CORS rejects HTTPS origins

[samuelkadolph]

In raising this issue, I confirm the following (please check boxes, eg [X] - no spaces) Failure to fill the template will close your issue:

• I have read and understood the contributors guide.
• The issue I am reporting can be replicated
• The issue I'm reporting isn't a duplicate (see FAQs, closed issues, and open issues).

How familiar are you with the codebase?:

2

---

[BUG | ISSUE] Expected Behaviour:

You should be able to add or remove domain from the whitelist or blacklist when hosted on an HTTPS host.

[BUG | ISSUE] Actual Behaviour:

You get a 200 response (which means the UI reports that it did succeed) which states CORS failed and the domain is not added or removed.

$ curl https://pi-hole.ottawa.samuelkadolph.com/php/add.php -H "Origin: https://pi-hole.ottawa.samuelkadolph.com" -d "domain=test.com" -d "list=white" -d "token=4yfTOx5ODR%2F2YYns6%2FT8gHldzXaMRHFfXZ2MJUnSsYk%3D" -v
*   Trying 10.4.0.60...
* Connected to pi-hole.ottawa.samuelkadolph.com (10.4.0.60) port 443 (#0)
* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* Server certificate: pi-hole.ottawa.samuelkadolph.com
* Server certificate: SAK CA
> POST /php/add.php HTTP/1.1
> Host: pi-hole.ottawa.samuelkadolph.com
> User-Agent: curl/7.49.1
> Accept: */*
> Origin: https://pi-hole.ottawa.samuelkadolph.com
> Content-Length: 83
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 83 out of 83 bytes
< HTTP/1.1 200 OK
< Server: nginx/1.4.6 (Ubuntu)
< Date: Sun, 01 Jan 2017 23:19:13 GMT
< Content-Type: text/html; charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< X-Powered-By: PHP/5.6.28
< X-Pi-hole: The Pi-hole Web interface is working!
<
* Connection #0 to host pi-hole.ottawa.samuelkadolph.com left intact
Failed CORS: https://pi-hole.ottawa.samuelkadolph.com vs http://172.17.0.3,http://pi.hole,http://localhost,http://pi-hole.ottawa.samuelkadolph.com

[BUG | ISSUE] Steps to reproduce:

Put pi-hole behind nginx with HTTPS and adding/deleting a domain from the blacklist or whitelist does not work.

This template was created based on the work of udemy-dl.

[DL6ER]

Should be fixed by #275 and #301 which will be included in the update we release in the coming days.

[samuelkadolph]

Cool beans. I'll test it out when released.