OPNSense

Recent Commits

• Monviech (18 Jun 26)

  Firewall: Rules: Remove safepoint actions (#10411) * Remove safepoint actions, no callers should be left * Remove rollback_cancel.php and rollback_timer.php and their configd actions

• Franco Fichtner (18 Jun 26)

  mvc: also do not translate empty labels in grids #10369

• Stephan de Wit (18 Jun 26)

  ui: add generic escaping function

• Stephan de Wit (17 Jun 26)

  system: curl_close() is deprecated This has been a no-op since 8.0.0, but deprecated since 8.5.0.

• Franco Fichtner (17 Jun 26)

  system: tweak text color on previous

• Franco Fichtner (20 Apr 26)

  system: change the services widget to a flat tile layout Make the names of the services shown a bit shorter. The colors are debatable but they are matchin what alerts are using in bootstrap.

• Franco Fichtner (17 Jun 26)

  system: deriving $_SERVER['argv'] from the query string is deprecated Only used by Nginx plugin and probably able to simplify there. It's a bit strange in this case. Allegedly the variable has no effect on CLI applications.

• haxorton (17 Jun 26)

  routing: fix HTTP 500 when deleting a non-existent gateway (#10429) delGatewayAction() dereferenced the result of getNodeByReference() without a null check, so an unknown uuid reached "(string)$gateway->name" on null and raised an error, which the API renders as HTTP 500 ("Unexpected error, check log for details"). Guard the lookup and return the already-initialised {"result":"failed"} instead, matching the inherited del* verbs and the adjacent toggleGatewayAction(), which already null-check getNodeByReference().

• Franco Fichtner (17 Jun 26)

  interfaces: missed in previous

• Franco Fichtner (17 Jun 26)

  firewall: chr(): providing a value not in-between 0 and 255 is deprecated

• Franco Fichtner (17 Jun 26)

  tests: Method ReflectionMethod::setAccessible() is deprecated since 8.5

• Franco Fichtner (17 Jun 26)

  mvc: DescriptionField: disable special and newline characters This is only cosmetic and since the description is only used as a label and not a note block this is fine (and could be overwridden by the model if needed).

• Vezpi (17 Jun 26)

  system: fix ACL pattern for carp_status action (#10428)

• Franco Fichtner (17 Jun 26)

  mvc: use camelCase for carp_status action related to #10428

• Ad Schellevis (16 Jun 26)

  Interfaces/DHCP - Further tighten security for https://github.com/opnsense/core/security/advisories/GHSA-5rx3-w735-74wm As advanced fields should always require high level access, we should prevent accidental mistakes from administrators allowing non-admins from changing these items. In the long run, we likely want to drop these options, but that requires at least bringing back some common options which we are able to validate properly.

• Franco Fichtner (16 Jun 26)

  system: webgui templating more pretty

• Franco Fichtner (16 Jun 26)

  src: non-canonical cast (double) is deprecated

• Franco Fichtner (16 Jun 26)

  system: non-canonical cast (binary) is deprecated May need to revisit this again, but for now PHP suggests that (string) is equivalent to (binary) although the code reads strange.

• Franco Fichtner (16 Jun 26)

  firewall: using null as an array offset is deprecated

• Franco Fichtner (16 Jun 26)

  contrib: another implicit null

• Franco Fichtner (16 Jun 26)

  src: implicitly marking parameter $chown as nullable is deprecated

• haxorton (15 Jun 26)

  Firewall: fix 500 (TypeError) on alias getItem with unknown UUID (#10417)

• Franco Fichtner (14 Jun 26)

  firewall: allow WAN as "associated interface" for NPTv6 #10413

• lujiefsi (15 Jun 26)

  firewall: escape shaper targets in rule edit PR: GHSA-m4m3-v627-wgc2

• Franco Fichtner (15 Jun 26)

  firewall: fix typo that prevented queues to be selectable in pf-based traffic shaping

• Franco Fichtner (15 Jun 26)

  ipsec: validate the use of refid in CA certificates PR: GHSA-33q4-wcv7-r8fr

• evan (29 May 26)

  mvc: strict alphanumeric-only regex for certificate refid CVE: CVE-2026-53582 PR: GHSA-xww7-76m6-mh2r

• Monviech (15 Jun 26)

  dnsmasq: change widget link from settings to leases page (#10420)

• Ad Schellevis (13 Jun 26)

  MVC:ui - refactor base_dialog and parseFormNode to simplify the template for https://github.com/opnsense/core/issues/9955 [2] bugfix https://github.com/opnsense/core/commit/3d9cccfe4038802807219621ddd49cf668a05144

• Franco Fichtner (13 Jun 26)

  src: style sweep