Issue #194 from the main pi-hole repo about web

[AzureMarker]

So, we have a security hole? I don't fully understand what he wants us to do.

[PromoFaux]

No, I've never been entirely sure what it is. @jacobsalmela tagged it as an enhancement, so I figured he knew what it was about...

[DonLexos]

Seems like you tag includes for CSS/JS that are not served by yourself?

[PromoFaux]

Isnit not just the cdns for jquery and bootstrap?

[jacobsalmela]

I just tagged it as an enhancement, but didn't fully look at it. I guess I don't fully understand what he wanted--something to do with it being coded insecurely, which his department cannot work with, however, I had trouble understanding the original request. If @Mcat12 doesn't know what he means, than I don't know that the rest of us will. I just wanted to eliminate any security issues if there really is one.

[AzureMarker]

I think he may be taking about some JavaScript thing where using "eval" (runs JavaScript code in it's parameter, ex eval("1+1")) is very unsafe, because you can run any code you want. I don't think there's a security issue though, as JavaScript is run client side. If there is, it would be nice for him to elaborate.

[jacobsalmela]

@magarto, can you elaborate on what you meant in your original issue? We are a bit confused.

[AzureMarker]

I just came back to this issue, and I think I understand a bit of what he's saying. This link he shared does a good summary. Basically, we should move all Javascript to their own files and remove JS code in the html (onclick, etc) and instead use event handlers.

[jacobsalmela]

Cool, that makes more sense.