firewall: skip alias on rules GUI reload
Also align the alias load path in the controller with
how !skip_alias serializes the sequence after rules
reload inside filter_configure_sync().
(cherry picked from commit a3091013d724f19e5fc2767a12de811da606e935)
(cherry picked from commit 5c1d8575a7d87dd717963506b510d144e6fcd63a)
Firewall: NAT: Destination NAT: Add validations for No RDR, prevent target and local-port being set (#10447)
(cherry picked from commit 7914d185d4fbc0faa06572ba205391654df7b589)
Firewall: Rules: Improve interface filter logic to include floating rules with multiple interfaces when they overlap with at least one interface in the interface filter request (#10449)
* Firewall: Rules: Improve interface filter logic to include floating rules with multiple interfaces when they overlap with at least one interface in the interface filter request.
* Improve inverted interface condition, make it symmetric to positive interface match in final else condition
(cherry picked from commit a1d16690c2c34c0a131e70e0ffeee0771f672b0e)
Firewall: Migration Assistant: Show rule counts that can be exported, hide tab if no rules exist (#10395)
(cherry picked from commit f4c040a0c134d73264ebfe932fe6a80e6f3768cf)
mvc: give throwReadOnly() a sibling named throwNotFullAdmin() which validates if a user has full access rights and can be treated as "provides safe input".
Although there aren't a lot of cases where user input can't be validated strictly enough, there are still one or two edge cases which offer some sort of "advanced" input which we currently wouldn't accept and are thus hard to change for historic reasons. The most prominent one is Monit, which allows local commands being executed.
throwNotFullAdmin simply raises an exception and bails before persisting changes to the configuration, which can be set on a per action or controller (internalSaveRequiresAdmin).
(cherry picked from commit 578e025111161ffd03fd3fd0ccdac203be546505)
mvc: DescriptionField: disable special and newline characters
This is only cosmetic and since the description is only used as a
label and not a note block this is fine (and could be overwridden
by the model if needed).
(cherry picked from commit d3c654f848284bcf8b510ea22df3e6ac90063387)
openvpn: clean up these option values
Push flags not always mention "push" in label but their
context is clear and keys do not change so simplify.
(cherry picked from commit a9dee3dcff89be9ecd2985ebe590e79ad0bdf01f)
Firewall: NAT: Source NAT: skip rendering rules when mode is not advanced (manual) or hybrid (#10472)
(cherry picked from commit aa2a54a5a8a9988b7a63e6ccef18ab01a4777a83)
