From 4d1beeb8bfc76f2c13e8c822ecadb07bcbeb1d8a Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sat, 2 Nov 2019 10:20:18 +0100 Subject: [PATCH 1/2] UTF-8 encode all strings read from the database before JSON-encoding them Signed-off-by: DL6ER --- api_db.php | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/api_db.php b/api_db.php index d4f84df7..af296ca2 100644 --- a/api_db.php +++ b/api_db.php @@ -79,6 +79,9 @@ if(isset($_GET["network"]) && $auth) $network_addresses = $db->query("SELECT ip FROM network_addresses WHERE network_id = $id ORDER BY lastSeen DESC"); while($network_addresses !== false && $ip = $network_addresses->fetchArray(SQLITE3_ASSOC)) array_push($res["ip"],$ip["ip"]); + // UTF-8 encode host name and vendor + $res["name"] = utf8_encode($res["name"]); + $res["macVendor"] = utf8_encode($res["macVendor"]); array_push($network, $res); } @@ -148,8 +151,8 @@ if (isset($_GET['getAllQueries']) && $auth) $query_type = "UNKN"; break; } - - $allQueries[] = [$row[0], $query_type, $row[2], $c, $row[4]]; + // array: time type domain client status + $allQueries[] = [$row[0], $query_type, utf8_encode($row[2]), utf8_encode($c), $row[4]]; } } $result = array('data' => $allQueries); @@ -182,8 +185,8 @@ if (isset($_GET['topClients']) && $auth) if(!is_bool($results)) while ($row = $results->fetchArray()) { - - $c = resolveHostname($row[0],false); + // Try to resolve host name and convert to UTF-8 + $c = utf8_encode(resolveHostname($row[0],false)); if(array_key_exists($c, $clientnums)) { @@ -233,8 +236,8 @@ if (isset($_GET['topDomains']) && $auth) if(!is_bool($results)) while ($row = $results->fetchArray()) { - // Convert client to lower case - $c = strtolower($row[0]); + // Convert domain to lower case UTF-8 + $c = utf8_encode(strtolower($row[0])); if(array_key_exists($c, $domains)) { // Entry already exists, add to it (might appear multiple times due to mixed capitalization in the database) @@ -283,7 +286,7 @@ if (isset($_GET['topAds']) && $auth) if(!is_bool($results)) while ($row = $results->fetchArray()) { - $addomains[$row[0]] = intval($row[1]); + $addomains[utf8_encode($row[0])] = intval($row[1]); } $result = array('top_ads' => $addomains); $data = array_merge($data, $result); From 300d8d4b1fe43951de7d8f1dd6536c0411e55bef Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sat, 2 Nov 2019 10:30:07 +0100 Subject: [PATCH 2/2] UTF-8 encode all strings read from the FTL interface before JSON-encoding them Signed-off-by: DL6ER --- api_FTL.php | 50 ++++++++++++++++++++++++++++++++++++-------------- 1 file changed, 36 insertions(+), 14 deletions(-) diff --git a/api_FTL.php b/api_FTL.php index 571fe74b..f1a882d6 100644 --- a/api_FTL.php +++ b/api_FTL.php @@ -104,7 +104,8 @@ else foreach($return as $line) { $tmp = explode(" ",$line); - $top_queries[$tmp[2]] = intval($tmp[1]); + $domain = utf8_encode($tmp[2]); + $top_queries[$domain] = intval($tmp[1]); } if($_GET['topItems'] === "audit") @@ -125,10 +126,11 @@ else foreach($return as $line) { $tmp = explode(" ",$line); + $domain = utf8_encode($tmp[2]); if(count($tmp) > 3) - $top_ads[$tmp[2]." (".$tmp[3].")"] = intval($tmp[1]); + $top_ads[$domain." (".$tmp[3].")"] = intval($tmp[1]); else - $top_ads[$tmp[2]] = intval($tmp[1]); + $top_ads[$domain] = intval($tmp[1]); } $result = array('top_queries' => $top_queries, @@ -163,10 +165,14 @@ else foreach($return as $line) { $tmp = explode(" ",$line); + $clientip = utf8_encode($tmp[2]); if(count($tmp) > 3 && strlen($tmp[3]) > 0) - $top_clients[$tmp[3]."|".$tmp[2]] = intval($tmp[1]); + { + $clientname = utf8_encode($tmp[3]); + $top_clients[$clientname."|".$clientip] = intval($tmp[1]); + } else - $top_clients[$tmp[2]] = intval($tmp[1]); + $top_clients[$clientip] = intval($tmp[1]); } $result = array('top_sources' => $top_clients); @@ -195,10 +201,14 @@ else foreach($return as $line) { $tmp = explode(" ",$line); + $clientip = utf8_encode($tmp[2]); if(count($tmp) > 3 && strlen($tmp[3]) > 0) - $top_clients[$tmp[3]."|".$tmp[2]] = intval($tmp[1]); + { + $clientname = utf8_encode($tmp[3]); + $top_clients[$clientname."|".$clientip] = intval($tmp[1]); + } else - $top_clients[$tmp[2]] = intval($tmp[1]); + $top_clients[$clientip] = intval($tmp[1]); } $result = array('top_sources_blocked' => $top_clients); @@ -220,10 +230,14 @@ else foreach($return as $line) { $tmp = explode(" ",$line); + $forwardip = utf8_encode($tmp[2]); if(count($tmp) > 3 && strlen($tmp[3]) > 0) - $forward_dest[$tmp[3]."|".$tmp[2]] = floatval($tmp[1]); + { + $forwardname = utf8_encode($tmp[3]); + $forward_dest[$forwardname."|".$forwardip] = floatval($tmp[1]); + } else - $forward_dest[$tmp[2]] = floatval($tmp[1]); + $forward_dest[$forwardip] = floatval($tmp[1]); } $result = array('forward_destinations' => $forward_dest); @@ -238,6 +252,7 @@ else foreach($return as $ret) { $tmp = explode(": ",$ret); + // Reply cannot contain non-ASCII characters $querytypes[$tmp[0]] = floatval($tmp[1]); } @@ -253,6 +268,7 @@ else foreach($return as $ret) { $tmp = explode(": ",$ret); + // Reply cannot contain non-ASCII characters $cacheinfo[$tmp[0]] = floatval($tmp[1]); } @@ -301,6 +317,10 @@ else foreach($return as $line) { $tmp = explode(" ",$line); + // UTF-8 encode domain + $tmp[2] = utf8_encode($tmp[2]); + // UTF-8 encode client host name + $tmp[3] = utf8_encode($tmp[3]);; array_push($allQueries,$tmp); } @@ -311,7 +331,7 @@ else if(isset($_GET["recentBlocked"])) { sendRequestFTL("recentBlocked"); - die(getResponseFTL()[0]); + die(utf8_encode(getResponseFTL()[0])); unset($data); } @@ -323,13 +343,15 @@ else foreach($return as $line) { $tmp = explode(" ",$line); + $forwardip = utf8_encode($tmp[2]); if(count($tmp) > 3) { - $forward_dest[$tmp[3]."|".$tmp[2]] = floatval($tmp[1]); + $forwardname = utf8_encode($tmp[3]); + $forward_dest[$forwardname."|".$forwardip] = floatval($tmp[1]); } else { - $forward_dest[$tmp[2]] = floatval($tmp[1]); + $forward_dest[$forwardip] = floatval($tmp[1]); } } @@ -363,8 +385,8 @@ else { $tmp = explode(" ", $line); $client_names[] = array( - "name" => $tmp[0], - "ip" => $tmp[1] + "name" => utf8_encode($tmp[0]), + "ip" => utf8_encode($tmp[1]) ); }