BSD Commit Log Search

configd: change https://github.com/opnsense/core/commit/c8cd5565ec135a0111497fde2e20e3cb79324f0d seemed to have uncovered another issue when it comes to file generation, as each call generates a new tempfile, we're now keeping a lot of them.

In order to fix this behavoir, only generate the filename and reuse it when serving cached commands, which was the intention from the beginning.

Add a default for ddns_domain_algorithm inside the config generator

firewall: use safe config iteration in outbound NAT page

system: use safe config iteration in admin settings page

backend: mwexecfb(): "spidfile" is weird so switch "pidfile" according to "reset"

ipsec: use safe config iteration for VIP lookup

make: improve rebase to auto-abort much like mfc target

(cherry picked from commit 45dc8a3c1fa2e8ca112c2b557e0a35b5027a0925)

interfaces: use safe config iteration in PPP edit page

firewall: use safe iteration in old rule page for schedule lookup

make: improve rebase to auto-abort much like mfc target

LICENSE: sync

shell: improve config restore UX using diff and additional meta data display

monit: use safe config iteration in gateway alert script

kea: kea_prefix_watcher guard when no link-local address exists for a route that should be installed (#9905)

(cherry picked from commit dddecb4ca7aa80d59abab1a4e940324d14963d94)

firewall: fix SyntaxWarning, perhaps a Python 3.13 side effect

See: https://docs.python.org/3/library/re.html
PR: https://forum.opnsense.org/index.php?topic=51226.0
(cherry picked from commit 92e0d5a96fbe2befb41e7d3a151d5b734497f7eb)

firewall: live view: allow regex use in 'contains' cases

https://forum.opnsense.org/index.php?topic=51226.0
(cherry picked from commit 41664263de3f4fe211d0e7af9d0a471c300ceb21)

Firewall: NAT: Destination NAT: Add model validations for common errors (#9885)

(cherry picked from commit 4c5fa27a00a10b1f5612549d32df1c60fc4e0620)

mvc: BaseListField $hash access to static options #9816

Also make $internalStaticOptList private and reshuffle the callers
for maximum effect.

(cherry picked from commit feee43402d946e5c3799d412a77f7a5801f822c3)

mvc: move CertificateField and InterfaceField to newer static option API for #9816

(cherry picked from commit 7b6e666b74089609466f6c383891b6b8bf8d0406)

firewall: make MVC protocol selection much more like old GUI

This means list most frequently used protocols first, but only if
found in the list that has been built (including additional option
like TCP/UDP from model).

(cherry picked from commit 29dab2fa77c748d12e623333e98ddd299c2ded96)

mvc: ProtocolField: use shared implementation of $internalStaticOptionList

PR: https://github.com/opnsense/core/issues/9816

(cherry picked from commit 568146dae51acbc5f9e5ace3a8da2371235b1e42)

firewall: merge read of groups and interfaces

They are stored in the same location and used by the interface
field type as such.  This prevents showing unrendered groups
and also displays the consistent label between the rule and
rules selectors.

(cherry picked from commit fce88501cc9dcd4d225083cd14be8532ee346111)
(cherry picked from commit 16bc9ee719da5443a23f33ab925071a9b18e30a8)

Firewall: Rules [new]: Fix automatically generated rules not showing label name, minor regression in 963b9a8c (#9911)

(cherry picked from commit ff2fa254eaa9aa57ab8a004a86344cdd78638228)

mvc: style

(cherry picked from commit b07af5376e14213c5976d961af2a8b374fa6a593)

php: "Implicitly marking parameter XXX as nullable is deprecated" in php 8.4 and up.

(cherry picked from commit 029c840f5e55023d72a3e8d48bc219b2d5b1d06b)
(cherry picked from commit 06a2025f3cbd5df7bb9f5a57571fb856d921307e)

mvc: UserException: style updates while we have changes here

mvc: fix CSRF vulnerability in multiple API endpoints by enforcing POST-only requests

Several API actions executed state-changing backend operations while accepting
GET requests. Since CSRF validation in ApiControllerBase only applies to
POST/PUT/DELETE methods, these endpoints could be triggered via authenticated
CSRF requests.

This patch enforces POST-only access for the following actions:

- AliasUtilController::updateBogonsAction
- OverviewController::reloadInterfaceAction
- ServiceController::dnsblAction
- ServiceController::reconfigureGeneralAction

(cherry picked from commit ac7a8024c2804b4fa213c38e30e4d97bc7f955cc)
(cherry picked from commit 0903e242adade4a2d7521fb93d0805da5988cfc0)

unbound: minor style adjustment on previous

Merge commit from fork

* Fix CSRF vulnerability in multiple API endpoints by enforcing POST-only requests

Several API actions executed state-changing backend operations while accepting
GET requests. Since CSRF validation in ApiControllerBase only applies to
POST/PUT/DELETE methods, these endpoints could be triggered via authenticated
CSRF requests.

This patch enforces POST-only access for the following actions:

- AliasUtilController::updateBogonsAction
- OverviewController::reloadInterfaceAction
- ServiceController::dnsblAction
- ServiceController::reconfigureGeneralAction

Non-POST requests now return HTTP 405 with Allow: POST.

* simplify POST enforcement to match project conventions

    [9 lines not shown]

security/q-feeds-connector: sync with master