From d0c15cef924dd693714f1f15fab307b504b95965 Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Tue, 28 Nov 2023 15:48:03 +0100
Subject: [PATCH 1/2] Fix mass-deletion of DHCP leases

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 scripts/pi-hole/js/settings-dhcp.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/pi-hole/js/settings-dhcp.js b/scripts/pi-hole/js/settings-dhcp.js
index 56b10ab4e..30ed65021 100644
--- a/scripts/pi-hole/js/settings-dhcp.js
+++ b/scripts/pi-hole/js/settings-dhcp.js
@@ -118,7 +118,7 @@ $(function () {
           var ids = [];
           $("tr.selected").each(function () {
             // ... add the row identified by "data-id".
-            ids.push(parseInt($(this).attr("data-id"), 10));
+            ids.push($(this).attr("data-id"));
           });
           // Delete all selected rows at once
           delLease(ids);

From 2a4506b3ee19c09b0afffe1f7d341a0e9ed11664 Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Tue, 28 Nov 2023 16:04:36 +0100
Subject: [PATCH 2/2] Simplify DHCP lease deletion

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 scripts/pi-hole/js/settings-dhcp.js | 31 +++++++++--------------------
 1 file changed, 9 insertions(+), 22 deletions(-)

diff --git a/scripts/pi-hole/js/settings-dhcp.js b/scripts/pi-hole/js/settings-dhcp.js
index 30ed65021..0799c76f5 100644
--- a/scripts/pi-hole/js/settings-dhcp.js
+++ b/scripts/pi-hole/js/settings-dhcp.js
@@ -60,7 +60,7 @@ $(function () {
       },
     ],
     drawCallback: function () {
-      $('button[id^="deleteLease_"]').on("click", deleteLease);
+      $('button[id^="deleteLease_"]').on("click", delLease);
 
       // Hide buttons if all messages were deleted
       var hasRows = this.api().rows({ filter: "applied" }).data().length > 0;
@@ -115,13 +115,10 @@ $(function () {
         className: "btn-sm datatable-bt deleteSelected",
         action: function () {
           // For each ".selected" row ...
-          var ids = [];
           $("tr.selected").each(function () {
-            // ... add the row identified by "data-id".
-            ids.push($(this).attr("data-id"));
+            // ... delete the row identified by "data-id".
+            delLease($(this).attr("data-id"));
           });
-          // Delete all selected rows at once
-          delLease(ids);
         },
       },
     ],
@@ -159,25 +156,15 @@ $(function () {
   });
 });
 
-function deleteLease() {
-  // Passes the button data-del-id attribute as IP
-  var ips = [$(this).attr("data-del-ip")];
-
-  // Check input validity
-  if (!Array.isArray(ips)) return;
-
-  // Exploit prevention: Return early for non-numeric IDs
-  for (var ip in ips) {
-    if (Object.hasOwnProperty.call(ips, ip)) {
-      delLease(ips);
-    }
-  }
-}
-
-function delLease(ip) {
+function delLease(ip = null) {
   utils.disableAll();
   utils.showAlert("info", "", "Deleting lease...");
 
+  // If no IP is passed, use the button data-del-ip attribute
+  if (ip === null) {
+    ip = $(this).attr("data-del-ip");
+  }
+
   $.ajax({
     url: "/api/dhcp/leases/" + ip,
     method: "DELETE",