BSD Commit Log Search

configd/templates - allow "strict" mode +TARGETS using the ! keyword.

Example line:
!at.cron:/etc/cron.d/at

In which case the target won't be generated when multiple modules are being flushed out (such as template_ctl.py \* being used on boot)

While here, also deprecate codecs (python warning)

for https://github.com/opnsense/plugins/pull/5521

firmware: support for patch release matching

(cherry picked from commit c997621e316ebe9936b99ca3d0c15cbc62cc2b16)

VPN: OpenVPN: Instances - partially revert https://github.com/opnsense/core/commit/6c3be9a11699879fe50aea1c30e50de5864601d7 and add a specific regex constraint for static keys (alphanum, line endings, minus signs and hashes)

closes https://github.com/opnsense/core/issues/10483

(cherry picked from commit 803b2fa6855a8ef1431209edc7e257e7a7681d4e)

VPN: OpenVPN: Client Export - php85 issue "Using null as an array offset is deprecated"

VPN: OpenVPN: Instances - partially revert https://github.com/opnsense/core/commit/6c3be9a11699879fe50aea1c30e50de5864601d7 and add a specific regex constraint for static keys (alphanum, line endings, minus signs and hashes)

closes https://github.com/opnsense/core/issues/10483

config.xml.sample - fix default to use mvc firewall rules.

uuid's are omitted intentionally as the initial migration will generate a unique one automatically.

firmware: support for patch release matching

pkg: fix plist

php85 - some minor issues foud while testing firewall rules migration

Interfaces: Assignments - minor usability improvements.

* show "hint" when editing an interface without a description
* add lock toggle and set to locked by default.
* show identifier by default in grid and edit dialog

as discussed in https://github.com/opnsense/core/pull/10476

mvc: BaseField: in getNodes, emit descriptions as well when they're not the same as the value to match getNodeContent()'s behavior.

ref: https://github.com/opnsense/core/pull/10476

monit: allow spaces in places

Monit model never had a security concept and GHSA-fq94-cxvc-9r7w made
sure to restrict the fields, but went a bit too far with them.

PR: https://forum.opnsense.org/index.php?topic=52263.0
(cherry picked from commit b86fb99465d9faa603040c8b3af36e09067e24e0)

System: Access: Users - hasPrivilege not merging user privs correctly.

PR: GHSA-p9pr-782r-w2xw
(cherry picked from commit e15a884973746319e79bd2cd421e8a015cc3ddb9)

Firewall: fix some small issues in menu registration, taking under account the situations where legacy removed the items leading to config.xml like:

  <filter>
    <rule/>
  </filter>

And mvc Filter->rules always being there (the container vs the entries)

(cherry picked from commit bf08cc48326216eca7703a93b06f10825e64ae43)

System: Access: Users - hasPrivilege not merging user privs correctly.

PR: GHSA-p9pr-782r-w2xw

Firewall: NAT: Source NAT: Fix automatic rules not displayed for PPPoE interfaces, flatten automatic rules into two per WAN type interface (#10482)

ACL: cleanup some user ACL's for simplicity and overlap.

Firewall: NAT: Source NAT: Fix automatic rules not displayed for PPPoE interfaces, flatten automatic rules into two per WAN type interface

Firewall: fix some small issues in menu registration, taking under account the situations where legacy removed the items leading to config.xml like:

  <filter>
    <rule/>
  </filter>

And mvc Filter->rules always being there (the container vs the entries)

monit: allow spaces in places

Monit model never had a security concept and GHSA-fq94-cxvc-9r7w made
sure to restrict the fields, but went a bit too far with them.

PR: https://forum.opnsense.org/index.php?topic=52263.0

bootgrid: test disabling scroll

mvc: PortField now rejects whitespaces in port ranges during validation (#10478)

Fix the test, I wanted to see if it worked but forgot to update it that it didn't fire

mvc: PortField now rejects whitespaces in port ranges during validation

system: lockout: address newline injection and correct IP parsing

PR: GHSA-2v2x-m4j7-76pv
(cherry picked from commit 8bdaad95f405f4587bb83bf35aa652ca493cc2a4)

mvc: checkAndThrowValueInUse validate input token which may only contain alphanum and dashes

PR: GHSA-98h6-479q-9q3w
(cherry picked from commit d7054cef69f72588feac1091254960835be19dfe)

System: Settings: Administration - add missing legacy_html_escape_form_data for $a_cert

PR: GHSA-8pgr-x852-qx4j
(cherry picked from commit 9d0a590e9c49f4374a5539929b366123f63bc9eb)

network time: fix stored XSS in GPS init string display

Squelch a PHP warning and change the way the default init
command string is used.

PR: GHSA-h793-67jm-j4m5
(cherry picked from commit ed04a154dc40967541be1388e9134e451be4199e)

firewall: escape user-controlled values in tooltip attributes

PR: GHSA-2xrm-p255-p43h
(cherry picked from commit fb3b8a07f407ce281b1dde748706acbb0bc514ce)

Firewall: Aliases - safeguard ISO country codes in alias download

PR: GHSA-wjqq-rfmm-v5h3
(cherry picked from commit c46aced9c47d956167e294911113bc334fea5f48)