From a28b926b3a613a545763bb7b6d48d3d9289e3616 Mon Sep 17 00:00:00 2001 From: Joseph Haig Date: Sat, 9 Jul 2016 00:55:03 +0100 Subject: [PATCH 1/5] Move status messages into new class --- includes/admin.php | 24 ++++++++---------------- includes/status_messages.php | 22 ++++++++++++++++++++++ 2 files changed, 30 insertions(+), 16 deletions(-) create mode 100644 includes/status_messages.php diff --git a/includes/admin.php b/includes/admin.php index f9a8a4ff..8aacf8f2 100755 --- a/includes/admin.php +++ b/includes/admin.php @@ -1,38 +1,30 @@ '.$message; - if ($dismissable) $status .= ''; - $status .= ''; - - return $status; -} +include_once( 'includes/status_messages.php' ); function DisplayAuthConfig($username, $password){ - $status = ''; + $status = new StatusMessages(); if (isset($_POST['UpdateAdminPassword'])) { if (CSRFValidate()) { if (password_verify($_POST['oldpass'], $password)) { $new_username=trim($_POST['username']); if ($_POST['newpass'] != $_POST['newpassagain']) { - $status = Status('New passwords do not match', 'danger'); + $status->addMessage('New passwords do not match', 'danger'); } else if ($new_username == '') { - $status = Status('Username must not be empty', 'danger'); + $status->addMessage('Username must not be empty', 'danger'); } else { if ($auth_file = fopen(RASPI_ADMIN_DETAILS, 'w')) { fwrite($auth_file, $new_username.PHP_EOL); fwrite($auth_file, password_hash($_POST['newpass'], PASSWORD_BCRYPT).PHP_EOL); fclose($auth_file); $username = $new_username; - $status = Status('Admin password updated'); + $status->addMessage('Admin password updated'); } else { - $status = Status('Failed to update admin password', 'danger'); + $status->addMessage('Failed to update admin password', 'danger'); } } } else { - $status = Status('Old password does not match', 'danger'); + $status->addMessage('Old password does not match', 'danger'); } } else { error_log('CSRF violation'); @@ -44,7 +36,7 @@ function DisplayAuthConfig($username, $password){
Configure Auth
-

+

showMessages(); ?>

diff --git a/includes/status_messages.php b/includes/status_messages.php new file mode 100644 index 00000000..d58b8f5a --- /dev/null +++ b/includes/status_messages.php @@ -0,0 +1,22 @@ +'.$message; + if ($dismissable) $status .= ''; + $status .= '
'; + + array_push($this->messages, $status); + } + + public function showMessages($clear = true) { + foreach($this->messages as $message) { + echo $message; + } + if ( $clear ) $this->messages = array(); + } +} +?> From c65ddd010fc9311292a2a4b41025945b66a72d3b Mon Sep 17 00:00:00 2001 From: Joseph Haig Date: Sat, 9 Jul 2016 01:00:53 +0100 Subject: [PATCH 2/5] Tabs to spaces --- includes/admin.php | 124 +++++++++++++++++------------------ includes/status_messages.php | 6 +- 2 files changed, 65 insertions(+), 65 deletions(-) diff --git a/includes/admin.php b/includes/admin.php index 8aacf8f2..7e7e900f 100755 --- a/includes/admin.php +++ b/includes/admin.php @@ -3,72 +3,72 @@ include_once( 'includes/status_messages.php' ); function DisplayAuthConfig($username, $password){ - $status = new StatusMessages(); - if (isset($_POST['UpdateAdminPassword'])) { - if (CSRFValidate()) { - if (password_verify($_POST['oldpass'], $password)) { - $new_username=trim($_POST['username']); - if ($_POST['newpass'] != $_POST['newpassagain']) { - $status->addMessage('New passwords do not match', 'danger'); - } else if ($new_username == '') { - $status->addMessage('Username must not be empty', 'danger'); - } else { - if ($auth_file = fopen(RASPI_ADMIN_DETAILS, 'w')) { - fwrite($auth_file, $new_username.PHP_EOL); - fwrite($auth_file, password_hash($_POST['newpass'], PASSWORD_BCRYPT).PHP_EOL); - fclose($auth_file); - $username = $new_username; - $status->addMessage('Admin password updated'); - } else { - $status->addMessage('Failed to update admin password', 'danger'); - } - } - } else { - $status->addMessage('Old password does not match', 'danger'); - } + $status = new StatusMessages(); + if (isset($_POST['UpdateAdminPassword'])) { + if (CSRFValidate()) { + if (password_verify($_POST['oldpass'], $password)) { + $new_username=trim($_POST['username']); + if ($_POST['newpass'] != $_POST['newpassagain']) { + $status->addMessage('New passwords do not match', 'danger'); + } else if ($new_username == '') { + $status->addMessage('Username must not be empty', 'danger'); + } else { + if ($auth_file = fopen(RASPI_ADMIN_DETAILS, 'w')) { + fwrite($auth_file, $new_username.PHP_EOL); + fwrite($auth_file, password_hash($_POST['newpass'], PASSWORD_BCRYPT).PHP_EOL); + fclose($auth_file); + $username = $new_username; + $status->addMessage('Admin password updated'); + } else { + $status->addMessage('Failed to update admin password', 'danger'); + } + } + } else { + $status->addMessage('Old password does not match', 'danger'); + } } else { - error_log('CSRF violation'); + error_log('CSRF violation'); } } ?> -
-
-
-
Configure Auth
-
-

showMessages(); ?>

- - -
-
- - -
-
-
-
- - -
-
-
-
- - -
-
-
-
- - -
-
- - -
-
-
-
+
+
+
+
Configure Auth
+
+

showMessages(); ?>

+
+ +
+
+ + +
+
+
+
+ + +
+
+
+
+ + +
+
+
+
+ + +
+
+ +
+
+
+
+
messages as $message) { echo $message; - } - if ( $clear ) $this->messages = array(); - } + } + if ( $clear ) $this->messages = array(); + } } ?> From 3b043950deaeecbbbd3e41ffaf560c296490e4ac Mon Sep 17 00:00:00 2001 From: Joseph Haig Date: Sat, 9 Jul 2016 01:26:13 +0100 Subject: [PATCH 3/5] Add CSRF to DHCP form Also, separate out into separate file and refactor --- includes/dhcp.php | 220 +++++++++++++++++++++++++++++++++++++++++ includes/functions.php | 182 ---------------------------------- index.php | 3 +- 3 files changed, 222 insertions(+), 183 deletions(-) create mode 100755 includes/dhcp.php diff --git a/includes/dhcp.php b/includes/dhcp.php new file mode 100755 index 00000000..48b122b3 --- /dev/null +++ b/includes/dhcp.php @@ -0,0 +1,220 @@ + /tmp/dhcpddata',$temp ); + system( 'sudo cp /tmp/dhcpddata '. RASPI_DNSMASQ_CONFIG, $return ); + + if( $return == 0 ) { + $status->addMessage('Dnsmasq configuration updated successfully', 'success'); + } else { + $status->addMessage('Dnsmasq configuration failed to be updated', 'danger'); + } + } else { + error_log('CSRF violation'); + } + } + + exec( 'pidof dnsmasq | wc -l',$dnsmasq ); + $dnsmasq_state = ($dnsmasq[0] > 0); + + if( isset( $_POST['startdhcpd'] ) ) { + if (CSRFValidate()) { + if ($dnsmasq_state) { + $status->addMessage('dnsmasq already running', 'info'); + } else { + $line = system('sudo /etc/init.d/dnsmasq start',$return); + exec( 'pidof dnsmasq | wc -l',$dnsmasq ); + if ($dnsmasq[0] == 0) { + $status->addMessage('Failed to start dnsmasq', 'danger'); + } else { + $status->addMessage('Successfully started dnsmasq', 'success'); + } + } + } else { + error_log('CSRF violation'); + } + } elseif( isset($_POST['stopdhcpd'] ) ) { + if (CSRFValidate()) { + if ($dnsmasq_state) { + $line = system('sudo /etc/init.d/dnsmasq stop',$return); + exec( 'pidof dnsmasq | wc -l',$dnsmasq ); + if ($dnsmasq[0] == 0) { + $status->addMessage('Successfully stopped dnsmasq', 'success'); + } else { + $status->addMessage('Failed to stop dnsmasq', 'danger'); + } + } else { + $status->addMessage('dnsmasq already stopped', 'info'); + } + } else { + error_log('CSRF violation'); + } + } else { + if( $dnsmasq_state ) { + $status->addMessage('Dnsmasq is running', 'success'); + } else { + $status->addMessage('Dnsmasq is not running', 'warning'); + } + } + + exec( 'cat '. RASPI_DNSMASQ_CONFIG, $return ); + $conf = ParseConfig($return); + $arrRange = explode( ",", $conf['dhcp-range'] ); + $RangeStart = $arrRange[0]; + $RangeEnd = $arrRange[1]; + $RangeMask = $arrRange[2]; + preg_match( '/([0-9]*)([a-z])/i', $arrRange[3], $arrRangeLeaseTime ); + + switch( $arrRangeLeaseTime[2] ) { + case "h": + $hselected = " selected"; + break; + case "m": + $mselected = " selected"; + break; + case "d": + $dselected = " selected"; + break; + } + + ?> +
+
+
+
Configure DHCP +
+ +
+

showMessages(); ?>

+ + + +
+
+

DHCP server settings

+
+ +
+
+ + +
+
+
+
+ + +
+
+ +
+
+ + +
+
+ +
+
+ + +
+
+ + +
+
+ + + '; + } else { + echo''; + } + ?> +
+
+ +
+

Client list

+
+
+
+ Active DHCP leases +
+ +
+
+ + + + + + + + + + + + + ' . $lease_item . ''; + } + echo ''; + }; + ?> + + +
Expire timeMAC AddressIP AddressHost nameClient ID
+
+
+
+
+
+
+
+
Information provided by Dnsmasq
+
+
+
+ + diff --git a/includes/functions.php b/includes/functions.php index bd32ec65..3e9f4ddb 100755 --- a/includes/functions.php +++ b/includes/functions.php @@ -551,188 +551,6 @@ function DisplayHostAPDConfig(){ Dnsmasq is not running
'; - } else { - $status = '
Dnsmasq is running
'; - } - ?> -
-
-
-
Configure DHCP -
- -
- - - -
-

-
-

DHCP server settings

-
-
-
- - -
-
-
-
- - -
-
- -
-
- - -
-
- -
-
- - -
-
- - -
-
- - - '; - } else { - echo ''; - } - ?> -
-
- -
-

Client list

-
-
-
- Active DHCP leases -
- -
-
- - - - - - - - - - - - - ' . $lease_item . ''; - } - echo ''; - }; - ?> - - -
Expire timeMAC AddressIP AddressHost nameClient ID
-
-
-
-
- /tmp/dhcpddata',$temp ); - system( 'sudo cp /tmp/dhcpddata '. RASPI_DNSMASQ_CONFIG, $return ); - - if( $return == 0 ) { - echo "Dnsmasq configuration updated successfully"; - } else { - echo "Dnsmasq configuration failed to be updated"; - } - } - - if( isset( $_POST['startdhcpd'] ) ) { - $line = system('sudo /etc/init.d/dnsmasq start',$return); - echo "Attempting to start dnsmasq"; - } - - if( isset($_POST['stopdhcpd'] ) ) { - $line = system('sudo /etc/init.d/dnsmasq stop',$return); - echo "Stopping dnsmasq"; - } - ?> -
-
-
-
Information provided by Dnsmasq
-
-
-
- Date: Sat, 9 Jul 2016 03:34:48 +0100 Subject: [PATCH 4/5] Fix checking dnsmasq starting/stopping --- includes/dhcp.php | 22 ++++++++++++++++++---- 1 file changed, 18 insertions(+), 4 deletions(-) diff --git a/includes/dhcp.php b/includes/dhcp.php index 48b122b3..6dfa93c9 100755 --- a/includes/dhcp.php +++ b/includes/dhcp.php @@ -36,11 +36,18 @@ function DisplayDHCPConfig() { $status->addMessage('dnsmasq already running', 'info'); } else { $line = system('sudo /etc/init.d/dnsmasq start',$return); - exec( 'pidof dnsmasq | wc -l',$dnsmasq ); - if ($dnsmasq[0] == 0) { + $n_tries = 0; + while ($n_tries < 5) { + exec( 'pidof dnsmasq | wc -l',$dnsmasq ); + if (end($dnsmasq) > 0) break; + sleep(1); + $n_tries += 1; + } + if (end($dnsmasq) == 0) { $status->addMessage('Failed to start dnsmasq', 'danger'); } else { $status->addMessage('Successfully started dnsmasq', 'success'); + $dnsmasq_state = true; } } } else { @@ -50,9 +57,16 @@ function DisplayDHCPConfig() { if (CSRFValidate()) { if ($dnsmasq_state) { $line = system('sudo /etc/init.d/dnsmasq stop',$return); - exec( 'pidof dnsmasq | wc -l',$dnsmasq ); - if ($dnsmasq[0] == 0) { + $n_tries = 0; + while ($n_tries < 5) { + exec( 'pidof dnsmasq | wc -l',$dnsmasq ); + if (end($dnsmasq) == 0) break; + sleep(1); + $n_tries += 1; + } + if (end($dnsmasq) == 0) { $status->addMessage('Successfully stopped dnsmasq', 'success'); + $dnsmasq_state = false; } else { $status->addMessage('Failed to stop dnsmasq', 'danger'); } From bfae272b0f20708d52b54a00a716668399d088ce Mon Sep 17 00:00:00 2001 From: Joseph Haig Date: Sat, 9 Jul 2016 03:46:21 +0100 Subject: [PATCH 5/5] Better checking --- includes/dhcp.php | 26 ++++++-------------------- 1 file changed, 6 insertions(+), 20 deletions(-) diff --git a/includes/dhcp.php b/includes/dhcp.php index 6dfa93c9..d173547a 100755 --- a/includes/dhcp.php +++ b/includes/dhcp.php @@ -35,19 +35,12 @@ function DisplayDHCPConfig() { if ($dnsmasq_state) { $status->addMessage('dnsmasq already running', 'info'); } else { - $line = system('sudo /etc/init.d/dnsmasq start',$return); - $n_tries = 0; - while ($n_tries < 5) { - exec( 'pidof dnsmasq | wc -l',$dnsmasq ); - if (end($dnsmasq) > 0) break; - sleep(1); - $n_tries += 1; - } - if (end($dnsmasq) == 0) { - $status->addMessage('Failed to start dnsmasq', 'danger'); - } else { + exec('sudo /etc/init.d/dnsmasq start', $dnsmasq, $return); + if ($return == 0) { $status->addMessage('Successfully started dnsmasq', 'success'); $dnsmasq_state = true; + } else { + $status->addMessage('Failed to start dnsmasq', 'danger'); } } } else { @@ -56,15 +49,8 @@ function DisplayDHCPConfig() { } elseif( isset($_POST['stopdhcpd'] ) ) { if (CSRFValidate()) { if ($dnsmasq_state) { - $line = system('sudo /etc/init.d/dnsmasq stop',$return); - $n_tries = 0; - while ($n_tries < 5) { - exec( 'pidof dnsmasq | wc -l',$dnsmasq ); - if (end($dnsmasq) == 0) break; - sleep(1); - $n_tries += 1; - } - if (end($dnsmasq) == 0) { + exec('sudo /etc/init.d/dnsmasq stop', $dnsmasq, $return); + if ($return == 0) { $status->addMessage('Successfully stopped dnsmasq', 'success'); $dnsmasq_state = false; } else {