luci-mod-status: fix potential XSS via specially crafted DNS names

When an upstream NS returns PTR domain names containing HTML, it is
added verbatim to the connection status table.

Prevent this issue by HTML escaping any values in the source and
destination columns.

Fixes: CVE-2021-32019
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 3c66c5b1651aa25afbff09bee45047da9a0ba43d)

treewide: backport translations i18n

Backport translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

treewide: i18n - Backport translations

Backport translations from master.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-base: form.js: fix AbstractValue.textvalue() for uci list options

Serialize the uci list value into a space separated string before passing
it to String.format() for HTML escaping. Without that change, empty strings
were returned whenever the underlying uci get operation yieled an array.

Fixes: #4993
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 5c792aefc744d1417fc9e24cfb92cd61cf8a651f)

[19.07] luci-app-fwknopd: add support for ENABLE_CMD_EXEC

Add support for execution commands on the fwknopd server.

Signed-off-by: Ptilopsis Leucotis <PtilopsisLeucotis@yandex.com>

Merge pull request #4976 from stangri/19.07-luci-app-simple-adblock

[19.07 luci-app-simple-adblock: bugfix: crash when dnsmasq.ipset selected

luci-app-simple-adblock: bugfix: crash when dnsmasq.ipset selected

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-mod-system: implement system.description, system.notes

Implement two new text "options" for UCI system config, intended to
help humans describe the device.

"system.description" is a short, single-line description suitable for
selector UIs in remote administration applications, or remote UCI (over
ubus RPC), etc.  It would also be suitable as a default for LLDP/SNMP
"system description".

"system.notes" is a multi-line, free-form text field that can be used in
any way the user wishes, e.g. to hold installation notes, or unit serial
number and inventory number, location, etc.

Signed-off-by: Henrique de Moraes Holschuh <henrique@nic.br>

treewide: Backport translations and sync

Backport from master and sync translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-app-opkg: fix parsing empty package repository indexes

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 3bcbcbf0889142ca19b893f41318963b69de90ab)

treewide: i18n backport and sync

Backport translations from master and sync.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

Merge pull request #4908 from stangri/19.07-luci-app-vpn-policy-routing

[19.07] luci-app-vpn-policy-routing: explicit package version

Merge pull request #4905 from stangri/19.07-luci-app-simple-adblock

[19.07] luci-app-simple-adblock: explicit package version

Merge pull request #4902 from stangri/19.07-luci-app-https-dns-proxy

[19.07] luci-app-https-dns-proxy: explicit package version

Merge pull request #4899 from stangri/19.07-luci-app-advanced-reboot

[19.07] luci-app-advanced-reboot: explicit package version

Merge pull request #4844 from oofnikj/4510_backport_gre

 luci-proto-gre: backport to 19.07

luci-app-vpn-policy-routing: explicit package version

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-app-simple-adblock: explicit package version

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-app-https-dns-proxy: explicit package version

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-app-advanced-reboot: explicit package version

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #4884 from stangri/19.07-luci-app-https-dns-proxy

[19.07] luci-app-https-dns-proxy: bugfix: layout issues on theme-openwrt-2020

Merge pull request #4887 from stangri/19.07-luci-app-simple-adblock

[19.07] luci-app-simple-adblock: bugfix: template layout on theme-openwrt-2020

Merge pull request #4890 from stangri/19.07-luci-app-vpn-policy-routing

[19.07] luci-app-vpn-policy-routing: bugfix: template layout on theme-openwrt-2020

luci-app-vpn-policy-routing: bugfix: template layout on theme-openwrt-2020

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-app-simple-adblock: bugfix: template layout on theme-openwrt-2020

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-app-https-dns-proxy: bugfix: layout issues on theme-openwrt-2020

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #4871 from stangri/19.07-luci-app-vpn-policy-routing

[19.07] luci-app-vpn-policy-routing: sync with principal app

luci-app-vpn-policy-routing: sync with principal app

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-app-firewall: allow negative prefix lengths

Fixes: #4812
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit f64b3d509446cc78a7df746b174bdab330f23ab2)

luci-base: validation.js: optionally support negative prefixes

Support negative prefix length in the `cidr`, `cidr4`, `cidr6`, `ipmask`,
`ipmask4` and `ipmask6` data types when an optional truish flag is passed
to the datatype name.

Ref: #4812
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit cd06e708d8d8037486b77dab3389ca91a88f2dd0)

luci-base: network.js: sort interface statuses by metric, then name

Fixes: #4693
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 0ee422b4c0e266f0ece70fa60e0ebfa84851992e)

luci-proto-gre: update i18n and fix typo

Signed-off-by: Sergio E. Nemirowski <sergio@outerface.net>
Signed-off-by: Jordan Sokolic <oofnik@gmail.com>

luci-app-firewall: zones.js: fix HTML display in ct helper selection

Fixes: #4845
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 154117ff05d0ecbe97ee98493bb647f526166b50)

luci-app-firewall: fix creating multiple networks from zone network selector

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 5d528da29f3b03deba0144c85d862e1e4468ff25)

luci-base: firewall.js: manage zomne networks as list

Fixes: #4827
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 49ecaf60902be2e43ccec3c61bc6b7d0b41da251)

rpcd-mod-luci: Fix parsing of DUID-LLT's in duid2ea

Fix parsing of DUID-LLT's in duid2ea.  Unlike DUID-LL's, DUID-LLT's have a 32-bit time field between the hardware type and link-layer address fields, see RFC 3315 Sections 9.2 and 9.4:

https://tools.ietf.org/html/rfc3315#section-9.2
https://tools.ietf.org/html/rfc3315#section-9.4

therefore, the link-layer address starts at offset 16 instead of 8.

Signed-off-by: Niels Widger <niels@qacafe.com>
(cherry picked from commit 8920a2bf71e544fada3de824126a5c8f1c596b63)

luci-proto-gre: remove extra parenthesis

fix the following error:
SyntaxError
Unexpected token ')'
  in http://192.168.122.131/luci-static/resources/protocol/grev6.js:?
  at http://192.168.122.131/luci-static/resources/luci.js:22
  at async Promise.all (index 4)
  at async Promise.all (index 5)

Fixes: 2b7fd1292 ("luci-proto-gre: improvement of LuCI interface")
Signed-off-by: Chuanhong Guo <gch981213@gmail.com>

luci-proto-gre: improvement of LuCI interface

Better handling of Type of Service (IPv4), Traffic Class (IPv6) values
Optional value Local endpoint address is detected and pre-filled in the interface

Signed-off-by: Jan Bětík <jan.betik@svine.su>

luci-proto-gre: Protocol extension for GRE tunnels

I'm running several GRE tunnels to different locations and
the option to see and to configure GRE tunnels in LuCI was not
crucial but nice to have.

Signed-off-by: Jan Bětík <jan.betik@svine.su>

treewide: i18n backport and sync translations

Backport translations from master.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

Merge pull request #4830 from stangri/19.07-luci-app-https-dns-proxy

luci-app-https-dns-proxy: add Force DNS, IDNet support, add missing class to buttons

luci-app-https-dns-proxy: add Force DNS, IDNet support, add missing class to buttons

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-base: ui.js: resolve parent ul early in UIDropdown.toggleItem()

The parent node of the current li might be null after collapsing the
dropdown, so resolve the parent ul early to avoid passing null to
subsequent calls.

Fixes clearing custom input values in DynamicList dropdowns.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit b8d2bcd432ab23a883de1dd4fbce29f9751a6e84)

luci-app-firewall: properly handle custom multi IP/MAC input

Store multiple space separated custom address values as separate uci
list items in the configuration.

Fixes: #4822
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit b60be8cfd82e83818013fafce00c9433e0c38376)

luci-app-ddns: fix multiple authenticated RCEs

The ddns detail model passes unsanitized values directly to sys.call() in
various places, which allows injecting arbitrary commands through a number
of fields.

Prevent that issue by quoting the values used in command invocations.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>

treewide: i18n backport and sync translations

Backport translations from master.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

Merge pull request #4795 from stangri/19.07-luci-app-simple-adblock

[19.07] luci-app-simple-adblock: bugfix: default values for ListValue

luci-app-simple-adblock: bugfix: default values for ListValue

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-base: luci.js: fix sortedKeys() ordering

Chrome does not properly sort arrays when the sort function returns boolean
results, in contrast to Firefox which does.

Fix the issue by returning a numerical result instead.

Fixes: #4792
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 3c166c25de535c5c5aeda1d40eba6c1756c412be)

Merge pull request #4766 from stangri/19.07-luci-app-https-dns-proxy

[19.07] luci-app-https-dns-proxy: add nextdns.io and quad 101 providers

luci-app-https-dns-proxy: add nextdns.io and quad 101 providers

Signed-off-by: Stan Grishin <stangri@melmac.net>

timezone data: update to 2021a

Update timezone data to 2021a.

http://mm.icann.org/pipermail/tz-announce/2021-January/000065.html

* South Sudan changes from +03 to +02

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit af1f961589e9c339a774d42682b9978eabaebcfd)

treewide: i18n - Sync and backport translations from master

Backport translations from master.
Sync.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-app-sqm: remove orphaned ACL file

Remove a backport artefact. For the openwrt-19.07 branch, luci-app-sqm
is maintained in the packages feed.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>

luci-mod-network: properly handle wireless devices when adding interfaces

Wireless device names must not be added as list/option ifname, but the
network must be backreferenced in config wifi-iface instead in these
cases.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(backported from commit 7b5b7fbcd63af14658ad234cd39c076a823e4629)

treewide: i18n - backport translations from master

Backport translations from master.
Sync.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

Merge pull request #4730 from stangri/19.07-luci-app-https-dns-proxy

[19.07] luci-app-https-dns-proxy: DSCP tagging support

luci-app-https-dns-proxy: DSCP tagging support

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci-base: correct button name on flash page help text

Correct the help text in the flash page to match the current
buttons. 'Continue' instead of "Proceed".

Adjust translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit e2ac2e92b0de9f4be78b090ad7fc62a8df222b37
 languages not existing in 19.07 removed from the commit)

timezone data: update to 2020f

Update timezone data to 2020f.

2020e: http://mm.icann.org/pipermail/tz-announce/2020-December/000063.html
       Volgograd switches to Moscow time.
       Australia/Currie removed as identical to Australia/Hobart
2020f: http://mm.icann.org/pipermail/tz-announce/2020-December/000064.html

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 9e4391e3a62dc0f7dc64720a1ca79b477099dc28)

luci-theme-rosy: Remove BROKEN theme

Remove the Rosy theme that has been marked broken in master
for over a year, and in openwrt-19.07 since March 2020.

Reference to
https://github.com/openwrt/luci/issues/3759#issuecomment-599436159

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

treewide: i18n - backport again

Backport translations again, after fixing the weblate
conflicts in master.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

treewide: i18n - backport translations

Backport translations from master.
Sync translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-app-adblock: XHTML fix

* made DNS Report page XHTML compatible

Signed-off-by: Dirk Brenken <dev@brenken.org>

luci-app-adblock: backport fixes

* fix dns backend detection in TurrisOS
* sync translations

Signed-off-by: Dirk Brenken <dev@brenken.org>

luci-mod-system: fix reference to undefined variable

Fixes: 24550446c ("luci-mod-system: fix parsing SSH pubkeys with options")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>

luci-mod-system: fix parsing SSH pubkeys with options

Also eliminate some duplicate code while we're at it.

Fixes: #4684
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(backported from commit 846b89c5bf07100f9bf1e46bcac55acab5535e26)

luci-app-noddos: remove

The 'noddos' package itself was removed with commit
https://github.com/openwrt/packages/commit/eb9d5bbf39e89909283c431ae981feac39b02d95

Remove also the corresponding LuCI app.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(backported from commit b06bc2c9ef2bd30271afe80a28197a352d15a93f)

Merge pull request #4682 from stangri/19.07-luci-app-simple-adblock

[19.07] luci-app-simple-adblock: README URL update

luci-app-simple-adblock: README URL update

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #4679 from stangri/19.07-luci-app-https-dns-proxy

[19.07] luci-app-https-dns-proxy: WebUI for dnsmasq config update, quad9 bootstrap IPv6

luci-app-https-dns-proxy: WebUI for dnsmasq config update, quad9 bootstrap IPv6

Signed-off-by: Stan Grishin <stangri@melmac.net>

luci.mk: correcting a misspell for Brazilian Portuguese

Reported-by: Wellington Uemura
* update message header
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 151787b561bce39f505d0f5753d0f80d2b796ba3)

treewide: Backport and sync translations

Backport translations from master.
Sync translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-app-firewall: map proto '*' and 'any' to all on rule config

Before the change, the options '*' and 'any' in the drop down were not
recognized as valid options, when loaded from the uci. With this change,
the options '*' and 'any' are mapped to 'all' and saved as such. This
change is especially important if the proto option is changed manually
to '*' or 'any' in shell and then further configured via LuCI.

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry picked from commit 972096bf39c932ad007fb431c81a2f5fab64649f)

luci-app-statistics: Adjust UI defaults to match config file

Adjust the defaults shown in the LuCI user interface to match
the real default values in the default config file.

(If a plugin is disabled and config values get deleted from
the config file, user has been offered incorrect default
values from UI defaults when the plugin is later re-enabled.)

* email: socket in /var/run/collectd/ dir
* ping: TTL 127
* rrdtool: 3600 sec (1hour) as shortest period, 144 RRArows
* unixsock: socket in /var/run/collectd/ dir

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(Backported and adapted from commit f7e5b56649)

luci-app-statistics: correct/tidy default config

Tidy up the current default config for statistics:

* df: use /overlay as the example mount point instead of /jffs
* openvpn: add missing section

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(backported and adapted from commit c052818ee9)

treewide: i18n - backport and sync translations

Backport translations from master.
Sync translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-app-adblock: update dns report page

* add search anchor to all listed domains on dns report page
* small wording changes & cosmetics
* update translations

Signed-off-by: Dirk Brenken <dev@brenken.org>

treewide: i18n - backport and sync translations

Backport translations from master.
Sync translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

treewide: i18n - backport and sync translations

Backport translations from master.
Sync translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-app-firewall: fix removing networks from zone

Fixes: #4608
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 4dbf600de61c0db9052343f0447ee31db79a8346)

treewide: i18n - backport and sync translations

Backport translations from master.
Sync translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-app-statistics: CPU plugin: backport defaults from master

Backport from master the current defaults based on 1cff1002.
(The part related to 'idle' state is not backported, yet)

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

rpcd-mod-luci: bump version

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit d9b4f036eae3fd13a9769b9d55435f8de883e8bb)

luci-base: tools.widgets.NetworkSelect: properly validate multi select

Fixes: 2b99473f2 ("luci-base: tools.widget.NetworkSelect: disallow invalid network names")
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 5c5b1340e5541d6283b825f7756812fc1784756f)

luci-base: tools.widget.NetworkSelect: disallow invalid network names

Fixes: #4523, #4573
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 2b99473f2cd3321ecf96e92606c3263c2941eb7b)

luci-app-aria2: fix incorrect "Extra Settings" section option name

The "Extra Settings" section `extra_setting` option name does not match what
the `net/aria2` package expects.

See:

- https://github.com/openwrt/packages/blob/openwrt-19.07/net/aria2/files/aria2.init#L311
- https://github.com/openwrt/packages/blob/openwrt-19.07/net/aria2/files/aria2.conf#L31

Causing the luci UI "Extra Settings" option to have no effect. This fix
renames `extra_setting` => `extra_settings`.

Signed-off-by: Raymond Wanyoike <raymond.wanyoike@gmail.com>
(cherry picked from commit 6709d3a355e6723b8a2ae4f5354c3e917d1b7ac8)

rpcd-mod-luci: handle lease files from all dnsmasq/odhcpd sections

Fixes: #911, #4303, #4308
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 0c7a33523027e2241d4ff93dc987c97ce233912e)

luci-app-adblock: extend the download queue scale

* see https://forum.openwrt.org/t/adblock-support-thread/507/1646 for
  details

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 0cdad3834fdd2180771a8dfb8f29f6369ce3799a)

luci-app-hd-idle: rename .po files to match app name

Rename .po(t) files from hd_idle.po to hd-idle.po
in order to get them noticed in weblate.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 74c17ea84ce55baccdc7be986216fd03865edf7d)

timezone data: update to 2020d

Update timezone data to 2020d

2020b: http://mm.icann.org/pipermail/tz-announce/2020-October/000059.html
     Macquarie Island has stayed in sync with Tasmania since 2011.
     Casey, Antarctica is at +08 in winter and +11 in summer.

2020c: http://mm.icann.org/pipermail/tz-announce/2020-October/000060.html

2020d: http://mm.icann.org/pipermail/tz-announce/2020-October/000062.html
     Palestine ends DST earlier than predicted, on 2020-10-24.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit ce3402a4530e06b1b5479e56caf9b8bb3a07dc15)

Merge pull request #4420 from etactica/mos-nlocal-only-1907

19.07: mosquitto: support notifications_local_only flag

Merge pull request #4486 from Robby-/openwrt-19.07-luci-app-firewall-packettoobig

[19.07] luci-app-firewall: rules: add ICMPv6 Packet Too Big (Type 2)

luci-app-adblock: change "refresh" action

* change "refresh" action to fix potential white-/blacklist issues

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit a392dbf888f0cdaee211eca9b58becc804ee3458)

treewide: i18n - backport and sync translations

Backport translations from master.
Sync translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-base: set the fallback default of rollback timeout to 90s

Set the fallback value of the config change rollback timeout
to 90 seconds to match the change in /etc/config/luci by commit
81cf99a50.

That commit changed the value in the config file, but did
not change the underlying fallback values that do get applied
when there is no proper config item in etc/config/luci.

Users sysupgrading from old systems may have carried an ancient
/etc/config/luci (without rollback config) with them, so this
change should help them to see the intended user experience.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit b0fe11ffc4921c606b78ceb9756cc44579689005)

treewide: i18n - backport and sync translations

Backport translations from master.
Sync translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>

luci-app-firewall: rules: add ICMPv6 Packet Too Big (Type 2)

The "Match ICMP type" drop-down menu was missing this ICMPv6 type. According to RFC 4890 section 4.3.1 it is essential for communications and must not be dropped. This patch allows for doing this through LuCI.

Signed-off-by: Robby K <robbyke@gmail.com>

treewide: i18n - backport and sync translations

Backport transations from master.
Sync translations.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>