Fix to require trusted proxies for SSL client cert headers

This PR tightens handling of proxied SSL client certificate headers so they are only honored when Webmin is configured to trust SSL headers and the direct TCP peer matches an explicit `trusted_proxies` entry.

The change preserves legacy forwarded-IP behavior for `trust_real_ip`, but prevents ambiguous legacy configs with no trusted proxy from accepting spoofable `X-SSL-Client-*` headers as authentication identity. During postinstall, such legacy configs now default to `no_trust_ssl=1`.

CHANGELOG.md

@@ -1,5 +1,8 @@
 ## Changelog
 
+#### 2.652 (July, 2026)
+* Fix to recognize hex numeric HTML entities to work in various elements
+
 #### 2.651 (June 28, 2026)
 * Fix Certbot-backed certificate requests and renewals to correctly parse PEM paths after issuance
 * Fix live activation of Linux bond interfaces [#2777](https://github.com/webmin/webmin/pull/2777)

miniserv.pl

@@ -1542,16 +1542,25 @@ if ($headerhost) {
 	$headerhost = undef if (!&check_ipaddress($headerhost) &&
 				!&check_ip6address($headerhost));
 	}
-# If trusted_proxies is configured, header-supplied client IP and SSL
+# If trusted_proxies is configured, header-supplied client IP is only
-# client info are only honored when the direct TCP peer is in that list.
+# honored when the direct TCP peer is in that list. Proxied SSL client
-# Otherwise drop them so an attacker reaching miniserv directly cannot
+# cert headers carry authentication identity, so only honor those from
-# spoof X-Forwarded-For or X-SSL-Client-* to bypass auth.
+# an explicitly trusted proxy.
-if ($config{'trust_real_ip'} && $config{'trusted_proxies'} ne '' &&
+my @trusted_proxies = split(/\s+/, $config{'trusted_proxies'} || "");
-    !&ip_match($acptip, $localip,
+my $trusted_proxy = @trusted_proxies &&
-	       split(/\s+/, $config{'trusted_proxies'}))) {
+	&ip_match($acptip, $localip, @trusted_proxies);
+my $trust_ssl_client_headers = $config{'trust_real_ip'} &&
+	!$config{'no_trust_ssl'} && $trusted_proxy;
+if ($config{'trust_real_ip'} && @trusted_proxies && !$trusted_proxy) {
 	print DEBUG "handle_request: peer $acptip not in trusted_proxies; ".
-		    "ignoring forwarding and SSL client headers\n";
+		    "ignoring forwarding headers\n";
 	$headerhost = undef;
+	}
+if (!$trust_ssl_client_headers) {
+	print DEBUG "handle_request: ignoring SSL client headers from ".
+		    "peer $acptip\n"
+		if ($header{'x-ssl-client-dn'} ||
+		    $header{'x-ssl-client-verify'});
 	delete $header{'x-ssl-client-dn'};
 	delete $header{'x-ssl-client-verify'};
 	}

t/web-lib-funcs-strings.t

@@ -38,6 +38,9 @@ subtest 'html_escape' => sub {
 	is(main::html_escape('&'),    '&', 'default mode double-escapes &');
 	is(main::html_escape('&', 1), '&',     'nodblamp preserves existing &');
 	is(main::html_escape('A', 1), 'A',     'nodblamp preserves numeric entity');
+	is(main::html_escape('◦', 1), '◦', 'nodblamp preserves hex numeric entity');
+	is(main::html_escape('◦', 1), '◦', 'nodblamp preserves uppercase hex numeric entity');
+	is(main::html_escape('&#xZZ;', 1), '&#xZZ;', 'nodblamp escapes invalid hex numeric entity');
 	# Note: nodblamp's lookahead matches any &<letters>; as an entity, so
 	# made-up names like &x; are treated as entities and not re-escaped.
 	is(main::html_escape('&x;',   1), '&x;',       'nodblamp preserves arbitrary &word; shape');

web-lib-funcs.pl

@@ -302,7 +302,7 @@ if (!defined $tmp) {
 	};
 # Before escaping ampersand use negative lookahead to see if occurrence
 # is not an HTML entity already to prevent double escaping (optionally)
-$tmp =~ s/&(?!(([a-zA-Z]+)|(#|#x)\d+);)/&/g if ($nodblamp);
+$tmp =~ s/&(?!([a-zA-Z]+|#\d+|#[xX][0-9A-Fa-f]+);)/&/g if ($nodblamp);
 # Always escape all ampersands by default
 # to make sure they are displayed per se
 $tmp =~ s/&/&/g if (!$nodblamp);

webmin/postinstall.pl

@@ -60,8 +60,12 @@ if (!-r $first_install_file || $miniserv{'login_script'} eq $record_login_cmd) {
 	$miniserv{'failed_script'} = $record_failed_cmd;
 	}
 
-# Disable trusting SSL certs unless already enabled
+# Disable trusting SSL certs unless already enabled. Legacy configs with
-if (!$miniserv{'trust_real_ip'} && !defined($miniserv{'no_trust_ssl'})) {
+# trust_real_ip but no trusted proxy cannot safely authenticate from
+# proxied SSL client cert headers.
+my @trusted_proxies = split(/\s+/, $miniserv{'trusted_proxies'} || "");
+if ((!$miniserv{'trust_real_ip'} || !@trusted_proxies) &&
+    !defined($miniserv{'no_trust_ssl'})) {
 	$miniserv{'no_trust_ssl'} = 1;
 	}