Skip to main content

cpanel-csf 16.20 WHM temporary IP form stores “-p” as comment and ignores later arguments

Dezdan

I (my AI overlords) have identified what appears to be an argument-handling defect in the cPanel-maintained CSF package.

**Server information**
* CSF version: `csf: v16.20 (cPanel)`
* RPM package: `cpanel-csf 16.20-1.1.1.cpanel`
* Package installation date: `Sat 06 Jun 2026 09:48:02 AM PDT`
* Operating system: AlmaLinux 9
* cPanel version: 11.136.0.32

**Observed behavior**
When I add a temporary IP block through the CSF interface in WHM, the Temporary IP Entries list shows the comment as:

`-p`

Previously, when the comment field was left blank, CSF generated a comment similar to:

`Manually added: 72.195.39.60 (US/United States/ipmapt-72-195-39-60.oc.oc.cox.net)`

The changed behavior began immediately after the `cpanel-csf 16.20-1.1.1.cpanel` package was installed on June 6, 2026.

**Steps to reproduce**
1. Open WHM.
2. Navigate to Plugins → ConfigServer Security & Firewall.
3. Use the Temporary Allow and Deny IP Entries form.
4. Enter a valid public IP address.
5. Select Block.
6. Enter a duration.
7. Leave the comment blank.
8. Submit the form.
9. Open the Temporary IP Entries list.

**Actual result**
The entry’s comment is shown as:

`-p`

The generated “Manually added” comment is missing.

When a specific port and a custom comment are supplied, those values also appear not to be parsed correctly. The resulting temporary entry may show all ports and the comment `-p`.

**Expected result**
The port option should be honored. The supplied comment should be saved, or, when the comment field is blank, CSF should generate the normal `Manually added: ...` comment.

**Probable cause**
In the current `lib/ConfigServer/DisplayUI.pm`, the temporary deny action calls CSF with separate arguments resembling:

`-td IP TIMEOUT -p PORT COMMENT`

The `dotempdeny()` function in `csf.pl` assigns only the first three arguments:

`my ( $ip, $timeout, $portdir ) = @{ $input{argument} }[ 0 .. 2 ];`

As a result, `$portdir` contains only `-p`. The port and comment are in subsequent array elements and are not included when the function parses `$portdir`.

The same pattern appears in `dotempallow()`, so temporary allow entries may also be affected.

This appears to be a functional regression in the cPanel CSF fork’s conversion to array-based command arguments. Please confirm whether an internal case already exists and whether a corrected cpanel-csf package can be issued.

Comments

8 comments

Date Votes
  • cPRex Jurassic Moderator

    Hey there!  I've reached out to the CSF team about this and I'll let you know once I have an update to share.

    0
  • cPRex Jurassic Moderator

    Our team was able to confirm this behavior and we've created case CPANEL-55408 to have the developers work on this.  I've also linked this thread to the case so I'll be sure to post any updates as I hear them.

    Thanks for reaching out to us about this!

     

    0
  • Dezdan

    Thanks for the update! 

    0
  • cPRex Jurassic Moderator

    You're very welcome!

    0
  • Metro2

    cPRex

    Just ran into this today on csf v16.30 (cPanel), and I think there may be a little more to this bug than what was originally reported here.

    I was trying to temporarily block one IP from mail access while leaving HTTPS/Webmail available.

    First I tried:

    csf -td 203.0.113.86 3600 -p 25,110,143,465,587,993,995 -d in "Temporary mail block"

    CSF accepted it, but created:

    csf: 203.0.113.86 blocked on port * for 3600 seconds inbound

    I assumed maybe the comma-separated port list was the problem, so I removed it and tried the simplest possible test with one port:

    csf -td 203.0.113.86 3600 -p 993 -d in "Temporary mail block"

    Same result:

    csf: 203.0.113.86 blocked on port * for 3600 seconds inbound

    csf -g confirmed that it actually installed an all-port DROP, and csf -t showed:

    DENY  203.0.113.86  *  in

    So this is still present in 16.30, and at least in my testing it is also reproducible directly from the command line with a single -p 993.

    That seems worth noting because the original report here was centered around the WHM temporary-IP form and argument handling. In this case there is no form involved at all - the CLI command itself is accepting the port argument and then silently applying the block to all ports.

    Hopefully that helps with CPANEL-55408.

    0
  • cPRex Jurassic Moderator

    Thanks for sharing!

    0
  • Dezdan

    Looks like it was fixed in the patch released today, thanks! 

    0
  • cPRex Jurassic Moderator

    Yes it made it into the security release!

    1

Please sign in to leave a comment.

Didn't find what you were looking for?

New post