Revisions to GET/POST conversion limiting POSTs to save, apply, and delete functions - VPN

12 files changed, 204 insertions, 210 deletions

diff --git a/src/usr/local/www/vpn_ipsec.php b/src/usr/local/www/vpn_ipsec.php
index 1b9fa16..22ef39d 100644
--- a/src/usr/local/www/vpn_ipsec.php
+++ b/src/usr/local/www/vpn_ipsec.php
@@ -48,174 +48,174 @@ if (!is_array($config['ipsec']['phase2'])) {
 $a_phase1 = &$config['ipsec']['phase1'];
 $a_phase2 = &$config['ipsec']['phase2'];
 
-if ($_POST) {
-	if ($_POST['apply']) {
-		$ipsec_dynamic_hosts = vpn_ipsec_configure();
-		/* reload the filter in the background */
-		$retval = 0;
-		$retval |= filter_configure();
-		if ($ipsec_dynamic_hosts >= 0) {
-			if (is_subsystem_dirty('ipsec')) {
-				clear_subsystem_dirty('ipsec');
-			}
+
+if ($_POST['apply']) {
+	$ipsec_dynamic_hosts = vpn_ipsec_configure();
+	/* reload the filter in the background */
+	$retval = 0;
+	$retval |= filter_configure();
+	if ($ipsec_dynamic_hosts >= 0) {
+		if (is_subsystem_dirty('ipsec')) {
+			clear_subsystem_dirty('ipsec');
 		}
-	} else if (isset($_POST['del'])) {
-		/* delete selected p1 entries */
-		if (is_array($_POST['p1entry']) && count($_POST['p1entry'])) {
-			foreach ($_POST['p1entry'] as $p1entrydel) {
-				unset($a_phase1[$p1entrydel]);
-			}
-			if (write_config()) {
-				mark_subsystem_dirty('ipsec');
-			}
+	}
+} else if (isset($_POST['del'])) {
+	/* delete selected p1 entries */
+	if (is_array($_POST['p1entry']) && count($_POST['p1entry'])) {
+		foreach ($_POST['p1entry'] as $p1entrydel) {
+			unset($a_phase1[$p1entrydel]);
 		}
-	} else if (isset($_POST['delp2'])) {
-		/* delete selected p2 entries */
-		if (is_array($_POST['p2entry']) && count($_POST['p2entry'])) {
-			foreach ($_POST['p2entry'] as $p2entrydel) {
-				unset($a_phase2[$p2entrydel]);
-			}
-			if (write_config()) {
-				mark_subsystem_dirty('ipsec');
-			}
+		if (write_config()) {
+			mark_subsystem_dirty('ipsec');
 		}
-	} else {
-		/* yuck - IE won't send value attributes for image buttons, while Mozilla does - so we use .x/.y to find move button clicks instead... */
-
-		// TODO: this. is. nasty.
-		unset($delbtn, $delbtnp2, $movebtn, $movebtnp2, $togglebtn, $togglebtnp2);
-		foreach ($_POST as $pn => $pd) {
-			if (preg_match("/del_(\d+)/", $pn, $matches)) {
-				$delbtn = $matches[1];
-			} else if (preg_match("/delp2_(\d+)/", $pn, $matches)) {
-				$delbtnp2 = $matches[1];
-			} else if (preg_match("/move_(\d+)/", $pn, $matches)) {
-				$movebtn = $matches[1];
-			} else if (preg_match("/movep2_(\d+)/", $pn, $matches)) {
-				$movebtnp2 = $matches[1];
-			} else if (preg_match("/toggle_(\d+)/", $pn, $matches)) {
-				$togglebtn = $matches[1];
-			} else if (preg_match("/togglep2_(\d+)/", $pn, $matches)) {
-				$togglebtnp2 = $matches[1];
-			}
+	}
+} else if (isset($_POST['delp2'])) {
+	/* delete selected p2 entries */
+	if (is_array($_POST['p2entry']) && count($_POST['p2entry'])) {
+		foreach ($_POST['p2entry'] as $p2entrydel) {
+			unset($a_phase2[$p2entrydel]);
 		}
+		if (write_config()) {
+			mark_subsystem_dirty('ipsec');
+		}
+	}
+} else  {
+	/* yuck - IE won't send value attributes for image buttons, while Mozilla does - so we use .x/.y to find move button clicks instead... */
+
+	// TODO: this. is. nasty.
+	unset($delbtn, $delbtnp2, $movebtn, $movebtnp2, $togglebtn, $togglebtnp2);
+	foreach ($_POST as $pn => $pd) {
+		if (preg_match("/del_(\d+)/", $pn, $matches)) {
+			$delbtn = $matches[1];
+		} else if (preg_match("/delp2_(\d+)/", $pn, $matches)) {
+			$delbtnp2 = $matches[1];
+		} else if (preg_match("/move_(\d+)/", $pn, $matches)) {
+			$movebtn = $matches[1];
+		} else if (preg_match("/movep2_(\d+)/", $pn, $matches)) {
+			$movebtnp2 = $matches[1];
+		} else if (preg_match("/toggle_(\d+)/", $pn, $matches)) {
+			$togglebtn = $matches[1];
+		} else if (preg_match("/togglep2_(\d+)/", $pn, $matches)) {
+			$togglebtnp2 = $matches[1];
+		}
+	}
 
-		$save = 1;
-
-		/* move selected p1 entries before this */
-		if (isset($movebtn) && is_array($_POST['p1entry']) && count($_POST['p1entry'])) {
-			$a_phase1_new = array();
-
-			/* copy all p1 entries < $movebtn and not selected */
-			for ($i = 0; $i < $movebtn; $i++) {
-				if (!in_array($i, $_POST['p1entry'])) {
-					$a_phase1_new[] = $a_phase1[$i];
-				}
-			}
+	$save = 1;
 
-			/* copy all selected p1 entries */
-			for ($i = 0; $i < count($a_phase1); $i++) {
-				if ($i == $movebtn) {
-					continue;
-				}
-				if (in_array($i, $_POST['p1entry'])) {
-					$a_phase1_new[] = $a_phase1[$i];
-				}
-			}
+	/* move selected p1 entries before this */
+	if (isset($movebtn) && is_array($_POST['p1entry']) && count($_POST['p1entry'])) {
+		$a_phase1_new = array();
 
-			/* copy $movebtn p1 entry */
-			if ($movebtn < count($a_phase1)) {
-				$a_phase1_new[] = $a_phase1[$movebtn];
+		/* copy all p1 entries < $movebtn and not selected */
+		for ($i = 0; $i < $movebtn; $i++) {
+			if (!in_array($i, $_POST['p1entry'])) {
+				$a_phase1_new[] = $a_phase1[$i];
 			}
+		}
 
-			/* copy all p1 entries > $movebtn and not selected */
-			for ($i = $movebtn+1; $i < count($a_phase1); $i++) {
-				if (!in_array($i, $_POST['p1entry'])) {
-					$a_phase1_new[] = $a_phase1[$i];
-				}
+		/* copy all selected p1 entries */
+		for ($i = 0; $i < count($a_phase1); $i++) {
+			if ($i == $movebtn) {
+				continue;
 			}
-			if (count($a_phase1_new) > 0) {
-				$a_phase1 = $a_phase1_new;
+			if (in_array($i, $_POST['p1entry'])) {
+				$a_phase1_new[] = $a_phase1[$i];
 			}
+		}
 
-		} else if (isset($movebtnp2) && is_array($_POST['p2entry']) && count($_POST['p2entry'])) {
-			/* move selected p2 entries before this */
-			$a_phase2_new = array();
+		/* copy $movebtn p1 entry */
+		if ($movebtn < count($a_phase1)) {
+			$a_phase1_new[] = $a_phase1[$movebtn];
+		}
 
-			/* copy all p2 entries < $movebtnp2 and not selected */
-			for ($i = 0; $i < $movebtnp2; $i++) {
-				if (!in_array($i, $_POST['p2entry'])) {
-					$a_phase2_new[] = $a_phase2[$i];
-				}
+		/* copy all p1 entries > $movebtn and not selected */
+		for ($i = $movebtn+1; $i < count($a_phase1); $i++) {
+			if (!in_array($i, $_POST['p1entry'])) {
+				$a_phase1_new[] = $a_phase1[$i];
 			}
+		}
+		if (count($a_phase1_new) > 0) {
+			$a_phase1 = $a_phase1_new;
+		}
 
-			/* copy all selected p2 entries */
-			for ($i = 0; $i < count($a_phase2); $i++) {
-				if ($i == $movebtnp2) {
-					continue;
-				}
-				if (in_array($i, $_POST['p2entry'])) {
-					$a_phase2_new[] = $a_phase2[$i];
-				}
-			}
+	} else if (isset($movebtnp2) && is_array($_POST['p2entry']) && count($_POST['p2entry'])) {
+		/* move selected p2 entries before this */
+		$a_phase2_new = array();
 
-			/* copy $movebtnp2 p2 entry */
-			if ($movebtnp2 < count($a_phase2)) {
-				$a_phase2_new[] = $a_phase2[$movebtnp2];
+		/* copy all p2 entries < $movebtnp2 and not selected */
+		for ($i = 0; $i < $movebtnp2; $i++) {
+			if (!in_array($i, $_POST['p2entry'])) {
+				$a_phase2_new[] = $a_phase2[$i];
 			}
+		}
 
-			/* copy all p2 entries > $movebtnp2 and not selected */
-			for ($i = $movebtnp2+1; $i < count($a_phase2); $i++) {
-				if (!in_array($i, $_POST['p2entry'])) {
-					$a_phase2_new[] = $a_phase2[$i];
-				}
+		/* copy all selected p2 entries */
+		for ($i = 0; $i < count($a_phase2); $i++) {
+			if ($i == $movebtnp2) {
+				continue;
 			}
-			if (count($a_phase2_new) > 0) {
-				$a_phase2 = $a_phase2_new;
+			if (in_array($i, $_POST['p2entry'])) {
+				$a_phase2_new[] = $a_phase2[$i];
 			}
+		}
 
-		} else if (isset($togglebtn)) {
-			if (isset($a_phase1[$togglebtn]['disabled'])) {
-				unset($a_phase1[$togglebtn]['disabled']);
-			} else {
-				$a_phase1[$togglebtn]['disabled'] = true;
-			}
-		} else if (isset($togglebtnp2)) {
-			if (isset($a_phase2[$togglebtnp2]['disabled'])) {
-				unset($a_phase2[$togglebtnp2]['disabled']);
-			} else {
-				$a_phase2[$togglebtnp2]['disabled'] = true;
-			}
-		} else if (isset($delbtn)) {
-			/* remove static route if interface is not WAN */
-			if ($a_phase1[$delbtn]['interface'] <> "wan") {
-				mwexec("/sbin/route delete -host {$a_phase1[$delbtn]['remote-gateway']}");
-			}
+		/* copy $movebtnp2 p2 entry */
+		if ($movebtnp2 < count($a_phase2)) {
+			$a_phase2_new[] = $a_phase2[$movebtnp2];
+		}
 
-			/* remove all phase2 entries that match the ikeid */
-			$ikeid = $a_phase1[$delbtn]['ikeid'];
-			foreach ($a_phase2 as $p2index => $ph2tmp) {
-				if ($ph2tmp['ikeid'] == $ikeid) {
-					unset($a_phase2[$p2index]);
-				}
+		/* copy all p2 entries > $movebtnp2 and not selected */
+		for ($i = $movebtnp2+1; $i < count($a_phase2); $i++) {
+			if (!in_array($i, $_POST['p2entry'])) {
+				$a_phase2_new[] = $a_phase2[$i];
 			}
-			unset($a_phase1[$delbtn]);
-
-		} else if (isset($delbtnp2)) {
-			unset($a_phase2[$delbtnp2]);
+		}
+		if (count($a_phase2_new) > 0) {
+			$a_phase2 = $a_phase2_new;
+		}
 
+	} else if (isset($togglebtn)) {
+		if (isset($a_phase1[$togglebtn]['disabled'])) {
+			unset($a_phase1[$togglebtn]['disabled']);
 		} else {
-			$save = 0;
+			$a_phase1[$togglebtn]['disabled'] = true;
+		}
+	} else if (isset($togglebtnp2)) {
+		if (isset($a_phase2[$togglebtnp2]['disabled'])) {
+			unset($a_phase2[$togglebtnp2]['disabled']);
+		} else {
+			$a_phase2[$togglebtnp2]['disabled'] = true;
+		}
+	} else if (isset($delbtn)) {
+		/* remove static route if interface is not WAN */
+		if ($a_phase1[$delbtn]['interface'] <> "wan") {
+			mwexec("/sbin/route delete -host {$a_phase1[$delbtn]['remote-gateway']}");
 		}
 
-		if ($save === 1) {
-			if (write_config()) {
-				mark_subsystem_dirty('ipsec');
+		/* remove all phase2 entries that match the ikeid */
+		$ikeid = $a_phase1[$delbtn]['ikeid'];
+		foreach ($a_phase2 as $p2index => $ph2tmp) {
+			if ($ph2tmp['ikeid'] == $ikeid) {
+				unset($a_phase2[$p2index]);
 			}
 		}
+		unset($a_phase1[$delbtn]);
+
+	} else if (isset($delbtnp2)) {
+		unset($a_phase2[$delbtnp2]);
+
+	} else {
+		$save = 0;
+	}
+
+	if ($save === 1) {
+		if (write_config()) {
+			mark_subsystem_dirty('ipsec');
+		}
 	}
 }
 
+
 $pgtitle = array(gettext("VPN"), gettext("IPsec"), gettext("Tunnels"));
 $pglinks = array("", "@self", "@self");
 $shortcut_section = "ipsec";
@@ -350,9 +350,9 @@ if (is_subsystem_dirty('ipsec')) {
 						<td style="cursor: pointer;">
 <!--							<a	class="fa fa-anchor" id="Xmove_<?=$i?>" title="<?=gettext("Move checked entries to here")?>"></a> -->
 							<button style="display: none;" class="btn btn-default btn-xs" type="submit" id="move_<?=$i?>" name="move_<?=$i?>" value="move_<?=$i?>"><?=gettext("Move checked entries to here")?></button>
-							<a class="fa fa-pencil" href="vpn_ipsec_phase1.php?p1index=<?=$i?>" title="<?=gettext("Edit phase1 entry"); ?>" usepost></a>
+							<a class="fa fa-pencil" href="vpn_ipsec_phase1.php?p1index=<?=$i?>" title="<?=gettext("Edit phase1 entry"); ?>"></a>
 <?php if (!isset($ph1ent['mobile'])): ?>
-							<a class="fa fa-clone" href="vpn_ipsec_phase1.php?dup=<?=$i?>" title="<?=gettext("Copy phase1 entry"); ?>" usepost></a>
+							<a class="fa fa-clone" href="vpn_ipsec_phase1.php?dup=<?=$i?>" title="<?=gettext("Copy phase1 entry"); ?>"></a>
 <?php endif; ?>
 							<a	class="fa fa-trash no-confirm" id="Xdel_<?=$i?>" title="<?=gettext('Delete phase1 entry'); ?>"></a>
 							<button style="display: none;" class="btn btn-xs btn-warning" type="submit" id="del_<?=$i?>" name="del_<?=$i?>" value="del_<?=$i?>" title="<?=gettext('Delete phase1 entry'); ?>">delete</button>
@@ -363,8 +363,8 @@ if (is_subsystem_dirty('ipsec')) {
 						<td colspan="2"></td>
 						<td colspan="7" class="contains-table">
 <?php
-			if (isset($_POST["tdph2-{$i}-visible"])) {
-				$tdph2_visible = htmlspecialchars($_POST["tdph2-{$i}-visible"]);
+			if (isset($_REQUEST["tdph2-{$i}-visible"])) {
+				$tdph2_visible = htmlspecialchars($_REQUEST["tdph2-{$i}-visible"]);
 			} else {
 				$tdph2_visible = 0;
 			}
@@ -472,8 +472,8 @@ if (is_subsystem_dirty('ipsec')) {
 											</td>
 											<td style="cursor: pointer;">
 <!--												<button class="fa fa-anchor button-icon" type="submit" name="movep2_<?=$j?>" value="movep2_<?=$j?>" title="<?=gettext("Move checked P2s here")?>"></button> -->
-												<a class="fa fa-pencil" href="vpn_ipsec_phase2.php?p2index=<?=$ph2ent['uniqid']?>" title="<?=gettext("Edit phase2 entry"); ?>" usepost></a>
-												<a class="fa fa-clone" href="vpn_ipsec_phase2.php?dup=<?=$ph2ent['uniqid']?>" title="<?=gettext("Add a new Phase 2 based on this one"); ?>" usepost></a>
+												<a class="fa fa-pencil" href="vpn_ipsec_phase2.php?p2index=<?=$ph2ent['uniqid']?>" title="<?=gettext("Edit phase2 entry"); ?>"></a>
+												<a class="fa fa-clone" href="vpn_ipsec_phase2.php?dup=<?=$ph2ent['uniqid']?>" title="<?=gettext("Add a new Phase 2 based on this one"); ?>"></a>
 												<a	class="fa fa-trash no-confirm" id="Xdelp2_<?=$ph2index?>" title="<?=gettext('Delete phase2 entry'); ?>"></a>
 												<button style="display: none;" class="btn btn-xs btn-warning" type="submit" id="delp2_<?=$ph2index?>" name="delp2_<?=$ph2index?>" value="delp2_<?=$ph2index?>" title="<?=gettext('delete phase2 entry'); ?>">delete</button>
 											</td>
@@ -482,7 +482,7 @@ if (is_subsystem_dirty('ipsec')) {
 										<tr>
 											<td></td>
 											<td>
-												<a class="btn btn-xs btn-success" href="vpn_ipsec_phase2.php?ikeid=<?=$ph1ent['ikeid']?><?php if (isset($ph1ent['mobile'])) echo "&amp;mobile=true"?>" usepost>
+												<a class="btn btn-xs btn-success" href="vpn_ipsec_phase2.php?ikeid=<?=$ph1ent['ikeid']?><?php if (isset($ph1ent['mobile'])) echo "&amp;mobile=true"?>">
 													<i class="fa fa-plus icon-embed-btn"></i>
 													<?=gettext("Add P2")?>
 												</a>
diff --git a/src/usr/local/www/vpn_ipsec_keys.php b/src/usr/local/www/vpn_ipsec_keys.php
index 39e2d36..d9f652b 100644
--- a/src/usr/local/www/vpn_ipsec_keys.php
+++ b/src/usr/local/www/vpn_ipsec_keys.php
@@ -152,7 +152,7 @@ if (is_subsystem_dirty('ipsec')) {
 							<?=htmlspecialchars($secretent['pre-shared-key'])?>
 						</td>
 						<td>
-							<a class="fa fa-pencil"	title="<?=gettext('Edit key')?>" href="vpn_ipsec_keys_edit.php?id=<?=$i?>" usepost></a>
+							<a class="fa fa-pencil"	title="<?=gettext('Edit key')?>" href="vpn_ipsec_keys_edit.php?id=<?=$i?>"></a>
 							<a class="fa fa-trash"	title="<?=gettext('Delete key')?>" href="vpn_ipsec_keys.php?act=del&amp;id=<?=$i?>" usepost></a>
 						</td>
 					</tr>
@@ -164,7 +164,7 @@ if (is_subsystem_dirty('ipsec')) {
 </div>
 
 <nav class="action-buttons">
-	<a class="btn btn-success btn-sm" href="vpn_ipsec_keys_edit.php" usepost>
+	<a class="btn btn-success btn-sm" href="vpn_ipsec_keys_edit.php">
 		<i class="fa fa-plus icon-embed-btn"></i>
 		<?=gettext("Add")?>
 	</a>
diff --git a/src/usr/local/www/vpn_ipsec_keys_edit.php b/src/usr/local/www/vpn_ipsec_keys_edit.php
index bf6b24d..14bf75a 100644
--- a/src/usr/local/www/vpn_ipsec_keys_edit.php
+++ b/src/usr/local/www/vpn_ipsec_keys_edit.php
@@ -41,8 +41,8 @@ if (!is_array($config['ipsec']['mobilekey'])) {
 ipsec_mobilekey_sort();
 $a_secret = &$config['ipsec']['mobilekey'];
 
-if (is_numericint($_POST['id'])) {
-	$id = $_POST['id'];
+if (is_numericint($_REQUEST['id'])) {
+	$id = $_REQUEST['id'];
 }
 
 if (isset($id) && $a_secret[$id]) {
diff --git a/src/usr/local/www/vpn_ipsec_mobile.php b/src/usr/local/www/vpn_ipsec_mobile.php
index 4fa5fe7..32f9de3 100644
--- a/src/usr/local/www/vpn_ipsec_mobile.php
+++ b/src/usr/local/www/vpn_ipsec_mobile.php
@@ -122,7 +122,7 @@ if (count($a_client)) {
 	}
 }
 
-if ($_POST['create']) {
+if ($_REQUEST['create']) {
 	header("Location: vpn_ipsec_phase1.php?mobile=true");
 }
 
diff --git a/src/usr/local/www/vpn_ipsec_phase1.php b/src/usr/local/www/vpn_ipsec_phase1.php
index bad3ae5..951f19f 100644
--- a/src/usr/local/www/vpn_ipsec_phase1.php
+++ b/src/usr/local/www/vpn_ipsec_phase1.php
@@ -48,20 +48,17 @@ if (!is_array($config['ipsec']['phase2'])) {
 $a_phase1 = &$config['ipsec']['phase1'];
 $a_phase2 = &$config['ipsec']['phase2'];
 
-if (is_numericint($_POST['p1index'])) {
-	$p1index = $_POST['p1index'];
-}
-if (isset($_POST['p1index']) && is_numericint($_POST['p1index'])) {
-	$p1index = $_POST['p1index'];
+if (is_numericint($_REQUEST['p1index'])) {
+	$p1index = $_REQUEST['p1index'];
 }
 
-if (is_numericint($_POST['dup'])) {
-	$p1index = $_POST['dup'];
+if (is_numericint($_REQUEST['dup'])) {
+	$p1index = $_REQUEST['dup'];
 }
 
 if (isset($p1index) && $a_phase1[$p1index]) {
 	// don't copy the ikeid on dup
-	if (!isset($_POST['dup']) || !is_numericint($_POST['dup'])) {
+	if (!isset($_REQUEST['dup']) || !is_numericint($_REQUEST['dup'])) {
 		$pconfig['ikeid'] = $a_phase1[$p1index]['ikeid'];
 	}
 
@@ -160,13 +157,13 @@ if (isset($p1index) && $a_phase1[$p1index]) {
 	$pconfig['iketype'] = "ikev1";
 
 	/* mobile client */
-	if ($_POST['mobile']) {
+	if ($_REQUEST['mobile']) {
 		$pconfig['mobile'] = true;
 		$pconfig['mode'] = "aggressive";
 	}
 }
 
-if (isset($_POST['dup']) && is_numericint($_POST['dup'])) {
+if (isset($_REQUEST['dup']) && is_numericint($_REQUEST['dup'])) {
 	unset($p1index);
 }
 
@@ -177,13 +174,16 @@ if ($_POST['save']) {
 	/* input validation */
 
 	$method = $pconfig['authentication_method'];
+
 	// Unset ca and cert if not required to avoid storing in config
 	if ($method == "pre_shared_key" || $method == "xauth_psk_server") {
 		unset($pconfig['certref']);
 	}
+
 	if ($method != "rsasig" && $method != "xauth_rsa_server" && $method != "eap-tls") {
 		unset($pconfig['caref']);
 	}
+
 	// Only require PSK here for normal PSK tunnels (not mobile) or xauth.
 	// For RSA methods, require the CA/Cert.
 	switch ($method) {
@@ -220,6 +220,7 @@ if ($_POST['save']) {
 			$reqdfieldsn = array(gettext("Certificate Authority"), gettext("Certificate"));
 			break;
 	}
+
 	if (!$pconfig['mobile']) {
 		$reqdfields[] = "remotegw";
 		$reqdfieldsn[] = gettext("Remote gateway");
@@ -909,7 +910,7 @@ if (isset($p1index) && $a_phase1[$p1index]) {
 		'p1index',
 		null,
 		'hidden',
-		$pconfig['$p1index']
+		$p1index
 	));
 }
 
diff --git a/src/usr/local/www/vpn_ipsec_phase2.php b/src/usr/local/www/vpn_ipsec_phase2.php
index 26a4d0d..dd62ede 100644
--- a/src/usr/local/www/vpn_ipsec_phase2.php
+++ b/src/usr/local/www/vpn_ipsec_phase2.php
@@ -53,16 +53,16 @@ if (!is_array($config['ipsec']['phase2'])) {
 $a_phase1 = &$config['ipsec']['phase1'];
 $a_phase2 = &$config['ipsec']['phase2'];
 
-if (!empty($_POST['p2index'])) {
-	$uindex = $_POST['p2index'];
+if (!empty($_REQUEST['p2index'])) {
+	$uindex = $_REQUEST['p2index'];
 }
 
-if (!empty($_POST['uniqid'])) {
-	$uindex = $_POST['uniqid'];
+if (!empty($_REQUEST['uniqid'])) {
+	$uindex = $_REQUEST['uniqid'];
 }
 
-if (!empty($_POST['dup'])) {
-	$uindex = $_POST['dup'];
+if (!empty($_REQUEST['dup'])) {
+	$uindex = $_REQUEST['dup'];
 }
 
 $ph2found = false;
@@ -101,7 +101,7 @@ if ($ph2found === true) {
 		$pconfig['remoteid_type'] = "mobile";
 	}
 } else {
-	$pconfig['ikeid'] = $_POST['ikeid'];
+	$pconfig['ikeid'] = $_REQUEST['ikeid'];
 
 	/* defaults */
 	$pconfig['localid_type'] = "lan";
@@ -114,14 +114,14 @@ if ($ph2found === true) {
 	$pconfig['uniqid'] = uniqid();
 
 	/* mobile client */
-	if ($_POST['mobile']) {
+	if ($_REQUEST['mobile']) {
 		$pconfig['mobile']=true;
 		$pconfig['remoteid_type'] = "mobile";
 	}
 }
 
 unset($ph2);
-if (!empty($_POST['dup'])) {
+if (!empty($_REQUEST['dup'])) {
 	unset($uindex);
 	unset($p2index);
 	$pconfig['uniqid'] = uniqid();
diff --git a/src/usr/local/www/vpn_ipsec_settings.php b/src/usr/local/www/vpn_ipsec_settings.php
index 2aa2e7e..c1629f9 100644
--- a/src/usr/local/www/vpn_ipsec_settings.php
+++ b/src/usr/local/www/vpn_ipsec_settings.php
@@ -45,7 +45,7 @@ $pconfig['maxmss_enable'] = isset($config['system']['maxmss_enable']);
 $pconfig['maxmss'] = $config['system']['maxmss'];
 $pconfig['uniqueids'] = $config['ipsec']['uniqueids'];
 
-if ($_POST) {
+if ($_POST['save']) {
 	unset($input_errors);
 	$pconfig = $_POST;
 
diff --git a/src/usr/local/www/vpn_l2tp_users.php b/src/usr/local/www/vpn_l2tp_users.php
index 77ae8c9..618581f 100644
--- a/src/usr/local/www/vpn_l2tp_users.php
+++ b/src/usr/local/www/vpn_l2tp_users.php
@@ -38,19 +38,17 @@ if (!is_array($config['l2tp']['user'])) {
 }
 $a_secret = &$config['l2tp']['user'];
 
-if ($_POST) {
 
-	$pconfig = $_POST;
+$pconfig = $_POST;
 
-	if ($_POST['apply']) {
-		$retval = 0;
-		if (!is_subsystem_dirty('rebootreq')) {
-			$retval |= vpn_l2tp_configure();
-		}
-		if ($retval == 0) {
-			if (is_subsystem_dirty('l2tpusers')) {
-				clear_subsystem_dirty('l2tpusers');
-			}
+if ($_POST['apply']) {
+	$retval = 0;
+	if (!is_subsystem_dirty('rebootreq')) {
+		$retval |= vpn_l2tp_configure();
+	}
+	if ($retval == 0) {
+		if (is_subsystem_dirty('l2tpusers')) {
+			clear_subsystem_dirty('l2tpusers');
 		}
 	}
 }
@@ -108,7 +106,7 @@ display_top_tabs($tab_array);
 							<?=htmlspecialchars($secretent['ip'])?>&nbsp;
 						</td>
 						<td>
-							<a class="fa fa-pencil"	title="<?=gettext('Edit user')?>"	href="vpn_l2tp_users_edit.php?id=<?=$i?>" usepost></a>
+							<a class="fa fa-pencil"	title="<?=gettext('Edit user')?>"	href="vpn_l2tp_users_edit.php?id=<?=$i?>"></a>
 							<a class="fa fa-trash"	title="<?=gettext('Delete user')?>"	href="vpn_l2tp_users.php?act=del&amp;id=<?=$i?>" usepost></a>
 						</td>
 					</tr>
@@ -119,7 +117,7 @@ display_top_tabs($tab_array);
 	</div>
 </div>
 <nav class="action-buttons">
-	<a class="btn btn-success btn-sm" href="vpn_l2tp_users_edit.php" usepost>
+	<a class="btn btn-success btn-sm" href="vpn_l2tp_users_edit.php">
 		<i class="fa fa-plus icon-embed-btn"></i>
 		<?=gettext("Add")?>
 	</a>
diff --git a/src/usr/local/www/vpn_l2tp_users_edit.php b/src/usr/local/www/vpn_l2tp_users_edit.php
index ee79f02..9f9d1ef 100644
--- a/src/usr/local/www/vpn_l2tp_users_edit.php
+++ b/src/usr/local/www/vpn_l2tp_users_edit.php
@@ -53,8 +53,8 @@ if (!is_array($config['l2tp']['user'])) {
 
 $a_secret = &$config['l2tp']['user'];
 
-if (isset($_POST['id']) && is_numericint($_POST['id'])) {
-	$id = $_POST['id'];
+if (isset($_REQUEST['id']) && is_numericint($_REQUEST['id'])) {
+	$id = $_REQUEST['id'];
 }
 
 if (isset($id) && $a_secret[$id]) {
diff --git a/src/usr/local/www/vpn_openvpn_client.php b/src/usr/local/www/vpn_openvpn_client.php
index 0d863f1..e1ba72f 100644
--- a/src/usr/local/www/vpn_openvpn_client.php
+++ b/src/usr/local/www/vpn_openvpn_client.php
@@ -57,14 +57,11 @@ if (!is_array($config['crl'])) {
 
 $a_crl =& $config['crl'];
 
-if (isset($_POST['id']) && is_numericint($_POST['id'])) {
-	$id = $_POST['id'];
+if (isset($_REQUEST['id']) && is_numericint($_REQUEST['id'])) {
+	$id = $_REQUEST['id'];
 }
 
-$act = $_POST['act'];
-if (isset($_POST['act'])) {
-	$act = $_POST['act'];
-}
+$act = $_REQUEST['act'];
 
 if (isset($id) && $a_client[$id]) {
 	$vpnid = $a_client[$id]['vpnid'];
@@ -86,7 +83,7 @@ if ($_POST['act'] == "del") {
 	$savemsg = gettext("Client successfully deleted.");
 }
 
-if ($_POST['act'] == "new") {
+if ($act == "new") {
 	$pconfig['ncp_enable'] = "enabled";
 	$pconfig['ncp-ciphers'] = "AES-256-GCM,AES-128-GCM";
 	$pconfig['autokey_enable'] = "yes";
@@ -102,8 +99,7 @@ if ($_POST['act'] == "new") {
 global $simplefields;
 $simplefields = array('auth_user', 'auth_pass');
 
-if ($_POST['act'] == "edit") {
-
+if ($act == "edit") {
 	if (isset($id) && $a_client[$id]) {
 		foreach ($simplefields as $stat) {
 			$pconfig[$stat] = $a_client[$id][$stat];
@@ -923,7 +919,7 @@ else:
 						<?=htmlspecialchars($client['description'])?>
 					</td>
 					<td>
-						<a class="fa fa-pencil"	title="<?=gettext('Edit client')?>"	href="vpn_openvpn_client.php?act=edit&amp;id=<?=$i?>" usepost></a>
+						<a class="fa fa-pencil"	title="<?=gettext('Edit client')?>"	href="vpn_openvpn_client.php?act=edit&amp;id=<?=$i?>"></a>
 						<a class="fa fa-trash"	title="<?=gettext('Delete client')?>" href="vpn_openvpn_client.php?act=del&amp;id=<?=$i?>" usepost></a>
 					</td>
 				</tr>
@@ -937,7 +933,7 @@ else:
 </div>
 
 <nav class="action-buttons">
-	<a href="vpn_openvpn_client.php?act=new" class="btn btn-sm btn-success" usepost>
+	<a href="vpn_openvpn_client.php?act=new" class="btn btn-sm btn-success">
 		<i class="fa fa-plus icon-embed-btn"></i>
 		<?=gettext("Add")?>
 	</a>
diff --git a/src/usr/local/www/vpn_openvpn_csc.php b/src/usr/local/www/vpn_openvpn_csc.php
index ff52b8e..c61dc82 100644
--- a/src/usr/local/www/vpn_openvpn_csc.php
+++ b/src/usr/local/www/vpn_openvpn_csc.php
@@ -39,15 +39,15 @@ if (!is_array($config['openvpn']['openvpn-csc'])) {
 
 $a_csc = &$config['openvpn']['openvpn-csc'];
 
-if (isset($_POST['id']) && is_numericint($_POST['id'])) {
-	$id = $_POST['id'];
+if (isset($_REQUEST['id']) && is_numericint($_REQUEST['id'])) {
+	$id = $_REQUEST['id'];
 }
 
-if (isset($_POST['act'])) {
-	$act = $_POST['act'];
+if (isset($_REQUEST['act'])) {
+	$act = $_REQUEST['act'];
 }
 
-if ($act == "del") {
+if ($_POST['act'] == "del") {
 	if (!$a_csc[$id]) {
 		pfSenseHeader("vpn_openvpn_csc.php");
 		exit;
@@ -60,7 +60,6 @@ if ($act == "del") {
 }
 
 if ($act == "edit") {
-
 	if (isset($id) && $a_csc[$id]) {
 		$pconfig['server_list'] = explode(",", $a_csc[$id]['server_list']);
 		$pconfig['custom_options'] = $a_csc[$id]['custom_options'];
@@ -678,7 +677,7 @@ else :  // Not an 'add' or an 'edit'. Just the table of Override CSCs
 						<?=htmlspecialchars($csc['description'])?>
 					</td>
 					<td>
-						<a class="fa fa-pencil"	title="<?=gettext('Edit CSC Override')?>"	href="vpn_openvpn_csc.php?act=edit&amp;id=<?=$i?>" usepost></a>
+						<a class="fa fa-pencil"	title="<?=gettext('Edit CSC Override')?>"	href="vpn_openvpn_csc.php?act=edit&amp;id=<?=$i?>"></a>
 						<a class="fa fa-trash"	title="<?=gettext('Delete CSC Override')?>"	href="vpn_openvpn_csc.php?act=del&amp;id=<?=$i?>" usepost></a>
 					</td>
 				</tr>
@@ -692,7 +691,7 @@ else :  // Not an 'add' or an 'edit'. Just the table of Override CSCs
 </div>
 
 <nav class="action-buttons">
-	<a href="vpn_openvpn_csc.php?act=new" class="btn btn-success btn-sm" usepost>
+	<a href="vpn_openvpn_csc.php?act=new" class="btn btn-success btn-sm">
 		<i class="fa fa-plus icon-embed-btn"></i>
 		<?=gettext('Add')?>
 	</a>
diff --git a/src/usr/local/www/vpn_openvpn_server.php b/src/usr/local/www/vpn_openvpn_server.php
index 8bb20fa..598dd4d 100644
--- a/src/usr/local/www/vpn_openvpn_server.php
+++ b/src/usr/local/www/vpn_openvpn_server.php
@@ -63,12 +63,12 @@ foreach ($a_crl as $cid => $acrl) {
 	}
 }
 
-if (isset($_POST['id']) && is_numericint($_POST['id'])) {
-	$id = $_POST['id'];
+if (isset($_REQUEST['id']) && is_numericint($_REQUEST['id'])) {
+	$id = $_REQUEST['id'];
 }
 
-if (isset($_POST['act'])) {
-	$act = $_POST['act'];
+if (isset($_REQUEST['act'])) {
+	$act = $_REQUEST['act'];
 }
 
 if (isset($id) && $a_server[$id]) {
@@ -77,7 +77,7 @@ if (isset($id) && $a_server[$id]) {
 	$vpnid = 0;
 }
 
-if ($act == "del") {
+if ($_POST['act'] == "del") {
 
 	if (!isset($a_server[$id])) {
 		pfSenseHeader("vpn_openvpn_server.php");
@@ -1365,7 +1365,7 @@ else:
 						<?=htmlspecialchars(sprintf('%1$s (%2$s)', $server['description'], $server['dev_mode']))?>
 					</td>
 					<td>
-						<a class="fa fa-pencil"	title="<?=gettext('Edit server')?>" href="vpn_openvpn_server.php?act=edit&amp;id=<?=$i?>" usepost></a>
+						<a class="fa fa-pencil"	title="<?=gettext('Edit server')?>" href="vpn_openvpn_server.php?act=edit&amp;id=<?=$i?>"></a>
 						<a class="fa fa-trash"	title="<?=gettext('Delete server')?>" href="vpn_openvpn_server.php?act=del&amp;id=<?=$i?>" usepost></a>
 					</td>
 				</tr>
@@ -1379,7 +1379,7 @@ else:
 </div>
 
 <nav class="action-buttons">
-	<a href="vpn_openvpn_server.php?act=new" class="btn btn-sm btn-success btn-sm" usepost>
+	<a href="vpn_openvpn_server.php?act=new" class="btn btn-sm btn-success btn-sm">
 	<i class="fa fa-plus icon-embed-btn"></i>
 		<?=gettext("Add")?>
 	</a>