mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add input validation for interface names on firewall_nat_edit.php and fix encoding of the interface name in dst_change. Fixes #7651

Browse Source
This commit is contained in:
jim-p 2017-06-16 15:36:14 -04:00
parent 6c989d4ac2
commit bae3b2be97
1 changed files with 33 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

62
src/usr/local/www/firewall_nat_edit.php
View File

@ -84,6 +84,34 @@ if (!is_array($config['nat']['rule'])) {
$a_nat = &$config['nat']['rule'];
$iflist = get_configured_interface_with_descr(false, true);
foreach ($iflist as $if => $ifdesc) {
if (have_ruleint_access($if)) {
$interfaces[$if] = $ifdesc;
}
}
if ($config['l2tp']['mode'] == "server") {
if (have_ruleint_access("l2tp")) {
$interfaces['l2tp'] = gettext("L2TP VPN");
}
}
if (is_pppoe_server_enabled() && have_ruleint_access("pppoe")) {
$interfaces['pppoe'] = gettext("PPPoE Server");
}
/* add ipsec interfaces */
if (ipsec_enabled() && have_ruleint_access("enc0")) {
$interfaces["enc0"] = gettext("IPsec");
}
/* add openvpn/tun interfaces */
if ($config['openvpn']["openvpn-server"] || $config['openvpn']["openvpn-client"]) {
$interfaces["openvpn"] = gettext("OpenVPN");
}
if (is_numericint($_GET['id'])) {
$id = $_GET['id'];
}
@ -284,6 +312,10 @@ if ($_POST) {
$_POST['localip'] = trim($_POST['localip']);
}
if (!array_key_exists($_POST['interface'], $interfaces)) {
$input_errors[] = gettext("The submitted interface does not exist.");
}
if (!isset($_POST['nordr']) && ($_POST['localip'] && !is_ipaddroralias($_POST['localip']))) {
$input_errors[] = sprintf(gettext("\"%s\" is not a valid redirect target IP address or host alias."), $_POST['localip']);
}
@ -694,34 +726,6 @@ $section->addInput(new Form_Checkbox(
$pconfig['nordr']
))->setHelp('This option is rarely needed. Don\'t use this without thorough knowledge of the implications.');
$iflist = get_configured_interface_with_descr(false, true);
foreach ($iflist as $if => $ifdesc) {
if (have_ruleint_access($if)) {
$interfaces[$if] = $ifdesc;
}
}
if ($config['l2tp']['mode'] == "server") {
if (have_ruleint_access("l2tp")) {
$interfaces['l2tp'] = gettext("L2TP VPN");
}
}
if (is_pppoe_server_enabled() && have_ruleint_access("pppoe")) {
$interfaces['pppoe'] = gettext("PPPoE Server");
}
/* add ipsec interfaces */
if (ipsec_enabled() && have_ruleint_access("enc0")) {
$interfaces["enc0"] = gettext("IPsec");
}
/* add openvpn/tun interfaces */
if ($config['openvpn']["openvpn-server"] || $config['openvpn']["openvpn-client"]) {
$interfaces["openvpn"] = gettext("OpenVPN");
}
$section->addInput(new Form_Select(
'interface',
'*Interface',
@ -1273,7 +1277,7 @@ events.push(function() {
<?php
if (!$_POST) {
?>
dst_change($('#interface').val(),'<?=htmlspecialchars($pconfig['interface'])?>','<?=htmlspecialchars($pconfig['dst'])?>');
dst_change($('#interface').val(),'<?=htmlspecialchars(addslashes($pconfig['interface']))?>','<?=htmlspecialchars($pconfig['dst'])?>');
<?php
}
?>