Files
web/php/get.php
T
Mcat12 7265405424 Fix possible list param exploit
Sanitize list parameter, so that only the whitelist or blacklist are able to be read.
2016-08-16 15:17:28 -04:00

20 lines
403 B
PHP

<?php
if(!isset($_GET['list']))
die();
$type = $_GET['list'];
if($type !== "white" || $type !== "black")
die("Invalid list parameter");
$rawList = file_get_contents("/etc/pihole/${type}list.txt");
$list = explode("\n", $rawList);
// Get rid of empty lines
for($i = sizeof($list)-1; $i >= 0; $i--) {
if($list[$i] == "")
unset($list[$i]);
}
echo json_encode(array_values($list));