mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote branch 'upstream/master'

Browse Source 
Conflicts:
	etc/inc/filter.inc
	etc/inc/system.inc
	usr/local/www/interfaces.php
	usr/local/www/interfaces_gif_edit.php
This commit is contained in:
Seth Mos 2010-11-15 12:46:58 +01:00
commit 172007f50c
136 changed files with 1582 additions and 649 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
etc/inc/IPv6.inc
View File

@ -919,4 +919,4 @@ class Net_IPv6 {
* End:
*/
?>
?>

1
etc/inc/PEAR.inc
View File

@ -1056,4 +1056,5 @@ class PEAR_Error
* c-basic-offset: 4
* End:
*/
?>

30
etc/inc/auth.inc
View File

@ -86,6 +86,32 @@ if (function_exists("display_error_form") && !isset($config['system']['webgui'][
}
}
// If the HTTP_REFERER is something other than ourselves then disallow.
if(function_exists("display_error_form") && !$config['system']['nohttpreferercheck']) {
if($_SERVER['HTTP_REFERER']) {
$found_host = false;
$hostname_me = $config['system']['hostname'] . "." . $config['system']['domain'];
if(stristr($_SERVER['HTTP_REFERER'], $hostname_me))
$found_host = true;
if(!empty($config['system']['webgui']['althostnames'])) {
$althosts = explode(" ", $config['system']['webgui']['althostnames']);
foreach ($althosts as $ah)
if(stristr($ah, $hostname_me))
$found_host = true;
}
$interface_list_ips = get_configured_ip_addresses();
foreach($interface_list_ips as $ilips) {
$hostname_me_ip = $config['webgui']['protocol'] . "://" . $ilips;
if(stristr($_SERVER['HTTP_REFERER'],$hostname_me_ip))
$found_host = true;
}
if($found_host == false) {
display_error_form("501", "An HTTP_REFERER was detected other than what is defined in System -> Advanced (" . htmlspecialchars($_SERVER['HTTP_REFERER']) . "). You can disable this check if needed in System -> Advanced -> Admin.");
exit;
}
}
}
$groupindex = index_groups();
$userindex = index_users();
@ -449,6 +475,7 @@ function local_user_set_groups($user, $new_groups = NULL ) {
$group['member'][] = $user['uid'];
$mod_groups[] = $group;
}
unset($group);
/* determine which memberships to remove */
foreach ($cur_groups as $groupname) {
@ -463,6 +490,7 @@ function local_user_set_groups($user, $new_groups = NULL ) {
$mod_groups[] = $group;
}
}
unset($group);
/* sync all modified groups */
foreach ($mod_groups as $group)
@ -1244,4 +1272,4 @@ function session_auth() {
return true;
}
?>
?>

2
etc/inc/certs.inc
View File

@ -556,4 +556,4 @@ function is_crl_internal($crl) {
return !(!empty($crl['text']) && empty($crl['cert']));
}
?>
?>

2
etc/inc/config.lib.inc
View File

@ -803,4 +803,4 @@ function set_device_perms() {
}
}
?>
?>

2
etc/inc/dyndns.class
View File

@ -921,4 +921,4 @@
}
?>
?>

3
etc/inc/easyrule.inc
View File

@ -329,4 +329,5 @@ function easyrule_parse_pass($int, $proto, $src, $dst, $dstport = 0) {
}
return "Unknown pass error.";
}
?>
?>

212
etc/inc/filter.inc
View File

@ -5,7 +5,7 @@
Copyright (C) 2004-2006 Scott Ullrich
Copyright (C) 2005 Bill Marquette
Copyright (C) 2006 Peter Allgeyer
Copyright (C) 2008 Ermal Luci
Copyright (C) 2008-2010 Ermal Luci
All rights reserved.
originally part of m0n0wall (http://m0n0.ch/wall)
@ -126,9 +126,9 @@ function filter_pflog_start() {
echo "filter_pflog_start() being called $mt\n";
}
mute_kernel_msgs();
$pid = 0;
$pid = `/bin/pgrep -f "tcpdump -s 256 -v -l -n -e -ttt -i pflog0"`;
if(!$pid)
$output = 0;
exec("/bin/pgrep -f 'tcpdump -s 256 -v -l -n -e -ttt -i pflog0'", $output, $retval);
if($retval != 0)
mwexec_bg("/usr/sbin/tcpdump -s 256 -v -l -n -e -ttt -i pflog0 | logger -t pf -p local0.info");
unmute_kernel_msgs();
}
@ -887,7 +887,7 @@ function filter_generate_reflection_nat($rule, $nat_ifs, $protocol, $target, $ta
return $natrules;
}
function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_port, $dstport, &$starting_localhost_port, &$reflection_txt) {
function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_port, &$starting_localhost_port, &$reflection_txt) {
global $FilterIflist, $config;
// Initialize natrules holder string
@ -908,16 +908,43 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_
$natrules .= "\n# Reflection redirects\n";
if($dstport[1])
$range_end = ($dstport[1]);
else
$range_end = ($dstport[0]);
$localport = $rule['local-port'];
if(!empty($localport) && is_alias($localport)) {
$localport = filter_expand_alias($localport);
$localport = explode(" ", trim($localport));
// The translation port for rdr, when specified, does not support more than one port or range.
// Emulating for behavior consistent with the original port forward.
$localport = $localport[0];
}
if(is_alias($rule['destination']['port'])) {
if(empty($localport) || $rule['destination']['port'] == $rule['local-port']) {
$dstport = filter_expand_alias($rule['destination']['port']);
$dstport = array_filter(explode(" ", trim($dstport)));
$localport = "";
} else if(!empty($localport)) {
$dstport = array($localport);
}
} else {
$dstport = array(str_replace("-", ":", $rule['destination']['port']));
$dstport_split = explode(":", $dstport[0]);
if(!empty($localport) && $dstport_split[0] != $rule['local-port']) {
if(!is_alias($rule['local-port']) && $dstport_split[1] && $dstport_split[0] != $dstport_split[1]) {
$localendport = $localport + ($dstport_split[1] - $dstport_split[0]);
$localport .= ":$localendport";
}
$dstport = array($localport);
} else
$localport = "";
}
$dstaddr = explode(" ", $dstaddr_port);
if($dstaddr[2])
$rflctintrange = $dstaddr[2];
else
$rflctintrange = "";
return "";
$dstaddr = $dstaddr[0];
if(empty($dstaddr) || trim($dstaddr) == "0.0.0.0" || strtolower(trim($dstaddr)) == "port")
return "";
@ -968,67 +995,77 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_
else
return "";
if($rule['local-port'])
$lrange_start = $rule['local-port'];
if(($range_end + 1) - $dstport[0] > 500) {
log_error("Not installing nat reflection rules for a port range > 500");
$starting_localhost_port_tmp = $starting_localhost_port;
$toomanyports = false;
/* only install reflection rules for < 19991 items */
} else if($starting_localhost_port < 19991) {
$loc_pt = $lrange_start;
$rflctnorange = true;
if(is_alias($loc_pt)) {
$loc_pt_translated = filter_expand_alias($loc_pt);
if(empty($loc_pt_translated)) {
log_error("Reflection processing: {$loc_pt} is not a vaild port alias.");
continue;
}
$toadd_array = split(" ", $loc_pt_translated);
$rflctnorange = false;
}
$inetdport = $starting_localhost_port;
if($range_end > $dstport[0]) {
$rflctrange = "{$starting_localhost_port}";
$delta = $range_end - $dstport[0];
if(($starting_localhost_port + $delta) > 19990) {
log_error("Installing partial nat reflection rules. Maximum 1,000 reached.");
$delta = 19990 - $starting_localhost_port;
$range_end = $dstport[0] + $delta;
$rflctintrange = "";
}
$starting_localhost_port = $starting_localhost_port + $delta;
$rflctrange .= ":{$starting_localhost_port}";
if(empty($rflctintrange))
$rflctintrange = "{$dstport[0]}:{$range_end}";
if($rflctnorange)
$toadd_array = range($loc_pt, $loc_pt + $delta);
$starting_localhost_port++;
} else {
foreach($dstport as $loc_pt) {
if($starting_localhost_port < 19991) {
$toadd_array = array();
$inetdport = $starting_localhost_port;
$rflctrange = $starting_localhost_port;
if(empty($rflctintrange))
$rflctintrange = $dstport[0];
if($rflctnorange)
$toadd_array = array($loc_pt);
$starting_localhost_port++;
$loc_pt = explode(":", $loc_pt);
if($loc_pt[1] && $loc_pt[1] > $loc_pt[0])
$delta = $loc_pt[1] - $loc_pt[0];
else
$delta = 0;
if(($inetdport + $delta + 1) - $starting_localhost_port_tmp > 500) {
log_error("Not installing nat reflection rules for a port range > 500");
$inetdport = $starting_localhost_port;
$toadd_array = array();
$toomanyports = true;
break;
} else if(($inetdport + $delta) > 19990) {
log_error("Installing partial nat reflection rules. Maximum 1,000 reached.");
$delta = 19990 - $inetdport;
$loc_pt[1] = $loc_pt[0] + $delta;
if($delta == 0)
unset($loc_pt[1]);
$toomanyports = true;
if(!empty($localport)) {
if(is_alias($rule['destination']['port'])) {
$rflctintrange = alias_expand($rule['destination']['port']);
} else {
if($dstport_split[1])
$dstport_split[1] = $dstport_split[0] + $inetdport + $delta - $starting_localhost_port;
$rflctintrange = implode(":", $dstport_split);
}
}
}
if(empty($localport))
$rflctintrange = implode(":", $loc_pt);
if($inetdport + $delta > $starting_localhost_port)
$rflctrange .= ":" . ($inetdport + $delta);
$starting_localhost_port = $inetdport + $delta + 1;
$toadd_array = array_merge($toadd_array, range($loc_pt[0], $loc_pt[0] + $delta));
if(!empty($toadd_array)) {
foreach($toadd_array as $tda) {
if (empty($tda))
continue;
foreach($reflect_protos as $reflect_proto) {
if($reflect_proto == "udp") {
$socktype = "dgram";
$dash_u = "-u ";
} else {
$socktype = "stream";
$dash_u = "";
}
$reflection_txt[] = "{$inetdport}\t{$socktype}\t{$reflect_proto}\tnowait/0\tnobody\t/usr/bin/nc\tnc {$dash_u}-w {$reflectiontimeout} {$target} {$tda}\n";
}
$inetdport++;
}
$natrules .= "rdr on {$rdr_if_list} proto {$protocol} from {$srcaddr} to {$dstaddr} port {$rflctintrange} tag PFREFLECT -> 127.0.0.1 port {$rflctrange}\n";
}
}
foreach($toadd_array as $tda) {
if (empty($tda))
continue;
foreach($reflect_protos as $reflect_proto) {
if($reflect_proto == "udp") {
$socktype = "dgram";
$dash_u = "-u ";
} else {
$socktype = "stream";
$dash_u = "";
}
$reflection_txt[] = "{$inetdport}\t{$socktype}\t{$reflect_proto}\tnowait/0\tnobody\t/usr/bin/nc\tnc {$dash_u}-w {$reflectiontimeout} {$target} {$tda}\n";
}
$inetdport++;
}
$natrules .= "rdr on {$rdr_if_list} proto {$protocol} from {$srcaddr} to {$dstaddr} port {$rflctintrange} tag PFREFLECT -> 127.0.0.1 port {$rflctrange}\n";
if($toomanyports)
break;
}
$reflection_txt = array_unique($reflection_txt);
}
@ -1447,7 +1484,7 @@ function filter_nat_rules_generate() {
$natrules .= "no nat on {$natif} proto tcp from ({$natif}) to {$rule_subnet}/{$rule_interface_subnet}\n";
$natrules .= "nat on {$natif} proto tcp from {$rule_subnet}/{$rule_interface_subnet} to {$target} port {$dstport[0]} -> ({$natif})\n";
}
$natrules .= filter_generate_reflection($rule, $nordr, $nat_if_list, $srcaddr, $dstaddr, $dstport, $starting_localhost_port, $reflection_rules);
$natrules .= filter_generate_reflection($rule, $nordr, $nat_if_list, $srcaddr, $dstaddr, $starting_localhost_port, $reflection_rules);
$natrules .= "\n";
foreach ($reflection_rules as $txtline)
@ -1652,22 +1689,23 @@ function filter_generate_user_rule($rule) {
$pptpdcfg = $config['pptpd'];
$pppoecfg = $config['pppoe'];
$int = "";
$aline = array();
/* Check to see if the interface is in our list */
if(isset($rule['floating'])) {
if(isset($rule['interface']) && $rule['interface'] <> "") {
$interfaces = explode(",", $rule['interface']);
$ifliste = "";
foreach ($interfaces as $iface) {
if(array_key_exists($iface, $FilterIflist))
$ifliste .= " " . $FilterIflist[$iface]['if'] . " ";
}
if($ifliste <> "")
$aline['interface'] = " on { {$ifliste} }";
else
$aline['interface'] = "";
if(isset($rule['interface']) && $rule['interface'] <> "") {
$interfaces = explode(",", $rule['interface']);
$ifliste = "";
foreach ($interfaces as $iface) {
if(array_key_exists($iface, $FilterIflist))
$ifliste .= " " . $FilterIflist[$iface]['if'] . " ";
}
if($ifliste <> "")
$aline['interface'] = " on { {$ifliste} } ";
else
$aline['interface'] = "";
} else
$aline['interface'] = "";
} else if(!array_key_exists($rule['interface'], $FilterIflist)) {
foreach($FilterIflist as $oc) $item .= $oc['descr'];
return "# {$item} {$rule['interface']} array key does not exist for " . $rule['descr'];
@ -1726,7 +1764,7 @@ function filter_generate_user_rule($rule) {
update_filter_reload_status("Setting up pass/block rules {$rule['descr']}");
/* do not process reply-to for gateway'd rules */
if($rule['gateway'] == "" && interface_has_gateway($rule['interface']) && !isset($rule['disablereplyto'])) {
if($rule['gateway'] == "" && $aline['direction'] <> "" && interface_has_gateway($rule['interface']) && !isset($rule['disablereplyto'])) {
if($rule['ipprotocol'] == "inet6") {
$rg = get_interface_gateway_v6($rule['interface']);
if(is_ipaddrv6($rg)) {
@ -2246,6 +2284,17 @@ pass out on \$IPsec all keep state label "IPsec internal host to host"
EOD;
if(!isset($config['system']['webgui']['noantilockout'])) {
$portarg = 80;
if (isset($config['system']['webgui']['port']) && $config['system']['webgui']['port'] <> "")
$portarg = "{$config['system']['webgui']['port']}";
if ($config['system']['webgui']['protocol'] == "https")
$portarg .= " 443 ";
$sshport = "";
if (isset($config['system']['enablesshd'])) {
$sshport = 22;
if($config['system']['ssh']['port'] <> "")
$sshport = $config['system']['ssh']['port'];
}
if(count($config['interfaces']) > 1 && !empty($FilterIflist['lan']['if'])) {
/* if antilockout is enabled, LAN exists and has
* an IP and subnet mask assigned
@ -2254,7 +2303,7 @@ EOD;
$ipfrules .= <<<EOD
# make sure the user cannot lock himself out of the webConfigurator or SSH
anchor "anti-lockout"
pass in quick on {$lanif} from any to ({$lanif}) keep state label "anti-lockout rule"
pass in quick on {$lanif} proto tcp from any to ({$lanif}) port { $portarg $sshport } keep state label "anti-lockout rule"
EOD;
} else if (count($config['interfaces']) == 1) {
@ -2263,7 +2312,7 @@ EOD;
$ipfrules .= <<<EOD
# make sure the user cannot lock himself out of the webConfigurator or SSH
anchor "anti-lockout"
pass in quick on {$wanif} from any to ({$wanif}) keep state label "anti-lockout rule"
pass in quick on {$wanif} proto tcp from any to ({$wanif}) port { $portarg $sshport } keep state label "anti-lockout rule"
EOD;
}
@ -2838,4 +2887,5 @@ function discover_pkg_rules($ruletype) {
}
// vim: ts=4 sw=4 noexpandtab
?>

3
etc/inc/globals.inc
View File

@ -165,4 +165,5 @@ $sysctls = array("net.inet.ip.portrange.first" => "1024",
);
$config_inc_loaded = false;
?>
?>

2
etc/inc/growl.class
View File

@ -99,4 +99,4 @@
}
}
?>
?>

22
etc/inc/interfaces.inc
View File

@ -3364,9 +3364,6 @@ function get_interfaces_with_gateway() {
/* loop interfaces, check config for outbound */
foreach($config['interfaces'] as $ifdescr => $ifname) {
if (substr($ifdescr, 0, 5) == "ovpnc")
return true;
switch ($ifname['ipaddr']) {
case "dhcp":
case "carpdev-dhcp":
@ -3378,7 +3375,8 @@ function get_interfaces_with_gateway() {
$ints[$ifdescr] = $ifdescr;
break;
default:
if (!empty($ifname['gateway']))
if (substr($ifname['if'], 0, 5) == "ovpnc" ||
!empty($ifname['gateway']))
$ints[$ifdescr] = $ifdescr;
break;
}
@ -3391,8 +3389,6 @@ function interface_has_gateway($friendly) {
global $config;
if (!empty($config['interfaces'][$friendly])) {
if (substr($friendly, 0, 5) == "ovpnc")
return true;
$ifname = &$config['interfaces'][$friendly];
switch ($ifname['ipaddr']) {
case "dhcp":
@ -3404,6 +3400,8 @@ function interface_has_gateway($friendly) {
return true;
break;
default:
if (substr($ifname['if'], 0, 5) == "ovpnc")
return true;
if (!empty($ifname['gateway']))
return true;
break;
@ -3439,9 +3437,9 @@ function is_altq_capable($int) {
if (in_array($int_family[0], $capable))
return true;
else if (stristr($int_family, "vlan")) /* VLANs are name $parent_$vlan now */
else if (stristr($int, "vlan")) /* VLANs are name $parent_$vlan now */
return true;
else if (stristr($int_family, "_wlan")) /* WLANs are name $parent_$wlan now */
else if (stristr($int, "_wlan")) /* WLANs are name $parent_$wlan now */
return true;
else
return false;
@ -3594,7 +3592,13 @@ function setup_pppoe_reset_file($pppif, $iface="") {
$cron_file = "{$g['varetc_path']}/pppoe_restart_{$pppif}";
if(!empty($iface) && !empty($pppif)){
$cron_cmd = "#!/bin/sh\necho '<?php require(\"config.inc\"); require(\"interfaces.inc\"); interface_reconfigure({$iface}); log_error(\"PPPoE periodic reset executed on {$iface}\"); ?>' | /usr/local/bin/php -q";
$cron_cmd = <<<EOD
#!/bin/sh
/usr/local/sbin/pfSctl -c 'interface reload {$iface}'
/usr/bin/logger -t pppoe{$iface} "PPPoE periodic reset executed on {$iface}"
EOD;
file_put_contents($cron_file, $cron_cmd);
chmod($cron_file, 0700);
sigkillbypid("{$g['varrun_path']}/cron.pid", "HUP");

2
etc/inc/ipsec.inc
View File

@ -463,4 +463,4 @@ function ipsec_mobilekey_sort() {
usort($config['ipsec']['mobilekey'], "mobilekeycmp");
}
?>
?>

2
etc/inc/itemid.inc
View File

@ -103,4 +103,4 @@ function get_unique_id(){
return uniqid("nat_", true);
}
?>
?>

1
etc/inc/led.inc
View File

@ -350,4 +350,5 @@ function char_to_morse($char) {
break;
}
}
?>

2
etc/inc/meta.inc
View File

@ -197,4 +197,4 @@ function read_file_metadata($fpath, & $metadata, $taglist = false) {
$metadata[$fname] = $tags;
}
?>
?>

2
etc/inc/notices.inc
View File

@ -379,4 +379,4 @@ function register_via_growl() {
}
}
?>
?>

2
etc/inc/openvpn.auth-user.php
View File

@ -121,4 +121,4 @@ syslog(LOG_WARNING, "user {$username} authenticated\n");
exit(0);
?>
?>

2
etc/inc/openvpn.inc
View File

@ -935,4 +935,4 @@ function openvpn_refresh_crls() {
}
}
?>
?>

41
etc/inc/pfsense-utils.inc
View File

@ -149,22 +149,13 @@ function get_tmp_file() {
******/
function get_dns_servers() {
$dns_servers = array();
$dns = `cat /etc/resolv.conf`;
$dns_s = split("\n", $dns);
$dns_s = file("/etc/resolv.conf", FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
foreach($dns_s as $dns) {
$matches = "";
if (preg_match("/nameserver (.*)/", $dns, $matches))
$dns_servers[] = $matches[1];
}
$dns_server_master = array();
$lastseen = "";
foreach($dns_servers as $t) {
if($t <> $lastseen)
if($t <> "")
$dns_server_master[] = $t;
$lastseen = $t;
}
return $dns_server_master;
return array_unique($dns_servers);
}
/****f* pfsense-utils/enable_hardware_offloading
@ -2131,4 +2122,32 @@ function get_country_name($country_code) {
return "";
}
/* sort by interface only, retain the original order of rules that apply to
the same interface */
function filter_rules_sort() {
global $config;
/* mark each rule with the sequence number (to retain the order while sorting) */
for ($i = 0; isset($config['filter']['rule'][$i]); $i++)
$config['filter']['rule'][$i]['seq'] = $i;
usort($config['filter']['rule'], "filter_rules_compare");
/* strip the sequence numbers again */
for ($i = 0; isset($config['filter']['rule'][$i]); $i++)
unset($config['filter']['rule'][$i]['seq']);
}
function filter_rules_compare($a, $b) {
if (isset($a['floating']) && isset($b['floating']))
return $a['seq'] - $b['seq'];
else if (isset($a['floating']))
return -1;
else if (isset($b['floating']))
return 1;
else if ($a['interface'] == $b['interface'])
return $a['seq'] - $b['seq'];
else
return compare_interface_friendly_names($a['interface'], $b['interface']);
}
?>

6
etc/inc/pkg-utils.inc
View File

@ -200,7 +200,7 @@ function resync_all_package_configs($show_message = false) {
}
}
if($show_message == true)
echo "done.\n";
echo " done.\n";
@unlink("/conf/needs_package_sync");
}
@ -953,7 +953,7 @@ function delete_package_xml($pkg) {
update_output_window($static_output);
}
if($pkg_config['include_file'] <> "") {
$static_output = "\tRemoving pacakge instructions...";
$static_output = "\tRemoving package instructions...";
update_output_window($static_output);
fwrite($fd_log, "Remove '{$pkg_config['include_file']}'\n");
unlink_if_exists("/usr/local/pkg/" . $pkg_config['include_file']);
@ -1078,4 +1078,4 @@ function squash_from_bytes($size, $round = "") {
return;
}
?>
?>

2
etc/inc/priv.defs.inc
View File

@ -1164,4 +1164,4 @@ $priv_list['page-firewall-schedules-edit']['match'][] = "firewall_schedule_edit.
$priv_rmvd = array();
?>
?>

2
etc/inc/priv.inc
View File

@ -285,4 +285,4 @@ function getAllowedPages($username) {
return $allowed_pages;
}
?>
?>

2
etc/inc/radius.inc
View File

@ -1126,4 +1126,4 @@ class Auth_RADIUS_Acct_Update extends Auth_RADIUS_Acct
var $status_type = RADIUS_UPDATE;
}
?>
?>

2
etc/inc/rrd.inc
View File

@ -695,4 +695,4 @@ function kill_traffic_collector() {
mwexec("/bin/pkill -f updaterrd.sh", true);
}
?>
?>

2
etc/inc/service-utils.inc
View File

@ -207,4 +207,4 @@ function is_service_running($service, $ps = "") {
return false;
}
?>
?>

26
etc/inc/services.inc
View File

@ -207,7 +207,11 @@ function services_dhcpd_configure() {
foreach ($dhcpdcfg as $dhcpif => $dhcpifconf) {
if(is_array($dhcpifconf['numberoptions']) && is_array($dhcpifconf['numberoptions']['item'])) {
foreach($dhcpifconf['numberoptions']['item'] as $itemidx => $item) {
$custoptions .= "option custom-{$dhcpif}-{$itemidx} code {$item['number']} = text;\n";
if(!empty($item['type']))
$itemtype = $item['type'];
else
$itemtype = "text";
$custoptions .= "option custom-{$dhcpif}-{$itemidx} code {$item['number']} = {$itemtype};\n";
}
}
}
@ -487,7 +491,10 @@ EOD;
$dhcpdconf .= "\n";
if($dhcpifconf['numberoptions']['item']) {
foreach($dhcpifconf['numberoptions']['item'] as $itemidx => $item) {
$dhcpdconf .= " option custom-{$dhcpif}-{$itemidx} \"{$item['value']}\";\n";
if(empty($item['type']) || $item['type'] == "text")
$dhcpdconf .= " option custom-{$dhcpif}-{$itemidx} \"{$item['value']}\";\n";
else
$dhcpdconf .= " option custom-{$dhcpif}-{$itemidx} {$item['value']};\n";
}
}
@ -1049,6 +1056,7 @@ function services_snmpd_configure() {
/* kill any running snmpd */
sigkillbypid("{$g['varrun_path']}/snmpd.pid", "TERM");
sleep(2);
if(is_process_running("bsnmpd"))
mwexec("/usr/bin/killall bsnmpd", true);
@ -1586,19 +1594,19 @@ EODAD;
/* configure cron service */
function configure_cron() {
global $g, $config;
conf_mount_rw();
/* preserve existing crontab entries */
$crontab_contents = file_get_contents("/etc/crontab");
$crontab_contents_a = split("\n", $crontab_contents);
$crontab_contents = file("/etc/crontab", FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
for ($i = 0; $i < count($crontab_contents_a); $i++) {
$item =& $crontab_contents_a[$i];
if (strpos($item, "# pfSense specific crontab entries") !== false) {
array_splice($crontab_contents_a, $i - 1);
for ($i = 0; $i < count($crontab_contents); $i++) {
$cron_item =& $crontab_contents[$i];
if (strpos($cron_item, "# pfSense specific crontab entries") !== false) {
array_splice($crontab_contents, $i - 1);
break;
}
}
$crontab_contents = implode("\n", $crontab_contents_a) . "\n";
$crontab_contents = implode("\n", $crontab_contents) . "\n";
if (is_array($config['cron']['item'])) {

4
etc/inc/shaper.inc
View File

@ -3785,7 +3785,7 @@ function &get_unique_queue_list() {
$qlist = array();
if (is_array($altq_list_queues)) {
foreach ($altq_list_queues as $altq) {
if ($altq->GetEnabled())
if ($altq->GetEnabled() == "")
continue;
$tmplist =& $altq->get_queue_list();
foreach ($tmplist as $qname => $link) {
@ -4006,4 +4006,4 @@ $dn_default_shaper_msg .= "</td></tr>";
?>
?>

23
etc/inc/system.inc
View File

@ -210,13 +210,7 @@ function system_hosts_generate() {
}
$hostscfg = $dnsmasqcfg['hosts'];
$fd = fopen("{$g['varetc_path']}/hosts", "w");
if (!$fd) {
log_error("Error: cannot open hosts file in system_hosts_generate().\n");
return 1;
}
$hosts .= "127.0.0.1 localhost localhost.{$syscfg['domain']}\n";
$hosts = "127.0.0.1 localhost localhost.{$syscfg['domain']}\n";
if ($config['interfaces']['lan']) {
$cfgip = get_interface_ip("lan");
@ -248,6 +242,20 @@ function system_hosts_generate() {
if ($host['ipaddr'] && $host['hostname'])
$hosts .= "{$host['ipaddr']} {$host['hostname']}.{$syscfg['domain']} {$host['hostname']}\n";
}
/*
* Do not remove this because dhcpleases monitors with kqueue it needs to be
* killed before writing to hosts files.
*/
if (file_exists("{$g['varrun_path']}/dhcpleases.pid")) {
sigkillbypid("{$g['varrun_path']}/dhcpleases.pid", "TERM");
@unlink("{$g['varrun_path']}/dhcpleases.pid");
}
$fd = fopen("{$g['varetc_path']}/hosts", "w");
if (!$fd) {
log_error("Error: cannot open hosts file in system_hosts_generate().\n");
return 1;
}
fwrite($fd, $hosts);
fclose($fd);
@ -1091,7 +1099,6 @@ EOD;
$lighty_config .= <<<EOD
## error-handler for status 404
#server.error-handler-404 = "/error-handler.html"
#server.error-handler-404 = "/error-handler.php"

3
etc/inc/upgrade_config.inc
View File

@ -2272,4 +2272,5 @@ function upgrade_074_to_075() {
if (is_array($config['crl']))
rename_field($config['crl'], 'name', 'descr');
}
?>
?>

31
etc/inc/util.inc
View File

@ -633,6 +633,22 @@ function get_configured_ip_aliases_list() {
}
/* comparison function for sorting by the order in which interfaces are normally created */
function compare_interface_friendly_names($a, $b) {
if ($a == $b)
return 0;
else if ($a == 'wan')
return -1;
else if ($b == 'wan')
return 1;
else if ($a == 'lan')
return -1;
else if ($b == 'lan')
return 1;
return strnatcmp($a, $b);
}
/* return the configured interfaces list. */
function get_configured_interface_list($only_opt = false, $withdisabled = false) {
global $config;
@ -691,6 +707,21 @@ function get_configured_interface_with_descr($only_opt = false, $withdisabled =
return $iflist;
}
/*
* get_configured_ip_addresses() - Return a list of all configured
* interfaces IP Addresses
*
*/
function get_configured_ip_addresses() {
require_once("interfaces.inc");
$ip_array = array();
$interfaces = get_configured_interface_list();
foreach($interfaces as $int) {
$ipaddr = get_interface_ip($int);
$ip_array[$int] = $ipaddr;
}
return $ip_array;
}
/*
* get_interface_list() - Return a list of all physical interfaces

3
etc/inc/vpn.inc
View File

@ -1720,4 +1720,5 @@ function vpn_ipsec_configure_preferoldsa() {
else
mwexec("/sbin/sysctl net.key.preferred_oldsa=0");
}
?>
?>

2
etc/inc/wizardapp.inc
View File

@ -345,4 +345,4 @@ $othersplist = array();
$othersplist['slingbox'][] = array('Slingbox2', 'udp', '5001', '5001', 'both');
?>
?>

2
etc/inc/xmlparse.inc
View File

@ -291,4 +291,4 @@ function dump_xml_config_raw($arr, $rootobj) {
return $xmlconfig;
}
?>
?>

2
etc/inc/xmlparse_attr.inc
View File

@ -224,4 +224,4 @@ function parse_xml_config_raw_attr($cffile, $rootobj, &$parsed_attributes, $isst
return $parsedcfg[$rootobj];
}
?>
?>

2
etc/inc/xmlreader.inc
View File

@ -211,4 +211,4 @@ function dump_xml_config_raw($arr, $rootobj) {
return $xmlconfig;
}
?>
?>

4
etc/pfSense.obsoletedfiles
View File

@ -45,4 +45,6 @@
/usr/local/www/dfuife.cgi
/usr/local/www/fred.png
/usr/local/www/index.html
/usr/local/www/system_usermanager_addcert.php
/usr/local/www/system_usermanager_addcert.php
/usr/local/pkg/routed/routed.inc
/usr/local/pkg/routed/routed.xml

18
etc/phpshellsessions/gitsync
View File

@ -19,6 +19,10 @@ $CODIR = "/root/pfsense/";
global $argv;
global $command_split;
// If this parameter is set, all interactive functions are disabled
// and neither PHP nor the web gui will be killed or restarted.
$upgrading = in_array("--upgrading", $argv);
unlink_if_exists("/tmp/config.cache");
if(!file_exists("/usr/local/bin/git")) {
@ -61,7 +65,7 @@ if(is_dir("$CODIR/pfSenseGITREPO/pfSenseGITREPO")) {
if($command_split[2]) {
$branch = $command_split[2];
} else {
if(!$argv[3]) {
if(!$argv[3] && !$upgrading) {
echo "\nCurrent repository is $GIT_REPO\n";
echo "\nPlease select which branch you would like to sync against:\n\n";
foreach($branches as $branchname => $branchdesc) {
@ -98,7 +102,7 @@ foreach($branches as $branchname => $branchdesc) {
$found = true;
}
if(!$found) {
if(isURL($branch)) {
if(isURL($branch) && !$upgrading) {
echo "\n";
echo "NOTE: $branch was not found.\n\n";
$command = readline("Is this a custom GIT URL? [y]? ");
@ -142,7 +146,7 @@ if(file_exists("/root/.gitsync_merge")) {
}
}
}
if(!$command_split[2] && !$argv[3]) {
if(!$command_split[2] && !$argv[3] && !$upgrading) {
do {
echo "\nAdd a custom RCS branch URL (HTTP) to merge in or press enter if done.\n\n";
$merge_repo = readline("> ");
@ -268,11 +272,15 @@ exec("mv $CODIR/pfSenseGITREPO/gitsync_temp.git $CODIR/pfSenseGITREPO/pfSenseGIT
// Reset the repository to restore the deleted files
exec("cd $CODIR/pfSenseGITREPO/pfSenseGITREPO && git reset --hard >/dev/null 2>/dev/null");
post_cvssync_commands();
if(!$upgrading)
post_cvssync_commands();
echo "===> Checkout complete.\n";
echo "\n";
echo "Your system is now sync'd and PHP and Lighty will be restarted in 5 seconds.\n\n";
if(!$upgrading)
echo "Your system is now sync'd and PHP and Lighty will be restarted in 5 seconds.\n\n";
else
echo "Your system is now sync'd.\n\n";
function post_cvssync_commands() {
echo "===> Removing FAST-CGI temporary files...\n";

3
etc/rc
View File

@ -349,9 +349,6 @@ echo -n "Launching the init system..."
/bin/rm -f /cf/conf/backup/backup.cache
/bin/rm -f /root/lighttpd*
/usr/bin/touch $varrunpath/booting
for iface in `/sbin/ifconfig -l`; do
/sbin/ifconfig $iface up
done
/etc/rc.bootup
# If a shell was selected from recovery

10
etc/rc.bootup
View File

@ -157,9 +157,6 @@ echo "Loading configuration...";
parse_config_bootup();
echo "done.\n";
$lan_if = $config['interfaces']['lan']['if'];
$wan_if = get_real_interface();
/*
* Determine if we need to throw a interface exception
* and ask the user to reassign interfaces. This will
@ -168,6 +165,11 @@ $wan_if = get_real_interface();
while(is_interface_mismatch() == true) {
led_assigninterfaces();
echo "\nNetwork interface mismatch -- Running interface assignment option.\n";
$ifaces = get_interface_list();
if (is_array($ifaces)) {
foreach($ifaces as $iface => $ifdata)
interfaces_bring_up($iface);
}
set_networking_interfaces_ports();
led_kitt();
}
@ -344,7 +346,7 @@ enable_rrd_graphing();
setup_wireless_olsr();
/* startup routed if needed */
include_once("/usr/local/pkg/routed/routed.inc");
include_once("/usr/local/pkg/routed.inc");
setup_routed();
/* enable watchdog if supported */

1
etc/rc.create_full_backup
View File

@ -10,6 +10,7 @@ tar czPf /root/$FILENAME \
--exclude root/* \
--exclude var/empty/* \
--exclude var/empty \
--exclude var/etc \
/
echo ">>> Backup completed. Note: this backup includes config.xml!"

6
etc/rc.firmware
View File

@ -287,6 +287,12 @@ pfSenseNanoBSDupgrade)
mkdir /tmp/$GLABEL_SLICE
mount /dev/ufs/$GLABEL_SLICE /tmp/$GLABEL_SLICE
# If /boot/loader.conf.local exists
# copy to the other slice.
if [ -f /boot/loader.conf.local ]; then
cp /boot/loader.conf.local /tmp/$GLABEL_SLICE/boot/loader.conf.local
fi
# If /tmp/$GLABEL_SLICE/tmp/post_upgrade_command exists
# after update then execute the command.
if [ -f /tmp/$GLABEL_SLICE/tmp/post_upgrade_command ]; then

9
tmp/post_upgrade_command.php
View File

@ -6,6 +6,13 @@
require_once("config.inc");
require_once("functions.inc");
if(file_exists("/usr/local/bin/git") && isset($config['system']['gitsync']['synconupgrade'])) {
if(isset($config['system']['gitsync']['repositoryurl']))
exec("cd /root/pfsense/pfSenseGITREPO/pfSenseGITREPO && git config remote.origin.url " . escapeshellarg($config['system']['gitsync']['repositoryurl']));
if(isset($config['system']['gitsync']['branch']))
system("pfSsh.php playback gitsync " . escapeshellarg($config['system']['gitsync']['branch']) . " --upgrading");
}
if($g['platform'] == "embedded") {
$config['system']['enableserial'] = true;
write_config();
@ -19,6 +26,6 @@
$files_to_process = split("\n", file_get_contents("/etc/pfSense.obsoletedfiles"));
foreach($files_to_process as $filename)
if(file_exists($filename))
exec("/bin/rm $filename");
exec("/bin/rm -f $filename");
?>

22
usr/local/bin/easyrule
View File

@ -84,28 +84,6 @@ function is_specialnet($net) {
return false;
}
/* Another one we need from guiconfig.inc but can't include... */
function filter_rules_sort() {
global $config;
/* mark each rule with the sequence number (to retain the order while sorting) */
for ($i = 0; isset($config['filter']['rule'][$i]); $i++)
$config['filter']['rule'][$i]['seq'] = $i;
function filtercmp($a, $b) {
if ($a['interface'] == $b['interface'])
return $a['seq'] - $b['seq'];
else
return -strcmp($a['interface'], $b['interface']);
}
usort($config['filter']['rule'], "filtercmp");
/* strip the sequence numbers again */
for ($i = 0; isset($config['filter']['rule'][$i]); $i++)
unset($config['filter']['rule'][$i]['seq']);
}
if (($argc > 1) && !empty($argv[1])) {
$message = "";

0
usr/local/pkg/routed/routed.inc → usr/local/pkg/routed.inc
View File

10
usr/local/pkg/routed/routed.xml → usr/local/pkg/routed.xml
View File

@ -33,7 +33,7 @@
<name>routed</name>
<version>1.1</version>
<title>Services: RIP</title>
<include_file>routed/routed.inc</include_file>
<include_file>routed.inc</include_file>
<additional_files_needed>
<item>http://www.pfsense.org/packages/config/routed/routed.inc</item>
@ -43,13 +43,13 @@
<menu>
<name>RIP</name>
<section>Services</section>
<configfile>routed/routed.xml</configfile>
<url>pkg_edit.php?xml=routed/routed.xml&amp;id=0</url>
<configfile>routed.xml</configfile>
<url>pkg_edit.php?xml=routed.xml&amp;id=0</url>
</menu>
<tabs>
<tab>
<text>ROUTED Settings</text>
<url>/pkg_edit.php?xml=routed/routed.xml</url>
<url>/pkg_edit.php?xml=routed.xml</url>
<active/>
</tab>
</tabs>
@ -97,7 +97,7 @@
<type>input</type>
</field>
</fields>
<aftersaveredirect>pkg_edit.php?xml=routed/routed.xml&amp;id=0</aftersaveredirect>
<aftersaveredirect>pkg_edit.php?xml=routed.xml&amp;id=0</aftersaveredirect>
<custom_php_command_before_form>
</custom_php_command_before_form>
<custom_delete_php_command>

177
usr/local/www/csrf/csrf-magic.js Normal file
View File

@ -0,0 +1,177 @@
/**
* @file
*
* Rewrites XMLHttpRequest to automatically send CSRF token with it. In theory
* plays nice with other JavaScript libraries, needs testing though.
*/
// Here are the basic overloaded method definitions
// The wrapper must be set BEFORE onreadystatechange is written to, since
// a bug in ActiveXObject prevents us from properly testing for it.
CsrfMagic = function(real) {
// try to make it ourselves, if you didn't pass it
if (!real) try { real = new XMLHttpRequest; } catch (e) {;}
if (!real) try { real = new ActiveXObject('Msxml2.XMLHTTP'); } catch (e) {;}
if (!real) try { real = new ActiveXObject('Microsoft.XMLHTTP'); } catch (e) {;}
if (!real) try { real = new ActiveXObject('Msxml2.XMLHTTP.4.0'); } catch (e) {;}
this.csrf = real;
// properties
var csrfMagic = this;
real.onreadystatechange = function() {
csrfMagic._updateProps();
return csrfMagic.onreadystatechange ? csrfMagic.onreadystatechange() : null;
};
csrfMagic._updateProps();
}
CsrfMagic.prototype = {
open: function(method, url, async, username, password) {
if (method == 'POST') this.csrf_isPost = true;
// deal with Opera bug, thanks jQuery
if (username) return this.csrf_open(method, url, async, username, password);
else return this.csrf_open(method, url, async);
},
csrf_open: function(method, url, async, username, password) {
if (username) return this.csrf.open(method, url, async, username, password);
else return this.csrf.open(method, url, async);
},
send: function(data) {
if (!this.csrf_isPost) return this.csrf_send(data);
prepend = csrfMagicName + '=' + csrfMagicToken + '&';
if (this.csrf_purportedLength === undefined) {
this.csrf_setRequestHeader("Content-length", this.csrf_purportedLength + prepend.length);
delete this.csrf_purportedLength;
}
delete this.csrf_isPost;
return this.csrf_send(prepend + data);
},
csrf_send: function(data) {
return this.csrf.send(data);
},
setRequestHeader: function(header, value) {
// We have to auto-set this at the end, since we don't know how long the
// nonce is when added to the data.
if (this.csrf_isPost && header == "Content-length") {
this.csrf_purportedLength = value;
return;
}
return this.csrf_setRequestHeader(header, value);
},
csrf_setRequestHeader: function(header, value) {
return this.csrf.setRequestHeader(header, value);
},
abort: function() {
return this.csrf.abort();
},
getAllResponseHeaders: function() {
return this.csrf.getAllResponseHeaders();
},
getResponseHeader: function(header) {
return this.csrf.getResponseHeader(header);
} // ,
}
// proprietary
CsrfMagic.prototype._updateProps = function() {
this.readyState = this.csrf.readyState;
if (this.readyState == 4) {
this.responseText = this.csrf.responseText;
this.responseXML = this.csrf.responseXML;
this.status = this.csrf.status;
this.statusText = this.csrf.statusText;
}
}
CsrfMagic.process = function(base) {
var prepend = csrfMagicName + '=' + csrfMagicToken;
if (base) return prepend + '&' + base;
return prepend;
}
// callback function for when everything on the page has loaded
CsrfMagic.end = function() {
// This rewrites forms AGAIN, so in case buffering didn't work this
// certainly will.
forms = document.getElementsByTagName('form');
for (var i = 0; i < forms.length; i++) {
form = forms[i];
if (form.method.toUpperCase() !== 'POST') continue;
if (form.elements[csrfMagicName]) continue;
var input = document.createElement('input');
input.setAttribute('name', csrfMagicName);
input.setAttribute('value', csrfMagicToken);
input.setAttribute('type', 'hidden');
form.appendChild(input);
}
}
// Sets things up for Mozilla/Opera/nice browsers
if (window.XMLHttpRequest && window.XMLHttpRequest.prototype) {
var x = XMLHttpRequest.prototype;
var c = CsrfMagic.prototype;
// Save the original functions
x.csrf_open = x.open;
x.csrf_send = x.send;
x.csrf_setRequestHeader = x.setRequestHeader;
// Notice that CsrfMagic is itself an instantiatable object, but only
// open, send and setRequestHeader are necessary as decorators.
x.open = c.open;
x.send = c.send;
x.setRequestHeader = c.setRequestHeader;
} else {
// The only way we can do this is by modifying a library you have been
// using. We support YUI, script.aculo.us, prototype, MooTools,
// jQuery, Ext and Dojo.
if (window.jQuery) {
// jQuery didn't implement a new XMLHttpRequest function, so we have
// to do this the hard way.
jQuery.csrf_ajax = jQuery.ajax;
jQuery.ajax = function( s ) {
if (s.type && s.type.toUpperCase() == 'POST') {
s = jQuery.extend(true, s, jQuery.extend(true, {}, jQuery.ajaxSettings, s));
if ( s.data && s.processData && typeof s.data != "string" ) {
s.data = jQuery.param(s.data);
}
s.data = CsrfMagic.process(s.data);
}
return jQuery.csrf_ajax( s );
}
} else if (window.Prototype) {
// This works for script.aculo.us too
Ajax.csrf_getTransport = Ajax.getTransport;
Ajax.getTransport = function() {
return new CsrfMagic(Ajax.csrf_getTransport());
}
} else if (window.MooTools) {
Browser.csrf_Request = Browser.Request;
Browser.Request = function () {
return new CsrfMagic(Browser.csrf_Request());
}
} else if (window.YAHOO) {
YAHOO.util.Connect.csrf_createXhrObject = YAHOO.util.Connect.createXhrObject;
YAHOO.util.Connect.createXhrObject = function (transaction) {
obj = YAHOO.util.Connect.csrf_createXhrObject(transaction);
obj.conn = new CsrfMagic(obj.conn);
return obj;
}
} else if (window.Ext) {
// Ext can use other js libraries as loaders, so it has to come last
// Ext's implementation is pretty identical to Yahoo's, but we duplicate
// it for comprehensiveness's sake.
Ext.lib.Ajax.csrf_createXhrObject = Ext.lib.Ajax.createXhrObject;
Ext.lib.Ajax.createXhrObject = function (transaction) {
obj = Ext.lib.Ajax.csrf_createXhrObject(transaction);
obj.conn = new CsrfMagic(obj.conn);
return obj;
}
} else if (window.dojo) {
dojo.csrf__xhrObj = dojo._xhrObj;
dojo._xhrObj = function () {
return new CsrfMagic(dojo.csrf__xhrObj());
}
}
}

372
usr/local/www/csrf/csrf-magic.php Normal file
View File

@ -0,0 +1,372 @@
<?php
/**
* @file
*
* csrf-magic is a PHP library that makes adding CSRF-protection to your
* web applications a snap. No need to modify every form or create a database
* of valid nonces; just include this file at the top of every
* web-accessible page (or even better, your common include file included
* in every page), and forget about it! (There are, of course, configuration
* options for advanced users).
*
* This library is PHP4 and PHP5 compatible.
*/
// CONFIGURATION:
/**
* By default, when you include this file csrf-magic will automatically check
* and exit if the CSRF token is invalid. This will defer executing
* csrf_check() until you're ready. You can also pass false as a parameter to
* that function, in which case the function will not exit but instead return
* a boolean false if the CSRF check failed. This allows for tighter integration
* with your system.
*/
$GLOBALS['csrf']['defer'] = false;
/**
* This is the amount of seconds you wish to allow before any token becomes
* invalid; the default is two hours, which should be more than enough for
* most websites.
*/
$GLOBALS['csrf']['expires'] = 7200;
/**
* Callback function to execute when there's the CSRF check fails and
* $fatal == true (see csrf_check). This will usually output an error message
* about the failure.
*/
$GLOBALS['csrf']['callback'] = 'csrf_callback';
/**
* Whether or not to include our JavaScript library which also rewrites
* AJAX requests on this domain. Set this to the web path. This setting only works
* with supported JavaScript libraries in Internet Explorer; see README.txt for
* a list of supported libraries.
*/
$GLOBALS['csrf']['rewrite-js'] = false;
/**
* A secret key used when hashing items. Please generate a random string and
* place it here. If you change this value, all previously generated tokens
* will become invalid.
*/
$GLOBALS['csrf']['secret'] = '';
/**
* Set this to false to disable csrf-magic's output handler, and therefore,
* its rewriting capabilities. If you're serving non HTML content, you should
* definitely set this false.
*/
$GLOBALS['csrf']['rewrite'] = true;
/**
* Whether or not to use IP addresses when binding a user to a token. This is
* less reliable and less secure than sessions, but is useful when you need
* to give facilities to anonymous users and do not wish to maintain a database
* of valid keys.
*/
$GLOBALS['csrf']['allow-ip'] = true;
/**
* If this information is available, use the cookie by this name to determine
* whether or not to allow the request. This is a shortcut implementation
* very similar to 'key', but we randomly set the cookie ourselves.
*/
$GLOBALS['csrf']['cookie'] = '__csrf_cookie';
/**
* If this information is available, set this to a unique identifier (it
* can be an integer or a unique username) for the current "user" of this
* application. The token will then be globally valid for all of that user's
* operations, but no one else. This requires that 'secret' be set.
*/
$GLOBALS['csrf']['user'] = false;
/**
* This is an arbitrary secret value associated with the user's session. This
* will most probably be the contents of a cookie, as an attacker cannot easily
* determine this information. Warning: If the attacker knows this value, they
* can easily spoof a token. This is a generic implementation; sessions should
* work in most cases.
*
* Why would you want to use this? Lets suppose you have a squid cache for your
* website, and the presence of a session cookie bypasses it. Let's also say
* you allow anonymous users to interact with the website; submitting forms
* and AJAX. Previously, you didn't have any CSRF protection for anonymous users
* and so they never got sessions; you don't want to start using sessions either,
* otherwise you'll bypass the Squid cache. Setup a different cookie for CSRF
* tokens, and have Squid ignore that cookie for get requests, for anonymous
* users. (If you haven't guessed, this scheme was(?) used for MediaWiki).
*/
$GLOBALS['csrf']['key'] = false;
/**
* The name of the magic CSRF token that will be placed in all forms, i.e.
* the contents of <input type="hidden" name="$name" value="CSRF-TOKEN" />
*/
$GLOBALS['csrf']['input-name'] = '__csrf_magic';
/**
* Set this to false if your site must work inside of frame/iframe elements,
* but do so at your own risk: this configuration protects you against CSS
* overlay attacks that defeat tokens.
*/
$GLOBALS['csrf']['frame-breaker'] = true;
/**
* Whether or not CSRF Magic should be allowed to start a new session in order
* to determine the key.
*/
$GLOBALS['csrf']['auto-session'] = true;
/**
* Whether or not csrf-magic should produce XHTML style tags.
*/
$GLOBALS['csrf']['xhtml'] = true;
// FUNCTIONS:
// Don't edit this!
$GLOBALS['csrf']['version'] = '1.0.1';
/**
* Rewrites <form> on the fly to add CSRF tokens to them. This can also
* inject our JavaScript library.
*/
function csrf_ob_handler($buffer, $flags) {
// Even though the user told us to rewrite, we should do a quick heuristic
// to check if the page is *actually* HTML. We don't begin rewriting until
// we hit the first <html tag.
static $is_html = false;
if (!$is_html) {
// not HTML until proven otherwise
if (stripos($buffer, '<html') !== false) {
$is_html = true;
} else {
return $buffer;
}
}
$tokens = csrf_get_tokens();
$name = $GLOBALS['csrf']['input-name'];
$endslash = $GLOBALS['csrf']['xhtml'] ? ' /' : '';
$input = "<input type='hidden' name='$name' value=\"$tokens\"$endslash>";
$buffer = preg_replace('#(<form[^>]*method\s*=\s*["\']post["\'][^>]*>)#i', '$1' . $input, $buffer);
if ($GLOBALS['csrf']['frame-breaker']) {
$buffer = str_ireplace('</head>', '<script type="text/javascript">if (top != self) {top.location.href = self.location.href;}</script></head>', $buffer);
}
if ($js = $GLOBALS['csrf']['rewrite-js']) {
$buffer = str_ireplace(
'</head>',
'<script type="text/javascript">'.
'var csrfMagicToken = "'.$tokens.'";'.
'var csrfMagicName = "'.$name.'";</script>'.
'<script src="'.$js.'" type="text/javascript"></script></head>',
$buffer
);
$script = '<script type="text/javascript">CsrfMagic.end();</script>';
$buffer = str_ireplace('</body>', $script . '</body>', $buffer, $count);
if (!$count) {
$buffer .= $script;
}
}
return $buffer;
}
/**
* Checks if this is a post request, and if it is, checks if the nonce is valid.
* @param bool $fatal Whether or not to fatally error out if there is a problem.
* @return True if check passes or is not necessary, false if failure.
*/
function csrf_check($fatal = true) {
if ($_SERVER['REQUEST_METHOD'] !== 'POST') return true;
csrf_start();
$name = $GLOBALS['csrf']['input-name'];
$ok = false;
$tokens = '';
do {
if (!isset($_POST[$name])) break;
// we don't regenerate a token and check it because some token creation
// schemes are volatile.
$tokens = $_POST[$name];
if (!csrf_check_tokens($tokens)) break;
$ok = true;
} while (false);
if ($fatal && !$ok) {
$callback = $GLOBALS['csrf']['callback'];
if (trim($tokens, 'A..Za..z0..9:;,') !== '') $tokens = 'hidden';
$callback($tokens);
exit;
}
return $ok;
}
/**
* Retrieves a valid token(s) for a particular context. Tokens are separated
* by semicolons.
*/
function csrf_get_tokens() {
$has_cookies = !empty($_COOKIE);
// $ip implements a composite key, which is sent if the user hasn't sent
// any cookies. It may or may not be used, depending on whether or not
// the cookies "stick"
if (!$has_cookies && $secret) {
// :TODO: Harden this against proxy-spoofing attacks
$ip = ';ip:' . csrf_hash($_SERVER['IP_ADDRESS']);
} else {
$ip = '';
}
csrf_start();
// These are "strong" algorithms that don't require per se a secret
if (session_id()) return 'sid:' . csrf_hash(session_id()) . $ip;
if ($GLOBALS['csrf']['cookie']) {
$val = csrf_generate_secret();
setcookie($GLOBALS['csrf']['cookie'], $val);
return 'cookie:' . csrf_hash($val) . $ip;
}
if ($GLOBALS['csrf']['key']) return 'key:' . csrf_hash($GLOBALS['csrf']['key']) . $ip;
// These further algorithms require a server-side secret
if ($secret === '') return 'invalid';
if ($GLOBALS['csrf']['user'] !== false) {
return 'user:' . csrf_hash($GLOBALS['csrf']['user']);
}
if ($GLOBALS['csrf']['allow-ip']) {
return ltrim($ip, ';');
}
return 'invalid';
}
/**
* @param $tokens is safe for HTML consumption
*/
function csrf_callback($tokens) {
header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
echo "<html><head><title>CSRF check failed</title></head><body>CSRF check failed. Please enable cookies.<br />Debug: ".$tokens."</body></html>
";
}
/**
* Checks if a composite token is valid. Outward facing code should use this
* instead of csrf_check_token()
*/
function csrf_check_tokens($tokens) {
if (is_string($tokens)) $tokens = explode(';', $tokens);
foreach ($tokens as $token) {
if (csrf_check_token($token)) return true;
}
return false;
}
/**
* Checks if a token is valid.
*/
function csrf_check_token($token) {
if (strpos($token, ':') === false) return false;
list($type, $value) = explode(':', $token, 2);
if (strpos($value, ',') === false) return false;
list($x, $time) = explode(',', $token, 2);
if ($GLOBALS['csrf']['expires']) {
if (time() > $time + $GLOBALS['csrf']['expires']) return false;
}
switch ($type) {
case 'sid':
return $value === csrf_hash(session_id(), $time);
case 'cookie':
$n = $GLOBALS['csrf']['cookie'];
if (!$n) return false;
if (!isset($_COOKIE[$n])) return false;
return $value === csrf_hash($_COOKIE[$n], $time);
case 'key':
if (!$GLOBALS['csrf']['key']) return false;
return $value === csrf_hash($GLOBALS['csrf']['key'], $time);
// We could disable these 'weaker' checks if 'key' was set, but
// that doesn't make me feel good then about the cookie-based
// implementation.
case 'user':
if ($GLOBALS['csrf']['secret'] === '') return false;
if ($GLOBALS['csrf']['user'] === false) return false;
return $value === csrf_hash($GLOBALS['csrf']['user'], $time);
case 'ip':
if (csrf_get_secret() === '') return false;
// do not allow IP-based checks if the username is set, or if
// the browser sent cookies
if ($GLOBALS['csrf']['user'] !== false) return false;
if (!empty($_COOKIE)) return false;
if (!$GLOBALS['csrf']['allow-ip']) return false;
return $value === csrf_hash($_SERVER['IP_ADDRESS'], $time);
}
return false;
}
/**
* Sets a configuration value.
*/
function csrf_conf($key, $val) {
if (!isset($GLOBALS['csrf'][$key])) {
trigger_error('No such configuration ' . $key, E_USER_WARNING);
return;
}
$GLOBALS['csrf'][$key] = $val;
}
/**
* Starts a session if we're allowed to.
*/
function csrf_start() {
if ($GLOBALS['csrf']['auto-session'] && !session_id()) {
session_start();
}
}
/**
* Retrieves the secret, and generates one if necessary.
*/
function csrf_get_secret() {
if ($GLOBALS['csrf']['secret']) return $GLOBALS['csrf']['secret'];
$dir = dirname(__FILE__);
$file = $dir . '/csrf-secret.php';
$secret = '';
if (file_exists($file)) {
include $file;
return $secret;
}
if (is_writable($dir)) {
$secret = csrf_generate_secret();
$fh = fopen($file, 'w');
fwrite($fh, '<?php $secret = "'.$secret.'";' . PHP_EOL);
fclose($fh);
return $secret;
}
return '';
}
/**
* Generates a random string as the hash of time, microtime, and mt_rand.
*/
function csrf_generate_secret($len = 32) {
$secret = '';
for ($i = 0; $i < 32; $i++) {
$secret .= chr(mt_rand(0, 255));
}
$secret .= time() . microtime();
return sha1($secret);
}
/**
* Generates a hash/expiry double. If time isn't set it will be calculated
* from the current time.
*/
function csrf_hash($value, $time = null) {
if (!$time) $time = time();
return sha1($secret . $value . $time) . ',' . $time;
}
// Load user configuration
if (function_exists('csrf_startup')) csrf_startup();
// Initialize our handler
if ($GLOBALS['csrf']['rewrite']) ob_start('csrf_ob_handler');
// Perform check
if (!$GLOBALS['csrf']['defer']) csrf_check();

4
usr/local/www/diag_authentication.php
View File

@ -105,13 +105,13 @@ include("head.inc");
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Username"); ?></td>
<td width="78%" class="vtable">
<input class="formfld unknown" size='20' id='username' name='username' value='<?=$pconfig['username'];?>' />
<input class="formfld unknown" size='20' id='username' name='username' value='<?=htmlspecialchars($pconfig['username']);?>' />
</td>
</tr>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Password"); ?></td>
<td width="78%" class="vtable">
<input class="formfld pwd" type='password' size='20' id='password' name='password' value='<?=$pconfig['password'];?>' />
<input class="formfld pwd" type='password' size='20' id='password' name='password' value='<?=htmlspecialchars($pconfig['password']);?>' />
</td>
</tr>
<tr>

12
usr/local/www/diag_dns.php
View File

@ -131,7 +131,7 @@ if ($_POST) {
$type = "hostname";
$resolved = gethostbyname($host);
if($resolved) {
$dig=`dig "$host" A | grep "$host" | grep -v ";" | awk '{ print $5 }'`;
$dig=`dig $host_esc A | grep $host_esc | grep -v ";" | awk '{ print $5 }'`;
$resolved = split("\n", $dig);
}
$hostname = $host;
@ -182,12 +182,12 @@ include("head.inc"); ?>
}
if($found > 0) {
if($alias_exists) {
echo "<br/><font size='-2'>An alias already exists for the hostname {$host}. To overwrite, click <a href='diag_dns.php?host=" . trim(urlencode($host)) . "&createalias=true&override=true'>here</a>.";
echo "<br/><font size='-2'>An alias already exists for the hostname " . htmlspecialchars($host) . ". To overwrite, click <a href='diag_dns.php?host=" . trim(urlencode(htmlspecialchars($host))) . "&createalias=true&override=true'>here</a>.";
} else {
if(!$createdalias) {
echo "<br/><font size='-2'><a href='diag_dns.php?host=" . trim(urlencode($host)) . "&createalias=true'>Create alias</a> out of these entries.";
echo "<br/><font size='-2'><a href='diag_dns.php?host=" . trim(urlencode(htmlspecialchars($host))) . "&createalias=true'>Create alias</a> out of these entries.";
} else {
echo "<br/><font size='-2'>Alias created with name {$newalias['name']}";
echo "<br/><font size='-2'>Alias created with name " . htmlspecialchars($newalias['name']);
}
}
}
@ -234,8 +234,8 @@ include("head.inc"); ?>
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("More Information:");?></td>
<td width="78%" class="vtable">
<a target="_new" href ="/diag_ping.php?host=<?=$host?>&interface=wan&count=3"><?=gettext("Ping");?></a> <br/>
<a target="_new" href ="/diag_traceroute.php?host=<?=$host?>&ttl=18"><?=gettext("Traceroute");?></a>
<a target="_new" href ="/diag_ping.php?host=<?=htmlspecialchars($host)?>&interface=wan&count=3"><?=gettext("Ping");?></a> <br/>
<a target="_new" href ="/diag_traceroute.php?host=<?=htmlspecialchars($host)?>&ttl=18"><?=gettext("Traceroute");?></a>
<p/>
<?=gettext("NOTE: The following links are to external services, so their reliability cannot be guaranteed.");?><br/><br/>
<a target="_new" href="http://private.dnsstuff.com/tools/whois.ch?ip=<?php echo $ipaddr; ?>"><?=gettext("IP WHOIS @ DNS Stuff");?></a><br />

12
usr/local/www/diag_dump_states.php
View File

@ -44,11 +44,9 @@ require_once("guiconfig.inc");
/* handle AJAX operations */
if($_GET['action']) {
if($_GET['action'] == "remove") {
$srcip = $_GET['srcip'];
$dstip = $_GET['dstip'];
if (is_ipaddr($srcip) and is_ipaddr($dstip)) {
$retval = mwexec("/sbin/pfctl -k '{$srcip}' -k '{$dstip}'");
echo htmlentities("|{$srcip}|{$dstip}|{$retval}|");
if (is_ipaddr($_GET['srcip']) and is_ipaddr($_GET['dstip'])) {
$retval = mwexec("/sbin/pfctl -k " . escapeshellarg($_GET['srcip']) . " -k " . escapeshellarg($_GET['dstip']));
echo htmlentities("|{$_GET['srcip']}|{$_GET['dstip']}|{$retval}|");
} else {
echo gettext("invalid input");
}
@ -58,7 +56,7 @@ if($_GET['action']) {
/* get our states */
if($_GET['filter']) {
exec("/sbin/pfctl -s state | grep " . escapeshellarg($_GET['filter']), $states);
exec("/sbin/pfctl -s state | grep " . escapeshellarg(htmlspecialchars($_GET['filter'])), $states);
}
else {
exec("/sbin/pfctl -s state", $states);
@ -135,7 +133,7 @@ include("head.inc");
<td><?=gettext("Current state count:");?> <?=$current_statecount?></td>
<td style="font-weight:bold;" align="right">
<?=gettext("Filter expression:");?>
<input type="text" name="filter" class="formfld search" value="<?=$_GET['filter'];?>" size="30" />
<input type="text" name="filter" class="formfld search" value="<?=htmlspecialchars($_GET['filter']);?>" size="30" />
<input type="submit" class="formbtn" value="<?=gettext("Filter");?>" />
<td>
</tr>

26
usr/local/www/diag_ipsec.php
View File

@ -51,6 +51,12 @@ require("guiconfig.inc");
include("head.inc");
require("ipsec.inc");
if ($_GET['act'] == "connect") {
if (is_ipaddr($_GET['remoteid']) && is_ipaddr($_GET['source'])) {
exec("/sbin/ping -S " . escapeshellarg($_GET['source']) . " -c 1 " . escapeshellarg($_GET['remoteid']));
}
}
if (!is_array($config['ipsec']['phase2']))
$config['ipsec']['phase2'] = array();
@ -119,6 +125,26 @@ $sad = ipsec_dump_sad();
<img src ="/themes/<?=$g['theme']?>/images/icons/icon_<?=$icon?>.gif">
</center>
</td>
<td class="list">
<?php
$source = "";
if ($ph2ent['localid']['type'] == 'lan') {
$source = get_interface_ip('lan');
} else {
$source = get_interface_ip(find_ip_interface($ph2ent['localid']['address']));
}
?>
<?php if (($ph2ent['remoteid']['type'] != "mobile") && ($icon != "pass") && ($source != "")): ?>
<center>
<a href="diag_ipsec.php?act=connect&remoteid=<?= $ph2ent['remoteid']['address'] ?>&source=<?= $source ?>">
<img src ="/themes/<?=$g['theme']?>/images/icons/icon_service_start.gif" alt="Connect VPN" title="Connect VPN" border="0">
</a>
</center>
<?php else: ?>
&nbsp;
<?php endif; ?>
</td>
</tr>
<?php
}

4
usr/local/www/diag_logs.php
View File

@ -54,10 +54,10 @@ if ($_POST['clear'])
clear_log_file($system_logfile);
if ($_GET['filtertext'])
$filtertext = $_GET['filtertext'];
$filtertext = htmlspecialchars($_GET['filtertext']);
if ($_POST['filtertext'])
$filtertext = $_POST['filtertext'];
$filtertext = htmlspecialchars($_POST['filtertext']);
if ($filtertext)
$filtertextmeta="?filtertext=$filtertext";

4
usr/local/www/diag_logs_filter.php
View File

@ -73,9 +73,9 @@ if($_GET['dnsip'] or $_POST['dnsip']) {
$filtertext = "";
if($_GET['filtertext'] or $_POST['filtertext']) {
if($_GET['filtertext'])
$filtertext = $_GET['filtertext'];
$filtertext = htmlspecialchars($_GET['filtertext']);
if($_POST['filtertext'])
$filtertext = $_POST['filtertext'];
$filtertext = htmlspecialchars($_POST['filtertext']);
}
$filter_logfile = "{$g['varlog_path']}/filter.log";

4
usr/local/www/diag_logs_vpn.php
View File

@ -49,8 +49,8 @@ $nentries = $config['syslog']['nentries'];
if (!$nentries)
$nentries = 50;
$vpntype = ($_GET['vpntype']) ? $_GET['vpntype'] : "pptp";
$mode = ($_GET['mode']) ? $_GET['mode'] : "login";
$vpntype = (htmlspecialchars($_GET['vpntype'])) ? htmlspecialchars($_GET['vpntype']) : "pptp";
$mode = (htmlspecialchars($_GET['mode'])) ? htmlspecialchars($_GET['mode']) : "login";
if ($_POST['clear'])
clear_log_file("/var/log/vpn.log");

2
usr/local/www/diag_smart.php
View File

@ -208,7 +208,7 @@ switch($action)
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Email Address"); ?></td>
<td width="78%" class="vtable">
<input type="text" name="smartmonemail" value="<?=$pconfig['smartmonemail']?>"/>
<input type="text" name="smartmonemail" value="<?=htmlspecialchars($pconfig['smartmonemail'])?>"/>
</td>
</tr>
<tr>

6
usr/local/www/exec.php
View File

@ -104,8 +104,8 @@ if (isBlank( $_POST['txtRecallBuffer'] )) {
} else {
puts( " var arrRecallBuffer = new Array(" );
$arrBuffer = explode( "&", $_POST['txtRecallBuffer'] );
for ($i=0; $i < (count( $arrBuffer ) - 1); $i++) puts( " '" . $arrBuffer[$i] . "'," );
puts( " '" . $arrBuffer[count( $arrBuffer ) - 1] . "'" );
for ($i=0; $i < (count( $arrBuffer ) - 1); $i++) puts( " '" . htmlspecialchars($arrBuffer[$i]) . "'," );
puts( " '" . htmlspecialchars($arrBuffer[count( $arrBuffer ) - 1]) . "'" );
puts( " );" );
}
@ -259,7 +259,7 @@ if (!isBlank($_POST['txtPHPCommand'])) {
<tr>
<td valign="top">&nbsp;&nbsp;&nbsp;</td>
<td valign="top" class="label">
<input type="hidden" name="txtRecallBuffer" value="<?=$_POST['txtRecallBuffer'] ?>">
<input type="hidden" name="txtRecallBuffer" value="<?=htmlspecialchars($_POST['txtRecallBuffer']) ?>">
<input type="button" class="button" name="btnRecallPrev" value="<" onClick="btnRecall_onClick( this.form, -1 );">
<input type="submit" class="button" value="<?=gettext("Execute"); ?>">
<input type="button" class="button" name="btnRecallNext" value=">" onClick="btnRecall_onClick( this.form, 1 );">

16
usr/local/www/fbegin.inc
View File

@ -125,7 +125,7 @@ $services_menu[] = array("IGMP proxy", "/services_igmpproxy.php");
$services_menu[] = array("Load Balancer", "/load_balancer_pool.php");
$services_menu[] = array("OLSR", "/pkg_edit.php?xml=olsrd.xml&id=0");
$services_menu[] = array("PPPoE Server", "/vpn_pppoe.php");
$services_menu[] = array("RIP", "/pkg_edit.php?xml=routed/routed.xml&id=0");
$services_menu[] = array("RIP", "/pkg_edit.php?xml=routed.xml&id=0");
$services_menu[] = array("SNMP", "/services_snmp.php");
if(count($config['interfaces']) > 1) {
/* no use for UPnP in single-interface deployments
@ -222,7 +222,7 @@ if(! $g['disablehelpmenu']) {
/* NOTICE ACKNOWLEDGE CODE by Erik Kristensen */
if ($_REQUEST['noticeaction'] == 'acknowledge') {
$notice_id = $_REQUEST['noticeid'];
$notice_id = htmlspecialchars($_REQUEST['noticeid']);
close_notice($notice_id);
}
/**********************************************/
@ -263,18 +263,18 @@ if ($_REQUEST['noticeaction'] == 'acknowledge') {
$noticemsg = str_replace("<br>", "", $noticemsg);
$extra_args = "";
if($_GET['xml'])
$extraargs="&xml=" . $_GET['xml'];
$extraargs="&xml=" . htmlspecialchars($_GET['xml']);
if($_POST['xml'])
$extraargs="&xml=" . $_POST['xml'];
$extraargs="&xml=" . htmlspecialchars($_POST['xml']);
if($_GET['id'])
$extraargs="&xml=" . $_GET['id'];
$extraargs="&xml=" . htmlspecialchars($_GET['id']);
if($_POST['id'])
$extraargs="&xml=" . $_POST['id'];
$extraargs="&xml=" . htmlspecialchars($_POST['id']);
$notice_msgs = '<a href="?noticeaction=acknowledge&noticeid=all' . $extraargs . '">Acknowledge All</a> &nbsp;&nbsp;&nbsp;&nbsp;.:.&nbsp;&nbsp;&nbsp;&nbsp; ';
if ($value['url']) {
$notice_msgs .= $date.' - <a href="'.$url.'?'.$request_string.'&noticeaction=acknowledge&noticeid='.$key.'">['.$value['id'].']</a>';
$notice_msgs .= $date.' - <a href="'.$url.'?' . htmlspecialchars($request_string) . '&noticeaction=acknowledge&noticeid='.$key.'">['.$value['id'].']</a>';
} else {
$notice_msgs .= $date.' - <a href="?'.$request_string.'&noticeaction=acknowledge&noticeid='.$key.'">['.$value['id'].']'.$noticemsg.'</a>';
$notice_msgs .= $date.' - <a href="?' . htmlspecialchars($request_string) . '&noticeaction=acknowledge&noticeid='.$key.'">['.$value['id'].']'.htmlspecialchars($noticemsg).'</a>';
}
$notice_msgs .= " &nbsp;&nbsp;&nbsp;&nbsp;.:.&nbsp;&nbsp;&nbsp;&nbsp; ";
}

4
usr/local/www/firewall_aliases_edit.php
View File

@ -558,7 +558,7 @@ EOD;
<input name="origname" type="hidden" id="origname" class="formfld unknown" size="40" value="<?=htmlspecialchars($pconfig['name']);?>" />
<input name="name" type="text" id="name" class="formfld unknown" size="40" value="<?=htmlspecialchars($pconfig['name']);?>" />
<?php if (isset($id) && $a_aliases[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>" />
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
<?php endif; ?>
<br />
<span class="vexpl">
@ -569,7 +569,7 @@ EOD;
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Description"); ?></td>
<td width="78%" class="vtable">
<input name="descr" type="text" class="formfld unknown" id="descr" size="40" value="<?=$pconfig['descr'];?>" />
<input name="descr" type="text" class="formfld unknown" id="descr" size="40" value="<?=htmlspecialchars($pconfig['descr']);?>" />
<br />
<span class="vexpl">
<?=gettext("You may enter a description here for your reference (not parsed)."); ?>

8
usr/local/www/firewall_nat_1to1_edit.php
View File

@ -305,11 +305,11 @@ function typesel_change() {
<?=gettext("Hint: in most cases, you'll want to use WAN here"); ?>.</span></td>
</tr>
<tr>
<td width="22%" valign="top" class="vncellreq"><?=gettext("External subnet"); ?></td>
<td width="22%" valign="top" class="vncellreq"><?=gettext("External subnet IP"); ?></td>
<td width="78%" class="vtable">
<input name="external" type="text" class="formfldalias" id="external" size="20" value="<?=htmlspecialchars($pconfig['external']);?>">
<br/>
<span class="vexpl"><?=gettext("Enter the external (usually on a WAN) subnet's starting address for the 1:1 mapping."); ?><br>
<span class="vexpl"><?=gettext("Enter the external (usually on a WAN) subnet's starting address for the 1:1 mapping. The subnet mask from the source address below will be applied to this IP address."); ?><br>
<?=gettext("Hint: this is generally an address owned by the router itself on the selected interface."); ?></span>
</td>
</tr>
@ -365,7 +365,7 @@ function typesel_change() {
</tr>
</table>
<br/>
<span class="vexpl"><?=gettext("Enter the internal (LAN) subnet for the 1:1 mapping. The subnet size specified for the internal subnet also applies to the external subnet (they have to be the same)."); ?></span>
<span class="vexpl"><?=gettext("Enter the internal (LAN) subnet for the 1:1 mapping. The subnet size specified for the internal subnet will be applied to the external subnet."); ?></span>
</td>
</tr>
<tr>
@ -447,7 +447,7 @@ function typesel_change() {
<td width="78%">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>"> <input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
<?php if (isset($id) && $a_1to1[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

14
usr/local/www/firewall_nat_edit.php
View File

@ -585,7 +585,7 @@ include("fbegin.inc"); ?>
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcbeginport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
<?php endforeach; ?>
</select>
<input autocomplete='off' class="formfldalias" name="srcbeginport_cust" id="srcbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcbeginport']) echo $pconfig['srcbeginport']; ?>">
<input autocomplete='off' class="formfldalias" name="srcbeginport_cust" id="srcbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcbeginport']) echo htmlspecialchars($pconfig['srcbeginport']); ?>">
</td>
</tr>
<tr>
@ -598,7 +598,7 @@ include("fbegin.inc"); ?>
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
<?php endforeach; ?>
</select>
<input autocomplete='off' class="formfldalias" name="srcendport_cust" id="srcendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcendport']) echo $pconfig['srcendport']; ?>">
<input autocomplete='off' class="formfldalias" name="srcendport_cust" id="srcendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcendport']) echo htmlspecialchars($pconfig['srcendport']); ?>">
</td>
</tr>
</table>
@ -695,7 +695,7 @@ include("fbegin.inc"); ?>
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstbeginport']) { echo "selected"; $bfound = 1; }?>><?=htmlspecialchars($wkportdesc);?></option>
<?php endforeach; ?>
</select>
<input autocomplete='off' class="formfldalias" name="dstbeginport_cust" id="dstbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstbeginport']) echo $pconfig['dstbeginport']; ?>">
<input autocomplete='off' class="formfldalias" name="dstbeginport_cust" id="dstbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstbeginport']) echo htmlspecialchars($pconfig['dstbeginport']); ?>">
</td>
</tr>
<tr>
@ -708,7 +708,7 @@ include("fbegin.inc"); ?>
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
<?php endforeach; ?>
</select>
<input autocomplete='off' class="formfldalias" name="dstendport_cust" id="dstendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstendport']) echo $pconfig['dstendport']; ?>">
<input autocomplete='off' class="formfldalias" name="dstendport_cust" id="dstendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstendport']) echo htmlspecialchars($pconfig['dstendport']); ?>">
</td>
</tr>
</table>
@ -741,7 +741,7 @@ include("fbegin.inc"); ?>
<?=htmlspecialchars($wkportdesc);?>
</option>
<?php endforeach; ?>
</select> <input onChange="check_for_aliases();" autocomplete='off' class="formfldalias" name="localbeginport_cust" id="localbeginport_cust" type="text" size="5" value="<?php if (!$bfound) echo $pconfig['localbeginport']; ?>">
</select> <input onChange="check_for_aliases();" autocomplete='off' class="formfldalias" name="localbeginport_cust" id="localbeginport_cust" type="text" size="5" value="<?php if (!$bfound) echo htmlspecialchars($pconfig['localbeginport']); ?>">
<br>
<span class="vexpl"><?=gettext("Specify the port on the machine with the " .
"IP address entered above. In case of a port range, specify " .
@ -825,7 +825,7 @@ include("fbegin.inc"); ?>
<td width="78%">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>"> <input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
<?php if (isset($id) && $a_nat[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>
@ -834,7 +834,7 @@ include("fbegin.inc"); ?>
<script language="JavaScript">
<!--
ext_change();
dst_change(document.iform.interface.value,'<?=$pconfig['interface']?>','<?=$pconfig['dst']?>');
dst_change(document.iform.interface.value,'<?=htmlspecialchars($pconfig['interface'])?>','<?=htmlspecialchars($pconfig['dst'])?>');
var iface_old = document.iform.interface.value;
typesel_change();
proto_change();

10
usr/local/www/firewall_nat_out.php
View File

@ -132,7 +132,7 @@ if (isset($_POST['save']) && $_POST['save'] == "Save") {
$ossubnet = $config['pptpd']['pptp_subnet'];
else
$ossubnet = "32";
$osn = gen_subnet($config['pptpd']['localip'], $osn);
$osn = gen_subnet($config['pptpd']['localip'], $ossubnet);
$natent = array();
$natent['source']['network'] = "{$osn}/{$ossubnet}";
$natent['sourceport'] = "";
@ -148,10 +148,10 @@ if (isset($_POST['save']) && $_POST['save'] == "Save") {
if($config['pppoe']['mode'] == "server") {
if (is_ipaddr($config['pppoe']['localip'])) {
if($config['pppoe']['pppoe_subnet'] <> "")
$ossubnet = $config['pppoe']['pptp_subnet'];
$ossubnet = $config['pppoe']['pppoe_subnet'];
else
$ossubnet = "32";
$osn = gen_subnet($config['pppoe']['localip'], $osn);
$osn = gen_subnet($config['pppoe']['localip'], $ossubnet);
$natent = array();
$natent['source']['network'] = "{$osn}/{$ossubnet}";
$natent['sourceport'] = "";
@ -167,10 +167,10 @@ if (isset($_POST['save']) && $_POST['save'] == "Save") {
if($config['l2tp']['mode'] == "server") {
if (is_ipaddr($config['l2tp']['localip'])) {
if($config['l2tp']['l2tp_subnet'] <> "")
$ossubnet = $config['l2tp']['pptp_subnet'];
$ossubnet = $config['l2tp']['l2tp_subnet'];
else
$ossubnet = "32";
$osn = gen_subnet($config['l2tp']['localip'], $osn);
$osn = gen_subnet($config['l2tp']['localip'], $ossubnet);
$natent = array();
$natent['source']['network'] = "{$osn}/{$ossubnet}";
$natent['sourceport'] = "";

2
usr/local/www/firewall_nat_out_edit.php
View File

@ -532,7 +532,7 @@ any)");?></td>
<td width="78%">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>"> <input type="button" class="formbtn" value="<?=gettext("Cancel");?>" onclick="history.back()">
<?php if (isset($id) && $a_out[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

78
usr/local/www/firewall_rules.php
View File

@ -79,27 +79,33 @@ $ifdescs = get_configured_interface_with_descr();
// Drag and drop reordering
if($_REQUEST['dragdroporder']) {
// First create a new ruleset array and tmp arrays
$a_filter_unorder = array();
$a_filter_before = array();
$a_filter_order = array();
$a_filter_order_tmp = array();
// Pointer to id of item being reordered
$found = 0;
$a_filter_after = array();
$found = false;
$drag_order = $_REQUEST['dragtable'];
// Next traverse through rules building a new order for interface
for ($i = 0; isset($a_filter[$i]); $i++) {
if($a_filter[$i]['interface'] <> $_REQUEST['if'])
$a_filter_unorder[] = $a_filter[$i];
else
if(( $_REQUEST['if'] == "FloatingRules" && isset($a_filter[$i]['floating']) ) || ( $a_filter[$i]['interface'] == $_REQUEST['if'] && !isset($a_filter[$i]['floating']) )) {
$a_filter_order_tmp[] = $a_filter[$i];
$found = true;
} else if (!$found)
$a_filter_before[] = $a_filter[$i];
else
$a_filter_after[] = $a_filter[$i];
}
// Reorder rules with the posted order
for ($i = 0; $i<count($drag_order); $i++)
for ($i = 0; $i<count($drag_order); $i++)
$a_filter_order[] = $a_filter_order_tmp[$drag_order[$i]];
unset($config['filter']['rule']);
// In case $drag_order didn't account for some rules, make sure we don't lose them
if(count($a_filter_order) < count($a_filter_order_tmp)) {
for ($i = 0; $i<count($a_filter_order_tmp); $i++)
if(!in_array($i, $drag_order))
$a_filter_order[] = $a_filter_order_tmp[$i];
}
// Overwrite filter rules with newly created items
$config['filter']['rule'] = $a_filter_order;
foreach($a_filter_unorder as $aa)
$config['filter']['rule'][] = $aa;
$config['filter']['rule'] = array_merge($a_filter_before, $a_filter_order, $a_filter_after);
// Write configuration
$config = write_config("Drag and drop firewall rules ordering update.");
// Redirect back to page
@ -365,11 +371,43 @@ if($_REQUEST['undodrag']) {
<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x_d.gif" width="17" height="17" title="<?gettext("delete selected rules"); ?>" border="0"><?php else: ?>
<input name="del" type="image" src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" width="17" height="17" title="<?=gettext("delete selected rules");?>" onclick="return confirm('<?=gettext('Do you really want to delete the selected rules?');?>')"><?php endif; ?>
</td>
<td align="center" valign="middle"><a href="firewall_rules_edit.php?if=<?=$if;?>&after=-1"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add new rule");?>" width="17" height="17" border="0"></a></td>
<td align="center" valign="middle"><a href="firewall_rules_edit.php?if=<?=htmlspecialchars($if);?>&after=-1"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add new rule");?>" width="17" height="17" border="0"></a></td>
</tr>
</table>
</td>
</tr>
<?php // Show the anti-lockout rule if it's enabled, and we are on LAN with an if count > 1, or WAN with an if count of 1.
if (!isset($config['system']['webgui']['noantilockout']) &&
(((count($config['interfaces']) > 1) && ($if == 'lan'))
|| ((count($config['interfaces']) == 1) && ($if == 'wan')))): ?>
<tr valign="top" id="antilockout">
<td class="list">&nbsp;</td>
<td class="listt" align="center"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_pass.gif" width="11" height="11" border="0"></td>
<td class="listlr" style="background-color: #E0E0E0"></td>
<td class="listr" style="background-color: #E0E0E0">*</td>
<td class="listr" style="background-color: #E0E0E0">*</td>
<td class="listr" style="background-color: #E0E0E0">*</td>
<td class="listr" style="background-color: #E0E0E0"><?=$iflist[$if];?> Address</td>
<td class="listr" style="background-color: #E0E0E0">*</td>
<td class="listr" style="background-color: #E0E0E0">*</td>
<td class="listr" style="background-color: #E0E0E0">*</td>
<td class="listr" style="background-color: #E0E0E0"></td>
<td class="listbg"><?=gettext("Anti-Lockout Rule");?></td>
<td valign="middle" nowrap class="list">
<table border="0" cellspacing="0" cellpadding="1">
<tr>
<td><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_left_d.gif" width="17" height="17" title="<?=gettext("move selected rules before this rule");?>"></td>
<td><a href="system_advanced_admin.php"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" title="<?=gettext("edit rule");?>" width="17" height="17" border="0"></a></td>
</tr>
<tr>
<td align="center" valign="middle"></td>
<td><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus_d.gif" title="<?=gettext("add a new rule based on this one");?>" width="17" height="17" border="0"></td>
</tr>
</table>
</td>
</tr>
<?php endif; ?>
<?php if (isset($config['interfaces'][$if]['blockpriv'])): ?>
<tr valign="top" id="frrfc1918">
<td class="list">&nbsp;</td>
@ -388,7 +426,7 @@ if($_REQUEST['undodrag']) {
<table border="0" cellspacing="0" cellpadding="1">
<tr>
<td><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_left_d.gif" width="17" height="17" title="<?=gettext("move selected rules before this rule");?>"></td>
<td><a href="interfaces.php?if=<?=$if?>#rfc1918"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" title="<?=gettext("edit rule");?>" width="17" height="17" border="0"></a></td>
<td><a href="interfaces.php?if=<?=htmlspecialchars($if)?>#rfc1918"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" title="<?=gettext("edit rule");?>" width="17" height="17" border="0"></a></td>
</tr>
<tr>
<td align="center" valign="middle"></td>
@ -416,7 +454,7 @@ if($_REQUEST['undodrag']) {
<table border="0" cellspacing="0" cellpadding="1">
<tr>
<td><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_left_d.gif" width="17" height="17" title="<?=gettext("move selected rules before this rule");?>"></td>
<td><a href="interfaces.php?if=<?=$if?>#rfc1918"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" title="<?=gettext("edit rule");?>" width="17" height="17" border="0"></a></td>
<td><a href="interfaces.php?if=<?=htmlspecialchars($if)?>#rfc1918"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" title="<?=gettext("edit rule");?>" width="17" height="17" border="0"></a></td>
</tr>
<tr>
<td align="center" valign="middle"></td>
@ -459,7 +497,7 @@ if($_REQUEST['undodrag']) {
$textss = $textse = "";
}
?>
<a href="?if=<?=$if;?>&act=toggle&id=<?=$i;?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_<?=$iconfn;?>.gif" width="11" height="11" border="0" title="<?=gettext("click to toggle enabled/disabled status");?>"></a>
<a href="?if=<?=htmlspecialchars($if);?>&act=toggle&id=<?=$i;?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_<?=$iconfn;?>.gif" width="11" height="11" border="0" title="<?=gettext("click to toggle enabled/disabled status");?>"></a>
<?php if (isset($filterent['log'])):
$iconfnlog = "log_s";
if (isset($filterent['disabled']))
@ -695,7 +733,7 @@ if($_REQUEST['undodrag']) {
<td><a href="firewall_rules_edit.php?id=<?=$i;?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" title="<?=gettext("edit rule"); ?>" width="17" height="17" border="0"></a></td>
</tr>
<tr>
<td align="center" valign="middle"><a href="firewall_rules.php?act=del&if=<?=$if;?>&id=<?=$i;?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" width="17" height="17" border="0" title="<?=gettext("delete rule"); ?>" onclick="return confirm('Do you really want to delete this rule?')"></a></td>
<td align="center" valign="middle"><a href="firewall_rules.php?act=del&if=<?=htmlspecialchars($if);?>&id=<?=$i;?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" width="17" height="17" border="0" title="<?=gettext("delete rule"); ?>" onclick="return confirm('Do you really want to delete this rule?')"></a></td>
<td><a href="firewall_rules_edit.php?dup=<?=$i;?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add a new rule based on this one"); ?>" width="17" height="17" border="0"></a></td>
</tr>
</table>
@ -710,7 +748,7 @@ if($_REQUEST['undodrag']) {
<span class="gray">
<?=gettext("No rules are currently defined for this interface"); ?><br>
<?=gettext("All incoming connections on this interface will be blocked until you add pass rules."); ?><br><br>
<?=gettext("Click the"); ?> <a href="firewall_rules_edit.php?if=<?=$if;?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add new rule");?>" border="0" width="17" height="17" align="absmiddle"></a><?=gettext(" button to add a new rule.");?></span>
<?=gettext("Click the"); ?> <a href="firewall_rules_edit.php?if=<?=htmlspecialchars($if);?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add new rule");?>" border="0" width="17" height="17" align="absmiddle"></a><?=gettext(" button to add a new rule.");?></span>
</td>
<?php endif; ?>
<tr id="fr<?=$nrules;?>">
@ -739,7 +777,7 @@ if($_REQUEST['undodrag']) {
<img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x_d.gif" width="17" height="17" title="<?=gettext("delete selected rules");?>" border="0"><?php else: ?>
<input name="del" type="image" src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" width="17" height="17" title="<?=gettext("delete selected rules");?>" onclick="return confirm('<?=gettext('Do you really want to delete the selected rules?');?>')"><?php endif; ?>
</td>
<td><a href="firewall_rules_edit.php?if=<?=$if;?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add new rule");?>" width="17" height="17" border="0"></a></td>
<td><a href="firewall_rules_edit.php?if=<?=htmlspecialchars($if);?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" title="<?=gettext("add new rule");?>" width="17" height="17" border="0"></a></td>
</tr>
</table>
</td>
@ -796,7 +834,7 @@ if($_REQUEST['undodrag']) {
</td>
</tr>
</table>
<input type="hidden" name="if" value="<?=$if;?>">
<input type="hidden" name="if" value="<?=htmlspecialchars($if);?>">
<script type="text/javascript">
var number_of_rules = <?=$nrules?>;
<?php $nrules = 0; for ($i = 0; isset($a_filter[$i]); $i++): ?>
@ -818,7 +856,7 @@ if($_REQUEST['undodrag']) {
$('redboxtable').hide();
$('loading').show();
document.body.style.cursor = 'wait';
document.location = 'firewall_rules.php?if=<?=$if?>&dragdroporder=true&' + Sortable.serialize('dragtable', 'tr');
document.location = 'firewall_rules.php?if=<?=htmlspecialchars($if);?>&dragdroporder=true&' + Sortable.serialize('dragtable', 'tr');
return;
}
$('loading').hide();

29
usr/local/www/firewall_rules_edit.php
View File

@ -553,6 +553,7 @@ if ($_POST) {
$a_filter[] = $filterent;
}
filter_rules_sort();
write_config();
mark_subsystem_dirty('filter');
@ -859,7 +860,7 @@ include("head.inc");
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcbeginport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
<?php endforeach; ?>
</select>
<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="srcbeginport_cust" id="srcbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcbeginport']) echo $pconfig['srcbeginport']; ?>">
<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="srcbeginport_cust" id="srcbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcbeginport']) echo htmlspecialchars($pconfig['srcbeginport']); ?>">
</td>
</tr>
<tr>
@ -872,7 +873,7 @@ include("head.inc");
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['srcendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
<?php endforeach; ?>
</select>
<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="srcendport_cust" id="srcendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcendport']) echo $pconfig['srcendport']; ?>">
<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="srcendport_cust" id="srcendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['srcendport']) echo htmlspecialchars($pconfig['srcendport']); ?>">
</td>
</tr>
</table>
@ -950,7 +951,7 @@ include("head.inc");
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstbeginport']) { echo "selected"; $bfound = 1; }?>><?=htmlspecialchars($wkportdesc);?></option>
<?php endforeach; ?>
</select>
<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="dstbeginport_cust" id="dstbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstbeginport']) echo $pconfig['dstbeginport']; ?>">
<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="dstbeginport_cust" id="dstbeginport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstbeginport']) echo htmlspecialchars($pconfig['dstbeginport']); ?>">
</td>
</tr>
<tr>
@ -963,7 +964,7 @@ include("head.inc");
<option value="<?=$wkport;?>" <?php if ($wkport == $pconfig['dstendport']) { echo "selected"; $bfound = 1; } ?>><?=htmlspecialchars($wkportdesc);?></option>
<?php endforeach; ?>
</select>
<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="dstendport_cust" id="dstendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstendport']) echo $pconfig['dstendport']; ?>">
<input <?=$edit_disabled;?> autocomplete='off' class="formfldalias" name="dstendport_cust" id="dstendport_cust" type="text" size="5" value="<?php if (!$bfound && $pconfig['dstendport']) echo htmlspecialchars($pconfig['dstendport']); ?>">
</td>
</tr>
</table>
@ -999,9 +1000,9 @@ include("head.inc");
&nbsp;<br>&nbsp;
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>"> <input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
<?php if (isset($id) && $a_filter[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
<input name="after" type="hidden" value="<?=$after;?>">
<input name="after" type="hidden" value="<?=htmlspecialchars($after);?>">
</td>
</tr>
<?php endif; ?>
@ -1080,11 +1081,11 @@ include("head.inc");
<input name="tagged" id="tagged" value="<?=htmlspecialchars($pconfig['tagged']);?>">
<br /><span class="vexpl"><?=gettext("You can match packet on a mark placed before on another rule.")?>
</span> <p>
<input name="max" id="max" value="<?php echo $pconfig['max'] ?>"><br><?=gettext(" Maximum state entries this rule can create");?></p><p>
<input name="max-src-nodes" id="max-src-nodes" value="<?php echo $pconfig['max-src-nodes'] ?>"><br><?=gettext(" Maximum number of unique source hosts");?></p><p>
<input name="max-src-conn" id="max-src-conn" value="<?php echo $pconfig['max-src-conn'] ?>"><br><?=gettext(" Maximum number of established connections per host");?></p><p>
<input name="max-src-states" id="max-src-states" value="<?php echo $pconfig['max-src-states'] ?>"><br><?=gettext(" Maximum state entries per host");?></p><p>
<input name="max-src-conn-rate" id="max-src-conn-rate" value="<?php echo $pconfig['max-src-conn-rate'] ?>"> /
<input name="max" id="max" value="<?php echo htmlspecialchars($pconfig['max']) ?>"><br><?=gettext(" Maximum state entries this rule can create");?></p><p>
<input name="max-src-nodes" id="max-src-nodes" value="<?php echo htmlspecialchars($pconfig['max-src-nodes']) ?>"><br><?=gettext(" Maximum number of unique source hosts");?></p><p>
<input name="max-src-conn" id="max-src-conn" value="<?php echo htmlspecialchars($pconfig['max-src-conn']) ?>"><br><?=gettext(" Maximum number of established connections per host");?></p><p>
<input name="max-src-states" id="max-src-states" value="<?php echo htmlspecialchars($pconfig['max-src-states']) ?>"><br><?=gettext(" Maximum state entries per host");?></p><p>
<input name="max-src-conn-rate" id="max-src-conn-rate" value="<?php echo htmlspecialchars($pconfig['max-src-conn-rate']) ?>"> /
<select name="max-src-conn-rates" id="max-src-conn-rates">
<option value=""<?php if(intval($pconfig['max-src-conn-rates']) < 1) echo " selected"; ?>></option>
<?php for($x=1; $x<255; $x++) {
@ -1095,7 +1096,7 @@ include("head.inc");
<?=gettext("Maximum new connections / per second(s)");?>
</p><p>
<input name="statetimeout" value="<?php echo $pconfig['statetimeout'] ?>"><br>
<input name="statetimeout" value="<?php echo htmlspecialchars($pconfig['statetimeout']) ?>"><br>
<?=gettext("State Timeout in seconds");?>
</p>
@ -1394,9 +1395,9 @@ include("head.inc");
&nbsp;<br>&nbsp;
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>"> <input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
<?php if (isset($id) && $a_filter[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
<input name="after" type="hidden" value="<?=$after;?>">
<input name="after" type="hidden" value="<?=htmlspecialchars($after);?>">
</td>
</tr>
</table>

10
usr/local/www/firewall_schedule_edit.php
View File

@ -622,11 +622,11 @@ function insertElements(tempFriendlyTime, starttimehour, starttimemin, stoptimeh
tr.appendChild(td);
td = d.createElement("td");
td.innerHTML = "<input type='image' src='/themes/" + theme + "/images/icons/icon_e.gif' onclick='editRow(\"" + tempTime + "\",this); return false;' value='Edit'>";
td.innerHTML = "<a onclick='editRow(\"" + tempTime + "\",this); return false;' href='#'><img border='0' src='/themes/" + theme + "/images/icons/icon_e.gif' /></a>";
tr.appendChild(td);
td = d.createElement("td");
td.innerHTML = "<input type='image' src='/themes/" + theme + "/images/icons/icon_x.gif' onclick='removeRow(this); return false;' value='Delete'>";
td.innerHTML = "<a onclick='removeRow(this); return false;' href='#'><img border='0' src='/themes/" + theme + "/images/icons/icon_x.gif' /></a>";
tr.appendChild(td);
td = d.createElement("td");
@ -1131,10 +1131,10 @@ EOD;
<input type='text' readonly class='vexpl' name='timedescr<?php echo $counter; ?>' id='timedescr<?php echo $counter; ?>' style=' word-wrap:break-word; width:100%; border:0px solid;' value='<?php echo $timedescr; ?>'>
</td>
<td>
<input type='image' src='/themes/<?php echo $g['theme']; ?>/images/icons/icon_e.gif' onclick='editRow("<?php echo $tempTime; ?>",this); return false;' value='Edit'>
<a onclick='editRow("<?php echo $tempTime; ?>",this); return false;' href='#'><img border='0' src='/themes/<?php echo $g['theme']; ?>/images/icons/icon_e.gif' /></a>
</td>
<td>
<input type='image' src='/themes/<?php echo $g['theme']; ?>/images/icons/icon_x.gif' onclick='removeRow(this); return false;' value='Delete'>
<a onclick='removeRow(this); return false;' href='#'><img border='0' src='/themes/<?php echo $g['theme']; ?>/images/icons/icon_x.gif' /></a>
</td>
<td>
<input type='hidden' id='schedule<?php echo $counter; ?>' name='schedule<?php echo $counter; ?>' value='<?php echo $tempID; ?>'>
@ -1156,7 +1156,7 @@ EOD;
<input id="submit" name="submit" type="submit" onclick="return checkForRanges();" class="formbtn" value="<?=gettext("Save"); ?>" />
<input id="cancelbutton" name="cancelbutton" type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()" />
<?php if (isset($id) && $a_schedules[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>" />
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
<?php endif; ?>
</td>
</tr>

10
usr/local/www/firewall_shaper.php
View File

@ -65,17 +65,17 @@ if ($_GET) {
if ($_GET['queue'])
$qname = trim($_GET['queue']);
if ($_GET['interface'])
$interface = trim($_GET['interface']);
$interface = htmlspecialchars(trim($_GET['interface']));
if ($_GET['action'])
$action = $_GET['action'];
$action = htmlspecialchars($_GET['action']);
}
if ($_POST) {
if ($_POST['name'])
$qname = trim($_POST['name']);
$qname = htmlspecialchars(trim($_POST['name']));
if ($_POST['interface'])
$interface = trim($_POST['interface']);
$interface = htmlspecialchars(trim($_POST['interface']));
if ($_POST['parentqueue'])
$parentqueue = trim($_POST['parentqueue']);
$parentqueue = htmlspecialchars(trim($_POST['parentqueue']));
}
if ($interface) {

11
usr/local/www/firewall_shaper_layer7.php
View File

@ -77,14 +77,14 @@ if($_GET['reset'] <> "") {
if ($_GET) {
if ($_GET['container'])
$name = trim($_GET['container']);
$name = htmlspecialchars(trim($_GET['container']));
if ($_GET['action'])
$action = $_GET['action'];
$action = htmlspecialchars($_GET['action']);
}
if($_POST) {
if ($_POST['container']) {
$name = trim($_POST['container']);
$name = htmlspecialchars(trim($_POST['container']));
}
}
@ -93,7 +93,6 @@ if ($name) {
$container = $layer7_rules_list[$name];
}
if ($_GET) {
switch ($action) {
case "add":
@ -359,7 +358,7 @@ function addRow(table_id) {
var tFielsNum = rows_count - initial_count[table_id];
if (rows_limit!=0 && tFielsNum >= rows_limit) return false;
var remove = '<input type = "image" src = "/themes/<?=$g['theme'];?>/images/icons/icon_x.gif" onclick="removeRow(\''+table_id+'\',this.parentNode.parentNode)" value = "Delete" />';
var remove = '<a onclick="removeRow(\''+table_id+'\',this.parentNode.parentNode)" href="#"><img border="0" src="/themes/<?=$g['theme'];?>/images/icons/icon_x.gif" /></a>';
try {
var newRow = tbl.insertRow(rows_count);
@ -540,7 +539,7 @@ include("fbegin.inc");
<?php endif; ?>
</td>
<td>
<input type="image" src="/themes/<?=$g['theme'];?>/images/icons/icon_x.gif" onclick="removeRow('maintable',this.parentNode.parentNode); return false;" value="<?=gettext("Delete"); ?>" />
<a onclick="removeRow('maintable',this.parentNode.parentNode); return false;" href="#"><img border="0" src="/themes/<?=$g['theme'];?>/images/icons/icon_x.gif" /></a>
</td>
</tr>

6
usr/local/www/firewall_shaper_queues.php
View File

@ -69,11 +69,11 @@ $tree .= "</ul>";
if ($_GET) {
if ($_GET['queue'])
$qname = trim($_GET['queue']);
$qname = htmlspecialchars(trim($_GET['queue']));
if ($_GET['interface'])
$interface = trim($_GET['interface']);
$interface = htmlspecialchars(trim($_GET['interface']));
if ($_GET['action'])
$action = $_GET['action'];
$action = htmlspecialchars($_GET['action']);
switch ($action) {
case "delete":

14
usr/local/www/firewall_shaper_vinterface.php
View File

@ -62,21 +62,21 @@ read_dummynet_config();
if ($_GET) {
if ($_GET['queue'])
$qname = trim($_GET['queue']);
$qname = htmlspecialchars(trim($_GET['queue']));
if ($_GET['pipe'])
$pipe = trim($_GET['pipe']);
$pipe = htmlspecialchars(trim($_GET['pipe']));
if ($_GET['action'])
$action = $_GET['action'];
$action = htmlspecialchars($_GET['action']);
}
if ($_POST) {
if ($_POST['name'])
$qname = trim($_POST['name']);
$qname = htmlspecialchars(trim($_POST['name']));
if ($_POST['pipe'])
$pipe = trim($_POST['pipe']);
$pipe = htmlspecialchars(trim($_POST['pipe']));
else
$pipe = trim($_POST['name']);
$pipe = htmlspecialchars(trim($_POST['name']));
if ($_POST['parentqueue'])
$parentqueue = trim($_POST['parentqueue']);
$parentqueue = htmlspecialchars(trim($_POST['parentqueue']));
}
if ($pipe) {

2
usr/local/www/firewall_virtual_ip_edit.php
View File

@ -479,7 +479,7 @@ function typesel_change() {
<td width="78%">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>"> <input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
<?php if (isset($id) && $a_vip[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

7
usr/local/www/graph.php
View File

@ -51,6 +51,7 @@ header("Content-type: image/svg+xml");
/********** HTTP GET Based Conf ***********/
$ifnum=@$_GET["ifnum"]; // BSD / SNMP interface name / number
$ifnum = get_real_interface($ifnum);
$ifname=@$_GET["ifname"]?$_GET["ifname"]:"Interface $ifnum"; //Interface name that will be showed on top right of graph
/********* Other conf *******/
@ -82,12 +83,12 @@ $attribs['error']='fill="blue" font-family="Arial" font-size="4"';
$attribs['collect_initial']='fill="gray" font-family="Tahoma, Verdana, Arial, Helvetica, sans-serif" font-size="4"';
//Error text if we cannot fetch data : depends on which method is used
$error_text = "Cannot get data about interface $ifnum";
$error_text = "Cannot get data about interface " . htmlspecialchars($ifnum);
$height=100; //SVG internal height : do not modify
$width=200; //SVG internal width : do not modify
$fetch_link = "ifstats.php?if={$ifnum}";
$fetch_link = "ifstats.php?if=" . htmlspecialchars($ifnum);
/* check for custom theme colors */
if(file_exists("/usr/local/www/themes/{$g['theme']}/graph.php")) {
@ -112,7 +113,7 @@ print('<?xml version="1.0" encoding="iso-8859-1"?>' . "\n");?>
<text id="graph_out_lbl" x="5" y="16" <?=$attribs['out']?>><?=gettext("Out"); ?></text>
<text id="graph_in_txt" x="20" y="8" <?=$attribs['in']?>> </text>
<text id="graph_out_txt" x="20" y="16" <?=$attribs['out']?>> </text>
<text id="ifname" x="<?=$width?>" y="8" <?=$attribs['graphname']?> text-anchor="end"><?=$ifname?></text>
<text id="ifname" x="<?=$width?>" y="8" <?=$attribs['graphname']?> text-anchor="end"><?=htmlspecialchars($ifname)?></text>
<text id="switch_unit" x="<?=$width*0.55?>" y="5" <?=$attribs['switch_unit']?>><?=gettext("Switch to bytes/s"); ?></text>
<text id="switch_scale" x="<?=$width*0.55?>" y="11" <?=$attribs['switch_scale']?>><?=gettext("AutoScale"); ?> (<?=$scale_type?>)</text>
<text id="datetime" x="<?=$width*0.33?>" y="5" <?=$attribs['legend']?>> </text>

29
usr/local/www/guiconfig.inc
View File

@ -34,6 +34,12 @@
/* Include authentication routines */
/* THIS MUST BE ABOVE ALL OTHER CODE */
if(!$nocsrf) {
function csrf_startup() {
csrf_conf('rewrite-js', '/csrf/csrf-magic.js');
}
require_once("csrf/csrf-magic.php");
}
require_once("authgui.inc");
/* make sure nothing is cached */
@ -454,29 +460,6 @@ function pprint_port($port) {
return $pport;
}
/* sort by interface only, retain the original order of rules that apply to
the same interface */
function filter_rules_sort() {
global $config;
/* mark each rule with the sequence number (to retain the order while sorting) */
for ($i = 0; isset($config['filter']['rule'][$i]); $i++)
$config['filter']['rule'][$i]['seq'] = $i;
function filtercmp($a, $b) {
if ($a['interface'] == $b['interface'])
return $a['seq'] - $b['seq'];
else
return -strcmp($a['interface'], $b['interface']);
}
usort($config['filter']['rule'], "filtercmp");
/* strip the sequence numbers again */
for ($i = 0; isset($config['filter']['rule'][$i]); $i++)
unset($config['filter']['rule'][$i]['seq']);
}
function firewall_check_for_advanced_options(&$item) {
$item_set = "";
if($item['max'])

25
usr/local/www/installer.php
View File

@ -27,6 +27,8 @@
POSSIBILITY OF SUCH DAMAGE.
*/
$nocsrf = true;
require("globals.inc");
require("guiconfig.inc");
@ -289,7 +291,7 @@ function begin_install() {
return;
unlink_if_exists("/tmp/install_complete");
if($_REQUEST['disk'])
$disk = $_REQUEST['disk'];
$disk = htmlspecialchars($_REQUEST['disk']);
else
$disk = installer_find_first_disk();
if(!$disk) {
@ -302,7 +304,7 @@ function begin_install() {
}
// Handle other type of file systems
if($_REQUEST['fstype'])
$fstype = strtoupper($_REQUEST['fstype']);
$fstype = htmlspecialchars(strtoupper($_REQUEST['fstype']));
else
$fstype = "UFS+S";
write_out_pc_sysinstaller_config($disk, $fstype);
@ -422,15 +424,18 @@ function verify_before_install() {
head_html();
body_html();
page_table_start();
$disk = pcsysinstall_get_disk_info($_REQUEST['disk']);
$disk = pcsysinstall_get_disk_info(htmlspecialchars($_REQUEST['disk']));
$disksize = format_bytes($disk['size'] * 1048576);
$swapsize = $_REQUEST['swapsize'];
$swapsize = htmlspecialchars($_REQUEST['swapsize']);
$fstype_echo = htmlspecialchars($_REQUEST['fstype']);
$disk_echo = htmlspecialchars($_REQUEST['disk']);
$swapsize_echo = htmlspecialchars($_REQUEST['swapsize']);
echo <<<EOF
<form method="post" action="installer.php">
<input type="hidden" name="fstype" value="{$_REQUEST['fstype']}">
<input type="hidden" name="disk" value="{$_REQUEST['disk']}">
<input type="hidden" name="fstype" value="{$fstype_echo}">
<input type="hidden" name="disk" value="{$disk_echo}">
<input type="hidden" name="state" value="begin_install">
<input type="hidden" name="swapsize" value="{$_REQUEST['swapsize']}">
<input type="hidden" name="swapsize" value="{$swapsize_echo}">
<div id="mainlevel">
<table width="100%" border="0" cellpadding="0" cellspacing="0">
<tr>
@ -451,11 +456,11 @@ function verify_before_install() {
</table>
<p/>
<table>
<tr><td align="right"><b>Disk:</td><td>{$_REQUEST['disk']}</td></tr>
<tr><td align="right"><b>Disk:</td><td>{$disk_echo}</td></tr>
<tr><td align="right"><b>Description:</td><td>{$disk['desc']}</td></tr>
<tr><td align="right"><b>Size:</td><td>{$disksize}</td></tr>
<tr><td align="right"><b>SWAP Size:</td><td>{$_REQUEST['swapsize']}</td></tr>
<tr><td align="right"><b>Filesystem:</td><td>{$_REQUEST['fstype']}</td></tr>
<tr><td align="right"><b>SWAP Size:</td><td>{$swapsize}</td></tr>
<tr><td align="right"><b>Filesystem:</td><td>{$fstype_echo}</td></tr>
</table>
</div>
</center>

87
usr/local/www/interfaces.php
View File

@ -4,7 +4,7 @@
interfaces.php
Copyright (C) 2004-2008 Scott Ullrich
Copyright (C) 2006 Daniel S. Haischt.
Copyright (C) 2008 Ermal Luçi
Copyright (C) 2008-2010 Ermal Luçi
All rights reserved.
originally part of m0n0wall (http://m0n0.ch/wall)
@ -54,10 +54,16 @@ require_once("rrd.inc");
require_once("vpn.inc");
require_once("xmlparse_attr.inc");
if ($_REQUEST['if']) {
// Get configured interface list
$ifdescrs = get_configured_interface_with_descr(false, true);
$if = "wan";
if ($_REQUEST['if'])
$if = $_REQUEST['if'];
} else {
$if = "wan";
if (empty($ifdescrs[$if])) {
Header("Location: interfaces.php");
exit;
}
define("CRON_MONTHLY_PATTERN", "0 0 1 * *");
@ -76,10 +82,15 @@ function remove_bad_chars($string) {
if (!is_array($config['gateways']['gateway_item']))
$config['gateways']['gateway_item'] = array();
$a_gateways = &$config['gateways']['gateway_item'];
$wancfg = &$config['interfaces'][$if];
// Populate page descr if it does not exist.
if ($if == "wan" && !$wancfg['descr'])
$wancfg['descr'] = "WAN";
else if ($if == "lan" && !$wancfg['descr'])
$wancfg['descr'] = "LAN";
foreach ($a_ppps as $pppid => $ppp) {
if ($wancfg['if'] == $ppp['if'])
@ -164,13 +175,6 @@ if ($wancfg['if'] == $a_ppps[$pppid]['if']) {
$pconfig['dhcphostname'] = $wancfg['dhcphostname'];
$pconfig['alias-address'] = $wancfg['alias-address'];
$pconfig['alias-subnet'] = $wancfg['alias-subnet'];
// Populate page descr if it does not exist.
if($if == "wan" && !$wancfg['descr']) {
$wancfg['descr'] = "WAN";
} else if ($if == "lan" && !$wancfg['descr']) {
$wancfg['descr'] = "LAN";
}
$pconfig['descr'] = remove_bad_chars($wancfg['descr']);
$pconfig['enable'] = isset($wancfg['enable']);
@ -204,9 +208,8 @@ switch($wancfg['ipaddr']) {
if((is_ipaddr($wancfg['ipaddrv6'])) && (is_ipaddr($wancfg['ipaddr']))) {
$pconfig['type'] = "staticv4v6";
}
} else {
} else
$pconfig['type'] = "none";
}
break;
}
@ -323,15 +326,18 @@ if ($_POST['apply']) {
else {
unlink_if_exists("{$g['tmp_path']}/config.cache");
clear_subsystem_dirty('interfaces');
if ($pconfig['enable'])
interface_configure($if, true);
else
interface_bring_down($if);
if (file_exists("{$g['tmp_path']}/.interfaces.apply")) {
$toapplylist = unserialize(file_get_contents("{$g['tmp_path']}/.interfaces.apply"));
foreach ($toapplylist as $ifapply) {
if (isset($config['interfaces'][$ifapply]['enable']))
interface_configure($ifapply, true);
else
interface_bring_down($ifapply);
}
}
/* restart snmp so that it binds to correct address */
services_snmpd_configure();
if ($if == "lan")
$savemsg = gettext("The changes have been applied. You may need to correct your web browser's IP address.");
/* sync filter configuration */
setup_gateways_monitor();
@ -342,22 +348,25 @@ if ($_POST['apply']) {
enable_rrd_graphing();
}
@unlink("{$g['tmp_path']}/.interfaces.apply");
header("Location: interfaces.php?if={$if}");
exit;
} else
if ($_POST && $_POST['enable'] != "yes") {
} else if ($_POST && $_POST['enable'] != "yes") {
unset($wancfg['enable']);
if (isset($wancfg['wireless'])) {
if (isset($wancfg['wireless']))
interface_sync_wireless_clones($wancfg, false);
}
write_config("Interface {$_POST['descr']}({$if}) is now disabled.");
mark_subsystem_dirty('interfaces');
if (file_exists("{$g['tmp_path']}/.interfaces.apply"))
$toapplylist = unserialize(file_get_contents("{$g['tmp_path']}/.interfaces.apply"));
else
$toapplylist = array();
$toapplylist[$if] = $if;
file_put_contents("{$g['tmp_path']}/.interfaces.apply", serialize($toapplylist));
header("Location: interfaces.php?if={$if}");
exit;
} else
} else if ($_POST) {
if ($_POST) {
unset($input_errors);
$pconfig = $_POST;
conf_mount_rw();
@ -378,10 +387,8 @@ if ($_POST) {
unset($_POST['pppoe_resetdate']);
unset($_POST['pppoe_pr_preset_val']);
}
/* optional interface if list */
$iflist = get_configured_interface_with_descr(false, true);
/* description unique? */
foreach ($iflist as $ifent => $ifdescr) {
foreach ($ifdescrs as $ifent => $ifdescr) {
if ($if != $ifent && $ifdescr == $_POST['descr']) {
$input_errors[] = gettext("An interface with the specified description already exists.");
break;
@ -762,17 +769,25 @@ if ($_POST) {
handle_wireless_post();
}
conf_mount_ro();
write_config();
if (file_exists("{$g['tmp_path']}/.interfaces.apply"))
$toapplylist = unserialize(file_get_contents("{$g['tmp_path']}/.interfaces.apply"));
else
$toapplylist = array();
$toapplylist[$if] = $if;
file_put_contents("{$g['tmp_path']}/.interfaces.apply", serialize($toapplylist));
mark_subsystem_dirty('interfaces');
/* regenerate cron settings/crontab file */
configure_cron();
conf_mount_ro();
header("Location: interfaces.php?if={$if}");
exit;
}
} // end if($_POST)
function handle_wireless_post() {
@ -936,7 +951,7 @@ function check_wireless_mode() {
}
}
$pgtitle = array(gettext("Interfaces"), $pconfig['descr']);
$pgtitle = array(gettext("Interfaces"), strtoupper($pconfig['descr']));
$statusurl = "status_interfaces.php";
$closehead = false;
@ -2233,9 +2248,9 @@ $types = array("none" => gettext("None"), "staticv4" => gettext("Static IPv4"),
<input id="cancel" type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
<input name="if" type="hidden" id="if" value="<?=$if;?>">
<?php if ($wancfg['if'] == $a_ppps[$pppid]['if']) : ?>
<input name="ppp_port" type="hidden" value="<?=$pconfig['port'];?>">
<input name="ppp_port" type="hidden" value="<?=htmlspecialchars($pconfig['port']);?>">
<?php endif; ?>
<input name="ptpid" type="hidden" value="<?=$pconfig['ptpid'];?>">
<input name="ptpid" type="hidden" value="<?=htmlspecialchars($pconfig['ptpid']);?>">
</td>
</tr>
</table>

21
usr/local/www/interfaces_assign.php
View File

@ -320,7 +320,7 @@ if ($_GET['act'] == "add") {
$config['interfaces'][$newifname]['descr'] = $descr;
}
uksort($config['interfaces'], "compare_interface_names");
uksort($config['interfaces'], "compare_interface_friendly_names");
/* Find an unused port for this interface */
foreach ($portlist as $portname => $portinfo) {
@ -350,21 +350,6 @@ if ($_GET['act'] == "add") {
}
function compare_interface_names($a, $b) {
if ($a == $b)
return 0;
else if ($a == 'wan')
return -1;
else if ($b == 'wan')
return 1;
else if ($a == 'lan')
return -1;
else if ($b == 'lan')
return 1;
return strnatcmp($a, $b);
}
include("head.inc");
if(file_exists("/var/run/interface_mismatch_reboot_needed"))
@ -416,7 +401,7 @@ if(file_exists("/var/run/interface_mismatch_reboot_needed"))
</tr>
<?php foreach ($config['interfaces'] as $ifname => $iface):
if ($iface['descr'])
$ifdescr = $iface['descr'];
$ifdescr = strtoupper($iface['descr']);
else
$ifdescr = strtoupper($ifname);
?>
@ -429,7 +414,7 @@ if(file_exists("/var/run/interface_mismatch_reboot_needed"))
<?php if ($portinfo['isvlan']) {
$descr = sprintf(gettext('VLAN %1$s on %2$s'),$portinfo['tag'],$portinfo['if']);
if ($portinfo['descr'])
$descr .= " (" . $portinfo['descr'] . ")";
$descr .= " (" . strtoupper($portinfo['descr']) . ")";
echo htmlspecialchars($descr);
} elseif ($portinfo['iswlclone']) {
$descr = $portinfo['cloneif'];

20
usr/local/www/interfaces_bridge_edit.php
View File

@ -268,7 +268,7 @@ function show_source_port_range() {
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Description"); ?></td>
<td width="78%" class="vtable">
<input type="text" name="descr" id="descr" class="formfld unknown" size="50" value="<?=$pconfig['descr'];?>">
<input type="text" name="descr" id="descr" class="formfld unknown" size="50" value="<?=htmlspecialchars($pconfig['descr']);?>">
</td>
</tr>
<tr id="sprtable" name="sprtable">
@ -321,7 +321,7 @@ function show_source_port_range() {
</td></tr>
<tr><td valign="top" class="vncell" width="20%"><?=gettext("Valid time"); ?></td>
<td class="vtable" width="80%">
<input name="maxage" type="text" class="formfld unkown" id="maxage" size="8" value="<?=$pconfig['maxage'];?>"> <?=gettext("seconds"); ?>
<input name="maxage" type="text" class="formfld unkown" id="maxage" size="8" value="<?=htmlspecialchars($pconfig['maxage']);?>"> <?=gettext("seconds"); ?>
<br/>
<span class="vexpl">
<?=gettext("Set the time that a Spanning Tree Protocol configuration is " .
@ -331,7 +331,7 @@ function show_source_port_range() {
</td></tr>
<tr><td valign="top" class="vncell" width="20%"><?=gettext("Forward time"); ?> </td>
<td class="vtable" width="80%">
<input name="fwdelay" type="text" class="formfld unkown" id="fwdelay" size="8" value="<?=$pconfig['fwdelay'];?>"> <?=gettext("seconds"); ?>
<input name="fwdelay" type="text" class="formfld unkown" id="fwdelay" size="8" value="<?=htmlspecialchars($pconfig['fwdelay']);?>"> <?=gettext("seconds"); ?>
<br/>
<span class="vexpl">
<?=gettext("Set the time that must pass before an interface begins forwarding " .
@ -340,7 +340,7 @@ function show_source_port_range() {
</td></tr>
<tr><td valign="top" class="vncell" width="20%"><?=gettext("Hello time"); ?></td>
<td class="vtable" width="80%">
<input name="hellotime" type="text" class="formfld unkown" size="8" id="hellotime" value="<?=$pconfig['hellotime'];?>"> <?=gettext("seconds"); ?>
<input name="hellotime" type="text" class="formfld unkown" size="8" id="hellotime" value="<?=htmlspecialchars($pconfig['hellotime']);?>"> <?=gettext("seconds"); ?>
<br/>
<span class="vexpl">
<?=gettext("Set the time between broadcasting of Spanning Tree Protocol configuration messages. The hello time may only be changed when " .
@ -349,7 +349,7 @@ function show_source_port_range() {
</td></tr>
<tr><td valign="top" class="vncell" width="20%"><?=gettext("Priority"); ?></td>
<td class="vtable" width="80%">
<input name="priority" type="text" class="formfld unkown" id="priority" value="<?=$pconfig['priority'];?>">
<input name="priority" type="text" class="formfld unkown" id="priority" value="<?=htmlspecialchars($pconfig['priority']);?>">
<br/>
<span class="vexpl">
<?=gettext("Set the bridge priority for Spanning Tree. The default is 32768. " .
@ -358,7 +358,7 @@ function show_source_port_range() {
</td></tr>
<tr><td valign="top" class="vncell" width="20%"><?=gettext("Hold count"); ?></td>
<td class="vtable" width="80%">
<input name="holdcnt" type="text" class="formfld unkown" id="holdcnt" value="<?=$pconfig['holdcnt'];?>">
<input name="holdcnt" type="text" class="formfld unkown" id="holdcnt" value="<?=htmlspecialchars($pconfig['holdcnt']);?>">
<br/>
<span class="vexpl">
<?=gettext("Set the transmit hold count for Spanning Tree. This is the num- " .
@ -399,7 +399,7 @@ function show_source_port_range() {
<tr style="display:none" id="sprtable2" name="sprtable2">
<td valign="top" class="vncell"><?=gettext("Cache size"); ?></td>
<td class="vtable">
<input name="maxaddr" size="10" type="text" class="formfld unkown" id="maxaddr" value="<?=$pconfig['maxaddr'];?>"> <?=gettext("entries"); ?>
<input name="maxaddr" size="10" type="text" class="formfld unkown" id="maxaddr" value="<?=htmlspecialchars($pconfig['maxaddr']);?>"> <?=gettext("entries"); ?>
<br/><span class="vexpl">
<?=gettext("Set the size of the bridge address cache to size. The default is " .
".100 entries."); ?>
@ -409,7 +409,7 @@ function show_source_port_range() {
<tr style="display:none" id="sprtable3" name="sprtable3">
<td valign="top" class="vncell"><?=gettext("Cache entry expire time"); ?></td>
<td>
<input name="timeout" type="text" class="formfld unkown" id="timeout" size="10" value="<?=$pconfig['timeout'];?>"> <?=gettext("seconds"); ?>
<input name="timeout" type="text" class="formfld unkown" id="timeout" size="10" value="<?=htmlspecialchars($pconfig['timeout']);?>"> <?=gettext("seconds"); ?>
<br/><span class="vexpl">
<?=gettext("Set the timeout of address cache entries to this number of seconds. If " .
"seconds is zero, then address cache entries will not be expired. " .
@ -575,10 +575,10 @@ function show_source_port_range() {
<tr>
<td width="22%" valign="top">&nbsp;</td>
<td width="78%">
<input type="hidden" name="bridgeif" value="<?=$pconfig['bridgeif']; ?>">
<input type="hidden" name="bridgeif" value="<?=htmlspecialchars($pconfig['bridgeif']); ?>">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>"> <input type="button" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
<?php if (isset($id) && $a_bridges[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

10
usr/local/www/interfaces_gif_edit.php
View File

@ -150,21 +150,21 @@ include("head.inc");
<tr>
<td valign="top" class="vncellreq"><?=gettext("gif remote address"); ?></td>
<td class="vtable">
<input name="remote-addr" type="text" class="formfld unknown" id="remote-addr" size="24" value="<?=$pconfig['remote-addr'];?>">
<input name="remote-addr" type="text" class="formfld unknown" id="remote-addr" size="24" value="<?=htmlspecialchars($pconfig['remote-addr']);?>">
<br>
<span class="vexpl"><?=gettext("Peer address where encapsulated gif packets will be sent. "); ?></span></td>
</tr>
<tr>
<td valign="top" class="vncellreq"><?=gettext("gif tunnel local address"); ?></td>
<td class="vtable">
<input name="tunnel-local-addr" type="text" class="formfld unknown" id="tunnel-local-addr" size="24" value="<?=$pconfig['tunnel-local-addr'];?>">
<input name="tunnel-local-addr" type="text" class="formfld unknown" id="tunnel-local-addr" size="24" value="<?=htmlspecialchars($pconfig['tunnel-local-addr']);?>">
<br>
<span class="vexpl"><?=gettext("Local gif tunnel endpoint"); ?></span></td>
</tr>
<tr>
<td valign="top" class="vncellreq"><?=gettext("gif tunnel remote address "); ?></td>
<td class="vtable">
<input name="tunnel-remote-addr" type="text" class="formfld unknown" id="tunnel-remote-addr" size="24" value="<?=$pconfig['tunnel-remote-addr'];?>">
<input name="tunnel-remote-addr" type="text" class="formfld unknown" id="tunnel-remote-addr" size="24" value="<?=htmlspecialchars($pconfig['tunnel-remote-addr']);?>">
<select name="tunnel-remote-net" class="formselect" id="tunnel-remote-net">
<?php
for ($i = 128; $i > 0; $i--) {
@ -206,10 +206,10 @@ include("head.inc");
<tr>
<td width="22%" valign="top">&nbsp;</td>
<td width="78%">
<input type="hidden" name="gifif" value="<?=$pconfig['gifif']; ?>">
<input type="hidden" name="gifif" value="<?=htmlspecialchars($pconfig['gifif']); ?>">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>"> <input type="button" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
<?php if (isset($id) && $a_gifs[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

14
usr/local/www/interfaces_gre_edit.php
View File

@ -84,8 +84,8 @@ if ($_POST) {
if (isset($id) && ($a_gres[$id]) && ($a_gres[$id] === $gre))
continue;
if (($gre['if'] == $_POST['if']) && ($gre['tunnel-remote-net'] == $_POST['tunnel-remote-net'])) {
$input_errors[] = sprintf(gettext("A gre with the network %s is already defined."),$gre['remote-network']);
if (($gre['if'] == $_POST['if']) && ($gre['tunnel-remote-addr'] == $_POST['tunnel-remote-addr'])) {
$input_errors[] = sprintf(gettext("A GRE tunnel with the network %s is already defined."),$gre['remote-network']);
break;
}
}
@ -153,21 +153,21 @@ include("head.inc");
<tr>
<td valign="top" class="vncellreq"><?=gettext("GRE remote address");?></td>
<td class="vtable">
<input name="remote-addr" type="text" class="formfld unknown" id="remote-addr" size="16" value="<?=$pconfig['remote-addr'];?>">
<input name="remote-addr" type="text" class="formfld unknown" id="remote-addr" size="16" value="<?=htmlspecialchars($pconfig['remote-addr']);?>">
<br>
<span class="vexpl"><?=gettext("Peer address where encapsulated GRE packets will be sent ");?></span></td>
</tr>
<tr>
<td valign="top" class="vncellreq"><?=gettext("GRE tunnel local address ");?></td>
<td class="vtable">
<input name="tunnel-local-addr" type="text" class="formfld unknown" id="tunnel-local-addr" size="16" value="<?=$pconfig['tunnel-local-addr'];?>">
<input name="tunnel-local-addr" type="text" class="formfld unknown" id="tunnel-local-addr" size="16" value="<?=htmlspecialchars($pconfig['tunnel-local-addr']);?>">
<br>
<span class="vexpl"><?=gettext("Local GRE tunnel endpoint");?></span></td>
</tr>
<tr>
<td valign="top" class="vncellreq"><?=gettext("GRE tunnel remote address ");?></td>
<td class="vtable">
<input name="tunnel-remote-addr" type="text" class="formfld unknown" id="tunnel-remote-addr" size="16" value="<?=$pconfig['tunnel-remote-addr'];?>">
<input name="tunnel-remote-addr" type="text" class="formfld unknown" id="tunnel-remote-addr" size="16" value="<?=htmlspecialchars($pconfig['tunnel-remote-addr']);?>">
<select name="tunnel-remote-net" class="formselect" id="tunnel-remote-net">
<?php
for ($i = 32; $i > 0; $i--) {
@ -218,10 +218,10 @@ include("head.inc");
<tr>
<td width="22%" valign="top">&nbsp;</td>
<td width="78%">
<input type="hidden" name="greif" value="<?=$pconfig['greif']; ?>">
<input type="hidden" name="greif" value="<?=htmlspecialchars($pconfig['greif']); ?>">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save");?>"> <input type="button" value="<?=gettext("Cancel");?>" onclick="history.back()">
<?php if (isset($id) && $a_gres[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

10
usr/local/www/interfaces_groups_edit.php
View File

@ -212,7 +212,7 @@ var addRowTo = (function() {
td = d.createElement("td");
td.rowSpan = "1";
td.innerHTML = '<input type="image" src="/themes/' + theme + '/images/icons/icon_x.gif" onclick="removeRow(this);return false;" value="Delete">';
td.innerHTML = '<a onclick="removeRow(this);return false;" href="#"><img border="0" src="/themes/' + theme + '/images/icons/icon_x.gif" /></a>';
tr.appendChild(td);
tbody.appendChild(tr);
totalrows++;
@ -251,7 +251,7 @@ function removeRow(el) {
<tr>
<td valign="top" class="vncellreq"><?=gettext("Group Name");?></td>
<td class="vtable">
<input class="formfld unknown" name="ifname" id="ifname" value="<?=$pconfig['ifname'];?>" />
<input class="formfld unknown" name="ifname" id="ifname" value="<?=htmlspecialchars($pconfig['ifname']);?>" />
<br />
<?=gettext("No numbers or spaces are allowed. Only characters in a-zA-Z");?>
</td>
@ -259,7 +259,7 @@ function removeRow(el) {
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Description");?></td>
<td width="78%" class="vtable">
<input name="descr" type="text" class="formfld unknown" id="descr" size="40" value="<?=$pconfig['descr'];?>" />
<input name="descr" type="text" class="formfld unknown" id="descr" size="40" value="<?=htmlspecialchars($pconfig['descr']);?>" />
<br />
<span class="vexpl">
<?=gettext("You may enter a description here for your reference (not parsed).");?>
@ -298,7 +298,7 @@ function removeRow(el) {
</select>
</td>
<td>
<input type="image" src="/themes/<?echo $g['theme'];?>/images/icons/icon_x.gif" onclick="removeRow(this); return false;" value="<?=gettext("Delete");?>" />
<a onclick="removeRow(this); return false;" href="#"><img border="0" src="/themes/<?echo $g['theme'];?>/images/icons/icon_x.gif" /></a>
</td>
</tr>
<?php
@ -323,7 +323,7 @@ function removeRow(el) {
<input id="submit" name="submit" type="submit" class="formbtn" value="<?=gettext("Save");?>" />
<a href="interfaces_groups.php"><input id="cancelbutton" name="cancelbutton" type="button" class="formbtn" value="<?=gettext("Cancel");?>" /></a>
<?php if (isset($id) && $a_ifgroups[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>" />
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
<?php endif; ?>
</td>
</tr>

4
usr/local/www/interfaces_lagg_edit.php
View File

@ -205,10 +205,10 @@ include("head.inc");
<tr>
<td width="22%" valign="top">&nbsp;</td>
<td width="78%">
<input type="hidden" name="laggif" value="<?=$pconfig['laggif']; ?>">
<input type="hidden" name="laggif" value="<?=htmlspecialchars($pconfig['laggif']); ?>">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>"> <input type="button" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
<?php if (isset($id) && $a_laggs[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

2
usr/local/www/interfaces_ppps_edit.php
View File

@ -789,7 +789,7 @@ $types = array("select" => gettext("Select"), "ppp" => "PPP", "pppoe" => "PPPoE"
<input type="button" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
<input name="ptpid" type="hidden" value="<?=htmlspecialchars($pconfig['ptpid']);?>">
<?php if (isset($id) && $a_ppps[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

10
usr/local/www/interfaces_qinq_edit.php
View File

@ -248,7 +248,7 @@ var addRowTo = (function() {
td = d.createElement("td");
td.rowSpan = "1";
td.innerHTML = '<input type="image" src="/themes/' + theme + '/images/icons/icon_x.gif" onclick="removeRow(this);return false;" value="Delete">';
td.innerHTML = '<a onclick="removeRow(this);return false;" href="#"><img border="0" src="/themes/' + theme + '/images/icons/icon_x.gif" /></a>';
tr.appendChild(td);
tbody.appendChild(tr);
totalrows++;
@ -307,7 +307,7 @@ function removeRow(el) {
<tr>
<td width="22%" valign="top" class="vncellreq"><?=gettext("First level tag");?></td>
<td width="78%" class="vtable">
<input name="tag" type="text" class="formfld unknown" id="tag" size="10" value="<?=$pconfig['tag'];?>" />
<input name="tag" type="text" class="formfld unknown" id="tag" size="10" value="<?=htmlspecialchars($pconfig['tag']);?>" />
<br />
<span class="vexpl">
<?=gettext("This is the first level VLAN tag. On top of this are stacked the member VLANs defined below.");?>
@ -336,7 +336,7 @@ function removeRow(el) {
<tr>
<td width="22%" valign="top" class="vncell"><?=gettext("Description");?></td>
<td width="78%" class="vtable">
<input name="descr" type="text" class="formfld unknown" id="descr" size="40" value="<?=$pconfig['descr'];?>" />
<input name="descr" type="text" class="formfld unknown" id="descr" size="40" value="<?=htmlspecialchars($pconfig['descr']);?>" />
<br />
<span class="vexpl">
<?=gettext("You may enter a description here for your reference (not parsed).");?>
@ -370,7 +370,7 @@ function removeRow(el) {
<input name="members<?php echo $tracker; ?>" class="formselect" id="members<?php echo $tracker; ?>" value="<? echo $members;?>">
</td>
<td>
<input type="image" src="/themes/<?echo $g['theme'];?>/images/icons/icon_x.gif" onclick="removeRow(this); return false;" value="<?=gettext("Delete");?>" />
<a onclick="removeRow(this); return false;" href="#"><img border="0" src="/themes/<?echo $g['theme'];?>/images/icons/icon_x.gif" /></a>
</td>
</tr>
<?php
@ -395,7 +395,7 @@ function removeRow(el) {
<input id="submit" name="submit" type="submit" class="formbtn" value="<?=gettext("Save");?>" />
<a href="interfaces_qinq.php"><input id="cancelbutton" name="cancelbutton" type="button" class="formbtn" value="<?=gettext("Cancel");?>" /></a>
<?php if (isset($id) && $a_qinqs[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>" />
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
<?php endif; ?>
</td>
</tr>

4
usr/local/www/interfaces_vlan_edit.php
View File

@ -172,10 +172,10 @@ include("head.inc");
<tr>
<td width="22%" valign="top">&nbsp;</td>
<td width="78%">
<input type="hidden" name="vlanif" value="<?=$pconfig['vlanif']; ?>">
<input type="hidden" name="vlanif" value="<?=htmlspecialchars($pconfig['vlanif']); ?>">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save");?>"> <input type="button" value="<?=gettext("Cancel");?>" onclick="history.back()">
<?php if (isset($id) && $a_vlans[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

4
usr/local/www/interfaces_wireless_edit.php
View File

@ -191,10 +191,10 @@ include("head.inc");
<tr>
<td width="22%" valign="top">&nbsp;</td>
<td width="78%">
<input type="hidden" name="cloneif" value="<?=$pconfig['cloneif']; ?>">
<input type="hidden" name="cloneif" value="<?=htmlspecialchars($pconfig['cloneif']); ?>">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save");?>"> <input type="button" value="<?=gettext("Cancel");?>" onclick="history.back()">
<?php if (isset($id) && $a_clones[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

4
usr/local/www/javascript/row_helper.js
View File

@ -24,7 +24,9 @@ var addRowTo = (function() {
tr = d.createElement("tr");
for (i = 0; i < field_counter_js; i++) {
td = d.createElement("td");
if(rowtype[i] == 'textbox') {
if(typeof(rowtype[i]) == 'function') {
td.innerHTML="<INPUT type='hidden' value='" + totalrows +"' name='" + rowname[i] + "_row-" + totalrows + "'></input>" + rowtype[i](rowname[i], rowsize[i], totalrows) + " ";
} else if(rowtype[i] == 'textbox') {
td.innerHTML="<INPUT type='hidden' value='" + totalrows +"' name='" + rowname[i] + "_row-" + totalrows + "'></input><input size='" + rowsize[i] + "' class='formfld unknown' name='" + rowname[i] + totalrows + "' id='" + rowname[i] + totalrows + "'></input> ";
} else if(rowtype[i] == 'password') {
td.innerHTML="<INPUT type='hidden' value='" + totalrows +"' name='" + rowname[i] + "_row-" + totalrows + "'></input><input type='password' size='" + rowsize[i] + "' class='formfld pwd' name='" + rowname[i] + totalrows + "' id='" + rowname[i] + totalrows + "'></input> ";

4
usr/local/www/javascript/row_helper_dynamic.js
View File

@ -27,7 +27,9 @@ var addRowTo = (function() {
objectSize = rowsize[i];
for (i = 0; i < field_counter_js; i++) {
td = d.createElement("td");
if(rowtype[i] == 'textbox') {
if(typeof(rowtype[i]) == 'function') {
td.innerHTML="<INPUT type='hidden' value='" + totalrows +"' name='" + rowname[i] + "_row-" + totalrows + "'></input>" + rowtype[i](rowname[i], objectSize, totalrows) + " ";
} else if(rowtype[i] == 'textbox') {
td.innerHTML="<INPUT type='hidden' value='" + totalrows +"' name='" + rowname[i] + "_row-" + totalrows + "'></input><input size='" + objectSize + "' name='" + rowname[i] + totalrows + "' id='" + rowname[i] + totalrows + "'></input> ";
} else if(rowtype[i] == 'select') {
td.innerHTML="<INPUT type='hidden' value='" + totalrows +"' name='" + rowname[i] + "_row-" + totalrows + "'></input><select name='" + rowname[i] + totalrows + "' id='" + rowname[i] + totalrows + "'>" + newrow[i] + "</select> ";

2
usr/local/www/load_balancer_monitor_edit.php
View File

@ -355,7 +355,7 @@ function updateType(t){
<td width="78%">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>"><input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
<?php if (isset($id) && $a_monitor[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

2
usr/local/www/load_balancer_pool_edit.php
View File

@ -297,7 +297,7 @@ echo "</select>";
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>" onClick="AllServers('serversSelect', true); AllServers('serversDisabledSelect', true);">
<input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
<?php if (isset($id) && $a_pool[$id] && $_GET['act'] != 'dup'): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

10
usr/local/www/load_balancer_relay_action_edit.php
View File

@ -392,10 +392,10 @@ function num_options() {
document.observe("dom:loaded", function() {
updateProtocol('<?=$pconfig['protocol']?>');
updateDirection('<?=$pconfig['direction']?>');
updateType('<?=$pconfig['type']?>');
updateAction('<?=$pconfig['action']?>');
updateProtocol('<?=htmlspecialchars($pconfig['protocol'])?>');
updateDirection('<?=htmlspecialchars($pconfig['direction'])?>');
updateType('<?=htmlspecialchars($pconfig['type'])?>');
updateAction('<?=htmlspecialchars($pconfig['action'])?>');
});
</script>
@ -556,7 +556,7 @@ document.observe("dom:loaded", function() {
<td width="78%">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>"><input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
<?php if (isset($id) && $a_action[$id] && $_GET['act'] != 'dup'): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

2
usr/local/www/load_balancer_relay_protocol_edit.php
View File

@ -279,7 +279,7 @@ echo "</select>";
<td width="78%">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>" onClick="AllOptions($('lbaction'), true); AllOptions($('available_action'), false);"><input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
<?php if (isset($id) && $a_protocol[$id] && $_GET['act'] != 'dup'): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

10
usr/local/www/load_balancer_virtual_server_edit.php
View File

@ -167,7 +167,7 @@ document.observe("dom:loaded", function() {
});
// Go ahead and disable the relay stuff, we'll trigger
updateRelay("<?=$pconfig['mode'];?>");
updateRelay("<?=htmlspecialchars($pconfig['mode']);?>");
});
@ -231,7 +231,7 @@ document.observe("dom:loaded", function() {
<b><?=gettext("NOTE:"); ?></b> <?=gettext("Please add a pool on the Pools tab to use this feature."); ?>
<?php else: ?>
<select id="sitedown" name="sitedown">
<option value=""<?=$pconfig['sitedown'] == '' ? ' selected' : ''?>><?=gettext("none"); ?></option>
<option value=""<?=htmlspecialchars($pconfig['sitedown']) == '' ? ' selected' : ''?>><?=gettext("none"); ?></option>
<?php
for ($i = 0; isset($config['load_balancer']['lbpool'][$i]); $i++) {
$selected = "";
@ -250,8 +250,8 @@ document.observe("dom:loaded", function() {
<tr align="left">
<td width="22%" valign="top" class="vncellreq">Mode</td>
<td width="78%" class="vtable" colspan="2">
<input id="redirect_mode" type="radio" name="mode" value="redirect"<?=$pconfig['mode'] == 'redirect' ? ' checked="checked"': ''?>> Redirect
<input id="relay_mode" type="radio" name="mode" value="relay"<?=$pconfig['mode'] == 'relay' ? ' checked="checked"': ''?>> Relay
<input id="redirect_mode" type="radio" name="mode" value="redirect"<?=htmlspecialchars($pconfig['mode']) == 'redirect' ? ' checked="checked"': ''?>> Redirect
<input id="relay_mode" type="radio" name="mode" value="relay"<?=htmlspecialchars($pconfig['mode']) == 'relay' ? ' checked="checked"': ''?>> Relay
<br>
</td>
@ -278,7 +278,7 @@ document.observe("dom:loaded", function() {
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Submit"); ?>">
<input type="button" class="formbtn" value="<?=gettext("Cancel"); ?>" onclick="history.back()">
<?php if (isset($id) && $a_vs[$id] && $_GET['act'] != 'dup'): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

11
usr/local/www/pkg.php
View File

@ -45,7 +45,7 @@ function gentitle_pkg($pgname) {
return $config['system']['hostname'] . "." . $config['system']['domain'] . " - " . $pgname;
}
$xml = htmlspecialchars($_REQUEST['xml']);
$xml = $_REQUEST['xml'];
if($xml == "") {
print_info_box_np(gettext("ERROR: No package defined."));
@ -53,6 +53,10 @@ if($xml == "") {
} else {
if(file_exists("/usr/local/pkg/" . $xml))
$pkg = parse_xml_config_pkg("/usr/local/pkg/" . $xml, "packagegui");
else {
echo "File not found " . htmlspecialchars($xml);
exit;
}
}
if($pkg['donotsave'] <> "") {
@ -410,11 +414,6 @@ if ($pkg['tabs'] <> "") {
</form>
<?php include("fend.inc"); ?>
<script type="text/javascript">
NiftyCheck();
Rounded("div#mainarea","bl br","#FFF","#eeeeee","smooth");
</script>
<?php
echo "<!-- filter_fieldname: {$filter_fieldname} -->";
echo "<!-- filter_regex: {$filter_regex} -->";

12
usr/local/www/pkg_edit.php
View File

@ -83,6 +83,12 @@ $pgtitle = $title;
$id = $_GET['id'];
if (isset($_POST['id']))
$id = htmlspecialchars($_POST['id']);
if(!is_numeric($id)) {
Header("Location: /");
exit;
}
// Not posting? Then user is editing a record. There must be a valid id
// when editing a record.
@ -725,7 +731,7 @@ if ($pkg['tabs'] <> "") {
$rowcounter++;
echo "<td>";
echo "<input type=\"image\" src=\"./themes/".$g['theme']."/images/icons/icon_x.gif\" onclick=\"removeRow(this); return false;\" value=\"" . gettext("Delete") . "\">";
echo "<a onclick=\"removeRow(this); return false;\" href=\"#\"><img border=\"0\" src=\"./themes/".$g['theme']."/images/icons/icon_x.gif\" /></a>";
echo "</td>\n";
echo "</tr>\n";
}
@ -762,7 +768,7 @@ if ($pkg['tabs'] <> "") {
$rowcounter++;
echo "<td>";
echo "<input type=\"image\" src=\"./themes/".$g['theme']."/images/icons/icon_x.gif\" onclick=\"removeRow(this); return false;\" value=\"" . gettext("Delete") . "\">";
echo "<a onclick=\"removeRow(this); return false;\" href=\"#\"><img border=\"0\" src=\"./themes/".$g['theme']."/images/icons/icon_x.gif\" /></a>";
echo "</td>\n";
echo "</tr>\n";
}
@ -863,7 +869,7 @@ function display_row($trc, $value, $fieldname, $type, $rowhelper, $size) {
global $text, $config;
echo "<td>\n";
if($type == "input") {
echo "<input size='" . $size . "' name='" . $fieldname . $trc . "' id='" . $fieldname . $trc . "' value='" . $value . "'>\n";
echo "<input size='" . $size . "' name='" . $fieldname . $trc . "' id='" . $fieldname . $trc . "' class='formfld unknown' value='" . $value . "'>\n";
} else if($type == "checkbox") {
if($value)
echo "<input size='" . $size . "' type='checkbox' id='" . $fieldname . $trc . "' name='" . $fieldname . $trc . "' value='ON' CHECKED>\n";

2
usr/local/www/services_captiveportal_ip_edit.php
View File

@ -207,7 +207,7 @@ include("head.inc");
<td width="78%">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>">
<?php if (isset($id) && $a_allowedips[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

2
usr/local/www/services_captiveportal_mac_edit.php
View File

@ -184,7 +184,7 @@ include("head.inc");
<td width="78%">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>">
<?php if (isset($id) && $a_passthrumacs[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
<?php if (isset($pconfig['username']) && $pconfig['username']): ?>
<input name="username" type="hidden" value="<?=htmlspecialchars($pconfig['username']);?>">

2
usr/local/www/services_captiveportal_vouchers_edit.php
View File

@ -191,7 +191,7 @@ include("head.inc");
<td width="78%">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save"); ?>">
<?php if (isset($id) && $a_roll[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

86
usr/local/www/services_dhcp.php
View File

@ -198,7 +198,8 @@ if ($_POST) {
if(isset($_POST["number{$x}"]) && ctype_digit($_POST["number{$x}"])) {
$numbervalue = array();
$numbervalue['number'] = htmlspecialchars($_POST["number{$x}"]);
$numbervalue['value'] = htmlspecialchars($_POST["value{$x}"]);
$numbervalue['type'] = htmlspecialchars($_POST["itemtype{$x}"]);
$numbervalue['value'] = str_replace('&quot;', '"', htmlspecialchars($_POST["value{$x}"]));
$numberoptions['item'][] = $numbervalue;
}
}
@ -260,6 +261,31 @@ if ($_POST) {
if ($_POST['staticarp'] && $noip)
$input_errors[] = "Cannot enable static ARP when you have static map entries without IP addresses. Ensure all static maps have IP addresses and try again.";
if(is_array($pconfig['numberoptions']['item'])) {
foreach ($pconfig['numberoptions']['item'] as $numberoption) {
if ( $numberoption['type'] == 'text' && strstr($numberoption['value'], '"') )
$input_errors[] = gettext("Text type cannot include quotation marks.");
else if ( $numberoption['type'] == 'string' && !preg_match('/^"[^"]*"$/', $numberoption['value']) && !preg_match('/^[0-9a-z]{2}(?:\:[0-9a-z]{2})*$/i', $numberoption['value']) )
$input_errors[] = gettext("String type must be enclosed in quotes like \"this\" or must be a series of octets specified in hexadecimal, separated by colons, like 01:23:45:67:89:ab:cd:ef");
else if ( $numberoption['type'] == 'flag' && $numberoption['value'] != 'true' && $numberoption['value'] != 'false' && $numberoption['value'] != 'on' && $numberoption['value'] != 'off' )
$input_errors[] = gettext("Boolean type must be true, false, on, or off.");
else if ( $numberoption['type'] == 'uint8' && (!is_numeric($numberoption['value']) || $numberoption['value'] < 0 || $numberoption['value'] > 255) )
$input_errors[] = gettext("Unsigned 8-bit integer type must be a number in the range 0 to 255.");
else if ( $numberoption['type'] == 'uint16' && (!is_numeric($numberoption['value']) || $numberoption['value'] < 0 || $numberoption['value'] > 65535) )
$input_errors[] = gettext("Unsigned 16-bit integer type must be a number in the range 0 to 65535.");
else if ( $numberoption['type'] == 'uint32' && (!is_numeric($numberoption['value']) || $numberoption['value'] < 0 || $numberoption['value'] > 4294967295) )
$input_errors[] = gettext("Unsigned 32-bit integer type must be a number in the range 0 to 4294967295.");
else if ( $numberoption['type'] == 'int8' && (!is_numeric($numberoption['value']) || $numberoption['value'] < -128 || $numberoption['value'] > 127) )
$input_errors[] = gettext("Signed 8-bit integer type must be a number in the range -128 to 127.");
else if ( $numberoption['type'] == 'int16' && (!is_numeric($numberoption['value']) || $numberoption['value'] < -32768 || $numberoption['value'] > 32767) )
$input_errors[] = gettext("Signed 16-bit integer type must be a number in the range -32768 to 32767.");
else if ( $numberoption['type'] == 'int32' && (!is_numeric($numberoption['value']) || $numberoption['value'] < -2147483648 || $numberoption['value'] > 2147483647) )
$input_errors[] = gettext("Signed 32-bit integer type must be a number in the range -2147483648 to 2147483647.");
else if ( $numberoption['type'] == 'ip-address' && !is_ipaddr($numberoption['value']) && !is_hostname($numberoption['value']) )
$input_errors[] = gettext("IP address or host type must be an IP address or host name.");
}
}
if (!$input_errors) {
/* make sure the range lies within the current subnet */
$subnet_start = ip2ulong(long2ip32(ip2long($ifcfgip) & gen_subnet_mask_long($ifcfgsn)));
@ -401,12 +427,25 @@ include("head.inc");
</script>
<script type="text/javascript">
function itemtype_field(fieldname, fieldsize, n) {
return '<select name="' + fieldname + n + '" class="formselect" id="' + fieldname + n + '"><?php
$customitemtypes = array('text' => gettext('Text'), 'string' => gettext('String'), 'flag' => gettext('Boolean'),
'uint8' => gettext('Unsigned 8-bit integer'), 'uint16' => gettext('Unsigned 16-bit integer'), 'uint32' => gettext('Unsigned 32-bit integer'),
'int8' => gettext('Signed 8-bit integer'), 'int16' => gettext('Signed 16-bit integer'), 'int32' => gettext('Signed 32-bit integer'), 'ip-address' => gettext('IP address or host'));
foreach ($customitemtypes as $typename => $typedescr) {
echo "<option value=\"{$typename}\">{$typedescr}</option>";
}
?></select>';
}
rowname[0] = "number";
rowtype[0] = "textbox";
rowsize[0] = "10";
rowname[1] = "value";
rowtype[1] = "textbox";
rowsize[1] = "55";
rowname[1] = "itemtype";
rowtype[1] = itemtype_field;
rowname[2] = "value";
rowtype[2] = "textbox";
rowsize[2] = "40";
</script>
<script type="text/javascript" language="JavaScript">
@ -768,7 +807,8 @@ include("head.inc");
</tr>
<tr>
<td><div id="onecolumn"><?=gettext("Number");?></div></td>
<td><div id="twocolumn"><?=gettext("Value");?></div></td>
<td><div id="twocolumn"><?=gettext("Type");?></div></td>
<td><div id="threecolumn"><?=gettext("Value");?></div></td>
</tr>
<?php $counter = 0; ?>
<?php
@ -777,6 +817,7 @@ include("head.inc");
?>
<?php
$number = $item['number'];
$itemtype = $item['type'];
$value = $item['value'];
?>
<tr>
@ -784,10 +825,21 @@ include("head.inc");
<input autocomplete="off" name="number<?php echo $counter; ?>" type="text" class="formfld" id="number<?php echo $counter; ?>" size="10" value="<?=htmlspecialchars($number);?>" />
</td>
<td>
<input autocomplete="off" name="value<?php echo $counter; ?>" type="text" class="formfld" id="value<?php echo $counter; ?>" size="55" value="<?=htmlspecialchars($value);?>" />
<select name="itemtype<?php echo $counter; ?>" class="formselect" id="itemtype<?php echo $counter; ?>">
<?php
foreach ($customitemtypes as $typename => $typedescr) {
echo "<option value=\"{$typename}\" ";
if ($itemtype == $typename) echo "selected";
echo ">" . $typedescr . "</option>";
}
?>
</select>
</td>
<td>
<input type="image" src="/themes/<?echo $g['theme'];?>/images/icons/icon_x.gif" onclick="removeRow(this); return false;" value="<?=gettext("Delete");?>" />
<input autocomplete="off" name="value<?php echo $counter; ?>" type="text" class="formfld" id="value<?php echo $counter; ?>" size="40" value="<?=htmlspecialchars($value);?>" />
</td>
<td>
<a onclick="removeRow(this); return false;" href="#"><img border="0" src="/themes/<?echo $g['theme'];?>/images/icons/icon_x.gif" /></a>
</td>
</tr>
<?php $counter++; ?>
@ -800,7 +852,7 @@ include("head.inc");
<img border="0" src="/themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" alt="" title="<?=gettext("add another entry");?>" />
</a>
<script type="text/javascript">
field_counter_js = 2;
field_counter_js = 3;
rows = 1;
totalrows = <?php echo $counter; ?>;
loaded = <?php echo $counter; ?>;
@ -812,7 +864,7 @@ include("head.inc");
<tr>
<td width="22%" valign="top">&nbsp;</td>
<td width="78%">
<input name="if" type="hidden" value="<?=$if;?>">
<input name="if" type="hidden" value="<?=htmlspecialchars($if);?>">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save");?>" onclick="enable_change(true)">
</td>
</tr>
@ -840,7 +892,7 @@ include("head.inc");
<table border="0" cellspacing="0" cellpadding="1">
<tr>
<td valign="middle" width="17"></td>
<td valign="middle"><a href="services_dhcp_edit.php?if=<?=$if;?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" width="17" height="17" border="0"></a></td>
<td valign="middle"><a href="services_dhcp_edit.php?if=<?=htmlspecialchars($if);?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" width="17" height="17" border="0"></a></td>
</tr>
</table>
</td>
@ -849,23 +901,23 @@ include("head.inc");
<?php $i = 0; foreach ($a_maps as $mapent): ?>
<?php if($mapent['mac'] <> "" or $mapent['ipaddr'] <> ""): ?>
<tr>
<td class="listlr" ondblclick="document.location='services_dhcp_edit.php?if=<?=$if;?>&id=<?=$i;?>';">
<td class="listlr" ondblclick="document.location='services_dhcp_edit.php?if=<?=htmlspecialchars($if);?>&id=<?=$i;?>';">
<?=htmlspecialchars($mapent['mac']);?>
</td>
<td class="listr" ondblclick="document.location='services_dhcp_edit.php?if=<?=$if;?>&id=<?=$i;?>';">
<td class="listr" ondblclick="document.location='services_dhcp_edit.php?if=<?=htmlspecialchars($if);?>&id=<?=$i;?>';">
<?=htmlspecialchars($mapent['ipaddr']);?>&nbsp;
</td>
<td class="listr" ondblclick="document.location='services_dhcp_edit.php?if=<?=$if;?>&id=<?=$i;?>';">
<td class="listr" ondblclick="document.location='services_dhcp_edit.php?if=<?=htmlspecialchars($if);?>&id=<?=$i;?>';">
<?=htmlspecialchars($mapent['hostname']);?>&nbsp;
</td>
<td class="listbg" ondblclick="document.location='services_dhcp_edit.php?if=<?=$if;?>&id=<?=$i;?>';">
<td class="listbg" ondblclick="document.location='services_dhcp_edit.php?if=<?=htmlspecialchars($if);?>&id=<?=$i;?>';">
<?=htmlspecialchars($mapent['descr']);?>&nbsp;
</td>
<td valign="middle" nowrap class="list">
<table border="0" cellspacing="0" cellpadding="1">
<tr>
<td valign="middle"><a href="services_dhcp_edit.php?if=<?=$if;?>&id=<?=$i;?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" width="17" height="17" border="0"></a></td>
<td valign="middle"><a href="services_dhcp.php?if=<?=$if;?>&act=del&id=<?=$i;?>" onclick="return confirm('<?=gettext("Do you really want to delete this mapping?");?>')"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" width="17" height="17" border="0"></a></td>
<td valign="middle"><a href="services_dhcp_edit.php?if=<?=htmlspecialchars($if);?>&id=<?=$i;?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_e.gif" width="17" height="17" border="0"></a></td>
<td valign="middle"><a href="services_dhcp.php?if=<?=htmlspecialchars($if);?>&act=del&id=<?=$i;?>" onclick="return confirm('<?=gettext("Do you really want to delete this mapping?");?>')"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_x.gif" width="17" height="17" border="0"></a></td>
</tr>
</table>
</td>
@ -879,7 +931,7 @@ include("head.inc");
<table border="0" cellspacing="0" cellpadding="1">
<tr>
<td valign="middle" width="17"></td>
<td valign="middle"><a href="services_dhcp_edit.php?if=<?=$if;?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" width="17" height="17" border="0"></a></td>
<td valign="middle"><a href="services_dhcp_edit.php?if=<?=htmlspecialchars($if);?>"><img src="./themes/<?= $g['theme']; ?>/images/icons/icon_plus.gif" width="17" height="17" border="0"></a></td>
</tr>
</table>
</td>

4
usr/local/www/services_dhcp_edit.php
View File

@ -253,9 +253,9 @@ include("head.inc");
<td width="78%">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save");?>"> <input class="formbtn" type="button" value="<?=gettext("Cancel");?>" onclick="history.back()">
<?php if (isset($id) && $a_maps[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
<input name="if" type="hidden" value="<?=$if;?>">
<input name="if" type="hidden" value="<?=htmlspecialchars($if);?>">
</td>
</tr>
</table>

2
usr/local/www/services_dnsmasq_domainoverride_edit.php
View File

@ -129,7 +129,7 @@ include("head.inc");
<td width="78%">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save");?>"> <input class="formbtn" type="button" value="<?=gettext("Cancel");?>" onclick="history.back()">
<?php if (isset($id) && $a_domainOverrides[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

2
usr/local/www/services_dnsmasq_edit.php
View File

@ -170,7 +170,7 @@ include("head.inc");
<td width="78%">
<input name="Submit" type="submit" class="formbtn" value="<?=gettext("Save");?>"> <input class="formbtn" type="button" value="<?=gettext("Cancel");?>" onclick="history.back()">
<?php if (isset($id) && $a_hosts[$id]): ?>
<input name="id" type="hidden" value="<?=$id;?>">
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>">
<?php endif; ?>
</td>
</tr>

Some files were not shown because too many files have changed in this diff Show More