Help ticket #3449:

Improve data validation to avoid save a host/subnet or a IPv4 with
invalid mask. The reported error is on javascript and only happen on
IE8,but this fix will prevent the same issue happening in the future on
a different browser.

1 files changed, 6 insertions, 2 deletions

diff --git a/usr/local/www/firewall_aliases_edit.php b/usr/local/www/firewall_aliases_edit.php
index 417deb2..e5702f2 100755
--- a/usr/local/www/firewall_aliases_edit.php
+++ b/usr/local/www/firewall_aliases_edit.php
@@ -307,8 +307,12 @@ if ($_POST) {
 					$address = array_merge($address, $rangesubnets);
 				} else {
 					$tmpaddress = $_POST["address{$x}"];
-					if(is_ipaddr($_POST["address{$x}"]) && $_POST["address_subnet{$x}"] <> "")
-						$tmpaddress .= "/" . $_POST["address_subnet{$x}"];
+					if($_POST['type'] != "host" && is_ipaddr($_POST["address{$x}"]) && $_POST["address_subnet{$x}"] <> "") {
+						if (!is_subnet($_POST["address{$x}"] . "/" . $_POST["address_subnet{$x}"]))
+							$input_errors[] = sprintf(gettext('%s/%s is not a valid subnet.'), $_POST["address{$x}"], $_POST["address_subnet{$x}"]);
+						else
+							$tmpaddress .= "/" . $_POST["address_subnet{$x}"];
+					}
 					$address[] = $tmpaddress;
 				}
 				if ($_POST["detail{$x}"] <> "") {