From 80dba39a369a87c24249ec535be2e138f0e20af5 Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Thu, 19 Oct 2023 19:05:45 +0200
Subject: [PATCH 1/3] Fix mass-deletion of sessions on the settings -> API page

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 scripts/pi-hole/js/settings-api.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/pi-hole/js/settings-api.js b/scripts/pi-hole/js/settings-api.js
index d2e80cc8..c76eb052 100644
--- a/scripts/pi-hole/js/settings-api.js
+++ b/scripts/pi-hole/js/settings-api.js
@@ -70,7 +70,7 @@ $(function () {
       $("body > .bootstrap-select.dropdown").remove();
     },
     rowCallback: function (row, data) {
-      $(row).attr("data-id", data.ip);
+      $(row).attr("data-id", data.id);
       var button =
         '<button type="button" class="btn btn-danger btn-xs" id="deleteSession_' +
         data.id +
@@ -148,7 +148,7 @@ $(function () {
             ids.push(parseInt($(this).attr("data-id"), 10));
           });
           // Delete all selected rows at once
-          delSession(ids);
+          delSessions(ids);
         },
       },
     ],

From 7595ceb17fc44769d4337c28f19bb83fd967c573 Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Mon, 23 Oct 2023 22:11:01 +0200
Subject: [PATCH 2/3] Ensure the own session is only removed once all other
 sessions removals finished. This also ensures our own session is NOT deleted
 on error so the user can still see the generated error message

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 scripts/pi-hole/js/settings-api.js | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/scripts/pi-hole/js/settings-api.js b/scripts/pi-hole/js/settings-api.js
index c76eb052..873fa5bc 100644
--- a/scripts/pi-hole/js/settings-api.js
+++ b/scripts/pi-hole/js/settings-api.js
@@ -9,6 +9,7 @@
 
 var apiSessionsTable = null;
 var ownSessionID = null;
+var deleted = 0;
 var TOTPdata = null;
 
 function renderBool(data, type) {
@@ -206,9 +207,12 @@ function delSessions(ids) {
     return parseInt(value, 10);
   });
 
-  // Check if own session is selected
+  // Check if own session is selected and remove it when deleting multiple
+  // We need this only when multiple sessions are removed to ensure we do not
+  // accidentally remove our own session and thus log us out *before* we can
+  // remove the other sessions
   let ownSessionDelete = false;
-  if (ids.includes(ownSessionID)) {
+  if (ids.includes(ownSessionID) && ids.length > 1) {
     ownSessionDelete = true;
     // Strip own session ID from array
     ids = ids.filter(function (value) {
@@ -217,24 +221,24 @@ function delSessions(ids) {
   }
 
   // Loop through IDs and delete them
+  deleted = 0;
   for (const id of ids) {
-    if (Object.hasOwnProperty.call(ids, id)) {
-      delSession(ids[id]);
-    }
-  }
-
-  // Delete own session last (if selected)
-  if (ownSessionDelete) {
-    delSession(ownSessionID);
+    delSession(id, ids.length, ownSessionDelete);
   }
 }
 
-function delSession(id) {
+function delSession(id, len, ownSessionDelete) {
   $.ajax({
     url: "/api/auth/session/" + id,
     method: "DELETE",
   })
     .done(function () {
+      // Do not reload page when deleting multiple sessions
+      if (++deleted < len) return;
+
+      // All other sessions have been deleted, now delete own session
+      if (ownSessionDelete) delSession(ownSessionID, 1, false);
+
       if (id !== ownSessionID) {
         // Reload table to remove session
         apiSessionsTable.ajax.reload();

From b84683e1a9221fe4bd11391faedf97a847f335fc Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Thu, 26 Oct 2023 00:11:15 +0200
Subject: [PATCH 3/3] Rename functions for clarity

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 scripts/pi-hole/js/settings-api.js | 30 ++++++++++++++++++++----------
 1 file changed, 20 insertions(+), 10 deletions(-)

diff --git a/scripts/pi-hole/js/settings-api.js b/scripts/pi-hole/js/settings-api.js
index 873fa5bc..e498f297 100644
--- a/scripts/pi-hole/js/settings-api.js
+++ b/scripts/pi-hole/js/settings-api.js
@@ -61,7 +61,7 @@ $(function () {
       },
     ],
     drawCallback: function () {
-      $('button[id^="deleteSession_"]').on("click", deleteSession);
+      $('button[id^="deleteSession_"]').on("click", deleteThisSession);
 
       // Hide buttons if all messages were deleted
       var hasRows = this.api().rows({ filter: "applied" }).data().length > 0;
@@ -149,7 +149,7 @@ $(function () {
             ids.push(parseInt($(this).attr("data-id"), 10));
           });
           // Delete all selected rows at once
-          delSessions(ids);
+          deleteMultipleSessions(ids);
         },
       },
     ],
@@ -187,13 +187,18 @@ $(function () {
   });
 });
 
-function deleteSession() {
-  // Passes the button data-del-id attribute as ID
-  var ids = [$(this).attr("data-del-id")];
-  delSessions(ids);
+function deleteThisSession() {
+  // This function is called when a red trash button is clicked
+  // We get the ID of the current item from the data-del-id attribute
+  const thisID = parseInt(this.attr("data-del-id"), 10);
+  deleted = 0;
+  deleteOneSession(thisID, 1, false);
 }
 
-function delSessions(ids) {
+function deleteMultipleSessions(ids) {
+  // This function is called when multiple sessions are selected and the gray
+  // trash button is clicked
+
   // Check input validity
   if (!Array.isArray(ids)) return;
 
@@ -223,11 +228,16 @@ function delSessions(ids) {
   // Loop through IDs and delete them
   deleted = 0;
   for (const id of ids) {
-    delSession(id, ids.length, ownSessionDelete);
+    deleteOneSession(id, ids.length, ownSessionDelete);
   }
 }
 
-function delSession(id, len, ownSessionDelete) {
+function deleteOneSession(id, len, ownSessionDelete) {
+  // This function is called to delete a single session
+  // If we are batch deleting, we ensure that we do not delete our own session
+  // before having successfully deleted all other sessions, the deletion of
+  // our own session is then triggered by the last successful deletion of
+  // another session (ownSessionDelete == true, len == global deleted)
   $.ajax({
     url: "/api/auth/session/" + id,
     method: "DELETE",
@@ -237,7 +247,7 @@ function delSession(id, len, ownSessionDelete) {
       if (++deleted < len) return;
 
       // All other sessions have been deleted, now delete own session
-      if (ownSessionDelete) delSession(ownSessionID, 1, false);
+      if (ownSessionDelete) deleteOneSession(ownSessionID, 1, false);
 
       if (id !== ownSessionID) {
         // Reload table to remove session