luci-base: form.js: do not execute embedded script code in stripTags()

Instead of relying on .innerHTML which executes embedded script code to
parse a given HTML fragment, use dom.parse() which utilizies DOMParser()
internally in order to extract textContent in a safe manner.

Fixes: FS#4199
Ref: https://bugs.openwrt.org/index.php?do=details&task_id=4199
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 993151504e8e810c083d3257555bdcdc2f00673a)

treewide: Backport translations from master - i18n

Backport translations.
Sync.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-base: cbi.js: properly handle falsy values in cbi_update_table()

Fixes: #5544
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit e982c05671229b3d13622b38c9536812e8c5f05c)

luci-base: network.js: ignore wireless ifname patterns on retrieving devices

Only treat the given identifier as Linux netdev name if we can find a
corresponding entry in the device info cache and do not consider strings
starting with "wlan", "ath" or "wl" to be existing devices.

This fixes incorrectly adding wireless sections as ifnames to network
interfaces when the wifi-iface section name begins with one of the
`iface_patterns_wireless` patterns.

Fixes: #5069
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit d4092b15ce92cda2d7711b57b2251ebebef32b5c)

timezone data: update to 2021e

Update timezone data to 2021e.

http://mm.icann.org/pipermail/tz-announce/2021-September/000066.html
* Jordan now starts DST on February's last Thursday.
* Samoa no longer observes DST.
* Rename Pacific/Enderbury to Pacific/Kanton.

http://mm.icann.org/pipermail/tz-announce/2021-October/000068.html
* Fiji will suspend observance of DST for the 2021/2022 season.

http://mm.icann.org/pipermail/tz-announce/2021-October/000069.html
* Palestine will fall back 10-29 (not 10-30)

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 0740023a3c44ebfb47126b8c9bb4e9a20985aa55)

treewide: Backport i18n translations

Backport translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

Merge pull request #5414 from stangri/19.07-luci-app-advanced-reboot

[19.07] luci-app-advanced-reboot: bugfix for Linksys E4200v2

luci-app-advanced-reboot: bugfix for Linksys E4200v2

* bugfix for Linksys E4200v2
* backport updates from master

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-mod-network: allow literal "auto" value for distance

Fixes: #4050
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 01d5d5f92963d9596a3c0b669a7e8d87b64132d5)

tree: remove erroneous luci-app-dawn ACL file

Remove ACL file accidentally added by ecd49247eb.
There is no luci-app-dawn in 19.07, so no ACL is needed.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

treewide: i18n - Sync and backport translations

Backport translations from master.
Sync translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

treewide: i18n - Backport and sync translations

Backport translations from master.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-app-attendedsysupgrade: use detail not message

The new API unifies all human readable responses in the `detail` field
to follow the newly used framework.

Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 2a29911121bf72d5d316b2eeae7f184b8ce14482)

luci-app-attendedsysupgrade: use latest.json

The content is the same response as for `/api/latest.json` but
statically hosted by a webserver rather than Python generated.

Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit a672875402a0802ddcd0e4c8c2d0ac7913dff671)

luci-app-attendedsysupgrade: show position in queue

The server provides a queue_position argument, show it.

Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit 53ff7ca676d10fa253d3ab472b9b5645996527ed)

luci-app-attendedsysupgrade: add timeout and catch

If the upgrade server API does not respond, show an error message.
Fix #5222

While at it, minimal code linting

Signed-off-by: Paul Spooren <mail@aparcar.org>
(cherry picked from commit ff24b78c807a52a0f9afb62ba0aba1085d9ad045)

luci-app-attendedsysupgrade: fix empty array condition

In JavaScript (other than in Python) an empty array is considered `true`
within if statements. Fix this by checking for the array length rather
than its existence.

This fixes the issue of an empty dropdown menu in case the user is
running the latest release.

Signed-off-by: Paul Spooren <mail@aparcar.org>

treewide: i18n - Sync and backport translations

Sync translations.
Backport translations from master.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

Merge pull request #5228 from stangri/19.07-firewall

[19.07] luci-app-firewall: replace hh.mm.ss with hh:mm:ss

luci-app-firewall: replace hh.mm.ss with hh:mm:ss

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #5218 from stangri/19.07-luci-app-https-dns-proxy

[19.07] luci-app-https-dns-proxy: update to 2021-07-29-1

luci-app-https-dns-proxy: update to 2021-07-29-1

* add HTTP/2-only supporting providers: Mullvad, Digitale-Gesellschaft, dns.sb and Rubyfish.cn
* switch default provider from Google to Cloudflare
* add IPv6 addresses for bootstrap resolvers for Google DNS
* add secondary bootstrap resolver (Cloudflare's) to all providers with a single bootstrap resolver
* modify model/cbi file to show HTTP/2-only providers (and help texts) on HTTP/2-supporting systems

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-mod-network: handle multiple mac for static lease

The mac section for the static lease doesn't correctly handle when multiple mac are set for a rule.
Fixes: #4291
Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
(cherry picked from commit 6c9a6c334e2fa55f4b64b64b85e0b104f0b99037)

luci-app-attendedsysupgrade: sync with master branch

Upgrade the app to stay compatible with the running upgrade server.

Signed-off-by: Paul Spooren <mail@aparcar.org>

themes: Call striptags() on hostname to prevent XSS

This calls striptags() on the hostname to prevent any XSS over the
hostname. This should fix CVE-2021-33425 as far as I understood it.

If someone adds some Javascript into system.@system[0].hostname it would
have been directly added to the page, this prevents the problem.

This can only be exploited by someone being able to modify the uci
configuration, normally a user with such privileges could also just
modify the webpage.

Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 5cbd79d7e31c0f0feaea2770bf102bbae7831e3c)

treewide: i18n - Backport translations from master

Backport translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-mod-status: fix potential XSS via specially crafted DNS names

When an upstream NS returns PTR domain names containing HTML, it is
added verbatim to the connection status table.

Prevent this issue by HTML escaping any values in the source and
destination columns.

Fixes: CVE-2021-32019
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 3c66c5b1651aa25afbff09bee45047da9a0ba43d)

treewide: backport translations i18n

Backport translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

treewide: i18n - Backport translations

Backport translations from master.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-base: form.js: fix AbstractValue.textvalue() for uci list options

Serialize the uci list value into a space separated string before passing
it to String.format() for HTML escaping. Without that change, empty strings
were returned whenever the underlying uci get operation yieled an array.

Fixes: #4993
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 5c792aefc744d1417fc9e24cfb92cd61cf8a651f)

[19.07] luci-app-fwknopd: add support for ENABLE_CMD_EXEC

Add support for execution commands on the fwknopd server.

Signed-off-by: Ptilopsis Leucotis <PtilopsisLeucotis@yandex.com>

Merge pull request #4976 from stangri/19.07-luci-app-simple-adblock

[19.07 luci-app-simple-adblock: bugfix: crash when dnsmasq.ipset selected

luci-app-simple-adblock: bugfix: crash when dnsmasq.ipset selected

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-mod-system: implement system.description, system.notes

Implement two new text "options" for UCI system config, intended to
help humans describe the device.

"system.description" is a short, single-line description suitable for
selector UIs in remote administration applications, or remote UCI (over
ubus RPC), etc.  It would also be suitable as a default for LLDP/SNMP
"system description".

"system.notes" is a multi-line, free-form text field that can be used in
any way the user wishes, e.g. to hold installation notes, or unit serial
number and inventory number, location, etc.

Signed-off-by: Henrique de Moraes Holschuh <henrique@nic.br>

treewide: Backport translations and sync

Backport from master and sync translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-app-opkg: fix parsing empty package repository indexes

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 3bcbcbf0889142ca19b893f41318963b69de90ab)

treewide: i18n backport and sync

Backport translations from master and sync.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

Merge pull request #4908 from stangri/19.07-luci-app-vpn-policy-routing

[19.07] luci-app-vpn-policy-routing: explicit package version

Merge pull request #4905 from stangri/19.07-luci-app-simple-adblock

[19.07] luci-app-simple-adblock: explicit package version

Merge pull request #4902 from stangri/19.07-luci-app-https-dns-proxy

[19.07] luci-app-https-dns-proxy: explicit package version

Merge pull request #4899 from stangri/19.07-luci-app-advanced-reboot

[19.07] luci-app-advanced-reboot: explicit package version

Merge pull request #4844 from oofnikj/4510_backport_gre

 luci-proto-gre: backport to 19.07

luci-app-vpn-policy-routing: explicit package version

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-app-simple-adblock: explicit package version

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-app-https-dns-proxy: explicit package version

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-app-advanced-reboot: explicit package version

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #4884 from stangri/19.07-luci-app-https-dns-proxy

[19.07] luci-app-https-dns-proxy: bugfix: layout issues on theme-openwrt-2020

Merge pull request #4887 from stangri/19.07-luci-app-simple-adblock

[19.07] luci-app-simple-adblock: bugfix: template layout on theme-openwrt-2020

Merge pull request #4890 from stangri/19.07-luci-app-vpn-policy-routing

[19.07] luci-app-vpn-policy-routing: bugfix: template layout on theme-openwrt-2020

luci-app-vpn-policy-routing: bugfix: template layout on theme-openwrt-2020

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-app-simple-adblock: bugfix: template layout on theme-openwrt-2020

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-app-https-dns-proxy: bugfix: layout issues on theme-openwrt-2020

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #4871 from stangri/19.07-luci-app-vpn-policy-routing

[19.07] luci-app-vpn-policy-routing: sync with principal app

luci-app-vpn-policy-routing: sync with principal app

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-app-firewall: allow negative prefix lengths

Fixes: #4812
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit f64b3d509446cc78a7df746b174bdab330f23ab2)

luci-base: validation.js: optionally support negative prefixes

Support negative prefix length in the `cidr`, `cidr4`, `cidr6`, `ipmask`,
`ipmask4` and `ipmask6` data types when an optional truish flag is passed
to the datatype name.

Ref: #4812
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit cd06e708d8d8037486b77dab3389ca91a88f2dd0)

luci-base: network.js: sort interface statuses by metric, then name

Fixes: #4693
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 0ee422b4c0e266f0ece70fa60e0ebfa84851992e)

luci-proto-gre: update i18n and fix typo

Signed-off-by: Sergio E. Nemirowski <sergio@outerface.net>
Signed-off-by: Jordan Sokolic <oofnik@gmail.com>

luci-app-firewall: zones.js: fix HTML display in ct helper selection

Fixes: #4845
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 154117ff05d0ecbe97ee98493bb647f526166b50)

luci-app-firewall: fix creating multiple networks from zone network selector

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 5d528da29f3b03deba0144c85d862e1e4468ff25)

luci-base: firewall.js: manage zomne networks as list

Fixes: #4827
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 49ecaf60902be2e43ccec3c61bc6b7d0b41da251)

rpcd-mod-luci: Fix parsing of DUID-LLT's in duid2ea

Fix parsing of DUID-LLT's in duid2ea.  Unlike DUID-LL's, DUID-LLT's have a 32-bit time field between the hardware type and link-layer address fields, see RFC 3315 Sections 9.2 and 9.4:

https://tools.ietf.org/html/rfc3315#section-9.2
https://tools.ietf.org/html/rfc3315#section-9.4

therefore, the link-layer address starts at offset 16 instead of 8.

Signed-off-by: Niels Widger <niels@qacafe.com>
(cherry picked from commit 8920a2bf71e544fada3de824126a5c8f1c596b63)

luci-proto-gre: remove extra parenthesis

fix the following error:
SyntaxError
Unexpected token ')'
  in http://192.168.122.131/luci-static/resources/protocol/grev6.js:?
  at http://192.168.122.131/luci-static/resources/luci.js:22
  at async Promise.all (index 4)
  at async Promise.all (index 5)

Fixes: 2b7fd1292 ("luci-proto-gre: improvement of LuCI interface")
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>

luci-proto-gre: improvement of LuCI interface

Better handling of Type of Service (IPv4), Traffic Class (IPv6) values
Optional value Local endpoint address is detected and pre-filled in the interface

Signed-off-by: Jan Bětík <jan.betik@svine.su>

luci-proto-gre: Protocol extension for GRE tunnels

I'm running several GRE tunnels to different locations and
the option to see and to configure GRE tunnels in LuCI was not
crucial but nice to have.

Signed-off-by: Jan Bětík <jan.betik@svine.su>

treewide: i18n backport and sync translations

Backport translations from master.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

Merge pull request #4830 from stangri/19.07-luci-app-https-dns-proxy

luci-app-https-dns-proxy: add Force DNS, IDNet support, add missing class to buttons

luci-app-https-dns-proxy: add Force DNS, IDNet support, add missing class to buttons

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-base: ui.js: resolve parent ul early in UIDropdown.toggleItem()

The parent node of the current li might be null after collapsing the
dropdown, so resolve the parent ul early to avoid passing null to
subsequent calls.

Fixes clearing custom input values in DynamicList dropdowns.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit b8d2bcd432ab23a883de1dd4fbce29f9751a6e84)

luci-app-firewall: properly handle custom multi IP/MAC input

Store multiple space separated custom address values as separate uci
list items in the configuration.

Fixes: #4822
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit b60be8cfd82e83818013fafce00c9433e0c38376)

luci-app-ddns: fix multiple authenticated RCEs

The ddns detail model passes unsanitized values directly to sys.call() in
various places, which allows injecting arbitrary commands through a number
of fields.

Prevent that issue by quoting the values used in command invocations.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

treewide: i18n backport and sync translations

Backport translations from master.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

Merge pull request #4795 from stangri/19.07-luci-app-simple-adblock

[19.07] luci-app-simple-adblock: bugfix: default values for ListValue

luci-app-simple-adblock: bugfix: default values for ListValue

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-base: luci.js: fix sortedKeys() ordering

Chrome does not properly sort arrays when the sort function returns boolean
results, in contrast to Firefox which does.

Fix the issue by returning a numerical result instead.

Fixes: #4792
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 3c166c25de535c5c5aeda1d40eba6c1756c412be)

Merge pull request #4766 from stangri/19.07-luci-app-https-dns-proxy

[19.07] luci-app-https-dns-proxy: add nextdns.io and quad 101 providers

luci-app-https-dns-proxy: add nextdns.io and quad 101 providers

Signed-off-by: Stan Grishin <stangri@melmac.net>

timezone data: update to 2021a

Update timezone data to 2021a.

http://mm.icann.org/pipermail/tz-announce/2021-January/000065.html

* South Sudan changes from +03 to +02

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit af1f961589e9c339a774d42682b9978eabaebcfd)

treewide: i18n - Sync and backport translations from master

Backport translations from master.
Sync.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-app-sqm: remove orphaned ACL file

Remove a backport artefact. For the openwrt-19.07 branch, luci-app-sqm
is maintained in the packages feed.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

luci-mod-network: properly handle wireless devices when adding interfaces

Wireless device names must not be added as list/option ifname, but the
network must be backreferenced in config wifi-iface instead in these
cases.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(backported from commit 7b5b7fbcd63af14658ad234cd39c076a823e4629)

treewide: i18n - backport translations from master

Backport translations from master.
Sync.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

Merge pull request #4730 from stangri/19.07-luci-app-https-dns-proxy

[19.07] luci-app-https-dns-proxy: DSCP tagging support

luci-app-https-dns-proxy: DSCP tagging support

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-base: correct button name on flash page help text

Correct the help text in the flash page to match the current
buttons. 'Continue' instead of "Proceed".

Adjust translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit e2ac2e92b0de9f4be78b090ad7fc62a8df222b37
 languages not existing in 19.07 removed from the commit)

timezone data: update to 2020f

Update timezone data to 2020f.

2020e: http://mm.icann.org/pipermail/tz-announce/2020-December/000063.html
       Volgograd switches to Moscow time.
       Australia/Currie removed as identical to Australia/Hobart
2020f: http://mm.icann.org/pipermail/tz-announce/2020-December/000064.html

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 9e4391e3a62dc0f7dc64720a1ca79b477099dc28)

luci-theme-rosy: Remove BROKEN theme

Remove the Rosy theme that has been marked broken in master
for over a year, and in openwrt-19.07 since March 2020.

Reference to
https://github.com/openwrt/luci/issues/3759#issuecomment-599436159

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

treewide: i18n - backport again

Backport translations again, after fixing the weblate
conflicts in master.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

treewide: i18n - backport translations

Backport translations from master.
Sync translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-app-adblock: XHTML fix

* made DNS Report page XHTML compatible

Signed-off-by: Dirk Brenken <dev@brenken.org>

luci-app-adblock: backport fixes

* fix dns backend detection in TurrisOS
* sync translations

Signed-off-by: Dirk Brenken <dev@brenken.org>

luci-mod-system: fix reference to undefined variable

Fixes: 24550446c ("luci-mod-system: fix parsing SSH pubkeys with options")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>

luci-mod-system: fix parsing SSH pubkeys with options

Also eliminate some duplicate code while we're at it.

Fixes: #4684
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(backported from commit 846b89c5bf07100f9bf1e46bcac55acab5535e26)

luci-app-noddos: remove

The 'noddos' package itself was removed with commit
https://github.com/openwrt/packages/commit/eb9d5bbf39e89909283c431ae981feac39b02d95

Remove also the corresponding LuCI app.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(backported from commit b06bc2c9ef2bd30271afe80a28197a352d15a93f)

Merge pull request #4682 from stangri/19.07-luci-app-simple-adblock

[19.07] luci-app-simple-adblock: README URL update

luci-app-simple-adblock: README URL update

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #4679 from stangri/19.07-luci-app-https-dns-proxy

[19.07] luci-app-https-dns-proxy: WebUI for dnsmasq config update, quad9 bootstrap IPv6

luci-app-https-dns-proxy: WebUI for dnsmasq config update, quad9 bootstrap IPv6

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci.mk: correcting a misspell for Brazilian Portuguese

Reported-by: Wellington Uemura
* update message header
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 151787b561bce39f505d0f5753d0f80d2b796ba3)

treewide: Backport and sync translations

Backport translations from master.
Sync translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>