From 5fe3b65184ff67709c9b7b8b8712301664b2bb73 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Fri, 25 Jun 2010 10:46:19 -0400
Subject: [PATCH 01/12] Validate MTU in setup wizard. Ticket #464

---
 usr/local/www/wizards/setup_wizard.xml | 11 +++++++++++
 1 file changed, 11 insertions(+)
diff --git a/usr/local/www/wizards/setup_wizard.xml b/usr/local/www/wizards/setup_wizard.xml
index 64ffef13fe..485b2d2e81 100644
--- a/usr/local/www/wizards/setup_wizard.xml
+++ b/usr/local/www/wizards/setup_wizard.xml
@@ -328,6 +328,16 @@
 			<type>submit</type>
 		</field>
 	</fields>
+	<stepsubmitphpaction>
+		<![CDATA[
+		if(!empty($_POST['mtu'])) {
+			if($_POST['mtu'] < 576) {
+				print_info_box_np("MTU Must be at least 576 (Per RFC 791). Please press back in your browser window and correct.");
+				die;
+			}
+		}
+		]]>
+	</stepsubmitphpaction>
 	<stepsubmitbeforesave>
 		<![CDATA[
 			if($_POST['selectedtype'] == "Static") { 
@@ -428,3 +438,4 @@
 	</stepafterformdisplay>
 </step>
 </pfsensewizard>
+ 
\ No newline at end of file

From 618e43ca4f4e6f36bcfd7c0ecc32c8d6cebfb5ad Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Fri, 25 Jun 2010 11:15:52 -0400
Subject: [PATCH 02/12] Do some more strict validation on hostname, domain, and
 DNS servers. Ticket #464

---
 usr/local/www/wizards/setup_wizard.xml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/usr/local/www/wizards/setup_wizard.xml b/usr/local/www/wizards/setup_wizard.xml
index 485b2d2e81..5d08501b7a 100644
--- a/usr/local/www/wizards/setup_wizard.xml
+++ b/usr/local/www/wizards/setup_wizard.xml
@@ -59,6 +59,8 @@
 			<type>input</type>
 			<bindstofield>system->hostname</bindstofield>
 			<description>EXAMPLE: myserver</description>
+			<validate>^[a-z0-9.|-]+$</validate>
+			<message>Invalid Hostname</message>
 		</field>
 		<field>
 			<name>Domain</name>
@@ -75,12 +77,16 @@
 			<!-- we must unset the fields because this is an array. -->
 			<unsetfield>yes</unsetfield>
 			<arraynum>0</arraynum>
+			<validate>^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$</validate>
+			<message>Primary DNS Server field is invalid</message>
 		</field>
 		<field>
 			<name>Secondary DNS Server</name>
 			<type>input</type>
 			<bindstofield>system->dnsserver</bindstofield>
 			<arraynum>1</arraynum>
+			<validate>^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$</validate>
+			<message>Secondary DNS Server field is invalid</message>
 		</field>
 		<field>
 			<name>Override DNS</name>
@@ -93,6 +99,26 @@
 			<type>submit</type>
 		</field>
 	</fields>
+	<stepsubmitphpaction>
+		<![CDATA[
+		if(empty($_POST['hostname']) || !is_hostname($_POST['hostname'])) {
+			print_info_box_np("Hostname is invalid. Please press back in your browser window and correct.");
+			die;
+		}
+		if(empty($_POST['domain']) || !is_domain($_POST['domain'])) {
+			print_info_box_np("Domain is invalid. Please press back in your browser window and correct.");
+			die;
+		}
+		if(!empty($_POST['primarydnsserver']) && !is_ipaddr($_POST['primarydnsserver'])) {
+			print_info_box_np("Primary DNS server is invalid. Please press back in your browser window and correct.");
+			die;
+		}
+		if(!empty($_POST['secondarydnsserver']) && !is_ipaddr($_POST['secondarydnsserver'])) {
+			print_info_box_np("Second DNS server is invalid. Please press back in your browser window and correct.");
+			die;
+		}
+		]]>
+	</stepsubmitphpaction>
 </step>
 <step>
 	<id>3</id>

From ce6b39f25d512d41ea8b2d83f3a50ed5182438e0 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Fri, 25 Jun 2010 11:21:56 -0400
Subject: [PATCH 03/12] Hide GMZ offset zones in setup wizard. Ticket #464

---
 usr/local/www/wizard.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/usr/local/www/wizard.php b/usr/local/www/wizard.php
index a59e83dd82..5ba3ff8ee1 100755
--- a/usr/local/www/wizard.php
+++ b/usr/local/www/wizard.php
@@ -697,6 +697,8 @@ function showchange() {
 				echo "<td class=\"vtable\">";
 			echo "<select class='formselect' name='{$name}'>\n";
 			foreach ($timezonelist as $tz) {
+				if(strstr($tz, "GMT"))
+					continue;
 				$SELECTED = "";
 				if ($value == $tz) $SELECTED = " SELECTED";
 				echo "<option value='" . htmlspecialchars($tz) . "' {$SELECTED}>";

From 85ee0940ac9774cffe066e15249fde1edaa8f812 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Fri, 25 Jun 2010 12:12:17 -0400
Subject: [PATCH 04/12] Do more strict validation on WAN setup fields. Ticket
 #464

---
 usr/local/www/wizards/setup_wizard.xml | 47 ++++++++++++++++++++++----
 1 file changed, 41 insertions(+), 6 deletions(-)

diff --git a/usr/local/www/wizards/setup_wizard.xml b/usr/local/www/wizards/setup_wizard.xml
index 5d08501b7a..b6300fded1 100644
--- a/usr/local/www/wizards/setup_wizard.xml
+++ b/usr/local/www/wizards/setup_wizard.xml
@@ -206,6 +206,8 @@
 			<bindstofield>interfaces->wan->spoofmac</bindstofield>
 			<type>input</type>
 			<description> This field can be used to modify ("spoof") the MAC address of the WAN interface (may be required with some cable connections). Enter a MAC address in the following format: xx:xx:xx:xx:xx:xx or leave blank.</description>
+			<validate>^([0-9a-f]{2}([:-]||$)){6}$</validate>
+			<message>MAC Address field is invalid</message>
 		</field>
 		<field>
 			<donotdisable>true</donotdisable>
@@ -224,6 +226,8 @@
 			<type>input</type>
 			<typehint> / </typehint>
 			<combinefieldsbegin>true</combinefieldsbegin>
+			<validate>^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$</validate>
+			<message>IP Address field is invalid</message>
 		</field>
 		<field>
 			<combinefieldsend>true</combinefieldsend>
@@ -237,6 +241,8 @@
 			<name>Gateway</name>
 			<bindstofield>interfaces->wan->gateway</bindstofield>
 			<type>input</type>
+			<validate>^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$</validate>
+			<message>Gateway IP Address field is invalid</message>
 		</field>
 		<field>
 			<name>DHCP client configuration</name>
@@ -298,6 +304,8 @@
 			<type>input</type>
 			<typehint> / </typehint>
 			<bindstofield>pptp->local</bindstofield>
+			<validate>^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$</validate>
+			<message>PPTP Local IP Address field is invalid</message>
 		</field>
 		<field>
 			<combinefieldsend>true</combinefieldsend>
@@ -311,6 +319,8 @@
 			<name>PPTP Remote IP Address</name>
 			<bindstofield>pptp->remote</bindstofield>
 			<type>input</type>
+			<validate>^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$</validate>
+			<message>PPTP Remote IP Address field is invalid</message>
 		</field>
 		<field>
 			<name>PPTP Dial on demand</name>
@@ -356,11 +366,29 @@
 	</fields>
 	<stepsubmitphpaction>
 		<![CDATA[
-		if(!empty($_POST['mtu'])) {
-			if($_POST['mtu'] < 576) {
-				print_info_box_np("MTU Must be at least 576 (Per RFC 791). Please press back in your browser window and correct.");
-				die;
-			}
+		if(!empty($_POST['mtu']) && ($_POST['mtu'] < 576)) {
+			print_info_box_np("MTU Must be at least 576 (Per RFC 791). Please press back in your browser window and correct.");
+			die;
+		}
+		if(!empty($_POST['macaddress']) && !is_macaddr($_POST['macaddress'])) {
+			print_info_box_np("Invalid MAC Address. Please press back in your browser window and correct.");
+			die;
+		}
+		if(!empty($_POST['ipaddress']) && ($_POST['selectedtype'] == "Static") && (!is_ipaddr($_POST['ipaddress']))) {
+			print_info_box_np("Invalid WAN IP Address. Please press back in your browser window and correct.");
+			die;
+		}
+		if(!empty($_POST['dhcphostname']) && !is_hostname($_POST['dhcphostname'])) {
+			print_info_box_np("Invalid DHCP Hostname. Please press back in your browser window and correct.");
+			die;
+		}
+		if(!empty($_POST['pptplocalipaddress']) && !is_ipaddr($_POST['pptplocalipaddress'])) {
+			print_info_box_np("Invalid PPTP Local IP Address. Please press back in your browser window and correct.");
+			die;
+		}
+		if(!empty($_POST['pptpremoteipaddress']) && !is_ipaddr($_POST['pptpremoteipaddress'])) {
+			print_info_box_np("Invalid PPTP Remopte IP Address. Please press back in your browser window and correct.");
+			die;
 		}
 		]]>
 	</stepsubmitphpaction>
@@ -388,6 +416,8 @@
 			<type>input</type>
 			<bindstofield>interfaces->lan->ipaddr</bindstofield>
 			<description>Type dhcp if this interface uses DHCP to obtain its IP address.</description>
+			<validate>^(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$</validate>
+			<message>LAN IP Address field is invalid</message>
 		</field>
 				<field>
 			<name>Subnet Mask</name>
@@ -400,6 +430,11 @@
 		</field>
 	</fields>
 	<stepsubmitphpaction>
+		<![CDATA[
+		if(empty($_POST['lanipaddress']) || !is_ipaddr($_POST['lanipaddress'])) {
+			print_info_box_np("Invalid LAN IP Address. Please press back in your browser window and correct.");
+			die;
+		}
 		$ft = split("\.", $_POST['lanipaddress']);
 		$ft_ip = $ft[0] . "." . $ft[1] . "." . $ft[2] . ".";
 		$config['dhcpd']['lan']['range']['from'] = $ft_ip . "10";
@@ -407,6 +442,7 @@
 		$hi = split("\.", $highestip);
 		$highestip = $hi[3]-10;
 		$config['dhcpd']['lan']['range']['to'] = $ft_ip . $highestip;
+		]]>
 	</stepsubmitphpaction>
 </step>
 <step>
@@ -464,4 +500,3 @@
 	</stepafterformdisplay>
 </step>
 </pfsensewizard>
- 
\ No newline at end of file

From ff93a5c1460e5c48f10fe92587ff2913eff8450a Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Fri, 25 Jun 2010 12:17:09 -0400
Subject: [PATCH 05/12] Validate time server. Should be the last thing that
 fixes #464

---
 usr/local/www/wizards/setup_wizard.xml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/usr/local/www/wizards/setup_wizard.xml b/usr/local/www/wizards/setup_wizard.xml
index b6300fded1..d0ef4b3fe4 100644
--- a/usr/local/www/wizards/setup_wizard.xml
+++ b/usr/local/www/wizards/setup_wizard.xml
@@ -130,6 +130,8 @@
 			<description>Enter the hostname (FQDN) of the time server.</description>
 			<type>input</type>
 			<bindstofield>system->timeservers</bindstofield>
+			<validate>^[a-z0-9.|-]+$</validate>
+			<message>Invalid Time Server Field</message>
 		</field>
 		<field>
 			<name>Timezone</name>
@@ -141,6 +143,14 @@
 			<type>submit</type>
 		</field>
 	</fields>
+	<stepsubmitphpaction>
+		<![CDATA[
+		if(!empty($_POST['timeserverhostname']) && !(is_hostname($_POST['timeserverhostname']) || is_ipaddr($_POST['timeserverhostname']))) {
+			print_info_box_np("Invalid Time Server. Please press back in your browser window and correct.");
+			die;
+		}
+		]]>
+	</stepsubmitphpaction>
 </step>
 <step>
 	<id>4</id>

From dabc76691966f00a20081b7731b2c5816f066536 Mon Sep 17 00:00:00 2001
From: Erik Fonnesbeck <efonnes@gmail.com>
Date: Fri, 25 Jun 2010 10:22:45 -0600
Subject: [PATCH 06/12] Check for tcp/udp in the protocol specified for
 outbound NAT rules, since tcp/udp itself is not a valid protocol choice in
 pf. Fixes #696

---
 etc/inc/filter.inc | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index c3a8cd2422..0a6f39ecf0 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -1011,9 +1011,12 @@ function filter_nat_rules_generate_if($if, $src = "any", $srcport = "", $dst = "
 			$tgt = "($if)";
 	}
 	/* Add the protocol, if defined */
-	if (!empty($proto) && $proto != "any")
-		$protocol = " proto {$proto}";
-	else
+	if (!empty($proto) && $proto != "any") {
+		if ($proto == "tcp/udp")
+			$protocol = " proto { tcp udp }";
+		else
+			$protocol = " proto {$proto}";
+	} else
 		$protocol = "";
 	/* Add the hard set source port (useful for ISAKMP) */
 	if($natport != "")

From 4c9a23db7df40aa1b60a17d205fc7faa11f62257 Mon Sep 17 00:00:00 2001
From: Erik Fonnesbeck <efonnes@gmail.com>
Date: Fri, 25 Jun 2010 10:36:33 -0600
Subject: [PATCH 07/12] Label for 1:1 NAT reflection rules in rules.debug.

---
 etc/inc/filter.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/etc/inc/filter.inc b/etc/inc/filter.inc
index 0a6f39ecf0..fe7c047905 100644
--- a/etc/inc/filter.inc
+++ b/etc/inc/filter.inc
@@ -1426,7 +1426,7 @@ EOD;
 	$natrules .= "rdr-anchor \"miniupnpd\"\n";
 
 	if(!empty($reflection_txt))
-		$natrules .= "\n" . $reflection_txt;
+		$natrules .= "\n# Reflection redirects and NAT for 1:1 mappings\n" . $reflection_txt;
 
 	return $natrules;
 }

From 2708e3997d81f8a755d6b6a31247c2c120b4b4de Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Fri, 25 Jun 2010 13:08:09 -0400
Subject: [PATCH 08/12] Remove some redundant code and make sure admin's home
 directory is /root - Fixes #218

---
 etc/inc/auth.inc | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

diff --git a/etc/inc/auth.inc b/etc/inc/auth.inc
index 3a72db9c75..4f97f24ee8 100644
--- a/etc/inc/auth.inc
+++ b/etc/inc/auth.inc
@@ -269,9 +269,9 @@ function local_user_set(& $user) {
 		fwrite($fd, $user['password']);
 		pclose($fd);
 		$user_group = "wheel";
+		$user_home = "/root";
 	}
 
-
 	/* read from pw db */
 	$fd = popen("/usr/sbin/pw usershow {$user_name} 2>&1", "r");
 	$pwread = fgets($fd);
@@ -295,18 +295,6 @@ function local_user_set(& $user) {
 	fwrite($fd, $user['password']);
 	pclose($fd);
 
-
-	/* admin user special handling */
-	if ($user_uid == 0) {
-		$cmd = "/usr/sbin/pw usermod -q -n {$user_name} -s /etc/rc.initial -H 0";
-		if($debug)
-			log_error("Running: {$cmd}");
-		$fd = popen($cmd, "w");
-		fwrite($fd, $user['password']);
-		pclose($fd);
-		$user_group = "wheel";
-	}
-
 	/* create user directory if required */
 	if (!is_dir($user_home)) {
 		mkdir($user_home, 0700);

From 8339ab6d6939f873a40845a02b9029ff02dc6b19 Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Fri, 25 Jun 2010 14:38:03 -0400
Subject: [PATCH 09/12] Prevent the GUI from adding a user that already exists
 in /etc/passwd (root, operator, daemon, etc)

---
 usr/local/www/system_usermanager.php | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/usr/local/www/system_usermanager.php b/usr/local/www/system_usermanager.php
index 058046a3a2..b0ecd8fdab 100644
--- a/usr/local/www/system_usermanager.php
+++ b/usr/local/www/system_usermanager.php
@@ -215,6 +215,14 @@ if (isAllowedPage("system_usermanager")) {
 					break;
 				}
 			}
+			$system_users = explode("\n", file_get_contents("/etc/passwd"));
+			foreach ($system_users as $s_user) {
+				$ent = explode(":", $s_user);
+				if ($ent[0] ==  $_POST['usernamefld']) {
+					$input_errors[] = gettext("That username already exists or is reserved by the system.");
+					break;
+				}
+			}
 		}
 
 		/*

From 3dec33d454ad5b8146b092e927385cc2bd2c14d4 Mon Sep 17 00:00:00 2001
From: Erik Fonnesbeck <efonnes@gmail.com>
Date: Fri, 25 Jun 2010 13:12:06 -0600
Subject: [PATCH 10/12] Validate for duplicate user names when editing, too.

---
 usr/local/www/system_usermanager.php | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/usr/local/www/system_usermanager.php b/usr/local/www/system_usermanager.php
index b0ecd8fdab..f89d8345fc 100644
--- a/usr/local/www/system_usermanager.php
+++ b/usr/local/www/system_usermanager.php
@@ -207,19 +207,26 @@ if (isAllowedPage("system_usermanager")) {
 		if (($_POST['passwordfld1']) && ($_POST['passwordfld1'] != $_POST['passwordfld2']))
 			$input_errors[] = gettext("The passwords do not match.");
 
+		if (isset($id) && $a_user[$id])
+			$oldusername = $a_user[$id]['name'];
+		else
+			$oldusername = "";
 		/* make sure this user name is unique */
-		if (!$input_errors && !(isset($id) && $a_user[$id])) {
+		if (!$input_errors) {
 			foreach ($a_user as $userent) {
-				if ($userent['name'] == $_POST['usernamefld']) {
+				if ($userent['name'] == $_POST['usernamefld'] && $oldusername != $_POST['usernamefld']) {
 					$input_errors[] = gettext("Another entry with the same username already exists.");
 					break;
 				}
 			}
+		}
+		/* also make sure it is not reserved */
+		if (!$input_errors) {
 			$system_users = explode("\n", file_get_contents("/etc/passwd"));
 			foreach ($system_users as $s_user) {
 				$ent = explode(":", $s_user);
-				if ($ent[0] ==  $_POST['usernamefld']) {
-					$input_errors[] = gettext("That username already exists or is reserved by the system.");
+				if ($ent[0] == $_POST['usernamefld'] && $oldusername != $_POST['usernamefld']) {
+					$input_errors[] = gettext("That username is reserved by the system.");
 					break;
 				}
 			}

From 04735a091f2efc00baf45997124f5dec61d257e7 Mon Sep 17 00:00:00 2001
From: Chris Buechler <cmb@pfsense.org>
Date: Sat, 26 Jun 2010 21:26:48 -0400
Subject: [PATCH 11/12] fix Description display. Ticket #666

---
 usr/local/www/status_gateways.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/usr/local/www/status_gateways.php b/usr/local/www/status_gateways.php
index 6d6c43ddf8..72e14b2629 100755
--- a/usr/local/www/status_gateways.php
+++ b/usr/local/www/status_gateways.php
@@ -118,7 +118,7 @@ include("head.inc");
                         ?>
 			</table>
                   </td>
-		  <td class="listbg"> <?=$a_gateway[$gateway['name']]['descr']; ?></td>
+		  <td class="listbg"> <?=$a_gateways[$gateway['name']]['descr']; ?></td>
                 </tr>
 		<?php } ?>
               </table>

From e88ace756391836878b81e8b4fb88776d96872c5 Mon Sep 17 00:00:00 2001
From: Chris Buechler <cmb@pfsense.org>
Date: Sun, 27 Jun 2010 01:27:30 -0400
Subject: [PATCH 12/12] fix gettext

---
 usr/local/www/system_gateways_edit.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/usr/local/www/system_gateways_edit.php b/usr/local/www/system_gateways_edit.php
index 700ba41a80..98d1e818c6 100755
--- a/usr/local/www/system_gateways_edit.php
+++ b/usr/local/www/system_gateways_edit.php
@@ -375,7 +375,7 @@ function show_advanced_gateway() {
 			?>
 			<input name="monitor" type="text" id="monitor" value="<?php echo $monitor; ?>" />
 			<strong><?=gettext("Alternative monitor IP"); ?></strong> <br />
-			<?gettext("Enter an alternative address here to be used to monitor the link. This is used for the " .
+			<?=gettext("Enter an alternative address here to be used to monitor the link. This is used for the " .
 			"quality RRD graphs as well as the load balancer entries. Use this if the gateway does not respond " .
 			"to ICMP echo requests (pings)"); ?>.</strong>
 			<br />
