OPNsense Forum

English Forums => 26.1, 26,4 Series => Topic started by: mlenje on July 05, 2026, 12:36:23 AM

Title: Did Monit Settings Change?
Post by: mlenje on July 05, 2026, 12:36:23 AM
It was working perfectly, but now I am getting an error in the Alert Setting for the Mail Format free text field that says "Text may not contain spaces or tabs."

Monit 5.35.2 on OPNsense v26.1.11
Title: Re: Did Monit Settings Change?
Post by: lmoore on July 05, 2026, 01:44:09 AM
Are you on 26.1.11_3 or later?

https://forum.opnsense.org/index.php?msg=269519 (https://forum.opnsense.org/index.php?msg=269519)
Title: Re: Did Monit Settings Change?
Post by: mlenje on July 05, 2026, 03:07:02 AM
I am on 26.1.11_5... will update to 26.1.11_6 and see if that helps.
Title: Re: Did Monit Settings Change?
Post by: mlenje on July 05, 2026, 04:31:09 AM
Still persists with v26.1.11_6
Title: Re: Did Monit Settings Change?
Post by: franco on July 05, 2026, 08:57:08 AM
Can you open a ticket on GitHub? A security issue was raised over concerns of arbitrary config file injection due to settings made by Monit amongst other which prompted us to make the validation of some fields more restrictive. Mail format should have been flagged as one of those that apparently allow newlines and thus need other safeguards if any, but I also have no idea how mail format is escaped underneath so a ticket would be better.


Thanks,
Franco
Title: Re: Did Monit Settings Change?
Post by: mlenje on July 06, 2026, 07:28:23 PM
Ticket created.
Title: Re: Did Monit Settings Change?
Post by: franco on July 06, 2026, 08:03:55 PM
Thanks, moved to core: https://github.com/opnsense/core/issues/10498
Title: Re: Did Monit Settings Change?
Post by: franco on July 08, 2026, 08:09:14 AM
# opnsense-patch https://github.com/opnsense/core/commit/d930c04
Title: Re: Did Monit Settings Change?
Post by: TomS2 on July 09, 2026, 11:24:17 AM
Thank you Franco for the patch.
Looking forward to the next update containing the patch.

Thanks,
Tom
Title: Re: Did Monit Settings Change?
Post by: franco on July 09, 2026, 01:01:45 PM
Will be next week with the upgrade path unlock for 26.7.

Still some things to do so we refrained from pushing a 26.1.12 this week.


Cheers,
Franco