The name only made sense next to a non-strict counterpart, and that one is
gone. Its comment claimed to reject characters invalid in DNS names, which
underscores are not - say what the regex actually does instead.
Signed-off-by: DL6ER <dl6er@dl6er.de>
The regex was unanchored: `/[^<>;"]/` matched on the first character that was
not one of those four, so `evil<script>` passed. Output is escaped on render
anyway.
Its only caller is the client field in group management, which takes a host
name or an interface like `:eth0`. FTL matches both verbatim and only records
names of `[A-Za-z0-9._-]`, so we check exactly that.
Signed-off-by: DL6ER <dl6er@dl6er.de>
`hexEncode()` padded every code point to four hex digits and `hexDecode()`
chopped the string back into four-character groups. That works up to
`U+FFFF`, but code points go up to `U+10FFFF`: an emoji such as `U+1F4D2`
is encoded as the five-digit group `1f4d2`, after which the decoder is out
of step and returns garbage for the remainder of the string.
The tables carry the address/domain/client/name of each row in a
`data-address` (resp. `data-id`) attribute in this encoding, so a list
subscribed with an emoji in its address could neither be deleted nor
edited - we asked FTL to remove something that is not in the database and
it correctly answered `404`.
Widen both functions to six digits, which covers the whole Unicode range.
The encoding never leaves the page, so there is nothing to migrate.
Signed-off-by: DL6ER <dl6er@dl6er.de>
The functions should only accept IPs with an optional port:
- IPs are valid: "a.b.c.d"
- IPs with port ("a.b.c.d#p") are allowed if the port is valid
- network ranges (CIDR) should be rejected
- empty ports ("a.b.c.d#") should be rejected
- all other strings should be rejected
Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>
Adding a domain from the query log opens a modal that, on any HTTP
error, showed a fixed "Timeout or Network Connection Error!" text. The
most common case - the domain is already on the list - is returned by
FTL as HTTP 400 with `{"error":{"hint":"The item is already present"}}`,
so it surfaced as a misleading network error.
We now read the JSON error body and show its hint (or message), falling
back to the network-error text only when there genuinely is no response
body.
Signed-off-by: DL6ER <dl6er@dl6er.de>
- Replace the old `.hidden-*` classes and use the new `.d-*-none`. This
classes apply `display: none` to the elements matching the size or above
- remove unused/unnecessary classes from pi-hole.css
Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>
This class job was basically make the element 100% wide.
We can replace it with the Bootstrap class: `w-100`, or (if the element
already has its own class) we add `width: 100%`.
Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>
The new theme (AdminLTE 4 + Bootstrap 5) uses different z-index for some
elements. The `nav#navigation` element uses z-index=1034, which is higher
than the default inital z-index (1030) used by bootstrap-notify, resulting
in notifications partially hidden under the navigation bar.
Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>
The Bootstrap 3 -> 5 jump silently dropped several utilities and defaults the
templates still relied on, leaving elements mis-rendered:
- `.hidden` no longer exists in Bootstrap 5, so every element toggled via it
(the 2FA login field, the diagnosis `warning-count` badge, the "reset
sorting" and "enable 2FA" buttons) was permanently visible. Restore it.
- `.btn-block` was removed; restore it so the settings "Actions" and gravity
buttons fill their grid column again instead of collapsing left-aligned.
- AdminLTE 4 resets `.card` bottom margin to 0, removing the vertical rhythm
between stacked cards. Restore a consistent `margin-bottom`.
- `.btn-toolbar` no longer spaces its button groups; add a small gap.
- The header logo/wordmark is no longer swapped when the sidebar collapses, so
"Pi-hole" wrapped in the narrow header. Show the compact "Ph" mark instead.
- The domain-management tab links were missing the `nav-item`/`nav-link`
classes Bootstrap 5 requires, so they rendered as bare text.
Also tone down the over-bright `h4` heading colour (`#44def1`) in the dark
theme to the theme's own accent blue, and hide the Tom Select "none selected"
placeholder once a group is selected.
Signed-off-by: DL6ER <dl6er@dl6er.de>
- DataTables: replace the combined BS3 download-builder bundles with
the official core + Bootstrap 5 styling-adapter package pairs
(datatables.net(-buttons/-select) + datatables.net-bs5/-buttons-bs5/
-select-bs5), loaded core-then-adapter.
- bootstrap-select -> Tom Select: bootstrap-select has no Bootstrap 5
build. Add utils.createGroupSelect(), a small wrapper around Tom
Select that recreates bootstrap-select's actionsBox (Select all/
Select none) via a couple of buttons injected into the dropdown, and
use it for all four "assign to group(s)" multi-selects (groups,
groups/clients, groups/domains, groups/lists). Two behavioral fixes
were needed to match the old widget: `hideSelected: false` (Tom
Select refuses to open its dropdown once every option is already
selected, which made the actions box unreachable) and
`dropdownParent: "body"` (otherwise the dropdown is clipped by the
surrounding .table-responsive/.card ancestors' overflow, same reason
bootstrap-select was configured with container: "body").
- bootstrap-toggle -> bootstrap5-toggle: drop-in replacement, same
$.fn.bootstrapToggle() API and onstyle/offstyle option names (all
call sites already used Bootstrap 5-valid color names).
- select2: bump to 4.1.0 and add the select2-bootstrap-5-theme package
for correct Bootstrap 5 styling; wire theme: "bootstrap-5" into both
call sites.
- Remove now-dead bootstrap-select cleanup code (the
"$('body > .bootstrap-select.dropdown').remove()" DataTables
drawCallback lines across 8 files) and dead icheck/bootstrap-select
CSS in pi-hole.css.
Also fixed a Phase 1 regression surfaced by this pass: utils.js's
loadingOverlay() still targeted the old ".wrapper" class instead of
".app-wrapper", throwing whenever a settings page triggered the
Save & Apply overlay.
Verified against a live container: groups/clients' per-row Tom Select
multiselect (open dropdown, Select all/none, Apply, restore-on-cancel),
bootstrap5-toggle switches on groups, select2 filters on the query log,
and DataTables' select/export button row on groups/lists all work with
zero console errors. Settings pages' Save & Apply overlay confirmed
fixed and no longer throwing.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Adam Warner <me@adamwarner.co.uk>
Convert the remaining 20 .lp templates from AdminLTE 2's .box/.panel
component family to Bootstrap 5 .card markup, matching the pattern
established in index.lp/queries.lp during the layout migration:
box/box-header/box-title/box-body/box-footer -> card equivalents,
box-info/-danger/-warning etc. -> card-info/-danger/-warning +
card-outline for the non-solid variant, collapsed-box + data-widget
-> collapsed-card + data-lte-toggle="card-collapse" with the dual
expand/collapse icon AdminLTE 4 expects. Also renames the accompanying
Bootstrap-3-isms throughout (col-xs-*, pull-left/right, input-group-addon,
data-toggle/-dismiss/-backdrop/-keyboard, label -> badge, btn-default,
BS3 modal close-button markup).
Fix the JS-side selectors that referenced the old markup and would have
silently broken once the classes changed: charts.js's tooltip anchor
lookup, footer.js's "no visible cards" redirect check, login.js's
2FA/forgot-password card color swap (plus made both boxes consistently
non-solid so the swap doesn't need to touch card-outline), and
settings-advanced.js's dynamically generated settings cards and its
manual Bootstrap 3 "in"/"active" tab-pane class toggling (Bootstrap 5
renamed .in to .show). Rewrite settings-dhcp.js's jQuery-plugin tooltip
delegation (`$("body").tooltip(...)`, `.tooltip("hide")`) as a small
lazily-instantiating delegated listener plus direct bootstrap.Tooltip
calls, since Bootstrap 5 dropped jQuery integration entirely and the
DHCP lease action buttons are added to the DOM dynamically. Restore
Bootstrap 3's .has-error/.has-warning/.has-success form-validation
color feedback in pi-hole.css, since Bootstrap 5 dropped those classes
in favor of .is-invalid/.is-valid and a couple of pages still toggle
the old class names for simple color-coded feedback.
Refresh package-lock.json for the admin-lte/bootstrap version bump from
the previous commit.
Verified against a live container: dashboard, query log (incl. the
collapsible advanced-filter card and populated DataTable), groups/lists,
groups/domains, and settings/dns all render correctly with zero console
errors; card-collapse toggling confirmed working on the query log's
filter card. Plugin-styled elements (select2/bootstrap-select dropdowns,
DataTables chrome, icheck checkboxes, bootstrap-toggle switches, nav-tabs)
still look wrong until the JS-plugin-swap phase lands, as expected.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Signed-off-by: Adam Warner <me@adamwarner.co.uk>
`unicorn/prefer-scoped-selector` (new in xo 3) requires `:scope` in
combined element queries, so the selector was changed to
`:scope > .btn-box-tool > i`. The child combinator `>` after `:scope` is
wrong though: the box markup nests the tool button as
`.box > .box-header > .box-tools > button.btn-box-tool`, so a direct-child
query matched nothing and the collapse/expand chevron never toggled on
`#forgot-pw-box` (login) and `#custom-servers-box` (settings/dns). Use the
descendant combinator `:scope .btn-box-tool > i`, which the rule's own
suggestion inserts and which correctly resolves the icon in the header.
Signed-off-by: DL6ER <dl6er@dl6er.de>
WebKit-based browsers (Safari, DuckDuckGo on macOS) don't yet support
the ES2024 Unicode Sets `v` regex flag, causing a SyntaxError that
prevents all dashboard JavaScript from executing — stats show `---` and
charts spin indefinitely.
None of the affected patterns use v-exclusive features (set notation
`[A--B]`, `[A&&B]`), so downgrading to `u` is fully equivalent and
restores broad compatibility without any functional change.
Also updates xo.config.js to enforce `requireFlag: "u"` so the linter
stays consistent with the codebase.
Affected files (16 occurrences across 8 files):
- scripts/js/utils.js
- scripts/js/index.js
- scripts/js/footer.js
- scripts/js/groups-domains.js
- scripts/js/settings-teleporter.js
- scripts/js/gravity.js
- scripts/js/groups.js
- scripts/js/groups-clients.js
- scripts/js/groups-lists.js
- scripts/js/settings-dns-records.js
- scripts/js/network.js
- scripts/js/taillog.js
Signed-off-by: Austin Gilmour <gilmoursa@gmail.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Also fix 2 issues on validation functions:
- better regex for validateMAC()
- make sure validateIPv6Brackets() correctly trims the value before
validation
Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>
Only accept valid hostnames:
Previously, invalid hostnames were trigerring the cell highlighting,
but invalid entries were still accepted when using the green "save"
button. Now, hostnames are saved only if they pass the validation,
like other values.
Only allow IPv6 enclosed in square brackets:
The previous validation function used to validate IPv6 didn't accept
brackets, resulting in errors when an IPv6 was typed directly on the
table cell. A new function was created to validate IPv6 enclosed in
brackets.
Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>
Also remove the old code used to read hideNonfatalDnsmasqWarnings_chkbox
from localstorage. This value was a leftover from v5 web interface.
Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>
DL6ER
RD WebDesignandGitHub
Austin GilmourandClaude Sonnet 4.6
XhmikosR