summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* luci-mod-system: sshkeys.js: prevent XSS through pubkey commentsopenwrt-19.07Jo-Philipp Wich2022-09-211-1/+1
| | | | | | | | | Ensure to not display public key comments verbatim in order to prevent injection of markup. Reported-by: Eric McDonald <ericmcdonald@protonmail.com> Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 944b55738e7f9685865d5298248b7fbd7380749e)
* luci-app-statistics: stat-genconfig: don't emit bools for absent uci optionsJo-Philipp Wich2022-04-251-5/+5
| | | | | | | | | | | | | Do not emit native collectd.conf boolean false options if the corresponding uci option is unset in order to honour collectd's implicit defaults. This fixes certain options, such as the memory plugins `ValuesAbsolute`, being without effect if declared as default-enabled in the related plugin uci forms. Fixes: #5777 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit f16037cec5e3f65cffe2f5788c264f1912435b0e)
* treewide: Backport translations and syncHannu Nyman2022-04-0976-442/+478
| | | | | | | Backport translations from master. Sync. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* timezone data: update to 2022aHannu Nyman2022-03-241-2/+2
| | | | | | | | | | Update timezone data to 2022a. http://mm.icann.org/pipermail/tz-announce/2022-March/000070.html * Palestine will spring forward on 2022-03-27, not 2022-03-26. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi> (cherry picked from commit 15bbe6979bade530171420721ee8d99b3a1eacd9)
* treewide: Backport translations from master - i18nHannu Nyman2022-03-13103-630/+643
| | | | | | | Backport translations from master. Sync. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* luci-base: properly handle promise targets in Request.request()Jo-Philipp Wich2022-02-211-91/+93
| | | | | | | | | | | | | | | | | | | Under some circumstances, ubus RPC requests may be initiated while LuCI is still resolving the `rpcBaseURL` value. In this situation, the `target` argument of the `request()` call will be a pending promise object which results in an invalid URL when serialized by `expandURL()`, leading to an `Failed to execute 'open' on 'XMLHttpRequest': Invalid URL` exception. This commonly occured on the index status page which immediately initiates ubus RPC calls on load to discover existing status page partials. Solve the issue by filtering the given `target` argument through `Promise.resolve()` before expanding the URL and initiating the actual request. Fixes: #3747 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (backported from commit 5663fd596b567d53587fcc4052df3095520c08a7)
* treewide: Backport translations from masterHannu Nyman2022-02-14118-529/+530
| | | | | | | Backport translations. Sync. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* luci-app-openvpn: fix stray uci permission warningJo-Philipp Wich2022-01-251-11/+15
| | | | | | | | | | | | | | The OpenVPN file view uses a dummy Map() instance to render the breadcrumb template which triggers a uci permission error since the view is being rendered by a form() action which does not set up the expected permission flags. CBI Map() instances should only be used for cbi() dispatch targets. Solve the issue by appending the breadcrumb template directly to the SimpleForm() instance and by removing the redundant dummy Map() instance. Fixes: #4370 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 18b1130711b6ff7aacba98034e2bd7f4893b33df)
* treewide: Backport i18n translations from master and syncHannu Nyman2022-01-23101-2055/+2226
| | | | | | | Backport translations from master. Sync. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* luci-base: sys: prevent path traversal via sys.init routinesJo-Philipp Wich2022-01-191-0/+2
| | | | | | | | | Filter the init script name parameter through fs.basename() to avoid invoking paths outside of /etc/init.d/. Reported-by: Graham R <gr348@cam.ac.uk> Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 8752701b0d01a81d0bd0a735be733f24ad11ab69)
* luci.js: remove unsafe fallback code from dom.parse()Jo-Philipp Wich2021-12-231-11/+2
| | | | | | | Do not fallback to .innerHTML if DOMParser() failed for whatever reason. Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 63d9bcb6825fac92fd7dfa4ba858c8d5aafa23e8)
* luci-base: form.js: do not execute embedded script code in stripTags()Jo-Philipp Wich2021-12-231-1/+2
| | | | | | | | | | | Instead of relying on .innerHTML which executes embedded script code to parse a given HTML fragment, use dom.parse() which utilizies DOMParser() internally in order to extract textContent in a safe manner. Fixes: FS#4199 Ref: https://bugs.openwrt.org/index.php?do=details&task_id=4199 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 993151504e8e810c083d3257555bdcdc2f00673a)
* treewide: Backport translations from master - i18nHannu Nyman2021-12-18277-4824/+6284
| | | | | | | Backport translations. Sync. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* luci-base: cbi.js: properly handle falsy values in cbi_update_table()Jo-Philipp Wich2021-11-231-1/+1
| | | | | | Fixes: #5544 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit e982c05671229b3d13622b38c9536812e8c5f05c)
* luci-base: network.js: ignore wireless ifname patterns on retrieving devicesJo-Philipp Wich2021-11-101-1/+1
| | | | | | | | | | | | | | Only treat the given identifier as Linux netdev name if we can find a corresponding entry in the device info cache and do not consider strings starting with "wlan", "ath" or "wl" to be existing devices. This fixes incorrectly adding wireless sections as ifnames to network interfaces when the wifi-iface section name begins with one of the `iface_patterns_wireless` patterns. Fixes: #5069 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit d4092b15ce92cda2d7711b57b2251ebebef32b5c)
* timezone data: update to 2021eHannu Nyman2021-10-281-5/+5
| | | | | | | | | | | | | | | | | | Update timezone data to 2021e. http://mm.icann.org/pipermail/tz-announce/2021-September/000066.html * Jordan now starts DST on February's last Thursday. * Samoa no longer observes DST. * Rename Pacific/Enderbury to Pacific/Kanton. http://mm.icann.org/pipermail/tz-announce/2021-October/000068.html * Fiji will suspend observance of DST for the 2021/2022 season. http://mm.icann.org/pipermail/tz-announce/2021-October/000069.html * Palestine will fall back 10-29 (not 10-30) Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi> (cherry picked from commit 0740023a3c44ebfb47126b8c9bb4e9a20985aa55)
* treewide: Backport i18n translationsHannu Nyman2021-10-19118-1699/+1879
| | | | | | Backport translations. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* Merge pull request #5414 from stangri/19.07-luci-app-advanced-rebootStan Grishin2021-10-065-17/+44
|\ | | | | [19.07] luci-app-advanced-reboot: bugfix for Linksys E4200v2
| * luci-app-advanced-reboot: bugfix for Linksys E4200v2Stan Grishin2021-10-065-17/+44
|/ | | | | | | * bugfix for Linksys E4200v2 * backport updates from master Signed-off-by: Stan Grishin <stangri@melmac.net>
* luci-mod-network: allow literal "auto" value for distanceJo-Philipp Wich2021-09-281-1/+1
| | | | | | Fixes: #4050 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 01d5d5f92963d9596a3c0b669a7e8d87b64132d5)
* tree: remove erroneous luci-app-dawn ACL fileHannu Nyman2021-09-241-11/+0
| | | | | | | Remove ACL file accidentally added by ecd49247eb. There is no luci-app-dawn in 19.07, so no ACL is needed. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* treewide: i18n - Sync and backport translationsHannu Nyman2021-09-23136-889/+1035
| | | | | | | Backport translations from master. Sync translations. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* treewide: i18n - Backport and sync translationsHannu Nyman2021-09-09241-1887/+2189
| | | | | | Backport translations from master. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* luci-app-attendedsysupgrade: use detail not messagePaul Spooren2021-08-251-1/+1
| | | | | | | | The new API unifies all human readable responses in the `detail` field to follow the newly used framework. Signed-off-by: Paul Spooren <mail@aparcar.org> (cherry picked from commit 2a29911121bf72d5d316b2eeae7f184b8ce14482)
* luci-app-attendedsysupgrade: use latest.jsonPaul Spooren2021-08-251-1/+1
| | | | | | | | The content is the same response as for `/api/latest.json` but statically hosted by a webserver rather than Python generated. Signed-off-by: Paul Spooren <mail@aparcar.org> (cherry picked from commit a672875402a0802ddcd0e4c8c2d0ac7913dff671)
* luci-app-attendedsysupgrade: show position in queuePaul Spooren2021-08-251-8/+6
| | | | | | | The server provides a queue_position argument, show it. Signed-off-by: Paul Spooren <mail@aparcar.org> (cherry picked from commit 53ff7ca676d10fa253d3ab472b9b5645996527ed)
* luci-app-attendedsysupgrade: add timeout and catchPaul Spooren2021-08-251-8/+24
| | | | | | | | | | If the upgrade server API does not respond, show an error message. Fix #5222 While at it, minimal code linting Signed-off-by: Paul Spooren <mail@aparcar.org> (cherry picked from commit ff24b78c807a52a0f9afb62ba0aba1085d9ad045)
* luci-app-attendedsysupgrade: fix empty array conditionPaul Spooren2021-08-251-1/+1
| | | | | | | | | | | In JavaScript (other than in Python) an empty array is considered `true` within if statements. Fix this by checking for the array length rather than its existence. This fixes the issue of an empty dropdown menu in case the user is running the latest release. Signed-off-by: Paul Spooren <mail@aparcar.org>
* treewide: i18n - Sync and backport translationsHannu Nyman2021-08-10277-2439/+2655
| | | | | | | Sync translations. Backport translations from master. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* Merge pull request #5228 from stangri/19.07-firewallStan Grishin2021-08-0432-83/+83
|\ | | | | [19.07] luci-app-firewall: replace hh.mm.ss with hh:mm:ss
| * luci-app-firewall: replace hh.mm.ss with hh:mm:ssStan Grishin2021-08-0532-83/+83
|/ | | | Signed-off-by: Stan Grishin <stangri@melmac.net>
* Merge pull request #5218 from stangri/19.07-luci-app-https-dns-proxyStan Grishin2021-08-0318-57/+101
|\ | | | | [19.07] luci-app-https-dns-proxy: update to 2021-07-29-1
| * luci-app-https-dns-proxy: update to 2021-07-29-1Stan Grishin2021-07-3118-57/+101
|/ | | | | | | | | | * add HTTP/2-only supporting providers: Mullvad, Digitale-Gesellschaft, dns.sb and Rubyfish.cn * switch default provider from Google to Cloudflare * add IPv6 addresses for bootstrap resolvers for Google DNS * add secondary bootstrap resolver (Cloudflare's) to all providers with a single bootstrap resolver * modify model/cbi file to show HTTP/2-only providers (and help texts) on HTTP/2-supporting systems Signed-off-by: Stan Grishin <stangri@melmac.net>
* luci-mod-network: handle multiple mac for static leaseAnsuel Smith2021-07-081-4/+1
| | | | | | | | The mac section for the static lease doesn't correctly handle when multiple mac are set for a rule. Fixes: #4291 Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com> (cherry picked from commit 6c9a6c334e2fa55f4b64b64b85e0b104f0b99037)
* luci-app-attendedsysupgrade: sync with master branchPaul Spooren2021-07-0442-631/+6334
| | | | | | Upgrade the app to stay compatible with the running upgrade server. Signed-off-by: Paul Spooren <mail@aparcar.org>
* themes: Call striptags() on hostname to prevent XSSHauke Mehrtens2021-06-093-3/+3
| | | | | | | | | | | | | | | This calls striptags() on the hostname to prevent any XSS over the hostname. This should fix CVE-2021-33425 as far as I understood it. If someone adds some Javascript into system.@system[0].hostname it would have been directly added to the page, this prevents the problem. This can only be exploited by someone being able to modify the uci configuration, normally a user with such privileges could also just modify the webpage. Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de> (cherry picked from commit 5cbd79d7e31c0f0feaea2770bf102bbae7831e3c)
* treewide: i18n - Backport translations from masterHannu Nyman2021-06-08173-4086/+5575
| | | | | | Backport translations. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* luci-mod-status: fix potential XSS via specially crafted DNS namesJo-Philipp Wich2021-05-121-2/+2
| | | | | | | | | | | | When an upstream NS returns PTR domain names containing HTML, it is added verbatim to the connection status table. Prevent this issue by HTML escaping any values in the source and destination columns. Fixes: CVE-2021-32019 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 3c66c5b1651aa25afbff09bee45047da9a0ba43d)
* treewide: backport translations i18nHannu Nyman2021-05-08150-839/+889
| | | | | | Backport translations. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* treewide: i18n - Backport translationsHannu Nyman2021-04-17393-6594/+7381
| | | | | | Backport translations from master. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* luci-base: form.js: fix AbstractValue.textvalue() for uci list optionsJo-Philipp Wich2021-04-161-0/+3
| | | | | | | | | | Serialize the uci list value into a space separated string before passing it to String.format() for HTML escaping. Without that change, empty strings were returned whenever the underlying uci get operation yieled an array. Fixes: #4993 Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 5c792aefc744d1417fc9e24cfb92cd61cf8a651f)
* [19.07] luci-app-fwknopd: add support for ENABLE_CMD_EXECPtilopsis Leucotis2021-04-141-0/+3
| | | | | | Add support for execution commands on the fwknopd server. Signed-off-by: Ptilopsis Leucotis <PtilopsisLeucotis@yandex.com>
* Merge pull request #4976 from stangri/19.07-luci-app-simple-adblockStan Grishin2021-04-113-110/+118
|\ | | | | [19.07 luci-app-simple-adblock: bugfix: crash when dnsmasq.ipset selected
| * luci-app-simple-adblock: bugfix: crash when dnsmasq.ipset selectedStan Grishin2021-04-103-110/+118
|/ | | | Signed-off-by: Stan Grishin <stangri@melmac.net>
* luci-mod-system: implement system.description, system.notesHenrique de Moraes Holschuh2021-04-061-0/+7
| | | | | | | | | | | | | | | | Implement two new text "options" for UCI system config, intended to help humans describe the device. "system.description" is a short, single-line description suitable for selector UIs in remote administration applications, or remote UCI (over ubus RPC), etc. It would also be suitable as a default for LLDP/SNMP "system description". "system.notes" is a multi-line, free-form text field that can be used in any way the user wishes, e.g. to hold installation notes, or unit serial number and inventory number, location, etc. Signed-off-by: Henrique de Moraes Holschuh <henrique@nic.br>
* treewide: Backport translations and syncHannu Nyman2021-03-27202-891/+956
| | | | | | Backport from master and sync translations. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* luci-app-opkg: fix parsing empty package repository indexesJo-Philipp Wich2021-03-201-1/+1
| | | | | Signed-off-by: Jo-Philipp Wich <jo@mein.io> (cherry picked from commit 3bcbcbf0889142ca19b893f41318963b69de90ab)
* treewide: i18n backport and syncHannu Nyman2021-03-13323-7624/+16759
| | | | | | Backport translations from master and sync. Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
* Merge pull request #4908 from stangri/19.07-luci-app-vpn-policy-routingStan Grishin2021-03-121-0/+1
|\ | | | | [19.07] luci-app-vpn-policy-routing: explicit package version
| * luci-app-vpn-policy-routing: explicit package versionStan Grishin2021-03-101-0/+1
| | | | | | | | Signed-off-by: Stan Grishin <stangri@melmac.net>
generated by cgit (git 2.46.0) at 2026-10-12 00:26:26 +0000