Pi-hole Web v6.3

.github/workflows/codeql.yml

@@ -26,21 +26,21 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
         with:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.28.18
+        uses: github/codeql-action/init@f443b600d91635bebf5b0d9ebc620189c0d6fba5 #v4.30.8
         with:
           config-file: ./.github/codeql/codeql-config.yml
           languages: "javascript"
           queries: +security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3.28.18
+        uses: github/codeql-action/autobuild@f443b600d91635bebf5b0d9ebc620189c0d6fba5 #v4.30.8
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3.28.18
+        uses: github/codeql-action/analyze@f443b600d91635bebf5b0d9ebc620189c0d6fba5 #v4.30.8
         with:
           category: "/language:javascript"

.github/workflows/codespell.yml

@@ -13,12 +13,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
         with:
           persist-credentials: false
 
       - name: Spell-Checking
-        uses: codespell-project/actions-codespell@master
+        uses: codespell-project/actions-codespell@406322ec52dd7b488e48c1c4b82e2a8b3a1bf630 #v2.1
         with:
           ignore_words_file: .codespellignore
           skip: ./vendor,./package.json,./package-lock.json

.github/workflows/editorconfig-checker.yml

@@ -10,8 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
         with:
           persist-credentials: false
-      - uses: editorconfig-checker/action-editorconfig-checker@main
+      - uses: editorconfig-checker/action-editorconfig-checker@1a41284d59c6fe7f1b21ddc4a2b36400a33dc1b4 # tag v2. is really out of date
       - run: editorconfig-checker

.github/workflows/merge-conflict.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check if PRs are have merge conflicts
-        uses: eps1lon/actions-label-merge-conflict@v3.0.3
+        uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 #v3.0.3
         with:
           dirtyLabel: "Merge Conflicts"
           repoToken: "${{ secrets.GITHUB_TOKEN }}"

.github/workflows/stale.yml

@@ -17,7 +17,7 @@ jobs:
       issues: write
 
     steps:
-      - uses: actions/stale@v9.1.0
+      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 #v10.1.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 30
@@ -41,7 +41,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
         with:
           persist-credentials: false
       - name: Remove 'stale' label

.github/workflows/stale_pr.yml

@@ -16,7 +16,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: actions/stale@v9.1.0
+      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 #v10.1.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           # Do not automatically mark PR/issue as stale

.github/workflows/sync-back-to-dev.yml

@@ -11,7 +11,7 @@ jobs:
     name: Syncing branches
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
         with:
           persist-credentials: false
       - name: Opening pull request

.github/workflows/test.yml

@@ -19,12 +19,12 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
         with:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4.4.0
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 #v5.0.0
         with:
           node-version: "22.x"
           cache: npm

error403.lp

@@ -9,6 +9,7 @@
 
 mg.include('scripts/lua/header.lp','r')
 ?>
+</head>
 <body class="hold-transition layout-boxed login-page page-<?=pihole.format_path(mg.request_info.request_uri)?>">
     <div class="box login-box">
         <section style="padding: 15px;">

error404.lp

@@ -9,6 +9,7 @@
 
 mg.include('scripts/lua/header.lp','r')
 ?>
+</head>
 <body class="hold-transition layout-boxed login-page page-<?=pihole.format_path(mg.request_info.request_uri)?>">
     <div class="box login-box">
         <section style="padding: 15px;">

gravity.lp

@@ -15,17 +15,17 @@ mg.include('scripts/lua/header_authenticated.lp','r')
 </div>
 
 <!-- Alerts -->
-<div id="alInfo" class="alert alert-info alert-dismissible fade in" role="alert" hidden>
+<div id="alertInfo" class="alert alert-info alert-dismissible fade in" role="alert" hidden>
     <button type="button" class="close" data-hide="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
     Updating... this may take a while. <strong>Please do not navigate away from or close this page.</strong>
 </div>
-<div id="alSuccess" class="alert alert-success alert-dismissible fade in" role="alert" hidden>
+<div id="alertSuccess" class="alert alert-success alert-dismissible fade in" role="alert" hidden>
     <button type="button" class="close" data-hide="alert" aria-label="Close"><span aria-hidden="true">&times;</span></button>
     Success!
 </div>
 
 <button type="button" id="gravityBtn" class="btn btn-lg btn-primary btn-block">Update</button>
-<pre id="output" style="width: 100%; height: 100%;" hidden></pre>
+<pre id="output" class="d-none"></pre>
 
 <script src="<?=pihole.fileversion('scripts/js/gravity.js')?>"></script>
 <? mg.include('scripts/lua/footer.lp','r')?>

groups-clients.lp

@@ -46,16 +46,16 @@ mg.include('scripts/lua/header_authenticated.lp','r')
                 <div class="row">
                     <div class="col-md-12">
                         <p>You can select an existing client or add a custom one by typing into the field above and confirming your entry with <kbd>&#x23CE;</kbd>.
-                        Multiple clients can be added by separating each client with a space or comma.</p>
-                        <p>Clients may be described either by their IP addresses (IPv4 and IPv6 are supported),
-                            IP subnets (CIDR notation, like <code>192.168.2.0/24</code>),
-                            their MAC addresses (like <code>12:34:56:78:9A:BC</code>),
-                            by their hostnames (like <code>localhost</code>), or by the interface they are connected to (prefaced with a colon, like <code>:eth0</code>).
-                        </p>
-                        <p>Note that client recognition by IP addresses (incl. subnet ranges) are preferred over MAC address, host name or interface recognition as
-                            the two latter will only be available after some time.
-                            Furthermore, MAC address recognition only works for devices at most one networking hop away from your Pi-hole.
-                        </p>
+                        Multiple clients can be added by separating each client with a space or comma. Clients may be described either by their</p>
+                        <ol>
+                            <li>IP addresses (IPv4 and IPv6 are supported),</li>
+                            <li>IP subnets (CIDR notation, like <code>192.168.2.0/24</code>), their</li>
+                            <li>MAC addresses (like <code>12:34:56:78:9A:BC</code>), by their</li>
+                            <li>hostnames (like <code>localhost</code>), or by the</li>
+                            <li>interface they are connected to (prefaced with a colon, like <code>:eth0</code>).</li>
+                        </ol>
+                        <p>The first match (from top to down) wins. Note that client recognition by host name or interface recognition as
+                        the two latter may only be available after some time. Furthermore, MAC address recognition only works for devices at most one networking hop away from your Pi-hole.</p>
                     </div>
                 </div>
             </div>

groups-domains.lp

@@ -100,10 +100,10 @@ mg.include('scripts/lua/header_authenticated.lp','r')
                 </div>
                 <div class="btn-toolbar pull-right" role="toolbar" aria-label="Toolbar with buttons">
                     <div class="btn-group" role="group">
-                        <button type="button" class="btn btn-primary" id="add_deny">Add to denied domains</button>
+                        <button type="button" class="btn btn-danger" id="add_deny">Add to denied domains</button>
                     </div>
                     <div class="btn-group" role="group">
-                        <button type="button" class="btn btn-primary" id="add_allow">Add to allowed domains</button>
+                        <button type="button" class="btn btn-success" id="add_allow">Add to allowed domains</button>
                     </div>
                 </div>
             </div>

login.lp

@@ -9,6 +9,7 @@
 
 mg.include('scripts/lua/header.lp','r')
 ?>
+</head>
 <body class="hold-transition layout-boxed login-page page-<?=pihole.format_path(mg.request_info.request_uri)?>" data-apiurl="<?=pihole.api_url()?>" data-webhome="<?=webhome?>">
 <div class="box login-box" id="login-box">
     <section style="padding: 15px;">
@@ -50,9 +51,13 @@ mg.include('scripts/lua/header.lp','r')
                             </span>
                         </div>
                     </div>
-                    <div class="form-group has-feedback hidden" id="totp_input">
-                        <input type="text" id="totp" size="6" maxlen="6" class="form-control totp_token" placeholder="123456" value="" spellcheck="false" autofocus autocomplete="off">
-                        <span class="fa fa-clock-rotate-left pwd-field form-control-feedback"></span>
+                    <div class="form-group hidden" id="totp_input">
+                        <div class="input-group">
+                            <input type="text" id="totp" size="6" maxlen="6" class="form-control totp_token" placeholder="123456" value="" spellcheck="false" autofocus autocomplete="off">
+                            <div class="input-group-addon" data-toggle="tooltip" data-placement="auto" title="TOTP verification code">
+                                <i class="fa fa-clock-rotate-left"></i>
+                            </div>
+                        </div>
                     </div>
                     <div class="form-group">
                         <button type="submit" class="btn btn-primary form-control"><i class="fas fa-sign-in-alt"></i>&nbsp;&nbsp;&nbsp;Log in (uses cookie)</button>