From 76279928bdd2475567e0903626225eff272a4b35 Mon Sep 17 00:00:00 2001
From: Tim <timvdwest@gmail.com>
Date: Sat, 18 Jul 2015 21:33:09 +0200
Subject: [PATCH] Rewrite of the Datatables class, should be a lot more secure
 now and maybe slightly faster. Please clear your browser cache after this
 update.

---
 data/interfaces/default/history.html          |  13 +-
 data/interfaces/default/info.html             |  21 +-
 .../default/js/tables/history_table.js        |  78 +----
 data/interfaces/default/js/tables/users.js    |   8 +-
 data/interfaces/default/user.html             |  25 +-
 data/interfaces/default/users.html            |   7 +-
 plexpy/datafactory.py                         | 221 ++++---------
 plexpy/datatables.py                          | 310 ++++++++++--------
 plexpy/helpers.py                             |   7 +
 plexpy/webserve.py                            |  30 +-
 10 files changed, 301 insertions(+), 419 deletions(-)

diff --git a/data/interfaces/default/history.html b/data/interfaces/default/history.html
index c5e6b12c..a1b9fb81 100644
--- a/data/interfaces/default/history.html
+++ b/data/interfaces/default/history.html
@@ -28,7 +28,6 @@ from plexpy import helpers
                 <table class="display" id="history_table" width="100%">
                     <thead>
                     <tr>
-                        <th class="never" align='left' id="id">ID</th>
                         <th class="all" align='left' id="time">Time</th>
                         <th class="all" align='left' id="friendly_name">User</th>
                         <th class="desktop" align='left' id="platform">Platform</th>
@@ -39,12 +38,6 @@ from plexpy import helpers
                         <th class="desktop" align='left' id="stopped">Stopped</th>
                         <th class="desktop" align='left' id="duration">Duration</th>
                         <th class="desktop" align='left' id="percent_complete"></th>
-                        <th class="never" align='left' id="grandparent_rating_key">grandparentRatingKey</th>
-                        <th class="never" align='left' id="rating_key">RatingKey</th>
-                        <th class="never" align='left' id="user"></th>
-                        <th class="never" align='left' id="media_type"></th>
-                        <th class="never" align='left' id="video_decision"></th>
-                        <th class="never" align='left' id="user_id"></th>
                     </tr>
                     </thead>
                     <tbody>
@@ -71,7 +64,11 @@ from plexpy import helpers
 <script>
     $(document).ready(function() {
         history_table_options.ajax = {
-            "url": "get_history"
+            "url": "get_history",
+            type: "post",
+            data: function ( d ) {
+                return { 'json_data': JSON.stringify( d ) };
+            }
         }
 
         history_table = $('#history_table').DataTable(history_table_options);
diff --git a/data/interfaces/default/info.html b/data/interfaces/default/info.html
index 4778e32f..6512dc93 100644
--- a/data/interfaces/default/info.html
+++ b/data/interfaces/default/info.html
@@ -173,7 +173,6 @@ from plexpy import helpers
                 <table class="display" id="history_table" width="100%">
                     <thead>
                     <tr>
-                        <th class="never" align='left' id="id">ID</th>
                         <th class="all" align='left' id="time">Time</th>
                         <th class="all" align='left' id="friendly_name">User</th>
                         <th class="desktop" align='left' id="platform">Platform</th>
@@ -184,12 +183,6 @@ from plexpy import helpers
                         <th class="desktop" align='left' id="stopped">Stopped</th>
                         <th class="desktop" align='left' id="duration">Duration</th>
                         <th class="desktop" align='left' id="percent_complete"></th>
-                        <th class="never" align='left' id="grandparent_rating_key">grandparentRatingKey</th>
-                        <th class="never" align='left' id="rating_key">RatingKey</th>
-                        <th class="never" align='left' id="user"></th>
-                        <th class="never" align='left' id="media_type"></th>
-                        <th class="never" align='left' id="video_decision"></th>
-                        <th class="never" align='left' id="user_id"></th>
                     </tr>
                     </thead>
                     <tbody>
@@ -246,8 +239,11 @@ from plexpy import helpers
     $(document).ready(function () {
         history_table_options.ajax = {
             "url": "get_history",
-            "data": function(d) {
-               d.rating_key = ${data['rating_key']};
+            type: 'post',
+            data: function ( d ) {
+                return { 'json_data': JSON.stringify( d ),
+                         'rating_key': ${data['rating_key']}
+                };
             }
         }
 
@@ -264,8 +260,11 @@ from plexpy import helpers
     $(document).ready(function () {
         history_table_options.ajax = {
             "url": "get_history",
-            "data": function(d) {
-               d.grandparent_rating_key = ${data['rating_key']};
+            type: 'post',
+            data: function ( d ) {
+                return { 'json_data': JSON.stringify( d ),
+                         'grandparent_rating_key': ${data['grandparent_rating_key']}
+                };
             }
         }
 
diff --git a/data/interfaces/default/js/tables/history_table.js b/data/interfaces/default/js/tables/history_table.js
index 8b442f57..8f81709f 100644
--- a/data/interfaces/default/js/tables/history_table.js
+++ b/data/interfaces/default/js/tables/history_table.js
@@ -28,17 +28,10 @@ history_table_options = {
     "processing": false,
     "serverSide": true,
     "pageLength": 25,
-    "order": [ 1, 'desc'],
+    "order": [ 0, 'desc'],
     "columnDefs": [
         {
             "targets": [0],
-            "data":"id",
-            "visible": false,
-            "searchable": false,
-            "className": "no-wrap"
-        },
-        {
-            "targets": [1],
             "data":"date",
             "createdCell": function (td, cellData, rowData, row, col) {
                 if (rowData['stopped'] === null) {
@@ -52,7 +45,7 @@ history_table_options = {
             "className": "no-wrap"
         },
         {
-            "targets": [2],
+            "targets": [1],
             "data":"friendly_name",
             "createdCell": function (td, cellData, rowData, row, col) {
                 if (cellData !== '') {
@@ -68,8 +61,8 @@ history_table_options = {
             "className": "no-wrap"
         },
         {
-            "targets": [3],
-            "data":"platform",
+            "targets": [2],
+            "data":"player",
             "createdCell": function (td, cellData, rowData, row, col) {
                 if (cellData !== '') {
                     $(td).html('<a href="#info-modal" data-toggle="modal"><span data-toggle="tooltip" data-placement="left" title="Stream Info" id="stream-info"><i class="fa fa-lg fa-info-circle"></i></span></a>&nbsp'+cellData);
@@ -78,7 +71,7 @@ history_table_options = {
             "className": "modal-control no-wrap"
         },
         {
-            "targets": [4],
+            "targets": [3],
             "data":"ip_address",
             "createdCell": function (td, cellData, rowData, row, col) {
                 if ((cellData == '') || (cellData == '0')) {
@@ -88,9 +81,8 @@ history_table_options = {
             "className": "no-wrap"
         },
         {
-            "targets": [5],
+            "targets": [4],
             "data":"full_title",
-            "name":"full_title",
             "createdCell": function (td, cellData, rowData, row, col) {
                 if (cellData !== '') {
                     if (rowData['media_type'] === 'movie' || rowData['media_type'] === 'episode') {
@@ -108,7 +100,7 @@ history_table_options = {
             }
         },
         {
-            "targets": [6],
+            "targets": [5],
             "data":"started",
             "render": function ( data, type, full ) {
                 return moment(data, "X").format(time_format);
@@ -117,16 +109,20 @@ history_table_options = {
             "className": "no-wrap"
         },
         {
-            "targets": [7],
+            "targets": [6],
             "data":"paused_counter",
             "render": function ( data, type, full ) {
-                return Math.round(moment.duration(data, 'seconds').as('minutes')) + ' mins';
+                if (data !== null) {
+                    return Math.round(moment.duration(data, 'seconds').as('minutes')) + ' mins';
+                } else {
+                    return '0 mins';
+                }
             },
             "searchable": false,
             "className": "no-wrap"
         },
         {
-            "targets": [8],
+            "targets": [7],
             "data":"stopped",
             "render": function ( data, type, full ) {
                 if (data !== null) {
@@ -139,7 +135,7 @@ history_table_options = {
             "className": "no-wrap"
         },
         {
-            "targets": [9],
+            "targets": [8],
             "data":"duration",
             "render": function ( data, type, full ) {
                 if (data !== null) {
@@ -152,15 +148,13 @@ history_table_options = {
             "className": "no-wrap"
         },
         {
-            "targets": [10],
+            "targets": [9],
             "data":"percent_complete",
             "render": function ( data, type, full ) {
                 if (data > 80) {
                     return '<i class="fa fa-lg fa-circle"></i>'
-                    //return '<span class="badge">'+Math.round(data)+'%</span>';
                 } else if (data > 40) {
-                    return '<i class="fa fa-lg fa-adjust"></i>'
-                    //return '<span class="badge">100%</span>';
+                    return '<i class="fa fa-lg fa-adjust fa-rotate-180"></i>'
                 } else {
                     return '<i class="fa fa-lg fa-circle-o"></i>'
                 }
@@ -168,45 +162,7 @@ history_table_options = {
             "searchable": false,
             "orderable": true,
             "className": "no-wrap"
-        },
-        {
-            "targets": [11],
-            "data":"grandparent_rating_key",
-            "visible": false,
-            "searchable": false
-        },
-        {
-            "targets": [12],
-            "data":"rating_key",
-            "visible": false,
-            "searchable": false
-        },
-        {
-            "targets": [13],
-            "data":"media_type",
-            "searchable":false,
-            "visible":false
-        },
-        {
-            "targets": [14],
-            "data":"user",
-            "searchable":false,
-            "visible":false
-        },
-        {
-            "targets": [15],
-            "data":"video_decision",
-            "searchable":false,
-            "visible":false
-        },
-        {
-            "targets": [16],
-            "data":"user_id",
-            "searchable":false,
-            "visible":false
         }
-
-
     ],
     "drawCallback": function (settings) {
         // Jump to top of page
diff --git a/data/interfaces/default/js/tables/users.js b/data/interfaces/default/js/tables/users.js
index b0796669..cade9c53 100644
--- a/data/interfaces/default/js/tables/users.js
+++ b/data/interfaces/default/js/tables/users.js
@@ -50,7 +50,7 @@ users_list_table_options = {
         },
         {
             "targets": [2],
-            "data": "time",
+            "data": "started",
             "render": function ( data, type, full ) {
                 return moment(data, "X").fromNow();
             }
@@ -63,12 +63,6 @@ users_list_table_options = {
         {
             "targets": [4],
             "data": "plays"
-        },
-        {
-            "targets": [5],
-            "data": "user",
-            "searchable": false,
-            "visible": false
         }
 
     ],
diff --git a/data/interfaces/default/user.html b/data/interfaces/default/user.html
index 315081f3..a9317aa0 100644
--- a/data/interfaces/default/user.html
+++ b/data/interfaces/default/user.html
@@ -182,7 +182,6 @@ from plexpy import helpers
                         <table class="display" id="history_table" width="100%">
                             <thead>
                             <tr>
-                                <th class="never" align='left' id="id">ID</th>
                                 <th class="all" align='left' id="time">Time</th>
                                 <th class="never" align='left' id="friendly_name">User</th>
                                 <th class="desktop" align='left' id="platform">Platform</th>
@@ -193,12 +192,6 @@ from plexpy import helpers
                                 <th class="desktop" align='left' id="stopped">Stopped</th>
                                 <th class="desktop" align='left' id="duration">Duration</th>
                                 <th class="desktop" align='left' id="percent_complete"></th>
-                                <th class="never" align='left' id="grandparent_rating_key">grandparentRatingKey</th>
-                                <th class="never" align='left' id="rating_key">RatingKey</th>
-                                <th class="never" align='left' id="user"></th>
-                                <th class="never" align='left' id="media_type"></th>
-                                <th class="never" align='left' id="video_decision"></th>
-                                <th class="never" align='left' id="user_id"></th>
                             </tr>
                             </thead>
                             <tbody>
@@ -301,9 +294,12 @@ from plexpy import helpers
                     // Build watch history table
                     history_table_options.ajax = {
                         "url": "get_history",
-                        "data": function(d) {
-                           d.user_id = user_id;
-                           d.user = "${data['username']}";
+                        type: 'post',
+                        data: function ( d ) {
+                            return { 'json_data': JSON.stringify( d ),
+                                     'user_id': user_id,
+                                     'user': "${data['username']}"
+                            };
                         }
                     }
                     history_table = $('#history_table').DataTable(history_table_options);
@@ -314,9 +310,12 @@ from plexpy import helpers
                     // Build user IP table
                     user_ip_table_options.ajax = {
                         "url": "get_user_ips",
-                        "data": function(d) {
-                            d.user_id = user_id;
-                            d.user = "${data['username']}";
+                        type: 'post',
+                        data: function ( d ) {
+                            return { 'json_data': JSON.stringify( d ),
+                                     'user_id': user_id,
+                                     'user': "${data['username']}"
+                            };
                         }
                     }
                     user_ip_table = $('#user_ip_table').DataTable(user_ip_table_options);
diff --git a/data/interfaces/default/users.html b/data/interfaces/default/users.html
index b75d63bb..d252f8ea 100644
--- a/data/interfaces/default/users.html
+++ b/data/interfaces/default/users.html
@@ -37,7 +37,6 @@ from plexpy import helpers
                         <th class="min-tablet" align="left" id="last_seen">Last Seen</th>
                         <th class="min-tablet" align="left" id="last_known_ip">Last Known IP</th>
                         <th class="min-tablet" align="left" id="total_plays">Total Plays</th>
-                        <th class="never" align="left" id="user"></th>
                     </tr>
                     </thead>
                     <tbody>
@@ -59,7 +58,11 @@ from plexpy import helpers
 <script src="interfaces/default/js/tables/users.js"></script>
 <script>
         users_list_table_options.ajax = {
-            "url": "get_user_list"
+            "url": "get_user_list",
+            type: "post",
+            data: function ( d ) {
+                return { 'json_data': JSON.stringify( d ) };
+            }
         }
 
         var users_list_table = $('#users_list_table').DataTable(users_list_table_options);
diff --git a/plexpy/datafactory.py b/plexpy/datafactory.py
index 7f7bc9c5..12695013 100644
--- a/plexpy/datafactory.py
+++ b/plexpy/datafactory.py
@@ -20,63 +20,33 @@ import datetime
 
 class DataFactory(object):
     """
-    Retrieve and process data from the plexwatch database
+    Retrieve and process data from the monitor database
     """
 
     def __init__(self):
         pass
 
-    def get_user_list(self, start='', length='', kwargs=None):
+    def get_user_list(self, kwargs=None):
         data_tables = datatables.DataTables()
 
-        start = int(start)
-        length = int(length)
-        filtered = []
-        totalcount = 0
-        search_value = ""
-        search_regex = ""
-        order_column = 1
-        order_dir = "desc"
-
-        if 'order[0][dir]' in kwargs:
-            order_dir = kwargs.get('order[0][dir]', "desc")
-
-        if 'order[0][column]' in kwargs:
-            order_column = kwargs.get('order[0][column]', 1)
-
-        if 'search[value]' in kwargs:
-            search_value = kwargs.get('search[value]', "")
-
-        if 'search[regex]' in kwargs:
-            search_regex = kwargs.get('search[regex]', "")
-
-        t1 = 'session_history'
-        t2 = 'session_history_metadata'
-        t3 = 'users'
-
-        columns = [t1 + '.id',
-                   '(case when users.friendly_name is null then ' + t1 +
-                   '.user else users.friendly_name end) as friendly_name',
-                   t1 + '.started',
-                   t1 + '.ip_address',
-                   'COUNT(' + t1 + '.rating_key) as plays',
-                   t1 + '.user',
-                   t1 + '.user_id',
-                   'users.thumb as thumb']
+        columns = ['session_history.id',
+                   'users.thumb as thumb',
+                   '(case when users.friendly_name is null then session_history.user else \
+                    users.friendly_name end) as friendly_name',
+                   'session_history.started',
+                   'session_history.ip_address',
+                   'COUNT(session_history.rating_key) as plays',
+                   'session_history.user',
+                   'session_history.user_id'
+                   ]
         try:
-            query = data_tables.ssp_query(table_name=t1,
+            query = data_tables.ssp_query(table_name='session_history',
                                           columns=columns,
-                                          start=start,
-                                          length=length,
-                                          order_column=int(order_column),
-                                          order_dir=order_dir,
-                                          search_value=search_value,
-                                          search_regex=search_regex,
-                                          custom_where='',
-                                          group_by=(t1 + '.user_id'),
-                                          join_type=['LEFT OUTER JOIN'],
-                                          join_table=['users'],
-                                          join_evals=[[t1 + '.user_id', 'users.user_id']],
+                                          custom_where=[],
+                                          group_by=['session_history.user_id'],
+                                          join_types=['LEFT OUTER JOIN'],
+                                          join_tables=['users'],
+                                          join_evals=[['session_history.user_id', 'users.user_id']],
                                           kwargs=kwargs)
         except:
             logger.warn("Unable to execute database query.")
@@ -93,8 +63,9 @@ class DataFactory(object):
             else:
                 user_thumb = item['thumb']
 
-            row = {"plays": item['plays'],
-                   "time": item['started'],
+            row = {"id": item['id'],
+                   "plays": item['plays'],
+                   "started": item['started'],
                    "friendly_name": item["friendly_name"],
                    "ip_address": item["ip_address"],
                    "thumb": user_thumb,
@@ -111,73 +82,48 @@ class DataFactory(object):
 
         return dict
 
-    def get_history(self, start='', length='', kwargs=None, custom_where=''):
+    def get_history(self, kwargs=None, custom_where=None):
         data_tables = datatables.DataTables()
 
-        start = int(start)
-        length = int(length)
-        filtered = []
-        totalcount = 0
-        search_value = ""
-        search_regex = ""
-        order_column = 1
-        order_dir = "desc"
-
-        t1 = 'session_history'
-        t2 = 'session_history_metadata'
-        t3 = 'users'
-        t4 = 'session_history_media_info'
-
-        if 'order[0][dir]' in kwargs:
-            order_dir = kwargs.get('order[0][dir]', "desc")
-
-        if 'order[0][column]' in kwargs:
-            order_column = kwargs.get('order[0][column]', "1")
-
-        if 'search[value]' in kwargs:
-            search_value = kwargs.get('search[value]', "")
-
-        if 'search[regex]' in kwargs:
-            search_regex = kwargs.get('search[regex]', "")
-
-        columns = [t1 + '.id',
-                   t1 + '.started as date',
-                   '(CASE WHEN users.friendly_name IS NULL THEN ' + t1 +
+        columns = ['session_history.id',
+                   'session_history.started as date',
+                   '(CASE WHEN users.friendly_name IS NULL THEN session_history'
                    '.user ELSE users.friendly_name END) as friendly_name',
-                   t1 + '.player as platform',
-                   t1 + '.ip_address',
-                   t2 + '.full_title as full_title',
-                   t1 + '.started',
-                   t1 + '.paused_counter',
-                   t1 + '.stopped',
-                   'round((julianday(datetime(' + t1 + '.stopped, "unixepoch", "localtime")) - \
-                    julianday(datetime(' + t1 + '.started, "unixepoch", "localtime"))) * 86400) - \
-                    (CASE WHEN ' + t1 + '.paused_counter IS NULL THEN 0 ELSE ' + t1 + '.paused_counter END) as duration',
-                   '((CASE WHEN ' + t1 + '.view_offset IS NULL THEN 0.1 ELSE ' + t1 + '.view_offset * 1.0 END) / \
-                   (CASE WHEN ' + t2 + '.duration IS NULL THEN 1.0 ELSE ' + t2 + '.duration * 1.0 END) * 100) as percent_complete',
-                   t1 + '.grandparent_rating_key as grandparent_rating_key',
-                   t1 + '.rating_key as rating_key',
-                   t1 + '.user',
-                   t2 + '.media_type',
-                   t4 + '.video_decision',
-                   t1 + '.user_id as user_id'
+                   'session_history.player',
+                   'session_history.ip_address',
+                   'session_history_metadata.full_title as full_title',
+                   'session_history.started',
+                   'session_history.paused_counter',
+                   'session_history.stopped',
+                   'round((julianday(datetime(session_history.stopped, "unixepoch", "localtime")) - \
+                    julianday(datetime(session_history.started, "unixepoch", "localtime"))) * 86400) - \
+                    (CASE WHEN session_history.paused_counter IS NULL THEN 0 \
+                    ELSE session_history.paused_counter END) as duration',
+                   '((CASE WHEN session_history.view_offset IS NULL THEN 0.1 ELSE \
+                    session_history.view_offset * 1.0 END) / \
+                   (CASE WHEN session_history_metadata.duration IS NULL THEN 1.0 ELSE \
+                    session_history_metadata.duration * 1.0 END) * 100) as percent_complete',
+                   'session_history.grandparent_rating_key as grandparent_rating_key',
+                   'session_history.rating_key as rating_key',
+                   'session_history.user',
+                   'session_history_metadata.media_type',
+                   'session_history_media_info.video_decision',
+                   'session_history.user_id as user_id'
                    ]
         try:
-            query = data_tables.ssp_query(table_name=t1,
+            query = data_tables.ssp_query(table_name='session_history',
                                           columns=columns,
-                                          start=start,
-                                          length=length,
-                                          order_column=int(order_column),
-                                          order_dir=order_dir,
-                                          search_value=search_value,
-                                          search_regex=search_regex,
                                           custom_where=custom_where,
-                                          group_by='',
-                                          join_type=['LEFT OUTER JOIN', 'JOIN', 'JOIN'],
-                                          join_table=[t3, t2, t4],
-                                          join_evals=[[t1 + '.user_id', t3 + '.user_id'],
-                                                      [t1 + '.id', t2 + '.id'],
-                                                      [t1 + '.id', t4 + '.id']],
+                                          group_by=[],
+                                          join_types=['LEFT OUTER JOIN',
+                                                      'JOIN',
+                                                      'JOIN'],
+                                          join_tables=['users',
+                                                       'session_history_metadata',
+                                                       'session_history_media_info'],
+                                          join_evals=[['session_history.user_id', 'users.user_id'],
+                                                      ['session_history.id', 'session_history_metadata.id'],
+                                                      ['session_history.id', 'session_history_media_info.id']],
                                           kwargs=kwargs)
         except:
             logger.warn("Unable to execute database query.")
@@ -188,12 +134,11 @@ class DataFactory(object):
         history = query['result']
 
         rows = []
-        # NOTE: We are adding in a blank xml field in order enable the Datatables "searchable" parameter
         for item in history:
             row = {"id": item['id'],
                    "date": item['date'],
                    "friendly_name": item['friendly_name'],
-                   "platform": item["platform"],
+                   "player": item["player"],
                    "ip_address": item["ip_address"],
                    "full_title": item["full_title"],
                    "started": item["started"],
@@ -209,21 +154,6 @@ class DataFactory(object):
                    "user_id": item["user_id"]
                    }
 
-            if item['paused_counter'] > 0:
-                row['paused_counter'] = item['paused_counter']
-            else:
-                row['paused_counter'] = 0
-
-            if item['started']:
-                if item['stopped'] > 0:
-                    stopped = item['stopped']
-                else:
-                    stopped = 0
-                if item['paused_counter'] > 0:
-                    paused_counter = item['paused_counter']
-                else:
-                    paused_counter = 0
-
             rows.append(row)
 
         dict = {'recordsFiltered': query['filteredCount'],
@@ -233,30 +163,9 @@ class DataFactory(object):
 
         return dict
 
-    def get_user_unique_ips(self, start='', length='', kwargs=None, custom_where=''):
+    def get_user_unique_ips(self, kwargs=None, custom_where=None):
         data_tables = datatables.DataTables()
 
-        start = int(start)
-        length = int(length)
-        filtered = []
-        totalcount = 0
-        search_value = ""
-        search_regex = ""
-        order_column = 0
-        order_dir = "desc"
-
-        if 'order[0][dir]' in kwargs:
-            order_dir = kwargs.get('order[0][dir]', "desc")
-
-        if 'order[0][column]' in kwargs:
-            order_column = kwargs.get('order[0][column]', 1)
-
-        if 'search[value]' in kwargs:
-            search_value = kwargs.get('search[value]', "")
-
-        if 'search[regex]' in kwargs:
-            search_regex = kwargs.get('search[regex]', "")
-
         columns = ['session_history.started as last_seen',
                    'session_history.ip_address as ip_address',
                    'COUNT(session_history.id) as play_count',
@@ -269,16 +178,10 @@ class DataFactory(object):
         try:
             query = data_tables.ssp_query(table_name='session_history',
                                           columns=columns,
-                                          start=start,
-                                          length=length,
-                                          order_column=int(order_column),
-                                          order_dir=order_dir,
-                                          search_value=search_value,
-                                          search_regex=search_regex,
                                           custom_where=custom_where,
-                                          group_by='session_history.ip_address',
-                                          join_type=['JOIN'],
-                                          join_table=['session_history_metadata'],
+                                          group_by=['ip_address'],
+                                          join_types=['JOIN'],
+                                          join_tables=['session_history_metadata'],
                                           join_evals=[['session_history.id', 'session_history_metadata.id']],
                                           kwargs=kwargs)
         except:
@@ -949,4 +852,4 @@ class DataFactory(object):
 
         output = {'categories': categories,
                   'series': [series_1_output]}
-        return output
\ No newline at end of file
+        return output
diff --git a/plexpy/datatables.py b/plexpy/datatables.py
index 4c821999..c5fdc8cb 100644
--- a/plexpy/datatables.py
+++ b/plexpy/datatables.py
@@ -13,8 +13,6 @@
 #  You should have received a copy of the GNU General Public License
 #  along with PlexPy.  If not, see <http://www.gnu.org/licenses/>.
 
-# TODO: Implement with sqlite3 directly instead of using db class
-
 from plexpy import logger, helpers, database
 
 import re
@@ -28,159 +26,216 @@ class DataTables(object):
     def __init__(self):
         self.ssp_db = database.MonitorDatabase()
 
-    # TODO: Pass all parameters via kwargs
-    def ssp_query(self, table_name,
+    def ssp_query(self,
+                  table_name=None,
                   columns=[],
-                  start=0,
-                  length=0,
-                  order_column=0,
-                  order_dir='asc',
-                  search_value='',
-                  search_regex='',
-                  custom_where='',
-                  group_by='',
-                  join_type=None,
-                  join_table=None,
-                  join_evals=None,
+                  custom_where=[],
+                  group_by=[],
+                  join_types=[],
+                  join_tables=[],
+                  join_evals=[],
                   kwargs=None):
 
-        parameters = self.process_kwargs(kwargs)
+        if not table_name:
+            logger.error('PlexPy DataTables :: No table name received.')
+            return None
 
-        if group_by != '':
-            grouping = True
+        # Set default variable values
+        parameters = {}
+        args = []
+        group = ''
+        order = ''
+        where = ''
+        join = ''
+        c_where = ''
+
+        # Fetch all our parameters
+        if kwargs.get('json_data'):
+            parameters = helpers.process_json_kwargs(json_kwargs=kwargs.get('json_data'))
+        else:
+            logger.error('PlexPy DataTables :: Parameters for Datatables must be sent as a serialised json object '
+                         'named json_data.')
+            return None
+
+        dt_columns = parameters['columns']
+        extracted_columns = self.extract_columns(columns=columns)
+
+        # Build grouping
+        if group_by:
+            for g in group_by:
+                group += g + ', '
+            if group:
+                grouping = True
+                group = 'GROUP BY ' + group.rstrip(', ')
         else:
             grouping = False
 
-        column_data = self.extract_columns(columns)
-        where = self.construct_where(column_data, search_value, grouping, parameters)
-        order = self.construct_order(column_data, order_column, order_dir, parameters, table_name, grouping)
-        join = ''
+        # Build ordering
+        for o in parameters['order']:
+            sort_order = ' COLLATE NOCASE'
+            if o['dir'] == 'desc':
+                sort_order = ' COLLATE NOCASE DESC'
+            # We first see if a name was sent though for the column sort.
+            if dt_columns[int(o['column'])]['data']:
+                # We have a name, now check if it's a valid column name for our query
+                # so we don't just inject a random value
+                if any(d.lower() == dt_columns[int(o['column'])]['data'].lower()
+                       for d in extracted_columns['column_named']):
+                    order += dt_columns[int(o['column'])]['data'] + '%s' % sort_order
+                else:
+                    # if we receive a bogus name, rather not sort at all.
+                    pass
+            # If no name exists for the column, just use the column index to sort
+            else:
+                order += extracted_columns['column_named'][int(o['column'])]
 
-        if join_type:
-            join_iter = 0
-            for join_type_item in join_type:
-                if join_type_item.upper() == 'LEFT OUTER JOIN':
+            order += ', '
+
+        if order:
+            order = 'ORDER BY ' + order.rstrip(', ')
+
+        # Build where parameters
+        if parameters['search']['value']:
+            counter = 0
+            for s in parameters['columns']:
+                if s['searchable']:
+                    # We first see if a name was sent though for the column search.
+                    if s['data']:
+                        # We have a name, now check if it's a valid column name for our query
+                        # so we don't just inject a random value
+                        if any(d.lower() == s['data'].lower() for d in extracted_columns['column_named']):
+                            where += s['data'] + ' LIKE ? OR '
+                            args.append('%' + parameters['search']['value'] + '%')
+                        else:
+                            # if we receive a bogus name, rather not search at all.
+                            pass
+                    # If no name exists for the column, just use the column index to search
+                    else:
+                        where += extracted_columns['column_named'][counter] + ' LIKE ? OR '
+                        args.append('%' + parameters['search']['value'] + '%')
+
+                counter += 1
+
+            if where:
+                where = 'WHERE ' + where.rstrip(' OR ')
+
+        # Build join parameters
+        if join_types:
+            counter = 0
+            for join_type in join_types:
+                if join_type.upper() == 'LEFT OUTER JOIN':
                     join_item = 'LEFT OUTER JOIN %s ON %s = %s ' % \
-                                (join_table[join_iter], join_evals[join_iter][0], join_evals[join_iter][1])
-                elif join_type_item.upper() == 'JOIN' or join_type.upper() == 'INNER JOIN':
-                    join_item = 'INNER JOIN %s ON %s = %s ' % \
-                                (join_table[join_iter], join_evals[join_iter][0], join_evals[join_iter][1])
+                                (join_tables[counter], join_evals[counter][0], join_evals[counter][1])
+                elif join_type.upper() == 'JOIN' or join_type.upper() == 'INNER JOIN':
+                    join_item = 'JOIN %s ON %s = %s ' % \
+                                (join_tables[counter], join_evals[counter][0], join_evals[counter][1])
                 else:
                     join_item = ''
-                join_iter += 1
+
+                counter += 1
                 join += join_item
 
-        # TODO: custom_where is ugly and causes issues with reported total results
-        if custom_where != '':
-            custom_where = 'WHERE (' + custom_where + ')'
+        # Build custom where parameters
+        if custom_where:
+            for w in custom_where:
+                c_where += w[0] + ' = ? AND '
 
+                # The order of our args changes if we are grouping
+                if grouping:
+                    args.insert(0, w[1])
+                else:
+                    args.append(w[1])
+
+            if c_where:
+                c_where = 'WHERE ' + c_where.rstrip(' AND ')
+
+        # Build our queries
         if grouping:
-            if custom_where == '':
-                query = 'SELECT * FROM (SELECT %s FROM %s %s GROUP BY %s) %s %s' \
-                        % (column_data['column_string'], table_name, join, group_by,
+            if c_where == '':
+                query = 'SELECT * FROM (SELECT %s FROM %s %s %s) %s %s' \
+                        % (extracted_columns['column_string'], table_name, join, group,
                            where, order)
             else:
-                query = 'SELECT * FROM (SELECT %s FROM %s %s %s GROUP BY %s) %s %s' \
-                        % (column_data['column_string'], table_name, join, custom_where, group_by,
+                query = 'SELECT * FROM (SELECT %s FROM %s %s %s %s) %s %s' \
+                        % (extracted_columns['column_string'], table_name, join, c_where, group,
                            where, order)
         else:
-            if custom_where == '':
+            if c_where == '':
                 query = 'SELECT %s FROM %s %s %s %s' \
-                        % (column_data['column_string'], table_name, join, where,
+                        % (extracted_columns['column_string'], table_name, join, where,
                            order)
             else:
                 query = 'SELECT * FROM (SELECT %s FROM %s %s %s %s) %s' \
-                        % (column_data['column_string'], table_name, join, where,
-                           order, custom_where)
+                        % (extracted_columns['column_string'], table_name, join, where,
+                           order, c_where)
 
-        # logger.debug(u"Query string: %s" % query)
-        filtered = self.ssp_db.select(query)
+        # logger.debug(u"Query: %s" % query)
 
-        if search_value == '':
-            totalcount = len(filtered)
-        else:
-            totalcount = self.ssp_db.select('SELECT COUNT(*) from %s' % table_name)[0][0]
+        # Execute the query
+        filtered = self.ssp_db.select(query, args=args)
 
-        result = filtered[start:(start + length)]
+        # Build grand totals
+        totalcount = self.ssp_db.select('SELECT COUNT(id) from %s' % table_name)[0][0]
+
+        result = filtered[parameters['start']:(parameters['start'] + parameters['length'])]
         output = {'result': result,
                   'filteredCount': len(filtered),
                   'totalCount': totalcount}
 
         return output
 
+    # This method extracts column data from our column list
+    # The first parameter is required, the match_columns parameter is optional and will cause the function to
+    # only return results if the value also exists in the match_columns 'data' field
     @staticmethod
-    def construct_order(column_data, order_column, order_dir, parameters=None, table_name=None, grouped=False):
-        order = ''
-        if grouped:
-            sort_col = column_data['column_named'][order_column]
-        else:
-            sort_col = column_data['column_order'][order_column]
-        if parameters:
-            for parameter in parameters:
-                if parameter['data'] != '':
-                    if int(order_column) == parameter['index']:
-                        if parameter['data'] in column_data['column_named'] and parameter['orderable'] == 'true':
-                            if table_name and table_name != '':
-                                order = 'ORDER BY %s COLLATE NOCASE %s' % (sort_col, order_dir)
-                            else:
-                                order = 'ORDER BY %s COLLATE NOCASE %s' % (sort_col, order_dir)
-        else:
-            order = 'ORDER BY %s COLLATE NOCASE %s' % (sort_col, order_dir)
-
-        return order
-
-    @staticmethod
-    def construct_where(column_data, search_value='', grouping=False, parameters=None):
-        if search_value != '':
-            where = 'WHERE '
-            if parameters:
-                for column in column_data['column_named']:
-                    search_skip = False
-                    for parameter in parameters:
-                        if column.rpartition('.')[-1] in parameter['data']:
-                            if parameter['searchable'] == 'true':
-                                where += column + ' LIKE "%' + search_value + '%" OR '
-                                search_skip = True
-                            else:
-                                search_skip = True
-
-                    if not search_skip:
-                        where += column + ' LIKE "%' + search_value + '%" OR '
-            else:
-                for column in column_data['column_named']:
-                    where += column + ' LIKE "%' + search_value + '%" OR '
-
-            # TODO: This will break the query if all parameters are excluded
-            where = where[:-4]
-
-            return where
-        else:
-            where = ''
-
-            return where
-
-    @staticmethod
-    def extract_columns(columns=[]):
+    def extract_columns(columns=None, match_columns=None):
         columns_string = ''
         columns_literal = []
         columns_named = []
         columns_order = []
 
         for column in columns:
-            columns_string += column
-            columns_string += ', '
-            # TODO: make this case insensitive
-            if ' as ' in column:
-                columns_literal.append(column.rpartition(' as ')[0])
-                columns_named.append(column.rpartition(' as ')[-1].rpartition('.')[-1])
-                columns_order.append(column.rpartition(' as ')[-1])
+            # We allow using "as" in column names for more complex sql functions.
+            # This function breaks up the column to get all it's parts.
+            as_search = re.compile(' as ', re.IGNORECASE)
+
+            if re.search(as_search, column):
+                column_named = re.split(as_search, column)[1].rpartition('.')[-1]
+                column_literal = re.split(as_search, column)[0]
+                column_order = re.split(as_search, column)[1]
+                if match_columns:
+                    if any(d['data'].lower() == column_named.lower() for d in match_columns):
+                        columns_string += column + ', '
+                        columns_literal.append(column_literal)
+                        columns_named.append(column_named)
+                        columns_order.append(column_order)
+                else:
+                    columns_string += column + ', '
+                    columns_literal.append(column_literal)
+                    columns_named.append(column_named)
+                    columns_order.append(column_order)
             else:
-                columns_literal.append(column)
-                columns_named.append(column.rpartition('.')[-1])
-                columns_order.append(column)
+                column_named = column.rpartition('.')[-1]
+                if match_columns:
+                    if any(d['data'].lower() == column_named.lower() for d in match_columns):
+                        columns_string += column + ', '
+                        columns_literal.append(column)
+                        columns_named.append(column_named)
+                        columns_order.append(column)
+                else:
+                    columns_string += column + ', '
+                    columns_literal.append(column)
+                    columns_named.append(column_named)
+                    columns_order.append(column)
 
-        columns_string = columns_string[:-2]
+        columns_string = columns_string.rstrip(', ')
 
+        # We return a dict of the column params
+        # column_string is a comma seperated list of the exact column variables received.
+        # column_literal is the text before the "as" if we have an "as". Usually a function.
+        # column_named is the text after the "as", if we have an "as". Any table prefix is also stripped off.
+        #   We use this to match with columns received from the Datatables request.
+        # column_order is the text after the "as", if we have an "as". Any table prefix is left intact.
         column_data = {'column_string': columns_string,
                        'column_literal': columns_literal,
                        'column_named': columns_named,
@@ -188,32 +243,3 @@ class DataTables(object):
                        }
 
         return column_data
-
-    # TODO: Fix this method. Should not break if kwarg list is not sorted.
-    def process_kwargs(self, kwargs):
-
-        column_parameters = []
-
-        for kwarg in sorted(kwargs):
-            if re.search(r"\[(\w+)\]", kwarg) and kwarg[:7] == 'columns':
-                parameters = re.findall(r"\[(\w+)\]", kwarg)
-                array_index = ''
-                for parameter in parameters:
-                    pass_complete = False
-                    if parameter.isdigit():
-                        array_index = parameter
-                    if parameter == 'data':
-                        data = kwargs.get('columns[' + array_index + '][data]', "")
-                    if parameter == 'orderable':
-                        orderable = kwargs.get('columns[' + array_index + '][orderable]', "")
-                    if parameter == 'searchable':
-                        searchable = kwargs.get('columns[' + array_index + '][searchable]', "")
-                        pass_complete = True
-                    if pass_complete:
-                        row = {'index': int(array_index),
-                               'data': data,
-                               'searchable': searchable,
-                               'orderable': orderable}
-                        column_parameters.append(row)
-
-        return sorted(column_parameters, key=lambda i: i['index'])
\ No newline at end of file
diff --git a/plexpy/helpers.py b/plexpy/helpers.py
index 26bef79c..4a5767c1 100644
--- a/plexpy/helpers.py
+++ b/plexpy/helpers.py
@@ -396,3 +396,10 @@ def get_xml_attr(xml_key, attribute, return_bool=False, default_return=''):
             return False
         else:
             return default_return
+
+def process_json_kwargs(json_kwargs):
+    params = {}
+    if json_kwargs:
+        params = json.loads(json_kwargs)
+
+    return params
diff --git a/plexpy/webserve.py b/plexpy/webserve.py
index 52517089..17c89c9e 100644
--- a/plexpy/webserve.py
+++ b/plexpy/webserve.py
@@ -204,10 +204,10 @@ class WebInterface(object):
         return serve_template(templatename="stream_data.html", title="Stream Data", data=stream_data, user=user)
 
     @cherrypy.expose
-    def get_user_list(self, start=0, length=100, **kwargs):
+    def get_user_list(self, **kwargs):
 
         data_factory = datafactory.DataFactory()
-        users = data_factory.get_user_list(start, length, kwargs)
+        users = data_factory.get_user_list(kwargs=kwargs)
 
         cherrypy.response.headers['Content-type'] = 'application/json'
         return json.dumps(users)
@@ -461,22 +461,22 @@ class WebInterface(object):
                               message=message, timer=timer)
 
     @cherrypy.expose
-    def get_history(self, start=0, length=100, user=None, user_id=None, **kwargs):
+    def get_history(self, user=None, user_id=None, **kwargs):
 
-        custom_where=''
+        custom_where=[]
         if user_id:
-            custom_where = 'user_id = "%s"' % user_id
+            custom_where = [['user_id', user_id]]
         elif user:
-            custom_where = 'user = "%s"' % user
+            custom_where = [['user', user]]
         if 'rating_key' in kwargs:
             rating_key = kwargs.get('rating_key', "")
-            custom_where = 'rating_key = %s' % rating_key
+            custom_where = [['rating_key', rating_key]]
         if 'grandparent_rating_key' in kwargs:
             rating_key = kwargs.get('grandparent_rating_key', "")
-            custom_where = 'grandparent_rating_key = %s' % rating_key
+            custom_where = [['grandparent_rating_key', rating_key]]
 
         data_factory = datafactory.DataFactory()
-        history = data_factory.get_history(start, length, kwargs, custom_where)
+        history = data_factory.get_history(kwargs=kwargs, custom_where=custom_where)
 
         cherrypy.response.headers['Content-type'] = 'application/json'
         return json.dumps(history)
@@ -760,18 +760,16 @@ class WebInterface(object):
             logger.warn('Unable to retrieve data.')
 
     @cherrypy.expose
-    def get_user_ips(self, start=0, length=100, user_id=None, user=None, **kwargs):
+    def get_user_ips(self, user_id=None, user=None, **kwargs):
 
-        custom_where=''
+        custom_where=[]
         if user_id:
-            custom_where = 'user_id = "%s"' % user_id
+            custom_where = [['user_id', user_id]]
         elif user:
-            custom_where = 'user = "%s"' % user
+            custom_where = [['user', user]]
 
         data_factory = datafactory.DataFactory()
-        history = data_factory.get_user_unique_ips(start=start,
-                                                   length=length,
-                                                   kwargs=kwargs,
+        history = data_factory.get_user_unique_ips(kwargs=kwargs,
                                                    custom_where=custom_where)
 
         cherrypy.response.headers['Content-type'] = 'application/json'