Merge pull request #6 from jrmhaig/master

A bugfix and adding authentication

README.md

@@ -59,11 +59,19 @@ Set the files ownership to `www-data` user.
 ```sh
 sudo chown -R www-data:www-data /var/www
 ```
+Move the RaspAP configuration file to the correct location
+```sh
+sudo mkdir /etc/raspad
+sudo mv /var/www/raspad.php /etc/raspad/
+sudo chown -R www-data:www-data /etc/raspad
+```
 Reboot and it should be up and running!
 ```sh
 sudo reboot
 ```
 
+The default username is 'admin' and the default password is 'secret'.
+
 ## Optional services
 OpenVPN and TOR are two additional services that run perfectly well on the RPi, and are a nice way to extend the usefulness of your WiFi router. I've started on interfaces to administer these services. Not everyone will need them, so for the moment they are disabled by default. You can enable them by changing these options in `index.php`:
 

includes/admin.php

@@ -0,0 +1,78 @@
+<?php
+
+function Status($message, $level='success', $dismissable=true) {
+	$status = '<div class="alert alert-'.$level;
+	if ($dismissable) $status .= ' alert-dismissable';
+	$status .= '">'.$message;
+	if ($dismissable) $status .= '<button type="button" class="close" data-dismiss="alert" aria-hidden="true">x</button>';
+	$status .= '</div>';
+
+	return $status;
+}
+
+function DisplayRaspAPConfig($username, $password){
+  $status = '';
+  if (isset($_POST['UpdateAdminPassword'])) {
+		if (password_verify($_POST['oldpass'], $password)) {
+			$new_username=trim($_POST['username']);
+			if ($_POST['newpass'] != $_POST['newpassagain']) {
+				$status = Status('New passwords do not match', 'danger');
+			} else if ($new_username == '') {
+				$status = Status('Username must not be empty', 'danger');
+			} else {
+				if ($auth_file = fopen(RASPI_ADMIN_DETAILS, 'w')) {
+					fwrite($auth_file, $new_username.PHP_EOL);
+					fwrite($auth_file, password_hash($_POST['newpass'], PASSWORD_BCRYPT).PHP_EOL);
+					fclose($auth_file);
+					$username = $new_username;
+					$status = Status('Admin password updated');
+				} else {
+					$status = Status('Failed to update admin password', 'danger');
+				}
+			}
+		} else {
+			$status = Status('Old password does not match', 'danger');
+		}
+  }
+?>
+	<div class="row">
+		<div class="col-lg-12">
+			<div class="panel panel-primary">
+				<div class="panel-heading"><i class="fa fa-dashboard fa-fw"></i>RaspAP Configuration</div>
+				<div class="panel-body">
+					<p><?php echo $status; ?></p>
+					<form role="form" action="/?page=admin_conf" method="POST">
+						<div class="row">
+							<div class="form-group col-md-4">
+								<label for="username">Username</label>
+								<input type="text" class="form-control" name="username" value="<?php echo $username; ?>"/>
+							</div>
+						</div>
+						<div class="row">
+							<div class="form-group col-md-4">
+								<label for="password">Old password</label>
+								<input type="password" class="form-control" name="oldpass"/>
+							</div>
+						</div>
+						<div class="row">
+							<div class="form-group col-md-4">
+								<label for="password">New password</label>
+								<input type="password" class="form-control" name="newpass"/>
+							</div>
+						</div>
+						<div class="row">
+							<div class="form-group col-md-4">
+								<label for="password">Repeat new password</label>
+								<input type="password" class="form-control" name="newpassagain"/>
+							</div>
+						</div>
+						<input type="submit" class="btn btn-outline btn-primary" name="UpdateAdminPassword" value="Save settings" />
+					</form>
+				</div><!-- /.panel-body -->
+			</div><!-- /.panel-default -->
+		</div><!-- /.col-lg-12 -->
+	</div><!-- /.row -->
+<?php 
+}
+
+?>

includes/authenticate.php

@@ -0,0 +1,13 @@
+<?php
+$user = $_SERVER['PHP_AUTH_USER'];
+$pass = $_SERVER['PHP_AUTH_PW'];
+
+$validated = ($user == $config['admin_user']) && password_verify($pass, $config['admin_pass']);
+
+if (!$validated) {
+  header('WWW-Authenticate: Basic realm="RaspAP"');
+  header('HTTP/1.0 401 Unauthorized');
+  die ("Not authorized");
+}
+
+?>

includes/functions.php

@@ -988,27 +988,20 @@ function DisplayTorProxyConfig(){
 */
 function SaveHostAPDConfig(){
 	if( isset($_POST['SaveHostAPDSettings']) ) {
-		$config = 'driver=nl80211
+		$config = 'driver=nl80211'.PHP_EOL
-		ctrl_interface='. RASPI_HOSTAPD_CTRL_INTERFACE .'
+			.'ctrl_interface='.RASPI_HOSTAPD_CTRL_INTERFACE.PHP_EOL
-		ctrl_interface_group=0
+			.'ctrl_interface_group=0'.PHP_EOL
-		beacon_int=100
+			.'beacon_int=100'.PHP_EOL
-		auth_algs=1
+			.'auth_algs=1'.PHP_EOL
-		wpa_key_mgmt=WPA-PSK';
+			.'wpa_key_mgmt=WPA-PSK'.PHP_EOL;
 
-		$config .= "interface=".$_POST['interface']."
+		$config .= "interface=".$_POST['interface'].PHP_EOL;
-		";
+		$config .= "ssid=".$_POST['ssid'].PHP_EOL;
-		$config .= "ssid=".$_POST['ssid']."
+		$config .= "hw_mode=".$_POST['hw_mode'].PHP_EOL;
-		";
+		$config .= "channel=".$_POST['channel'].PHP_EOL;
-		$config .= "hw_mode=".$_POST['hw_mode']."
+		$config .= "wpa=".$_POST['wpa'].PHP_EOL;
-		";
+		$config .='wpa_passphrase='.$_POST['wpa_passphrase'].PHP_EOL;
-		$config .= "channel=".$_POST['channel']."
+		$config .="wpa_pairwise=".$_POST['wpa_pairwise'].PHP_EOL;
-		";
-		$config .= "wpa=".$_POST['wpa']."
-		";
-		$config .='wpa_passphrase='.$_POST['wpa_passphrase'].'
-		';
-		$config .="wpa_pairwise=".$_POST['wpa_pairwise']."
-		";
 		$config .="country_code=".$_POST['country_code'];
 
 		exec( "echo '$config' > /tmp/hostapddata", $return );

index.php

@@ -20,6 +20,9 @@
  * @see        http://sirlagz.net/2013/02/08/raspap-webgui/
  */
 
+define('RASPI_CONFIG', '/etc/raspap');
+define('RASPI_ADMIN_DETAILS', RASPI_CONFIG.'/raspap.auth');
+
 // Constants for configuration file paths.
 // These are typical for default RPi installs. Modify if needed.
 define('RASPI_DNSMASQ_CONFIG', '/etc/dnsmasq.conf');
@@ -36,6 +39,9 @@ define('RASPI_TORPROXY_CONFIG', '/etc/tor/torrc');
 define('RASPI_OPENVPN_ENABLED', false );
 define('RASPI_TORPROXY_ENABLED', false );
 
+include_once( RASPI_CONFIG.'/raspap.php' );
+include_once( 'includes/authenticate.php' );
+include_once( 'includes/admin.php' );
 include_once( 'includes/functions.php' );
 
 $output = $return = 0;
@@ -94,7 +100,7 @@ $page = $_GET['page'];
 	                <span class="icon-bar"></span>
 	                <span class="icon-bar"></span>
 	            </button>
-	            <a class="navbar-brand" href="index.html">RaspAP Wifi Portal v1.0</a>
+	            <a class="navbar-brand" href="index.php">RaspAP Wifi Portal v1.0</a>
 			</div>
 			<!-- /.navbar-header -->
 
@@ -124,6 +130,9 @@ $page = $_GET['page'];
 	                        <a href="index.php?page=torproxy_conf"><i class="fa fa-eye-slash fa-fw"></i> Configure TOR proxy</a>
 	                    </li>
 	                	<?php endif; ?>
+	                    <li>
+	                        <a href="index.php?page=admin_conf"><i class="fa fa-dashboard fa-fw"></i> Configure RaspAP</a>
+	                    </li>
 	                </ul>
 	            </div><!-- /.navbar-collapse -->
 	        </div><!-- /.navbar-default -->
@@ -161,6 +170,9 @@ $page = $_GET['page'];
 				case "torproxy_conf":
 					DisplayTorProxyConfig();
 					break;
+				case "admin_conf":
+					DisplayRaspAPConfig($config['admin_user'], $config['admin_pass']);
+					break;
 				case "save_hostapd_conf":
 					SaveHostAPDConfig();
 					break;

raspap.php

@@ -0,0 +1,14 @@
+<?php
+
+$config = array(
+  'admin_user' => 'admin',
+  'admin_pass' => '$2y$10$YKIyWAmnQLtiJAy6QgHQ.eCpY4m.HCEbiHaTgN6.acNC6bDElzt.i'
+);
+
+if ( $auth_details = fopen(RASPI_CONFIG.'/raspap.auth', 'r') ) {
+  $config['admin_user'] = trim(fgets($auth_details));
+  $config['admin_pass'] = trim(fgets($auth_details));
+  fclose($auth_details);
+}
+
+?>