configd: further restrict configd actions to root and wwwonly for more sensitive actions (stopping services, reading certain data, ..) that won't be scheduled anyway and should have no other consumers.
addition to https://github.com/opnsense/core/commit/a313cbd5bdcfc3c9d4a55704fcdb8bbcf7182069
In the long run we might consider swapping the defaults, but since the chance of regressions is rather larger and most callouts aren't that problematic anyway, opt for explicit elevated rights for now.
Firewall: NAT: Destination NAT - fix missing "well-known" in local-port, closes https://github.com/opnsense/core/issues/10612
While here, also suppress a php warning for an non-existing entry.
Firewall: Rules and NAT: Group invalid rules to the end of the ruleset. These rules are skipped by PF processing because they do not have a valid interface. (#10550)
---------
Co-authored-by: Stephan de Wit <stephan.de.wit at deciso.com>
system: add hidden services so they can be operated by pluginctl -s #9352
For now that's kernel and powerd. Eventually these workarounds will
go away anyway.
system: replace cron restart in legacy pages #9352
This probably slows down execution, but either we solve this later
on or just live with it as these pages are going away eventually.
www: avoid filter_configure() to make backend call less obscure #9352
We need to switch all other configuration to the backend as well so
it makes sense to deprecate filter_configure() and later match all
the other configuration functions using similar backend calls.
