The regex was unanchored: `/[^<>;"]/` matched on the first character that was
not one of those four, so `evil<script>` passed. Output is escaped on render
anyway.
Its only caller is the client field in group management, which takes a host
name or an interface like `:eth0`. FTL matches both verbatim and only records
names of `[A-Za-z0-9._-]`, so we check exactly that.
Signed-off-by: DL6ER <dl6er@dl6er.de>
This branch's code predates development's xo 2 -> 3 upgrade and hadn't been checked against its stricter ruleset. Fix the new violations: drop unnecessary globalThis prefixes on location/matchMedia, prefer location.assign() over href assignment, use early returns instead of wrapping onDropdownClose bodies in an if, fix a parameter shadow in getGroups, and use {capture: true} instead of a bare boolean for addEventListener.
Signed-off-by: Adam Warner <github@promofaux.dev>
This class job was basically make the element 100% wide.
We can replace it with the Bootstrap class: `w-100`, or (if the element
already has its own class) we add `width: 100%`.
Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>
Widen the select column from 15px to 2rem so the checkbox is no longer cramped
against the column edges, centre it horizontally and vertically, and draw a
slightly larger, rounded box (dimmed until the row is selected) so the control
reads as a proper checkbox.
Signed-off-by: DL6ER <dl6er@dl6er.de>
- DataTables: replace the combined BS3 download-builder bundles with
the official core + Bootstrap 5 styling-adapter package pairs
(datatables.net(-buttons/-select) + datatables.net-bs5/-buttons-bs5/
-select-bs5), loaded core-then-adapter.
- bootstrap-select -> Tom Select: bootstrap-select has no Bootstrap 5
build. Add utils.createGroupSelect(), a small wrapper around Tom
Select that recreates bootstrap-select's actionsBox (Select all/
Select none) via a couple of buttons injected into the dropdown, and
use it for all four "assign to group(s)" multi-selects (groups,
groups/clients, groups/domains, groups/lists). Two behavioral fixes
were needed to match the old widget: `hideSelected: false` (Tom
Select refuses to open its dropdown once every option is already
selected, which made the actions box unreachable) and
`dropdownParent: "body"` (otherwise the dropdown is clipped by the
surrounding .table-responsive/.card ancestors' overflow, same reason
bootstrap-select was configured with container: "body").
- bootstrap-toggle -> bootstrap5-toggle: drop-in replacement, same
$.fn.bootstrapToggle() API and onstyle/offstyle option names (all
call sites already used Bootstrap 5-valid color names).
- select2: bump to 4.1.0 and add the select2-bootstrap-5-theme package
for correct Bootstrap 5 styling; wire theme: "bootstrap-5" into both
call sites.
- Remove now-dead bootstrap-select cleanup code (the
"$('body > .bootstrap-select.dropdown').remove()" DataTables
drawCallback lines across 8 files) and dead icheck/bootstrap-select
CSS in pi-hole.css.
Also fixed a Phase 1 regression surfaced by this pass: utils.js's
loadingOverlay() still targeted the old ".wrapper" class instead of
".app-wrapper", throwing whenever a settings page triggered the
Save & Apply overlay.
Verified against a live container: groups/clients' per-row Tom Select
multiselect (open dropdown, Select all/none, Apply, restore-on-cancel),
bootstrap5-toggle switches on groups, select2 filters on the query log,
and DataTables' select/export button row on groups/lists all work with
zero console errors. Settings pages' Save & Apply overlay confirmed
fixed and no longer throwing.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Adam Warner <me@adamwarner.co.uk>
WebKit-based browsers (Safari, DuckDuckGo on macOS) don't yet support
the ES2024 Unicode Sets `v` regex flag, causing a SyntaxError that
prevents all dashboard JavaScript from executing — stats show `---` and
charts spin indefinitely.
None of the affected patterns use v-exclusive features (set notation
`[A--B]`, `[A&&B]`), so downgrading to `u` is fully equivalent and
restores broad compatibility without any functional change.
Also updates xo.config.js to enforce `requireFlag: "u"` so the linter
stays consistent with the codebase.
Affected files (16 occurrences across 8 files):
- scripts/js/utils.js
- scripts/js/index.js
- scripts/js/footer.js
- scripts/js/groups-domains.js
- scripts/js/settings-teleporter.js
- scripts/js/gravity.js
- scripts/js/groups.js
- scripts/js/groups-clients.js
- scripts/js/groups-lists.js
- scripts/js/settings-dns-records.js
- scripts/js/network.js
- scripts/js/taillog.js
Signed-off-by: Austin Gilmour <gilmoursa@gmail.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
DL6ER
Adam Warner
RD WebDesignandAdam Warner
yubiuser
Austin GilmourandClaude Sonnet 4.6
XhmikosR