Fix and rename the host name validators

[DL6ER]

Thank you for your contribution to the Pi-hole Community!

Please read the comments below to help us consider your Pull Request.

We are all volunteers and completing the process outlined will help us review your commits quicker.

Please make sure you

1. Base your code and PRs against the repositories developmental branch.
2. Sign Off all commits as we enforce the DCO for all contributions
3. Sign all your commits as they must have verified signatures
4. File a pull request for any change that requires changes to our documentation at our documentation repo

---

What does this PR aim to accomplish?:

validateHostname() validates nothing. /[^<>;"]/ is unanchored, so it matches on the first character that is not one of those four - evil<script> passes. Only the empty string is ever rejected.

Noticed while reviewing #3853.

How does this PR accomplish the above?:

Its only caller is the client field in group management, which after the IP/CIDR and MAC branches takes a host name or an interface like :eth0. FTL matches both verbatim and only ever records names of [A-Za-z0-9._-] (valid_hostname()), so the check is now /^:?[\w.-]+$/u and the function is named after what it does.

The reserved characters are not lost: the table escapes on render.

validateHostnameStrict() then drops a suffix that no longer tells it apart from anything.

Please merge this after #3853. The two touch neighboring lines, and I would rather resolve that here than push it onto the contributor.

Link documentation PRs if any are needed to support this PR:

None needed.

---

By submitting this pull request, I confirm the following:

1. I have read and understood the contributors guide, as well as this entire template. I understand which branch to base my commits and Pull Requests against.
2. I have commented my proposed changes within the code and I have tested my changes.
3. I am willing to help maintain this change if there are issues with it later.
4. It is compatible with the EUPL 1.2 license
5. I have squashed any insignificant commits. (git rebase)
6. I have checked that another pull request for this purpose does not exist.
7. I have considered, and confirmed that this submission will be valuable to others.
8. I accept that this submission may not be used, and the pull request closed at the will of the maintainer.
9. I give this submission freely, and claim no ownership to its content.

---

• I have read the above and my PR is ready for review. Check this box to confirm

[Copilot]

Pull request overview

This PR fixes a misleading client “hostname” validator in the web UI by replacing the ineffective validateHostname() check with a stricter, correctly-anchored validator that matches the actual client identifiers accepted by FTL (hostname-like strings and :interface).

Changes:

• Replace validateHostname() with validateClientPattern() using an anchored regex (^:?[\w.-]+$) to reject inputs that can never match an FTL client identifier.
• Update group client entry validation to call the new function and adjust the user-facing warning text accordingly.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
scripts/js/utils.js	Replaces the ineffective validateHostname() helper with validateClientPattern() and exports it via globalThis.utils.
scripts/js/groups-clients.js	Switches client input validation to utils.validateClientPattern() and updates the inline comment + warning message.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.