Releases

@KHr00t

Security

This release fixes the following security advisories (credit to the reporter):

Low

GHSA-rmr4-hqc8-825f (CVSS 3.5), GHSA-3vhj-5284-xrmm (CVSS 3.1), GHSA-qfpp-28mj-pj6p (CVSS 3.1): stored XSS in Settings > All settings, Local DNS Records and DNS. Reported by @KHr00t; fixed by @rdwebdesign.

What's Changed

A patch release for the stable line while development is mid-rework (AdminLTE 4 / Bootstrap 5).

Query Log: show the actual API error (e.g. "The item is already present") instead of a generic network error.
Conditional Forwarding: reject CIDR and otherwise invalid server IPs.
Static DHCP leases: fix the tag: validation regex and allow internal underscores in hostnames.
hexEncode() now handles code points above U+FFFF.
Login no longer blames the password for a refusal that is not about it.
Query Log: the API URL is no longer encoded twice.
Bundled Moment.js bumped to 2.31.0.
DNS settings: clearer "local requests" wording, and an emptyTable typo fixed.

Full Changelog: v6.6...v6.6.1

@rdwebdesign

What's Changed

Improve DHCP static leases interface (alternative) by @rdwebdesign in #3766
Lists page - Improve hints and help text by @rdwebdesign in #3798
Update daterangepicker ranges everytime the picker is shown by @yubiuser in #3793
Better user interface to edit reverse DNS servers (dns.revServers) by @rdwebdesign in #3769

Full Changelog: v6.5.1...v6.6

@yubiuser

What's Changed

Fix backed-up typo by @yubiuser in #3759
fix: replace ES2024 regex v flag with u for WebKit compatibility by @Gilmoursa in #3778
bug: multiline comments on doughnut chart by @vinaykulk621 in #3781

New Contributors

@Gilmoursa made their first contribution in #3778
@vinaykulk621 made their first contribution in #3781

Full Changelog: v6.5...v6.5.1

@yubiuser

What's Changed

Amend teleporter help text that the long-term data is not included by @yubiuser in #3721
Do not use 3 columns when boxed layout is used by @rdwebdesign in #3722
Use ENTER instead of ⏎ by @yubiuser in #3727
Don't link to github releases if docker tag is nightly by @yubiuser in #3718
Do not try to compare component version when remote version info is not available by @yubiuser in #3729
Show loading overlay when adding/removing CNAME records as it requires a FTL restart by @yubiuser in #3742
fix: check on responseJSON when wrong password by @guybrush2105 in #3693
Remove the loggingButton from Settings > System > Actions by @yubiuser in #3747

Security Advisories

Multiple Stored HTML Injections and XSS in different web interface pages reported by @andrejtomci

New Contributors

@guybrush2105 made their first contribution in #3693

Full Changelog: v6.4.1...v6.5

@rrobgill

What's Changed

Set the end date for live query update to end of epoch by @rrobgill in #3677
Improve initial loading of Query Log by @DL6ER in #3715

Also fixes two security advisories:

GHSA-6xp4-jw73-f4qp: fixed with d328f14
GHSA-8rw8-vjgp-rwj6: fixed with 1a0c6f4

Full Changelog: v6.4...v6.4.1

@yubiuser

What's Changed

Start using commented tags for editorconfig-checker by @yubiuser in #3643
Remove some unused code (leftover from v5) by @rdwebdesign in #3636
Make sure the table is redrawn after the dnssec API call returns by @rdwebdesign in #3645
Add hint that partial matching may not return all possible results by @DL6ER in #3654
Enable one-time code autofill for TOTP input by @sebastianlivoni in #3658
Set "All Time " range for query log datepicker based on Database ranges (moment) by @PromoFaux in #3657
Request ANSI colour codes when calling gravity API by @PromoFaux in #3662
Pi-hole Web v6.4 by @PromoFaux in #3670

New Contributors

@sebastianlivoni made their first contribution in #3658

Full Changelog: v6.3...v6.4

@DL6ER

What's Changed

Clarify client description priorities on the groups/client interface by @DL6ER in #3521
Remove superfluous settings-level-expert class by @yubiuser in #3503
Remove link to rate limit documentation which does not add further etails by @yubiuser in #3526
Add some color to gravity output by @yubiuser in #3530
settings-system : Avoid division by zero 8000 in DNS metrics by @rrobgill in #3533
Make the "Add to denied/allowed domains" buttons red and green by @darkexplosiveqwx in #3551
Remove query type from domainNeeded option by @yubiuser in #3557
Handle pie chart item style conditionally by @yubiuser in #3532
Use label-primary for number of enabled list icon on sidebar by @yubiuser in #3563
Use innerHTML instead of append to fix gravity color output by @yubiuser in #3566
Trim whitespaces before adding custom DNS record by @yubiuser in #3569
Bind address to new element instead of raw HTML construction by @DL6ER in #3567
Use /flush/network instead of /flush/arp by @yubiuser in #3553
Prevents getting stuck loading unlimited query log results by @ablankenship10 in #3592
Fix 2FA icon styles #3431 by @idotj in #3585
Fix header.lp closing head tag formatting by @h3xcat in #3607
Fix the link on the upstream chart legend by @rdwebdesign in #3606
Rename config key dns.domain > dns.domain.name by @yubiuser in #3611
Improve line graph tooltip by @yubiuser in #3601
Make DNSSEC icon conditional in Queries Log (redo of #3399) by @yubiuser in #3535
Query Log: The underscore is special by @DL6ER in #3578
Fix addList function to include type in API request URL by @PromoFaux in #3620
Pin github action to SHA by @yubiuser in #3593
Adjust domain count according to pi-hole/FTL#2177 by @yubiuser in #3619
Also pin editorconfigchecker by sha by @yubiuser in #3621
Update FTL %cpu and %mem everytime total CPU stats are updated by @yubiuser in #3622
Clarify uptime in container matching the host uptime with a tooltip by @yubiuser in #3624
Adjust text BitWarden to Bitwarden by @jprusik in #3629

New Contributors

@darkexplosiveqwx made their first contribution in #3551
@ablankenship10 made their first contribution in #3592
@idotj made their first contribution in #3585
@h3xcat made their first contribution in #3607
@jprusik made their first contribution in #3629

Full Changelog: v6.2.1...v6.3

No Functional changes, retagging as we managed to tag previous to the merge commit....

Full Changelog: v6.2...v6.2.1

@XhmikosR

What's Changed

Streamline actions, format and switch to Node.js 22 by @XhmikosR in #3357
Remove remaining hard-coded /admin/ paths in the webinterface by @DL6ER in #3370
Fix Local CNAME records records mistake by @yubiuser in #3367
Fix concurrency issue about const apiUrl by @DL6ER in #3371
groups-lists: remove unneeded HTML escape by @XhmikosR in #3379
login.js: fix deprecated submit() usage by @XhmikosR in #3380
Remove x-dns-prefetch-control meta tag by @XhmikosR in #3378
group-domains: fix uncaught TypeError due to invalid URLs by @XhmikosR in #3383
Replace remaining i element cases with em by @XhmikosR in #3381
Revert the defer addition for now by @XhmikosR in #3382
header: fix runtime error when query_string is null by @XhmikosR in #3395
utils: fix typo in showAlert() by @XhmikosR in #3403
queries: make the Advanced filtering button occupy all space by @XhmikosR in #3402
Remove icheckbox related-code except for primary by @XhmikosR in #3387
queries: add missing display: none by @XhmikosR in #3405
Allow free input in upstream filter by @yubiuser in #3408
Fix console warning when no password set by @PromoFaux in #3410
Modernize JS and tighten things by @XhmikosR in #3388
high-contrast.css: fix duplicate selector by @XhmikosR in #3411
Remove unused CSS by @XhmikosR in #3420
Add missing display: none for collapsed boxes by @XhmikosR in #3417
Remove unused HTML elements by @XhmikosR in #3418
Update chart.umd.js.map from npm by @XhmikosR in #3419
settings-api: add missing end closing p tag by @XhmikosR in #3428
settings-system: fix span end tag typo by @XhmikosR in #3427
login: fix deprecated submit() function by @XhmikosR in #3425
settings-api: fix deprecated keyup() function by @XhmikosR in #3424
gravity: remove the unused ?go code by @XhmikosR in #3426
disabled and checked are boolean attributes by @XhmikosR in #3434
queries: replace the deprecated jQuery.parseJSON with JSON.parse by @XhmikosR in #3435
package.json: sort deps by name by @XhmikosR in #3437
Use CODEOWNERS instead of deprecated dependbot/reviewers by @yubiuser in #3433
Add 'Bug: Confirmed' to stale exempt list by @yubiuser in #3432
Various minor tweaks to the LCARS theme by @rdwebdesign in #3446
queries: fix box markup by @XhmikosR in #3445
Use the same default interface used by FTL if none is set in pihole.toml by @rdwebdesign in #3436
Use font-weight: 600 by @XhmikosR in #3449
Use mg.script_name to retrieve the scriptname by @rdwebdesign in #3447
.user-header: use font-weight: 600 by @XhmikosR in #3450
settings-system.js: remove unused overlay code by @XhmikosR in #3455
settings-advanced: remove unused code by @XhmikosR in #3454
index.lp: remove unused classes by @XhmikosR in #3453
scripts/js/settings-dns-records.js: fix api url base by @onlyJakob in #3456
Add hint about wildcard search in advanced query filtering by @yubiuser in #3452
index: make tables stripped by @XhmikosR in #3438
Replace invalid hostname to prevent XSS by @yubiuser in #3401
settings-system: fix typo by @XhmikosR in #3460
sidebar: increase logo size to prevent a reflow by @XhmikosR in #3407
queries: improve link to search page by @XhmikosR in #3422
Hide top tables depending on privacy level by @yubiuser in #3362
settings-dns-records: fix typo by @XhmikosR in #3459
Fix deprecated ready function by @XhmikosR in #3461
utils: remove the unused objectToArray util by @XhmikosR in #3462
utils: improve readability for validateIPv* functions by @XhmikosR in #3423
settings-api: fix wrong code by @XhmikosR in #3463
Use text()/textContent when we don't need HTML by @XhmikosR in #3464
footer: drop redundant addAdvancedInfo() call by @XhmikosR in #3467
settings-system: remove unneeded span elements by @XhmikosR in #3468
settings-dhcp: drop unused lookatme-text attribute by @XhmikosR in #3469
settings-advanced.js: fix wrong role value by @XhmikosR in #3470
settings-advanced: drop small element by @XhmikosR in #3472
updateFtlInfo: remove unused code by @XhmikosR in #3474
settings-level-expert: only toggle the expert elements by @XhmikosR in #3473
Make use of the new format_path function to add the current page in body by @XhmikosR in #3390
Use proper Object methods by @XhmikosR in #3441
queries: minor grammar fix by @XhmikosR in #3477
queries: change box to an info one by @XhmikosR in #3476
Fix DataTables warning message in Network page by @rdwebdesign in #3475
Fix broken themes by @rdwebdesign in #3479
queries: drop non-existent elements code by @XhmikosR in #3478
Reset update-hint text every time updateVersionInfo() function is executed by @rdwebdesign in #3480
Use the same interface name used by FTL in DNS Settings page by @rdwebdesign in #3481
messages: fix function call by @XhmikosR in #3482
footer: rename label by @XhmikosR in #3486
header_authenticated: change documentation icon to solid by @XhmikosR in #3488
Remove horizontal line in hamburger menu by @yubiuser in #3491
sidebar: move active class outside of class attribute conditional by @XhmikosR in #3492
index: use sentence case for queries for consistency by @XhmikosR in #3493
Add rel="noreferrer" to external hyperlinks by @casperklein in #3495
settings-level-expert: hide them by default by @XhmikosR in #3487

New Contributors

@onlyJakob made their first contribution in #3456
@casperklein made their first contribution in #3495

Full Changelog: v6.1...v6.2

@alexwhitman

What's Changed

Fix typo in DHCP settings page by @alexwhitman in #3279
Live long and prosper by @PromoFaux in #3280
Fix CPU% by @DL6ER in #3262
Fix top lists links on the dashboard by @DL6ER in #3283
Improve HTTPS detection behind reverse proxy by @DL6ER in #3285
Improve CodeQL action by @XhmikosR in #3289
package.json: properly configure xo and postcss by @XhmikosR in #3248
Set default values for each property of versions object by @rdwebdesign in #3268
Fix the text and icon used to report end-to-end encryption status (TLS/SSL) on the top menu by @rdwebdesign in #3288
.gitattributes: enforce LF by @XhmikosR in #3282
Sort IPv4 before IPv6 addresses on the network overview by @DL6ER in #3286
Add missing img dimensions by @XhmikosR in #3294
Sort interfaces by @DL6ER in #3284
Remove the obsolete X-UA-Compatible meta tag by @XhmikosR in #3305
logout.js: add missing preventDefault call by @XhmikosR in #3301
Switch to Font Awesome CSS by @XhmikosR in #3300
Ran autoprefixer by @XhmikosR in #3246
testpr: run prefix script too by @XhmikosR in #3307
Updated run gravity message when importing config in Teleporter by @jmui in #3312
Fix a few CodeQL issues by @XhmikosR in #3290
Remove trailing slash from void elements by @XhmikosR in #3315
sidebar: fix missing span end-closing tags by @XhmikosR in #3316
Fix stray - by @XhmikosR in #3318
Fix issues found in LCARS theme after recent changes in CSS and HTML by @rdwebdesign in #3327
Remove a few unused CSS rules from pi-hole.css and LCARS theme by @rdwebdesign in #3329
Update browserslistc by @XhmikosR in #3322
Use em instead of i and strong instead of b by @XhmikosR in #3321
Update fonts by @XhmikosR in #3309
Add missing rel="noopener" for external links by @XhmikosR in #3333
Allow path prefix multiplexing the dashboard and API by @DL6ER in #3269
login.lp: remove mention of sudo by @XhmikosR in #3334
Refactor assets loading by @XhmikosR in #3295
queries: switch to a real button by @XhmikosR in #3339
Logout: fix redirect by @XhmikosR in #3304
sidebar: switch to a real button by @XhmikosR in #3342
parseQueryString: switch to URLSearchParams and remove unused param by @XhmikosR in #3340
Queries: user fieldtext directly by @XhmikosR in #3343
Queries: escape querystatus.fieldtext by @XhmikosR in #3348
Fix typo in advanced DNS help text by @yubiuser in #3350
Set an upper limit on the number of rows returned for the query log by @PromoFaux in #3346
Use pretty URLs when possible by @XhmikosR in #3351
Use modernized waitMe plugin by @yubiuser in #3213
Query Log: Add QUERY_EXTERNAL_BLOCKED_EDE15 rules by @DL6ER in #3347
index: remove useless empty title attributes by @XhmikosR in #3352
Remove meta http-equiv="cache-control" by @XhmikosR in #3353
Regenerate package-lock.json with npm 10.9 by @XhmikosR in #3356

New Contributors

@alexwhitman made their first contribution in #3279
@jmui made their first contribution in #3312

Full Changelog: v6.0.2...v6.1

v6.6.1

Security

What's Changed

Contributors

Uh oh!

v6.6

What's Changed

Contributors

Uh oh!

v6.5.1

What's Changed

New Contributors

Contributors

Uh oh!

v6.5

What's Changed

Security Advisories

New Contributors

Contributors

Uh oh!

v6.4.1

What's Changed

Contributors

Uh oh!

v6.4

What's Changed

New Contributors

Contributors

Uh oh!

v6.3

What's Changed

New Contributors

Contributors

Uh oh!

v6.2.1

Uh oh!

v6.2

What's Changed

New Contributors

Contributors

Uh oh!

v6.1

What's Changed

New Contributors

Contributors

Uh oh!