ids.cgi: Exception list changes display order and something more...

ids.cgi: Exception list changes display order and something more...

[Matthias Fischer]

Hi,

I found some strange things on the IPS system...

First:
I defined five whitelisted hosts (or more, doesn't matter) on the
intrusion prevention page.

Now every time I reload the page, the display order of these host list
changes. IP address and remark stick together but the order changes
every time I reload the page. As far as I saw it, the contents of
'ignored' file stay the same.

Second:
Furthermore, when I try to deactivate the last entry by removing the
check mark, the check mark disappears from the third entry (e.g.). When
I try to deactivate the third entry, check mark disappears from the last
(fifth). When I try to deactivate the second, check mark vanished from
the third... That means, most of the time the check mark disappears from
a different entry than the one I wanted to deselect. Weird...

Third:
Last but not least: I can't deacivate single rules from the 'IPFire DBL
domain blocklists'. When I remove the check mark from the rule "IPFire
DBL [Malware] Blocked HTTP Request", the mark is back after reloading
the ruleset. I can't disable individual rules, only the entire rule set.

Can anyone confirm these findings?

Best
Matthias

Re: ids.cgi: Exception list changes display order and something more...

[Stefan Schantl]

[-- Attachment #1: Type: text/plain, Size: 1461 bytes --]

Good morning Matthias,

thanks for your mail.

I'll have a closer look at todays evening after my daily job and will 
report back.

Best regards,

-Stefan

Am 9. März 2026 22:30:47 schrieb Matthias Fischer 
<matthias.fischer@ipfire.org>:

> Hi,
>
> I found some strange things on the IPS system...
>
> First:
> I defined five whitelisted hosts (or more, doesn't matter) on the
> intrusion prevention page.
>
> Now every time I reload the page, the display order of these host list
> changes. IP address and remark stick together but the order changes
> every time I reload the page. As far as I saw it, the contents of
> 'ignored' file stay the same.
>
> Second:
> Furthermore, when I try to deactivate the last entry by removing the
> check mark, the check mark disappears from the third entry (e.g.). When
> I try to deactivate the third entry, check mark disappears from the last
> (fifth). When I try to deactivate the second, check mark vanished from
> the third... That means, most of the time the check mark disappears from
> a different entry than the one I wanted to deselect. Weird...
>
> Third:
> Last but not least: I can't deacivate single rules from the 'IPFire DBL
> domain blocklists'. When I remove the check mark from the rule "IPFire
> DBL [Malware] Blocked HTTP Request", the mark is back after reloading
> the ruleset. I can't disable individual rules, only the entire rule set.
>
> Can anyone confirm these findings?
>
> Best
> Matthias


[-- Attachment #2: Type: text/html, Size: 2809 bytes --]

[PATCH] ids.cgi: Fix sorting the ignored hosts by id

[Stefan Schantl]

The sorting statement was entirely wrong, so the lists of ignored
hosts never got sorted in a proper way.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
---
 html/cgi-bin/ids.cgi | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/html/cgi-bin/ids.cgi b/html/cgi-bin/ids.cgi
index 192c71ec6..849c37528 100644
--- a/html/cgi-bin/ids.cgi
+++ b/html/cgi-bin/ids.cgi
@@ -1506,7 +1506,7 @@ END
 			my $col = "";
 
 			# Loop through all entries of the hash.
-			foreach my $key (sort { $ignored{$a}[0] <=> $ignored{$b}[0] } keys %ignored)  {
+			foreach my $key (sort { $a <=> $b } keys %ignored)  {
 				# Assign data array positions to some nice variable names.
 				my $address = $ignored{$key}[0];
 				my $remark = $ignored{$key}[1];
-- 
2.47.3

Re: ids.cgi: Exception list changes display order and something more...

[Stefan Schantl]

Hello Matthias,

today I found some time to have the closer look on the ids.cgi file.
> Hi,
> 
> I found some strange things on the IPS system...
> 
> First:
> I defined five whitelisted hosts (or more, doesn't matter) on the
> intrusion prevention page.
> 
> Now every time I reload the page, the display order of these host
> list
> changes. IP address and remark stick together but the order changes
> every time I reload the page. As far as I saw it, the contents of
> 'ignored' file stay the same.

I was able to reproduce this issue and sent a fix to this mailing list.

Thanks for finding and reporting.
> 
> Second:
> Furthermore, when I try to deactivate the last entry by removing the
> check mark, the check mark disappears from the third entry (e.g.).
> When
> I try to deactivate the third entry, check mark disappears from the
> last
> (fifth). When I try to deactivate the second, check mark vanished
> from
> the third... That means, most of the time the check mark disappears
> from
> a different entry than the one I wanted to deselect. Weird...

Sadly I was not able to reproduce this behaviour, but I also did the
test with the fixed first issue. May this also fixed the second issue.
> 
> Third:
> Last but not least: I can't deacivate single rules from the 'IPFire
> DBL
> domain blocklists'. When I remove the check mark from the rule
> "IPFire
> DBL [Malware] Blocked HTTP Request", the mark is back after reloading
> the ruleset. I can't disable individual rules, only the entire rule
> set.

This is not directly a CGI related issue. It may come from a double
usage of the same rule SID. I did some quick analysis, found some SID
related issues on our rules and reported them to Michael.
> 
> Can anyone confirm these findings?
> 
> Best
> Matthias
> 
Best regards,

-Stefan

Re: ids.cgi: Exception list changes display order and something more...

[Matthias Fischer]

On 11.03.2026 21:12, Stefan Schantl wrote:
> Hello Matthias,
> 
> today I found some time to have the closer look on the ids.cgi file.
>> Hi,
>> 
>> I found some strange things on the IPS system...
>> 
>> First:
>> I defined five whitelisted hosts (or more, doesn't matter) on the
>> intrusion prevention page.
>> 
>> Now every time I reload the page, the display order of these host
>> list
>> changes. IP address and remark stick together but the order changes
>> every time I reload the page. As far as I saw it, the contents of
>> 'ignored' file stay the same.
> 
> I was able to reproduce this issue and sent a fix to this mailing list.

Tested. Fixed. Thanks! :-)

> Thanks for finding and reporting.

No problem - you're welcome! ;-)

>> Second:
>> Furthermore, when I try to deactivate the last entry by removing the
>> check mark, the check mark disappears from the third entry (e.g.).
>> When
>> I try to deactivate the third entry, check mark disappears from the
>> last
>> (fifth). When I try to deactivate the second, check mark vanished
>> from
>> the third... That means, most of the time the check mark disappears
>> from
>> a different entry than the one I wanted to deselect. Weird...
> 
> Sadly I was not able to reproduce this behaviour, but I also did the
> test with the fixed first issue. May this also fixed the second issue.

Yep. Fixing the sorting statement fixed this, too.

>> Third:
>> Last but not least: I can't deacivate single rules from the 'IPFire
>> DBL
>> domain blocklists'. When I remove the check mark from the rule
>> "IPFire
>> DBL [Malware] Blocked HTTP Request", the mark is back after reloading
>> the ruleset. I can't disable individual rules, only the entire rule
>> set.
> 
> This is not directly a CGI related issue. It may come from a double
> usage of the same rule SID. I did some quick analysis, found some SID
> related issues on our rules and reported them to Michael.

Ok, we'll see. Thanks again!

Best
Matthias

>> Can anyone confirm these findings?
>> 
>> Best
>> Matthias
>> 
> Best regards,
> 
> -Stefan
>