cpanel-csf 16.20 WHM temporary IP form stores “-p” as comment and ignores later arguments

I (my AI overlords) have identified what appears to be an argument-handling defect in the cPanel-maintained CSF package.

**Server information**
* CSF version: `csf: v16.20 (cPanel)`
* RPM package: `cpanel-csf 16.20-1.1.1.cpanel`
* Package installation date: `Sat 06 Jun 2026 09:48:02 AM PDT`
* Operating system: AlmaLinux 9
* cPanel version: 11.136.0.32

**Observed behavior**
When I add a temporary IP block through the CSF interface in WHM, the Temporary IP Entries list shows the comment as:

`-p`

Previously, when the comment field was left blank, CSF generated a comment similar to:

`Manually added: 72.195.39.60 (US/United States/ipmapt-72-195-39-60.oc.oc.cox.net)`

The changed behavior began immediately after the `cpanel-csf 16.20-1.1.1.cpanel` package was installed on June 6, 2026.

**Steps to reproduce**
1. Open WHM.
2. Navigate to Plugins → ConfigServer Security & Firewall.
3. Use the Temporary Allow and Deny IP Entries form.
4. Enter a valid public IP address.
5. Select Block.
6. Enter a duration.
7. Leave the comment blank.
8. Submit the form.
9. Open the Temporary IP Entries list.

**Actual result**
The entry’s comment is shown as:

`-p`

The generated “Manually added” comment is missing.

When a specific port and a custom comment are supplied, those values also appear not to be parsed correctly. The resulting temporary entry may show all ports and the comment `-p`.

**Expected result**
The port option should be honored. The supplied comment should be saved, or, when the comment field is blank, CSF should generate the normal `Manually added: ...` comment.

**Probable cause**
In the current `lib/ConfigServer/DisplayUI.pm`, the temporary deny action calls CSF with separate arguments resembling:

`-td IP TIMEOUT -p PORT COMMENT`

The `dotempdeny()` function in `csf.pl` assigns only the first three arguments:

`my ( $ip, $timeout, $portdir ) = @{ $input{argument} }[ 0 .. 2 ];`

As a result, `$portdir` contains only `-p`. The port and comment are in subsequent array elements and are not included when the function parses `$portdir`.

The same pattern appears in `dotempallow()`, so temporary allow entries may also be affected.

This appears to be a functional regression in the cPanel CSF fork’s conversion to array-based command arguments. Please confirm whether an internal case already exists and whether a corrected cpanel-csf package can be issued.

cPRex Jurassic Moderator

July 30, 2026 18:45

Hey there! I've reached out to the CSF team about this and I'll let you know once I have an update to share.

July 31, 2026 17:22

Our team was able to confirm this behavior and we've created case CPANEL-55408 to have the developers work on this. I've also linked this thread to the case so I'll be sure to post any updates as I hear them.

Thanks for reaching out to us about this!

Dezdan

July 31, 2026 17:54

Thanks for the update!

July 31, 2026 18:04

You're very welcome!

cpanel-csf 16.20 WHM temporary IP form stores “-p” as comment and ignores later arguments

Comments

Didn't find what you were looking for?