Pi-Hole/web
1
0 Fork 0
mirror of https://github.com/pi-hole/web.git synced 2026-10-05 20:47:42 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix up CORS

Browse Source 
Previously had been checking Origin AND Host header, but we should not
check Host header... Removed Host check and only check if Origin header
is set, because otherwise CORS doesn't apply (could be a same-origin
request).
This commit is contained in:
Mcat12 committed 2016-07-03 16:29:19 -04:00
1 parent 2fef2bab07
commit cb32c5572a
2 files changed
+23 -17
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

php/add.php
+12 -9
View File
@@ -3,21 +3,24 @@ if(!isset($_POST['domain'], $_POST['list'], $_POST['token']))
die("Missing POST variables");
// Check CORS
if($_SERVER['HTTP_ORIGIN'] == "http://pi.hole" || $_SERVER['HTTP_ORIGIN'] == "http://${_SERVER['SERVER_ADDR']}")
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
else if($_SERVER['HTTP_HOST'] == $_SERVER['SERVER_ADDR'] || $_SERVER['HTTP_HOST'] == "pi.hole")
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_HOST']}");
else
die("Failed CORS");
session_start();
if(isset($_SERVER['HTTP_ORIGIN'])) {
if ($_SERVER['HTTP_ORIGIN'] == "http://pi.hole" ||
$_SERVER['HTTP_ORIGIN'] == "http://${_SERVER['SERVER_ADDR']}" ||
$_SERVER['HTTP_ORIGIN'] == "http://localhost"
)
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
else
die("Failed CORS");
}
// Otherwise probably same origin... out of the scope of CORS
// Check CSRF token
session_start();
if(!hash_equals($_SESSION['token'], $_POST['token']))
die("Wrong token");
switch($_POST['list']) {
case "white":
case "white":
echo exec("sudo pihole -w -q ${_POST['domain']}");
break;
case "black":
php/sub.php
+11 -8
View File
@@ -3,16 +3,19 @@ if(!isset($_POST['domain'], $_POST['list'], $_POST['token']))
die("Missing POST variables");
// Check CORS
if($_SERVER['HTTP_ORIGIN'] == "http://pi.hole" || $_SERVER['HTTP_ORIGIN'] == "http://${_SERVER['SERVER_ADDR']}")
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
else if($_SERVER['HTTP_HOST'] == $_SERVER['SERVER_ADDR'] || $_SERVER['HTTP_HOST'] == "pi.hole")
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_HOST']}");
else
die("Failed CORS");
session_start();
if(isset($_SERVER['HTTP_ORIGIN'])) {
if ($_SERVER['HTTP_ORIGIN'] == "http://pi.hole" ||
$_SERVER['HTTP_ORIGIN'] == "http://${_SERVER['SERVER_ADDR']}" ||
$_SERVER['HTTP_ORIGIN'] == "http://localhost"
)
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
else
die("Failed CORS");
}
// Otherwise probably same origin... out of the scope of CORS
// Check CSRF token
session_start();
if(!hash_equals($_SESSION['token'], $_POST['token']))
die("Wrong token");