mirror of
https://github.com/pi-hole/web.git
synced 2026-02-24 03:35:18 +00:00
8a33af6d6b
Both failed CORS as both browsers, unlike Chrome, do not send `Origin` headers for same-origin requests. Now the scripts check if the `Host` header equals the IP of the Pi-hole. IE may require more fixing, as it's IE. :P
25 lines
699 B
PHP
25 lines
699 B
PHP
<?php
|
|
if(!isset($_POST['domain'], $_POST['list'], $_POST['token']))
|
|
die("Missing POST variables");
|
|
|
|
// Check CORS
|
|
if($_SERVER['HTTP_ORIGIN'] != "http://pi.hole" && $_SERVER['HTTP_ORIGIN'] != "http://${_SERVER['SERVER_ADDR']}" || $_SERVER['HTTP_HOST'] != $_SERVER['SERVER_ADDR'])
|
|
die("Failed CORS");
|
|
|
|
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
|
|
|
|
session_start();
|
|
|
|
// Check CSRF token
|
|
if(!hash_equals($_SESSION['token'], $_POST['token']))
|
|
die("Wrong token");
|
|
|
|
switch($_POST['list']) {
|
|
case "white":
|
|
exec("sudo pihole -w -q -d ${_POST['domain']}");
|
|
break;
|
|
case "black":
|
|
exec("sudo pihole -b -q -d ${_POST['domain']}");
|
|
break;
|
|
}
|