/api.php?recentBlocked Not Working

[C4Wiz]

Versions

• Pi-hole: 5.2.2
• AdminLTE: 5.2.2
• FTL: 5.3.4

Platform

• OS and version: Debian Buster

• Platform: Raspberry Pi

Expected behavior

/api.php?recentBlocked should return last blocked domain
A clear and concise description of what you expected to happen.

Actual behavior / bug

/api.php?recentBlocked returns []
A clear and concise description of what the bug is.

Steps to reproduce

http://ip/admin/api.php?recentBlocked
Steps to reproduce the behavior:

1. Go to '...'
2. Click on '....'
3. Scroll down to '....'
4. See error

Debug Token

• URL:

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

Add any other context about the problem here.

[C4Wiz]

has anyone looked into this yet?

[dschaper]

pi-hole/web#1650

[dschaper]

This is intended behavior. You'll need to be logged in or pass the auth token to access that information now.

[C4Wiz]

thank you, thats my bad for not reading the pull requests.

[DL6ER]

It shouldn't have been exposed without password before so this was fixing incorrect behavior now. Assuming someone continuously scanning the API endpoint. They could reconstruct your entire list of blocked domains.