Merge pull request #479 from pi-hole/new/audit-log

Audit log
2025-12-25 05:05:33 +00:00 · 2017-06-27 10:53:31 +02:00
parent 0872db2cfb 870959026b
commit 557ebbbc7c
5 changed files with 241 additions and 7 deletions
--- a/api_FTL.php
+++ b/api_FTL.php
@@ -71,7 +71,11 @@ if (isset($_GET['overTimeData10mins']))

 if (isset($_GET['topItems']) && $auth)
 {
-	if(is_numeric($_GET['topItems']))
+	if($_GET['topItems'] === "audit")
+	{
+		sendRequestFTL("top-domains for audit");
+	}
+	else if(is_numeric($_GET['topItems']))
 	{
 		sendRequestFTL("top-domains (".$_GET['topItems'].")");
 	}
@@ -88,7 +92,11 @@ if (isset($_GET['topItems']) && $auth)
 		$top_queries[$tmp[2]] = intval($tmp[1]);
 	}

-	if(is_numeric($_GET['topItems']))
+	if($_GET['topItems'] === "audit")
+	{
+		sendRequestFTL("top-ads for audit");
+	}
+	else if(is_numeric($_GET['topItems']))
 	{
 		sendRequestFTL("top-ads (".$_GET['topItems'].")");
 	}
@@ -102,7 +110,10 @@ if (isset($_GET['topItems']) && $auth)
 	foreach($return as $line)
 	{
 		$tmp = explode(" ",$line);
-		$top_ads[$tmp[2]] = intval($tmp[1]);
+		if(count($tmp) === 4)
+			$top_ads[$tmp[2]." (".$tmp[3].")"] = intval($tmp[1]);
+		else
+			$top_ads[$tmp[2]] = intval($tmp[1]);
 	}

 	$result = array('top_queries' => $top_queries,
--- a/auditlog.php
+++ b/auditlog.php
@@ -0,0 +1,81 @@
+<?php /*
+*    Pi-hole: A black hole for Internet advertisements
+*    (c) 2017 Pi-hole, LLC (https://pi-hole.net)
+*    Network-wide ad blocking via your own hardware.
+*
+*    This file is copyright under the latest version of the EUPL.
+*    Please see LICENSE file for your rights under this license. */
+    require "scripts/pi-hole/php/header.php";
+?>
+<!-- Send PHP info to JS -->
+<div id="token" hidden><?php echo $token ?></div>
+<!-- Title -->
+<div class="page-header">
+    <h1>Audit log (showing live data)</h1>
+</div>
+
+<div class="row">
+    <div class="col-md-6">
+      <div class="box" id="domain-frequency">
+        <div class="box-header with-border">
+          <h3 class="box-title">Allowed queries</h3>
+        </div>
+        <!-- /.box-header -->
+        <div class="box-body">
+            <div class="table-responsive">
+                <table class="table table-bordered">
+                  <tbody>
+                    <tr>
+                    <th>Domain</th>
+                    <th>Hits</th>
+                    <th>Actions</th>
+                    </tr>
+                  </tbody>
+                </table>
+            </div>
+        </div>
+        <div class="overlay">
+          <i class="fa fa-refresh fa-spin"></i>
+        </div>
+        <!-- /.box-body -->
+      </div>
+      <!-- /.box -->
+    </div>
+    <!-- /.col -->
+    <div class="col-md-6">
+      <div class="box" id="ad-frequency">
+        <div class="box-header with-border">
+          <h3 class="box-title">Blocked queries</h3>
+        </div>
+        <!-- /.box-header -->
+        <div class="box-body">
+            <div class="table-responsive">
+                <table class="table table-bordered">
+                  <tbody>
+                    <tr>
+                    <th>Domain</th>
+                    <th>Hits</th>
+                    <th>Actions</th>
+                    </tr>
+                  </tbody>
+                </table>
+            </div>
+        </div>
+        <div class="overlay">
+          <i class="fa fa-refresh fa-spin"></i>
+        </div>
+        <!-- /.box-body -->
+      </div>
+      <!-- /.box -->
+    </div>
+    <div class="col-md-12">
+        <p><strong>Important:</strong> Note that black- and whitelisted domains are not automatically applied on this page to avoid restarting the DNS service too often. Instead, go to <a href="http://pi.hole/admin/gravity.php">Update Lists</a> and run the update, to have the new settings become effective.</p>
+    </div>
+    <!-- /.col -->
+</div>
+<!-- /.row -->
+<?php
+    require "scripts/pi-hole/php/footer.php";
+?>
+
+<script src="scripts/pi-hole/js/auditlog.js"></script>
--- a/scripts/pi-hole/js/auditlog.js
+++ b/scripts/pi-hole/js/auditlog.js
@@ -0,0 +1,116 @@
+/* Pi-hole: A black hole for Internet advertisements
+*  (c) 2017 Pi-hole, LLC (https://pi-hole.net)
+*  Network-wide ad blocking via your own hardware.
+*
+*  This file is copyright under the latest version of the EUPL.
+*  Please see LICENSE file for your rights under this license. */
+// Define global variables
+var timeLineChart, queryTypeChart, forwardDestinationChart;
+
+// Credit: http://stackoverflow.com/questions/1787322/htmlspecialchars-equivalent-in-javascript/4835406#4835406
+function escapeHtml(text) {
+  var map = {
+    "&": "&amp;",
+    "<": "&lt;",
+    ">": "&gt;",
+    "\"": "&quot;",
+    "\'": "&#039;"
+  };
+
+  return text.replace(/[&<>"']/g, function(m) { return map[m]; });
+}
+
+function updateTopLists() {
+    $.getJSON("api.php?topItems=audit", function(data) {
+
+        if("FTLnotrunning" in data)
+        {
+            return;
+        }
+
+        // Clear tables before filling them with data
+        $("#domain-frequency td").parent().remove();
+        $("#ad-frequency td").parent().remove();
+        var domaintable = $("#domain-frequency").find("tbody:last");
+        var adtable = $("#ad-frequency").find("tbody:last");
+        var url, domain, percentage;
+        for (domain in data.top_queries) {
+            if ({}.hasOwnProperty.call(data.top_queries,domain)){
+                // Sanitize domain
+                domain = escapeHtml(domain);
+                url = "<a href=\"queries.php?domain="+domain+"\">"+domain+"</a>";
+                percentage = data.top_queries[domain] / data.dns_queries_today * 100;
+                domaintable.append("<tr> <td>" + url +
+                    "</td> <td>" + data.top_queries[domain] + "</td> <td> <button style=\"color:red; white-space: nowrap;\"><i class=\"fa fa-ban\"></i> Blacklist</button> <button style=\"color:orange; white-space: nowrap;\"><i class=\"fa fa-balance-scale\"></i> Audit</button> </td> </tr> ");
+            }
+        }
+
+        for (domain in data.top_ads) {
+            if ({}.hasOwnProperty.call(data.top_ads,domain)){
+                var input = domain.split(" ");
+                // Sanitize domain
+                var printdomain = escapeHtml(input[0]);
+                if(input.length > 1)
+                {
+                    url = "<a href=\"queries.php?domain="+printdomain+"\">"+printdomain+"</a> (wildcard blocked)";
+                    adtable.append("<tr> <td>" + url +
+                    "</td> <td>" + data.top_ads[domain] + "</td> <td> <button style=\"color:orange; white-space: nowrap;\"><i class=\"fa fa-balance-scale\"></i> Audit</button> </td> </tr> ");
+                }
+                else
+                {
+                    url = "<a href=\"queries.php?domain="+printdomain+"\">"+printdomain+"</a>";
+                    adtable.append("<tr> <td>" + url +
+                    "</td> <td>" + data.top_ads[domain] + "</td> <td> <button style=\"color:green; white-space: nowrap;\"><i class=\"fa fa-pencil-square-o\"></i> Whitelist</button> <button style=\"color:orange; white-space: nowrap;\"><i class=\"fa fa-balance-scale\"></i> Audit</button> </td> </tr> ");
+                }
+            }
+        }
+
+        $("#domain-frequency .overlay").hide();
+        $("#ad-frequency .overlay").hide();
+        // Update top lists data every 10 seconds
+        setTimeout(updateTopLists, 10000);
+    });
+}
+
+
+function add(domain,list) {
+    var token = $("#token").html();
+    $.ajax({
+        url: "scripts/pi-hole/php/add.php",
+        method: "post",
+        data: {"domain":domain, "list":list, "token":token, "auditlog":1},
+        success: function(response) {
+            setTimeout(updateTopLists, 300);
+        }
+    });
+}
+
+$(document).ready(function() {
+
+    // Pull in data via AJAX
+    updateTopLists();
+
+    $("#domain-frequency tbody").on( "click", "button", function () {
+        var url = ($(this).parents("tr"))[0].innerText.split("	")[0];
+        if($(this).context.innerText === "Blacklist")
+        {
+            add(url,"black");
+        }
+        else
+        {
+            add(url,"audit");
+        }
+    });
+
+    $("#ad-frequency tbody").on( "click", "button", function () {
+        var url = ($(this).parents("tr"))[0].innerText.split("	")[0].split(" ")[0];
+        if($(this).context.innerText === "Whitelist")
+        {
+            add(url,"white");
+        }
+        else
+        {
+            add(url,"audit");
+        }
+    });
+});
--- a/scripts/pi-hole/php/add.php
+++ b/scripts/pi-hole/php/add.php
@@ -16,13 +16,33 @@ list_verify($type);

 switch($type) {
    case "white":
-        echo exec("sudo pihole -w -q ${_POST['domain']}");
+        if(!isset($_POST["auditlog"]))
+            echo exec("sudo pihole -w -q ${_POST['domain']}");
+        else
+        {
+            echo exec("sudo pihole -w -q -n ${_POST['domain']}");
+            echo exec("sudo pihole -a audit ${_POST['domain']}");
+        }
        break;
    case "black":
-        echo exec("sudo pihole -b -q ${_POST['domain']}");
+        if(!isset($_POST["auditlog"]))
+            echo exec("sudo pihole -b -q ${_POST['domain']}");
+        else
+        {
+            echo exec("sudo pihole -b -q -n ${_POST['domain']}");
+            echo exec("sudo pihole -a audit ${_POST['domain']}");
+        }
        break;
    case "wild":
-        echo exec("sudo pihole -wild -q ${_POST['domain']}");
+        if(!isset($_POST["auditlog"]))
+            echo exec("sudo pihole -wild -q ${_POST['domain']}");
+        else
+        {
+            echo exec("sudo pihole -wild -q -n ${_POST['domain']}");
+            echo exec("sudo pihole -a audit ${_POST['domain']}");
+        }
+    case "audit":
+        echo exec("sudo pihole -a audit ${_POST['domain']}");
        break;
 }

--- a/scripts/pi-hole/php/header.php
+++ b/scripts/pi-hole/php/header.php
@@ -470,7 +470,7 @@ if($auth) {
                    <a href="#"><i class="fa fa-play"></i> <span id="enableLabel">Enable</span>&nbsp;&nbsp;&nbsp;<span id="flip-status-enable"></span></a>
                </li>
                <!-- Tools -->
-                <li class="treeview <?php if($scriptname === "gravity.php" || $scriptname === "queryads.php" || $scriptname === "debug.php"){ ?>active<?php } ?>">
+                <li class="treeview <?php if($scriptname === "gravity.php" || $scriptname === "queryads.php" || $scriptname === "debug.php" || $scriptname === "auditlog.php"){ ?>active<?php } ?>">
                  <a href="#">
                    <i class="fa fa-folder"></i> <span>Tools</span>
                    <span class="pull-right-container">
@@ -490,6 +490,12 @@ if($auth) {
                            <i class="fa fa-search"></i> <span>Query adlists</span>
                        </a>
                    </li>
+                    <!-- Audit log -->
+                    <li<?php if($scriptname === "auditlog.php"){ ?> class="active"<?php } ?>>
+                        <a href="auditlog.php">
+                            <i class="fa fa-balance-scale"></i> <span>Audit log</span>
+                        </a>
+                    </li>
                    <!-- Tail pihole.log -->
                    <li<?php if($scriptname === "taillog.php"){ ?> class="active"<?php } ?>>
                        <a href="taillog.php">