⛄ Sync 2026-10-22 00:07:59

luci-app-passwall2/Makefile

@@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=luci-app-passwall2
 PKG_VERSION:=26.10.20
-PKG_RELEASE:=148
+PKG_RELEASE:=149
 PKG_PO_VERSION:=$(PKG_VERSION)
 
 PKG_CONFIG_DEPENDS:= \

luci-app-passwall2/luasrc/passwall2/api.lua

@@ -307,6 +307,16 @@ function md5_string(str)
 	return md5
 end
 
+-- Verify the SHA256 hash of a file.
+function verify_sha256(file, digest)
+	if type(digest) ~= "string" then return false end
+	local expected = digest:match("^sha256:(%x+)$")
+	if not expected or #expected ~= 64 then return false end
+	local code, output = exec_call("sha256sum " .. util.shellquote(file))
+	local actual = output:match("^(%x+)%s")
+	return code == 0 and actual ~= nil and actual:lower() == expected:lower()
+end
+
 -- Extract the domain name and port from the URL (no IP address).
 function get_domain_port_from_url(url)
 	local scheme, domain, port = string.match(url, "^(https?)://([%w%.%-]+):?(%d*)")
@@ -328,9 +338,14 @@ function resolve_domain(domain, dns)
 	address = (address or dns):gsub("^%[(.-)%]$", "%1")
 	port = port or "53"
 	local server = datatypes.ip6addr(address) and ("[" .. address .. "]") or address
+	local dns_servers = {server .. ":" .. port, address .. "#" .. port, "223.5.5.5"}
+	local version = sys.exec("LC_ALL=C busybox nslookup -v 2>&1"):match("BusyBox v(%d+%.%d+%.%d+)")
+	if version and compare_versions(version, "<", "1.35.0") then
+		dns_servers[1], dns_servers[2] = dns_servers[2], dns_servers[1]
+	end
 	local rc, result
-	for _, dns_server in ipairs({server .. ":" .. port, address .. "#" .. port, "223.5.5.5"}) do
-		rc, result = exec_call_as_gid("LC_ALL=C nslookup " .. util.shellquote(domain) .. " " .. util.shellquote(dns_server), DIRECT_GID)
+	for _, dns_server in ipairs(dns_servers) do
+		rc, result = exec_call_as_gid("LC_ALL=C busybox nslookup " .. util.shellquote(domain) .. " " .. util.shellquote(dns_server), DIRECT_GID)
 		local ips, seen, answer = {}, {}, false
 		for line in result:gmatch("[^\r\n]+") do
 			if line:match("^%s*Name:") then answer = true end
@@ -1224,6 +1239,17 @@ local function check_path(app_name)
 	}
 end
 
+local function cache_update_digests(app_name, assets)
+	local digests = {}
+	for _, asset in ipairs(assets) do
+		if asset.browser_download_url and type(asset.digest) == "string" then
+			digests[asset.browser_download_url] = asset.digest
+		end
+	end
+	fs.mkdirr(CACHE_PATH)
+	fs.writefile(CACHE_PATH .. "/update_" .. app_name .. ".json", jsonc.stringify(digests))
+end
+
 function to_check(arch, app_name)
 	local result = check_path(app_name)
 	if result.code ~= 0 then
@@ -1288,6 +1314,7 @@ function to_check(arch, app_name)
 		}
 	end
 
+	cache_update_digests(app_name, {asset})
 	return {
 		code = 0,
 		has_update = has_update,
@@ -1308,6 +1335,12 @@ function to_download(app_name, url, size, task_id, keep_files)
 		return {code = 1, error = i18n.translate("Download url is required.")}
 	end
 
+	local digests = jsonc.parse(fs.readfile(CACHE_PATH .. "/update_" .. app_name .. ".json") or "{}")
+	local digest = type(digests) == "table" and digests[url]
+	if type(digest) ~= "string" then
+		return {code = 1, error = i18n.translate("File verification failed.")}
+	end
+
 	if not keep_files then sys.call("/bin/rm -f /tmp/".. app_name .."_download.*") end
 
 	local tmp_file
@@ -1346,6 +1379,11 @@ function to_download(app_name, url, size, task_id, keep_files)
 		}
 	end
 
+	if not verify_sha256(tmp_file, digest) then
+		exec("/bin/rm", {"-f", tmp_file})
+		return {code = 1, error = i18n.translate("File verification failed.")}
+	end
+
 	return {code = 0, file = tmp_file, zip = com[app_name].zipped }
 end
 
@@ -1586,6 +1624,9 @@ function to_check_self()
 		selected[#selected + 1] = found[code]
 	end
 	if not main then return {code = 1, error = i18n.translate("Get remote version info failed.")} end
+	local assets = {main}
+	for _, asset in ipairs(selected) do assets[#assets + 1] = asset end
+	cache_update_digests(appname, assets)
 	return {
 		code = 0, has_update = compare_versions(local_version, "<", remote_version),
 		local_version = local_version, remote_version = remote_version, html_url = release.html_url,

luci-app-passwall2/luasrc/view/passwall2/app_update/app_version.htm

@@ -86,7 +86,7 @@ local com = self.com
 		var app = btn.getAttribute('data-update-app');
 		var detailId = app === appname ? appname + '-check_btn' : '_' + app + '-check_btn';
 		var ckeckDetailElm = document.getElementById(detailId + '-detail');
-		if (app === appname && !checking) errorMessage = errorMessage ? updateFailedText : unknownErrorText;
+		if (app === appname && !checking && !errorMessage) errorMessage = unknownErrorText;
 		if (errorMessage && ckeckDetailElm) {
 			ckeckDetailElm.textContent = errorMessage
 		}

luci-app-passwall2/po/fa/passwall2.po

@@ -1549,6 +1549,9 @@ msgstr "URL دانلود الزامی است."
 msgid "File download failed or timed out: %s"
 msgstr "دانلود فایل ناموفق بود یا زمان آن تمام شد: %s"
 
+msgid "File verification failed."
+msgstr "تأیید فایل ناموفق بود."
+
 msgid "File path required."
 msgstr "مسیر فایل الزامی است."
 
@@ -2285,6 +2288,9 @@ msgstr "شروع به‌روزرسانی قوانین..."
 msgid "Download file size verification error. Original file size: %sB. Downloaded file size: %sB."
 msgstr "خطای تأیید اندازه فایل دانلود شده. اندازه فایل اصلی: %sB. اندازه فایل دانلود شده: %sB."
 
+msgid "%s SHA256 verification information is invalid. Update failed."
+msgstr "اطلاعات تأیید SHA256 برای %s نامعتبر است. به‌روزرسانی ناموفق بود."
+
 msgid "Downloaded file is empty or an error occurred while reading it."
 msgstr "فایل دانلود شده خالی است یا خطایی هنگام خواندن آن رخ داده است."
 

luci-app-passwall2/po/ru/passwall2.po

@@ -1550,6 +1550,9 @@ msgstr "Необходимо указать URL для загрузки."
 msgid "File download failed or timed out: %s"
 msgstr "Ошибка загрузки файла или тайм-аут: %s"
 
+msgid "File verification failed."
+msgstr "Ошибка проверки файла."
+
 msgid "File path required."
 msgstr "Необходимо указать путь к файлу."
 
@@ -2286,6 +2289,9 @@ msgstr "Начало обновления правил..."
 msgid "Download file size verification error. Original file size: %sB. Downloaded file size: %sB."
 msgstr "Ошибка проверки размера файла. Исходный размер: %sB, загруженный: %sB."
 
+msgid "%s SHA256 verification information is invalid. Update failed."
+msgstr "Недопустимые данные проверки SHA256 для %s. Обновление не выполнено."
+
 msgid "Downloaded file is empty or an error occurred while reading it."
 msgstr "Загруженный файл пуст или произошла ошибка при чтении."
 

luci-app-passwall2/po/zh-cn/passwall2.po

@@ -1541,6 +1541,9 @@ msgstr "请指定下载地址。"
 msgid "File download failed or timed out: %s"
 msgstr "文件下载失败或超时：%s"
 
+msgid "File verification failed."
+msgstr "文件校验失败"
+
 msgid "File path required."
 msgstr "请指定文件路径。"
 
@@ -2271,6 +2274,9 @@ msgstr "开始更新规则..."
 msgid "Download file size verification error. Original file size: %sB. Downloaded file size: %sB."
 msgstr "下载文件大小校验出错，原始文件大小 %sB，下载文件大小：%sB。"
 
+msgid "%s SHA256 verification information is invalid. Update failed."
+msgstr "%s SHA256 校验信息无效，更新失败。"
+
 msgid "Downloaded file is empty or an error occurred while reading it."
 msgstr "下载的文件为空或读取文件时发生错误。"
 

luci-app-passwall2/po/zh-tw/passwall2.po

@@ -1541,6 +1541,9 @@ msgstr "請指定下載地址。"
 msgid "File download failed or timed out: %s"
 msgstr "文件下載失敗或超時：%s"
 
+msgid "File verification failed."
+msgstr "檔案校驗失敗"
+
 msgid "File path required."
 msgstr "請指定文件路径。"
 
@@ -2277,6 +2280,9 @@ msgstr "開始更新規則..."
 msgid "Download file size verification error. Original file size: %sB. Downloaded file size: %sB."
 msgstr "下載檔案大小校驗出錯，原始檔案大小 %sB，下載檔案大小：%sB。"
 
+msgid "%s SHA256 verification information is invalid. Update failed."
+msgstr "%s SHA256 校驗資訊無效，更新失敗。"
+
 msgid "Downloaded file is empty or an error occurred while reading it."
 msgstr "下載的文件為空或讀取文件時發生錯誤。"
 

luci-app-passwall2/root/usr/share/passwall2/rule_update.lua

@@ -116,31 +116,25 @@ local function fetch_geofile(geo_name, geo_type, url)
 	local sha_url = url:gsub((down_filename:gsub("(%W)", "%%%1")), down_filename .. ".sha256sum")
 	local sha_path = tmp_path .. ".sha256sum"
 
-	local function verify_sha256(sha_file)
-		return sys.call("sha256sum -c " .. sha_file .. " > /dev/null 2>&1") == 0
-	end
-
+	local digest
 	local sha_verify, _ = curl(sha_url, sha_path) == 200
 	if sha_verify then
 		local f = io.open(sha_path, "r")
 		if f then
 			local content = f:read("*l")
 			f:close()
-			if content then
-				content = content:gsub("(%x+)%s+.+", "%1  " .. tmp_path)
-				f = io.open(sha_path, "w")
-				if f then
-					f:write(content)
-					f:close()
-				end
+			local hash = content and content:match("^(%x+)%s")
+			if hash and #hash == 64 then
+				digest = "sha256:" .. hash
 			end
 		end
-		if fs.access(asset_path) then
-			sys.call(string.format("cp -f %s %s", asset_path, tmp_path))
-			if verify_sha256(sha_path) then
-				log(1, api.i18n.translatef("%s version is the same and does not need to be updated.", geo_type))
-				return 0
-			end
+		if not digest then
+			log(1, api.i18n.translatef("%s SHA256 verification information is invalid. Update failed.", geo_type))
+			return 1
+		end
+		if fs.access(asset_path) and api.verify_sha256(asset_path, digest) then
+			log(1, api.i18n.translatef("%s version is the same and does not need to be updated.", geo_type))
+			return 0
 		end
 	end
 
@@ -156,7 +150,7 @@ local function fetch_geofile(geo_name, geo_type, url)
 	end
 	if sret_tmp == 200 then
 		if sha_verify then
-			if verify_sha256(sha_path) then
+			if api.verify_sha256(tmp_path, digest) then
 				sys.call(string.format("mkdir -p %s && mv -f %s %s", backup_path, asset_path, backup_path))
 				sys.call(string.format("mkdir -p %s && mv -f %s %s", asset_location, tmp_path, asset_path))
 				reboot = 1