mirror of
https://github.com/pi-hole/web.git
synced 2026-02-25 12:15:56 +00:00
7067473d89
If only Host was correct (FireFox and IE only set Host for same-origin requests) then it would still use the empty Origin header for the CORS response, leading to `Access-Control-Allow-Origin: `
27 lines
819 B
PHP
27 lines
819 B
PHP
<?php
|
|
if(!isset($_POST['domain'], $_POST['list'], $_POST['token']))
|
|
die("Missing POST variables");
|
|
|
|
// Check CORS
|
|
if($_SERVER['HTTP_ORIGIN'] == "http://pi.hole" || $_SERVER['HTTP_ORIGIN'] == "http://${_SERVER['SERVER_ADDR']}")
|
|
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_ORIGIN']}");
|
|
else if($_SERVER['HTTP_HOST'] == $_SERVER['SERVER_ADDR'] || $_SERVER['HTTP_HOST'] == "pi.hole")
|
|
header("Access-Control-Allow-Origin: ${_SERVER['HTTP_HOST']}");
|
|
else
|
|
die("Failed CORS");
|
|
|
|
session_start();
|
|
|
|
// Check CSRF token
|
|
if(!hash_equals($_SESSION['token'], $_POST['token']))
|
|
die("Wrong token");
|
|
|
|
switch($_POST['list']) {
|
|
case "white":
|
|
exec("sudo pihole -w -q -d ${_POST['domain']}");
|
|
break;
|
|
case "black":
|
|
exec("sudo pihole -b -q -d ${_POST['domain']}");
|
|
break;
|
|
}
|