pfsense/pfsense — pull request #1001 by phil-davis (2014-03-07 16:23:08+00:00)
Title: Validate rule Advanced Options numbers

Add function is_posnumericint($arg) to util.inc as I think it will be useful for validation in a few places where currently "0" or "01" and similar unwanted stuff can be entered in the GUI. It is similar to is_numericint($arg) but it was much easier (and more efficient IMHO) to have a completely separate function, rather than having is_posnumericint() call is_numeric_int and then do extra, reasonably tricky, checks.
Use the function to validate numbers entered in Advanced Options of firewall rules. These maximum state entries etc. should be ordinary positive integers.
Note 1: The tests in function is_aoadv_used($rule_config) had to be changed back from using empty() to use $var != "" because if the user enters "0" in one of those fields and presses save, they get an error message, but the Advanced Options block on the GUI is closed (the "0" was considered empty()). That seemed rather confusing - the user would have had to click on the Advanced Options "Advanced" button again to open up that block and see the "0" they had entered.
Note 2: I have prohibited 2 things that "pf" allows into the ruleset without generating an error:
(max 0)
(tcp.established 0)
Both of these seem (IMHO) to have no valid use case. They would prevent states from ever happening, and so would effectively be block rules, which could be implemented easily as block rules. But let me know if there is some valid use case, and I will have to allow "0" in those fields.