pi-hole/web
1
0
Fork 0
mirror of https://github.com/pi-hole/web.git synced 2024-12-06 19:36:21 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fixing minor inconsistencies

Browse Source 
Signed-off-by: RD WebDesign <github@rdwebdesign.com.br>
This commit is contained in:
RD WebDesign
2022-05-07 15:37:39 -03:00
parent a2cb6821dc
commit f0bd5d725e
5 changed files with 25 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/pi-hole/js/groups-adlists.js
+1 -1
View File
@@ -119,7 +119,7 @@ function initTable() {
{ data: "id", visible: false },
{ data: null, visible: true, orderable: false, width: "15px" },
{ data: "status", searchable: false, class: "details-control" },
{ data: "address", orderable: false },
{ data: "address" },
{ data: "enabled", searchable: false },
{ data: "comment" },
{ data: "groups", searchable: false },
scripts/pi-hole/js/groups-clients.js
+1 -2
View File
@@ -92,7 +92,7 @@ function initTable() {
order: [[0, "asc"]],
columns: [
{ data: "id", visible: false },
{ data: null, visible: true, width: "15px" },
{ data: null, visible: true, orderable: false, width: "15px" },
{ data: "ip", type: "ip-address" },
{ data: "comment" },
{ data: "groups", searchable: false },
@@ -101,7 +101,6 @@ function initTable() {
columnDefs: [
{
targets: 1,
orderable: false,
className: "select-checkbox",
render: function () {
return "";
scripts/pi-hole/js/groups-domains.js
-1
View File
@@ -80,7 +80,6 @@ function initTable() {
columnDefs: [
{
targets: 1,
orderable: false,
className: "select-checkbox",
render: function () {
return "";
scripts/pi-hole/js/groups.js
+1 -2
View File
@@ -22,7 +22,7 @@ $(function () {
order: [[0, "asc"]],
columns: [
{ data: "id", visible: false },
{ data: null, visible: true, width: "15px" },
{ data: null, visible: true, orderable: false, width: "15px" },
{ data: "name" },
{ data: "enabled", searchable: false },
{ data: "description" },
@@ -31,7 +31,6 @@ $(function () {
columnDefs: [
{
targets: 1,
orderable: false,
className: "select-checkbox",
render: function () {
return "";
scripts/pi-hole/php/groups.php
+22 -24
View File
@@ -51,6 +51,20 @@ function JSON_error($message = null)
echo json_encode($response);
}
function verify_ID_array($arr)
{
if (!is_array($arr)) {
throw new Exception('Invalid payload: id is not an array');
}
// Exploit prevention: Ensure all entries in the ID array are integers
foreach ($arr as $value) {
if (!is_numeric($value)) {
throw new Exception('Invalid payload: id contains non-numeric entries');
}
}
}
if ($_POST['action'] == 'get_groups') {
// List all available groups
try {
@@ -154,12 +168,9 @@ if ($_POST['action'] == 'get_groups') {
// Delete group identified by ID
try {
$ids = json_decode($_POST['id']);
// Exploit prevention: Ensure all entries in the ID array are integers
foreach($ids as $value) {
if (!is_numeric($value)) {
throw new Exception('Invalid payload: id');
}
}
verify_ID_array($ids);
$table_name = ['domainlist_by_group', 'client_by_group', 'adlist_by_group', '"group"']; //quote reserved word
$table_keys = ['group_id', 'group_id', 'group_id', 'id'];
@@ -168,7 +179,7 @@ if ($_POST['action'] == 'get_groups') {
$table = $table_name[$i];
$key = $table_keys[$i];
$stmt = $db->prepare("DELETE FROM ".$table." WHERE ".$key." IN ('".implode("','",$ids)."')");
$stmt = $db->prepare("DELETE FROM ".$table." WHERE ".$key." IN (".implode(",",$ids).")");
if (!$stmt) {
throw new Exception("While preparing DELETE FROM $table statement: " . $db->lastErrorMsg());
}
@@ -469,12 +480,9 @@ if ($_POST['action'] == 'get_groups') {
// Delete client identified by ID
try {
$ids = json_decode($_POST['id']);
// Exploit prevention: Ensure all entries in the ID array are integers
foreach($ids as $value) {
if (!is_numeric($value)) {
throw new Exception('Invalid payload: id');
}
}
verify_ID_array($ids);
$db->query('BEGIN TRANSACTION;');
@@ -855,12 +863,9 @@ if ($_POST['action'] == 'get_groups') {
// Delete domain identified by ID
try {
$ids = json_decode($_POST['id']);
// Exploit prevention: Ensure all entries in the ID array are integers
foreach($ids as $value) {
if (!is_numeric($value)) {
throw new Exception('Invalid payload: id');
}
}
verify_ID_array($ids);
$db->query('BEGIN TRANSACTION;');
@@ -1139,16 +1144,9 @@ if ($_POST['action'] == 'get_groups') {
try {
// Accept only an array
$ids = json_decode($_POST['id']);
if (!is_array($ids)) {
throw new Exception('Invalid payload: id is not an array');
}
// Exploit prevention: Ensure all entries in the ID array are integers
foreach ($ids as $value) {
if (!is_numeric($value)) {
throw new Exception('Invalid payload: id contains non-numeric entries');
}
}
verify_ID_array($ids);
$db->query('BEGIN TRANSACTION;');