Skip to content

v2.10.0 Fixes & Enhancements - #929

Merged
jaredhendrickson13 merged 33 commits into
masterfrom
next_patch
Aug 8, 2026
Merged

v2.10.0 Fixes & Enhancements#929
jaredhendrickson13 merged 33 commits into
masterfrom
next_patch

Conversation

@jaredhendrickson13

@jaredhendrickson13 jaredhendrickson13 commented Aug 7, 2026

Copy link
Copy Markdown
Member

Fixes

  • Implements core Command auto-escaping to address command injection risks
  • Fixes an issue where ACME certificate issuance logs no longer populated due to out-of-band changes in the upstream acme package
  • Addresses a Validator object order of precedence issue that caused out of sequence validation for some fields
  • Various PHP >8.2 syntax fixed in preparation for pfSense CE 2.9.0

Changes

  • Adds sensitive flag to OpenVPNClient auth_pass field
  • Adds sensitive flag to User ipsecpsk field
  • Adds sensitive flag to WireGuardPeer presharedkey field
  • Remaining shell_exec and exec calls have been replaced with \RESTAPI\Core\Command for added protections
  • Basic auth is now only considered the requested method when a client provides both a username AND password
  • Auth is_requested now uses static analysis to determine the client's requested auth method
  • Adds additional guard clauses during auth handling

jaredhendrickson13 and others added 30 commits August 5, 2026 20:47
@jaredhendrickson13
fix: implement missing auto-escaping in Command class
b5eb2a7 
The intention for this wrapper class was to force escaping at a central location. This was either never implemented or was removed early in v2's development cycle. This commit implements the intended logic and closes command injection gaps at a core level.
@jaredhendrickson13
chore: CommandPrompt should not auto-escape
5055f4f
@jaredhendrickson13
chore: replace outlier exec calls with Command calls
0a4eb7d
@jaredhendrickson13
fix: enforce character validation in FilterNameValidator
06d46d9
@jaredhendrickson13
fix: add sensitive flag to several model fields
e5221c7 
Some fields were not marked as sensitive during the initial implementation of the sensitive flag. This commit adds the flag to applicable fields.
@jaredhendrickson13
style: run prettier on changed files
b812d56
@jaredhendrickson13
chore: don't make presharedkey write only
e3e039a 
The field is marked as sensitive so it is not necessary. Admins can override the sensitive flag if they want to accept the risk of exposing it through the API.
@jaredhendrickson13
test: replace usage of shell_exec in tests with Command
787b5ef
@jaredhendrickson13
chore: replace redundant TestCase::run_command method with Command calls
ca05fa9
@jaredhendrickson13
chore: optimize imports for models
7f1e6a9
@jaredhendrickson13
style: run prettier on changed files
eee85bf
@jaredhendrickson13
test: use redirect param instead of redirect literal
a4161a3
@jaredhendrickson13
test: use pipe parameter instead of pipe literal
ecb06a7
@jaredhendrickson13
test: sanitization wraps args in single-quotes, not individual char e…
52cbc73 
…scapes
@jaredhendrickson13
test: use redirect and pipe literals for LogTraits tests
10a3084
@jaredhendrickson13
fix: derive acme results from issue log
f716a68 
There have been out of band changes added to the acme package that are no publicly available. The issue_certificate command no longer prints the logs and the implementation broke because of this. To capture the results, this commit tracks the issueance log and extracts only the new log items as the result.
@jaredhendrickson13
style: run prettier on changed files
cae11cd
@jaredhendrickson13
test: check table status code in firewall alias tests
41a3f58
@jaredhendrickson13
style: run prettier on changed files
b3fea0d
@jaredhendrickson13
fix(RESTAPIKey): use hash_equals for key comparison
b46d10b
@jaredhendrickson13
chore: opt for static analysis of requested auth method
04d9f82
@jaredhendrickson13
chore: require both a username and a password to request basic auth
f10a916
@jaredhendrickson13
chore: guard against empty usernames in Auth class
98d3aa5
@jaredhendrickson13
chore: guard against empty usernames in JWTAuth class
275bf63
@jaredhendrickson13
chore: use PHP 8+ safe default syntax
311b651
@jaredhendrickson13
style: run prettier on changed files
448a0d3
@jaredhendrickson13
chore: prevent redundant validation during deletions
2b549f2
@jaredhendrickson13
test: invert context of when basic auth is requested without username…
1908d8b 
… AND password
@jaredhendrickson13
style: run prettier on changed files
e2f3bcd
@jaredhendrickson13
test: correct accidental false assertion for valid basic auth
0268aa7
@jaredhendrickson13
jaredhendrickson13 merged commit 805c7f0 into master Aug 8, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jaredhendrickson13