<?php
    $pwhash =  parse_ini_file("/etc/pihole/setupVars.conf")['WEBPASSWORD'];

    // Test if password is set
    if(strlen($pwhash) > 0)
    {
        // Password set compare with double hash
        if(hash('sha256',hash('sha256',$_POST["pw"])) == $pwhash || $_GET["auth"] == $pwhash)
        {
            // Password (POST) correct or hash (GET) correct
            $auth = true;
            $pwstring = "auth=".$pwhash;
        }
        else
        {
            // Password or hash wrong
            $auth = false;
            $pwstring = "";
        }
    }
    else
    {
        // No password set
        $auth = true;
        $pwstring = "";
    }
?>

<?php
    $pwhash =  parse_ini_file("/etc/pihole/setupVars.conf")['WEBPASSWORD'];

    // Test if password is set
    if(strlen($pwhash) > 0)
    {
        // Compare doubly hashes password input with saved hash
        if(isset($_POST["pw"]))
        {
            $postinput = hash('sha256',hash('sha256',$_POST["pw"]));
            if($postinput == $pwhash)
                $auth = true;
        }
        // Compare auth hash with saved hash
        else if (isset($_GET["auth"]))
        {
            if($_GET["auth"] == $pwhash)
                $auth = true;
        }
        else
        {
            // Password or hash wrong
            $auth = false;
            $pwstring = "";
        }
        // If authorized, then set the hash that will be
        // passed through using GET
        if($auth)
            $pwstring = "auth=".$pwhash;
    }
    else
    {
        // No password set
        $auth = true;
        $pwstring = "";
    }
?>

Test if POST and GET variables are set before trying to actually access them. This increases code complexity noticable, let's see if codacy complains ...
Test if POST and GET variables are set before trying to actually access them. This increases code complexity noticable, let's see if codacy complains ...
