diff --git a/etc/inc/IPv6.inc b/etc/inc/IPv6.inc
index 8896ef6627..f7e85deaa4 100644
--- a/etc/inc/IPv6.inc
+++ b/etc/inc/IPv6.inc
@@ -919,4 +919,4 @@ class Net_IPv6 {
* End:
*/
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/PEAR.inc b/etc/inc/PEAR.inc
index 26d11596bf..68d30fa136 100644
--- a/etc/inc/PEAR.inc
+++ b/etc/inc/PEAR.inc
@@ -1056,4 +1056,5 @@ class PEAR_Error
* c-basic-offset: 4
* End:
*/
+
?>
\ No newline at end of file
diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index 13ca678366..dbd8a3e790 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -86,6 +86,32 @@ if (function_exists("display_error_form") && !isset($config['system']['webgui'][
}
}
+// If the HTTP_REFERER is something other than ourselves then disallow.
+if(function_exists("display_error_form") && !$config['system']['nohttpreferercheck']) {
+ if($_SERVER['HTTP_REFERER']) {
+ $found_host = false;
+ $hostname_me = $config['system']['hostname'] . "." . $config['system']['domain'];
+ if(stristr($_SERVER['HTTP_REFERER'], $hostname_me))
+ $found_host = true;
+ if(!empty($config['system']['webgui']['althostnames'])) {
+ $althosts = explode(" ", $config['system']['webgui']['althostnames']);
+ foreach ($althosts as $ah)
+ if(stristr($ah, $hostname_me))
+ $found_host = true;
+ }
+ $interface_list_ips = get_configured_ip_addresses();
+ foreach($interface_list_ips as $ilips) {
+ $hostname_me_ip = $config['webgui']['protocol'] . "://" . $ilips;
+ if(stristr($_SERVER['HTTP_REFERER'],$hostname_me_ip))
+ $found_host = true;
+ }
+ if($found_host == false) {
+ display_error_form("501", "An HTTP_REFERER was detected other than what is defined in System -> Advanced (" . htmlspecialchars($_SERVER['HTTP_REFERER']) . "). You can disable this check if needed in System -> Advanced -> Admin.");
+ exit;
+ }
+ }
+}
+
$groupindex = index_groups();
$userindex = index_users();
@@ -449,6 +475,7 @@ function local_user_set_groups($user, $new_groups = NULL ) {
$group['member'][] = $user['uid'];
$mod_groups[] = $group;
}
+ unset($group);
/* determine which memberships to remove */
foreach ($cur_groups as $groupname) {
@@ -463,6 +490,7 @@ function local_user_set_groups($user, $new_groups = NULL ) {
$mod_groups[] = $group;
}
}
+ unset($group);
/* sync all modified groups */
foreach ($mod_groups as $group)
@@ -1244,4 +1272,4 @@ function session_auth() {
return true;
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/certs.inc b/etc/inc/certs.inc
index f177c9e274..33aac66d18 100644
--- a/etc/inc/certs.inc
+++ b/etc/inc/certs.inc
@@ -556,4 +556,4 @@ function is_crl_internal($crl) {
return !(!empty($crl['text']) && empty($crl['cert']));
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/config.lib.inc b/etc/inc/config.lib.inc
index 7b27b7a81a..4feef0f615 100644
--- a/etc/inc/config.lib.inc
+++ b/etc/inc/config.lib.inc
@@ -803,4 +803,4 @@ function set_device_perms() {
}
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/dyndns.class b/etc/inc/dyndns.class
index a07a7937b1..247fa680ab 100644
--- a/etc/inc/dyndns.class
+++ b/etc/inc/dyndns.class
@@ -921,4 +921,4 @@
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/easyrule.inc b/etc/inc/easyrule.inc
index af3f270aaf..0679060b66 100644
--- a/etc/inc/easyrule.inc
+++ b/etc/inc/easyrule.inc
@@ -329,4 +329,5 @@ function easyrule_parse_pass($int, $proto, $src, $dst, $dstport = 0) {
}
return "Unknown pass error.";
}
-?>
+
+?>
\ No newline at end of file
diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index 2b338583b9..063d0ec048 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -5,7 +5,7 @@
Copyright (C) 2004-2006 Scott Ullrich
Copyright (C) 2005 Bill Marquette
Copyright (C) 2006 Peter Allgeyer
- Copyright (C) 2008 Ermal Luci
+ Copyright (C) 2008-2010 Ermal Luci
All rights reserved.
originally part of m0n0wall (http://m0n0.ch/wall)
@@ -126,9 +126,9 @@ function filter_pflog_start() {
echo "filter_pflog_start() being called $mt\n";
}
mute_kernel_msgs();
- $pid = 0;
- $pid = `/bin/pgrep -f "tcpdump -s 256 -v -l -n -e -ttt -i pflog0"`;
- if(!$pid)
+ $output = 0;
+ exec("/bin/pgrep -f 'tcpdump -s 256 -v -l -n -e -ttt -i pflog0'", $output, $retval);
+ if($retval != 0)
mwexec_bg("/usr/sbin/tcpdump -s 256 -v -l -n -e -ttt -i pflog0 | logger -t pf -p local0.info");
unmute_kernel_msgs();
}
@@ -887,7 +887,7 @@ function filter_generate_reflection_nat($rule, $nat_ifs, $protocol, $target, $ta
return $natrules;
}
-function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_port, $dstport, &$starting_localhost_port, &$reflection_txt) {
+function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_port, &$starting_localhost_port, &$reflection_txt) {
global $FilterIflist, $config;
// Initialize natrules holder string
@@ -908,16 +908,43 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_
$natrules .= "\n# Reflection redirects\n";
- if($dstport[1])
- $range_end = ($dstport[1]);
- else
- $range_end = ($dstport[0]);
+ $localport = $rule['local-port'];
+ if(!empty($localport) && is_alias($localport)) {
+ $localport = filter_expand_alias($localport);
+ $localport = explode(" ", trim($localport));
+ // The translation port for rdr, when specified, does not support more than one port or range.
+ // Emulating for behavior consistent with the original port forward.
+ $localport = $localport[0];
+ }
+
+ if(is_alias($rule['destination']['port'])) {
+ if(empty($localport) || $rule['destination']['port'] == $rule['local-port']) {
+ $dstport = filter_expand_alias($rule['destination']['port']);
+ $dstport = array_filter(explode(" ", trim($dstport)));
+ $localport = "";
+ } else if(!empty($localport)) {
+ $dstport = array($localport);
+ }
+ } else {
+ $dstport = array(str_replace("-", ":", $rule['destination']['port']));
+ $dstport_split = explode(":", $dstport[0]);
+
+ if(!empty($localport) && $dstport_split[0] != $rule['local-port']) {
+ if(!is_alias($rule['local-port']) && $dstport_split[1] && $dstport_split[0] != $dstport_split[1]) {
+ $localendport = $localport + ($dstport_split[1] - $dstport_split[0]);
+ $localport .= ":$localendport";
+ }
+
+ $dstport = array($localport);
+ } else
+ $localport = "";
+ }
$dstaddr = explode(" ", $dstaddr_port);
if($dstaddr[2])
$rflctintrange = $dstaddr[2];
else
- $rflctintrange = "";
+ return "";
$dstaddr = $dstaddr[0];
if(empty($dstaddr) || trim($dstaddr) == "0.0.0.0" || strtolower(trim($dstaddr)) == "port")
return "";
@@ -968,67 +995,77 @@ function filter_generate_reflection($rule, $nordr, $rdr_ifs, $srcaddr, $dstaddr_
else
return "";
- if($rule['local-port'])
- $lrange_start = $rule['local-port'];
- if(($range_end + 1) - $dstport[0] > 500) {
- log_error("Not installing nat reflection rules for a port range > 500");
+ $starting_localhost_port_tmp = $starting_localhost_port;
+ $toomanyports = false;
/* only install reflection rules for < 19991 items */
- } else if($starting_localhost_port < 19991) {
- $loc_pt = $lrange_start;
- $rflctnorange = true;
- if(is_alias($loc_pt)) {
- $loc_pt_translated = filter_expand_alias($loc_pt);
- if(empty($loc_pt_translated)) {
- log_error("Reflection processing: {$loc_pt} is not a vaild port alias.");
- continue;
- }
- $toadd_array = split(" ", $loc_pt_translated);
- $rflctnorange = false;
- }
-
- $inetdport = $starting_localhost_port;
- if($range_end > $dstport[0]) {
- $rflctrange = "{$starting_localhost_port}";
- $delta = $range_end - $dstport[0];
- if(($starting_localhost_port + $delta) > 19990) {
- log_error("Installing partial nat reflection rules. Maximum 1,000 reached.");
- $delta = 19990 - $starting_localhost_port;
- $range_end = $dstport[0] + $delta;
- $rflctintrange = "";
- }
- $starting_localhost_port = $starting_localhost_port + $delta;
- $rflctrange .= ":{$starting_localhost_port}";
- if(empty($rflctintrange))
- $rflctintrange = "{$dstport[0]}:{$range_end}";
- if($rflctnorange)
- $toadd_array = range($loc_pt, $loc_pt + $delta);
- $starting_localhost_port++;
- } else {
+ foreach($dstport as $loc_pt) {
+ if($starting_localhost_port < 19991) {
+ $toadd_array = array();
+ $inetdport = $starting_localhost_port;
$rflctrange = $starting_localhost_port;
- if(empty($rflctintrange))
- $rflctintrange = $dstport[0];
- if($rflctnorange)
- $toadd_array = array($loc_pt);
- $starting_localhost_port++;
+
+ $loc_pt = explode(":", $loc_pt);
+ if($loc_pt[1] && $loc_pt[1] > $loc_pt[0])
+ $delta = $loc_pt[1] - $loc_pt[0];
+ else
+ $delta = 0;
+
+ if(($inetdport + $delta + 1) - $starting_localhost_port_tmp > 500) {
+ log_error("Not installing nat reflection rules for a port range > 500");
+ $inetdport = $starting_localhost_port;
+ $toadd_array = array();
+ $toomanyports = true;
+ break;
+ } else if(($inetdport + $delta) > 19990) {
+ log_error("Installing partial nat reflection rules. Maximum 1,000 reached.");
+ $delta = 19990 - $inetdport;
+ $loc_pt[1] = $loc_pt[0] + $delta;
+ if($delta == 0)
+ unset($loc_pt[1]);
+ $toomanyports = true;
+
+ if(!empty($localport)) {
+ if(is_alias($rule['destination']['port'])) {
+ $rflctintrange = alias_expand($rule['destination']['port']);
+ } else {
+ if($dstport_split[1])
+ $dstport_split[1] = $dstport_split[0] + $inetdport + $delta - $starting_localhost_port;
+ $rflctintrange = implode(":", $dstport_split);
+ }
+ }
+ }
+
+ if(empty($localport))
+ $rflctintrange = implode(":", $loc_pt);
+ if($inetdport + $delta > $starting_localhost_port)
+ $rflctrange .= ":" . ($inetdport + $delta);
+ $starting_localhost_port = $inetdport + $delta + 1;
+ $toadd_array = array_merge($toadd_array, range($loc_pt[0], $loc_pt[0] + $delta));
+
+ if(!empty($toadd_array)) {
+ foreach($toadd_array as $tda) {
+ if (empty($tda))
+ continue;
+ foreach($reflect_protos as $reflect_proto) {
+ if($reflect_proto == "udp") {
+ $socktype = "dgram";
+ $dash_u = "-u ";
+ } else {
+ $socktype = "stream";
+ $dash_u = "";
+ }
+ $reflection_txt[] = "{$inetdport}\t{$socktype}\t{$reflect_proto}\tnowait/0\tnobody\t/usr/bin/nc\tnc {$dash_u}-w {$reflectiontimeout} {$target} {$tda}\n";
+ }
+ $inetdport++;
+ }
+ $natrules .= "rdr on {$rdr_if_list} proto {$protocol} from {$srcaddr} to {$dstaddr} port {$rflctintrange} tag PFREFLECT -> 127.0.0.1 port {$rflctrange}\n";
+ }
}
- foreach($toadd_array as $tda) {
- if (empty($tda))
- continue;
- foreach($reflect_protos as $reflect_proto) {
- if($reflect_proto == "udp") {
- $socktype = "dgram";
- $dash_u = "-u ";
- } else {
- $socktype = "stream";
- $dash_u = "";
- }
- $reflection_txt[] = "{$inetdport}\t{$socktype}\t{$reflect_proto}\tnowait/0\tnobody\t/usr/bin/nc\tnc {$dash_u}-w {$reflectiontimeout} {$target} {$tda}\n";
- }
- $inetdport++;
- }
- $natrules .= "rdr on {$rdr_if_list} proto {$protocol} from {$srcaddr} to {$dstaddr} port {$rflctintrange} tag PFREFLECT -> 127.0.0.1 port {$rflctrange}\n";
+ if($toomanyports)
+ break;
}
+
$reflection_txt = array_unique($reflection_txt);
}
@@ -1447,7 +1484,7 @@ function filter_nat_rules_generate() {
$natrules .= "no nat on {$natif} proto tcp from ({$natif}) to {$rule_subnet}/{$rule_interface_subnet}\n";
$natrules .= "nat on {$natif} proto tcp from {$rule_subnet}/{$rule_interface_subnet} to {$target} port {$dstport[0]} -> ({$natif})\n";
}
- $natrules .= filter_generate_reflection($rule, $nordr, $nat_if_list, $srcaddr, $dstaddr, $dstport, $starting_localhost_port, $reflection_rules);
+ $natrules .= filter_generate_reflection($rule, $nordr, $nat_if_list, $srcaddr, $dstaddr, $starting_localhost_port, $reflection_rules);
$natrules .= "\n";
foreach ($reflection_rules as $txtline)
@@ -1652,22 +1689,23 @@ function filter_generate_user_rule($rule) {
$pptpdcfg = $config['pptpd'];
$pppoecfg = $config['pppoe'];
$int = "";
+ $aline = array();
+
/* Check to see if the interface is in our list */
if(isset($rule['floating'])) {
- if(isset($rule['interface']) && $rule['interface'] <> "") {
- $interfaces = explode(",", $rule['interface']);
- $ifliste = "";
- foreach ($interfaces as $iface) {
- if(array_key_exists($iface, $FilterIflist))
- $ifliste .= " " . $FilterIflist[$iface]['if'] . " ";
- }
- if($ifliste <> "")
- $aline['interface'] = " on { {$ifliste} }";
- else
- $aline['interface'] = "";
+ if(isset($rule['interface']) && $rule['interface'] <> "") {
+ $interfaces = explode(",", $rule['interface']);
+ $ifliste = "";
+ foreach ($interfaces as $iface) {
+ if(array_key_exists($iface, $FilterIflist))
+ $ifliste .= " " . $FilterIflist[$iface]['if'] . " ";
}
+ if($ifliste <> "")
+ $aline['interface'] = " on { {$ifliste} } ";
else
$aline['interface'] = "";
+ } else
+ $aline['interface'] = "";
} else if(!array_key_exists($rule['interface'], $FilterIflist)) {
foreach($FilterIflist as $oc) $item .= $oc['descr'];
return "# {$item} {$rule['interface']} array key does not exist for " . $rule['descr'];
@@ -1726,7 +1764,7 @@ function filter_generate_user_rule($rule) {
update_filter_reload_status("Setting up pass/block rules {$rule['descr']}");
/* do not process reply-to for gateway'd rules */
- if($rule['gateway'] == "" && interface_has_gateway($rule['interface']) && !isset($rule['disablereplyto'])) {
+ if($rule['gateway'] == "" && $aline['direction'] <> "" && interface_has_gateway($rule['interface']) && !isset($rule['disablereplyto'])) {
if($rule['ipprotocol'] == "inet6") {
$rg = get_interface_gateway_v6($rule['interface']);
if(is_ipaddrv6($rg)) {
@@ -2246,6 +2284,17 @@ pass out on \$IPsec all keep state label "IPsec internal host to host"
EOD;
if(!isset($config['system']['webgui']['noantilockout'])) {
+ $portarg = 80;
+ if (isset($config['system']['webgui']['port']) && $config['system']['webgui']['port'] <> "")
+ $portarg = "{$config['system']['webgui']['port']}";
+ if ($config['system']['webgui']['protocol'] == "https")
+ $portarg .= " 443 ";
+ $sshport = "";
+ if (isset($config['system']['enablesshd'])) {
+ $sshport = 22;
+ if($config['system']['ssh']['port'] <> "")
+ $sshport = $config['system']['ssh']['port'];
+ }
if(count($config['interfaces']) > 1 && !empty($FilterIflist['lan']['if'])) {
/* if antilockout is enabled, LAN exists and has
* an IP and subnet mask assigned
@@ -2254,7 +2303,7 @@ EOD;
$ipfrules .= <<
diff --git a/etc/inc/globals.inc b/etc/inc/globals.inc
index 5196dac7b6..b8593dca7c 100644
--- a/etc/inc/globals.inc
+++ b/etc/inc/globals.inc
@@ -165,4 +165,5 @@ $sysctls = array("net.inet.ip.portrange.first" => "1024",
);
$config_inc_loaded = false;
-?>
+
+?>
\ No newline at end of file
diff --git a/etc/inc/growl.class b/etc/inc/growl.class
index 883ec8bf82..33650ca8d0 100644
--- a/etc/inc/growl.class
+++ b/etc/inc/growl.class
@@ -99,4 +99,4 @@
}
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/interfaces.inc b/etc/inc/interfaces.inc
index 7e3c09c2ef..2bbc05b368 100644
--- a/etc/inc/interfaces.inc
+++ b/etc/inc/interfaces.inc
@@ -3364,9 +3364,6 @@ function get_interfaces_with_gateway() {
/* loop interfaces, check config for outbound */
foreach($config['interfaces'] as $ifdescr => $ifname) {
- if (substr($ifdescr, 0, 5) == "ovpnc")
- return true;
-
switch ($ifname['ipaddr']) {
case "dhcp":
case "carpdev-dhcp":
@@ -3378,7 +3375,8 @@ function get_interfaces_with_gateway() {
$ints[$ifdescr] = $ifdescr;
break;
default:
- if (!empty($ifname['gateway']))
+ if (substr($ifname['if'], 0, 5) == "ovpnc" ||
+ !empty($ifname['gateway']))
$ints[$ifdescr] = $ifdescr;
break;
}
@@ -3391,8 +3389,6 @@ function interface_has_gateway($friendly) {
global $config;
if (!empty($config['interfaces'][$friendly])) {
- if (substr($friendly, 0, 5) == "ovpnc")
- return true;
$ifname = &$config['interfaces'][$friendly];
switch ($ifname['ipaddr']) {
case "dhcp":
@@ -3404,6 +3400,8 @@ function interface_has_gateway($friendly) {
return true;
break;
default:
+ if (substr($ifname['if'], 0, 5) == "ovpnc")
+ return true;
if (!empty($ifname['gateway']))
return true;
break;
@@ -3439,9 +3437,9 @@ function is_altq_capable($int) {
if (in_array($int_family[0], $capable))
return true;
- else if (stristr($int_family, "vlan")) /* VLANs are name $parent_$vlan now */
+ else if (stristr($int, "vlan")) /* VLANs are name $parent_$vlan now */
return true;
- else if (stristr($int_family, "_wlan")) /* WLANs are name $parent_$wlan now */
+ else if (stristr($int, "_wlan")) /* WLANs are name $parent_$wlan now */
return true;
else
return false;
@@ -3594,7 +3592,13 @@ function setup_pppoe_reset_file($pppif, $iface="") {
$cron_file = "{$g['varetc_path']}/pppoe_restart_{$pppif}";
if(!empty($iface) && !empty($pppif)){
- $cron_cmd = "#!/bin/sh\necho '' | /usr/local/bin/php -q";
+ $cron_cmd = <<
+?>
\ No newline at end of file
diff --git a/etc/inc/itemid.inc b/etc/inc/itemid.inc
index dde376260a..787760d728 100644
--- a/etc/inc/itemid.inc
+++ b/etc/inc/itemid.inc
@@ -103,4 +103,4 @@ function get_unique_id(){
return uniqid("nat_", true);
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/led.inc b/etc/inc/led.inc
index ed67db514c..3f615baad6 100644
--- a/etc/inc/led.inc
+++ b/etc/inc/led.inc
@@ -350,4 +350,5 @@ function char_to_morse($char) {
break;
}
}
+
?>
\ No newline at end of file
diff --git a/etc/inc/meta.inc b/etc/inc/meta.inc
index 30903191ed..4091eac225 100644
--- a/etc/inc/meta.inc
+++ b/etc/inc/meta.inc
@@ -197,4 +197,4 @@ function read_file_metadata($fpath, & $metadata, $taglist = false) {
$metadata[$fname] = $tags;
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/notices.inc b/etc/inc/notices.inc
index fadd92bdba..34cbd82b2e 100644
--- a/etc/inc/notices.inc
+++ b/etc/inc/notices.inc
@@ -379,4 +379,4 @@ function register_via_growl() {
}
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/openvpn.auth-user.php b/etc/inc/openvpn.auth-user.php
index 544e21f32a..460d681776 100755
--- a/etc/inc/openvpn.auth-user.php
+++ b/etc/inc/openvpn.auth-user.php
@@ -121,4 +121,4 @@ syslog(LOG_WARNING, "user {$username} authenticated\n");
exit(0);
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/openvpn.inc b/etc/inc/openvpn.inc
index 341044c374..2750d01ff7 100644
--- a/etc/inc/openvpn.inc
+++ b/etc/inc/openvpn.inc
@@ -935,4 +935,4 @@ function openvpn_refresh_crls() {
}
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/pfsense-utils.inc b/etc/inc/pfsense-utils.inc
index 9214b6aa2a..ccc9745269 100644
--- a/etc/inc/pfsense-utils.inc
+++ b/etc/inc/pfsense-utils.inc
@@ -149,22 +149,13 @@ function get_tmp_file() {
******/
function get_dns_servers() {
$dns_servers = array();
- $dns = `cat /etc/resolv.conf`;
- $dns_s = split("\n", $dns);
+ $dns_s = file("/etc/resolv.conf", FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
foreach($dns_s as $dns) {
$matches = "";
if (preg_match("/nameserver (.*)/", $dns, $matches))
$dns_servers[] = $matches[1];
}
- $dns_server_master = array();
- $lastseen = "";
- foreach($dns_servers as $t) {
- if($t <> $lastseen)
- if($t <> "")
- $dns_server_master[] = $t;
- $lastseen = $t;
- }
- return $dns_server_master;
+ return array_unique($dns_servers);
}
/****f* pfsense-utils/enable_hardware_offloading
@@ -2131,4 +2122,32 @@ function get_country_name($country_code) {
return "";
}
+/* sort by interface only, retain the original order of rules that apply to
+ the same interface */
+function filter_rules_sort() {
+ global $config;
+
+ /* mark each rule with the sequence number (to retain the order while sorting) */
+ for ($i = 0; isset($config['filter']['rule'][$i]); $i++)
+ $config['filter']['rule'][$i]['seq'] = $i;
+
+ usort($config['filter']['rule'], "filter_rules_compare");
+
+ /* strip the sequence numbers again */
+ for ($i = 0; isset($config['filter']['rule'][$i]); $i++)
+ unset($config['filter']['rule'][$i]['seq']);
+}
+function filter_rules_compare($a, $b) {
+ if (isset($a['floating']) && isset($b['floating']))
+ return $a['seq'] - $b['seq'];
+ else if (isset($a['floating']))
+ return -1;
+ else if (isset($b['floating']))
+ return 1;
+ else if ($a['interface'] == $b['interface'])
+ return $a['seq'] - $b['seq'];
+ else
+ return compare_interface_friendly_names($a['interface'], $b['interface']);
+}
+
?>
diff --git a/etc/inc/pkg-utils.inc b/etc/inc/pkg-utils.inc
index adb2aa0ea4..49fd2c5d78 100644
--- a/etc/inc/pkg-utils.inc
+++ b/etc/inc/pkg-utils.inc
@@ -200,7 +200,7 @@ function resync_all_package_configs($show_message = false) {
}
}
if($show_message == true)
- echo "done.\n";
+ echo " done.\n";
@unlink("/conf/needs_package_sync");
}
@@ -953,7 +953,7 @@ function delete_package_xml($pkg) {
update_output_window($static_output);
}
if($pkg_config['include_file'] <> "") {
- $static_output = "\tRemoving pacakge instructions...";
+ $static_output = "\tRemoving package instructions...";
update_output_window($static_output);
fwrite($fd_log, "Remove '{$pkg_config['include_file']}'\n");
unlink_if_exists("/usr/local/pkg/" . $pkg_config['include_file']);
@@ -1078,4 +1078,4 @@ function squash_from_bytes($size, $round = "") {
return;
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/priv.defs.inc b/etc/inc/priv.defs.inc
index 7025a95b0c..6ba46d4fef 100644
--- a/etc/inc/priv.defs.inc
+++ b/etc/inc/priv.defs.inc
@@ -1164,4 +1164,4 @@ $priv_list['page-firewall-schedules-edit']['match'][] = "firewall_schedule_edit.
$priv_rmvd = array();
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/priv.inc b/etc/inc/priv.inc
index fa8092351c..f150aafced 100644
--- a/etc/inc/priv.inc
+++ b/etc/inc/priv.inc
@@ -285,4 +285,4 @@ function getAllowedPages($username) {
return $allowed_pages;
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/radius.inc b/etc/inc/radius.inc
index dddacc30cd..459b0cfd25 100644
--- a/etc/inc/radius.inc
+++ b/etc/inc/radius.inc
@@ -1126,4 +1126,4 @@ class Auth_RADIUS_Acct_Update extends Auth_RADIUS_Acct
var $status_type = RADIUS_UPDATE;
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/rrd.inc b/etc/inc/rrd.inc
index aaf4256aa5..f8f027b9aa 100644
--- a/etc/inc/rrd.inc
+++ b/etc/inc/rrd.inc
@@ -695,4 +695,4 @@ function kill_traffic_collector() {
mwexec("/bin/pkill -f updaterrd.sh", true);
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/service-utils.inc b/etc/inc/service-utils.inc
index 3f102b13e9..35889536cd 100644
--- a/etc/inc/service-utils.inc
+++ b/etc/inc/service-utils.inc
@@ -207,4 +207,4 @@ function is_service_running($service, $ps = "") {
return false;
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/services.inc b/etc/inc/services.inc
index 321720e362..f4f05e1b0f 100644
--- a/etc/inc/services.inc
+++ b/etc/inc/services.inc
@@ -207,7 +207,11 @@ function services_dhcpd_configure() {
foreach ($dhcpdcfg as $dhcpif => $dhcpifconf) {
if(is_array($dhcpifconf['numberoptions']) && is_array($dhcpifconf['numberoptions']['item'])) {
foreach($dhcpifconf['numberoptions']['item'] as $itemidx => $item) {
- $custoptions .= "option custom-{$dhcpif}-{$itemidx} code {$item['number']} = text;\n";
+ if(!empty($item['type']))
+ $itemtype = $item['type'];
+ else
+ $itemtype = "text";
+ $custoptions .= "option custom-{$dhcpif}-{$itemidx} code {$item['number']} = {$itemtype};\n";
}
}
}
@@ -487,7 +491,10 @@ EOD;
$dhcpdconf .= "\n";
if($dhcpifconf['numberoptions']['item']) {
foreach($dhcpifconf['numberoptions']['item'] as $itemidx => $item) {
- $dhcpdconf .= " option custom-{$dhcpif}-{$itemidx} \"{$item['value']}\";\n";
+ if(empty($item['type']) || $item['type'] == "text")
+ $dhcpdconf .= " option custom-{$dhcpif}-{$itemidx} \"{$item['value']}\";\n";
+ else
+ $dhcpdconf .= " option custom-{$dhcpif}-{$itemidx} {$item['value']};\n";
}
}
@@ -1049,6 +1056,7 @@ function services_snmpd_configure() {
/* kill any running snmpd */
sigkillbypid("{$g['varrun_path']}/snmpd.pid", "TERM");
+ sleep(2);
if(is_process_running("bsnmpd"))
mwexec("/usr/bin/killall bsnmpd", true);
@@ -1586,19 +1594,19 @@ EODAD;
/* configure cron service */
function configure_cron() {
global $g, $config;
+
conf_mount_rw();
/* preserve existing crontab entries */
- $crontab_contents = file_get_contents("/etc/crontab");
- $crontab_contents_a = split("\n", $crontab_contents);
+ $crontab_contents = file("/etc/crontab", FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
- for ($i = 0; $i < count($crontab_contents_a); $i++) {
- $item =& $crontab_contents_a[$i];
- if (strpos($item, "# pfSense specific crontab entries") !== false) {
- array_splice($crontab_contents_a, $i - 1);
+ for ($i = 0; $i < count($crontab_contents); $i++) {
+ $cron_item =& $crontab_contents[$i];
+ if (strpos($cron_item, "# pfSense specific crontab entries") !== false) {
+ array_splice($crontab_contents, $i - 1);
break;
}
}
- $crontab_contents = implode("\n", $crontab_contents_a) . "\n";
+ $crontab_contents = implode("\n", $crontab_contents) . "\n";
if (is_array($config['cron']['item'])) {
diff --git a/etc/inc/shaper.inc b/etc/inc/shaper.inc
index 201534cd57..02a1cd79fc 100644
--- a/etc/inc/shaper.inc
+++ b/etc/inc/shaper.inc
@@ -3785,7 +3785,7 @@ function &get_unique_queue_list() {
$qlist = array();
if (is_array($altq_list_queues)) {
foreach ($altq_list_queues as $altq) {
- if ($altq->GetEnabled())
+ if ($altq->GetEnabled() == "")
continue;
$tmplist =& $altq->get_queue_list();
foreach ($tmplist as $qname => $link) {
@@ -4006,4 +4006,4 @@ $dn_default_shaper_msg .= "";
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/system.inc b/etc/inc/system.inc
index 0845c8e475..97769666f2 100644
--- a/etc/inc/system.inc
+++ b/etc/inc/system.inc
@@ -210,13 +210,7 @@ function system_hosts_generate() {
}
$hostscfg = $dnsmasqcfg['hosts'];
- $fd = fopen("{$g['varetc_path']}/hosts", "w");
- if (!$fd) {
- log_error("Error: cannot open hosts file in system_hosts_generate().\n");
- return 1;
- }
-
- $hosts .= "127.0.0.1 localhost localhost.{$syscfg['domain']}\n";
+ $hosts = "127.0.0.1 localhost localhost.{$syscfg['domain']}\n";
if ($config['interfaces']['lan']) {
$cfgip = get_interface_ip("lan");
@@ -248,6 +242,20 @@ function system_hosts_generate() {
if ($host['ipaddr'] && $host['hostname'])
$hosts .= "{$host['ipaddr']} {$host['hostname']}.{$syscfg['domain']} {$host['hostname']}\n";
}
+
+ /*
+ * Do not remove this because dhcpleases monitors with kqueue it needs to be
+ * killed before writing to hosts files.
+ */
+ if (file_exists("{$g['varrun_path']}/dhcpleases.pid")) {
+ sigkillbypid("{$g['varrun_path']}/dhcpleases.pid", "TERM");
+ @unlink("{$g['varrun_path']}/dhcpleases.pid");
+ }
+ $fd = fopen("{$g['varetc_path']}/hosts", "w");
+ if (!$fd) {
+ log_error("Error: cannot open hosts file in system_hosts_generate().\n");
+ return 1;
+ }
fwrite($fd, $hosts);
fclose($fd);
@@ -1091,7 +1099,6 @@ EOD;
$lighty_config .= <<
+
+?>
\ No newline at end of file
diff --git a/etc/inc/util.inc b/etc/inc/util.inc
index 0b14b97217..718a22bd65 100644
--- a/etc/inc/util.inc
+++ b/etc/inc/util.inc
@@ -633,6 +633,22 @@ function get_configured_ip_aliases_list() {
}
+/* comparison function for sorting by the order in which interfaces are normally created */
+function compare_interface_friendly_names($a, $b) {
+ if ($a == $b)
+ return 0;
+ else if ($a == 'wan')
+ return -1;
+ else if ($b == 'wan')
+ return 1;
+ else if ($a == 'lan')
+ return -1;
+ else if ($b == 'lan')
+ return 1;
+
+ return strnatcmp($a, $b);
+}
+
/* return the configured interfaces list. */
function get_configured_interface_list($only_opt = false, $withdisabled = false) {
global $config;
@@ -691,6 +707,21 @@ function get_configured_interface_with_descr($only_opt = false, $withdisabled =
return $iflist;
}
+/*
+ * get_configured_ip_addresses() - Return a list of all configured
+ * interfaces IP Addresses
+ *
+ */
+function get_configured_ip_addresses() {
+ require_once("interfaces.inc");
+ $ip_array = array();
+ $interfaces = get_configured_interface_list();
+ foreach($interfaces as $int) {
+ $ipaddr = get_interface_ip($int);
+ $ip_array[$int] = $ipaddr;
+ }
+ return $ip_array;
+}
/*
* get_interface_list() - Return a list of all physical interfaces
diff --git a/etc/inc/vpn.inc b/etc/inc/vpn.inc
index 855756b093..7c045d20c1 100644
--- a/etc/inc/vpn.inc
+++ b/etc/inc/vpn.inc
@@ -1720,4 +1720,5 @@ function vpn_ipsec_configure_preferoldsa() {
else
mwexec("/sbin/sysctl net.key.preferred_oldsa=0");
}
-?>
+
+?>
\ No newline at end of file
diff --git a/etc/inc/wizardapp.inc b/etc/inc/wizardapp.inc
index bb9a6e4c47..2a2392ab45 100644
--- a/etc/inc/wizardapp.inc
+++ b/etc/inc/wizardapp.inc
@@ -345,4 +345,4 @@ $othersplist = array();
$othersplist['slingbox'][] = array('Slingbox2', 'udp', '5001', '5001', 'both');
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/xmlparse.inc b/etc/inc/xmlparse.inc
index 118a97bb6b..582f9b4613 100644
--- a/etc/inc/xmlparse.inc
+++ b/etc/inc/xmlparse.inc
@@ -291,4 +291,4 @@ function dump_xml_config_raw($arr, $rootobj) {
return $xmlconfig;
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/xmlparse_attr.inc b/etc/inc/xmlparse_attr.inc
index 06d02c48a3..802d335346 100644
--- a/etc/inc/xmlparse_attr.inc
+++ b/etc/inc/xmlparse_attr.inc
@@ -224,4 +224,4 @@ function parse_xml_config_raw_attr($cffile, $rootobj, &$parsed_attributes, $isst
return $parsedcfg[$rootobj];
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/inc/xmlreader.inc b/etc/inc/xmlreader.inc
index 3d21be1272..a228cd0199 100644
--- a/etc/inc/xmlreader.inc
+++ b/etc/inc/xmlreader.inc
@@ -211,4 +211,4 @@ function dump_xml_config_raw($arr, $rootobj) {
return $xmlconfig;
}
-?>
+?>
\ No newline at end of file
diff --git a/etc/pfSense.obsoletedfiles b/etc/pfSense.obsoletedfiles
index 76884531ee..fe54ea8c06 100644
--- a/etc/pfSense.obsoletedfiles
+++ b/etc/pfSense.obsoletedfiles
@@ -45,4 +45,6 @@
/usr/local/www/dfuife.cgi
/usr/local/www/fred.png
/usr/local/www/index.html
-/usr/local/www/system_usermanager_addcert.php
\ No newline at end of file
+/usr/local/www/system_usermanager_addcert.php
+/usr/local/pkg/routed/routed.inc
+/usr/local/pkg/routed/routed.xml
diff --git a/etc/phpshellsessions/gitsync b/etc/phpshellsessions/gitsync
index 6f7a53f267..9fa7079b7c 100644
--- a/etc/phpshellsessions/gitsync
+++ b/etc/phpshellsessions/gitsync
@@ -19,6 +19,10 @@ $CODIR = "/root/pfsense/";
global $argv;
global $command_split;
+// If this parameter is set, all interactive functions are disabled
+// and neither PHP nor the web gui will be killed or restarted.
+$upgrading = in_array("--upgrading", $argv);
+
unlink_if_exists("/tmp/config.cache");
if(!file_exists("/usr/local/bin/git")) {
@@ -61,7 +65,7 @@ if(is_dir("$CODIR/pfSenseGITREPO/pfSenseGITREPO")) {
if($command_split[2]) {
$branch = $command_split[2];
} else {
- if(!$argv[3]) {
+ if(!$argv[3] && !$upgrading) {
echo "\nCurrent repository is $GIT_REPO\n";
echo "\nPlease select which branch you would like to sync against:\n\n";
foreach($branches as $branchname => $branchdesc) {
@@ -98,7 +102,7 @@ foreach($branches as $branchname => $branchdesc) {
$found = true;
}
if(!$found) {
- if(isURL($branch)) {
+ if(isURL($branch) && !$upgrading) {
echo "\n";
echo "NOTE: $branch was not found.\n\n";
$command = readline("Is this a custom GIT URL? [y]? ");
@@ -142,7 +146,7 @@ if(file_exists("/root/.gitsync_merge")) {
}
}
}
-if(!$command_split[2] && !$argv[3]) {
+if(!$command_split[2] && !$argv[3] && !$upgrading) {
do {
echo "\nAdd a custom RCS branch URL (HTTP) to merge in or press enter if done.\n\n";
$merge_repo = readline("> ");
@@ -268,11 +272,15 @@ exec("mv $CODIR/pfSenseGITREPO/gitsync_temp.git $CODIR/pfSenseGITREPO/pfSenseGIT
// Reset the repository to restore the deleted files
exec("cd $CODIR/pfSenseGITREPO/pfSenseGITREPO && git reset --hard >/dev/null 2>/dev/null");
-post_cvssync_commands();
+if(!$upgrading)
+ post_cvssync_commands();
echo "===> Checkout complete.\n";
echo "\n";
-echo "Your system is now sync'd and PHP and Lighty will be restarted in 5 seconds.\n\n";
+if(!$upgrading)
+ echo "Your system is now sync'd and PHP and Lighty will be restarted in 5 seconds.\n\n";
+else
+ echo "Your system is now sync'd.\n\n";
function post_cvssync_commands() {
echo "===> Removing FAST-CGI temporary files...\n";
diff --git a/etc/rc b/etc/rc
index c4c1df3642..ab1b46092c 100755
--- a/etc/rc
+++ b/etc/rc
@@ -349,9 +349,6 @@ echo -n "Launching the init system..."
/bin/rm -f /cf/conf/backup/backup.cache
/bin/rm -f /root/lighttpd*
/usr/bin/touch $varrunpath/booting
-for iface in `/sbin/ifconfig -l`; do
- /sbin/ifconfig $iface up
-done
/etc/rc.bootup
# If a shell was selected from recovery
diff --git a/etc/rc.bootup b/etc/rc.bootup
index d6574ee642..2d39df625f 100755
--- a/etc/rc.bootup
+++ b/etc/rc.bootup
@@ -157,9 +157,6 @@ echo "Loading configuration...";
parse_config_bootup();
echo "done.\n";
-$lan_if = $config['interfaces']['lan']['if'];
-$wan_if = get_real_interface();
-
/*
* Determine if we need to throw a interface exception
* and ask the user to reassign interfaces. This will
@@ -168,6 +165,11 @@ $wan_if = get_real_interface();
while(is_interface_mismatch() == true) {
led_assigninterfaces();
echo "\nNetwork interface mismatch -- Running interface assignment option.\n";
+ $ifaces = get_interface_list();
+ if (is_array($ifaces)) {
+ foreach($ifaces as $iface => $ifdata)
+ interfaces_bring_up($iface);
+ }
set_networking_interfaces_ports();
led_kitt();
}
@@ -344,7 +346,7 @@ enable_rrd_graphing();
setup_wireless_olsr();
/* startup routed if needed */
-include_once("/usr/local/pkg/routed/routed.inc");
+include_once("/usr/local/pkg/routed.inc");
setup_routed();
/* enable watchdog if supported */
diff --git a/etc/rc.create_full_backup b/etc/rc.create_full_backup
index d0ef848a46..048e68bb5e 100755
--- a/etc/rc.create_full_backup
+++ b/etc/rc.create_full_backup
@@ -10,6 +10,7 @@ tar czPf /root/$FILENAME \
--exclude root/* \
--exclude var/empty/* \
--exclude var/empty \
+ --exclude var/etc \
/
echo ">>> Backup completed. Note: this backup includes config.xml!"
diff --git a/etc/rc.firmware b/etc/rc.firmware
index a7cbfafa13..b10737e02a 100755
--- a/etc/rc.firmware
+++ b/etc/rc.firmware
@@ -287,6 +287,12 @@ pfSenseNanoBSDupgrade)
mkdir /tmp/$GLABEL_SLICE
mount /dev/ufs/$GLABEL_SLICE /tmp/$GLABEL_SLICE
+ # If /boot/loader.conf.local exists
+ # copy to the other slice.
+ if [ -f /boot/loader.conf.local ]; then
+ cp /boot/loader.conf.local /tmp/$GLABEL_SLICE/boot/loader.conf.local
+ fi
+
# If /tmp/$GLABEL_SLICE/tmp/post_upgrade_command exists
# after update then execute the command.
if [ -f /tmp/$GLABEL_SLICE/tmp/post_upgrade_command ]; then
diff --git a/tmp/post_upgrade_command.php b/tmp/post_upgrade_command.php
index 497e5269bb..dfe9342d17 100755
--- a/tmp/post_upgrade_command.php
+++ b/tmp/post_upgrade_command.php
@@ -6,6 +6,13 @@
require_once("config.inc");
require_once("functions.inc");
+ if(file_exists("/usr/local/bin/git") && isset($config['system']['gitsync']['synconupgrade'])) {
+ if(isset($config['system']['gitsync']['repositoryurl']))
+ exec("cd /root/pfsense/pfSenseGITREPO/pfSenseGITREPO && git config remote.origin.url " . escapeshellarg($config['system']['gitsync']['repositoryurl']));
+ if(isset($config['system']['gitsync']['branch']))
+ system("pfSsh.php playback gitsync " . escapeshellarg($config['system']['gitsync']['branch']) . " --upgrading");
+ }
+
if($g['platform'] == "embedded") {
$config['system']['enableserial'] = true;
write_config();
@@ -19,6 +26,6 @@
$files_to_process = split("\n", file_get_contents("/etc/pfSense.obsoletedfiles"));
foreach($files_to_process as $filename)
if(file_exists($filename))
- exec("/bin/rm $filename");
+ exec("/bin/rm -f $filename");
?>
\ No newline at end of file
diff --git a/usr/local/bin/easyrule b/usr/local/bin/easyrule
index 60f5fb1c97..f4c9dad90f 100755
--- a/usr/local/bin/easyrule
+++ b/usr/local/bin/easyrule
@@ -84,28 +84,6 @@ function is_specialnet($net) {
return false;
}
-/* Another one we need from guiconfig.inc but can't include... */
-function filter_rules_sort() {
- global $config;
-
- /* mark each rule with the sequence number (to retain the order while sorting) */
- for ($i = 0; isset($config['filter']['rule'][$i]); $i++)
- $config['filter']['rule'][$i]['seq'] = $i;
-
- function filtercmp($a, $b) {
- if ($a['interface'] == $b['interface'])
- return $a['seq'] - $b['seq'];
- else
- return -strcmp($a['interface'], $b['interface']);
- }
-
- usort($config['filter']['rule'], "filtercmp");
-
- /* strip the sequence numbers again */
- for ($i = 0; isset($config['filter']['rule'][$i]); $i++)
- unset($config['filter']['rule'][$i]['seq']);
-}
-
if (($argc > 1) && !empty($argv[1])) {
$message = "";
diff --git a/usr/local/pkg/routed/routed.inc b/usr/local/pkg/routed.inc
similarity index 100%
rename from usr/local/pkg/routed/routed.inc
rename to usr/local/pkg/routed.inc
diff --git a/usr/local/pkg/routed/routed.xml b/usr/local/pkg/routed.xml
similarity index 93%
rename from usr/local/pkg/routed/routed.xml
rename to usr/local/pkg/routed.xml
index e28401067c..274c3d6e9c 100644
--- a/usr/local/pkg/routed/routed.xml
+++ b/usr/local/pkg/routed.xml
@@ -33,7 +33,7 @@
routed
1.1
Services: RIP
- routed/routed.inc
+ routed.inc
- http://www.pfsense.org/packages/config/routed/routed.inc
@@ -43,13 +43,13 @@
ROUTED Settings
- /pkg_edit.php?xml=routed/routed.xml
+ /pkg_edit.php?xml=routed.xml
@@ -97,7 +97,7 @@
input
- pkg_edit.php?xml=routed/routed.xml&id=0
+ pkg_edit.php?xml=routed.xml&id=0
diff --git a/usr/local/www/csrf/csrf-magic.js b/usr/local/www/csrf/csrf-magic.js
new file mode 100644
index 0000000000..820f6e80ec
--- /dev/null
+++ b/usr/local/www/csrf/csrf-magic.js
@@ -0,0 +1,177 @@
+/**
+ * @file
+ *
+ * Rewrites XMLHttpRequest to automatically send CSRF token with it. In theory
+ * plays nice with other JavaScript libraries, needs testing though.
+ */
+
+// Here are the basic overloaded method definitions
+// The wrapper must be set BEFORE onreadystatechange is written to, since
+// a bug in ActiveXObject prevents us from properly testing for it.
+CsrfMagic = function(real) {
+ // try to make it ourselves, if you didn't pass it
+ if (!real) try { real = new XMLHttpRequest; } catch (e) {;}
+ if (!real) try { real = new ActiveXObject('Msxml2.XMLHTTP'); } catch (e) {;}
+ if (!real) try { real = new ActiveXObject('Microsoft.XMLHTTP'); } catch (e) {;}
+ if (!real) try { real = new ActiveXObject('Msxml2.XMLHTTP.4.0'); } catch (e) {;}
+ this.csrf = real;
+ // properties
+ var csrfMagic = this;
+ real.onreadystatechange = function() {
+ csrfMagic._updateProps();
+ return csrfMagic.onreadystatechange ? csrfMagic.onreadystatechange() : null;
+ };
+ csrfMagic._updateProps();
+}
+
+CsrfMagic.prototype = {
+
+ open: function(method, url, async, username, password) {
+ if (method == 'POST') this.csrf_isPost = true;
+ // deal with Opera bug, thanks jQuery
+ if (username) return this.csrf_open(method, url, async, username, password);
+ else return this.csrf_open(method, url, async);
+ },
+ csrf_open: function(method, url, async, username, password) {
+ if (username) return this.csrf.open(method, url, async, username, password);
+ else return this.csrf.open(method, url, async);
+ },
+
+ send: function(data) {
+ if (!this.csrf_isPost) return this.csrf_send(data);
+ prepend = csrfMagicName + '=' + csrfMagicToken + '&';
+ if (this.csrf_purportedLength === undefined) {
+ this.csrf_setRequestHeader("Content-length", this.csrf_purportedLength + prepend.length);
+ delete this.csrf_purportedLength;
+ }
+ delete this.csrf_isPost;
+ return this.csrf_send(prepend + data);
+ },
+ csrf_send: function(data) {
+ return this.csrf.send(data);
+ },
+
+ setRequestHeader: function(header, value) {
+ // We have to auto-set this at the end, since we don't know how long the
+ // nonce is when added to the data.
+ if (this.csrf_isPost && header == "Content-length") {
+ this.csrf_purportedLength = value;
+ return;
+ }
+ return this.csrf_setRequestHeader(header, value);
+ },
+ csrf_setRequestHeader: function(header, value) {
+ return this.csrf.setRequestHeader(header, value);
+ },
+
+ abort: function() {
+ return this.csrf.abort();
+ },
+ getAllResponseHeaders: function() {
+ return this.csrf.getAllResponseHeaders();
+ },
+ getResponseHeader: function(header) {
+ return this.csrf.getResponseHeader(header);
+ } // ,
+}
+
+// proprietary
+CsrfMagic.prototype._updateProps = function() {
+ this.readyState = this.csrf.readyState;
+ if (this.readyState == 4) {
+ this.responseText = this.csrf.responseText;
+ this.responseXML = this.csrf.responseXML;
+ this.status = this.csrf.status;
+ this.statusText = this.csrf.statusText;
+ }
+}
+CsrfMagic.process = function(base) {
+ var prepend = csrfMagicName + '=' + csrfMagicToken;
+ if (base) return prepend + '&' + base;
+ return prepend;
+}
+// callback function for when everything on the page has loaded
+CsrfMagic.end = function() {
+ // This rewrites forms AGAIN, so in case buffering didn't work this
+ // certainly will.
+ forms = document.getElementsByTagName('form');
+ for (var i = 0; i < forms.length; i++) {
+ form = forms[i];
+ if (form.method.toUpperCase() !== 'POST') continue;
+ if (form.elements[csrfMagicName]) continue;
+ var input = document.createElement('input');
+ input.setAttribute('name', csrfMagicName);
+ input.setAttribute('value', csrfMagicToken);
+ input.setAttribute('type', 'hidden');
+ form.appendChild(input);
+ }
+}
+
+// Sets things up for Mozilla/Opera/nice browsers
+if (window.XMLHttpRequest && window.XMLHttpRequest.prototype) {
+ var x = XMLHttpRequest.prototype;
+ var c = CsrfMagic.prototype;
+
+ // Save the original functions
+ x.csrf_open = x.open;
+ x.csrf_send = x.send;
+ x.csrf_setRequestHeader = x.setRequestHeader;
+
+ // Notice that CsrfMagic is itself an instantiatable object, but only
+ // open, send and setRequestHeader are necessary as decorators.
+ x.open = c.open;
+ x.send = c.send;
+ x.setRequestHeader = c.setRequestHeader;
+} else {
+ // The only way we can do this is by modifying a library you have been
+ // using. We support YUI, script.aculo.us, prototype, MooTools,
+ // jQuery, Ext and Dojo.
+ if (window.jQuery) {
+ // jQuery didn't implement a new XMLHttpRequest function, so we have
+ // to do this the hard way.
+ jQuery.csrf_ajax = jQuery.ajax;
+ jQuery.ajax = function( s ) {
+ if (s.type && s.type.toUpperCase() == 'POST') {
+ s = jQuery.extend(true, s, jQuery.extend(true, {}, jQuery.ajaxSettings, s));
+ if ( s.data && s.processData && typeof s.data != "string" ) {
+ s.data = jQuery.param(s.data);
+ }
+ s.data = CsrfMagic.process(s.data);
+ }
+ return jQuery.csrf_ajax( s );
+ }
+ } else if (window.Prototype) {
+ // This works for script.aculo.us too
+ Ajax.csrf_getTransport = Ajax.getTransport;
+ Ajax.getTransport = function() {
+ return new CsrfMagic(Ajax.csrf_getTransport());
+ }
+ } else if (window.MooTools) {
+ Browser.csrf_Request = Browser.Request;
+ Browser.Request = function () {
+ return new CsrfMagic(Browser.csrf_Request());
+ }
+ } else if (window.YAHOO) {
+ YAHOO.util.Connect.csrf_createXhrObject = YAHOO.util.Connect.createXhrObject;
+ YAHOO.util.Connect.createXhrObject = function (transaction) {
+ obj = YAHOO.util.Connect.csrf_createXhrObject(transaction);
+ obj.conn = new CsrfMagic(obj.conn);
+ return obj;
+ }
+ } else if (window.Ext) {
+ // Ext can use other js libraries as loaders, so it has to come last
+ // Ext's implementation is pretty identical to Yahoo's, but we duplicate
+ // it for comprehensiveness's sake.
+ Ext.lib.Ajax.csrf_createXhrObject = Ext.lib.Ajax.createXhrObject;
+ Ext.lib.Ajax.createXhrObject = function (transaction) {
+ obj = Ext.lib.Ajax.csrf_createXhrObject(transaction);
+ obj.conn = new CsrfMagic(obj.conn);
+ return obj;
+ }
+ } else if (window.dojo) {
+ dojo.csrf__xhrObj = dojo._xhrObj;
+ dojo._xhrObj = function () {
+ return new CsrfMagic(dojo.csrf__xhrObj());
+ }
+ }
+}
diff --git a/usr/local/www/csrf/csrf-magic.php b/usr/local/www/csrf/csrf-magic.php
new file mode 100644
index 0000000000..447ecc94b8
--- /dev/null
+++ b/usr/local/www/csrf/csrf-magic.php
@@ -0,0 +1,372 @@
+
+ */
+$GLOBALS['csrf']['input-name'] = '__csrf_magic';
+
+/**
+ * Set this to false if your site must work inside of frame/iframe elements,
+ * but do so at your own risk: this configuration protects you against CSS
+ * overlay attacks that defeat tokens.
+ */
+$GLOBALS['csrf']['frame-breaker'] = true;
+
+/**
+ * Whether or not CSRF Magic should be allowed to start a new session in order
+ * to determine the key.
+ */
+$GLOBALS['csrf']['auto-session'] = true;
+
+/**
+ * Whether or not csrf-magic should produce XHTML style tags.
+ */
+$GLOBALS['csrf']['xhtml'] = true;
+
+// FUNCTIONS:
+
+// Don't edit this!
+$GLOBALS['csrf']['version'] = '1.0.1';
+
+/**
+ * Rewrites ', $script . '', $buffer, $count);
+ if (!$count) {
+ $buffer .= $script;
+ }
+ }
+ return $buffer;
+}
+
+/**
+ * Checks if this is a post request, and if it is, checks if the nonce is valid.
+ * @param bool $fatal Whether or not to fatally error out if there is a problem.
+ * @return True if check passes or is not necessary, false if failure.
+ */
+function csrf_check($fatal = true) {
+ if ($_SERVER['REQUEST_METHOD'] !== 'POST') return true;
+ csrf_start();
+ $name = $GLOBALS['csrf']['input-name'];
+ $ok = false;
+ $tokens = '';
+ do {
+ if (!isset($_POST[$name])) break;
+ // we don't regenerate a token and check it because some token creation
+ // schemes are volatile.
+ $tokens = $_POST[$name];
+ if (!csrf_check_tokens($tokens)) break;
+ $ok = true;
+ } while (false);
+ if ($fatal && !$ok) {
+ $callback = $GLOBALS['csrf']['callback'];
+ if (trim($tokens, 'A..Za..z0..9:;,') !== '') $tokens = 'hidden';
+ $callback($tokens);
+ exit;
+ }
+ return $ok;
+}
+
+/**
+ * Retrieves a valid token(s) for a particular context. Tokens are separated
+ * by semicolons.
+ */
+function csrf_get_tokens() {
+ $has_cookies = !empty($_COOKIE);
+
+ // $ip implements a composite key, which is sent if the user hasn't sent
+ // any cookies. It may or may not be used, depending on whether or not
+ // the cookies "stick"
+ if (!$has_cookies && $secret) {
+ // :TODO: Harden this against proxy-spoofing attacks
+ $ip = ';ip:' . csrf_hash($_SERVER['IP_ADDRESS']);
+ } else {
+ $ip = '';
+ }
+ csrf_start();
+
+ // These are "strong" algorithms that don't require per se a secret
+ if (session_id()) return 'sid:' . csrf_hash(session_id()) . $ip;
+ if ($GLOBALS['csrf']['cookie']) {
+ $val = csrf_generate_secret();
+ setcookie($GLOBALS['csrf']['cookie'], $val);
+ return 'cookie:' . csrf_hash($val) . $ip;
+ }
+ if ($GLOBALS['csrf']['key']) return 'key:' . csrf_hash($GLOBALS['csrf']['key']) . $ip;
+ // These further algorithms require a server-side secret
+ if ($secret === '') return 'invalid';
+ if ($GLOBALS['csrf']['user'] !== false) {
+ return 'user:' . csrf_hash($GLOBALS['csrf']['user']);
+ }
+ if ($GLOBALS['csrf']['allow-ip']) {
+ return ltrim($ip, ';');
+ }
+ return 'invalid';
+}
+
+/**
+ * @param $tokens is safe for HTML consumption
+ */
+function csrf_callback($tokens) {
+ header($_SERVER['SERVER_PROTOCOL'] . ' 403 Forbidden');
+ echo "