mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity
36,232 Commits 27 Branches 53 Tags 494 MiB
585bbbd33e
Commit Graph

8138 Commits

Author SHA1 Message Date
jim-p
585bbbd33e User & Group Manager: Improve Deny Config Write Handling. Fixes #9259 
* Denies all changes if a user has the Deny Config Write privilege.
Previously it only denied the config write but some OS operations were
performed.
* Sets an input error so the user is notified that their attempt failed.
* Hides the add and delete buttons so read only users don't see the
option to perform those actions (but are still denied if they submit the
form through other means)

(cherry picked from commit acd7e5601a)
 2019-08-27 13:21:40 -04:00
jim-p
0caa971ed9 Only prevent deleting IPsec VTI P2 when set to VTI. Fixes #9258 
(cherry picked from commit 37c6083084)
 2019-08-27 11:17:34 -04:00
jim-p
1abe3fc4e0 Correct wording of CA/Cert CN input validation. Fixes #9234 
(cherry picked from commit 0c51971baf)
 2019-08-27 10:49:43 -04:00
jim-p
0dd016d44d Add some exception handling to auth attempts. Fixes #9150 
(cherry picked from commit d832b6ce47)
 2019-08-26 16:44:21 -04:00
jim-p
5f66269dad Fix state kill ordering in rc.newwanip. Fixes #4674 
Move state kill to after new rules and routing have been setup.
Otherwise there is a race condition where new states could be created
before the new rules and routing are in place.

(cherry picked from commit 86e6e0bcff)
 2019-08-26 15:25:54 -04:00
jim-p
ecfd1ddc0e Fixup format of XMLRPC auth error to match GUI auth error. 
(cherry picked from commit 6e0d47510e)
 2019-08-07 10:49:31 -04:00
jim-p
e0bd07fdae Picture widget corrections. Fixes #9610 
* Sanitize user input before using as path/filenames
* Use a more accurate method of determining image type on read
* More sanity checks before reading images.

(cherry picked from commit 2c544ac61c)
 2019-07-01 16:00:06 -04:00
jim-p
3c2cc70243 Encode error output in services_captiveportal_mac.php. Fixes #9609 
(cherry picked from commit d31362b69d)
 2019-07-01 14:37:57 -04:00
jim-p
9357ffe380 Encode hostname in services_acb.php before use. Fixes #9584 
(cherry picked from commit fe482ccc1e)
 2019-06-13 13:10:04 -04:00
jim-p
b9e689cf5b Initialize VLAN array in console setup. Fixes #9582 
(cherry picked from commit 45f9575396)
 2019-06-11 09:51:22 -04:00
jim-p
affe8a552e Set IPsec VTI MTU to configured value at boot. Implements #9111 
(cherry picked from commit 3334f9c4cd7111c624ba2395b91c065d7dd338b1)
 2019-06-03 14:21:31 -04:00
jim-p
ef0045d812 Teach dhcrelay about upstream and downstream interfaces. Fixes #9466 
No config changes or UI changes, it is handled automatically.

(cherry picked from commit f427d68dbc)
 2019-06-03 12:48:37 -04:00
jim-p
113173b982 Terminal size detection. Fixes #9569 
For sh/.profile, run "resizewin -z" at login which will set the terminal
type only when empty, which is kind to remote and local logins and has
the intended behavior.

Also for tcsh, if the user logs in from the serial console, use postcmd
to resize the window after each command in case the user resizes the
window.

(cherry picked from commit 1dc4afdc66)
 2019-05-30 10:12:55 -04:00
jim-p
89b123fb3d Ensure NTP values are treated as numbers before use. Fixes #9558 
(cherry picked from commit c92dbfc189)
 2019-05-28 14:00:43 -04:00
jim-p
f8560a14e9 Privilege matching -- allow JS anchors. Fixes #9550 
Attempts to detect a special case where a file does not actually
exist, and yet should be allowed since it is used by JavaScript.

So long as the anchor name doesn't contain any characters that might let
it evade other checks, allow it through.

(cherry picked from commit bdbd8534ee)
 2019-05-24 15:49:55 -04:00
jim-p
00680d36ef Add GUI components for MDS mitigation. Implements #9532 
While here, add option to disable PTI display in sysinfo widget.
Implements #9323

(cherry picked from commit 42c48efe1c)
 2019-05-22 16:20:44 -04:00
jim-p
ac0bb6bc8e Use correct variable in IP address validation check for DNS. Fixes #9543 
(cherry picked from commit 912562c4d7)
 2019-05-22 14:06:07 -04:00
jim-p
b9ed452dbb Remove wildcards incorrectly used in isAllowedPage(). Fixes #9541 
(cherry picked from commit cf529cbe33)
 2019-05-21 14:53:53 -04:00
jim-p
303641f828 Fix a potential source of PHP errors when saving per-log settings. Fixes #9540 
While here, fix save descriptions.
 2019-05-20 11:35:35 -04:00
jim-p
2bf6d43226 Revert "LDAP TLS option update. Implements #9417" 
This reverts commit efdba6ca75.
 2019-05-15 16:18:56 -04:00
jim-p
92d5396f04 Implement new OpenVPN advanced options privilege. Fixes #9511 
(cherry picked from commit 4a1841a1fa)
 2019-05-13 11:02:24 -04:00
jim-p
0dd99de71d Remove Advanced box from OpenVPN Wizard. Issue #9511 
(cherry picked from commit b8ca6554d0)
 2019-05-13 11:02:18 -04:00
jim-p
7ccb452496 Fix ACB privileges. Fixes #9519 
(cherry picked from commit 18c1de4133)
 2019-05-11 18:55:48 -04:00
jim-p
6cb5a93762 Rewrite unbound remotecontrol.conf when it is empty. Fixes #9470 
(cherry picked from commit 4b70a2006e)
 2019-05-10 16:20:31 -04:00
jim-p
44fb8aca0d Add back DNS over TLS host verification code. Fixes #8602 
Requires Unbound 1.9.0_1 from pfsense/freebsd-ports, which fixes a bug
in Unbound 1.9.0 which did not fully implement OpenSSL 1.0.2 host
validation support. See https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=4206#c5

(cherry picked from commit 7e8bfed216)
 2019-05-10 16:20:21 -04:00
jim-p
fdb7f0a547 status.php updates 
* Ensure firewall info is generated when run from the CLI
* For SG-1100, also include its public key

(cherry picked from commit 2309b26a2b)
 2019-05-10 16:19:45 -04:00
jim-p
c6d54302b9 Fix another typo 
(cherry picked from commit a0930ca608)
 2019-05-10 16:19:41 -04:00
jim-p
ff32782af7 Add parens around NAT reflection rule interface. Fixes #9446 
(cherry picked from commit 8800ee6f90)
 2019-05-10 16:19:37 -04:00
jim-p
1f5fcdb72e Fix typo 
(cherry picked from commit 929cc874f6)
 2019-05-10 16:19:32 -04:00
Luiz Souza
70f50a2be9 Fix a typo. 
Reported by:	jimt

(cherry picked from commit b094594108)
 2019-05-10 15:55:19 -04:00
clinton
87642f6bd1 #9096 - updated login title 
(cherry picked from commit 814a7c2f1d)
 2019-05-10 15:55:15 -04:00
jim-p
efdba6ca75 LDAP TLS option update. Implements #9417 
(cherry picked from commit 996a1ad90e)
 2019-05-10 15:55:12 -04:00
Steve Beaver
4a762cf05d Update copyright notices to 2019. Happy New Year 
(cherry picked from commit 0b4c14a491)
 2019-05-10 15:52:01 -04:00
jim-p
ffe379adde Strengthen path privilege check. Fixes #9513 
* Removes/resolves any relative paths in the submitted URL
* Validates that the file exists
* Trims the path component off after in a nicer way

(cherry picked from commit 0604f68855)
 2019-05-10 15:30:46 -04:00
jim-p
2d7ec8bfdd Make widget privilege matching more specific. Fixes #9512 
(cherry picked from commit bc319bc01a)
 2019-05-09 16:40:15 -04:00
jim-p
a8a07cfbb4 Add warning for OpenVPN client, server, and override privileges. 
Since these can use OpenVPN advanced directives to call external
scripts, they can be used to run commands that the user may not
otherwise have access to run.

Issue #9510

(cherry picked from commit f75b0eb8e7)
 2019-05-09 16:23:28 -04:00
jim-p
48ab49abab Encode download parameter before use. Fixes #9508 
(cherry picked from commit ce77c104ee)
 2019-05-09 15:17:59 -04:00
jim-p
5b5bb2483c Encode descr in the WOL widget. Fixes #9507 
(cherry picked from commit 5789a02eab)
 2019-05-08 16:44:42 -04:00
jim-p
41c9fac85c Encode output in status_filter_reload.php. Fixes #9499 
(cherry picked from commit 1af9400d59)
 2019-05-03 15:25:01 -04:00
jim-p
89c1390a6b Init array before use 
(cherry picked from commit a8a0b1321d2a477772aac4d0034d819b61f2c9bf)
 2019-05-03 09:29:25 -04:00
Renato Botelho
259a034cec Do now show scheduler icon when scheduler tag is empty 
Spotted by: Oliveira MaisSecurity <oliveira@maissecurity.com.br>
 2019-03-25 10:54:20 -03:00
jim-p
e788a9e2ab Create /var/crash after creating /var RAM disk. Fixes #9409 
(cherry picked from commit b39d615394)
 2019-03-18 12:44:51 -04:00
Renato Botelho
64d2dd6199 Add missing obsoleted files 2019-03-13 16:34:29 -03:00
jim-p
b69eea46a5 Initialized entries variable before use. Fixes #9359 
(cherry picked from commit 9146639e72)
 2019-03-12 16:20:36 -04:00
jim-p
d67449c6a3 Use only sshguard table for blocking ssh/gui attacks. Issue #9223 
(cherry picked from commit 555a9ab5c0)
 2019-03-12 15:47:44 -04:00
jim-p
922a1ae3d9 Remove unnecessary expiretable cron jobs for ssh/gui lockout. Issue #9223 
(cherry picked from commit 7a68df5efc)
 2019-03-12 15:47:41 -04:00
jim-p
f1caf190d5 Remove unnecessary expiretable cron jobs for ssh/gui lockout. Issue #9223 
(cherry picked from commit 397d9fff6d)
 2019-03-12 14:42:29 -04:00
jim-p
428f6f021c Fix output buffering when downloading config backups. Fixes #9390 
(cherry picked from commit 4015b03d4b)
 2019-03-10 19:44:33 -04:00
Renato Botelho
4ee7905199 Update translation files 2019-02-25 11:56:16 -03:00
Renato Botelho
7f58d21b55 Regenerate pot 2019-02-25 11:56:13 -03:00