mirrors/pfsense
2
0
Fork 0
mirror of https://github.com/pfsense/pfsense.git synced 2025-10-26 11:38:35 +00:00
Code Issues Packages Projects Releases Wiki Activity
22,613 Commits 27 Branches 53 Tags 494 MiB
bf2fb3db04
Commit Graph

11342 Commits

Author SHA1 Message Date
jim-p
bf2fb3db04 Encode interface/VIP descriptions before displaying them on the NTP daemon settings. 2014-08-06 15:52:36 -04:00
jim-p
2276d74319 Encode the detail field of an alias entry before displaying its contents back to the user. 2014-08-06 15:34:05 -04:00
jim-p
52c67bc2d2 Escape the individual dnsmasq advanced/custom options 2014-08-06 15:26:41 -04:00
jim-p
1de3a5dd51 Fix input validation logic on diag_testport.php, escape more shell arguments for good measure 2014-08-04 15:25:48 -04:00
jim-p
5a1450dc0c Allow hostnames in bulk import since they are valid entries in a network type alias. 2014-07-14 10:56:50 -04:00
Renato Botelho
1ee3a2955a Change Cancel button to call history.back() as done in Firewall Rules, the current method has issues with IE 11, it should fix #3728 2014-07-08 12:44:24 -03:00
Renato Botelho
c69e813c84 Fix #3725: 
- Fix match_filter_field() and also simplify logic
- Fix $filterfieldsarray initialization
- Avoid to have double spaces on filterfieldsarray['act']
- Fix filter on Firewall Logs
 2014-06-30 10:57:19 -03:00
Renato Botelho
1c9a521b93 Merge pull request #1208 from razzfazz/nat_add_missing_protocols 2014-06-20 09:36:10 -03:00
Renato Botelho
4f380b62d5 Remove also . and / from graph 2014-06-19 13:05:06 -03:00
Renato Botelho
2d1e985d2b Fix status_rrd_graph_img.php and also improve it: 
- Remove escapeshellarg that broke command line
- Only remove dangerous chars to avoid command injection
- Replace all `hostname` calls by php_uname('n')
- Replace all `date` calls by strftime()
- Add $_gb to collect possibly garbage from exec return
 2014-06-19 12:23:44 -03:00
Renato Botelho
8aca755afe Make sure single quotes are encoded and avoid javascript injection 2014-06-19 11:29:18 -03:00
Renato Botelho
cedd070513 Use CDATA for javascript 2014-06-19 10:37:56 -03:00
Renato Botelho
559929c2da Fix indent and whitespaces 2014-06-19 10:37:44 -03:00
Renato Botelho
d1dda49817 Simplify logic, add some protection to user input parameters 2014-06-18 16:39:11 -03:00
Renato Botelho
f1a13a7fce Fix whitespaces and indent 2014-06-18 15:41:24 -03:00
Renato Botelho
811baa9bf5 We need to allow subdirectories under /usr/local/pkg, here is the proper fix 2014-06-18 13:46:08 -03:00
Renato Botelho
ce9d5d7255 Protect servicestatusfilter parameter with htmlspecialchars() 2014-06-17 15:13:42 -03:00
Renato Botelho
860b102acb Protect rssfeed parameters with htmlspecialchars() 2014-06-17 14:53:50 -03:00
Renato Botelho
62480a449e Avoid directory traversal on restorefullbackup 2014-06-17 13:47:46 -03:00
Matt Smith
7be297a2ce Fix core dump on viewing invalid package log 2014-06-17 11:30:53 -05:00
Renato Botelho
1cfe54900a Remove . and / from pkg name to avoid directory traversal 2014-06-17 11:17:15 -03:00
Renato Botelho
73944f6824 Remove id=0 from miniupnpd menu and shortcut 2014-06-17 10:48:21 -03:00
Renato Botelho
9ddd3418da Avoid directory traversal when reading package xml files, also check if file exists before try to read it 2014-06-17 10:33:05 -03:00
Renato Botelho
aa27de6e78 Make sure variables are escaped, also replace exec calls to run rm by unlink_if_exists() 2014-06-17 10:19:34 -03:00
Renato Botelho
592abfa4a4 Remove useless code, variable is set again on next line 2014-06-17 10:18:44 -03:00
Renato Botelho
e41ab9aa32 Escape parameters passed to shell_exec() 2014-06-17 09:40:06 -03:00
Renato Botelho
ee4ba9fba1 Be more careful with host parameter and make sure it's escaped when call shell functions 2014-06-17 09:28:35 -03:00
Renato Botelho
54a9da9fce Validate starttime and stoptime format 2014-06-17 07:34:03 -03:00
Renato Botelho
f5629ea6b8 Be more precise to match members of a bridge interface, it should fix #3637 2014-06-10 14:21:16 -03:00
Renato Botelho
6da518fcee Do not allow interface group name to be bigger than 15 chars, helps ticket #3208 2014-06-09 15:32:24 -03:00
Renato Botelho
4cc342453c Add some protection to parameters that come through _GET 2014-06-06 11:53:21 -03:00
Chris Buechler
bc76b18eb9 remove openbgpd bits from system_gateways_edit and system.inc. The package 
match is case-sensitive and hasn't matched the openbgpd package's name in
at least 5 years, so it doesn't do anything. It's far from functional in
any useful manner even fixing that issue.
 2014-05-30 19:57:51 -05:00
Renato Botelho
268258b5aa Unset iflist and iflist_disabled 2014-05-29 10:53:28 -03:00
Renato Botelho
22ed6e3eab Show disabled interface when it was already part of interface group, it avoids to show a random interface instead and let user to add it by mistake. It should fix #3680 2014-05-29 08:53:05 -03:00
Daniel Becker
a4d67bd5f7 bring protocols on NAT edit page more in line with rule edit page 2014-05-22 23:45:49 -07:00
Chris Buechler
ad57eacf87 add guiconfig to widgets not including it. ticket #3498 2014-05-14 10:37:29 -05:00
Chris Buechler
d3fa8a8775 remove text not relevant to Allowed IPs. Ticket #3594 2014-05-14 10:27:11 -05:00
Renato Botelho
29282ddc09 Merge pull request #1131 from razzfazz/make_upnp_listen_on_if_optional 2014-05-09 14:57:17 -03:00
Renato Botelho
91946ea44d Merge pull request #1130 from razzfazz/status_upnp_int_port 2014-05-08 18:41:20 -03:00
Renato Botelho
7e736f3850 Fix #3646, Revert part of 082c9d961e and fix highlight selected rules 2014-05-08 07:50:07 -03:00
Daniel Becker
d973a602ab make listening on interface rather than IP optional for miniupnp 2014-05-06 17:27:36 -07:00
Daniel Becker
a0dd23e0dc add column for internal port on UPnP status page 2014-05-05 15:35:32 -07:00
Phil Davis
b6ba57f67e Fix Bug #3627 Diagnostics: Tables - Remove button dont work after update to PfSense 2.1.2 
This annoyed me also, so I thought it worth finding what changes exactly broke this.
del_entry was broken on 2.1 branch by fe3088b965
These 2 small changes make it work again without needing to reverse the other bits of stuff in that commit.
Note that Master does not have that commit at all. There are lots of these "XHTML Compliance" and similar commits in 2.1 branch that are not done in master. I don't understand why that is. Why don't those code cleanups also need to be applied to master?
 2014-04-30 22:45:18 -07:00
Renato Botelho
19166f7d2d Check the right field here 2014-04-29 15:36:33 -03:00
Renato Botelho
2ae503264c Unbreak 'add rule on top of the list' allowing after param to be -1 2014-04-29 14:56:49 -03:00
Renato Botelho
2db29614d2 Move clog from /usr to /usr/local 
Conflicts:
	etc/inc/filter_log.inc
	etc/inc/system.inc
	etc/rc
	usr/local/www/guiconfig.inc
 2014-04-28 11:56:06 -03:00
Daniel Becker
b1c9aff653 make miniupnpd listen on interface instead of IP 
The 'listening_ip' option in miniupnpd.conf can accept an interface name
directly instead of having to translate it to an IPv4 address first. (This is
actually required if IPv6 support is enabled.)
 2014-04-27 16:09:50 -07:00
Chris Buechler
549b7ce250 Don't refuse to delete a bridge in the GUI just because its bridge interface doesn't exist, just log that it doesn't exist and don't attempt to ifconfig destroy it, delete it from config 2014-04-26 17:20:32 -05:00
Ermal
2f0401aff5 Remove problematic code without proper checks but even not needed here 2014-04-18 14:34:00 +00:00
Phil Davis
f4065455b0 List GWGs in Interface to send update from 
Back-port of this fix done in master 31300a95f7 and 8f56dd2794
Unfortunately this never got back-merged to 2.1 branch. A user on the forum noticed the issue again on 2.1.1 - https://forum.pfsense.org/index.php?topic=74922.0
I am submitting this so that when the next security issue happens, and there is 2.1.n+1 then this little fix will also happen automagically. I wonder what other fixes are in master that missed being back-ported to 2.1 branch.
 2014-04-09 17:58:10 -07:00