnum = false, $type = -1) { - if(!is_int($type)) - { - return "Error: Argument type has to be of type integer (is ".gettype($type).")"; + if (!is_int($type)) { + return 'Error: Argument type has to be of type integer (is '.gettype($type).')'; } // Begin transaction - if(!$db->exec("BEGIN TRANSACTION;")) - { - if($returnnum) + if (!$db->exec('BEGIN TRANSACTION;')) { + if ($returnnum) { return 0; - else - return "Error: Unable to begin transaction for domainlist table."; + } + + return 'Error: Unable to begin transaction for domainlist table.'; } // Get initial count of domains in this table - if($type === -1) - { - $countquery = "SELECT COUNT(*) FROM $table;"; - } - else - { - $countquery = "SELECT COUNT(*) FROM $table WHERE type = $type;"; + if (-1 === $type) { + $countquery = "SELECT COUNT(*) FROM {$table};"; + } else { + $countquery = "SELECT COUNT(*) FROM {$table} WHERE type = {$type};"; } $initialcount = intval($db->querySingle($countquery)); // Prepare SQLite statement - if($type === -1) - { - $querystr = "DELETE FROM $table WHERE domain = :domain AND type = $type;"; - } - else - { - $querystr = "DELETE FROM $table WHERE domain = :domain;"; + if (-1 === $type) { + $querystr = "DELETE FROM {$table} WHERE domain = :domain AND type = {$type};"; + } else { + $querystr = "DELETE FROM {$table} WHERE domain = :domain;"; } $stmt = $db->prepare($querystr); // Return early if we failed to prepare the SQLite statement - if(!$stmt) - { - if($returnnum) + if (!$stmt) { + if ($returnnum) { return 0; - else - return "Error: Failed to prepare statement for ".$table." table (type = ".$type.")."; + } + + return 'Error: Failed to prepare statement for '.$table.' table (type = '.$type.').'; } // Loop over domains and remove the lines from the database $num = 0; - foreach($domains as $domain) - { - $stmt->bindValue(":domain", $domain, SQLITE3_TEXT); + foreach ($domains as $domain) { + $stmt->bindValue(':domain', $domain, SQLITE3_TEXT); - if($stmt->execute() && $stmt->reset()) - $num++; - else - { + if ($stmt->execute() && $stmt->reset()) { + ++$num; + } else { $stmt->close(); - if($returnnum) + if ($returnnum) { return $num; - else - { - if($num === 1) - $plural = ""; - else - $plural = "s"; - return "Error: ".$db->lastErrorMsg().", removed ".$num." domain".$plural; } + if (1 === $num) { + $plural = ''; + } else { + $plural = 's'; + } + + return 'Error: '.$db->lastErrorMsg().', removed '.$num.' domain'.$plural; } } // Close prepared statement and return number or processed rows $stmt->close(); - $db->exec("COMMIT;"); + $db->exec('COMMIT;'); - if($returnnum) + if ($returnnum) { return $num; - else - { - if($num === 1) - $plural = ""; - else - $plural = "s"; - return "Success, removed ".$num." domain".$plural; } + if (1 === $num) { + $plural = ''; + } else { + $plural = 's'; + } + + return 'Success, removed '.$num.' domain'.$plural; } -if (!class_exists("ListType")) { - class ListType{ - const whitelist = 0; - const blacklist = 1; - const regex_whitelist = 2; - const regex_blacklist = 3; +if (!class_exists('ListType')) { + class ListType + { + public const whitelist = 0; + public const blacklist = 1; + public const regex_whitelist = 2; + public const regex_blacklist = 3; } } diff --git a/scripts/pi-hole/php/debug.php b/scripts/pi-hole/php/debug.php index eb50ef60..a994feee 100644 --- a/scripts/pi-hole/php/debug.php +++ b/scripts/pi-hole/php/debug.php @@ -1,70 +1,71 @@ '', - chr(27)."[1;32m" => '', - chr(27)."[1;33m" => '', - chr(27)."[1;34m" => '', - chr(27)."[1;35m" => '', - chr(27)."[1;36m" => '', + chr(27).'[1;91m' => '', + chr(27).'[1;32m' => '', + chr(27).'[1;33m' => '', + chr(27).'[1;34m' => '', + chr(27).'[1;35m' => '', + chr(27).'[1;36m' => '', - chr(27)."[90m" => '', - chr(27)."[91m" => '', - chr(27)."[32m" => '', - chr(27)."[33m" => '', - chr(27)."[94m" => '', - chr(27)."[95m" => '', - chr(27)."[96m" => '', + chr(27).'[90m' => '', + chr(27).'[91m' => '', + chr(27).'[32m' => '', + chr(27).'[33m' => '', + chr(27).'[94m' => '', + chr(27).'[95m' => '', + chr(27).'[96m' => '', - chr(27)."[1m" => '', - chr(27)."[4m" => '', + chr(27).'[1m' => '', + chr(27).'[4m' => '', - chr(27)."[0m" => '', + chr(27).'[0m' => '', ); $data = str_replace(array_keys($ANSIcolors), $ANSIcolors, htmlspecialchars($datatext)); - if (!isset($_GET["IE"])) { - echo "data: ".implode("\ndata: ", explode("\n", $data))."\n\n"; + if (!isset($_GET['IE'])) { + echo 'data: '.implode("\ndata: ", explode("\n", $data))."\n\n"; } else { echo $data; } } // Execute "pihole" using Web option -$command = "export TERM=dumb && sudo pihole -d -w"; +$command = 'export TERM=dumb && sudo pihole -d -w'; // Add auto-upload option -if (isset($_GET["upload"])) { - $command .= " -a"; +if (isset($_GET['upload'])) { + $command .= ' -a'; } // Execute database integrity_check -if (isset($_GET["dbcheck"])) { - $command .= " -c"; +if (isset($_GET['dbcheck'])) { + $command .= ' -c'; } -$proc = popen($command, "r"); +$proc = popen($command, 'r'); while (!feof($proc)) { echoEvent(fread($proc, 4096)); } -?> diff --git a/scripts/pi-hole/php/footer.php b/scripts/pi-hole/php/footer.php index 035209ee..29709e13 100644 --- a/scripts/pi-hole/php/footer.php +++ b/scripts/pi-hole/php/footer.php @@ -43,26 +43,26 @@