pfsense/pfsense — pull request #1000 by phil-davis (2014-03-07 10:44:56+00:00)
Title: Validate rule Advanced Options numbers

Fixes #3510. Sorry for all the comments in function is_blank_or_posint_string($strvar) - but this validation stuff is a real pain in PHP. "0" being empty and false, and all the various is_int is_numeric ctype_digit functions that do some unexpected things when passed (int) (float) (boolean) and (string) types. And in this case we really do want to accept just strings of digits from 0 to 9 without any leading zero. We don't want any fancy forms or casts of numbers to slip in somehow.
The tests in function is_aoadv_used($rule_config) had to be changed back from using empty() to use $var != "" because if the user enters "0" in one of those fields and presses save, they get an error message, but the Advanced Options block on the GUI is closed (the "0" was considered empty()). That seemed rather confusing - the user had to click on the Advanced Options "Advanced" button again to open up that block and see the "0" they had entered.
I have prohibited 2 things that "pf" allows into the ruleset without generating an error:
(max 0)
(tcp.established 0)
Both of these seem (IMHO) to have no valid use case. They would prevent states from ever happening, and so would effectively be block rules, which could be implemented easily as block rules. But let me know if there is some valid use case, and I will have to allow "0" in those fields.