System Firewall Log Filtering by Fields

Previous filter form retained for raw logs view.

1 files changed, 11 insertions, 1 deletions

diff --git a/etc/inc/filter_log.inc b/etc/inc/filter_log.inc
index 974dcdf..85548da 100644
--- a/etc/inc/filter_log.inc
+++ b/etc/inc/filter_log.inc
@@ -92,7 +92,17 @@ function match_filter_line($flent, $filtertext = "") {
 function match_filter_field($flent, $fields) {
 	foreach ($fields as $field) {
 		if ($fields[$field] == "All") continue;
-		if ( !(in_arrayi($flent[$field], explode(",", str_replace(" ", ",", $fields[$field]))) ) ) return false;
+		if ((strpos($fields[$field], '!') === 0)) {
+			$fields[$field] = substr($fields[$field], 1);
+			if (preg_match("/act/i", $field)) {
+				if ( (in_arrayi($flent[$field], explode(",", str_replace(" ", ",", $fields[$field]))) ) ) return false;
+			} else if ( (preg_match("/{$fields[$field]}/i", $flent[$field])) ) return false;
+		}
+		else {
+			if (preg_match("/act/i", $field)) {
+				if ( !(in_arrayi($flent[$field], explode(",", str_replace(" ", ",", $fields[$field]))) ) ) return false;
+			} else if ( !(preg_match("/{$fields[$field]}/i", $flent[$field])) ) return false;
+		}
 	}	
 	return true;
 }