OPNSense/core 28229edsrc/www interfaces.php

Interfaces/DHCP - Further tighten security for https://github.com/opnsense/core/security/advisories/GHSA-5rx3-w735-74wm

As advanced fields should always require high level access, we should prevent accidental mistakes from administrators allowing non-admins from changing these items.
In the long run, we likely want to drop these options, but that requires at least bringing back some common options which we are able to validate properly.
DeltaFile
+7-1src/www/interfaces.php
+7-11 files

OPNSense/core 8ec23b3src/opnsense/service/templates/OPNsense/WebGui php.ini

system: webgui templating more pretty
DeltaFile
+1-2src/opnsense/service/templates/OPNsense/WebGui/php.ini
+1-21 files

OPNSense/core c00711econtrib/IXR IXR_Library.php, src/opnsense/scripts/interfaces traffic_stats.php

src: non-canonical cast (double) is deprecated
DeltaFile
+2-2contrib/IXR/IXR_Library.php
+1-1src/opnsense/scripts/interfaces/traffic_stats.php
+3-32 files

OPNSense/core 50e99c6src/etc/inc util.inc

system: non-canonical cast (binary) is deprecated

May need to revisit this again, but for now PHP suggests that
(string) is equivalent to (binary) although the code reads
strange.
DeltaFile
+2-2src/etc/inc/util.inc
+2-21 files

OPNSense/core 1af182asrc/opnsense/mvc/app/library/OPNsense/Firewall Rule.php FilterRule.php

firewall: using null as an array offset is deprecated
DeltaFile
+10-7src/opnsense/mvc/app/library/OPNsense/Firewall/Rule.php
+1-1src/opnsense/mvc/app/library/OPNsense/Firewall/FilterRule.php
+11-82 files

OPNSense/core 041ab30contrib/parallel-lint/src Manager.php

contrib: another implicit null
DeltaFile
+1-1contrib/parallel-lint/src/Manager.php
+1-11 files

OPNSense/core 8441b9esrc/opnsense/mvc/app/library/OPNsense/Core File.php FileObject.php

src: implicitly marking parameter $chown as nullable is deprecated
DeltaFile
+2-2src/opnsense/mvc/app/library/OPNsense/Core/File.php
+1-1src/opnsense/mvc/app/library/OPNsense/Core/FileObject.php
+3-32 files

OPNSense/core b4fa4cdsrc/opnsense/mvc/app/controllers/OPNsense/Firewall/Api AliasController.php

Firewall: fix 500 (TypeError) on alias getItem with unknown UUID (#10417)
DeltaFile
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/AliasController.php
+1-11 files

OPNSense/core 569b3a6src/etc/inc/plugins.inc.d ipsec.inc

ipsec: validate the use of refid in CA certificates

PR: GHSA-33q4-wcv7-r8fr
(cherry picked from commit 6bc0a1df6550c419f2a44461f6595cacf2080bfa)
DeltaFile
+6-5src/etc/inc/plugins.inc.d/ipsec.inc
+6-51 files

OPNSense/core fb4ee60src/www firewall_rules_edit.php

firewall: escape shaper targets in rule edit

PR: GHSA-m4m3-v627-wgc2
(cherry picked from commit 3de53a25fdd9b605acc82e4071e9920fa1c9b418)
DeltaFile
+1-0src/www/firewall_rules_edit.php
+1-01 files

OPNSense/core e2cd067src/opnsense/mvc/app/models/OPNsense/Trust Cert.xml Ca.xml, src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes CertificatesField.php CAsField.php

mvc: strict alphanumeric-only regex for certificate refid

CVE: CVE-2026-53582
PR: GHSA-xww7-76m6-mh2r
(cherry picked from commit fc2f0d745c17855d2027b192fd4e3fa913e26859)
DeltaFile
+14-11src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php
+6-1src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Cert.xml
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Ca.xml
+28-144 files

OPNSense/core f390601. plist, src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes TextField.php StrictTextField.php

mvc: add new validators to TextField: AllowSpaces, AllowNewlines, AllowSpecial and introduce new StrictTextField (#10398)

(cherry picked from commit c34b7786516afb6dff7a43af92c4328225b81e69)
(cherry picked from commit 9d0e4bf2bb4fdd20f872ff612c5135a7f9115101)
DeltaFile
+127-0src/opnsense/mvc/tests/app/models/OPNsense/Base/FieldTypes/StrictTextFieldTest.php
+81-0src/opnsense/mvc/tests/app/models/OPNsense/Base/FieldTypes/TextFieldTest.php
+61-2src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/TextField.php
+51-0src/opnsense/mvc/app/models/OPNsense/Base/FieldTypes/StrictTextField.php
+2-0plist
+322-25 files

OPNSense/core 94acb26src/opnsense/www/js/widgets/Metadata Core.xml

dnsmasq: change widget link from settings to leases page (#10420)

(cherry picked from commit 5e8f226d49196c55cd61ba1ee8e69fbbc194a835)
DeltaFile
+1-1src/opnsense/www/js/widgets/Metadata/Core.xml
+1-11 files

OPNSense/core 1ae1f62src/opnsense/mvc/app/models/OPNsense/TrafficShaper TrafficShaper.php

firewall: fix typo that prevented queues to be selectable in pf-based traffic shaping

(cherry picked from commit 558809488e9014f3452aa7cbcf1c5555a8697846)
DeltaFile
+10-3src/opnsense/mvc/app/models/OPNsense/TrafficShaper/TrafficShaper.php
+10-31 files

OPNSense/core aa27c06src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms dialogNptRule.xml, src/opnsense/mvc/app/models/OPNsense/Firewall Filter.php

firewall: allow WAN as "associated interface" for NPTv6 #10413
DeltaFile
+13-5src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogNptRule.xml
+14-62 files

OPNSense/core 3de53a2src/www firewall_rules_edit.php

firewall: escape shaper targets in rule edit

PR: GHSA-m4m3-v627-wgc2
DeltaFile
+1-0src/www/firewall_rules_edit.php
+1-01 files

OPNSense/core 5588094src/opnsense/mvc/app/models/OPNsense/TrafficShaper TrafficShaper.php

firewall: fix typo that prevented queues to be selectable in pf-based traffic shaping
DeltaFile
+10-3src/opnsense/mvc/app/models/OPNsense/TrafficShaper/TrafficShaper.php
+10-31 files

OPNSense/core 6bc0a1dsrc/etc/inc/plugins.inc.d ipsec.inc

ipsec: validate the use of refid in CA certificates

PR: GHSA-33q4-wcv7-r8fr
DeltaFile
+6-5src/etc/inc/plugins.inc.d/ipsec.inc
+6-51 files

OPNSense/core fc2f0d7src/opnsense/mvc/app/models/OPNsense/Trust Ca.xml Cert.xml, src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes CertificatesField.php CAsField.php

mvc: strict alphanumeric-only regex for certificate refid

CVE: CVE-2026-53582
PR: GHSA-xww7-76m6-mh2r
DeltaFile
+14-11src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CertificatesField.php
+6-1src/opnsense/mvc/app/models/OPNsense/Trust/FieldTypes/CAsField.php
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Ca.xml
+4-1src/opnsense/mvc/app/models/OPNsense/Trust/Cert.xml
+28-144 files

OPNSense/core 5e8f226src/opnsense/www/js/widgets/Metadata Core.xml

dnsmasq: change widget link from settings to leases page (#10420)
DeltaFile
+1-1src/opnsense/www/js/widgets/Metadata/Core.xml
+1-11 files

OPNSense/core 894631esrc/opnsense/mvc/app/controllers/OPNsense/Firewall/forms dialogNptRule.xml, src/opnsense/mvc/app/models/OPNsense/Firewall Filter.php

firewall: allow WAN as "associated interface" for NPTv6 #10413
DeltaFile
+13-5src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogNptRule.xml
+14-62 files

OPNSense/core f1fec12src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms dialogNptRule.xml, src/opnsense/mvc/app/models/OPNsense/Firewall Filter.php

firewall: allow WAN as "associated interface" for NPTv6 #10413
DeltaFile
+2-1src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogNptRule.xml
+3-22 files

OPNSense/core ed87687src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms dialogNptRule.xml, src/opnsense/mvc/app/models/OPNsense/Firewall Filter.php

firewall: allow WAN as "associated interface" for NPTv6 #10413
DeltaFile
+2-1src/opnsense/mvc/app/models/OPNsense/Firewall/Filter.php
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/forms/dialogNptRule.xml
+3-22 files

OPNSense/core 25521f0src/opnsense/mvc/app/views/layout_partials base_form.volt

MVC:ui - refactor base_dialog and parseFormNode to simplify the template for https://github.com/opnsense/core/issues/9955 [2]

bugfix https://github.com/opnsense/core/commit/3d9cccfe4038802807219621ddd49cf668a05144
DeltaFile
+2-2src/opnsense/mvc/app/views/layout_partials/base_form.volt
+2-21 files

OPNSense/core bb78d31src/opnsense/mvc/app/controllers/OPNsense/Base ControllerBase.php

src: style sweep
DeltaFile
+6-4src/opnsense/mvc/app/controllers/OPNsense/Base/ControllerBase.php
+6-41 files

OPNSense/core 3d9cccfsrc/opnsense/mvc/app/controllers/OPNsense/Base ControllerBase.php, src/opnsense/mvc/app/views/layout_partials base_form.volt base_dialog.volt

MVC:ui - refactor base_dialog and parseFormNode to simplify the template for https://github.com/opnsense/core/issues/9955 (#10410)

Move defaults to parseFormNode() and introduce "sections" with children to avoid some more magic in the volt templates.

Set default title on multi selectpickers as these sometimes seem to miss the "Nothing selected" phrase for some odd reason.

Functionally this should be a backward compatible change.
DeltaFile
+69-80src/opnsense/mvc/app/views/layout_partials/base_form.volt
+32-81src/opnsense/mvc/app/views/layout_partials/base_dialog.volt
+31-3src/opnsense/mvc/app/controllers/OPNsense/Base/ControllerBase.php
+2-2src/opnsense/mvc/app/views/layout_partials/form_input_tr.volt
+134-1664 files

OPNSense/core c822d0esrc/opnsense/mvc/app/views/OPNsense/Diagnostics dns_diagnostics.volt packetcapture.volt

mvc/templates - remove direct apply_btn_id usage in favor of base_apply_button template partial. discussed in https://github.com/opnsense/core/pull/10410

Eventually we want to remove apply_btn_id from base_form completely, but since base_tabs_content is using the same construct and appears in quite some plugins, we have to postpone that action.
At least aim for consistency in the forms that only depend on base_form in core.
DeltaFile
+7-7src/opnsense/mvc/app/views/OPNsense/Diagnostics/dns_diagnostics.volt
+7-7src/opnsense/mvc/app/views/OPNsense/Diagnostics/packetcapture.volt
+7-7src/opnsense/mvc/app/views/OPNsense/Diagnostics/portprobe.volt
+7-7src/opnsense/mvc/app/views/OPNsense/Diagnostics/traceroute.volt
+7-5src/opnsense/mvc/app/views/OPNsense/Diagnostics/ping.volt
+35-335 files

OPNSense/core 86ac515src/opnsense/scripts/firmware config.sh

firmware: fix return value masking during updates

This caused reboots when updates not supposed to reboot
in case base/kernel could not install.  This way since
26.1.8.

(cherry picked from commit 2e90e6fbf77202efdbd599697951e6da12b78e26)
DeltaFile
+3-4src/opnsense/scripts/firmware/config.sh
+3-41 files

OPNSense/core 8d78389src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api FilterController.php

Firewall: Rules: use strnatcasecmp() for interface list (#10412)

(cherry picked from commit 0fe799f7872cd8436fa896394dd3bb5fa03397ef)
DeltaFile
+1-1src/opnsense/mvc/app/controllers/OPNsense/Firewall/Api/FilterController.php
+1-11 files

OPNSense/core 7d65e57src/opnsense/mvc/app/controllers/OPNsense/Base ControllerBase.php, src/opnsense/mvc/app/views/layout_partials base_form.volt base_dialog.volt

MVC:ui - refactor base_dialog and parseFormNode to simplify the template for https://github.com/opnsense/core/issues/9955

Move defaults to parseFormNode() and introduce "sections" with children to avoid some more magic in the volt templates.

Set default title on multi selectpickers as these sometimes seem to miss the "Nothing selected" phrase for some odd reason.

Functionally this should be a backward compatible change.
DeltaFile
+69-80src/opnsense/mvc/app/views/layout_partials/base_form.volt
+32-81src/opnsense/mvc/app/views/layout_partials/base_dialog.volt
+31-3src/opnsense/mvc/app/controllers/OPNsense/Base/ControllerBase.php
+2-2src/opnsense/mvc/app/views/layout_partials/form_input_tr.volt
+134-1664 files