luci, branch openwrt-19.07

luci-mod-system: sshkeys.js: prevent XSS through pubkey comments

2022-09-21T12:50:02Z

Ensure to not display public key comments verbatim in order to prevent injection of markup. Reported-by: Eric McDonald Signed-off-by: Jo-Philipp Wich (cherry picked from commit 944b55738e7f9685865d5298248b7fbd7380749e)

luci-app-statistics: stat-genconfig: don't emit bools for absent uci options

2022-04-25T19:00:48Z

Do not emit native collectd.conf boolean false options if the corresponding uci option is unset in order to honour collectd's implicit defaults. This fixes certain options, such as the memory plugins `ValuesAbsolute`, being without effect if declared as default-enabled in the related plugin uci forms. Fixes: #5777 Signed-off-by: Jo-Philipp Wich (cherry picked from commit f16037cec5e3f65cffe2f5788c264f1912435b0e)

treewide: Backport translations and sync

2022-04-09T16:22:08Z

Backport translations from master. Sync. Signed-off-by: Hannu Nyman

timezone data: update to 2022a

2022-03-24T19:12:49Z

Update timezone data to 2022a. http://mm.icann.org/pipermail/tz-announce/2022-March/000070.html * Palestine will spring forward on 2022-03-27, not 2022-03-26. Signed-off-by: Hannu Nyman (cherry picked from commit 15bbe6979bade530171420721ee8d99b3a1eacd9)

treewide: Backport translations from master - i18n

2022-03-13T16:29:52Z

Backport translations from master. Sync. Signed-off-by: Hannu Nyman

luci-base: properly handle promise targets in Request.request()

2022-02-21T14:09:48Z

Under some circumstances, ubus RPC requests may be initiated while LuCI is still resolving the `rpcBaseURL` value. In this situation, the `target` argument of the `request()` call will be a pending promise object which results in an invalid URL when serialized by `expandURL()`, leading to an `Failed to execute 'open' on 'XMLHttpRequest': Invalid URL` exception. This commonly occured on the index status page which immediately initiates ubus RPC calls on load to discover existing status page partials. Solve the issue by filtering the given `target` argument through `Promise.resolve()` before expanding the URL and initiating the actual request. Fixes: #3747 Signed-off-by: Jo-Philipp Wich (backported from commit 5663fd596b567d53587fcc4052df3095520c08a7)

treewide: Backport translations from master

2022-02-14T20:32:05Z

Backport translations. Sync. Signed-off-by: Hannu Nyman

luci-app-openvpn: fix stray uci permission warning

2022-01-25T21:45:15Z

The OpenVPN file view uses a dummy Map() instance to render the breadcrumb template which triggers a uci permission error since the view is being rendered by a form() action which does not set up the expected permission flags. CBI Map() instances should only be used for cbi() dispatch targets. Solve the issue by appending the breadcrumb template directly to the SimpleForm() instance and by removing the redundant dummy Map() instance. Fixes: #4370 Signed-off-by: Jo-Philipp Wich (cherry picked from commit 18b1130711b6ff7aacba98034e2bd7f4893b33df)

treewide: Backport i18n translations from master and sync

2022-01-23T10:37:35Z

Backport translations from master. Sync. Signed-off-by: Hannu Nyman

luci-base: sys: prevent path traversal via sys.init routines

2022-01-19T15:34:21Z

Filter the init script name parameter through fs.basename() to avoid invoking paths outside of /etc/init.d/. Reported-by: Graham R Signed-off-by: Jo-Philipp Wich (cherry picked from commit 8752701b0d01a81d0bd0a735be733f24ad11ab69)