Pi-Hole/web
1
0
Fork 0
mirror of https://github.com/pi-hole/web.git synced 2025-12-24 12:48:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

tailog: validate file URL param and guard against infinite loop

Browse Source 
Signed-off-by: XhmikosR <xhmikosr@gmail.com>
This commit is contained in:
XhmikosR
2025-04-13 18:25:26 +03:00
parent 306edb2f9e
commit 59a43c7d26
1 changed files with 21 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
scripts/js/taillog.js
View File

@@ -82,16 +82,30 @@ function getData() {
return;
}
const GETDict = utils.parseQueryString();
if (!("file" in GETDict)) {
globalThis.location.href += "?file=dnsmasq";
const queryParams = utils.parseQueryString();
const outputElement = document.getElementById("output");
const allowedFileParams = ["dnsmasq", "ftl", "webserver"];
// Check if file parameter exists
if (!queryParams.file) {
// Add default file parameter and redirect
const url = new URL(globalThis.location.href);
url.searchParams.set("file", "dnsmasq");
globalThis.location.href = url.toString();
return;
}
// Validate that file parameter is one of the allowed values
if (!allowedFileParams.includes(queryParams.file)) {
const errorMessage = `Invalid file parameter: ${queryParams.file}. Allowed values are: ${allowedFileParams.join(", ")}`;
outputElement.innerHTML = `<div><em class="text-danger">*** Error: ${errorMessage} ***</em></div>`;
return;
}
const csrfToken = document.querySelector('meta[name="csrf-token"]').getAttribute("content");
const outputElement = document.getElementById("output");
const url = `${document.body.dataset.apiurl}/logs/${queryParams.file}?nextID=${nextID}`;
fetch(`${document.body.dataset.apiurl}/logs/${GETDict.file}?nextID=${nextID}`, {
fetch(url, {
method: "GET",
headers: {
"X-CSRF-TOKEN": csrfToken,
@@ -157,9 +171,9 @@ function getData() {
line.message = utils.escapeHtml(line.message);
// Format line if applicable
if (GETDict.file === "dnsmasq") {
if (queryParams.file === "dnsmasq") {
line.message = formatDnsmasq(line.message);
} else if (GETDict.file === "ftl") {
} else if (queryParams.file === "ftl") {
line.message = formatFTL(line.message, line.prio);
}