mirror of
https://github.com/pi-hole/web.git
synced 2026-04-27 12:15:00 +01:00
5d0a399796
lighttpd suffers from the same same bug/feature apache does, it fills SERVER_NAME in with the requested URL if connonical names and server side server name is not configured. No thanks. Nginx seems to have secure defaults.
50 lines
1.1 KiB
PHP
50 lines
1.1 KiB
PHP
<?php
|
|
function pi_log($message) {
|
|
error_log($message . "\n", 3, '/var/log/lighttpd/pihole_php.log');
|
|
}
|
|
|
|
function die_and_log($message) {
|
|
pi_log($message);
|
|
die($message);
|
|
}
|
|
|
|
if(!isset($_POST['domain'], $_POST['list'], $_POST['token'])) {
|
|
die_and_log("Missing POST variables");
|
|
}
|
|
|
|
$SERVER_SIDE_IDS = [
|
|
$_SERVER['SERVER_ADDR'],
|
|
'pi.hole'
|
|
];
|
|
|
|
// Check CORS
|
|
$CORS_ALLOW_ORIGIN = false;
|
|
if(in_array($_SERVER['HTTP_ORIGIN'], $SERVER_SIDE_IDS)) {
|
|
$CORS_ALLOW_ORIGIN = $_SERVER['HTTP_ORIGIN'];
|
|
} else if(in_array($_SERVER['HTTP_HOST'], $SERVER_SIDE_IDS)) {
|
|
$CORS_ALLOW_ORIGIN = $_SERVER['HTTP_HOST'];
|
|
}
|
|
|
|
if (!$CORS_ALLOW_ORIGIN)
|
|
die_and_log("Failed CORS");
|
|
|
|
header("Access-Control-Allow-Origin: $CORS_ALLOW_ORIGIN");
|
|
|
|
session_start();
|
|
|
|
// Check CSRF token
|
|
if(!hash_equals($_SESSION['token'], $_POST['token']))
|
|
die_and_log("Wrong token");
|
|
|
|
|
|
switch($_POST['list']) {
|
|
case "white":
|
|
echo exec("sudo pihole -w -q ${_POST['domain']}");
|
|
break;
|
|
case "black":
|
|
echo exec("sudo pihole -b -q ${_POST['domain']}");
|
|
break;
|
|
}
|
|
|
|
?>
|