Repository: RaspAP/raspap-webgui

Issue #622: Security issue wifi qr code
Created: 2020-06-29T15:30:43Z
Before submitting an issue
Please read this first https://github.com/billz/raspap-webgui/wiki/Reporting-issues

 This is a bug report
 I searched existing issues before opening this one
 I checked the FAQ before creating this issue
 I have read and understand the issue reporting guidelines

Describe the bug
If you open the url
http://[IP_HERE]/app/img/wifi-qr-code.php
the qr code for login will show up even if you are not logged in.
That means pure IP-based access to the raspberry pi will allow you to log into the AP without credentials.
Your environment

Raspberry Pi hardware: Raspberry Pi 3B
Raspbian version: Buster
Followed the project prerequisites? Y
Checked the project FAQ? Y
RaspAP Quick Install or Manual setup? Quick Install
Using default configuration? Y
Simultaneous AP and managed mode? Y
Onboard wireless chipset or external adapter? Onboard WIFI
Other software or services running with RaspAP? No

Steps to reproduce
-Install RaspAP on your Raspberry Pi
-Go into yur browser and goto url http://[IP_HERE]/app/img/wifi-qr-code.php
-scan the shown qr code with your mobile phone
Expected behavior
I expected RaspAP-webgui to ask for credentials here.
Actual behavior
I saw the login code without authentication.
Screenshots
Sorry, screenshots have a problem on my phone
Additional context
Please apply authentication requirement on that image file.

Duplicate issue #726: WIFI-QR-Code still accessable
Created: 2020-12-06T15:00:09Z
Before submitting an issue
Please read this first https://github.com/billz/raspap-webgui/wiki/Reporting-issues

 This is a bug report
 I searched existing issues before opening this one
 I checked the FAQ before creating this issue
 I have read and understand the issue reporting guidelines

Describe the bug
Like in #622 the QR-Code is obtainable without logging in
Your environment

Raspberry Pi hardware = Raspberry Pi 3B
Raspbian version Buster Desktop or Buster Lite
Followed the project prerequisites? Y
Checked the project FAQ? Y
RaspAP Quick Install or Manual setup? Quick Installer
Using default configuration? Y
Simultaneous AP and managed mode? N
Onboard wireless chipset or external adapter? Onboard
Other software or services running with RaspAP? N

Steps to reproduce
Load the startpage except you dont input, but you click cancel so it shows you "Not authorized". Then you edit the HTML of the page's body using the inspect function (tested in Firefox or Chromium/Chrome) and you replace body's inner HTML with this:
<img src="/app/img/wifi-qr-code.php" class="figure-img img-fluid" alt="RaspAP Wifi QR code" style="width:100%;">
That's the original HTML code used in templates/hostapd/security.php to call the QR-Code.
Expected behavior
QR-Code not loaded
Actual behavior
QR-Code visible
Screenshots
Not necessary.
Additional context
Weather you log in or not, the QR-Code PHP doesn't check the credentials, but checks if it's being called directly or through another document. So you could call it from within any document, even from another server. Maybe you could use the QR-Code-PHP-File to generate not the image but the Data-URL for the QR-Code (Base64) and make it only usable from the PHP-Skripts on the server itself.

Closing comment (2020-12-06T22:16:34Z): Duplicate of #622