Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add authentication to ajax pages, thx @lts-rad #1548

Merged
merged 1 commit into from
Mar 12, 2024
+77 −32
Merged

Add authentication to ajax pages, thx @lts-rad #1548

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion ajax/adblock/update_blocklist.php
View file
Original file line number Diff line number Diff line change
@@ -2,6 +2,8 @@

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';

if (isset($_POST['blocklist_id'])) {
$blocklist_id = escapeshellcmd($_POST['blocklist_id']);
@@ -50,4 +52,3 @@
$jsonData = ['return'=>2,'output'=>['Error getting data']];
echo json_encode($jsonData);
}

12 changes: 5 additions & 7 deletions ajax/bandwidth/get_bandwidth.php
View file
Original file line number Diff line number Diff line change
@@ -1,8 +1,9 @@
<?php

require '../../includes/csrf.php';

require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';

$interface = filter_input(INPUT_GET, 'inet', FILTER_SANITIZE_SPECIAL_CHARS);
if (empty($interface)) {
@@ -13,8 +14,7 @@
} else {
exit('No network interfaces found.');
}
}

}
define('IFNAMSIZ', 16);
if (strlen($interface) > IFNAMSIZ) {
exit('Interface name too long.');
@@ -72,14 +72,12 @@
$datareceived = round($jsonData[$i]['rx'] / $dsu_factor, 0);

if ($timeunits === 'm') {
echo '{ "date": "' , $dt->format('Y-m') , '", "rx": "' , $datareceived ,
echo '{ "date": "' , $dt->format('Y-m') , '", "rx": "' , $datareceived ,
'", "tx": "' , $datasend , '" }';
} else {
echo '{ "date": "' , $dt->format('Y-m-d') , '", "rx": "' , $datareceived ,
echo '{ "date": "' , $dt->format('Y-m-d') , '", "rx": "' , $datareceived ,
'", "tx": "' , $datasend , '" }';
}
}

echo ' ]';


5 changes: 4 additions & 1 deletion ajax/bandwidth/get_bandwidth_hourly.php
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
<?php
<?php

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';

if (filter_input(INPUT_GET, 'tu') == 'h') {

13 changes: 10 additions & 3 deletions ajax/logging/clearlog.php
View file
Original file line number Diff line number Diff line change
@@ -2,12 +2,19 @@

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';
require_once '../../includes/functions.php';

if (isset($_POST['logfile'])) {
$logfile = escapeshellcmd($_POST['logfile']);
$logfile = escapeshellarg($_POST['logfile']);
$valid = '/(\/var\/log|\/tmp)/';

// truncate requested log file
exec("sudo truncate -s 0 $logfile", $return);
if (preg_match($valid, $logfile)) {
// truncate requested log file
exec("sudo truncate -s 0 $logfile", $return);
} else {
$return = 1;
}
echo json_encode($return);
}
5 changes: 3 additions & 2 deletions ajax/networking/do_sys_reset.php
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
<?php

require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';
require_once '../../includes/session.php';
require_once '../../includes/functions.php';

@@ -16,7 +18,7 @@
array("src" => $path .'/090_wlan0.conf', "tmp" => "/tmp/dnsmasqdata", "dest" => RASPI_DNSMASQ_PREFIX.'wlan0.conf'),
array("src" => $path .'/090_raspap.conf', "tmp" => "/tmp/dnsmasqdata", "dest" => RASPI_DNSMASQ_PREFIX.'raspap.conf'),
);

foreach ($configs as $config) {
try {
$tmp = file_get_contents($config["src"]);
@@ -32,4 +34,3 @@
} else {
handleInvalidCSRFToken();
}

3 changes: 3 additions & 0 deletions ajax/networking/get_all_interfaces.php
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
<?php

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';

exec("ls /sys/class/net | grep -v lo", $interfaces);
echo json_encode($interfaces);
2 changes: 2 additions & 0 deletions ajax/networking/get_channel.php
View file
Original file line number Diff line number Diff line change
@@ -2,6 +2,8 @@

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';

exec('cat '. RASPI_HOSTAPD_CONFIG, $hostapdconfig);
$arrConfig = array();
6 changes: 4 additions & 2 deletions ajax/networking/get_frequencies.php
View file
Original file line number Diff line number Diff line change
@@ -1,7 +1,10 @@
<?php

require '../../includes/csrf.php';
require '../../src/RaspAP/Parsers/IwParser.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../src/RaspAP/Parsers/IwParser.php';
require_once '../../includes/authenticate.php';

if (isset($_POST['interface'])) {

@@ -11,4 +14,3 @@

echo json_encode($supportedFrequencies);
}

3 changes: 3 additions & 0 deletions ajax/networking/get_ip_summary.php
View file
Original file line number Diff line number Diff line change
@@ -3,6 +3,9 @@
require '../../includes/csrf.php';

require_once '../../includes/functions.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';

if (isset($_POST['interface'])) {
$int = preg_replace('/[^a-z0-9]/', '', $_POST['interface']);
4 changes: 3 additions & 1 deletion ajax/networking/get_netcfg.php
View file
Original file line number Diff line number Diff line change
@@ -2,8 +2,10 @@

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';

$interface = $_GET['iface'];
$interface = $_POST['iface'];

if (isset($interface)) {
// fetch dnsmasq.conf settings for interface
10 changes: 8 additions & 2 deletions ajax/networking/get_nl80211_band.php
View file
Original file line number Diff line number Diff line change
@@ -2,12 +2,19 @@

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';
require_once '../../includes/locale.php';

if (isset($_POST['interface'])) {

define( 'NL80211_BAND_24GHZ', 0x1 );
define( 'NL80211_BAND_5GHZ', 0x2 );

if(!preg_match('/^[a-zA-Z0-9]+$/', $_POST['interface'])) {
exit('Invalid interface name.');
}

$iface = escapeshellcmd($_POST['interface']);
$flags = 0;

@@ -17,7 +24,7 @@

// get frequencies supported by device
exec('iw '.$phy.' info | sed -rn "s/^.*\*\s([0-9]{4})\sMHz.*/\1/p"', $frequencies);

if (count(preg_grep('/^24[0-9]{2}/i', $frequencies)) >0) {
$flags += NL80211_BAND_24GHZ;
}
@@ -40,4 +47,3 @@
}
echo json_encode($msg);
}

3 changes: 2 additions & 1 deletion ajax/networking/get_wgcfg.php
View file
Original file line number Diff line number Diff line change
@@ -2,8 +2,9 @@

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';

// fetch wg client.conf
exec('sudo cat '. RASPI_WIREGUARD_PATH.'client.conf', $return);
echo implode(PHP_EOL,$return);

6 changes: 4 additions & 2 deletions ajax/networking/get_wgkey.php
View file
Original file line number Diff line number Diff line change
@@ -2,17 +2,19 @@

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';

$entity = escapeshellcmd($_POST['entity']);

if (isset($entity)) {

// generate public/private key pairs for entity
$pubkey = RASPI_WIREGUARD_PATH.$entity.'-public.key';
$privkey = RASPI_WIREGUARD_PATH.$entity.'-private.key';
$pubkey_tmp = '/tmp/'.$entity.'-public.key';
$privkey_tmp = '/tmp/'.$entity.'-private.key';

exec("sudo wg genkey | tee $privkey_tmp | wg pubkey > $pubkey_tmp", $return);
$wgdata['pubkey'] = str_replace("\n",'',file_get_contents($pubkey_tmp));
exec("sudo mv $privkey_tmp $privkey", $return);
4 changes: 3 additions & 1 deletion ajax/networking/wifi_stations.php
View file
Original file line number Diff line number Diff line change
@@ -2,6 +2,8 @@

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';
require_once '../../includes/defaults.php';
require_once '../../includes/functions.php';
require_once '../../includes/wifi_functions.php';
@@ -14,7 +16,7 @@
nearbyWifiStations($networks, !isset($_REQUEST["refresh"]));
connectedWifiStations($networks);
sortNetworksByRSSI($networks);
foreach ($networks as $ssid => $network) $networks[$ssid]["ssidutf8"] = ssid2utf8( $ssid );
foreach ($networks as $ssid => $network) $networks[$ssid]["ssidutf8"] = ssid2utf8( $ssid );

$connected = array_filter($networks, function($n) { return $n['connected']; } );
$known = array_filter($networks, function($n) { return !$n['connected'] && $n['configured']; } );
3 changes: 2 additions & 1 deletion ajax/openvpn/activate_ovpncfg.php
View file
Original file line number Diff line number Diff line change
@@ -2,6 +2,8 @@

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';
require_once '../../includes/functions.php';

if (isset($_POST['cfg_id'])) {
@@ -24,4 +26,3 @@

echo json_encode($return);
}

3 changes: 2 additions & 1 deletion ajax/openvpn/del_ovpncfg.php
View file
Original file line number Diff line number Diff line change
@@ -2,6 +2,8 @@

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';
require_once '../../includes/functions.php';

if (isset($_POST['cfg_id'])) {
@@ -11,4 +13,3 @@
$jsonData = ['return'=>$return];
echo json_encode($jsonData);
}

4 changes: 3 additions & 1 deletion ajax/system/sys_actions.php
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
<?php

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';

$action = escapeshellcmd($_POST['a']);

@@ -18,4 +21,3 @@
}
echo json_encode($response);
}

3 changes: 2 additions & 1 deletion ajax/system/sys_debug.php
View file
Original file line number Diff line number Diff line change
@@ -2,6 +2,8 @@

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';

if (isset($_POST['csrf_token'])) {
if (csrfValidateRequest() && !CSRFValidate()) {
@@ -20,4 +22,3 @@
} else {
handleInvalidCSRFToken();
}

5 changes: 3 additions & 2 deletions ajax/system/sys_get_logfile.php
View file
Original file line number Diff line number Diff line change
@@ -1,7 +1,9 @@
<?php
<?php

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';

$tempDir = sys_get_temp_dir();
$filePath = $tempDir . DIRECTORY_SEPARATOR . RASPI_DEBUG_LOG;
@@ -19,4 +21,3 @@
header('Location: '.'/system_info');
exit();
}

4 changes: 3 additions & 1 deletion ajax/system/sys_perform_update.php
View file
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
<?php

require '../../includes/csrf.php';
require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';

if (isset($_POST['csrf_token'])) {
if (csrfValidateRequest() && !CSRFValidate()) {
@@ -18,4 +21,3 @@
} else {
handleInvalidCSRFToken();
}

5 changes: 4 additions & 1 deletion ajax/system/sys_read_logfile.php
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
<?php

require_once '../../includes/config.php';
require_once '../../src/RaspAP/Auth/HTTPAuth.php';
require_once '../../includes/authenticate.php';

$logFile = '/tmp/raspap_install.log';
$searchStrings = [
'Configure update' => 1,
@@ -40,4 +44,3 @@
} else {
echo json_encode("File does not exist: $logFile");
}

3 changes: 2 additions & 1 deletion app/js/custom.js
View file
Original file line number Diff line number Diff line change
@@ -216,7 +216,8 @@ Option toggles are set dynamically depending on the loaded configuration
*/
function loadInterfaceDHCPSelect() {
var strInterface = $('#cbxdhcpiface').val();
$.get('ajax/networking/get_netcfg.php?iface='+strInterface,function(data){
var csrfToken = $('meta[name=csrf_token]').attr('content');
$.post('ajax/networking/get_netcfg.php', {'iface' : strInterface, 'csrf_token': csrfToken}, function(data){
jsonData = JSON.parse(data);
$('#dhcp-iface')[0].checked = jsonData.DHCPEnabled;
$('#txtipaddress').val(jsonData.StaticIP);