pfSense

Do input validation on the actual array passed in

I was tearing my hair out for a while. If do_input_validation() is passed some array of keys/values that has been assembled elsewhere (not $_POST, $_GET or $_REQUEST superglobals) then it does not work. The code here, for at least the last 7 years, has actually been checking the array keys in the "hard-coded" superglobals. That is a bit surprising, since the array to be checked is passed in as $postdata parameter....

Escape IPv6 when passed to ndp delete command

(cherry picked from commit 1d92faa34f7c9aaa97b1983f273d2d73285befb5)

Add ability to delete NDP entry

(cherry picked from commit 13105d9c79fe3ac8be2b01c152fb9fb6a95147b4)

Remember original alias name on edit input errors

(cherry picked from commit 1271754326fe648093204296652398b1edd24912)

Refactor update_alias_names_upon_change

(cherry picked from commit 24807bfeaec218948937a1fdc2b4e863319e41a0)

Revise dev_mode change handler

(cherry picked from commit 8a0af41adc9c29ccf7b8dabb3b7658abf46054a6)

Fixed #7451
Revised onchage handlers to obviate need for second click in Chrome on MacOS

(cherry picked from commit dd3c646fa5744a550f91524035a92f509d6162cf)

Revert "Restore CSRF customizations"

This reverts commit 1d7a414705794f2527dc1b7b3bb5419db1024bb6.

Revert "CSRF: Close session before exit"

This reverts commit d2495e5893baa63b2973b66f7c1b9787fada2e30.

CSRF: Close session before exit

On CSRF, call phpsession_end() before exit to avoid syslog warning
about open session

Submitted by: PiBa-NL

Restore CSRF customizations

Update CSRF to latest version from github

Fix UTF8 in base64 decode

(cherry picked from commit 557e082696823ea5fa09a36d98f01775bf1e0c77)

Adds ability to ignore DHCP offers from multiple servers
- Forum thread: https://forum.pfsense.org/index.php?topic=124046.msg705100#msg705100
- related dhclient source:
https://github.com/pfsense/FreeBSD-src/blob/devel/sbin/dhclient/clparse.c#L945

changed files:...

Typo fix

Disallow IPv6 for RADIUS server.

See https://redmine.pfsense.org/issues/4154. No need for users to waste their time with debugging packets black hole.

Merge pull request #3613 from doktornotor/patch-15

Fixed #7445
Now properly handles service names that contain hyphens

(cherry picked from commit 21a8edd7836baf1e4ee2f347fdc1bafb4d96c9d9)

Merge pull request #3687 from doktornotor/patch-1

(cherry picked from commit 7c820a5d1ddb0ecf66ccaf1c4c82cc6361e15a6b)

Merge pull request #3580 from doktornotor/patch-9

load package add-on tabs into config to avoid parsing all installed package xml's, fix tabgroup filter

(cherry picked from commit bc0661b7b32a99016b9e71b0ece969f6584034c2)

Redmine #7435 Fix edit problems due to POST id code

Add underscores to is_port* function names

(cherry picked from commit 593e9fe32d2959cd823fe5da55714ccfb9a0e958)

Provide functions for checking port range alias combinations

Show the button to reset CARP demotion status even when the value is negative, and change the reset code to accommodate. Also fixup text in that dialog. Fixes #7424

Fix display of BIOS only on Sytem Info widget

Show BIOS information in the system info widget, if it exists in kenv.

System Info Widget enable All button when disable firmware check is set

If system firmware disablecheck is set, then the click event for the filter "All" button is also not included in the JS, so the "All" button is not effective.

The setTimeout for systemStatusGetUpdateStatus() can be moved up just below where it is declared and inside the existing "if" that conditionally includes that function - no need for it to be inside events.push...

Fix #7317 Widget Filter All button gateways widget RELENG_2_3

Reduce numeric precision in gateways widget to single decimal place (Feature #6841)

Further internationalization

Add missing internationalization

Revise gateway widget config form

Allow hiding of gateways in Gateways Widget

Sometimes there are gateways that I do not care about, so it is handy to
be able to save some space on the dashboard by hiding them.
This uses similar code structure taken from service_status widget. I
made the Save and Clear buttons and all that stuff use the same styles...

Visually separate the package manager legend area (Bug #7203)

Fix #7317 Widget Filter All button

(cherry picked from commit 7067e174c27a1fe9b23d13806f1e52ce9bc2aaee)

Fix #7364 Console assigned VLAN disappears after reboot

(cherry picked from commit 75a1149e0104561446e6f90f98d98c6c13c52996)

Fix #7306 Correctly filter log widget entries by interface description
(cherry picked from commit 27bc5848cfea95f97f70a4fe0c30da6319794a9a)

Remove whirlpool from the list of CA/Cert digest algorithms as it does not work properly. OpenSSL claims it's not valid ("unknown signature algorithm"). Fixes #7370
While I'm here, stop needlessly repeating the algo list, it's a global in certs.inc, so use that single copy of the list.

Fix display of openssl errors when working with CA or certificate entries. Found this while looking into ticket #7370

Set new blog URL (https://www.netgate.com/blog/) as default for RSS widget

(cherry picked from commit 294f14f7897f973f1fa2a1506cfdd9117b5daf65)

Redmine #7301 Put dot after the word break

Signed-off-by: Phil Davis <phil.davis@inf.org>
(cherry picked from commit 81b1b44ad7e4d7abc635b08533359b9df45b54b2)

Redmine #7301 Provide word-break opportunity for dynamic DNS host names

Signed-off-by: Phil Davis <phil.davis@inf.org>
(cherry picked from commit 138e79d42cb1771e3b8fcc727270187f5c7ee7db)

Add reasons to write_config() calls
(cherry picked from commit 919a43a7caa551cb14e72a5cd82ec1629b3a9aa5)

Remove useless add_base_packages_menu_items() function

Not really sure what was the idea 7+ years ago, but the code just doesn't make sense now.
(cherry picked from commit 94503103d8ce4e34de79f221f4fdd24f07dccb93)

Deduplicate code

Allow CloudFlare DDNS entries to use "" or "." for the hostname portion of the domain in the GUI to update the domain's @ record. Then in the backend code, remove that from the FQDN since CloudFlare doesn't like that to be sent explicitly. Fixes #7357

Fix is confirmed to work by two forum users: https://forum.pfsense.org/index.php?topic=122099.msg699763#msg699763

Do not enforce a max limit on state timeout when editing a firewall rule. Fixes #7356

Remove useless config_lock()/config_unlock() calls

Adjust fix for ticket #7294 for 2.3.x, it used a setHelp change that was only valid on 2.4.

Fix 7294 keep full rule description

Signed-off-by: Phil Davis <phil.davis@inf.org>
(cherry picked from commit 680e15baef76a9c598d52d3f2b9ab498077336a8)

Show PPPoE/PPTP/L2TP uptime on the Interfaces widget (Feature #6032)
(cherry picked from commit dc0f5e46a03e0ea797fb74df03e09c58f44a5c1a)

User Manager - Status Icon - Sort Order

Make status column sort order work correctly with the icons.

(2.4, 2.3)

(cherry picked from commit 0fdbaca8f16d0424cb2565ff4341e7620a7bdd2d)

Use the same cache filename pattern for RFC2136 IPv6 items as used by dyndns

Use | to separate dyndns IPv4 fields on cache file as done by rfc2136 items and for all IPv6 items

Fix #7300 provide default value for ipprotocol for old rules

Remove another leftover

Fix NTP widget to show server time (Issue #7245)

Fixes #7296
HTML tags not allowed in selector option values

(cherry picked from commit 57f4327a60c0cabf43161a6cfde98479b42a7092)

Check that DHCP registration isn't enabled for DNS forwarder/resolver when disabling DHCP server
(cherry picked from commit e83c9b733c86f39a14a874b115f2b8e0adc952e7)

Only allow the DHCP registration options to be enabled when DHCP server is enabled as well
(cherry picked from commit c6d03f09e035806dca8ac3314b41a3eaf523ab3f)

Only allow the DHCP registration options to be enabled when DHCP server is enabled as well
(cherry picked from commit 13fca9bcb3fdecfb6f9707e621b49f89569abfd7)

User Manager - Status Icon

Use icon for status rather than textual asterisk to indicate disabled account.

(2.4, 2.3)

(cherry picked from commit edd88334dbe95af4600ae493fa86d45244cbaecb)

Merge pull request #3528 from phil-davis/system-information-widget-filter-2_3

Merge pull request #3527 from phil-davis/breadcrumbs-2_3

fix colspan background on dark theme

Add "required field" highlighting

Only save valid widget locations in config

Some widgets create extra panels, e.g. the widgets that now have the filter functionality. Those panels are processed in the ".each" at line 424. They do not have an id in the form "widget-*" and when the old code tries to find the "*" part it gets "undefined". This results in the layout being saved like:...

Allow 5 dashboard columns to work

Selecting 1,2,3,4 or 6 dashboards columns results in an exact integer result here and all is good. But 5 columns results in "2.4" and "col-sm-2.4" is not a thing in bootstrap.
We need just the best int we can choose here, which is one that is just the int part of the division. That ensures that the 5 columns extend over less than the standard bootstrap total of 12 "units" wide....

Fix saving Hybrid RSA + Xauth. Fixes #7258

Revert "Add privs to control display of notices"

Fix #7051

This reverts commit 04665e78537906f7375668ca665cba17f95a4864.

IPv4 Tunnel Network is required for OpenVPN server

(cherry picked from commit e4488e51cf424907e06ef7cc73370aa0657e5e25)

System Information widget filter gettext()

(cherry picked from commit f5d762f90924510c097a9065dff135dab01f46f0)

System Information Widget Filter

(cherry picked from commit 718b3b0b1b75de09a87866cb37b5a0752643283a)

Fix cut-paste error in Breadcrumb Links
(cherry picked from commit 0e5ee5ae260c42a05b79edf74fb491fca52bacb4)

Breadcrumb links

(cherry picked from commit edcd75357f0e93b124159314d3306197d5312e6c)

Breadcrumb links support

(cherry picked from commit c50f228a1583fe694993778e8576322877a15bba)

Add foot.inc back to status.php

4th attempt!
- Reworked based on recent comments from @rbgarga

(cherry picked from commit c516cb287a78f7b05459e7fcba410f443d8eb8af)

3rd try!
- incorporate suggestions from @rbgarga with slight modification

(cherry picked from commit 6c2f093000b05285546e81dd1a578fc9b573b72b)

2nd try. . .

/etc/inc/util.inc:
- arp_get_mac_by_ip() updated to support IPv6
- attempt at code streamline

/usr/local/www/services_dhcp_edit.php:
- streamline code, now just a simple call to arp_get_mac_by_ip()

(cherry picked from commit dd83f869b79a858bd74c7a8bb4adcd49217445b0)

enhancements to services_dhcp_edit.php
- added ndp call to get MAC addr if remote client is connected via IPv6
- automatically hide `Copy MAC` button if arp/ndp returns null
- switch to exec() instead of backticks for calls to arp
- uses builtin is_ipaddr() function from util.inc...

Sync up status.php with master, but keep the 2.3/10.3-specific parts. Fixes #7246

Do not output PHP shell starup message unless it is run interactively. Fixes #7045

Fix for bug 6966 https://redmine.pfsense.org/issues/6966

Change-Id: I9471c2bbd8941e70965a86d369c8de87be9a4417
(cherry picked from commit 109a304e154a179bd340b06880ce95baec4dab03)

Revert "Fixed #6753"
User feedback suggests the sorted menu was better, despite the lack of consistency elsewhere.
This reverts commit 96ff627ff95e0fcadf8c15dbd6fe681309cb0fd8.

Mark missing parameter as required. It got lost during backport from master as spotted by @phil-davis

Required fields - Alias Type

should be a required field. And this 1-char change can also be backported to RELENG_2_3. I noticed this while looking at GUI pages in 2.3.3
(cherry picked from commit 8ea10c11441b5aed0b10eb14038aa8f8adbfb3de)

Fix #7157

trafficgraph: Don't update the on screen visual graph while invisible,
which avoids creating a large queue of pending timer objects waiting
for the next requestAnimationFrame to happen.

Submitted by: PiBa-NL at https://github.com/pfsense/pfsense/pull/3450

Ticket #7157: Backport upstream fix from https://github.com/novus/nvd3/commit/305cbad96e94f61a3c0bae02d16c28e09249fbc0

Example of setting required items

(cherry picked from commit 32a85c63c9411463c98a0605772b3e2c01702971)

Revise setHelpText to accommodate required fields

Provide Javascript set_Required function

Provide CSS for required fields

Add "Required field" capability to Groups.class.php

status_upnp remove nested getext()

I don't think this does anything useful.
(cherry picked from commit 3224663a3759935b47406c789b9f5cea3eb88136)

Part fix #7233 keep correct staticmap_array_index

The index needs to be incremented even for entries that were skipped for display because they (for whatever reason) have no MAC or CID set. So use the key directly from the array.
(cherry picked from commit 9aa3c5e84984958caa19ac76ecba849b94a8b360)

Part Fix #7233 Allow deletion of empty static map entries
(cherry picked from commit 2ea70e1a474fd871a007c76841f2a33f34082c58)

diag_backup do not use button text for comparisons

(cherry picked from commit 9a7e1c9580c5779c86bc97d6d82c43401c7a4b12)

Rather than setting the value directly, minimize exposure to eval() in update_config_field() from wizard.php by constructing a variable reference, then set the value using the reference rather than passing user input through eval(). Fixes #7230