1
0
mirror of https://github.com/billz/raspap-webgui.git synced 2023-10-10 13:37:24 +02:00

Merge pull request #6 from jrmhaig/master

A bugfix and adding authentication
This commit is contained in:
Bill Zimmerman 2016-06-01 21:14:27 +02:00
commit 250d1f58be
6 changed files with 139 additions and 21 deletions

View File

@ -59,11 +59,19 @@ Set the files ownership to `www-data` user.
```sh ```sh
sudo chown -R www-data:www-data /var/www sudo chown -R www-data:www-data /var/www
``` ```
Move the RaspAP configuration file to the correct location
```sh
sudo mkdir /etc/raspad
sudo mv /var/www/raspad.php /etc/raspad/
sudo chown -R www-data:www-data /etc/raspad
```
Reboot and it should be up and running! Reboot and it should be up and running!
```sh ```sh
sudo reboot sudo reboot
``` ```
The default username is 'admin' and the default password is 'secret'.
## Optional services ## Optional services
OpenVPN and TOR are two additional services that run perfectly well on the RPi, and are a nice way to extend the usefulness of your WiFi router. I've started on interfaces to administer these services. Not everyone will need them, so for the moment they are disabled by default. You can enable them by changing these options in `index.php`: OpenVPN and TOR are two additional services that run perfectly well on the RPi, and are a nice way to extend the usefulness of your WiFi router. I've started on interfaces to administer these services. Not everyone will need them, so for the moment they are disabled by default. You can enable them by changing these options in `index.php`:

78
includes/admin.php Executable file
View File

@ -0,0 +1,78 @@
<?php
function Status($message, $level='success', $dismissable=true) {
$status = '<div class="alert alert-'.$level;
if ($dismissable) $status .= ' alert-dismissable';
$status .= '">'.$message;
if ($dismissable) $status .= '<button type="button" class="close" data-dismiss="alert" aria-hidden="true">x</button>';
$status .= '</div>';
return $status;
}
function DisplayRaspAPConfig($username, $password){
$status = '';
if (isset($_POST['UpdateAdminPassword'])) {
if (password_verify($_POST['oldpass'], $password)) {
$new_username=trim($_POST['username']);
if ($_POST['newpass'] != $_POST['newpassagain']) {
$status = Status('New passwords do not match', 'danger');
} else if ($new_username == '') {
$status = Status('Username must not be empty', 'danger');
} else {
if ($auth_file = fopen(RASPI_ADMIN_DETAILS, 'w')) {
fwrite($auth_file, $new_username.PHP_EOL);
fwrite($auth_file, password_hash($_POST['newpass'], PASSWORD_BCRYPT).PHP_EOL);
fclose($auth_file);
$username = $new_username;
$status = Status('Admin password updated');
} else {
$status = Status('Failed to update admin password', 'danger');
}
}
} else {
$status = Status('Old password does not match', 'danger');
}
}
?>
<div class="row">
<div class="col-lg-12">
<div class="panel panel-primary">
<div class="panel-heading"><i class="fa fa-dashboard fa-fw"></i>RaspAP Configuration</div>
<div class="panel-body">
<p><?php echo $status; ?></p>
<form role="form" action="/?page=admin_conf" method="POST">
<div class="row">
<div class="form-group col-md-4">
<label for="username">Username</label>
<input type="text" class="form-control" name="username" value="<?php echo $username; ?>"/>
</div>
</div>
<div class="row">
<div class="form-group col-md-4">
<label for="password">Old password</label>
<input type="password" class="form-control" name="oldpass"/>
</div>
</div>
<div class="row">
<div class="form-group col-md-4">
<label for="password">New password</label>
<input type="password" class="form-control" name="newpass"/>
</div>
</div>
<div class="row">
<div class="form-group col-md-4">
<label for="password">Repeat new password</label>
<input type="password" class="form-control" name="newpassagain"/>
</div>
</div>
<input type="submit" class="btn btn-outline btn-primary" name="UpdateAdminPassword" value="Save settings" />
</form>
</div><!-- /.panel-body -->
</div><!-- /.panel-default -->
</div><!-- /.col-lg-12 -->
</div><!-- /.row -->
<?php
}
?>

13
includes/authenticate.php Normal file
View File

@ -0,0 +1,13 @@
<?php
$user = $_SERVER['PHP_AUTH_USER'];
$pass = $_SERVER['PHP_AUTH_PW'];
$validated = ($user == $config['admin_user']) && password_verify($pass, $config['admin_pass']);
if (!$validated) {
header('WWW-Authenticate: Basic realm="RaspAP"');
header('HTTP/1.0 401 Unauthorized');
die ("Not authorized");
}
?>

View File

@ -988,27 +988,20 @@ function DisplayTorProxyConfig(){
*/ */
function SaveHostAPDConfig(){ function SaveHostAPDConfig(){
if( isset($_POST['SaveHostAPDSettings']) ) { if( isset($_POST['SaveHostAPDSettings']) ) {
$config = 'driver=nl80211 $config = 'driver=nl80211'.PHP_EOL
ctrl_interface='. RASPI_HOSTAPD_CTRL_INTERFACE .' .'ctrl_interface='.RASPI_HOSTAPD_CTRL_INTERFACE.PHP_EOL
ctrl_interface_group=0 .'ctrl_interface_group=0'.PHP_EOL
beacon_int=100 .'beacon_int=100'.PHP_EOL
auth_algs=1 .'auth_algs=1'.PHP_EOL
wpa_key_mgmt=WPA-PSK'; .'wpa_key_mgmt=WPA-PSK'.PHP_EOL;
$config .= "interface=".$_POST['interface']." $config .= "interface=".$_POST['interface'].PHP_EOL;
"; $config .= "ssid=".$_POST['ssid'].PHP_EOL;
$config .= "ssid=".$_POST['ssid']." $config .= "hw_mode=".$_POST['hw_mode'].PHP_EOL;
"; $config .= "channel=".$_POST['channel'].PHP_EOL;
$config .= "hw_mode=".$_POST['hw_mode']." $config .= "wpa=".$_POST['wpa'].PHP_EOL;
"; $config .='wpa_passphrase='.$_POST['wpa_passphrase'].PHP_EOL;
$config .= "channel=".$_POST['channel']." $config .="wpa_pairwise=".$_POST['wpa_pairwise'].PHP_EOL;
";
$config .= "wpa=".$_POST['wpa']."
";
$config .='wpa_passphrase='.$_POST['wpa_passphrase'].'
';
$config .="wpa_pairwise=".$_POST['wpa_pairwise']."
";
$config .="country_code=".$_POST['country_code']; $config .="country_code=".$_POST['country_code'];
exec( "echo '$config' > /tmp/hostapddata", $return ); exec( "echo '$config' > /tmp/hostapddata", $return );

View File

@ -20,6 +20,9 @@
* @see http://sirlagz.net/2013/02/08/raspap-webgui/ * @see http://sirlagz.net/2013/02/08/raspap-webgui/
*/ */
define('RASPI_CONFIG', '/etc/raspap');
define('RASPI_ADMIN_DETAILS', RASPI_CONFIG.'/raspap.auth');
// Constants for configuration file paths. // Constants for configuration file paths.
// These are typical for default RPi installs. Modify if needed. // These are typical for default RPi installs. Modify if needed.
define('RASPI_DNSMASQ_CONFIG', '/etc/dnsmasq.conf'); define('RASPI_DNSMASQ_CONFIG', '/etc/dnsmasq.conf');
@ -36,6 +39,9 @@ define('RASPI_TORPROXY_CONFIG', '/etc/tor/torrc');
define('RASPI_OPENVPN_ENABLED', false ); define('RASPI_OPENVPN_ENABLED', false );
define('RASPI_TORPROXY_ENABLED', false ); define('RASPI_TORPROXY_ENABLED', false );
include_once( RASPI_CONFIG.'/raspap.php' );
include_once( 'includes/authenticate.php' );
include_once( 'includes/admin.php' );
include_once( 'includes/functions.php' ); include_once( 'includes/functions.php' );
$output = $return = 0; $output = $return = 0;
@ -94,7 +100,7 @@ $page = $_GET['page'];
<span class="icon-bar"></span> <span class="icon-bar"></span>
<span class="icon-bar"></span> <span class="icon-bar"></span>
</button> </button>
<a class="navbar-brand" href="index.html">RaspAP Wifi Portal v1.0</a> <a class="navbar-brand" href="index.php">RaspAP Wifi Portal v1.0</a>
</div> </div>
<!-- /.navbar-header --> <!-- /.navbar-header -->
@ -124,6 +130,9 @@ $page = $_GET['page'];
<a href="index.php?page=torproxy_conf"><i class="fa fa-eye-slash fa-fw"></i> Configure TOR proxy</a> <a href="index.php?page=torproxy_conf"><i class="fa fa-eye-slash fa-fw"></i> Configure TOR proxy</a>
</li> </li>
<?php endif; ?> <?php endif; ?>
<li>
<a href="index.php?page=admin_conf"><i class="fa fa-dashboard fa-fw"></i> Configure RaspAP</a>
</li>
</ul> </ul>
</div><!-- /.navbar-collapse --> </div><!-- /.navbar-collapse -->
</div><!-- /.navbar-default --> </div><!-- /.navbar-default -->
@ -161,6 +170,9 @@ $page = $_GET['page'];
case "torproxy_conf": case "torproxy_conf":
DisplayTorProxyConfig(); DisplayTorProxyConfig();
break; break;
case "admin_conf":
DisplayRaspAPConfig($config['admin_user'], $config['admin_pass']);
break;
case "save_hostapd_conf": case "save_hostapd_conf":
SaveHostAPDConfig(); SaveHostAPDConfig();
break; break;

14
raspap.php Normal file
View File

@ -0,0 +1,14 @@
<?php
$config = array(
'admin_user' => 'admin',
'admin_pass' => '$2y$10$YKIyWAmnQLtiJAy6QgHQ.eCpY4m.HCEbiHaTgN6.acNC6bDElzt.i'
);
if ( $auth_details = fopen(RASPI_CONFIG.'/raspap.auth', 'r') ) {
$config['admin_user'] = trim(fgets($auth_details));
$config['admin_pass'] = trim(fgets($auth_details));
fclose($auth_details);
}
?>