commit 209ae18603da965c284c9576975ebea300c99ac6
Author: jim-p <jimp@netgate.com>
Date:   Tue Jul 31 16:30:39 2018 -0400

    Validation for GUI custom settings. Fixes #8726
    
    Add validation for customizable GUI setting fields and test submitted
    values before allowing them to be stored.
    Also ensure that dashboardcolumns is an integer before using it in the
    GUI.
    
    (cherry picked from commit 9ceace2562e718b9b460633847c12050fff96640)
    (cherry picked from commit db7f2719b747da77805972f797c23654518d438e)

diff --git a/src/etc/inc/pfsense-utils.inc b/src/etc/inc/pfsense-utils.inc
index cd050618ba..4cf6a04f83 100644
--- a/src/etc/inc/pfsense-utils.inc
+++ b/src/etc/inc/pfsense-utils.inc
@@ -245,6 +245,12 @@ function gen_webguifixedmenu_field(&$section, $value) {
 		["" => gettext("Scrolls with page"), "fixed" => gettext("Fixed (Remains visible at top of page)")]
 	))->setHelp("The fixed option is intended for large screens only.");
 }
+function validate_webguifixedmenu_field(&$input_errors, $value) {
+	$valid_values = array("", "fixed");
+	if (!in_array($value, $valid_values)) {
+		$input_errors[] = gettext("The submitted Top Navigation value is invalid.");
+	}
+}
 
 /****f* pfsense-utils/gen_webguihostnamemenu_field
  * NAME
@@ -264,6 +270,12 @@ function gen_webguihostnamemenu_field(&$section, $value) {
 		["" => gettext("Default (No hostname)"), "hostonly" => gettext("Hostname only"), "fqdn" => gettext("Fully Qualified Domain Name")]
 	))->setHelp("Replaces the Help menu title in the Navbar with the system hostname or FQDN.");
 }
+function validate_webguihostnamemenu_field(&$input_errors, $value) {
+	$valid_values = array("", "hostonly", "fqdn");
+	if (!in_array($value, $valid_values)) {
+		$input_errors[] = gettext("The submitted Hostname in Menu value is invalid.");
+	}
+}
 
 /****f* pfsense-utils/gen_dashboardcolumns_field
  * NAME
@@ -276,7 +288,7 @@ function gen_webguihostnamemenu_field(&$section, $value) {
  ******/
 function gen_dashboardcolumns_field(&$section, $value) {
 
-	if (($value < 1) || ($value > 4)) {
+	if (((int) $value < 1) || ((int) $value > 4)) {
 		$value = 2;
 	}
 
@@ -288,6 +300,11 @@ function gen_dashboardcolumns_field(&$section, $value) {
 		[min => 1, max => 4]
 	));
 }
+function validate_dashboardcolumns_field(&$input_errors, $value) {
+	if (!is_numericint($value) || ((int) $value < 1) || ((int) $value > 6)) {
+		$input_errors[] = gettext("The submitted Dashboard Columns value is invalid.");
+	}
+}
 
 /****f* pfsense-utils/gen_interfacessort_field
  * NAME
diff --git a/src/usr/local/www/head.inc b/src/usr/local/www/head.inc
index 8d964865d6..cce6c2a973 100644
--- a/src/usr/local/www/head.inc
+++ b/src/usr/local/www/head.inc
@@ -471,7 +471,7 @@ if ($user_settings['webgui']['webguifixedmenu'] == "fixed") {
 	$menuclass = "fixed";
 }
 
-$numColumns = $user_settings['webgui']['dashboardcolumns'];
+$numColumns = (int) $user_settings['webgui']['dashboardcolumns'];
 
 if (($pagename === "index.php") && ($numColumns > 2)) {
 	$columnsContainer = 'style="max-width: ' . 585*$numColumns . 'px;width: 100%"';
diff --git a/src/usr/local/www/index.php b/src/usr/local/www/index.php
index 1dfc8c75c8..a5eb035a38 100644
--- a/src/usr/local/www/index.php
+++ b/src/usr/local/www/index.php
@@ -262,7 +262,7 @@ if ($fd) {
 
 ##build widget saved list information
 if ($user_settings['widgets']['sequence'] != "") {
-	$dashboardcolumns = isset($user_settings['webgui']['dashboardcolumns']) ? $user_settings['webgui']['dashboardcolumns'] : 2;
+	$dashboardcolumns = isset($user_settings['webgui']['dashboardcolumns']) ? (int) $user_settings['webgui']['dashboardcolumns'] : 2;
 	$pconfig['sequence'] = $user_settings['widgets']['sequence'];
 	$widgetsfromconfig = array();
 
diff --git a/src/usr/local/www/system.php b/src/usr/local/www/system.php
index 9b2fb42707..a26c0b24e2 100644
--- a/src/usr/local/www/system.php
+++ b/src/usr/local/www/system.php
@@ -190,45 +190,6 @@ if ($_POST) {
 
 	do_input_validation($_POST, $reqdfields, $reqdfieldsn, $input_errors);
 
-//	if ($_POST['dashboardperiod']) {
-//		$config['widgets']['period'] = $_POST['dashboardperiod'];
-//	}
-
-	if ($_POST['webguicss']) {
-		$config['system']['webgui']['webguicss'] = $_POST['webguicss'];
-	} else {
-		unset($config['system']['webgui']['webguicss']);
-	}
-
-
-	if ($_POST['logincss']) {
-		$config['system']['webgui']['logincss'] = $_POST['logincss'];
-	} else {
-		unset($config['system']['webgui']['logincss']);
-	}
-
-	$config['system']['webgui']['loginshowhost'] = $_POST['loginshowhost'] ? true:false;
-
-	if ($_POST['webguifixedmenu']) {
-		$config['system']['webgui']['webguifixedmenu'] = $_POST['webguifixedmenu'];
-	} else {
-		unset($config['system']['webgui']['webguifixedmenu']);
-	}
-
-	if ($_POST['webguihostnamemenu']) {
-		$config['system']['webgui']['webguihostnamemenu'] = $_POST['webguihostnamemenu'];
-	} else {
-		unset($config['system']['webgui']['webguihostnamemenu']);
-	}
-
-	if ($_POST['dashboardcolumns']) {
-		$config['system']['webgui']['dashboardcolumns'] = $_POST['dashboardcolumns'];
-	} else {
-		unset($config['system']['webgui']['dashboardcolumns']);
-	}
-
-	$config['system']['webgui']['requirestatefilter'] = $_POST['requirestatefilter'] ? true : false;
-
 	if ($_POST['hostname']) {
 		if (!is_hostname($_POST['hostname'])) {
 			$input_errors[] = gettext("The hostname can only contain the characters A-Z, 0-9 and '-'. It may not start or end with '-'.");
@@ -241,6 +202,10 @@ if ($_POST) {
 	if ($_POST['domain'] && !is_domain($_POST['domain'])) {
 		$input_errors[] = gettext("The domain may only contain the characters a-z, 0-9, '-' and '.'.");
 	}
+	validate_webguicss_field($input_errors, $_POST['webguicss']);
+	validate_webguifixedmenu_field($input_errors, $_POST['webguifixedmenu']);
+	validate_webguihostnamemenu_field($input_errors, $_POST['webguihostnamemenu']);
+	validate_dashboardcolumns_field($input_errors, $_POST['dashboardcolumns']);
 
 	$dnslist = $ignore_posted_dnsgw = array();
 
@@ -335,6 +300,46 @@ if ($_POST) {
 		unset($config['system']['webgui']['statusmonitoringsettingspanel']);
 		$config['system']['webgui']['statusmonitoringsettingspanel'] = $_POST['statusmonitoringsettingspanel'] ? true : false;
 
+//		if ($_POST['dashboardperiod']) {
+//			$config['widgets']['period'] = $_POST['dashboardperiod'];
+//		}
+
+		if ($_POST['webguicss']) {
+			$config['system']['webgui']['webguicss'] = $_POST['webguicss'];
+		} else {
+			unset($config['system']['webgui']['webguicss']);
+		}
+
+		$config['system']['webgui']['roworderdragging'] = $_POST['roworderdragging'] ? true:false;
+
+		if ($_POST['logincss']) {
+			$config['system']['webgui']['logincss'] = $_POST['logincss'];
+		} else {
+			unset($config['system']['webgui']['logincss']);
+		}
+
+		$config['system']['webgui']['loginshowhost'] = $_POST['loginshowhost'] ? true:false;
+
+		if ($_POST['webguifixedmenu']) {
+			$config['system']['webgui']['webguifixedmenu'] = $_POST['webguifixedmenu'];
+		} else {
+			unset($config['system']['webgui']['webguifixedmenu']);
+		}
+
+		if ($_POST['webguihostnamemenu']) {
+			$config['system']['webgui']['webguihostnamemenu'] = $_POST['webguihostnamemenu'];
+		} else {
+			unset($config['system']['webgui']['webguihostnamemenu']);
+		}
+
+		if ($_POST['dashboardcolumns']) {
+			$config['system']['webgui']['dashboardcolumns'] = $_POST['dashboardcolumns'];
+		} else {
+			unset($config['system']['webgui']['dashboardcolumns']);
+		}
+
+		$config['system']['webgui']['requirestatefilter'] = $_POST['requirestatefilter'] ? true : false;
+
 		/* XXX - billm: these still need updating after figuring out how to check if they actually changed */
 		$olddnsservers = $config['system']['dnsserver'];
 		unset($config['system']['dnsserver']);
diff --git a/src/usr/local/www/system_user_settings.php b/src/usr/local/www/system_user_settings.php
index 5a40f629ac..0c14efa89b 100644
--- a/src/usr/local/www/system_user_settings.php
+++ b/src/usr/local/www/system_user_settings.php
@@ -94,6 +94,10 @@ if (isset($_POST['save'])) {
 	$reqdfields = explode(" ", "webguicss dashboardcolumns");
 	$reqdfieldsn = array(gettext("Theme"), gettext("Dashboard Columns"));
 	do_input_validation($_POST, $reqdfields, $reqdfieldsn, $input_errors);
+	validate_webguicss_field($input_errors, $_POST['webguicss']);
+	validate_webguifixedmenu_field($input_errors, $_POST['webguifixedmenu']);
+	validate_webguihostnamemenu_field($input_errors, $_POST['webguihostnamemenu']);
+	validate_dashboardcolumns_field($input_errors, $_POST['dashboardcolumns']);
 
 	$userent = $a_user[$id];
 
diff --git a/src/usr/local/www/system_usermanager.php b/src/usr/local/www/system_usermanager.php
index 0ad8154285..5d8af45f5f 100644
--- a/src/usr/local/www/system_usermanager.php
+++ b/src/usr/local/www/system_usermanager.php
@@ -310,6 +310,10 @@ if ($_POST['save']) {
 			$input_errors[] = gettext("Invalid internal Certificate Authority") . "\n";
 		}
 	}
+	validate_webguicss_field($input_errors, $_POST['webguicss']);
+	validate_webguifixedmenu_field($input_errors, $_POST['webguifixedmenu']);
+	validate_webguihostnamemenu_field($input_errors, $_POST['webguihostnamemenu']);
+	validate_dashboardcolumns_field($input_errors, $_POST['dashboardcolumns']);
 
 	if (!$input_errors) {
 
