www: remove exec.php

(1) It has been disabled since our first release.
(2) It is not part of our development workflow.
(3) It is quite dangerous and potentally fatal.

src/etc/inc/priv.defs.inc

 <?php
-/*
- * priv.defs.inc - Generated privilege definitions
- *
- */
 
 $priv_list = array();
 
@@ -308,12 +304,6 @@ $priv_list['page-diagnostics-edit']['match'][] = "edit.php*";
 $priv_list['page-diagnostics-edit']['match'][] = "browser.php*";
 $priv_list['page-diagnostics-edit']['match'][] = "filebrowser/browser.php*";
 
-$priv_list['page-diagnostics-command'] = array();
-$priv_list['page-diagnostics-command']['name'] = gettext("WebCfg - Diagnostics: Command page");
-$priv_list['page-diagnostics-command']['descr'] = gettext("Allow access to the 'Diagnostics: Command' page.");
-$priv_list['page-diagnostics-command']['match'] = array();
-$priv_list['page-diagnostics-command']['match'][] = "exec.php*";
-
 $priv_list['page-firewall-aliases'] = array();
 $priv_list['page-firewall-aliases']['name'] = gettext("WebCfg - Firewall: Aliases page");
 $priv_list['page-firewall-aliases']['descr'] = gettext("Allow access to the 'Firewall: Aliases' page.");

src/opnsense/mvc/app/models/OPNsense/Core/ACL_Legacy_Page_Map.txt

@@ -50,7 +50,6 @@ page-diagnostics-traceroute=diag_traceroute.php*
 page-diagnostics-edit=edit.php*
 page-diagnostics-edit=browser.php*
 page-diagnostics-edit=filebrowser/browser.php*
-page-diagnostics-command=exec.php*
 page-firewall-aliases=firewall_aliases.php*
 page-firewall-alias-edit=firewall_aliases_edit.php*
 page-firewall-alias-import=firewall_aliases_import.php*

src/www/diag_exec.php

-<?php
-/*
-	Copyright (C) 2014 Deciso B.V.
-	All rights reserved.
-
-	Redistribution and use in source and binary forms, with or without
-	modification, are permitted provided that the following conditions are met:
-
-	1. Redistributions of source code must retain the above copyright notice,
-	   this list of conditions and the following disclaimer.
-
-	2. Redistributions in binary form must reproduce the above copyright
-	   notice, this list of conditions and the following disclaimer in the
-	   documentation and/or other materials provided with the distribution.
-
-	THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
-	INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
-	AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
-	AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
-	OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-	SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-	INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-	CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-	POSSIBILITY OF SUCH DAMAGE.
-*/
-?>
-
-<? include("exec.php"); ?>

src/www/fbegin.inc

@@ -263,7 +263,6 @@ $diagnostics_menu[] = array(gettext("ARP Table"), "/diag_arp.php");
 $diagnostics_menu[] = array(gettext("Authentication"), "/diag_authentication.php");
 $diagnostics_menu[] = array(gettext("Backup/Restore"), "/diag_backup.php");
 $diagnostics_menu[] = array(gettext("Crash Reporter"), "/crash_reporter.php");
-//$diagnostics_menu[] = array(gettext("Command Prompt"), "/diag_exec.php"); // Removed file editor for security reasons
 $diagnostics_menu[] = array(gettext("DNS Lookup"), "/diag_dns.php");
 $diagnostics_menu[] = array(gettext("NDP Table"), "/diag_ndp.php" );
 $diagnostics_menu[] = array(gettext("Factory Defaults"), "/diag_defaults.php");