From a28f4e4f1881916139e10859b98ce91d8d72bd64 Mon Sep 17 00:00:00 2001
From: Adam Warner <me@adamwarner.co.uk>
Date: Wed, 23 Dec 2020 18:11:14 +0000
Subject: [PATCH 1/2] Prevent malformed DNS queries executing JS on
 querylog/long term query log

Signed-off-by: Adam Warner <me@adamwarner.co.uk>
---
 scripts/pi-hole/js/db_queries.js | 4 ++--
 scripts/pi-hole/js/queries.js    | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/scripts/pi-hole/js/db_queries.js b/scripts/pi-hole/js/db_queries.js
index ec38f751..1ab5c340 100644
--- a/scripts/pi-hole/js/db_queries.js
+++ b/scripts/pi-hole/js/db_queries.js
@@ -324,8 +324,8 @@ $(function () {
         }
       },
       { width: "10%" },
-      { width: "40%" },
-      { width: "20%", type: "ip-address" },
+      { width: "40%", render: $.fn.dataTable.render.text() },
+      { width: "20%", type: "ip-address", render: $.fn.dataTable.render.text() },
       { width: "10%" },
       { width: "5%" }
     ],
diff --git a/scripts/pi-hole/js/queries.js b/scripts/pi-hole/js/queries.js
index 88779797..c422220e 100644
--- a/scripts/pi-hole/js/queries.js
+++ b/scripts/pi-hole/js/queries.js
@@ -201,7 +201,7 @@ $(function () {
           buttontext = "";
       }
 
-      fieldtext += '<input type="hidden" name="id" value="' + data[4] + '">';
+      fieldtext += '<input type="hidden" name="id" value="' + parseInt(data[4], 10) + '">';
 
       if (colorClass !== false) {
         $(row).addClass(colorClass);

From 62ac1841162a8b77bbf76ae7c78156dda5910be5 Mon Sep 17 00:00:00 2001
From: Adam Warner <me@adamwarner.co.uk>
Date: Wed, 23 Dec 2020 18:42:51 +0000
Subject: [PATCH 2/2] replace "~" by " " in getAllQueries response

Signed-off-by: Adam Warner <me@adamwarner.co.uk>
---
 api_FTL.php | 2 +-
 api_db.php  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/api_FTL.php b/api_FTL.php
index fd445240..3e1b350a 100644
--- a/api_FTL.php
+++ b/api_FTL.php
@@ -323,7 +323,7 @@ else
 		{
 			$tmp = explode(" ",$line);
 			// UTF-8 encode domain
-			$tmp[2] = utf8_encode($tmp[2]);
+			$tmp[2] = utf8_encode(str_replace("~"," ",$tmp[2]));
 			// UTF-8 encode client host name
 			$tmp[3] = utf8_encode($tmp[3]);
 			array_push($allQueries,$tmp);
diff --git a/api_db.php b/api_db.php
index 49270671..76b0ca5f 100644
--- a/api_db.php
+++ b/api_db.php
@@ -154,7 +154,7 @@ if (isset($_GET['getAllQueries']) && $auth)
 						break;
 				}
 				// array:        time     type         domain                client           status   upstream destination
-				$allQueries[] = [$row[0], $query_type, utf8_encode($row[2]), utf8_encode($c), $row[4], utf8_encode($row[5])];
+				$allQueries[] = [$row[0], $query_type, utf8_encode(str_replace("~"," ",$row[2])), utf8_encode($c), $row[4], utf8_encode($row[5])];
 			}
 	}
 	$result = array('data' => $allQueries);