BSD Commit Log Search

VPN: OpenVPN: Instances - partially revert https://github.com/opnsense/core/commit/6c3be9a11699879fe50aea1c30e50de5864601d7 and add a specific regex constraint for static keys (alphanum, line endings, minus signs and hashes)

closes https://github.com/opnsense/core/issues/10483

config.xml.sample - fix default to use mvc firewall rules.

uuid's are omitted intentionally as the initial migration will generate a unique one automatically.

firmware: support for patch release matching

pkg: fix plist

php85 - some minor issues foud while testing firewall rules migration

Interfaces: Assignments - minor usability improvements.

* show "hint" when editing an interface without a description
* add lock toggle and set to locked by default.
* show identifier by default in grid and edit dialog

as discussed in https://github.com/opnsense/core/pull/10476

mvc: BaseField: in getNodes, emit descriptions as well when they're not the same as the value to match getNodeContent()'s behavior.

ref: https://github.com/opnsense/core/pull/10476

monit: allow spaces in places

Monit model never had a security concept and GHSA-fq94-cxvc-9r7w made
sure to restrict the fields, but went a bit too far with them.

PR: https://forum.opnsense.org/index.php?topic=52263.0
(cherry picked from commit b86fb99465d9faa603040c8b3af36e09067e24e0)

System: Access: Users - hasPrivilege not merging user privs correctly.

PR: GHSA-p9pr-782r-w2xw
(cherry picked from commit e15a884973746319e79bd2cd421e8a015cc3ddb9)

Firewall: fix some small issues in menu registration, taking under account the situations where legacy removed the items leading to config.xml like:

  <filter>
    <rule/>
  </filter>

And mvc Filter->rules always being there (the container vs the entries)

(cherry picked from commit bf08cc48326216eca7703a93b06f10825e64ae43)

System: Access: Users - hasPrivilege not merging user privs correctly.

PR: GHSA-p9pr-782r-w2xw

Firewall: NAT: Source NAT: Fix automatic rules not displayed for PPPoE interfaces, flatten automatic rules into two per WAN type interface (#10482)

ACL: cleanup some user ACL's for simplicity and overlap.

Firewall: NAT: Source NAT: Fix automatic rules not displayed for PPPoE interfaces, flatten automatic rules into two per WAN type interface

Firewall: fix some small issues in menu registration, taking under account the situations where legacy removed the items leading to config.xml like:

  <filter>
    <rule/>
  </filter>

And mvc Filter->rules always being there (the container vs the entries)

monit: allow spaces in places

Monit model never had a security concept and GHSA-fq94-cxvc-9r7w made
sure to restrict the fields, but went a bit too far with them.

PR: https://forum.opnsense.org/index.php?topic=52263.0

bootgrid: test disabling scroll

mvc: PortField now rejects whitespaces in port ranges during validation (#10478)

Fix the test, I wanted to see if it worked but forgot to update it that it didn't fire

mvc: PortField now rejects whitespaces in port ranges during validation

system: lockout: address newline injection and correct IP parsing

PR: GHSA-2v2x-m4j7-76pv
(cherry picked from commit 8bdaad95f405f4587bb83bf35aa652ca493cc2a4)

mvc: checkAndThrowValueInUse validate input token which may only contain alphanum and dashes

PR: GHSA-98h6-479q-9q3w
(cherry picked from commit d7054cef69f72588feac1091254960835be19dfe)

System: Settings: Administration - add missing legacy_html_escape_form_data for $a_cert

PR: GHSA-8pgr-x852-qx4j
(cherry picked from commit 9d0a590e9c49f4374a5539929b366123f63bc9eb)

network time: fix stored XSS in GPS init string display

Squelch a PHP warning and change the way the default init
command string is used.

PR: GHSA-h793-67jm-j4m5
(cherry picked from commit ed04a154dc40967541be1388e9134e451be4199e)

firewall: escape user-controlled values in tooltip attributes

PR: GHSA-2xrm-p255-p43h
(cherry picked from commit fb3b8a07f407ce281b1dde748706acbb0bc514ce)

Firewall: Aliases - safeguard ISO country codes in alias download

PR: GHSA-wjqq-rfmm-v5h3
(cherry picked from commit c46aced9c47d956167e294911113bc334fea5f48)

openvpn: escape client common_name in connection-status views (stored XSS)

The OpenVPN connection-status widget and the connection-status page render
the client common_name into an HTML attribute (data-common-name /
data-common_name) without escaping the double quote, so a common_name
containing a quote breaks out of the attribute. With username-as-common-name
plus a RADIUS/LDAP backend the common_name is an attacker-chosen value.
Escape the quote before placing it in the attribute.

PR: GHSA-26cj-h9rj-g5pf
(cherry picked from commit e7b2ac8093f804bef8eb88dfa9a0d99fad00c12b)

openvpn: prevent path traversal in "common_name" attribute

PR: GHSA-2m9v-p7r9-gfcw
(cherry picked from commit 6101b3e2c90482111f420a47775c14a447441a72)

src: configuration line injection via multiple GUI text fields

PR: GHSA-fq94-cxvc-9r7w
Co-authored-by: Franco Fichtner <franco at opnsense.org>
(cherry picked from commit 6c3be9a11699879fe50aea1c30e50de5864601d7)

firewall: escape user-controlled values in tooltip attributes

PR: GHSA-2xrm-p255-p43h