pfSense REST API v2.10.0

Important

This release includes important security enhancements including fixes for GHSA-w3w4-mvcc-vmgr, as well as important optimizations and preparations for pfSense CE 2.9.0. It is recommended for all users. Please review the notes below for potential breaking changes introduced in this release.

Fixes

• Fixes a command prompt injection flaw in the /api/v2/interface/group and /api/v2/interface/groups endpoints GHSA-w3w4-mvcc-vmgr (thank you to @senti-man for discovering and reporting this issue!)
• Implements core Command auto-escaping to guard against future command injection risks
• Fixes an issue where ACME certificate issuance results no longer populated due to out-of-band changes in the upstream acme package
• Addresses a Validator object order-of-precedence issue that caused out of sequence validations for some fields
• Various PHP >8.2 syntax issues fixed in preparation for pfSense CE 2.9.0

Breaking Changes

• Adds sensitive flag to OpenVPNClient auth_pass field
• Adds sensitive flag to User ipsecpsk field
• Adds sensitive flag to WireGuardPeer presharedkey field

Note

These changes will prevent these fields from being included in API responses by default. If your integrations require read access to these fields, you can add sensitive field overrides for the associated field(s) in the REST API settings.

Changes

• Remaining shell_exec and exec calls have been replaced with \RESTAPI\Core\Command to take advantage of added protections
• Basic authentiatcion is now only considered the requested authentication method when a client provides both a username AND password. Previously either the presence of basic authentication username or password would elect basic authentication as the requested method.
• Auth now uses header presence to determine the client's requested auth method
• Additional guard clauses have been added during auth handling to exit quicker upon invalid auth

Full Changelog: v2.9.0...v2.10.0