Bug #1639
closed
Port alias missing input validation in firewall_rules_edit.php
0%
Description
A port alias can be assigned only as the "to" or "from" port, which is invalid and results in a pf syntax error. If an alias is used, it must either be in the "from" box only, or in "from" and "to" both, a numeric port cannot be in either field when a port alias is specified.
Updated by Evgeny Yurchenko over 13 years ago
A port alias can be assigned only as the "to" or "from" port, which is invalid and results in a pf syntax error.
I did not manage to reproduce. If I put port alias only in from: and leave to: empty it is properly applied as if 'to=from'. If I put port alias only in to: leaving empty from: it is ignored and applied as 'to=from=any'.
Updated by Evgeny Yurchenko over 13 years ago
Updated by Ermal Luçi over 13 years ago
Isnt this commit a bit drastic?
Possibly just check impossible combination should be enough?
Updated by Evgeny Yurchenko over 13 years ago
Basically it checks for invalid combinations. I did not feel safe to call is_alias(something) without making sure 'something' is set. We can remove this things.
Updated by Chris Buechler over 13 years ago
- Status changed from Feedback to Resolved