pi-hole/web
1
0
Fork 0
mirror of https://github.com/pi-hole/web.git synced 2024-12-06 19:36:21 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1665 from pi-hole/fix/escape-all-the-things

Browse Source 
Prevent malformed DNS queries executing JS on querylog/long term query pages
This commit is contained in:
DL6ER
2020-12-23 20:47:36 +01:00
committed by GitHub
parent 49a084076e 62ac184116
commit 8d73511005
4 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api_FTL.php
+1 -1
View File
@@ -323,7 +323,7 @@ else
{
$tmp = explode(" ",$line);
// UTF-8 encode domain
$tmp[2] = utf8_encode($tmp[2]);
$tmp[2] = utf8_encode(str_replace("~"," ",$tmp[2]));
// UTF-8 encode client host name
$tmp[3] = utf8_encode($tmp[3]);
array_push($allQueries,$tmp);
api_db.php
+1 -1
View File
@@ -154,7 +154,7 @@ if (isset($_GET['getAllQueries']) && $auth)
break;
}
// array: time type domain client status upstream destination
$allQueries[] = [$row[0], $query_type, utf8_encode($row[2]), utf8_encode($c), $row[4], utf8_encode($row[5])];
$allQueries[] = [$row[0], $query_type, utf8_encode(str_replace("~"," ",$row[2])), utf8_encode($c), $row[4], utf8_encode($row[5])];
}
}
$result = array('data' => $allQueries);
scripts/pi-hole/js/db_queries.js
+2 -2
View File
@@ -324,8 +324,8 @@ $(function () {
}
},
{ width: "10%" },
{ width: "40%" },
{ width: "20%", type: "ip-address" },
{ width: "40%", render: $.fn.dataTable.render.text() },
{ width: "20%", type: "ip-address", render: $.fn.dataTable.render.text() },
{ width: "10%" },
{ width: "5%" }
],
scripts/pi-hole/js/queries.js
+1 -1
View File
@@ -201,7 +201,7 @@ $(function () {
buttontext = "";
}
fieldtext += '<input type="hidden" name="id" value="' + data[4] + '">';
fieldtext += '<input type="hidden" name="id" value="' + parseInt(data[4], 10) + '">';
if (colorClass !== false) {
$(row).addClass(colorClass);