Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Whitelist and Blacklist editing #88

Merged
merged 20 commits into from
May 26, 2016
Merged

Whitelist and Blacklist editing #88

merged 20 commits into from
May 26, 2016

Conversation

AzureMarker
Copy link
Contributor

@AzureMarker AzureMarker commented May 8, 2016

Changes proposed in this pull request:

  • Add Whitelist and Blacklist pages to allow list editing from the web interface. This relies on #469 on the other repo.
  • The security of the lists are maintained by using CSRF tokens and CORS headers.

@pi-hole/dashboard

After the change to 0.0.0.0 there will
be no need for a password
Updates from using `whitelist.sh` and `blacklist.sh` to
using `pihole`. Currently includes sudo in command, but
after the scripts get updated with sudo checking that
should not be needed.
Conflicts:
	list.php
	php/add.php
	php/sub.php
Only allows requests from http://pi.hole and http://<Pi's IP>
It appears that sometimes the first time you open the page,
the token is not synced correctly or something, causing
the CSRF check to fail. Starting the session before any
HTML is outputted seems to be a recommended first step to
troubleshooting PHP session errors. I have tried to test
this fix, but right now I don't know exactly what triggers
the error.
Both failed CORS as both browsers, unlike Chrome,
do not send `Origin` headers for same-origin requests.
Now the scripts check if the `Host` header equals
the IP of the Pi-hole. IE may require more fixing,
as it's IE. :P
This fixes the fix. I still needed to account for
`pi.hole` as a Host value.
If only Host was correct (FireFox and IE only set Host
for same-origin requests) then it would still use the
empty Origin header for the CORS response, leading to
`Access-Control-Allow-Origin: `
IE would cache the list contents, so that if you
updated the list it would not show up as changed.
Mainly changed from `document.getElementById("something")` to
`$(#something)`. Also changed the html and hide/show functions
as a result of the change.
Only activates when the input has focus.
They will pop back up again if you add another domain.
If the list became empty, the "Your $list is empty!"
message would not pop up, since the fadeIn call is
out of that scope.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant