From 61deed354b3efbb7918eaae8991f10232b07d164 Mon Sep 17 00:00:00 2001
From: Vincent Li <vincent.mc.li@gmail.com>
Date: Fri, 10 Oct 2025 19:43:09 +0000
Subject: [PATCH] time.cgi: Fixes bug 13883

commit 8025aa78fb52933666e13a7e9e782edf4ddf8b42
Author: Adolf Belka <adolf.belka@ipfire.org>
Date:   Thu Sep 25 13:12:43 2025 +0200

    time.cgi: Fixes bug 13883

    Fixes: bug 13883 - time.cgi UPDATE_VALUE Stored Cross-Site Scripting
    Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
    Reviewed-by: Bernhard Bitsch <bbitsch@ipfire.org>
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

commit f561899b54d6abd81430dd26a83679d49bc3fae7
Author: Jon Murphy <jon.murphy@ipfire.org>
Date:   Mon Mar 11 18:45:00 2024 -0500

    time.cgi: add current date-time to this WebGUI page

    - added words and date-time format to english (en.pl)
    - other languages are needed
    - seconds included since time is accurate to < .1s
    https://git.ipfire.org/?p=ipfire-2.x.git;a=commit;h=2234e8aacac2e0d0b06dac4513585c15c2b3b440

    Code-by: Leo-Andres Hofmann <hofmann@leo-andres.de>
    Signed-off-by: Jon Murphy <jon.murphy@ipfire.org>
    Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Signed-off-by: Vincent Li <vincent.mc.li@gmail.com>
---
 html/cgi-bin/time.cgi  | 7 ++++++-
 langs/en/cgi-bin/en.pl | 2 ++
 langs/zh/cgi-bin/zh.pl | 2 ++
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/html/cgi-bin/time.cgi b/html/cgi-bin/time.cgi
index 57a02a4b6..d465354bb 100644
--- a/html/cgi-bin/time.cgi
+++ b/html/cgi-bin/time.cgi
@@ -2,7 +2,7 @@
 ###############################################################################
 #                                                                             #
 # IPFire.org - A linux based firewall                                         #
-# Copyright (C) 2010  IPFire Team                                             #
+# Copyright (C) 2010-2025  IPFire Team  <info@ipfire.org>                     #
 #                                                                             #
 # This program is free software: you can redistribute it and/or modify        #
 # it under the terms of the GNU General Public License as published by        #
@@ -78,6 +78,7 @@ if ($timesettings{'ACTION'} eq $Lang::tr{'save'})
 	if (!($timesettings{'UPDATE_VALUE'} =~ /^\d+$/) || $timesettings{'UPDATE_VALUE'} <= 0)
 	{
 		$errormessage = $Lang::tr{'invalid time period'};
+		$timesettings{'UPDATE_VALUE'} = 0;
 		goto ERROR;
 	}
 
@@ -287,6 +288,10 @@ print <<END
 </table>
 END
 ;
+
+my $now = strftime($Lang::tr{'timeformat'}, localtime);
+print "<hr>$Lang::tr{'system time'}: $now";
+
 &Header::closebox();
 &Header::openbox('100%',1,$Lang::tr{'ntp sync'});
 print <<END
diff --git a/langs/en/cgi-bin/en.pl b/langs/en/cgi-bin/en.pl
index 65d0373b2..c61237f81 100644
--- a/langs/en/cgi-bin/en.pl
+++ b/langs/en/cgi-bin/en.pl
@@ -2580,6 +2580,7 @@
 'system log viewer' => 'System Log Viewer',
 'system logs' => 'System Logs',
 'system status information' => 'System Status Information',
+'system time' => 'System time (as of last page load)',
 'ta key' => 'TLS-Authentification-Key',
 'taa zombieload2' => 'TSX Async Abort/ZombieLoad v2',
 'tcp more reliable' => 'TCP (more reliable)',
@@ -2608,6 +2609,7 @@
 'time' => 'Time',
 'time date manually reset' => 'Time/Date manually reset.',
 'time server' => 'Time Server',
+'timeformat' => '%Y-%m-%d at %H:%M:%S %Z',
 'timeout must be a number' => 'Timeout must be a number.',
 'title' => 'Title',
 'to' => 'To',
diff --git a/langs/zh/cgi-bin/zh.pl b/langs/zh/cgi-bin/zh.pl
index 424b7a6de..d08043d61 100644
--- a/langs/zh/cgi-bin/zh.pl
+++ b/langs/zh/cgi-bin/zh.pl
@@ -2529,6 +2529,7 @@
 'system log viewer' => '系统日志查看器',
 'system logs' => '系统日志',
 'system status information' => '系统状态信息',
+'system time' => '系统时间(自上次页面刷新)',
 'ta key' => 'TLS认证密钥',
 'taa zombieload2' => 'TSX Async中上/ZombieLoad v2',
 'tcp more reliable' => 'TCP(更可靠)',
@@ -2557,6 +2558,7 @@
 'time' => '时间',
 'time date manually reset' => '时间/日期手动重置。',
 'time server' => 'NTP服务',
+'timeformat' => '%Y-%m-%d at %H:%M:%S %Z',
 'timeout must be a number' => '超时必须为数字。',
 'title' => '标题',
 'to' => '到',