OPNSense/core 569b3a6src/etc/inc/plugins.inc.d ipsec.inc

ipsec: validate the use of refid in CA certificates

PR: GHSA-33q4-wcv7-r8fr
(cherry picked from commit 6bc0a1df6550c419f2a44461f6595cacf2080bfa)
DeltaFile
+6-5src/etc/inc/plugins.inc.d/ipsec.inc
+6-51 files

OPNSense/core fb4ee60src/www firewall_rules_edit.php

firewall: escape shaper targets in rule edit

PR: GHSA-m4m3-v627-wgc2
(cherry picked from commit 3de53a25fdd9b605acc82e4071e9920fa1c9b418)
DeltaFile
+1-0src/www/firewall_rules_edit.php
+1-01 files

OPNSense/core e2cd067src/opnsense/mvc/app/models/OPNsense/Trust Cert.xml Ca.xml, src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes CertificatesField.php CAsField.php

mvc: strict alphanumeric-only regex for certificate refid

CVE: CVE-2026-53582
PR: GHSA-xww7-76m6-mh2r
(cherry picked from commit fc2f0d745c17855d2027b192fd4e3fa913e26859)
DeltaFile
+14-11src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php
+6-1src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Cert.xml
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Ca.xml
+28-144 files

OPNSense/core f390601. plist, src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes TextField.php StrictTextField.php

mvc: add new validators to TextField: AllowSpaces, AllowNewlines, AllowSpecial and introduce new StrictTextField (#10398)

(cherry picked from commit c34b7786516afb6dff7a43af92c4328225b81e69)
(cherry picked from commit 9d0e4bf2bb4fdd20f872ff612c5135a7f9115101)
DeltaFile
+127-0src/opnsense/mvc/tests/app/models/OPNsense/Base/FieldTypes/StrictTextFieldTest.php
+81-0src/opnsense/mvc/tests/app/models/OPNsense/Base/FieldTypes/TextFieldTest.php
+61-2src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/TextField.php
+51-0src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/StrictTextField.php
+2-0plist
+322-25 files

OPNSense/core 94acb26src/opnsense/www/js/widgets/Metadata Core.xml

dnsmasq: change widget link from settings to leases page (#10420)

(cherry picked from commit 5e8f226d49196c55cd61ba1ee8e69fbbc194a835)
DeltaFile
+1-1src/opnsense/www/js/widgets/Metadata/Core.xml
+1-11 files

OPNSense/core 1ae1f62src/opnsense/mvc/app/models/OPNsense/TrafficShaper TrafficShaper.php

firewall: fix typo that prevented queues to be selectable in pf-based traffic shaping

(cherry picked from commit 558809488e9014f3452aa7cbcf1c5555a8697846)
DeltaFile
+10-3src/opnsense/mvc/app/models/OPNsense/TrafficShaper/TrafficShaper.php
+10-31 files

OPNSense/core aa27c06src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms dialogNptRule.xml, src/opnsense/mvc/app/models/OPNsense/Firewall Filter.php

firewall: allow WAN as "associated interface" for NPTv6 #10413
DeltaFile
+13-5src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogNptRule.xml
+14-62 files

OPNSense/core 3de53a2src/www firewall_rules_edit.php

firewall: escape shaper targets in rule edit

PR: GHSA-m4m3-v627-wgc2
DeltaFile
+1-0src/www/firewall_rules_edit.php
+1-01 files

OPNSense/core 5588094src/opnsense/mvc/app/models/OPNsense/TrafficShaper TrafficShaper.php

firewall: fix typo that prevented queues to be selectable in pf-based traffic shaping
DeltaFile
+10-3src/opnsense/mvc/app/models/OPNsense/TrafficShaper/TrafficShaper.php
+10-31 files

OPNSense/core 6bc0a1dsrc/etc/inc/plugins.inc.d ipsec.inc

ipsec: validate the use of refid in CA certificates

PR: GHSA-33q4-wcv7-r8fr
DeltaFile
+6-5src/etc/inc/plugins.inc.d/ipsec.inc
+6-51 files

OPNSense/core fc2f0d7src/opnsense/mvc/app/models/OPNsense/Trust Cert.xml Ca.xml, src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes CertificatesField.php CAsField.php

mvc: strict alphanumeric-only regex for certificate refid

CVE: CVE-2026-53582
PR: GHSA-xww7-76m6-mh2r
DeltaFile
+14-11src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php
+6-1src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Cert.xml
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Ca.xml
+28-144 files

OPNSense/core 5e8f226src/opnsense/www/js/widgets/Metadata Core.xml

dnsmasq: change widget link from settings to leases page (#10420)
DeltaFile
+1-1src/opnsense/www/js/widgets/Metadata/Core.xml
+1-11 files

OPNSense/core 894631esrc/opnsense/mvc/app/controllers/OPNsense/Firewall/forms dialogNptRule.xml, src/opnsense/mvc/app/models/OPNsense/Firewall Filter.php

firewall: allow WAN as "associated interface" for NPTv6 #10413
DeltaFile
+13-5src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogNptRule.xml
+14-62 files

OPNSense/core f1fec12src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms dialogNptRule.xml, src/opnsense/mvc/app/models/OPNsense/Firewall Filter.php

firewall: allow WAN as "associated interface" for NPTv6 #10413
DeltaFile
+2-1src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogNptRule.xml
+3-22 files

OPNSense/core ed87687src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms dialogNptRule.xml, src/opnsense/mvc/app/models/OPNsense/Firewall Filter.php

firewall: allow WAN as "associated interface" for NPTv6 #10413
DeltaFile
+2-1src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogNptRule.xml
+3-22 files

OPNSense/core 25521f0src/opnsense/mvc/app/views/layout_partials base_form.volt

MVC:ui - refactor base_dialog and parseFormNode to simplify the template for https://github.com/opnsense/core/issues/9955 [2]

bugfix https://github.com/opnsense/core/commit/3d9cccfe4038802807219621ddd49cf668a05144
DeltaFile
+2-2src/opnsense/mvc/app/views/layout_partials/base_form.volt
+2-21 files

OPNSense/core bb78d31src/opnsense/mvc/app/controllers/OPNsense/Base ControllerBase.php

src: style sweep
DeltaFile
+6-4src/opnsense/mvc/app/controllers/OPNsense/Base/ControllerBase.php
+6-41 files

OPNSense/core 3d9cccfsrc/opnsense/mvc/app/controllers/OPNsense/Base ControllerBase.php, src/opnsense/mvc/app/views/layout_partials base_form.volt base_dialog.volt

MVC:ui - refactor base_dialog and parseFormNode to simplify the template for https://github.com/opnsense/core/issues/9955 (#10410)

Move defaults to parseFormNode() and introduce "sections" with children to avoid some more magic in the volt templates.

Set default title on multi selectpickers as these sometimes seem to miss the "Nothing selected" phrase for some odd reason.

Functionally this should be a backward compatible change.
DeltaFile
+69-80src/opnsense/mvc/app/views/layout_partials/base_form.volt
+32-81src/opnsense/mvc/app/views/layout_partials/base_dialog.volt
+31-3src/opnsense/mvc/app/controllers/OPNsense/Base/ControllerBase.php
+2-2src/opnsense/mvc/app/views/layout_partials/form_input_tr.volt
+134-1664 files

OPNSense/core c822d0esrc/opnsense/mvc/app/views/OPNsense/Diagnostics packetcapture.volt portprobe.volt

mvc/templates - remove direct apply_btn_id usage in favor of base_apply_button template partial. discussed in https://github.com/opnsense/core/pull/10410

Eventually we want to remove apply_btn_id from base_form completely, but since base_tabs_content is using the same construct and appears in quite some plugins, we have to postpone that action.
At least aim for consistency in the forms that only depend on base_form in core.
DeltaFile
+7-7src/opnsense/mvc/app/views/OPNsense/Diagnostics/packetcapture.volt
+7-7src/opnsense/mvc/app/views/OPNsense/Diagnostics/portprobe.volt
+7-7src/opnsense/mvc/app/views/OPNsense/Diagnostics/dns_diagnostics.volt
+7-7src/opnsense/mvc/app/views/OPNsense/Diagnostics/traceroute.volt
+7-5src/opnsense/mvc/app/views/OPNsense/Diagnostics/ping.volt
+35-335 files

OPNSense/core 86ac515src/opnsense/scripts/firmware config.sh

firmware: fix return value masking during updates

This caused reboots when updates not supposed to reboot
in case base/kernel could not install.  This way since
26.1.8.

(cherry picked from commit 2e90e6fbf77202efdbd599697951e6da12b78e26)
DeltaFile
+3-4src/opnsense/scripts/firmware/config.sh
+3-41 files

OPNSense/core 8d78389src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api FilterController.php

Firewall: Rules: use strnatcasecmp() for interface list (#10412)

(cherry picked from commit 0fe799f7872cd8436fa896394dd3bb5fa03397ef)
DeltaFile
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterController.php
+1-11 files

OPNSense/core 7d65e57src/opnsense/mvc/app/controllers/OPNsense/Base ControllerBase.php, src/opnsense/mvc/app/views/layout_partials base_form.volt base_dialog.volt

MVC:ui - refactor base_dialog and parseFormNode to simplify the template for https://github.com/opnsense/core/issues/9955

Move defaults to parseFormNode() and introduce "sections" with children to avoid some more magic in the volt templates.

Set default title on multi selectpickers as these sometimes seem to miss the "Nothing selected" phrase for some odd reason.

Functionally this should be a backward compatible change.
DeltaFile
+69-80src/opnsense/mvc/app/views/layout_partials/base_form.volt
+32-81src/opnsense/mvc/app/views/layout_partials/base_dialog.volt
+31-3src/opnsense/mvc/app/controllers/OPNsense/Base/ControllerBase.php
+2-2src/opnsense/mvc/app/views/layout_partials/form_input_tr.volt
+134-1664 files

OPNSense/core 8bd91cbsrc/opnsense/mvc/app/controllers/OPNsense/Base ControllerBase.php, src/opnsense/mvc/app/views/layout_partials base_form.volt base_dialog.volt

MVC:ui - refactor base_dialog and parseFormNode to simplify the template for https://github.com/opnsense/core/issues/9955

Move defaults to parseFormNode() and introduce "sections" with children to avoid some more magic in the volt templates.

Set default title on multi selectpickers as these sometimes seem to miss the "Nothing selected" phrase for some odd reason.

Functionally this should be a backward compatible change.
DeltaFile
+69-80src/opnsense/mvc/app/views/layout_partials/base_form.volt
+32-81src/opnsense/mvc/app/views/layout_partials/base_dialog.volt
+31-3src/opnsense/mvc/app/controllers/OPNsense/Base/ControllerBase.php
+2-2src/opnsense/mvc/app/views/layout_partials/form_input_tr.volt
+134-1664 files

OPNSense/core 2e90e6fsrc/opnsense/scripts/firmware config.sh

firmware: fix return value masking during updates

This caused reboots when updates not supposed to reboot
in case base/kernel could not install.  This way since
26.1.8.
DeltaFile
+3-4src/opnsense/scripts/firmware/config.sh
+3-41 files

OPNSense/core 0fe799fsrc/opnsense/mvc/app/controllers/OPNsense/Firewall/Api FilterController.php

Firewall: Rules: use strnatcasecmp() for interface list (#10412)
DeltaFile
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterController.php
+1-11 files

OPNSense/core 39ffacfsrc/opnsense/mvc/app/controllers/OPNsense/Firewall/Api FilterController.php

Firewall: Rules: use strnatcasecmp() for interface list
DeltaFile
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterController.php
+1-11 files

OPNSense/core 8ff00fasrc/opnsense/mvc/app/views/layout_partials base_apply_button.volt, src/opnsense/www/js opnsense_ui.js

ui: fix excessive padding on apply section (#10409)

(cherry picked from commit 7a53cf1547beac857393ef97f4008bb91b5d4a52)
(cherry picked from commit 70853ba8ac3f6ec0e80cf639539e3da1b141d6bb)
DeltaFile
+2-2src/opnsense/www/js/opnsense_ui.js
+1-1src/opnsense/mvc/app/views/layout_partials/base_apply_button.volt
+3-32 files

OPNSense/core 96fa955src/opnsense/mvc/app/views/OPNsense/IPsec connections.volt, src/opnsense/www/js opnsense_bootgrid.js

ipsec: disable scroll in authentication and children grids (#10407)

Since the grids live on a lower position on the screen, the height calculation may squash the entries. This should be solved by enforcing a minimum row constraint, but for ipsec specifically being able to see all children at all times is more important, which is what this commit aims to solve.

(cherry picked from commit d2affcf0c0d14724237fd2a4aecc741f4ed2fd68)
DeltaFile
+1-0src/opnsense/mvc/app/views/OPNsense/IPsec/connections.volt
+1-0src/opnsense/www/js/opnsense_bootgrid.js
+2-02 files

OPNSense/core 3011649src/opnsense/mvc/app/views/OPNsense/Syslog index.volt, src/opnsense/mvc/app/views/OPNsense/TrafficShaper index.volt

ui: button padding when injecting next to apply button

Perhaps these fit another location much better, but keep them for now
and make sure that they are "primary" since they do a thing with a
confirmation button.

pull-right doesn't do much anymore and insertAfter already makes it
the rightmost button.

(cherry picked from commit d521d7d5293e5c63227e9dc6f8d986b70959da84)
DeltaFile
+1-1src/opnsense/mvc/app/views/OPNsense/Syslog/index.volt
+1-1src/opnsense/mvc/app/views/OPNsense/TrafficShaper/index.volt
+2-22 files

OPNSense/core d521d7dsrc/opnsense/mvc/app/views/OPNsense/Syslog index.volt, src/opnsense/mvc/app/views/OPNsense/TrafficShaper index.volt

ui: button padding when injecting next to apply button

Perhaps these fit another location much better, but keep them for now
and make sure that they are "primary" since they do a thing with a
confirmation button.

pull-right doesn't do much anymore and insertAfter already makes it
the rightmost button.
DeltaFile
+1-1src/opnsense/mvc/app/views/OPNsense/Syslog/index.volt
+1-1src/opnsense/mvc/app/views/OPNsense/TrafficShaper/index.volt
+2-22 files