GeezerVison

Fixes

• Removes unnecessary unique constraint from Service's name field #953
• Adds additional validation for HAProxyFrontendACL's expression to avoid silent service sync failures #948
• Corrects typo in HAProxyFrontendAddress's extaddr_advanced field name #969
• Fixes an issue where ModelSet's generated during replace_all with dry_run enabled yield no cache signature #967

Features

• Adds support for the azuredns_managedidentity field to ACMECertificateDomain #955
• Allow HAProxyFrontendAddress's extaddr field to accept interface references #947
• Adds new documentation page for HA Sync features to pfrest.org #954
• Adds new page-system-restapi-documentation privilege #961

Changes

• Updates help text in the REST API settings page for the HA Sync field to better describe functionality #954
• Bumps firebase/php-jwt from 7.1.0 to 7.2.1 #949, #963
• Bumps webonyx/graphql-php from 15.37.0 to 15.39.0 #939, #963

Full Changelog: v2.10.2...v2.11.0

Fixes

• Corrects the wrong cherry-picked commit for version formatting fix included in v2.10.1 #930

Full Changelog: v2.10.1...v2.10.2

New

• Adds Kea-specific netboot fields to DHCPServer
• Adds support for pfSense CE 2.9.0 #933
• Adds support for pfSense Plus 26.07 #933

Fixes

• Fixes a version formatting issue in RESTAPIVersion that resulted in an inaccurate installed version value #930

Changes

• FirewallApplyDispatcher now dispatches process using /etc/rc.filter_configure_sync
• Removes/replaces various defunct pfSense function calls
• Various minor compatibility and testing adjustments for pfSense CE 2.9.0 and Plus 26.07

Full Changelog: v2.10.0...v2.10.1

Fixes Changed

• Fixes authentication bug for v1 HA API sync by #935

New Contributors

• @cipwurzel362 made their first contribution in #936

Full Changelog: v1.9.0...v1.9.1

Contributors

Fixes

• Fixes a command prompt injection flaw in the /api/v2/interface/group and /api/v2/interface/groups endpoints GHSA-w3w4-mvcc-vmgr (thank you to @senti-man for discovering and reporting this issue!)
• Implements core Command auto-escaping to guard against future command injection risks
• Fixes an issue where ACME certificate issuance results no longer populated due to out-of-band changes in the upstream acme package
• Addresses a Validator object order-of-precedence issue that caused out of sequence validations for some fields
• Various PHP >8.2 syntax issues fixed in preparation for pfSense CE 2.9.0

Breaking Changes

• Adds sensitive flag to OpenVPNClient auth_pass field
• Adds sensitive flag to User ipsecpsk field
• Adds sensitive flag to WireGuardPeer presharedkey field

Changes

• Remaining shell_exec and exec calls have been replaced with \RESTAPI\Core\Command to take advantage of added protections
• Basic authentiatcion is now only considered the requested authentication method when a client provides both a username AND password. Previously either the presence of basic authentication username or password would elect basic authentication as the requested method.
• Auth now uses header presence to determine the client's requested auth method
• Additional guard clauses have been added during auth handling to exit quicker upon invalid auth

Full Changelog: v2.9.0...v2.10.0

Contributors

New

• Adds /api/v2/system/hasync endpoint to configure XMLRPC configuration sync #843
• Adds /api/v2/status/wireguard/tunnels endpoint to view status of current WireGuard tunnels #790
• Adds /api/v2/status/wireguard/peers endpoint to view status of current WireGuard peers #790

Breaking changes

• RESTAPISettings hasync_username now must hold page-all privileges to successfully sync on HA peers
• RESTAPISettings hasync must now be enabled on remote HA peers before settings sync can occur

Fixes

• Addresses a potential privilege escalation issue in /api/v2/system/restapi/settings/sync
• Fixes a weak deserialization pattern in /api/v2/system/restapi/settings/sync

New Contributors

• @TechAsen made their first contribution in #901

Full Changelog: v2.8.4...v2.9.0

Contributors

Breaking Changes

• Removes page-system-api privilege from /api/v1/system/api/sync

Full Changelog: v1.8.1...v1.9.0

New

• Adds dscp field to FirewallRule #918

Fixes

• Optimizes parameter ordering
• Uses sane maximum value for LogSetting's logfilesize parameter #917

New Contributors

• @scottmsilver made their first contribution in #919

Full Changelog: v2.8.3...v2.8.4

Contributors

Fixes

• Increases the maximum length of FreeRADIUSUser motp_pin to 8 #915
• Fixes an issue that prevented nested aliases from being used when replacing all firewall aliases

Full Changelog: v2.8.2...v2.8.3

Fixes

• Adjusts timing and placement of WireGuardTunnel 'addresses' update validation pre-conditions #902

Full Changelog: v2.8.1...v2.8.2