mirror of
https://github.com/billz/raspap-webgui.git
synced 2023-10-10 13:37:24 +02:00
Add CSRF to hostapd config
And tidy things up a bit
This commit is contained in:
Joe Haig
parent
15a4ece433
commit
671016e685
@ -20,6 +20,35 @@ function CSRFValidate() {
|
|||||||
return hash_equals($_POST['csrf_token'], $_SESSION['csrf_token']);
|
return hash_equals($_POST['csrf_token'], $_SESSION['csrf_token']);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Test whether array is associative
|
||||||
|
*/
|
||||||
|
function isAssoc($arr) {
|
||||||
|
return array_keys($arr) !== range(0, count($arr) - 1);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
*
|
||||||
|
* Display a selector field for a form. Arguments are:
|
||||||
|
* $name: Field name
|
||||||
|
* $options: Array of options
|
||||||
|
* $selected: Selected option (optional)
|
||||||
|
* If $options is an associative array this should be the key
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
function SelectorOptions($name, $options, $selected = null) {
|
||||||
|
echo "<select class=\"form-control\" name=\"$name\">";
|
||||||
|
foreach ( $options as $opt => $label) {
|
||||||
|
$select = '';
|
||||||
|
$key = isAssoc($options) ? $opt : $label;
|
||||||
|
if( $key == $selected ) {
|
||||||
|
$select = " selected";
|
||||||
|
}
|
||||||
|
echo "<option value=\"$key\"$select>$label</options>";
|
||||||
|
}
|
||||||
|
echo "</select>";
|
||||||
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
*
|
*
|
||||||
* @param string $input
|
* @param string $input
|
||||||
|
|||||||
@ -1,19 +1,73 @@
|
|||||||
<?php
|
<?php
|
||||||
|
|
||||||
|
include_once( 'includes/status_messages.php' );
|
||||||
|
|
||||||
/**
|
/**
|
||||||
*
|
*
|
||||||
*
|
*
|
||||||
*/
|
*/
|
||||||
function DisplayHostAPDConfig(){
|
function DisplayHostAPDConfig(){
|
||||||
|
|
||||||
|
$status = new StatusMessages();
|
||||||
|
|
||||||
|
if( isset($_POST['SaveHostAPDSettings']) ) {
|
||||||
|
if (CSRFValidate()) {
|
||||||
|
$config = 'driver=nl80211'.PHP_EOL
|
||||||
|
.'ctrl_interface='.RASPI_HOSTAPD_CTRL_INTERFACE.PHP_EOL
|
||||||
|
.'ctrl_interface_group=0'.PHP_EOL
|
||||||
|
.'beacon_int=100'.PHP_EOL
|
||||||
|
.'auth_algs=1'.PHP_EOL
|
||||||
|
.'wpa_key_mgmt=WPA-PSK'.PHP_EOL;
|
||||||
|
|
||||||
|
$config .= "interface=".$_POST['interface'].PHP_EOL;
|
||||||
|
$config .= "ssid=".$_POST['ssid'].PHP_EOL;
|
||||||
|
$config .= "hw_mode=".$_POST['hw_mode'].PHP_EOL;
|
||||||
|
$config .= "channel=".$_POST['channel'].PHP_EOL;
|
||||||
|
$config .= "wpa=".$_POST['wpa'].PHP_EOL;
|
||||||
|
$config .='wpa_passphrase='.$_POST['wpa_passphrase'].PHP_EOL;
|
||||||
|
$config .="wpa_pairwise=".$_POST['wpa_pairwise'].PHP_EOL;
|
||||||
|
$config .="country_code=".$_POST['country_code'];
|
||||||
|
|
||||||
|
exec( "echo '$config' > /tmp/hostapddata", $return );
|
||||||
|
system( "sudo cp /tmp/hostapddata " . RASPI_HOSTAPD_CONFIG, $return );
|
||||||
|
|
||||||
|
if( $return == 0 ) {
|
||||||
|
$status->addMessage('Wifi Hotspot settings saved', 'success');
|
||||||
|
} else {
|
||||||
|
$status->addMessage('Wifi Hotspot settings failed to be saved', 'danger');
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
error_log('CSRF violation');
|
||||||
|
}
|
||||||
|
} elseif( isset($_POST['StartHotspot']) ) {
|
||||||
|
if (CSRFValidate()) {
|
||||||
|
$status->addMessage('Attempting to start hotspot', 'info');
|
||||||
|
exec( 'sudo /etc/init.d/hostapd start', $return );
|
||||||
|
foreach( $return as $line ) {
|
||||||
|
$status->addMessage($line, 'info');
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
error_log('CSRF violation');
|
||||||
|
}
|
||||||
|
} elseif( isset($_POST['StopHotspot']) ) {
|
||||||
|
if (CSRFValidate()) {
|
||||||
|
$status->addMessage('Attempting to stop hotspot', 'info');
|
||||||
|
exec( 'sudo /etc/init.d/hostapd stop', $return );
|
||||||
|
foreach( $return as $line ) {
|
||||||
|
$status->addMessage($line, 'info');
|
||||||
|
}
|
||||||
|
} else {
|
||||||
|
error_log('CSRF violation');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
exec( 'cat '. RASPI_HOSTAPD_CONFIG, $return );
|
exec( 'cat '. RASPI_HOSTAPD_CONFIG, $return );
|
||||||
exec( 'pidof hostapd | wc -l', $hostapdstatus);
|
exec( 'pidof hostapd | wc -l', $hostapdstatus);
|
||||||
|
|
||||||
if( $hostapdstatus[0] == 0 ) {
|
if( $hostapdstatus[0] == 0 ) {
|
||||||
$status = '<div class="alert alert-warning alert-dismissable">HostAPD is not running
|
$status->addMessage('HostAPD is not running', 'warning');
|
||||||
<button type="button" class="close" data-dismiss="alert" aria-hidden="true">×</button></div>';
|
|
||||||
} else {
|
} else {
|
||||||
$status = '<div class="alert alert-success alert-dismissable">HostAPD is running
|
$status->addMessage('HostAPD is running', 'success');
|
||||||
<button type="button" class="close" data-dismiss="alert" aria-hidden="true">×</button></div>';
|
|
||||||
}
|
}
|
||||||
|
|
||||||
$arrConfig = array();
|
$arrConfig = array();
|
||||||
@ -29,148 +83,111 @@ function DisplayHostAPDConfig(){
|
|||||||
};
|
};
|
||||||
?>
|
?>
|
||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="col-lg-12">
|
<div class="col-lg-12">
|
||||||
<div class="panel panel-primary">
|
<div class="panel panel-primary">
|
||||||
<div class="panel-heading"><i class="fa fa-dot-circle-o fa-fw"></i> Configure hotspot
|
<div class="panel-heading"><i class="fa fa-dot-circle-o fa-fw"></i> Configure hotspot</div>
|
||||||
</div>
|
|
||||||
<!-- /.panel-heading -->
|
<!-- /.panel-heading -->
|
||||||
<div class="panel-body">
|
<div class="panel-body">
|
||||||
<!-- Nav tabs -->
|
<form role="form" action="/?page=hostapd_conf" method="POST">
|
||||||
|
<!-- Nav tabs -->
|
||||||
<ul class="nav nav-tabs">
|
<ul class="nav nav-tabs">
|
||||||
<li class="active"><a href="#basic" data-toggle="tab">Basic</a>
|
<li class="active"><a href="#basic" data-toggle="tab">Basic</a></li>
|
||||||
</li>
|
<li><a href="#security" data-toggle="tab">Security</a></li>
|
||||||
<li><a href="#security" data-toggle="tab">Security</a>
|
<li><a href="#advanced" data-toggle="tab">Advanced</a></li>
|
||||||
</li>
|
|
||||||
<li><a href="#advanced" data-toggle="tab">Advanced</a>
|
|
||||||
</li>
|
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
<!-- Tab panes -->
|
<!-- Tab panes -->
|
||||||
<div class="tab-content">
|
<div class="tab-content">
|
||||||
<p><?php echo $status; ?></p>
|
<p><?php $status->showMessages(); ?></p>
|
||||||
<div class="tab-pane fade in active" id="basic">
|
<div class="tab-pane fade in active" id="basic">
|
||||||
|
|
||||||
<h4>Basic settings</h4>
|
<h4>Basic settings</h4>
|
||||||
<form role="form" action="/?page=save_hostapd_conf" method="POST">
|
<?php CSRFToken() ?>
|
||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="form-group col-md-4">
|
<div class="form-group col-md-4">
|
||||||
<label for="code">Interface</label>
|
<label for="code">Interface</label>
|
||||||
<select class="form-control" name="interface">
|
<?php
|
||||||
<?php
|
exec("ip -o link show | awk -F': ' '{print $2}'", $interfaces);
|
||||||
exec("ip -o link show | awk -F': ' '{print $2}'", $interfaces);
|
SelectorOptions('interface', $interfaces, $arrConfig['interface']);
|
||||||
foreach( $interfaces as $int ) {
|
?>
|
||||||
$select = '';
|
</div>
|
||||||
if( $int == $arrConfig['interface'] ) {
|
</div>
|
||||||
$select = " selected";
|
<div class="row">
|
||||||
}
|
<div class="form-group col-md-4">
|
||||||
echo '<option value="'.$int.'"'.$select.'>'.$int.'</option>';
|
<label for="code">SSID</label>
|
||||||
}
|
<input type="text" class="form-control" name="ssid" value="<?php echo $arrConfig['ssid']; ?>" />
|
||||||
?>
|
</div>
|
||||||
</select>
|
</div>
|
||||||
</div>
|
<div class="row">
|
||||||
</div>
|
<div class="form-group col-md-4">
|
||||||
<div class="row">
|
<label for="code">Wireless Mode</label>
|
||||||
<div class="form-group col-md-4">
|
<?php SelectorOptions('hw_mode', $arrChannel, $arrConfig['hw_mode']); ?>
|
||||||
<label for="code">SSID</label>
|
</div>
|
||||||
<input type="text" class="form-control" name="ssid" value="<?php echo $arrConfig['ssid']; ?>" />
|
</div>
|
||||||
</div>
|
<div class="row">
|
||||||
</div>
|
<div class="form-group col-md-4">
|
||||||
<div class="row">
|
<label for="code">Channel</label>
|
||||||
<div class="form-group col-md-4">
|
<?php SelectorOptions('channel', range(1, 14), intval($arrConfig['channel'])) ?>
|
||||||
<label for="code">Wireless Mode</label>
|
</div>
|
||||||
<select class="form-control" name="hw_mode">
|
</div>
|
||||||
<?php
|
</div>
|
||||||
foreach( $arrChannel as $Mode ) {
|
<div class="tab-pane fade" id="security">
|
||||||
$select = '';
|
|
||||||
if( $arrConfig['hw_mode'] == $Mode ) {
|
|
||||||
$select = ' selected';
|
|
||||||
}
|
|
||||||
echo '<option value="'.$Mode.'"'.$select.'>'.$Mode.'</option>';
|
|
||||||
}
|
|
||||||
?>
|
|
||||||
</select>
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
<div class="row">
|
|
||||||
<div class="form-group col-md-4">
|
|
||||||
<label for="code">Channel</label>
|
|
||||||
<select class="form-control" name="channel">'
|
|
||||||
<?php
|
|
||||||
for( $channel = 1; $channel < 14; $channel++ ) {
|
|
||||||
$select = '';
|
|
||||||
if( $channel == $arrConfig['channel'] ) {
|
|
||||||
$select = " selected";
|
|
||||||
}
|
|
||||||
echo '<option value="'.$channel.'"'.$select.'>'.$channel.'</option>';
|
|
||||||
}
|
|
||||||
?>
|
|
||||||
</select>
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
<div class="tab-pane fade" id="security">
|
|
||||||
<h4>Security settings</h4>
|
<h4>Security settings</h4>
|
||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="form-group col-md-4">
|
<div class="form-group col-md-4">
|
||||||
<label for="code">Security type</label>
|
<label for="code">Security type</label>
|
||||||
<select class="form-control" name="wpa">
|
<?php SelectorOptions('wpa', $arrSecurity, $arrConfig['wpa']); ?>
|
||||||
<?php
|
</div>
|
||||||
foreach( $arrSecurity as $SecVal => $SecMode ) {
|
</div>
|
||||||
$select = '';
|
<div class="row">
|
||||||
if( $SecVal == $arrConfig['wpa'] ) {
|
<div class="form-group col-md-4">
|
||||||
$select = ' selected';
|
<label for="code">Encryption Type</label>
|
||||||
}
|
<?php
|
||||||
echo '<option value="'.$SecVal.'"'.$select.'>'.$SecMode.'</option>';
|
/*
|
||||||
}
|
* NB, the original tests $arrConfig['wpa_pairwise'] against
|
||||||
?>
|
* the value in the $arrEncType array rather than the key. I
|
||||||
</select>
|
* think there must be something wrong in the case of
|
||||||
</div>
|
* 'TKIP CCMP' => 'TKIP+CCMP' but I am not yet sure what
|
||||||
</div>
|
* exactly is correct.
|
||||||
<div class="row">
|
* At I read it, 'TKIP CCMP' would get written to the
|
||||||
<div class="form-group col-md-4">
|
* hostapd.conf file when it is saved but the correct option
|
||||||
<label for="code">Encryption Type</label>
|
* would only be selected if it reads 'TKIP+CCMP'. This is
|
||||||
<select class="form-control" name="wpa_pairwise">
|
* clearly broken.
|
||||||
<?php
|
* Now it is consistent, albeit possibly still broken.
|
||||||
foreach( $arrEncType as $EncConf => $Enc ) {
|
*/
|
||||||
$select = '';
|
?>
|
||||||
if( $Enc == $arrConfig['wpa_pairwise'] ) {
|
<?php SelectorOptions('wpa_pairwise', $arrEncType, $arrConfig['wpa_pairwise']); ?>
|
||||||
$select = ' selected';
|
</div>
|
||||||
}
|
</div>
|
||||||
echo '<option value="'.$EncConf.'"'.$select.'>'.$Enc.'</option>';
|
<div class="row">
|
||||||
} ?>
|
<div class="form-group col-md-4">
|
||||||
</select>
|
<label for="code">PSK</label>
|
||||||
</div>
|
<input type="text" class="form-control" name="wpa_passphrase" value="<?php echo $arrConfig['wpa_passphrase'] ?>" />
|
||||||
</div>
|
</div>
|
||||||
<div class="row">
|
</div>
|
||||||
<div class="form-group col-md-4">
|
|
||||||
<label for="code">PSK</label>
|
|
||||||
<input type="text" class="form-control" name="wpa_passphrase" value="<?php echo $arrConfig['wpa_passphrase'] ?>" />
|
|
||||||
</div>
|
|
||||||
</div>
|
|
||||||
</div>
|
</div>
|
||||||
<div class="tab-pane fade in" id="advanced">
|
<div class="tab-pane fade" id="advanced">
|
||||||
<h4>Advanced settings</h4>
|
<h4>Advanced settings</h4>
|
||||||
<div class="row">
|
<div class="row">
|
||||||
<div class="form-group col-md-4">
|
<div class="form-group col-md-4">
|
||||||
<label for="code">Country Code</label>
|
<label for="code">Country Code</label>
|
||||||
<input type="text" class="form-control" name="country_code" value="<?php echo $arrConfig['country_code'] ?>" />
|
<input type="text" class="form-control" name="country_code" value="<?php echo $arrConfig['country_code'] ?>" />
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div>
|
||||||
</div>
|
</div><!-- ./ Panel body -->
|
||||||
|
|
||||||
<input type="submit" class="btn btn-outline btn-primary" name="SaveHostAPDSettings" value="Save settings" />
|
<input type="submit" class="btn btn-outline btn-primary" name="SaveHostAPDSettings" value="Save settings" />
|
||||||
<?php
|
<?php
|
||||||
if($hostapdstatus[0] == 0) {
|
if($hostapdstatus[0] == 0) {
|
||||||
echo '<input type="submit" class="btn btn-success" name="StartHotspot" value="Start hotspot" />';
|
echo '<input type="submit" class="btn btn-success" name="StartHotspot" value="Start hotspot" />';
|
||||||
} else {
|
} else {
|
||||||
echo '<input type="submit" class="btn btn-warning" name="StopHotspot" value="Stop hotspot" />';
|
echo '<input type="submit" class="btn btn-warning" name="StopHotspot" value="Stop hotspot" />';
|
||||||
};
|
};
|
||||||
?>
|
?>
|
||||||
</form>
|
</form>
|
||||||
</div><!-- ./ Panel body -->
|
</div><!-- /.panel-primary -->
|
||||||
</div><!-- /.panel-primary -->
|
|
||||||
<div class="panel-footer"> Information provided by hostapd</div>
|
<div class="panel-footer"> Information provided by hostapd</div>
|
||||||
</div><!-- /.col-lg-12 -->
|
</div><!-- /.col-lg-12 -->
|
||||||
</div><!-- /.row -->
|
</div><!-- /.row -->
|
||||||
<?php
|
<?php
|
||||||
}
|
}
|
||||||
@ -179,50 +196,14 @@ function DisplayHostAPDConfig(){
|
|||||||
|
|
||||||
/**
|
/**
|
||||||
*
|
*
|
||||||
|
* NB This function is also used for TOR and VPN so don't completely delete
|
||||||
*
|
*
|
||||||
*/
|
*/
|
||||||
function SaveHostAPDConfig(){
|
function SaveHostAPDConfig(){
|
||||||
if( isset($_POST['SaveHostAPDSettings']) ) {
|
if( isset($_POST['SaveOpenVPNSettings']) ) {
|
||||||
$config = 'driver=nl80211'.PHP_EOL
|
|
||||||
.'ctrl_interface='.RASPI_HOSTAPD_CTRL_INTERFACE.PHP_EOL
|
|
||||||
.'ctrl_interface_group=0'.PHP_EOL
|
|
||||||
.'beacon_int=100'.PHP_EOL
|
|
||||||
.'auth_algs=1'.PHP_EOL
|
|
||||||
.'wpa_key_mgmt=WPA-PSK'.PHP_EOL;
|
|
||||||
|
|
||||||
$config .= "interface=".$_POST['interface'].PHP_EOL;
|
|
||||||
$config .= "ssid=".$_POST['ssid'].PHP_EOL;
|
|
||||||
$config .= "hw_mode=".$_POST['hw_mode'].PHP_EOL;
|
|
||||||
$config .= "channel=".$_POST['channel'].PHP_EOL;
|
|
||||||
$config .= "wpa=".$_POST['wpa'].PHP_EOL;
|
|
||||||
$config .='wpa_passphrase='.$_POST['wpa_passphrase'].PHP_EOL;
|
|
||||||
$config .="wpa_pairwise=".$_POST['wpa_pairwise'].PHP_EOL;
|
|
||||||
$config .="country_code=".$_POST['country_code'];
|
|
||||||
|
|
||||||
exec( "echo '$config' > /tmp/hostapddata", $return );
|
|
||||||
system( "sudo cp /tmp/hostapddata " . RASPI_HOSTAPD_CONFIG, $return );
|
|
||||||
|
|
||||||
if( $return == 0 ) {
|
|
||||||
echo "Wifi Hotspot settings saved";
|
|
||||||
} else {
|
|
||||||
echo "Wifi Hotspot settings failed to be saved";
|
|
||||||
}
|
|
||||||
} elseif( isset($_POST['SaveOpenVPNSettings']) ) {
|
|
||||||
// TODO
|
// TODO
|
||||||
} elseif( isset($_POST['SaveTORProxySettings']) ) {
|
} elseif( isset($_POST['SaveTORProxySettings']) ) {
|
||||||
// TODO
|
// TODO
|
||||||
} elseif( isset($_POST['StartHotspot']) ) {
|
|
||||||
echo "Attempting to start hotspot";
|
|
||||||
exec( 'sudo /etc/init.d/hostapd start', $return );
|
|
||||||
foreach( $return as $line ) {
|
|
||||||
echo $line."<br />";
|
|
||||||
}
|
|
||||||
} elseif( isset($_POST['StopHotspot']) ) {
|
|
||||||
echo "Attempting to stop hotspot";
|
|
||||||
exec( 'sudo /etc/init.d/hostapd stop', $return );
|
|
||||||
foreach( $return as $line ) {
|
|
||||||
echo $line."<br />";
|
|
||||||
}
|
|
||||||
} elseif( isset($_POST['StartOpenVPN']) ) {
|
} elseif( isset($_POST['StartOpenVPN']) ) {
|
||||||
echo "Attempting to start openvpn";
|
echo "Attempting to start openvpn";
|
||||||
exec( 'sudo /etc/init.d/openvpn start', $return );
|
exec( 'sudo /etc/init.d/openvpn start', $return );
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user