{"action":"created","issue":{"url":"https://api.github.com/repos/pi-hole/AdminLTE/issues/197","repository_url":"https://api.github.com/repos/pi-hole/AdminLTE","labels_url":"https://api.github.com/repos/pi-hole/AdminLTE/issues/197/labels{/name}","comments_url":"https://api.github.com/repos/pi-hole/AdminLTE/issues/197/comments","events_url":"https://api.github.com/repos/pi-hole/AdminLTE/issues/197/events","html_url":"https://github.com/pi-hole/AdminLTE/pull/197","id":189666891,"number":197,"title":"Add server-side password protection for the web interface","user":{"login":"DL6ER","id":16748619,"avatar_url":"https://avatars.githubusercontent.com/u/16748619?v=3","gravatar_id":"","url":"https://api.github.com/users/DL6ER","html_url":"https://github.com/DL6ER","followers_url":"https://api.github.com/users/DL6ER/followers","following_url":"https://api.github.com/users/DL6ER/following{/other_user}","gists_url":"https://api.github.com/users/DL6ER/gists{/gist_id}","starred_url":"https://api.github.com/users/DL6ER/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DL6ER/subscriptions","organizations_url":"https://api.github.com/users/DL6ER/orgs","repos_url":"https://api.github.com/users/DL6ER/repos","events_url":"https://api.github.com/users/DL6ER/events{/privacy}","received_events_url":"https://api.github.com/users/DL6ER/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":64,"created_at":"2016-11-16T10:57:04Z","updated_at":"2016-11-21T14:03:10Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/pi-hole/AdminLTE/pulls/197","html_url":"https://github.com/pi-hole/AdminLTE/pull/197","diff_url":"https://github.com/pi-hole/AdminLTE/pull/197.diff","patch_url":"https://github.com/pi-hole/AdminLTE/pull/197.patch"},"body":"Fixes #128.\r\n\r\nChanges proposed in this pull request:\r\n\r\n- Add an effective password protection to the web interface as I always felt that the current way of doing it is to inconvenient for most of the users.\r\n\r\nBehavior:\r\n\r\n1. No password is set: No surprises, everything is always shown to everyone.\r\n\r\n2. The user sets a password in `setupVars.conf`: Now, the user will be shown a \"login\" page:\r\n![screenshot at 2016-11-16 11-51-48](https://cloud.githubusercontent.com/assets/16748619/20344501/4fabcff8-abf3-11e6-897e-4eae1597270e.png)\r\nAlso, clicking on the links \"Enable/Disable\" doesn't do anything completely locking out any non-authorized user.\r\nOnce logged in, the hashed password is always carried around in all links to be sure that we only have to log in once.\r\n![screenshot at 2016-11-16 12-11-02](https://cloud.githubusercontent.com/assets/16748619/20345124/00d0674c-abf6-11e6-9899-aef38d343c1b.png)\r\nThe hashing of the password guarantees that the password is never visible in plain-text to someone who might look over your shoulder.\r\n\r\nOnce we agree on how we like to have it, we should definitely add an (clearly documented) option for the pihole command to make it easy to set the password. We might even ask for it during the installation.\r\n\r\nSyntax for `setupVars.conf`: `webpassword=\"ABC\"`\r\n\r\n@pi-hole/dashboard\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/pi-hole/AdminLTE/issues/comments/261946197","html_url":"https://github.com/pi-hole/AdminLTE/pull/197#issuecomment-261946197","issue_url":"https://api.github.com/repos/pi-hole/AdminLTE/issues/197","id":261946197,"user":{"login":"DL6ER","id":16748619,"avatar_url":"https://avatars.githubusercontent.com/u/16748619?v=3","gravatar_id":"","url":"https://api.github.com/users/DL6ER","html_url":"https://github.com/DL6ER","followers_url":"https://api.github.com/users/DL6ER/followers","following_url":"https://api.github.com/users/DL6ER/following{/other_user}","gists_url":"https://api.github.com/users/DL6ER/gists{/gist_id}","starred_url":"https://api.github.com/users/DL6ER/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DL6ER/subscriptions","organizations_url":"https://api.github.com/users/DL6ER/orgs","repos_url":"https://api.github.com/users/DL6ER/repos","events_url":"https://api.github.com/users/DL6ER/events{/privacy}","received_events_url":"https://api.github.com/users/DL6ER/received_events","type":"User","site_admin":false},"created_at":"2016-11-21T14:03:10Z","updated_at":"2016-11-21T14:03:10Z","body":"Currently, the session countdown timer is slightly hidden because I don't know if people would want to see it. Should I put it to some more prominent place clearly visible to the logged in user?"}}
{"actor":{"display_login":"DL6ER"}}