Commit Graph
33 Commits
Author SHA1 Message Date
RD WebDesign d81cc80f48 Fix dropdown-menu text color, when the theme is set to "default-auto"
Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>
2026-07-18 20:09:43 -03:00
RD WebDesignandAdam Warner 37701121e2 Fix a few visual issues on the top bar and sidebar
- add `data-bs-theme` to the body, accordingly to the current theme;
- add `data-bs-theme=dark` the the top bar, because we always use some
  background color with white text, on this element;
- change the default theme font-size to 15px. The previous theme used 14px
  (too small) and the original AdminLTE uses 16px (maybe too big);
- use `bg-body-secondary` class on the body to match the previous gray
  background color on the content area;
- use `bg-body-tertiary` class on the sidebar. It is still a dark color,
  but it will be changed according to the selected themes (when all themes
  are implemented);
- adjust the top bar text color and border color to match the previous
  theme look;
- adjust (or remove) the height on some elements on the top bar, to avoid
  breaking the layout;
- move the old "logo" element to the sidebar (`.sidebar-brand` element);
- use CSS to show a smaller "Pi-hole" text logo in the collapse sidebar;
- adjust the collapsed sidebar layout, adding `.nav-badge` class to the
  every badge on the sidebar;
- remove the outdated `pull-left` class;
- remove other outdated CSS rules;

Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>

Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>
2026-07-17 22:40:00 +01:00
e5c71a26f0 Fix CI: editorconfig indentation and a codespell false-hit
editorconfig-checker requires comment continuation lines to be
indented in multiples of the file's indent size (4 for .lp, 2 for
.css) - several block comments added during the AdminLTE4 migration
used visual alignment under the opening delimiter instead, tripping
the check. Reflowed them to a flat, spec-compliant indent.

Also fix a spell-check false-negative turned real hit: codespell flags
"pre-selected" as a common misspelling of "preselected".

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Adam Warner <me@adamwarner.co.uk>
2026-07-17 22:39:58 +01:00
646a3ef6ab Fix theme/layout regressions and CSP-blocked icons found in manual testing
Reviewed and built on top of a round of fixes already applied to the
working tree (boxed layout, badge alignment, sidebar treeview links,
bootstrap5-toggle's on/off->onlabel/offlabel rename, and forcing
data-bs-theme explicitly instead of leaving Bootstrap 5 to fall back to
the OS's prefers-color-scheme, plus the new scripts/js/theme.js that
locks the resolved theme so AdminLTE's own color-mode logic can't
silently override Pi-hole's own theme selection). On top of that:

- Fixed the "day theme still shows dark" gap: the anti-FOUC inline
  background style in header.lp only covered the case where the theme
  is unconditionally dark, never the "auto" theme (whose Lua-side flag
  is literally the string "auto", not "dark") - added a
  prefers-color-scheme media query fallback so the auto theme also
  avoids a white flash without needing to wait for theme.js/CSS to load.
- Fixed a strict Content-Security-Policy (img-src 'self', set by FTL's
  webserver) blocking every checkbox/radio checkmark, the modal close
  button, and the select2 dropdown arrow/clear icon: Bootstrap 5 and its
  plugins ship these as inline data: URI SVGs, which the CSP rejects
  outright. Re-hosted the exact same icons as local files under
  style/icons/ and pointed the same CSS custom properties at them.
  Learned the hard way that a url() stored in a custom property
  resolves relative to the stylesheet that *consumes* it via var(), not
  the one that declares it - the consumer here is always
  vendor/adminLTE/adminlte.min.css, so the override paths needed to
  account for that rather than being relative to pi-hole.css itself.
- Found and fixed three more leftover .box-* selectors in pi-hole.css
  that never got updated to .card-* during the earlier card-conversion
  phase: the query-types/forward-destinations pie chart flex layout,
  the domains-list filter row header, and the dynamically-generated
  settings cards' sizing/hidden-state selectors - all on pages that
  render in normal use, unlike the handful of genuinely-unreachable
  .box-solid/.box-comment selectors left alone in the theme files
  (those modifier classes are never applied by any current markup).

Verified against a live container: boxed layout now visibly constrains
and centers the page, day theme renders light content with checkmarks/
close icons/dropdown arrows all visible with zero console errors,
clicking Settings/Tools now expands the submenu instead of navigating
to the dashboard, and sidebar badges are aligned to a consistent right
edge.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Adam Warner <me@adamwarner.co.uk>
2026-07-17 22:39:57 +01:00
0153772cf5 Swap remaining jQuery plugins for Bootstrap 5-compatible versions
- DataTables: replace the combined BS3 download-builder bundles with
  the official core + Bootstrap 5 styling-adapter package pairs
  (datatables.net(-buttons/-select) + datatables.net-bs5/-buttons-bs5/
  -select-bs5), loaded core-then-adapter.
- bootstrap-select -> Tom Select: bootstrap-select has no Bootstrap 5
  build. Add utils.createGroupSelect(), a small wrapper around Tom
  Select that recreates bootstrap-select's actionsBox (Select all/
  Select none) via a couple of buttons injected into the dropdown, and
  use it for all four "assign to group(s)" multi-selects (groups,
  groups/clients, groups/domains, groups/lists). Two behavioral fixes
  were needed to match the old widget: `hideSelected: false` (Tom
  Select refuses to open its dropdown once every option is already
  selected, which made the actions box unreachable) and
  `dropdownParent: "body"` (otherwise the dropdown is clipped by the
  surrounding .table-responsive/.card ancestors' overflow, same reason
  bootstrap-select was configured with container: "body").
- bootstrap-toggle -> bootstrap5-toggle: drop-in replacement, same
  $.fn.bootstrapToggle() API and onstyle/offstyle option names (all
  call sites already used Bootstrap 5-valid color names).
- select2: bump to 4.1.0 and add the select2-bootstrap-5-theme package
  for correct Bootstrap 5 styling; wire theme: "bootstrap-5" into both
  call sites.
- Remove now-dead bootstrap-select cleanup code (the
  "$('body > .bootstrap-select.dropdown').remove()" DataTables
  drawCallback lines across 8 files) and dead icheck/bootstrap-select
  CSS in pi-hole.css.

Also fixed a Phase 1 regression surfaced by this pass: utils.js's
loadingOverlay() still targeted the old ".wrapper" class instead of
".app-wrapper", throwing whenever a settings page triggered the
Save & Apply overlay.

Verified against a live container: groups/clients' per-row Tom Select
multiselect (open dropdown, Select all/none, Apply, restore-on-cancel),
bootstrap5-toggle switches on groups, select2 filters on the query log,
and DataTables' select/export button row on groups/lists all work with
zero console errors. Settings pages' Save & Apply overlay confirmed
fixed and no longer throwing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Adam Warner <me@adamwarner.co.uk>
2026-07-17 22:39:57 +01:00
3d5193154a Replace icheck-bootstrap checkboxes/radios with native Bootstrap 5 form-check
Convert all 35 static checkbox/radio inputs across 9 templates (queries,
search, settings-api, settings-dhcp, groups-domains, settings-dns,
settings-privacy, settings-teleporter) plus the dynamically-generated
ones (settings-advanced.js's per-setting boolean/enum controls,
settings-dns.js's DNS-upstream picker) from icheck-bootstrap's
JS-post-processed styling to Bootstrap 5's native .form-check/
.form-check-input/.form-check-label markup, which needs no JS at all.

Remove footer.js's applyCheckboxRadioStyle() (and its call sites in
settings-advanced.js/settings-dns.js) entirely - it used to strip and
re-add classes on every checkbox/radio's parent after page load, which
would have destroyed the new static .form-check classes at runtime.
Drop the icheck-bootstrap dependency, its vendor CSS and the <link> in
header.lp, and replace its now-dead pseudo-element checkbox styling in
pi-hole.css with a couple of plain .form-check-input/.form-check-label
rules for the one spot that needs a smaller checkbox size (the domain
list's filter-by-type row).

Two "no-icheck"-excluded checkboxes (a table-header select-all in both
settings-dns.lp and settings-dns.js) are left as bare native checkboxes,
matching their original deliberate exclusion.

Also confirmed pi-hole's own text-red/text-green/bg-*/etc. color utility
classes are unaffected by the AdminLTE core removal - each theme file
already defines them fully rather than only overriding an AdminLTE base,
so no fix was needed there.

Verified against a live container: settings/dns (checkbox/radio styling,
custom-servers card-collapse toggle) and settings/privacy (privacy-level
radios) render correctly with zero console errors.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Adam Warner <me@adamwarner.co.uk>
2026-07-17 22:39:57 +01:00
89e65d8d08 Migrate layout shell to AdminLTE 4 / Bootstrap 5
Swap vendored AdminLTE 2.4.18 + Bootstrap 3.4.1 for AdminLTE 4.1.0 +
Bootstrap 5.3.8 (AdminLTE's dist CSS now bundles Bootstrap, so the
separate Bootstrap stylesheet is dropped; only its JS bundle remains).

Rewrite the page shell (header, header_authenticated, sidebar, footer)
to AdminLTE 4's app-wrapper/app-header/app-sidebar/app-main/app-content
structure and nav-sidebar/nav-treeview markup, and convert the dashboard
(index.lp) box/small-box markup to Bootstrap 5 cards as the first fully
migrated page.

Verified against a live container: fixed a chart.js tooltip lookup that
still targeted the old .box selector, restored the header logo mini/full
swap and sidebar user-panel collapse behavior that AdminLTE 2 used to
provide for free, and resolved a duplicate id="navigation" collision
with AdminLTE 4's own accessibility skip-link script.

Every other page still uses the old box/Bootstrap-3-grid/BS3-plugin
markup and will render incorrectly until the remaining migration phases
land.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Adam Warner <me@adamwarner.co.uk>
2026-07-17 22:38:11 +01:00
RD WebDesign 973900bfeb Fix sanitize_hostname() function (Lua) to escape invalid hostnames
The new function uses a single str:gsub() call with multiple replacements,
which is a lot faster than muiltiple calls with single string replacement.

Fix: https://github.com/pi-hole/web/security/advisories/GHSA-pg2q-335w-h75w

Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>
2026-03-19 19:38:47 -03:00
XhmikosR 4aaf7fe0e6 header: move unneeded unauthenticated assets to authenticated
Signed-off-by: XhmikosR <xhmikosr@gmail.com>
2025-06-27 16:43:32 +03:00
XhmikosRandGitHub 3d7f0d47df Lowercase doctype
It's perfectly valid and it should result in smaller compressed size when gzip is used.

Signed-off-by: XhmikosR <xhmikosr@gmail.com>
2025-06-15 08:18:36 +03:00
DominikandGitHub ed09c524ff Replace invalid hostname to prevent XSS (#3401) 2025-05-14 19:37:52 +02:00
RD WebDesign 66f7e1d081 Use mg.script_name to retrieve the scriptname
This value is independent from webhome or prefix

Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>
2025-05-09 00:05:52 -03:00
yubiuser d0829308db Replace hostname string if it contains invalid characters
Signed-off-by: yubiuser <github@yubiuser.dev>
2025-04-26 23:39:39 +02:00
XhmikosR 1fbbb91f51 Remove icheckbox related-code except for primary
v6 doesn't support changing this like v5

Signed-off-by: XhmikosR <xhmikosr@gmail.com>
2025-04-21 12:07:06 +03:00
yubiuserandGitHub 1d9a079fc9 header: fix runtime error when query_string is null (#3395) 2025-04-21 10:21:43 +02:00
DominikandGitHub 380c31f4cf Revert the defer addition for now (#3382) 2025-04-21 09:09:34 +02:00
XhmikosRandGitHub 27b7aaa713 header: fix runtime error when query_string is null
Signed-off-by: XhmikosR <xhmikosr@gmail.com>
2025-04-14 08:45:34 +03:00
yubiuser 6e4a17d8b3 Escape hostname to prevent XSS
Signed-off-by: yubiuser <github@yubiuser.dev>
2025-04-11 09:39:18 +02:00
XhmikosR 2dd128fbfb Revert the defer addition for now
There are still cases we are getting TypeErrors. We should try again after grouping our assets together in all pages.

Signed-off-by: XhmikosR <xhmikosr@gmail.com>
2025-04-03 07:52:28 +03:00
XhmikosRandGitHub f343fac2ab Remove x-dns-prefetch-control meta tag
This is now included in FTL

Signed-off-by: XhmikosR <xhmikosr@gmail.com>
2025-03-30 15:37:00 +03:00
DominikandGitHub fb86db5d30 Remove meta http-equiv="cache-control" (#3353) 2025-03-30 10:40:53 +02:00
XhmikosRandGitHub 39846a3531 Remove meta http-equiv="cache-control"
This is set in FTL to `no-cache, no-store, must-revalidate, private, max-age=0` so this is redundant

Signed-off-by: XhmikosR <xhmikosr@gmail.com>
2025-03-29 10:32:44 +02:00
yubiuser 621ec801e9 Use modernized waitMe plugin
Signed-off-by: yubiuser <github@yubiuser.dev>
2025-03-27 22:01:58 +01:00
XhmikosR 1acb80536b Refactor assets loading
* move fonts first
* move CSS and JS along with the rest
* move default auto theme media checks to the HEAD instead of imports

Also, use `script defer`. This makes the JS files non-blocking.

Signed-off-by: XhmikosR <xhmikosr@gmail.com>
2025-03-23 07:08:37 +02:00
DominikandGitHub 877d5f8cb9 Allow path prefix multiplexing the dashboard and API (#3269) 2025-03-22 20:46:37 +01:00
XhmikosR 7ebf4e07df Update fonts
Remove the .woff files since our supported browsers support .woff2

Signed-off-by: XhmikosR <xhmikosr@gmail.com>
2025-03-12 16:38:06 +02:00
DL6ER 5f3bcdac3c Merge branch 'development' into new/web_prefix
Signed-off-by: DL6ER <dl6er@dl6er.de>
2025-03-09 20:15:59 +01:00
XhmikosR 4e6105bef9 Switch to Font Awesome CSS
It's lighter than the JS

Signed-off-by: XhmikosR <xhmikosr@gmail.com>
2025-03-09 20:01:16 +02:00
XhmikosRandGitHub 6be8b07973 Remove the obsolete X-UA-Compatible meta tag
Signed-off-by: XhmikosR <xhmikosr@gmail.com>
2025-03-09 09:29:15 +02:00
DL6ER f8ef22572a Store value of pihole.webhome() in a globally available variable instead of calling pihole.webhome() multiple times
Signed-off-by: DL6ER <dl6er@dl6er.de>
2025-03-08 21:37:21 +01:00
DL6ER a5e2c627a4 Move the decision whether we are showing the no-HTTPS warning from server-side (where no https may be used when a reverse proxy is used) to user-side where this is more definite
Signed-off-by: DL6ER <dl6er@dl6er.de>
2025-03-06 19:58:57 +01:00
yubiuser 5a48c352df Update actual files
Signed-off-by: yubiuser <github@yubiuser.dev>
2024-10-29 16:31:30 +01:00
yubiuser 1e922a8b29 Move all files from /scripts/pi-hole/ to /scripts/
Signed-off-by: yubiuser <github@yubiuser.dev>
2024-10-28 20:22:09 +01:00