From 3ebc0da70f7237f8892884d96bf9fc5b9a06304a Mon Sep 17 00:00:00 2001
From: Michael Tremer <michael.tremer@ipfire.org>
Date: Thu, 10 Jul 2014 13:26:02 +0200
Subject: [PATCH] proxy.cgi: Allow safe/SSL ports to be empty.

Fixes a syntax error in the generated squid configuration
file.
---
 config/rootfiles/core/80/update.sh |  3 +++
 html/cgi-bin/proxy.cgi             | 36 +++++++++++++++++++-----------
 2 files changed, 26 insertions(+), 13 deletions(-)

diff --git a/config/rootfiles/core/80/update.sh b/config/rootfiles/core/80/update.sh
index 8bd9a89077..830481d0ea 100644
--- a/config/rootfiles/core/80/update.sh
+++ b/config/rootfiles/core/80/update.sh
@@ -53,6 +53,9 @@ rm -f \
 	/opt/pakfire/db/installed/meta-libgpg-error \
 	/opt/pakfire/db/rootfiles/libgpg-error
 
+# Regenerate squid configuration file
+/srv/web/ipfire/cgi-bin/proxy.cgi
+
 # Generate ddns configuration file
 /srv/web/ipfire/cgi-bin/ddns.cgi
 
diff --git a/html/cgi-bin/proxy.cgi b/html/cgi-bin/proxy.cgi
index 2a9d493942..03fd1ab7b6 100644
--- a/html/cgi-bin/proxy.cgi
+++ b/html/cgi-bin/proxy.cgi
@@ -3396,19 +3396,25 @@ END
 	}
 
 open (PORTS,"$acl_ports_ssl");
-@temp = <PORTS>;
+my @ssl_ports = <PORTS>;
 close PORTS;
-if (@temp)
-{
-	foreach (@temp) { print FILE "acl SSL_ports port $_"; }
+
+if (@ssl_ports) {
+	foreach (@ssl_ports) {
+		print FILE "acl SSL_ports port $_";
+	}
 }
+
 open (PORTS,"$acl_ports_safe");
-@temp = <PORTS>;
+my @safe_ports = <PORTS>;
 close PORTS;
-if (@temp)
-{
-	foreach (@temp) { print FILE "acl Safe_ports port $_"; }
+
+if (@safe_ports) {
+	foreach (@safe_ports) {
+		print FILE "acl Safe_ports port $_";
+	}
 }
+
 	print FILE <<END
 
 acl IPFire_http  port $http_port
@@ -3498,7 +3504,7 @@ END
 		print FILE "http_access deny purge\n";
 		print FILE "url_rewrite_access deny localhost\n";
 	}
-	print FILE <<END
+	print FILE <<END;
 
 #Access to squid:
 #local machine, no restriction
@@ -3509,11 +3515,15 @@ http_access allow         IPFire_ips IPFire_networks IPFire_http
 http_access allow CONNECT IPFire_ips IPFire_networks IPFire_https
 
 #Deny not web services
-http_access deny          !Safe_ports
-http_access deny  CONNECT !SSL_ports
-
 END
-	;
+
+if (@safe_ports) {
+	print FILE "http_access deny          !Safe_ports\n";
+}
+
+if (@ssl_ports) {
+	print FILE "http_access deny  CONNECT !SSL_ports\n";
+}
 
 if ($proxysettings{'AUTH_METHOD'} eq 'ident')
 {
-- 
2.39.5