From 3169b5ba887890e7787331444e4058e6d206d551 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Fri, 24 Aug 2018 14:09:08 +0200 Subject: [PATCH 1/4] Add selection for query types on long term DB query log page Signed-off-by: DL6ER --- api_db.php | 56 +++++++++++++++++++++++++++++++- db_queries.php | 40 +++++++++++++++++++++++ scripts/pi-hole/js/db_queries.js | 47 +++++++++++++++++++++++++-- 3 files changed, 140 insertions(+), 3 deletions(-) diff --git a/api_db.php b/api_db.php index 567e2c32..ef3cfdfc 100644 --- a/api_db.php +++ b/api_db.php @@ -101,7 +101,61 @@ if (isset($_GET['getAllQueries']) && $auth) { $from = intval($_GET["from"]); $until = intval($_GET["until"]); - $stmt = $db->prepare("SELECT timestamp, type, domain, client, status FROM queries WHERE timestamp >= :from AND timestamp <= :until ORDER BY timestamp ASC"); + $dbquery = "SELECT timestamp, type, domain, client, status FROM queries WHERE timestamp >= :from AND timestamp <= :until "; + if(isset($_GET["types"])) + { + $types = intval($_GET["types"]); + $typestr = ""; + if($types & 1) // GRAVITY + { + $typestr = "1"; + } + if($types & 2) // FORWARDED + { + if(strlen($typestr) > 0) + { + $typestr .= ","; + } + $typestr .= "2"; + } + if($types & 4) // CACHED + { + if(strlen($typestr) > 0) + { + $typestr .= ","; + } + $typestr .= "3"; + } + if($types & 8) // REGEX/WILDCARD + { + if(strlen($typestr) > 0) + { + $typestr .= ","; + } + $typestr .= "4"; + } + if($types & 16) // BLACKLIST + { + if(strlen($typestr) > 0) + { + $typestr .= ","; + } + $typestr .= "5"; + } + if($types & 32) // EXTERNAL + { + if(strlen($typestr) > 0) + { + $typestr .= ","; + } + $typestr .= "6"; + } + + // Append selector to DB query + $dbquery .= "AND status IN (".$typestr.") "; + } + $dbquery .= "ORDER BY timestamp ASC"; + $stmt = $db->prepare($dbquery); $stmt->bindValue(":from", intval($from), SQLITE3_INTEGER); $stmt->bindValue(":until", intval($until), SQLITE3_INTEGER); $results = $stmt->execute(); diff --git a/db_queries.php b/db_queries.php index 3c81e201..5c003ac1 100644 --- a/db_queries.php +++ b/db_queries.php @@ -40,6 +40,46 @@ $token = $_SESSION['token']; +
+
+
+ +
+
+
+ +
+
+
+
+ +
+
+
+
+ +
+
+
+
+ +
+
+
+
+ +
+
+
+
+ +
+
+
+
+
+
+ diff --git a/scripts/pi-hole/js/db_queries.js b/scripts/pi-hole/js/db_queries.js index 916fc9e0..2cc37d0a 100644 --- a/scripts/pi-hole/js/db_queries.js +++ b/scripts/pi-hole/js/db_queries.js @@ -130,17 +130,48 @@ function handleAjaxError( xhr, textStatus, error ) { } else if(xhr.responseText.indexOf("Connection refused") >= 0) { - alert( "An error occured while loading the data: Connection refused. Is FTL running?" ); + alert( "An error occurred while loading the data: Connection refused. Is FTL running?" ); } else { - alert( "An unknown error occured while loading the data.\n"+xhr.responseText ); + alert( "An unknown error occurred while loading the data.\n"+xhr.responseText ); } $("#all-queries_processing").hide(); tableApi.clear(); tableApi.draw(); } +function getQueryTypes() +{ + var queryType = 0; + if($("#type_gravity").prop("checked")) + { + queryType = 1; + } + if($("#type_forwarded").prop("checked")) + { + queryType += 1 << 1; + } + if($("#type_cached").prop("checked")) + { + queryType += 1 << 2; + } + if($("#type_regex").prop("checked")) + { + queryType += 1 << 3; + } + if($("#type_blacklist").prop("checked")) + { + queryType += 1 << 4; + } + if($("#type_external").prop("checked")) + { + queryType += 1 << 5; + } + console.log(queryType); + return queryType; +} + var reloadCallback = function() { timeoutWarning.hide(); @@ -176,6 +207,12 @@ var reloadCallback = function() function refreshTableData() { timeoutWarning.show(); var APIstring = "api_db.php?getAllQueries&from="+from+"&until="+until; + // Check if query type filtering is enabled + var queryType = getQueryTypes(); + if(queryType != 63) // 63 (0b00111111) = all possible query types are selected + { + APIstring += "&types="+queryType; + } statistics = [0,0,0]; tableApi.ajax.url(APIstring).load(reloadCallback); } @@ -192,6 +229,12 @@ $(document).ready(function() { { APIstring = "api_db.php?getAllQueries=empty"; } + // Check if query type filtering is enabled + var queryType = getQueryTypes(); + if(queryType != 63) // 63 (0b00111111) = all possible query types are selected + { + APIstring += "&types="+queryType; + } tableApi = $("#all-queries").DataTable( { "rowCallback": function( row, data, index ){ From 7ee18746724f80036ed20d69685c3b5207de1257 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Fri, 24 Aug 2018 14:25:02 +0200 Subject: [PATCH 2/4] Optimize HTML and JS Signed-off-by: DL6ER --- db_queries.php | 60 +++++++++++++++----------------- scripts/pi-hole/js/db_queries.js | 5 ++- 2 files changed, 31 insertions(+), 34 deletions(-) diff --git a/db_queries.php b/db_queries.php index 5c003ac1..ddb633f2 100644 --- a/db_queries.php +++ b/db_queries.php @@ -42,39 +42,37 @@ $token = $_SESSION['token'];
-
-
-
-
- -
+
+
+
+
+
-
-
- -
-
-
-
- -
-
-
-
- -
-
-
-
- -
-
-
-
- -
-
+
+
+
+ +
+
+
+
+ +
+
+
+
+ +
+
+
+
+ +
+
+
+
+
diff --git a/scripts/pi-hole/js/db_queries.js b/scripts/pi-hole/js/db_queries.js index 83d61e87..ae69775d 100644 --- a/scripts/pi-hole/js/db_queries.js +++ b/scripts/pi-hole/js/db_queries.js @@ -168,7 +168,6 @@ function getQueryTypes() { queryType += 1 << 5; } - console.log(queryType); return queryType; } @@ -209,7 +208,7 @@ function refreshTableData() { var APIstring = "api_db.php?getAllQueries&from="+from+"&until="+until; // Check if query type filtering is enabled var queryType = getQueryTypes(); - if(queryType != 63) // 63 (0b00111111) = all possible query types are selected + if(queryType !== 63) // 63 (0b00111111) = all possible query types are selected { APIstring += "&types="+queryType; } @@ -231,7 +230,7 @@ $(document).ready(function() { } // Check if query type filtering is enabled var queryType = getQueryTypes(); - if(queryType != 63) // 63 (0b00111111) = all possible query types are selected + if(queryType !== 63) // 63 (0b00111111) = all possible query types are selected { APIstring += "&types="+queryType; } From d2ecf1c70a8f95e1ea21834d09834f249d6b360a Mon Sep 17 00:00:00 2001 From: DL6ER Date: Thu, 30 Aug 2018 15:02:33 +0200 Subject: [PATCH 3/4] Use comma-separated list of type integers instead of byte-coded integer. Signed-off-by: DL6ER --- api_db.php | 55 ++++++-------------------------- scripts/pi-hole/js/db_queries.js | 19 +++++------ 2 files changed, 20 insertions(+), 54 deletions(-) diff --git a/api_db.php b/api_db.php index ef3cfdfc..daa04813 100644 --- a/api_db.php +++ b/api_db.php @@ -104,55 +104,20 @@ if (isset($_GET['getAllQueries']) && $auth) $dbquery = "SELECT timestamp, type, domain, client, status FROM queries WHERE timestamp >= :from AND timestamp <= :until "; if(isset($_GET["types"])) { - $types = intval($_GET["types"]); - $typestr = ""; - if($types & 1) // GRAVITY + $types = $_GET["types"]; + if(preg_match("/^[0-9]+(?:,[0-9]+)*$/", $types) === 1) { - $typestr = "1"; + // Append selector to DB query. The used regex ensures + // that only numbers, separated by commas are accepted + // to avoid code injection and other malicious things + // We accept only valid lists like "1,2,3" + // We reject ",2,3", "1,2," and similar arguments + $dbquery .= "AND status IN (".$types.") "; } - if($types & 2) // FORWARDED + else { - if(strlen($typestr) > 0) - { - $typestr .= ","; - } - $typestr .= "2"; + die("Error. Selector types specified using an invalid format."); } - if($types & 4) // CACHED - { - if(strlen($typestr) > 0) - { - $typestr .= ","; - } - $typestr .= "3"; - } - if($types & 8) // REGEX/WILDCARD - { - if(strlen($typestr) > 0) - { - $typestr .= ","; - } - $typestr .= "4"; - } - if($types & 16) // BLACKLIST - { - if(strlen($typestr) > 0) - { - $typestr .= ","; - } - $typestr .= "5"; - } - if($types & 32) // EXTERNAL - { - if(strlen($typestr) > 0) - { - $typestr .= ","; - } - $typestr .= "6"; - } - - // Append selector to DB query - $dbquery .= "AND status IN (".$typestr.") "; } $dbquery .= "ORDER BY timestamp ASC"; $stmt = $db->prepare($dbquery); diff --git a/scripts/pi-hole/js/db_queries.js b/scripts/pi-hole/js/db_queries.js index 67738ae7..3526cb04 100644 --- a/scripts/pi-hole/js/db_queries.js +++ b/scripts/pi-hole/js/db_queries.js @@ -143,32 +143,32 @@ function handleAjaxError( xhr, textStatus, error ) { function getQueryTypes() { - var queryType = 0; + var queryType = []; if($("#type_gravity").prop("checked")) { - queryType = 1; + queryType.push(1); } if($("#type_forwarded").prop("checked")) { - queryType += 1 << 1; + queryType.push(2); } if($("#type_cached").prop("checked")) { - queryType += 1 << 2; + queryType.push(3); } if($("#type_regex").prop("checked")) { - queryType += 1 << 3; + queryType.push(4); } if($("#type_blacklist").prop("checked")) { - queryType += 1 << 4; + queryType.push(5); } if($("#type_external").prop("checked")) { - queryType += 1 << 5; + queryType.push(6); } - return queryType; + return queryType.join(","); } var reloadCallback = function() @@ -208,8 +208,9 @@ function refreshTableData() { var APIstring = "api_db.php?getAllQueries&from="+from+"&until="+until; // Check if query type filtering is enabled var queryType = getQueryTypes(); - if(queryType !== 63) // 63 (0b00111111) = all possible query types are selected + if(queryType !== "1,2,3,4,5,6") { + console.log(queryType); APIstring += "&types="+queryType; } statistics = [0,0,0]; From 26ab341669e5817538d50b22090debf29a58f47c Mon Sep 17 00:00:00 2001 From: DL6ER Date: Thu, 30 Aug 2018 15:37:04 +0200 Subject: [PATCH 4/4] Remove debug statement Signed-off-by: DL6ER --- scripts/pi-hole/js/db_queries.js | 1 - 1 file changed, 1 deletion(-) diff --git a/scripts/pi-hole/js/db_queries.js b/scripts/pi-hole/js/db_queries.js index 3526cb04..f50d9802 100644 --- a/scripts/pi-hole/js/db_queries.js +++ b/scripts/pi-hole/js/db_queries.js @@ -210,7 +210,6 @@ function refreshTableData() { var queryType = getQueryTypes(); if(queryType !== "1,2,3,4,5,6") { - console.log(queryType); APIstring += "&types="+queryType; } statistics = [0,0,0];