Project

General

Profile

« Previous | Next » 

Revision 4611e283

Added by Steve Beaver over 8 years ago

Revisions to GET/POST conversion limiting POSTs to save, apply, and delete functions

View differences:

src/usr/local/www/system_advanced_sysctl.php
47 47
	$id = htmlspecialchars_decode($_POST['id']);
48 48
}
49 49

  
50
$act = $_POST['act'];
50
$act = $_REQUEST['act'];
51 51

  
52 52
if ($act == "edit") {
53 53
	if (isset($a_tunable[$id])) {
......
62 62
	}
63 63
}
64 64

  
65
if ($act == "del") {
65
if ($_POST['act'] == "del") {
66 66
	if ($a_tunable[$id]) {
67 67
		if (!$input_errors) {
68 68
			unset($a_tunable[$id]);
......
118 118
	$pgtitle[] = gettext('Edit');
119 119
	$pglinks[] = "@self";
120 120
}
121

  
121 122
include("head.inc");
122 123

  
123 124
if ($input_errors) {
......
155 156
						<th class="col-sm-3"><?=gettext("Tunable Name"); ?></th>
156 157
						<th><?=gettext("Description"); ?></th>
157 158
						<th class="col-sm-1"><?=gettext("Value"); ?></th>
158
						<th><a class="btn btn-xs btn-success" href="system_advanced_sysctl.php?act=edit" usepost><i class="fa fa-plus icon-embed-btn"></i><?=gettext('New'); ?></a></th>
159
						<th><a class="btn btn-xs btn-success" href="system_advanced_sysctl.php?act=edit"><i class="fa fa-plus icon-embed-btn"></i><?=gettext('New'); ?></a></th>
159 160
					</tr>
160 161
				</thead>
161 162
				<?php
......
175 176
					?>
176 177
					</td>
177 178
					<td>
178
					<a class="fa fa-pencil" title="<?=gettext("Edit tunable"); ?>" href="system_advanced_sysctl.php?act=edit&amp;id=<?=$i;?>" usepost></a>
179
					<a class="fa fa-pencil" title="<?=gettext("Edit tunable"); ?>" href="system_advanced_sysctl.php?act=edit&amp;id=<?=$i;?>"></a>
179 180
						<?php if (isset($tunable['modified'])): ?>
180 181
						<a class="fa fa-trash" title="<?=gettext("Delete/Reset tunable")?>" href="system_advanced_sysctl.php?act=del&amp;id=<?=$i;?>" usepost></a>
181 182
						<?php endif; ?>
src/usr/local/www/system_authservers.php
96 96
	exit;
97 97
}
98 98

  
99
$id = $_POST['id'];
99
$id = $_REQUEST['id'];
100 100

  
101 101
if (!is_array($config['system']['authserver'])) {
102 102
	$config['system']['authserver'] = array();
......
114 114

  
115 115
$a_ca =& $config['ca'];
116 116

  
117
$act = $_POST['act'];
117
$act = $_REQUEST['act'];
118 118

  
119
if ($act == "del") {
119
if ($_POST['act'] == "del") {
120 120

  
121 121
	if (!$a_server[$_POST['id']]) {
122 122
		pfSenseHeader("system_authservers.php");
......
446 446
						<td><?=htmlspecialchars($server['host'])?></td>
447 447
						<td>
448 448
						<?php if ($i < (count($a_server) - 1)): ?>
449
							<a class="fa fa-pencil" title="<?=gettext("Edit server"); ?>" href="system_authservers.php?act=edit&amp;id=<?=$i?>" usepost></a>
449
							<a class="fa fa-pencil" title="<?=gettext("Edit server"); ?>" href="system_authservers.php?act=edit&amp;id=<?=$i?>"></a>
450 450
							<a class="fa fa-trash"  title="<?=gettext("Delete server")?>" href="system_authservers.php?act=del&amp;id=<?=$i?>" usepost></a>
451 451
						<?php endif?>
452 452
						</td>
......
459 459
</div>
460 460

  
461 461
<nav class="action-buttons">
462
	<a href="?act=new" class="btn btn-success btn-sm" usepost>
462
	<a href="?act=new" class="btn btn-success btn-sm">
463 463
		<i class="fa fa-plus icon-embed-btn"></i>
464 464
		<?=gettext("Add")?>
465 465
	</a>
src/usr/local/www/system_camanager.php
38 38
$ca_keylens = array("512", "1024", "2048", "3072", "4096", "7680", "8192", "15360", "16384");
39 39
$openssl_digest_algs = array("sha1", "sha224", "sha256", "sha384", "sha512", "whirlpool");
40 40

  
41
if (isset($_POST['id']) && is_numericint($_POST['id'])) {
42
	$id = $_POST['id'];
41
if (isset($_REQUEST['id']) && is_numericint($_REQUEST['id'])) {
42
	$id = $_REQUEST['id'];
43 43
}
44 44

  
45 45
if (!is_array($config['ca'])) {
......
60 60

  
61 61
$a_crl =& $config['crl'];
62 62

  
63
if ($_POST['act']) {
64
	$act = $_POST['act'];
63
if ($_REQUEST['act']) {
64
	$act = $_REQUEST['act'];
65 65
}
66 66

  
67
if ($act == "del") {
67
if ($_POST['act'] == "del") {
68 68

  
69 69
	if (!isset($a_ca[$id])) {
70 70
		pfSenseHeader("system_camanager.php");
......
153 153
	exit;
154 154
}
155 155

  
156
if ($_POST && ($_POST['save'] == 'Save')) {
156
if ($_POST['save'] == 'Save') {
157 157

  
158 158
	unset($input_errors);
159 159
	$input_errors = array();
......
426 426
						<?php endif?>
427 427
					</td>
428 428
					<td class="text-nowrap">
429
						<a class="fa fa-pencil"	title="<?=gettext("Edit CA")?>"	href="system_camanager.php?act=edit&amp;id=<?=$i?>" usepost></a>
430
						<a class="fa fa-certificate"	title="<?=gettext("Export CA")?>"	href="system_camanager.php?act=exp&amp;id=<?=$i?>" usepost></a>
429
						<a class="fa fa-pencil"	title="<?=gettext("Edit CA")?>"	href="system_camanager.php?act=edit&amp;id=<?=$i?>"></a>
430
						<a class="fa fa-certificate"	title="<?=gettext("Export CA")?>"	href="system_camanager.php?act=exp&amp;id=<?=$i?>"></a>
431 431
					<?php if ($ca['prv']): ?>
432
						<a class="fa fa-key"	title="<?=gettext("Export key")?>"	href="system_camanager.php?act=expkey&amp;id=<?=$i?>" usepost></a>
432
						<a class="fa fa-key"	title="<?=gettext("Export key")?>"	href="system_camanager.php?act=expkey&amp;id=<?=$i?>"></a>
433 433
					<?php endif?>
434 434
					<?php if (!ca_in_use($ca['refid'])): ?>
435 435
						<a class="fa fa-trash" 	title="<?=gettext("Delete CA and its CRLs")?>"	href="system_camanager.php?act=del&amp;id=<?=$i?>" usepost ></a>
......
444 444
</div>
445 445

  
446 446
<nav class="action-buttons">
447
	<a href="?act=new" class="btn btn-success btn-sm" usepost>
447
	<a href="?act=new" class="btn btn-success btn-sm">
448 448
		<i class="fa fa-plus icon-embed-btn"></i>
449 449
		<?=gettext("Add")?>
450 450
	</a>
src/usr/local/www/system_certmanager.php
44 44
$altname_types = array("DNS", "IP", "email", "URI");
45 45
$openssl_digest_algs = array("sha1", "sha224", "sha256", "sha384", "sha512", "whirlpool");
46 46

  
47
if (isset($_POST['userid']) && is_numericint($_POST['userid'])) {
48
	$userid = $_POST['userid'];
47
if (isset($_REQUEST['userid']) && is_numericint(REQUEST['userid'])) {
48
	$userid = $_REQUEST['userid'];
49 49
}
50 50

  
51 51
if (isset($userid)) {
......
56 56
	$a_user =& $config['system']['user'];
57 57
}
58 58

  
59
if (isset($_POST['id']) && is_numericint($_POST['id'])) {
60
	$id = $_POST['id'];
59
if (isset($_REQUEST['id']) && is_numericint($_REQUEST['id'])) {
60
	$id = $_REQUEST['id'];
61 61
}
62 62

  
63 63
if (!is_array($config['ca'])) {
......
79 79
	}
80 80
}
81 81

  
82
$act = $_POST['act'];
82
$act = $_REQUEST['act'];
83 83

  
84 84

  
85
if ($act == "del") {
85
if ($_POST['act'] == "del") {
86 86

  
87 87
	if (!isset($a_cert[$id])) {
88 88
		pfSenseHeader("system_certmanager.php");
......
200 200
	$pconfig['csr'] = base64_decode($a_cert[$id]['csr']);
201 201
}
202 202

  
203
if ($_POST['save'] == "Save") {
203
if ($_POST['save']) {
204 204
	// This is just the blank alternate name that is added for display purposes. We don't want to validate/save it
205 205
	if ($_POST['altname_value0'] == "") {
206 206
		unset($_POST['altname_type0']);
......
1057 1057
					</td>
1058 1058
					<td>
1059 1059
						<?php if (!$cert['csr']): ?>
1060
							<a href="system_certmanager.php?act=exp&amp;id=<?=$i?>" class="fa fa-certificate" title="<?=gettext("Export Certificate")?>" usepost></a>
1061
							<a href="system_certmanager.php?act=key&amp;id=<?=$i?>" class="fa fa-key" title="<?=gettext("Export Key")?>" usepost></a>
1062
							<a href="system_certmanager.php?act=p12&amp;id=<?=$i?>" class="fa fa-archive" title="<?=gettext("Export P12")?>" usepost></a>
1060
							<a href="system_certmanager.php?act=exp&amp;id=<?=$i?>" class="fa fa-certificate" title="<?=gettext("Export Certificate")?>"></a>
1061
							<a href="system_certmanager.php?act=key&amp;id=<?=$i?>" class="fa fa-key" title="<?=gettext("Export Key")?>"></a>
1062
							<a href="system_certmanager.php?act=p12&amp;id=<?=$i?>" class="fa fa-archive" title="<?=gettext("Export P12")?>"></a>
1063 1063
						<?php else: ?>
1064
							<a href="system_certmanager.php?act=csr&amp;id=<?=$i?>" class="fa fa-pencil" title="<?=gettext("Update CSR")?>" usep></a>
1065
							<a href="system_certmanager.php?act=req&amp;id=<?=$i?>" class="fa fa-sign-in" title="<?=gettext("Export Request")?>" usepost></a>
1066
							<a href="system_certmanager.php?act=key&amp;id=<?=$i?>" class="fa fa-key" title="<?=gettext("Export Key")?>" usepost></a>
1064
							<a href="system_certmanager.php?act=csr&amp;id=<?=$i?>" class="fa fa-pencil" title="<?=gettext("Update CSR")?>"></a>
1065
							<a href="system_certmanager.php?act=req&amp;id=<?=$i?>" class="fa fa-sign-in" title="<?=gettext("Export Request")?>"></a>
1066
							<a href="system_certmanager.php?act=key&amp;id=<?=$i?>" class="fa fa-key" title="<?=gettext("Export Key")?>"></a>
1067 1067
						<?php endif?>
1068 1068
						<?php if (!cert_in_use($cert['refid'])): ?>
1069 1069
							<a href="system_certmanager.php?act=del&amp;id=<?=$i?>" class="fa fa-trash" title="<?=gettext("Delete Certificate")?>" usepost></a>
......
1080 1080
</div>
1081 1081

  
1082 1082
<nav class="action-buttons">
1083
	<a href="?act=new" class="btn btn-success btn-sm" usepost>
1083
	<a href="?act=new" class="btn btn-success btn-sm">
1084 1084
		<i class="fa fa-plus icon-embed-btn"></i>
1085 1085
		<?=gettext("Add")?>
1086 1086
	</a>
src/usr/local/www/system_crlmanager.php
37 37
	"internal" => gettext("Create an internal Certificate Revocation List"),
38 38
	"existing" => gettext("Import an existing Certificate Revocation List"));
39 39

  
40
if (isset($_POST['id']) && ctype_alnum($_POST['id'])) {
41
	$id = $_POST['id'];
40
if (isset($_REQUEST['id']) && ctype_alnum($_REQUEST['id'])) {
41
	$id = $_REQUEST['id'];
42 42
}
43 43

  
44 44
if (!is_array($config['ca'])) {
......
65 65
	}
66 66
}
67 67

  
68
$act = $_POST['act'];
68
$act = $_REQUEST['act'];
69 69

  
70 70

  
71 71
if (!empty($id)) {
......
80 80
	$class = "danger";
81 81
}
82 82

  
83
if ($act == "del") {
83
if ($_POST['act'] == "del") {
84 84
	$name = htmlspecialchars($thiscrl['descr']);
85 85
	if (crl_in_use($id)) {
86 86
		$savemsg = sprintf(gettext("Certificate Revocation List %s is in use and cannot be deleted."), $name);
......
98 98
}
99 99

  
100 100
if ($act == "new") {
101
	$pconfig['method'] = $_POST['method'];
102
	$pconfig['caref'] = $_POST['caref'];
101
	$pconfig['method'] = $_REQUEST['method'];
102
	$pconfig['caref'] = $_REQUEST['caref'];
103 103
	$pconfig['lifetime'] = "9999";
104 104
	$pconfig['serial'] = "0";
105 105
}
......
120 120
if ($act == "addcert") {
121 121

  
122 122
	unset($input_errors);
123
	$pconfig = $_POST;
123
	$pconfig = $_REQUEST;
124 124

  
125 125
	if (!$pconfig['crlref'] || !$pconfig['certref']) {
126 126
		pfSenseHeader("system_crlmanager.php");
......
161 161
	}
162 162
	$found = false;
163 163
	foreach ($thiscrl['cert'] as $acert) {
164
		if ($acert['refid'] == $_POST['certref']) {
164
		if ($acert['refid'] == $_REQUEST['certref']) {
165 165
			$found = true;
166 166
			$thiscert = $acert;
167 167
		}
......
607 607
<?php
608 608
		if ($cainternal == "YES"):
609 609
?>
610
							<a href="system_crlmanager.php?act=new&amp;caref=<?=$ca['refid']; ?>" class="btn btn-xs btn-success" usepost>
610
							<a href="system_crlmanager.php?act=new&amp;caref=<?=$ca['refid']; ?>" class="btn btn-xs btn-success">
611 611
								<i class="fa fa-plus icon-embed-btn"></i>
612 612
								<?=gettext("Add or Import CRL")?>
613 613
							</a>
614 614
<?php
615 615
		else:
616 616
?>
617
							<a href="system_crlmanager.php?act=new&amp;caref=<?=$ca['refid']; ?>&amp;importonly=yes" class="btn btn-xs btn-success" usepost>
617
							<a href="system_crlmanager.php?act=new&amp;caref=<?=$ca['refid']; ?>&amp;importonly=yes" class="btn btn-xs btn-success">
618 618
								<i class="fa fa-plus icon-embed-btn"></i>
619 619
								<?=gettext("Add or Import CRL")?>
620 620
							</a>
......
636 636
						<td><?=($internal) ? count($tmpcrl['cert']) : "Unknown (imported)"; ?></td>
637 637
						<td><i class="fa fa-<?=($inuse) ? "check" : "times"; ?>"></i></td>
638 638
						<td>
639
							<a href="system_crlmanager.php?act=exp&amp;id=<?=$tmpcrl['refid']?>" class="fa fa-download" title="<?=gettext("Export CRL")?>" usepost></a>
639
							<a href="system_crlmanager.php?act=exp&amp;id=<?=$tmpcrl['refid']?>" class="fa fa-download" title="<?=gettext("Export CRL")?>" ></a>
640 640
<?php
641 641
				if ($internal): ?>
642
							<a href="system_crlmanager.php?act=edit&amp;id=<?=$tmpcrl['refid']?>" class="fa fa-pencil" title="<?=gettext("Edit CRL")?>" usepost></a>
642
							<a href="system_crlmanager.php?act=edit&amp;id=<?=$tmpcrl['refid']?>" class="fa fa-pencil" title="<?=gettext("Edit CRL")?>"></a>
643 643
<?php
644 644
				else:
645 645
?>
646
							<a href="system_crlmanager.php?act=editimported&amp;id=<?=$tmpcrl['refid']?>" class="fa fa-pencil" title="<?=gettext("Edit CRL")?>" usepost></a>
646
							<a href="system_crlmanager.php?act=editimported&amp;id=<?=$tmpcrl['refid']?>" class="fa fa-pencil" title="<?=gettext("Edit CRL")?>"></a>
647 647
<?php			endif;
648 648
				if (!$inuse):
649 649
?>
src/usr/local/www/system_gateway_groups.php
41 41
$a_gateways = &$config['gateways']['gateway_item'];
42 42
$changedesc = gettext("Gateway Groups") . ": ";
43 43

  
44
if ($_POST) {
45
	$pconfig = $_POST;
46 44

  
47
	if ($_POST['apply']) {
45
$pconfig = $_REQUEST;
48 46

  
49
		$retval = 0;
47
if ($_POST['apply']) {
50 48

  
51
		$retval |= system_routing_configure();
52
		send_multiple_events(array("service reload dyndnsall", "service reload ipsecdns", "filter reload"));
49
	$retval = 0;
53 50

  
54
		/* reconfigure our gateway monitor */
55
		setup_gateways_monitor();
51
	$retval |= system_routing_configure();
52
	send_multiple_events(array("service reload dyndnsall", "service reload ipsecdns", "filter reload"));
56 53

  
57
		if ($retval == 0) {
58
			clear_subsystem_dirty('staticroutes');
59
		}
54
	/* reconfigure our gateway monitor */
55
	setup_gateways_monitor();
60 56

  
61
		foreach ($a_gateway_groups as $gateway_group) {
62
			$gw_subsystem = 'gwgroup.' . $gateway_group['name'];
63
			if (is_subsystem_dirty($gw_subsystem)) {
64
				openvpn_resync_gwgroup($gateway_group['name']);
65
				clear_subsystem_dirty($gw_subsystem);
66
			}
57
	if ($retval == 0) {
58
		clear_subsystem_dirty('staticroutes');
59
	}
60

  
61
	foreach ($a_gateway_groups as $gateway_group) {
62
		$gw_subsystem = 'gwgroup.' . $gateway_group['name'];
63
		if (is_subsystem_dirty($gw_subsystem)) {
64
			openvpn_resync_gwgroup($gateway_group['name']);
65
			clear_subsystem_dirty($gw_subsystem);
67 66
		}
68 67
	}
69 68
}
......
72 71
	if ($a_gateway_groups[$_POST['id']]) {
73 72
		$changedesc .= sprintf(gettext("removed gateway group %s"), $_POST['id']);
74 73
		foreach ($config['filter']['rule'] as $idx => $rule) {
75
			if ($rule['gateway'] == $a_gateway_groups[$_POST['id']]['name']) {
74
			if ($rule['gateway'] == $a_gateway_groups[$_REQUEST['id']]['name']) {
76 75
				unset($config['filter']['rule'][$idx]['gateway']);
77 76
			}
78 77
		}
......
166 165
							<?=htmlspecialchars($gateway_group['descr'])?>
167 166
						</td>
168 167
						<td>
169
							<a href="system_gateway_groups_edit.php?id=<?=$i?>" class="fa fa-pencil" title="<?=gettext('Edit gateway group')?>" usepost></a>
170
							<a href="system_gateway_groups_edit.php?dup=<?=$i?>" class="fa fa-clone" title="<?=gettext('Copy gateway group')?>" usepost></a>
168
							<a href="system_gateway_groups_edit.php?id=<?=$i?>" class="fa fa-pencil" title="<?=gettext('Edit gateway group')?>"></a>
169
							<a href="system_gateway_groups_edit.php?dup=<?=$i?>" class="fa fa-clone" title="<?=gettext('Copy gateway group')?>"></a>
171 170
							<a href="system_gateway_groups.php?act=del&amp;id=<?=$i?>" class="fa fa-trash" title="<?=gettext('Delete gateway group')?>" usepost></a>
172 171
						</td>
173 172
					</tr>
......
182 181
</div>
183 182

  
184 183
<nav class="action-buttons">
185
	<a href="system_gateway_groups_edit.php" class="btn btn-success btn-sm" usepost>
184
	<a href="system_gateway_groups_edit.php" class="btn btn-success btn-sm">
186 185
		<i class="fa fa-plus icon-embed-btn"></i>
187 186
		<?=gettext('Add')?>
188 187
	</a>
src/usr/local/www/system_gateway_groups_edit.php
44 44
	'downlatency' => gettext("High Latency"),
45 45
	'downlosslatency' => gettext("Packet Loss or High Latency"));
46 46

  
47
if (isset($_POST['id']) && is_numericint($_POST['id'])) {
48
	$id = $_POST['id'];
47
if (isset($_REQUEST['id']) && is_numericint($_REQUEST['id'])) {
48
	$id = $_REQUEST['id'];
49 49
}
50 50

  
51
if (isset($_POST['dup']) && is_numericint($_POST['dup'])) {
52
	$id = $_POST['dup'];
51
if (isset($_REQUEST['dup']) && is_numericint($_REQUEST['dup'])) {
52
	$id = $_REQUEST['dup'];
53 53
}
54 54

  
55 55
if (isset($id) && $a_gateway_groups[$id]) {
......
59 59
	$pconfig['trigger'] = $a_gateway_groups[$id]['trigger'];
60 60
}
61 61

  
62
if (isset($_POST['dup']) && is_numericint($_POST['dup'])) {
62
if (isset($_REQUEST['dup']) && is_numericint($_REQUEST['dup'])) {
63 63
	unset($id);
64 64
}
65 65

  
src/usr/local/www/system_gateways.php
45 45

  
46 46
$a_gateway_item = &$config['gateways']['gateway_item'];
47 47

  
48
if ($_POST) {
48
$pconfig = $_REQUEST;
49 49

  
50
	$pconfig = $_POST;
51

  
52
	if ($_POST['apply']) {
50
if ($_POST['apply']) {
53 51

  
54
		$retval = 0;
52
	$retval = 0;
55 53

  
56
		$retval |= system_routing_configure();
57
		$retval |= system_resolvconf_generate();
58
		$retval |= filter_configure();
59
		/* reconfigure our gateway monitor */
60
		setup_gateways_monitor();
61
		/* Dynamic DNS on gw groups may have changed */
62
		send_event("service reload dyndnsall");
54
	$retval |= system_routing_configure();
55
	$retval |= system_resolvconf_generate();
56
	$retval |= filter_configure();
57
	/* reconfigure our gateway monitor */
58
	setup_gateways_monitor();
59
	/* Dynamic DNS on gw groups may have changed */
60
	send_event("service reload dyndnsall");
63 61

  
64
		if ($retval == 0) {
65
			clear_subsystem_dirty('staticroutes');
66
		}
62
	if ($retval == 0) {
63
		clear_subsystem_dirty('staticroutes');
67 64
	}
68 65
}
69 66

  
67

  
70 68
function can_delete_disable_gateway_item($id, $disable = false) {
71 69
	global $config, $input_errors, $a_gateways;
72 70

  
......
154 152
}
155 153

  
156 154
unset($input_errors);
157
if ($_POST['act'] == "del") {
158
	if (can_delete_disable_gateway_item($_POST['id'])) {
159
		$realid = $a_gateways[$_POST['id']]['attribute'];
160
		delete_gateway_item($_POST['id']);
155
if ($_REQUEST['act'] == "del") {
156
	if (can_delete_disable_gateway_item($_REQUEST['id'])) {
157
		$realid = $a_gateways[$_REQUEST['id']]['attribute'];
158
		delete_gateway_item($_REQUEST['id']);
161 159
		write_config("Gateways: removed gateway {$realid}");
162 160
		mark_subsystem_dirty('staticroutes');
163 161
		header("Location: system_gateways.php");
......
165 163
	}
166 164
}
167 165

  
168
if (isset($_POST['del_x'])) {
166
if (isset($_REQUEST['del_x'])) {
169 167
	/* delete selected items */
170
	if (is_array($_POST['rule']) && count($_POST['rule'])) {
171
		foreach ($_POST['rule'] as $rulei) {
168
	if (is_array($_REQUEST['rule']) && count($_REQUEST['rule'])) {
169
		foreach ($_REQUEST['rule'] as $rulei) {
172 170
			if (!can_delete_disable_gateway_item($rulei)) {
173 171
				break;
174 172
			}
......
176 174

  
177 175
		if (!isset($input_errors)) {
178 176
			$items_deleted = "";
179
			foreach ($_POST['rule'] as $rulei) {
177
			foreach ($_REQUEST['rule'] as $rulei) {
180 178
				delete_gateway_item($rulei);
181 179
				$items_deleted .= "{$rulei} ";
182 180
			}
......
189 187
		}
190 188
	}
191 189

  
192
} else if ($_POST['act'] == "toggle" && $a_gateways[$_POST['id']]) {
193
	$realid = $a_gateways[$_POST['id']]['attribute'];
190
} else if ($_REQUEST['act'] == "toggle" && $a_gateways[$_REQUEST['id']]) {
191
	$realid = $a_gateways[$_REQUEST['id']]['attribute'];
194 192
	$disable_gw = !isset($a_gateway_item[$realid]['disabled']);
195 193
	if ($disable_gw) {
196 194
		// The user wants to disable the gateway, so check if that is OK.
197
		$ok_to_toggle = can_delete_disable_gateway_item($_POST['id'], $disable_gw);
195
		$ok_to_toggle = can_delete_disable_gateway_item($_REQUEST['id'], $disable_gw);
198 196
	} else {
199 197
		// The user wants to enable the gateway. That is always OK.
200 198
		$ok_to_toggle = true;
......
302 300
							<?=htmlspecialchars($gateway['descr'])?>
303 301
						</td>
304 302
						<td>
305
							<a href="system_gateways_edit.php?id=<?=$i?>" class="fa fa-pencil" title="<?=gettext('Edit gateway');?>" usepost></a>
306
							<a href="system_gateways_edit.php?dup=<?=$i?>" class="fa fa-clone" title="<?=gettext('Copy gateway')?>" usepost></a>
303
							<a href="system_gateways_edit.php?id=<?=$i?>" class="fa fa-pencil" title="<?=gettext('Edit gateway');?>"></a>
304
							<a href="system_gateways_edit.php?dup=<?=$i?>" class="fa fa-clone" title="<?=gettext('Copy gateway')?>"></a>
307 305

  
308 306
<?php if (is_numeric($gateway['attribute'])): ?>
309 307
	<?php if (isset($gateway['disabled'])) {
......
327 325
</div>
328 326

  
329 327
<nav class="action-buttons">
330
	<a href="system_gateways_edit.php" role="button" class="btn btn-success" usepost>
328
	<a href="system_gateways_edit.php" role="button" class="btn btn-success">
331 329
		<i class="fa fa-plus icon-embed-btn"></i>
332 330
		<?=gettext("Add");?>
333 331
	</a>
src/usr/local/www/system_gateways_edit.php
49 49
$a_gateway_item = &$config['gateways']['gateway_item'];
50 50
$dpinger_default = return_dpinger_defaults();
51 51

  
52
if (is_numericint($_POST['id'])) {
53
	$id = $_POST['id'];
52
if (is_numericint($_REQUEST['id'])) {
53
	$id = $_REQUEST['id'];
54 54
}
55 55

  
56
if (isset($_POST['dup']) && is_numericint($_POST['dup'])) {
57
	$id = $_POST['dup'];
56
if (isset($_REQUEST['dup']) && is_numericint($_REQUEST['dup'])) {
57
	$id = $_REQUEST['dup'];
58 58
}
59 59

  
60 60
if (isset($id) && $a_gateways[$id]) {
......
88 88
	$pconfig['disabled'] = isset($a_gateways[$id]['disabled']);
89 89
}
90 90

  
91
if (isset($_POST['dup']) && is_numericint($_POST['dup'])) {
91
if (isset($_REQUEST['dup']) && is_numericint($_REQUEST['dup'])) {
92 92
	unset($id);
93 93
	unset($pconfig['attribute']);
94 94
}
src/usr/local/www/system_groupmanager.php
42 42
$a_group = &$config['system']['group'];
43 43

  
44 44
unset($id);
45
$id = $_POST['groupid'];
46
$act = (isset($_POST['act']) ? $_POST['act'] : '');
45
$id = $_REQUEST['groupid'];
46
$act = (isset($_REQUEST['act']) ? $_REQUEST['act'] : '');
47 47

  
48 48
function cpusercmp($a, $b) {
49 49
	return strcasecmp($a['name'], $b['name']);
......
59 59
	usort($a_group, "cpusercmp");
60 60
}
61 61

  
62
if ($act == "delgroup") {
62
if ($_POST['act'] == "delgroup") {
63 63

  
64
	if (!isset($id) || !isset($_POST['groupname']) || !isset($a_group[$id]) || ($_POST['groupname'] != $a_group[$id]['name'])) {
64
	if (!isset($id) || !isset($_REQUEST['groupname']) || !isset($a_group[$id]) || ($_REQUEST['groupname'] != $a_group[$id]['name'])) {
65 65
		pfSenseHeader("system_groupmanager.php");
66 66
		exit;
67 67
	}
......
73 73
	$savemsg = sprintf(gettext("Group %s successfully deleted."), $groupdeleted);
74 74
}
75 75

  
76
if ($act == "delpriv") {
76
if ($_POST['act'] == "delpriv") {
77 77

  
78 78
	if (!isset($id) || !isset($a_group[$id])) {
79 79
		pfSenseHeader("system_groupmanager.php");
80 80
		exit;
81 81
	}
82 82

  
83
	$privdeleted = $priv_list[$a_group[$id]['priv'][$_POST['privid']]]['name'];
84
	unset($a_group[$id]['priv'][$_POST['privid']]);
83
	$privdeleted = $priv_list[$a_group[$id]['priv'][$_REQUEST['privid']]]['name'];
84
	unset($a_group[$id]['priv'][$_REQUEST['privid']]);
85 85

  
86 86
	if (is_array($a_group[$id]['member'])) {
87 87
		foreach ($a_group[$id]['member'] as $uid) {
......
259 259
	$privhtml .= '</div>';
260 260

  
261 261
	$privhtml .= '<nav class="action-buttons">';
262
	$privhtml .=	'<a href="system_groupmanager_addprivs.php?groupid=' . $id . '" class="btn btn-success" usepost><i class="fa fa-plus icon-embed-btn"></i>' . gettext("Add") . '</a>';
262
	$privhtml .=	'<a href="system_groupmanager_addprivs.php?groupid=' . $id . '" class="btn btn-success"><i class="fa fa-plus icon-embed-btn"></i>' . gettext("Add") . '</a>';
263 263
	$privhtml .= '</nav>';
264 264

  
265 265
	return($privhtml);
......
290 290
$tab_array[] = array(gettext("Authentication Servers"), false, "system_authservers.php");
291 291
display_top_tabs($tab_array);
292 292

  
293
if (!($_POST['act'] == "new" || $_POST['act'] == "edit")) {
293
if (!($act == "new" || $act == "edit")) {
294 294
?>
295 295
<div class="panel panel-default">
296 296
	<div class="panel-heading"><h2 class="panel-title"><?=gettext('Groups')?></h2></div>
......
325 325
							<?=$groupcount?>
326 326
						</td>
327 327
						<td>
328
							<a class="fa fa-pencil" title="<?=gettext("Edit group"); ?>" href="?act=edit&amp;groupid=<?=$i?>" usepost></a>
328
							<a class="fa fa-pencil" title="<?=gettext("Edit group"); ?>" href="?act=edit&amp;groupid=<?=$i?>"></a>
329 329
							<?php if ($group['scope'] != "system"): ?>
330 330
								<a class="fa fa-trash"	title="<?=gettext("Delete group")?>" href="?act=delgroup&amp;groupid=<?=$i?>&amp;groupname=<?=$group['name']?>" usepost></a>
331 331
							<?php endif;?>
......
341 341
</div>
342 342

  
343 343
<nav class="action-buttons">
344
	<a href="?act=new" class="btn btn-success btn-sm" usepost>
344
	<a href="?act=new" class="btn btn-success btn-sm">
345 345
		<i class="fa fa-plus icon-embed-btn"></i>
346 346
		<?=gettext("Add")?>
347 347
	</a>
src/usr/local/www/system_groupmanager_addprivs.php
34 34

  
35 35
require_once("guiconfig.inc");
36 36

  
37
$groupid = $_POST['groupid'];
37
$groupid = $_REQUEST['groupid'];
38 38

  
39 39
$pgtitle = array(gettext("System"), gettext("User Manager"), gettext("Groups"), gettext("Edit"), gettext("Add Privileges"));
40 40
$pglinks = array("", "system_usermanager.php", "system_groupmanager.php", "system_groupmanager.php?act=edit&groupid=" . $groupid, "@self");
src/usr/local/www/system_routes.php
125 125
		exit;
126 126
	}
127 127

  
128
} else if ($_POST['act'] == "toggle") {
128
}
129

  
130
if ($_POST['act'] == "toggle") {
129 131
	if ($a_routes[$_POST['id']]) {
130 132
		$do_update_config = true;
131 133
		if (isset($a_routes[$_POST['id']]['disabled'])) {
......
151 153
			exit;
152 154
		}
153 155
	}
154
} else {
156
}
157

  
158
if($_POST['save']) {
155 159
	/* yuck - IE won't send value attributes for image buttons, while Mozilla does - so we use .x/.y to find move button clicks instead... */
156 160
	unset($movebtn);
157 161
	foreach ($_POST as $pn => $pd) {
......
266 270
						<?=htmlspecialchars($route['descr'])?>
267 271
					</td>
268 272
					<td>
269
						<a href="system_routes_edit.php?id=<?=$i?>" class="fa fa-pencil" title="<?=gettext('Edit route')?>" usepost></a>
273
						<a href="system_routes_edit.php?id=<?=$i?>" class="fa fa-pencil" title="<?=gettext('Edit route')?>"></a>
270 274

  
271
						<a href="system_routes_edit.php?dup=<?=$i?>" class="fa fa-clone" title="<?=gettext('Copy route')?>" usepost></a>
275
						<a href="system_routes_edit.php?dup=<?=$i?>" class="fa fa-clone" title="<?=gettext('Copy route')?>"></a>
272 276

  
273 277
				<?php if (isset($route['disabled'])) {
274 278
				?>
......
289 293
</div>
290 294

  
291 295
<nav class="action-buttons">
292
	<a href="system_routes_edit.php" role="button" class="btn btn-success btn-sm" usepost>
296
	<a href="system_routes_edit.php" role="button" class="btn btn-success btn-sm">
293 297
		<i class="fa fa-plus icon-embed-btn"></i>
294 298
		<?=gettext("Add")?>
295 299
	</a>
src/usr/local/www/system_routes_edit.php
44 44
$a_routes = &$config['staticroutes']['route'];
45 45
$a_gateways = return_gateways_array(true, true);
46 46

  
47
$id = $_POST['id'];
47
$id = $_REQUEST['id'];
48 48

  
49
if (isset($_POST['dup']) && is_numericint($_POST['dup'])) {
50
	$id = $_POST['dup'];
49
if (isset($_REQUEST['dup']) && is_numericint($_REQUEST['dup'])) {
50
	$id = $_REQUEST['dup'];
51 51
}
52 52

  
53 53
if (isset($id) && $a_routes[$id]) {
......
58 58
	$pconfig['disabled'] = isset($a_routes[$id]['disabled']);
59 59
}
60 60

  
61
if (isset($_POST['dup']) && is_numericint($_POST['dup'])) {
61
if (isset($_REQUEST['dup']) && is_numericint($_REQUEST['dup'])) {
62 62
	unset($id);
63 63
}
64 64

  
src/usr/local/www/system_usermanager.php
37 37
require_once("guiconfig.inc");
38 38

  
39 39
// start admin user code
40
if (isset($_POST['userid']) && is_numericint($_POST['userid'])) {
41
	$id = $_POST['userid'];
40
if (isset($_REQUEST['userid']) && is_numericint($_REQUEST['userid'])) {
41
	$id = $_REQUEST['userid'];
42 42
}
43 43

  
44 44
if (!isset($config['system']['user']) || !is_array($config['system']['user'])) {
......
46 46
}
47 47

  
48 48
$a_user = &$config['system']['user'];
49
$act = $_POST['act'];
49
$act = $_REQUEST['act'];
50 50

  
51 51
if (isset($_SERVER['HTTP_REFERER'])) {
52 52
	$referer = $_SERVER['HTTP_REFERER'];
......
487 487
	$privhtml .= '</div>';
488 488

  
489 489
	$privhtml .= '<nav class="action-buttons">';
490
	$privhtml .=	'<a href="system_usermanager_addprivs.php?userid=' . $id . '" class="btn btn-success" usepost><i class="fa fa-plus icon-embed-btn"></i>' . gettext("Add") . '</a>';
490
	$privhtml .=	'<a href="system_usermanager_addprivs.php?userid=' . $id . '" class="btn btn-success"><i class="fa fa-plus icon-embed-btn"></i>' . gettext("Add") . '</a>';
491 491
	$privhtml .= '</nav>';
492 492

  
493 493
	return($privhtml);
......
533 533
	$certhtml .= '</div>';
534 534

  
535 535
	$certhtml .= '<nav class="action-buttons">';
536
	$certhtml .=	'<a href="system_certmanager.php?act=new&amp;userid=' . $id . '" class="btn btn-success" usepost><i class="fa fa-plus icon-embed-btn"></i>' . gettext("Add") . '</a>';
536
	$certhtml .=	'<a href="system_certmanager.php?act=new&amp;userid=' . $id . '" class="btn btn-success"><i class="fa fa-plus icon-embed-btn"></i>' . gettext("Add") . '</a>';
537 537
	$certhtml .= '</nav>';
538 538

  
539 539
	return($certhtml);
......
546 546
	$pgtitle[] = gettext('Edit');
547 547
	$pglinks[] = "@self";
548 548
}
549

  
549 550
include("head.inc");
550 551

  
551 552
if ($delete_errors) {
......
608 609
						<td><?php if (isset($userent['disabled'])) echo "*"?></td>
609 610
						<td><?=implode(",", local_user_get_groups($userent))?></td>
610 611
						<td>
611
							<a class="fa fa-pencil" title="<?=gettext("Edit user"); ?>" href="?act=edit&amp;userid=<?=$i?>" usepost></a>
612
							<a class="fa fa-pencil" title="<?=gettext("Edit user"); ?>" href="?act=edit&amp;userid=<?=$i?>"></a>
612 613
<?php if (($userent['scope'] != "system") && ($userent['name'] != $_SESSION['Username'])): ?>
613 614
							<a class="fa fa-trash"	title="<?=gettext("Delete user")?>" href="?act=deluser&amp;userid=<?=$i?>&amp;username=<?=$userent['name']?>" usepost></a>
614 615
<?php endif; ?>
......
621 622
	</div>
622 623
</div>
623 624
<nav class="action-buttons">
624
	<a href="?act=new" class="btn btn-sm btn-success" usepost>
625
	<a href="?act=new" class="btn btn-sm btn-success">
625 626
		<i class="fa fa-plus icon-embed-btn"></i>
626 627
		<?=gettext("Add")?>
627 628
	</a>
src/usr/local/www/system_usermanager_addprivs.php
34 34

  
35 35
require_once("guiconfig.inc");
36 36

  
37
if (isset($_POST['userid']) && is_numericint($_POST['userid'])) {
38
	$userid = $_POST['userid'];
37
if (isset($_REQUEST['userid']) && is_numericint($_REQUEST['userid'])) {
38
	$userid = $_REQUEST['userid'];
39 39
}
40 40

  
41 41
$pgtitle = array(gettext("System"), gettext("User Manager"), gettext("Users"), gettext("Edit"), gettext("Add Privileges"));

Also available in: Unified diff