Use $_POST for config changes and add misc fixes and improvements.

1 files changed, 52 insertions, 66 deletions

diff --git a/config/snort/snort_rules_flowbits.php b/config/snort/snort_rules_flowbits.php
index 325276ee..de5bdc6b 100644
--- a/config/snort/snort_rules_flowbits.php
+++ b/config/snort/snort_rules_flowbits.php
@@ -1,7 +1,7 @@
 <?php
 /*
  * snort_rules_flowbits.php
- * Copyright (C) 2013 Bill Meeks
+ * Copyright (C) 2013, 2014 Bill Meeks
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -41,40 +41,34 @@ if (!is_array($config['installedpackages']['snortglobal']['rule'])) {
 }
 $a_nat = &$config['installedpackages']['snortglobal']['rule'];
 
-// Set who called us so we can return to the correct page with
-// the RETURN button. Save the original referrer and the query
-// string in session variables.
-session_start();
-if (!isset($_SESSION['org_referrer']) || isset($_GET['returl'])) {
-	$_SESSION['org_referrer'] = urldecode($_GET['returl']);
-	$_SESSION['org_querystr'] = $_SERVER['QUERY_STRING'];
-}
-$referrer = $_SESSION['org_referrer'];
-$querystr = $_SESSION['org_querystr'];
-session_write_close();
+if (isset($_POST['id']) && is_numericint($_POST['id']))
+	$id = $_POST['id'];
+elseif (isset($_GET['id']) && is_numericint($_GET['id']))
+	$id = htmlspecialchars($_GET['id']);
 
-if ($_POST['cancel']) {
-	session_start();
-	unset($_SESSION['org_referrer']);
-	unset($_SESSION['org_querystr']);
-	session_write_close();
-	header("Location: {$referrer}?{$querystr}");
+if (is_null($id)) {
+	header("Location: /snort/snort_interfaces.php");
 	exit;
 }
 
-$id = $_GET['id'];
-if (isset($_POST['id']))
-	$id = $_POST['id'];
-if (is_null($id)) {
-	session_start();
-	unset($_SESSION['org_referrer']);
-	unset($_SESSION['org_querystr']);
-	session_write_close();
-	header("Location: /snort/snort_interfaces.php");
+// Set who called us so we can return to the correct page with
+// the RETURN ('cancel') button.
+if ($_POST['referrer'])
+	$referrer = $_POST['referrer'];
+else
+	$referrer = $_SERVER['HTTP_REFERER'];
+
+// Make sure a rule index ID is appended to the return URL
+if (strpos($referrer, "?id={$id}") === FALSE)
+	$referrer .= "?id={$id}";
+
+// If RETURN button clicked, exit to original calling page
+if ($_POST['cancel']) {
+	header("Location: {$referrer}");
 	exit;
 }
 
-$if_real = snort_get_real_interface($a_nat[$id]['interface']);
+$if_real = get_real_interface($a_nat[$id]['interface']);
 $snort_uuid = $a_nat[$id]['uuid'];
 
 /* We should normally never get to this page if Auto-Flowbits are disabled, but just in case... */
@@ -89,12 +83,13 @@ if ($a_nat[$id]['autoflowbitrules'] == 'on') {
 else
 	$input_errors[] = gettext("Auto-Flowbit rule generation is disabled for this interface!");
 
-if ($_GET['act'] == "addsuppress" && is_numeric($_GET['sidid']) && is_numeric($_GET['gen_id'])) {
-	$descr = snort_get_msg($rules_map[$_GET['gen_id']][$_GET['sidid']]['rule']);
+if ($_POST['addsuppress'] && is_numeric($_POST['sid']) && is_numeric($_POST['gid'])) {
+	$descr = snort_get_msg($rules_map[$_POST['gid']][$_POST['sid']]['rule']);
+	$suppress = gettext("## -- This rule manually suppressed from the Auto-Flowbits list. -- ##\n");
 	if (empty($descr))
-		$suppress = "suppress gen_id {$_GET['gen_id']}, sig_id {$_GET['sidid']}\n";
+		$suppress .= "suppress gen_id {$_POST['gid']}, sig_id {$_POST['sid']}\n";
 	else
-		$suppress = "# {$descr}\nsuppress gen_id {$_GET['gen_id']}, sig_id {$_GET['sidid']}";
+		$suppress .= "# {$descr}\nsuppress gen_id {$_POST['gid']}, sig_id {$_POST['sid']}\n";
 	if (!is_array($config['installedpackages']['snortglobal']['suppress']))
 		$config['installedpackages']['snortglobal']['suppress'] = array();
 	if (!is_array($config['installedpackages']['snortglobal']['suppress']['item']))
@@ -134,7 +129,7 @@ if ($_GET['act'] == "addsuppress" && is_numeric($_GET['sidid']) && is_numeric($_
 		$rebuild_rules = false;
 		sync_snort_package_config();
 		snort_reload_config($a_nat[$id]);
-		$savemsg = gettext("An entry to suppress the Alert for 'gen_id {$_GET['gen_id']}, sig_id {$_GET['sidid']}' has been added to Suppress List '{$a_nat[$id]['suppresslistname']}'.");
+		$savemsg = gettext("An entry to suppress the Alert for 'gen_id {$_POST['gid']}, sig_id {$_POST['sid']}' has been added to Suppress List '{$a_nat[$id]['suppresslistname']}'.");
 	}
 	else {
 		/* We did not find the defined list, so notify the user with an error */
@@ -142,23 +137,10 @@ if ($_GET['act'] == "addsuppress" && is_numeric($_GET['sidid']) && is_numeric($_
 	}
 }
 
-function truncate($string, $length) {
-
-	/********************************
-	 * This function truncates the  *
-	 * passed string to the length  *
-	 * specified adding ellipsis if *
-	 * truncation was necessary.    *
-	 ********************************/
-	if (strlen($string) > $length)
-		$string = substr($string, 0, ($length - 3)) . "...";
-	return $string; 
-}
-
 /* Load up an array with the current Suppression List GID,SID values */
 $supplist = snort_load_suppress_sigs($a_nat[$id]);
 
-$if_friendly = snort_get_friendly_interface($a_nat[$id]['interface']);
+$if_friendly = convert_friendly_interface_to_friendly_descr($a_nat[$id]['interface']);
 $pgtitle = gettext("Snort: Interface {$if_friendly} - Flowbit Rules");
 include_once("head.inc");
 
@@ -168,12 +150,16 @@ include_once("head.inc");
 
 <?php
 include("fbegin.inc");
-if($pfsense_stable == 'yes'){echo '<p class="pgtitle">' . $pgtitle . '</p>';}
-if ($input_errors) print_input_errors($input_errors);
+if ($input_errors)
+	print_input_errors($input_errors);
 if ($savemsg)
 	print_info_box($savemsg);
 ?>
 <form action="snort_rules_flowbits.php" method="post" name="iform" id="iform">
+<input type="hidden" name="id" value="<?=$id;?>"/>
+<input type="hidden" name="referrer" value="<?=$referrer;?>"/>
+<input type="hidden" name="sid" id="sid" value=""/>
+<input type="hidden" name="gid" id="gid" value=""/>
 <div id="boxarea">
 <table width="100%" border="0" cellpadding="0" cellspacing="0">
 <tr>
@@ -203,7 +189,7 @@ if ($savemsg)
 					<td><span class="vexpl"><?php echo gettext("Alert is Not Suppressed"); ?></span></td>
 					<td rowspan="3" align="right"><input id="cancel" name="cancel" type="submit" class="formbtn" <?php 
 					echo "value=\"" . gettext("Return") . "\" title=\"" . gettext("Return to previous page") . "\""; ?>/>
-					<input name="id" type="hidden" value="<?=$id;?>" /></td>
+					</td>
 				</tr>
 				<tr>
 					<td width="17px"><img src="../themes/<?=$g['theme']?>/images/icons/icon_plus_d.gif" width='12' height='12' border='0'/></td>
@@ -220,13 +206,13 @@ if ($savemsg)
 	</tr>
 	<tr>
 		<td>
-		<table id="myTable" width="100%" class="sortable" border="1" cellpadding="0" cellspacing="0">
+		<table id="myTable" width="100%" class="sortable" style="table-layout: fixed;" border="0" cellpadding="0" cellspacing="0">
 			<colgroup>
 				<col width="11%" axis="number">
-				<col width="10%" axis="string">
+				<col width="54" axis="string">
 				<col width="14%" axis="string">
 				<col width="14%" axis="string">
-				<col width="20%" axis="string">
+				<col width="24%" axis="string">
 				<col axis="string">
 			</colgroup>
 			<thead>
@@ -253,19 +239,20 @@ if ($savemsg)
 							$tmp = trim(preg_replace('/^\s*#+\s*/', '', $tmp));
 							$rule_content = preg_split('/[\s]+/', $tmp);
 
-							$protocol = $rule_content[1]; //protocol
-							$source = truncate($rule_content[2], 14); //source
-							$destination = truncate($rule_content[5], 14); //destination
-							$message = snort_get_msg($v['rule']);
+							$protocol = $rule_content[1];         //protocol
+							$source = $rule_content[2];           //source
+							$destination = $rule_content[5];      //destination
+							$message = snort_get_msg($v['rule']); // description
 							$flowbits = implode("; ", snort_get_flowbits($v['rule']));
 							if (strstr($flowbits, "noalert"))
 								$supplink = "";
 							else {
 								if (!isset($supplist[$gid][$sid])) {
-									$supplink = "<a href=\"?id={$id}&act=addsuppress&sidid={$sid}&gen_id={$gid}\">";
-									$supplink .= "<img src=\"../themes/{$g['theme']}/images/icons/icon_plus.gif\" ";
+									$supplink = "<input type=\"image\" name=\"addsuppress[]\" onClick=\"document.getElementById('sid').value='{$sid}';";
+									$supplink .= "document.getElementById('gid').value='{$gid}';\" ";
+									$supplink .= "src=\"../themes/{$g['theme']}/images/icons/icon_plus.gif\" ";
 									$supplink .= "width='12' height='12' border='0' title='";
-									$supplink .= gettext("Click to add to Suppress List") . "'/></a>";
+									$supplink .= gettext("Click to add to Suppress List") . "'/>";
 								}
 								else {
 									$supplink = "<img src=\"../themes/{$g['theme']}/images/icons/icon_plus_d.gif\" ";
@@ -276,12 +263,12 @@ if ($savemsg)
 
 							// Use "echo" to write the table HTML row-by-row.
 							echo "<tr>" . 
-								"<td class=\"listr\">{$sid}&nbsp;{$supplink}</td>" . 
-								"<td class=\"listr\">{$protocol}</td>" . 
-								"<td class=\"listr\"><span title=\"{$rule_content[2]}\">{$source}</span></td>" . 
-								"<td class=\"listr\"><span title=\"{$rule_content[5]}\">{$destination}</span></td>" . 
+								"<td class=\"listr\" sorttable_customkey=\"{$sid}\">{$sid}&nbsp;{$supplink}</td>" . 
+								"<td class=\"listr\" style=\"text-align:center;\">{$protocol}</td>" . 
+								"<td class=\"listr\" style=\"overflow: hidden; text-overflow: ellipsis; text-align:center;\" nowrap><span title=\"{$rule_content[2]}\">{$source}</span></td>" . 
+								"<td class=\"listr\" style=\"overflow: hidden; text-overflow: ellipsis; text-align:center;\" nowrap><span title=\"{$rule_content[5]}\">{$destination}</span></td>" . 
 								"<td class=\"listr\" style=\"word-wrap:break-word; word-break:normal;\">{$flowbits}</td>" . 
-								"<td class=\"listr\" style=\"word-wrap:break-word; word-break:normal;\">{$message}</td>" . 
+								"<td class=\"listbg\" style=\"word-wrap:break-word; word-break:normal;\">{$message}</td>" . 
 							"</tr>";
 							$count++;
 						}
@@ -297,7 +284,6 @@ if ($savemsg)
 		<td align="center" valign="middle">
 			<input id="cancel" name="cancel" type="submit" class="formbtn" <?php 
 			echo "value=\"" . gettext("Return") . "\" title=\"" . gettext("Return to previous page") . "\""; ?>/>
-			<input name="id" type="hidden" value="<?=$id;?>" />
 		</td>
 	</tr>
 	<?php endif; ?>