* Console:

- Fix update buttons
   - Don't filter parameter names starting with "nofilter_"
   - Re-allow configadvanced, news URL, and unsigned update URL if routerconsole.advanced=true
   - Re-allow plugin install if routerconsole.advanced=true or routerconsole.enablePluginInstall=true
   - Only allow whitelisted plugin signers, unless routerconsole.allowUntrustedPlugins=true
   - Re-allow clients.config changes if routerconsole.advanced=true or routerconsole.enableClientChange=true
   - More escaping
 * i2psnark: Fix add torrent form

apps/routerconsole/java/src/net/i2p/router/web/CSSHelper.java

@@ -57,7 +57,8 @@ public class CSSHelper extends HelperBase {
      */
     public void setLang(String lang) {
         // Protected with nonce in css.jsi
-        if (lang != null && lang.length() > 0 && lang.length() <= 6) {
+        if (lang != null && lang.length() >= 2 && lang.length() <= 6 &&
+            lang.replaceAll("[a-zA-Z_]", "").length() == 0) {
             Map m = new HashMap(2);
             int under = lang.indexOf('_');
             if (under < 0) {