Port upstream security fixes and features from ngoduykhanh/wireguard-ui

- Escape HTML in client list and wake-on-LAN names to prevent XSS
- Log successful/failed login attempts with remote address
- Fix leading-comma bug in AllowedIPs template when only extra allowed IPs are set
- Add PreUp script support for server interfaces (alongside existing PostUp/PreDown/PostDown)
- Fix endpoint parsing to support IPv6 addresses (upstream PR #223)

Cherry-picked from upstream PRs #656, #653, #680, #673, #223.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

util/util.go

@@ -21,6 +21,7 @@ import (
 	"text/template"
 	"time"
 
+	"github.com/asaskevich/govalidator"
 	"github.com/ngoduykhanh/wireguard-ui/store"
 	"github.com/ngoduykhanh/wireguard-ui/telegram"
 	"github.com/skip2/go-qrcode"
@@ -61,16 +62,9 @@ func BuildClientConfig(client model.Client, server model.Server, setting model.G
 
 	peerAllowedIPs := fmt.Sprintf("AllowedIPs = %s\n", strings.Join(client.AllowedIPs, ","))
 
-	desiredHost := setting.EndpointAddress
-	desiredPort := server.Interface.ListenPort
-	if strings.Contains(desiredHost, ":") {
-		split := strings.Split(desiredHost, ":")
-		desiredHost = split[0]
-		if n, err := strconv.Atoi(split[1]); err == nil {
-			desiredPort = n
-		} else {
-			log.Error("Endpoint appears to be incorrectly formatted: ", err)
-		}
+	desiredHost, desiredPort, err := ParseEndpoint(setting.EndpointAddress, server.Interface.ListenPort)
+	if err != nil {
+		log.Error("Endpoint appears to be incorrectly formatted: ", err)
 	}
 	peerEndpoint := fmt.Sprintf("Endpoint = %s:%d\n", desiredHost, desiredPort)
 
@@ -900,3 +894,52 @@ func GetCookiePath() string {
 	}
 	return cookiePath
 }
+
+func RemoveIPv6Brackets(host string) string {
+	ipv6 := host
+	if matchBrackets, _ := regexp.MatchString(`^\[.*\]$`, ipv6); matchBrackets {
+		ipv6 = strings.Replace(ipv6, "[", "", -1)
+		ipv6 = strings.Replace(ipv6, "]", "", -1)
+
+		// only remove brackets if valid ipv6 address
+		if govalidator.IsIPv6(ipv6) {
+			return ipv6
+		}
+	}
+	return host
+}
+
+func AddIPv6Brackets(host string) string {
+	ipv6 := host
+
+	// only add brackets if valid ipv6 address
+	if govalidator.IsIPv6(ipv6) {
+		ipv6 = "[" + ipv6 + "]"
+		return ipv6
+	}
+	return host
+}
+
+func ParseEndpoint(host string, defaultPort int) (string, int, error) {
+	port := defaultPort
+
+	// remove brackets from standalone IPv6 address
+	host = RemoveIPv6Brackets(host)
+
+	if govalidator.IsIPv4(host) || govalidator.IsIPv6(host) || govalidator.IsDNSName(host) {
+		return AddIPv6Brackets(host), port, nil
+	}
+
+	// check if specific port contained
+	host, strPort, err := net.SplitHostPort(host)
+	if err != nil {
+		return "", -1, errors.New("invalid Host")
+	}
+
+	port, err = strconv.Atoi(strPort)
+	if err != nil || port > 65535 || port < 0 {
+		return "", -1, errors.New("invalid Port")
+	}
+
+	return AddIPv6Brackets(host), port, nil
+}