From a8a07cfbb40a6134d47626cb81d249cf45c1df64 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@netgate.com>
Date: Thu, 9 May 2019 16:22:21 -0400
Subject: [PATCH] Add warning for OpenVPN client, server, and override
 privileges.

Since these can use OpenVPN advanced directives to call external
scripts, they can be used to run commands that the user may not
otherwise have access to run.

Issue #9510

(cherry picked from commit f75b0eb8e781570a84e8700b150e09e081ccacfe)
---
 src/etc/inc/priv.defs.inc                | 3 +++
 src/usr/local/www/vpn_openvpn_client.php | 1 +
 src/usr/local/www/vpn_openvpn_csc.php    | 1 +
 src/usr/local/www/vpn_openvpn_server.php | 1 +
 4 files changed, 6 insertions(+)

diff --git a/src/etc/inc/priv.defs.inc b/src/etc/inc/priv.defs.inc
index ba9368601f..0cb7eaed4a 100644
--- a/src/etc/inc/priv.defs.inc
+++ b/src/etc/inc/priv.defs.inc
@@ -1281,18 +1281,21 @@ $priv_list['page-vpn-vpnl2tp-users-edit']['match'][] = "vpn_l2tp_users_edit.php*
 $priv_list['page-openvpn-client'] = array();
 $priv_list['page-openvpn-client']['name'] = gettext("WebCfg - OpenVPN: Clients");
 $priv_list['page-openvpn-client']['descr'] = gettext("Allow access to the 'OpenVPN: Clients' page.");
+$priv_list['page-openvpn-client']['warn'] = "standard-warning-root";
 $priv_list['page-openvpn-client']['match'] = array();
 $priv_list['page-openvpn-client']['match'][] = "vpn_openvpn_client.php*";
 
 $priv_list['page-openvpn-csc'] = array();
 $priv_list['page-openvpn-csc']['name'] = gettext("WebCfg - OpenVPN: Client Specific Override");
 $priv_list['page-openvpn-csc']['descr'] = gettext("Allow access to the 'OpenVPN: Client Specific Override' page.");
+$priv_list['page-openvpn-csc']['warn'] = "standard-warning-root";
 $priv_list['page-openvpn-csc']['match'] = array();
 $priv_list['page-openvpn-csc']['match'][] = "vpn_openvpn_csc.php*";
 
 $priv_list['page-openvpn-server'] = array();
 $priv_list['page-openvpn-server']['name'] = gettext("WebCfg - OpenVPN: Servers");
 $priv_list['page-openvpn-server']['descr'] = gettext("Allow access to the 'OpenVPN: Servers' page.");
+$priv_list['page-openvpn-server']['warn'] = "standard-warning-root";
 $priv_list['page-openvpn-server']['match'] = array();
 $priv_list['page-openvpn-server']['match'][] = "vpn_openvpn_server.php*";
 
diff --git a/src/usr/local/www/vpn_openvpn_client.php b/src/usr/local/www/vpn_openvpn_client.php
index e1c838a6f7..ce6740fb3e 100644
--- a/src/usr/local/www/vpn_openvpn_client.php
+++ b/src/usr/local/www/vpn_openvpn_client.php
@@ -24,6 +24,7 @@
 ##|*IDENT=page-openvpn-client
 ##|*NAME=OpenVPN: Clients
 ##|*DESCR=Allow access to the 'OpenVPN: Clients' page.
+##|*WARN=standard-warning-root
 ##|*MATCH=vpn_openvpn_client.php*
 ##|-PRIV
 
diff --git a/src/usr/local/www/vpn_openvpn_csc.php b/src/usr/local/www/vpn_openvpn_csc.php
index 5d06a0e4a2..cba5ba568a 100644
--- a/src/usr/local/www/vpn_openvpn_csc.php
+++ b/src/usr/local/www/vpn_openvpn_csc.php
@@ -24,6 +24,7 @@
 ##|*IDENT=page-openvpn-csc
 ##|*NAME=OpenVPN: Client Specific Override
 ##|*DESCR=Allow access to the 'OpenVPN: Client Specific Override' page.
+##|*WARN=standard-warning-root
 ##|*MATCH=vpn_openvpn_csc.php*
 ##|-PRIV
 
diff --git a/src/usr/local/www/vpn_openvpn_server.php b/src/usr/local/www/vpn_openvpn_server.php
index 10b4c51a7f..9afcf881a8 100644
--- a/src/usr/local/www/vpn_openvpn_server.php
+++ b/src/usr/local/www/vpn_openvpn_server.php
@@ -24,6 +24,7 @@
 ##|*IDENT=page-openvpn-server
 ##|*NAME=OpenVPN: Servers
 ##|*DESCR=Allow access to the 'OpenVPN: Servers' page.
+##|*WARN=standard-warning-root
 ##|*MATCH=vpn_openvpn_server.php*
 ##|-PRIV