pi-hole/web v6.6.1

on GitHub

Security

This release fixes the following security advisories (credit to the reporter):

Low

• GHSA-rmr4-hqc8-825f (CVSS 3.5), GHSA-3vhj-5284-xrmm (CVSS 3.1), GHSA-qfpp-28mj-pj6p (CVSS 3.1): stored XSS in Settings > All settings, Local DNS Records and DNS. Reported by @KHr00t; fixed by @rdwebdesign.

What's Changed

A patch release for the stable line while development is mid-rework (AdminLTE 4 / Bootstrap 5).

• Query Log: show the actual API error (e.g. "The item is already present") instead of a generic network error.
• Conditional Forwarding: reject CIDR and otherwise invalid server IPs.
• Static DHCP leases: fix the tag: validation regex and allow internal underscores in hostnames.
• hexEncode() now handles code points above U+FFFF.
• Login no longer blames the password for a refusal that is not about it.
• Query Log: the API URL is no longer encoded twice.
• Bundled Moment.js bumped to 2.31.0.
• DNS settings: clearer "local requests" wording, and an emptyTable typo fixed.

Full Changelog: v6.6...v6.6.1