Commit Graph

12929 Commits

Author SHA1 Message Date
jim-p
1ab9e48986 Encode gateway name and description before printing. Fixes #5876 2016-02-10 13:29:05 -05:00
jim-p
6a109e3eaf Make RRD lists global, validate graph name using whitelist of known values rather than blacklist of characters, beef up validation and escaping of related values while here. Fixes #5874 for 2.2.x 2016-02-10 12:09:57 -05:00
Phil Davis
ddba2645f9 Fix #3209 editing unassigned VLAN tag can change an assigned interface - RELENG_2_2
Might as well fix this bug in 2.2.* as well, since it is easy and was obviously an error.
2016-02-09 07:35:46 +05:45
Chris Buechler
ec0643f7f1 Merge pull request #2575 from davidjwood/RELENG_2_2-ppp-ipv6-new 2016-01-30 04:06:00 -06:00
Phil Davis
f155b6e430 pkg.php consolidate else-if statement 2016-01-25 20:59:45 +05:45
Phil Davis
9fa1712002 Wrap pkg_full_path in htmlspecialchars()
Because it contains $xml which is itself wrapped in htmlspecialchars() for display.
2016-01-25 13:59:11 +05:45
Phil Davis
b5b8f8dd2f Enhance error output when package file not found - RELENG_2_2
I had a system that had upgraded but the Notes package had not managed to (re)install. In that situation the Notes item is on the Status menu but there is no notes.xml or other notes code on the the system.
When I go to Status->Notes I get:
Warning: substr_compare(): The start position cannot exceed initial string length in /usr/local/www/pkg.php on line 56 File not found notes.xml

The warning is because realpath() returns false in this case and cannot be used is a parameter to substr_compare().

Handle this case, and make the error message more informative.

Note: In RELENG_2_2 print_info_box_np() puts a "Close" button and has no way to stop that. It looks dumb, but that can be cleaned up in 2.3 master. I am just doing this in RELENG_2_2 to avoid the PHP warning.
2016-01-25 13:34:48 +05:45
Phil Davis
1d44f99f35 Use current interface description for breadcrumb - RELENG_2_2
If you enter invalid stuff in the interface description - e.g. "123" - and press save, then you get a warning about it, but the breadcrumb changes to "Interfaces: 123" - the wrongly entered description (that was not applied).
If you enter a valid string for 'descr' then by this point $wancfg has the new value anyway and so the breadcrumb will change correctly if you make a valid entry in 'descr' and save.
2016-01-18 22:18:07 +05:45
Phil Davis
b9abac57ec Fix #5778 do not save changes if interface description matches an alias name - RELENG_2_2 2016-01-18 21:49:32 +05:45
Phil Davis
587f46f452 Rationalize add and delete buttons for limiter GUI RELENG_2_2
This has annoyed me in the past. I noticed it in 2.3-BETA just now and went to look on a 2.2.6 system and realized it is an issue there also.
1) When you click to add a new limiter or new queue, then the "Add new queue" button is displayed down the bottom. That is dumb - you are already adding and actually you need to enter the data and save first before adding something else.
2) When you are adding something (like in (1)) the Delete button is displayed. That is also dumb - there is nothing to delete until you have press save to add it!
3) When clicking on a Limiter at the top of the tree, the Delete button syas "Delete this queue", but it is the top level limiter that is being edited and could be deleted, The $_GET/$_POST that happens sends "pipe" and "queue" both with the name of the top-level limiter. So in the end $queue always exists. So we only want the text "Delete this queue" if $queue exists and the queue name is NOT the same as the pipe name.

I am submitting this for RELENG_2_2 because I wanted to sort that out anyway to understand what was wrong and how it should behave.

Then I can look at 2.3-BETA and make it work nicely there...
2016-01-07 10:49:59 +05:45
David Wood
20d6e88a88 Attempt to ensure interface_dhcpv6_configure() is called at the most appropriate time
* ppp-ipv6 for PPP type with dhcp6usev4iface (or PPP without dhcp6usev4iface, as dhcp6usev4iface appears to be a no-op on this type of connection)
* rc.newwanip for non-PPP type with dhcp6usev4iface (no change in this commit)
* interface_configure() in all other cases
2016-01-06 09:19:52 +00:00
David Wood
3bcd4ff623 Prevent ppp-ipv6 from taking any action when dhcp6 is active on the parent interface, not the PPP interface 2016-01-06 02:38:06 +00:00
Phil Davis
49ad2c22b1 Fix redmine #5722 DHCP validation for RELENG_2_2
Might as well provide the fixes for RELENG_2_2 since it is easy and that is where I first tested. Even if there is never a 2.2.7, at least the fixes are there in GitHub to be seen.
2016-01-01 14:21:22 +05:45
jim-p
c7cd5f1c5e Take this conditional out, it wasn't enough, and we have a script example for how to handle this properly now while respecting CSRF. 2015-12-23 10:08:04 -05:00
jim-p
3643958c95 Only disable CSRF on diag_backup.php for the download action where it might be scripted. Other actions need its protection. 2015-12-21 10:47:54 -05:00
jim-p
4fa888b46c Encode hostname before printing; remove some related dead code. 2015-12-21 10:15:30 -05:00
jim-p
49e83995ce Encode gateway attributes before printing. 2015-12-21 09:33:45 -05:00
jim-p
d83a4dfcdb Encode DNS servers and their associated gateways before printing 2015-12-21 09:04:18 -05:00
Chris Buechler
0548783251 Add range validation to CP IP passthrough. Ticket #5655 2015-12-17 22:14:39 -06:00
Chris Buechler
6d05bb9af7 add validation to MAC passthrough. Ticket #5655 2015-12-17 22:10:13 -06:00
Chris Buechler
75272760ed Wrong source of syntax error. Revert "fix syntax error in ipfw command to disable on inactive interfaces"
This reverts commit 6310eaa2c7.
2015-12-17 17:10:40 -06:00
Chris Buechler
6310eaa2c7 fix syntax error in ipfw command to disable on inactive interfaces 2015-12-17 17:07:34 -06:00
jim-p
fc02b11a9d Change status.php state dump to use -vvss for more verbose info, add kenv and pbi_info. 2015-12-17 10:48:50 -05:00
Chris Buechler
be77d67ced Merge pull request #2061 from phil-davis/patch-7 2015-12-15 21:02:15 -06:00
Renato Botelho
c33fd4cc00 Fix typo, gateway entry in config has a field called monitor, not monitorip 2015-12-11 11:06:26 -02:00
Phil Davis
6ae579b560 Redmine #4279 Package reinstall displayed when shutting down before upgrade
Use a different flag file to indicate that a package reinstall is
required after a reboot is done first. This avoids the possibility that
the user navigates in the webGUI during the time while the shutdown is
in progress and is accidentally presented with the reinstall all
packages GUI button.
Early in rc.bootup switch the flag file to use its ordinary name, so
that all subsequent code in boot scripts and webGUI will work as it
already does to handle the package reinstall and notifying the user that
a package reinstall is about to be done or in progress...
2015-12-07 11:14:16 +05:45
jim-p
3ac0284805 Address a potential LFI in pkg.php and wizard.php without breaking the ability to pass relative paths
Restricts them to files under their intended base directories.
2015-12-04 15:38:39 -05:00
Chris Buechler
dc77f00532 Remove txtsupport from Unbound. Of limited use, and the back end code was never ported over from the package (and is messy to do so). Ticket #5545 2015-12-03 15:26:17 -06:00
Chris Buechler
43180e9c49 Sanitize the session_id/logout_id in captive portal. 2015-12-02 18:22:55 -06:00
Renato Botelho
8d82158408 Merge pull request #2049 from phil-davis/patch-4 2015-11-19 07:18:00 -02:00
Renato Botelho
9996b3e427 Merge pull request #2083 from phil-davis/patch-10 2015-11-19 07:16:17 -02:00
Renato Botelho
e0d520a454 Merge pull request #2082 from phil-davis/patch-9 2015-11-19 07:15:14 -02:00
Phil Davis
7137664c9c Make block bogon rule display consistent - RELENG_2_2
The block private networks and anti-lockout rules display in the firewall rules display with the schedule column blank. But the block bogon networks has an asterisk. That looks odd. I noticed it just now when looking at firewall rules in 2.3.
Might as well fix it here in RELENG_2_2.
2015-11-18 09:50:48 +05:45
Phil Davis
e889b813a2 Backport fix #5467 to RELENG_2_2 2015-11-18 09:02:23 +05:45
Phil Davis
08d6f8ff2a Backport Redmine #5440 to RELENG_2_2
The code in RELENG_2_2 for system_usermanager_settings.php seems to work OK in RELENG_2_2 so I did not touch anything there.
But diag_authentication.php had nothing about $pconfig on initial page load. This extra code makes it select a reasonable default auth server when the page first loads. After that, each time the user does "Test", the page comes back with the previously selected auth server, user name and password (like it did already) - so that seems good.
2015-11-15 17:20:04 +05:45
Phil Davis
ecab9d4c2b Limit alias info popup size #5415 RELENG_2_2
This is code for RELENG_2_2 pfSense 2.2.5 that will limit the number of rows in the alias info popup to 100.
2015-11-11 22:43:28 +05:45
Matt Smith
c670525f04 diag_ipsec.php - show button for child SAs only when some are established. Fix ID used by child SA disconnect button. 2015-11-10 10:02:55 -06:00
Phil Davis
f3d64bb5ee Unbound advanced Invoming TCP Buffers validation
There is a variable cut-paste error here. Actually it never makes any difference in practice because outgoing_num_tcp and incoming_num_tcp are both set, so the logic comes out the same.
I noticed this while reviewing stuff in master for 2.3-ALPHA - might as well back-port stuff like this so that nobody who notices will worry about it in RELENG_2_2.
2015-11-10 11:23:57 +05:45
Renato Botelho
7b41790bc7 Fix syntax 2015-11-09 10:57:55 -02:00
Renato Botelho
adc7124bc8 Let the code ready for strongswan 5.3.4, where key used to track nat were committed with a different name 2015-11-09 10:56:59 -02:00
Renato Botelho
d6d9144e20 Only call pfSense_ipsec_list_sa() when IPsec is enabled 2015-11-03 16:58:58 -02:00
Matt Smith
5897e4e397 Remove a redundant if and fix indentation accordingly. Fix is_array that should be an isset on the remote SPI field. 2015-10-30 15:51:04 -05:00
Matt Smith
9c56811ac6 Update license on diag_ipsec.php. Keep required attributions and reference
the original m0n0wall BSD 2 clause.
2015-10-30 13:54:31 -05:00
Renato Botelho
84c7819887 Remove port information from diag_ipsec.php since it's not available on VICI, also use local-nat-t and remote-nat-t to detect when NAT-T is being used 2015-10-30 16:31:18 -02:00
Renato Botelho
90056c8719 Rework ipsec widget to use VICI 2015-10-30 16:02:21 -02:00
Renato Botelho
63253e044b Remove diag_ipsec_xml.php, not being used 2015-10-30 16:01:33 -02:00
Matt Smith
8512e90a92 Make IPsec status page retrieve status with VICI instead of SMP 2015-10-30 12:26:58 -05:00
Chris Buechler
5eac8374c6 Fix up descriptive text for logging levels. Ticket #5340 2015-10-26 17:18:34 -05:00
Chris Buechler
b4140b14a2 Default log level where none is selected should be 3 here. Ticket #5340 2015-10-26 16:28:55 -05:00
Chris Buechler
f418fde488 Correct available log levels. Ticket #5340 2015-10-26 15:45:10 -05:00