Please follow the below template, it will help us to help you!
Expected Behaviour:
Settings are saved when clicking on "Save" Button in web interface
Actual Behaviour:
White page with this message:
"Failed CORS: null vs 192.168.0.5, , cloud.my.domain, pi.hole, localhost"
Settings are NOT saved.
Debug Token:
inf4j9wk2b
--
This happens for some time now (since I use the Pihole), also in the newest version (updated today). I wanted to set up the DHCP Server, but no matter what setting I want to save - I always get the white page.
I edited the config file as a workaround in the past (e.g. to add more blocklists), but it would be really more convenient to be able to use the web interface.
Your debug log shows that Apache 2 is running and interfering with lighttpd:
*** [ DIAGNOSING ]: Dashboard and block page
[✗] Block page X-Header: X-Header does not match or could not be retrieved.
HTTP/1.1 200 OK
Date: Mon, 14 Jan 2019 15:12:27 GMT
Server: Apache/2.4.29 (Ubuntu)
Last-Modified: Thu, 11 Oct 2018 22:45:48 GMT
ETag: "13d-577fbbb6b8199"
Accept-Ranges: bytes
Content-Length: 317
Vary: Accept-Encoding
Content-Type: text/html
[✗] Web interface X-Header: X-Header does not match or could not be retrieved.
HTTP/1.1 200 OK
Date: Mon, 14 Jan 2019 15:12:27 GMT
Server: Apache/2.4.29 (Ubuntu)
Set-Cookie: PHPSESSID=qpt4riajij5np0nspp308aut5k; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Yes I run Apache, as this server is also used as Nextcloud Server. I used the already running Apache to avoid running 2 different httpd servers.
When installing pihole I installed the webinterface but not lighttpd (at least thats what I intended to do, maybe lighttpd got 'accidentally' installed at some point).
The webinterface works fine to monitor logs and I can also add domains to the black- and whitelists, but I can not add new blocklists or setup the DHCP server etc. (always when saving any of those settings I get the CORS error).
--
one idea I have is that there might be a problem with the file access rights - most files are owned by root/root
and the webserver/webinterface may not be able to write to them.
But I don't know enough about how pihole works/accesses files etc.
--
How can I solve this?
Do I have to run lighttpd additionally (on a different port)?
Or change any settings in Apache?
Or change file access rights?
I would be also happy to configure DHCP via a config file, I just did not find documentation on how to do that (which file to edit, what to put...).
So the error happens in /var/www/html/admin/scripts/pi-hole/php/auth.php
in function check_cors()
this function compares a variable $server_origin with a list of allowed hostnames, e.g. "pi.hole", the ip address etc.
The allowed hostnames are fine in my case, BUT the variable $server_origin has "NULL" as value, which is obviously not the same as a valid hostname.
this triggers the line log_and_die("Failed CORS: " . $server_origin .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));
which kills the beautiful web interface and shows the ugly white page with the error.
Workaround:
comment the line out, then it works: // log_and_die("Failed CORS: " . $server_origin .' vs '. join(', ', $AUTHORIZED_HOSTNAMES));
Real solution (developer needed):
Find out why $server_origin gives "NULL" in my system (Ubuntu 18.04, Apache 2) and solve it. Or just remove the CORS check...
Apache seems to not properly fill in the necessary $_SERVER['HTTP_ORIGIN'] data. We only ship a lighttpd config, so I don't know if there's a way to tell Apache to fill in that data.
Well, then do not include this code when it runs on an Apache:
I think it is positive when PiHole can run on other webservers, because it can easily run on a homeserver you already have (like a Nextcloud). No need for extra hardware...
We accept all Pull Request to our GitHub code repositories. If you would like to write the code to allow for Apache2 to be supported we would be more than happy to have it included.
I report errors, I don't write code. Not everyone who uses a software is a programmer who can repair the software.
Pointing at the exact line of code where the error happens and showing a simple workaround is all I can do, and I am happy if it helps in any way.
