Merge remote-tracking branch 'upstream/devel' into devel

Sync AdminLTE to local devel

php/get.php

@@ -3,6 +3,10 @@ if(!isset($_GET['list']))
     die();
 
 $type = $_GET['list'];
+
+if($type !== "white" && $type !== "black")
+    die("Invalid list parameter");
+
 $rawList = file_get_contents("/etc/pihole/${type}list.txt");
 $list = explode("\n", $rawList);
 
@@ -12,4 +16,18 @@ for($i = sizeof($list)-1; $i >= 0; $i--) {
         unset($list[$i]);
 }
 
-echo json_encode(array_values($list));
+function filterArray(&$a) {
+    $sanArray = array();
+    foreach ($a as $k=>$v) {
+        if (is_array($v)) {
+            $sanArray[htmlspecialchars($k)] = filterArray($v);
+        } else {
+            $sanArray[htmlspecialchars($k)] = htmlspecialchars($v);
+        }
+    }
+    return $sanArray;
+}
+
+// Protect against XSS attacks
+$list = filterArray($list);
+echo json_encode(array_values($list));