Merge remote branch 'upstream/master'

Conflicts:
	etc/inc/vslb.inc
	etc/version

etc/inc/authgui.inc

@@ -232,8 +232,9 @@ if($config['virtualip']) {
 					$nifty_background = "#999";
 					print_info_box(gettext("You are accessing this router by an IP address not configured locally, which may be forwarded by NAT or other means. <br/><br/>If you did not setup this forwarding, you may be the target of a man-in-the-middle attack.")); 
 				}
+				$noautocomplete = isset($config['system']['webgui']['noautocomplete']) ? 'autocomplete="off"' : '';
 			?>
-			<form id="iform" name="login_iform" method="post" action="<?=$_SERVER['SCRIPT_NAME'];?>">
+			<form id="iform" name="login_iform" method="post" <?= $noautocomplete ?> action="<?=$_SERVER['SCRIPT_NAME'];?>">
 				<h1></h1>
 				<div id="inputerrors"><?=$_SESSION['Login_Error'];?></div>
 				<p>

etc/inc/certs.inc

@@ -479,14 +479,16 @@ function crl_update(& $crl) {
 	if (!$ca)
 		return false;
 	// If we have text but no certs, it was imported and cannot be updated.
-	if (!empty($crl['text']) && empty($crl['cert']))
+	if (($crl["method"] != "internal") && (!empty($crl['text']) && empty($crl['cert'])))
 		return false;
 	$crl['serial']++;
 	$ca_str_crt = base64_decode($ca['crt']);
 	$ca_str_key = base64_decode($ca['prv']);
 	$crl_res = openssl_crl_new($ca_str_crt, $crl['serial'], $crl['lifetime']);
-	foreach ($crl['cert'] as $cert) {
-		openssl_crl_revoke_cert($crl_res, base64_decode($cert["crt"]), $cert["revoke_time"], $cert["reason"]);
+	if (is_array($crl['cert']) && (count($crl['cert']) > 0)) {
+		foreach ($crl['cert'] as $cert) {
+			openssl_crl_revoke_cert($crl_res, base64_decode($cert["crt"]), $cert["revoke_time"], $cert["reason"]);
+		}
 	}
 	openssl_crl_export($crl_res, $crl_text, $ca_str_key);
 	$crl['text'] = base64_encode($crl_text);
@@ -514,7 +516,13 @@ function cert_unrevoke($cert, & $crl) {
 	foreach ($crl['cert'] as $id => $rcert) {
 		if (($rcert['refid'] == $cert['refid']) || ($rcert['descr'] == $cert['descr'])) {
 			unset($crl['cert'][$id]);
-			crl_update($crl);
+			if (count($crl['cert']) == 0) {
+				// Protect against accidentally switching the type to imported, for older CRLs
+				if (!isset($crl['method']))
+					$crl['method'] = "internal";
+				crl_update($crl);
+			} else
+				crl_update($crl);
 			return true;
 		}
 	}
@@ -564,7 +572,7 @@ function crl_in_use($crlref) {
 }
 
 function is_crl_internal($crl) {
-	return !(!empty($crl['text']) && empty($crl['cert']));
+	return (!(!empty($crl['text']) && empty($crl['cert'])) || ($crl["method"] == "internal"));
 }
 
 ?>

etc/inc/filter.inc

@@ -1568,14 +1568,6 @@ function filter_nat_rules_generate() {
 		}
 	}
 	fclose($inetd_fd);		// Close file handle
-	// Check if inetd is running, if not start it.	If so, restart it gracefully.
-	$helpers = isvalidproc("inetd");
-	if(file_exists("/var/etc/inetd.conf")) {
-		if(!$helpers)
-			mwexec("/usr/sbin/inetd -wW -R 0 -a 127.0.0.1 /var/etc/inetd.conf");
-		else
-			sigkillbypid("/var/run/inetd.pid", "HUP");
-	}
 
 	if (isset($config['pptpd']['mode']) && ($config['pptpd']['mode'] != "off")) {
 		if ($config['pptpd']['mode'] == "redir") {
@@ -1595,6 +1587,15 @@ function filter_nat_rules_generate() {
 	if(!empty($reflection_txt))
 		$natrules .= "\n# Reflection redirects and NAT for 1:1 mappings\n" . $reflection_txt;
 
+	// Check if inetd is running, if not start it.	If so, restart it gracefully.
+	$helpers = isvalidproc("inetd");
+	if(file_exists("/var/etc/inetd.conf")) {
+		if(!$helpers)
+			mwexec("/usr/sbin/inetd -wW -R 0 -a 127.0.0.1 /var/etc/inetd.conf");
+		else
+			sigkillbypid("/var/run/inetd.pid", "HUP");
+	}
+
 	return $natrules;
 }
 
@@ -2945,32 +2946,32 @@ function filter_generate_ipsec_rules() {
 				}
 
 				/* Add rules to allow IKE to pass */
-				$shorttunneldescr = substr($descr, 0, 36);
+				$shorttunneldescr = substr($descr, 0, 35);
 				$ipfrules .= <<<EOD
-pass out on \${$FilterIflist[$parentinterface]['descr']} $route_to proto udp from any to {$rgip} port = 500 keep state label \"IPsec: {$shorttunneldescr} - outbound isakmp\"
-pass in on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto udp from {$rgip} to any port = 500 keep state label \"IPsec: {$shorttunneldescr} - inbound isakmp\"
+pass out on \${$FilterIflist[$parentinterface]['descr']} $route_to proto udp from any to {$rgip} port = 500 keep state label "IPsec: {$shorttunneldescr} - outbound isakmp"
+pass in on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto udp from {$rgip} to any port = 500 keep state label "IPsec: {$shorttunneldescr} - inbound isakmp"
 
 EOD;
 				/* If NAT-T is enabled, add additional rules */
 				if($ph1ent['nat_traversal'] != "off" ) {
 					$ipfrules .= <<<EOD
-pass out on \${$FilterIflist[$parentinterface]['descr']} $route_to proto udp from any to {$rgip} port = 4500 keep state label \"IPsec: {$shorttunneldescr} - outbound nat-t\"
-pass in on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto udp from {$rgip} to any port = 4500 keep state label \"IPsec: {$shorttunneldescr} - inbound nat-t\"
+pass out on \${$FilterIflist[$parentinterface]['descr']} $route_to proto udp from any to {$rgip} port = 4500 keep state label "IPsec: {$shorttunneldescr} - outbound nat-t"
+pass in on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto udp from {$rgip} to any port = 4500 keep state label "IPsec: {$shorttunneldescr} - inbound nat-t"
 
 EOD;
 				}
 				/* Add rules to allow the protocols in use */
 				if($prot_used_esp == true) {
 					$ipfrules .= <<<EOD
-pass out on \${$FilterIflist[$parentinterface]['descr']} $route_to proto esp from any to {$rgip} keep state label \"IPsec: {$shorttunneldescr} - outbound esp proto\"
-pass in on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto esp from {$rgip} to any keep state label \"IPsec: {$shorttunneldescr} - inbound esp proto\"
+pass out on \${$FilterIflist[$parentinterface]['descr']} $route_to proto esp from any to {$rgip} keep state label "IPsec: {$shorttunneldescr} - outbound esp proto"
+pass in on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto esp from {$rgip} to any keep state label "IPsec: {$shorttunneldescr} - inbound esp proto"
 
 EOD;
 				}
 				if($prot_used_ah == true) {
 					$ipfrules .= <<<EOD
-pass out on \${$FilterIflist[$parentinterface]['descr']} $route_to proto ah from any to {$rgip} keep state label \"IPsec: {$shorttunneldescr} - outbound ah proto\"
-pass in on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto ah from {$rgip} to any keep state label \"IPsec: {$shorttunneldescr} - inbound ah proto\"
+pass out on \${$FilterIflist[$parentinterface]['descr']} $route_to proto ah from any to {$rgip} keep state label "IPsec: {$shorttunneldescr} - outbound ah proto"
+pass in on \${$FilterIflist[$parentinterface]['descr']} $reply_to proto ah from {$rgip} to any keep state label "IPsec: {$shorttunneldescr} - inbound ah proto"
 
 EOD;
 				}

etc/inc/interfaces.inc

@@ -417,6 +417,8 @@ function interface_bridge_configure(&$bridge) {
 		$realif = get_real_interface($member);
 		$opts = pfSense_get_interface_addresses($realif);
 		$mtu = $opts['mtu'];
+		if (substr($realif, 0, 3) == "gif" && $mtu < 1500)
+			continue;
 		if (!isset($opts['encaps']['txcsum']))
 			$commontx = false;
 		if (!isset($opts['encaps']['rxcsum']))
@@ -2627,6 +2629,11 @@ function interface_configure($interface = "wan", $reloadall = false, $linkupeven
 	}
 	if (!empty($wancfg['mtu']))
 		pfSense_interface_mtu($realhwif, $wancfg['mtu']);
+	else {
+		$mtu = get_interface_default_mtu(remove_numbers($realhwif));
+		if ($mtu != get_interface_mtu($realhwif))
+			pfSense_interface_mtu($realhwif, $mtu);
+	}
 
 	$options = pfSense_get_interface_addresses($realhwif);
 	if (is_array($options) && isset($options['caps']['polling'])) {
@@ -3962,6 +3969,27 @@ EOD;
 		unlink_if_exists($cron_file);
 }
 
+function get_interface_default_mtu($type = "ethernet") {
+	switch ($type) {
+	case "gre":
+		return 1476;
+		break;
+	case "gif":
+		return 1280;
+		break;
+	case "tun":
+	case "vlan":
+	case "tap":
+	case "ethernet":
+	default:
+		return 1500;
+		break;
+	}
+
+	/* Never reached */
+	return 1500;
+}
+
 function get_vip_descr($ipaddress) {
 	global $config;
 

etc/inc/openvpn.inc

@@ -974,6 +974,7 @@ function openvpn_refresh_crls() {
 				case 'server_user':
 					if (!empty($settings['crlref'])) {
 						$crl = lookup_crl($settings['crlref']);
+						crl_update($crl);
 						$fpath = $g['varetc_path']."/openvpn/server{$settings['vpnid']}.crl-verify";
 						file_put_contents($fpath, base64_decode($crl['text']));
 						@chmod($fpath, 0644);

etc/inc/vpn.inc

@@ -502,9 +502,9 @@ function vpn_ipsec_configure($ipchg = false)
 					$passive = "";
 					if (isset($ph1ent['mobile'])) {
 						$rgip = "anonymous";
+						$passive = "passive on;";
 						/* Mimic 1.2.3's behavior for pure-psk mobile tunnels */
 						if ($ph1ent['authentication_method'] == "pre_shared_key") {
-							$passive = "passive on;";
 							$pcheck = !empty($ph1ent['proposal_check']) ? $ph1ent['proposal_check'] : $pcheck = "obey";
 							$genp = "on";
 						} else {
@@ -892,7 +892,7 @@ EOD;
 							if(is_ipaddr($gatewayip)) {
 								/* FIXME: does adding route-to and reply-to on the in/outbound
 								 * rules fix this? smos@ 13-01-2009 */
-								log_error("IPSEC interface is not WAN but {$parentinterface}, adding static route for VPN endpoint {$rgip} via {$gatewayip}");
+								// log_error("IPSEC interface is not WAN but {$parentinterface}, adding static route for VPN endpoint {$rgip} via {$gatewayip}");
 								mwexec("/sbin/route delete -host {$rgip}");
 								mwexec("/sbin/route add -host {$rgip} {$gatewayip}");
 							}

etc/inc/vslb.inc

@@ -202,6 +202,7 @@ function relayd_configure() {
   /* reindex pools by name as we loop through the pools array */
   $pools = array();
   $conf .= "log updates \n";
+  $conf .= "timeout 1000 \n";
   /* Virtual server pools */
   if(is_array($pool_a)) {
     for ($i = 0; isset($pool_a[$i]); $i++) {
@@ -233,62 +234,61 @@ function relayd_configure() {
       $conf .= $proto;
     }
   }
-  if(is_array($vs_a)) {
-    for ($i = 0; isset($vs_a[$i]); $i++) {
-      switch($vs_a[$i]['mode']) {
-        case 'redirect_mode': {
-          $conf .= "redirect \"{$vs_a[$i]['name']}\" {\n";
-          $conf .= "  listen on {$vs_a[$i]['ipaddr']} port {$vs_a[$i]['port']}\n";
-          $conf .= "  forward to <{$vs_a[$i]['pool']}> port {$pools[$vs_a[$i]['pool']]['port']} {$check_a[$pools[$vs_a[$i]['pool']]['monitor']]} timeout 1000\n";
+	if(is_array($vs_a)) {
+		for ($i = 0; isset($vs_a[$i]); $i++) {
+			switch($vs_a[$i]['mode']) {
+				case 'redirect_mode': {
+					$conf .= "redirect \"{$vs_a[$i]['name']}\" {\n";
+					$conf .= "  listen on {$vs_a[$i]['ipaddr']} port {$vs_a[$i]['port']}\n";
+					$conf .= "  forward to <{$vs_a[$i]['pool']}> port {$pools[$vs_a[$i]['pool']]['port']} {$check_a[$pools[$vs_a[$i]['pool']]['monitor']]} \n";
 
-	  if (isset($conf['system']['lb_use_sticky']))
-		$conf .= "  sticky-address\n";
+					if (isset($config['system']['lb_use_sticky']))
+						$conf .= "  sticky-address\n";
 
-          # sitedown MUST use the same port as the primary pool - sucks, but it's a relayd thing
-          if (isset($vs_a[$i]['sitedown']) && strlen($vs_a[$i]['sitedown']) > 0)
-            $conf .= "  forward to <{$vs_a[$i]['sitedown']}> port {$pools[$vs_a[$i]['pool']]['port']} {$check_a[$pools[$vs_a[$i]['pool']]['monitor']]} timeout 1000\n";
+					# sitedown MUST use the same port as the primary pool - sucks, but it's a relayd thing
+					if (isset($vs_a[$i]['sitedown']) && strlen($vs_a[$i]['sitedown']) > 0)
+						$conf .= "  forward to <{$vs_a[$i]['sitedown']}> port {$pools[$vs_a[$i]['pool']]['port']} {$check_a[$pools[$vs_a[$i]['pool']]['monitor']]} \n";
 
-          $conf .= "}\n";
-          break;
-        }
-        case 'relay': {
-          $conf .= "relay \"{$vs_a[$i]['name']}\" {\n";
-          $conf .= "  listen on {$vs_a[$i]['ipaddr']} port {$vs_a[$i]['port']}\n";
-          $conf .= "  protocol \"{$vs_a[$i]['relay_protocol']}\"\n";
-          $conf .= "  forward to <{$vs_a[$i]['pool']}> port {$pools[$vs_a[$i]['pool']]['port']} {$check_a[$pools[$vs_a[$i]['pool']]['monitor']]} timeout 1000\n";
+					$conf .= "}\n";
+					break;
+				}
+				case 'relay': {
+					$conf .= "relay \"{$vs_a[$i]['name']}\" {\n";
+					$conf .= "  listen on {$vs_a[$i]['ipaddr']} port {$vs_a[$i]['port']}\n";
+					$conf .= "  protocol \"{$vs_a[$i]['relay_protocol']}\"\n";
+					$conf .= "  forward to <{$vs_a[$i]['pool']}> port {$pools[$vs_a[$i]['pool']]['port']} {$check_a[$pools[$vs_a[$i]['pool']]['monitor']]} \n";
 
-          if (isset($vs_a[$i]['sitedown']) &&  strlen($vs_a[$i]['sitedown']) > 0)
-            $conf .= "  forward to <{$vs_a[$i]['sitedown']}> port {$pools[$vs_a[$i]['pool']]['port']} {$check_a[$pools[$vs_a[$i]['pool']]['monitor']]} timeout 1000\n";
-          $conf .= "}\n";
-          break;
-        }
-      }
-    }
-  }
-  fwrite($fd, $conf);
-  fclose($fd);
-
-  if (is_process_running('relayd')) {
-	if (! empty($vs_a)) {
-		// it's running and there is a config, just reload
-		mwexec("/usr/local/sbin/relayctl reload");
-	} else {
-		/*
-		* XXX: Something breaks our control connection with relayd
-		* and makes 'relayctl stop' not work
-		* rule reloads are the current suspect
-		* mwexec('/usr/local/sbin/relayctl stop');
-		*  returns "command failed"
-		*/
-		mwexec('pkill relayd');
+					if (isset($vs_a[$i]['sitedown']) &&  strlen($vs_a[$i]['sitedown']) > 0)
+						$conf .= "  forward to <{$vs_a[$i]['sitedown']}> port {$pools[$vs_a[$i]['pool']]['port']} {$check_a[$pools[$vs_a[$i]['pool']]['monitor']]} \n";
+					$conf .= "}\n";
+					break;
+				}
+			}
+		}
 	}
-  } else {
-	if (count($vs_a) > 0) {
-		// not running and there is a config, start it
-		mwexec("/usr/local/sbin/relayd -f {$g['varetc_path']}/relayd.conf");
-	}	
-  }
+	fwrite($fd, $conf);
+	fclose($fd);
 
+	if (is_process_running('relayd')) {
+		if (! empty($vs_a)) {
+			// it's running and there is a config, just reload
+			mwexec("/usr/local/sbin/relayctl reload");
+		} else {
+			/*
+			 * XXX: Something breaks our control connection with relayd
+			 * and makes 'relayctl stop' not work
+			 * rule reloads are the current suspect
+			 * mwexec('/usr/local/sbin/relayctl stop');
+			 *  returns "command failed"
+			 */
+			mwexec('pkill relayd');
+		}
+	} else {
+		if (! empty($vs_a)) {
+			// not running and there is a config, start it
+			mwexec("/usr/local/sbin/relayd -f {$g['varetc_path']}/relayd.conf");
+		}
+	}
 }
 
 function get_lb_redirects() {

etc/version

@@ -1 +1 @@
-2.0-RC1-IPv6
+2.0-RC2-IPv6

sbin/dhclient-script

@@ -242,8 +242,8 @@ add_new_resolv_conf() {
 			# also backup the nameserver for later route removal
 			if [ $ALLOWOVERRIDE -gt 0 ]; then
 				echo $nameserver >>/var/etc/nameserver_$interface
+				$ROUTE add $nameserver -iface $interface
 			fi
-			$ROUTE add $nameserver -iface $interface
 		done
 		echo $new_domain_name >/var/etc/searchdomain_$interface
 	fi

usr/local/captiveportal/radius_accounting.inc

@@ -294,7 +294,7 @@ function gigawords($bytes) {
      */
 
     // We use BCMath functions since normal integers don't work with so large numbers
-    $gigawords = bcdiv( bcsub( $bytes, remainder($bytes) ) , 4294967295) ;
+    $gigawords = bcdiv( bcsub( $bytes, remainder($bytes) ) , PHP_INT_MAX) ;
 
     // We need to manually set this to a zero instead of NULL for put_int() safety
     if (is_null($gigawords)) {
@@ -308,7 +308,7 @@ function gigawords($bytes) {
 function remainder($bytes) {
 
     // Calculate the bytes we are going to send to the radius
-    $bytes = bcmod($bytes, 4294967295);
+    $bytes = bcmod($bytes, PHP_INT_MAX);
 
     if (is_null($bytes)) {
         $bytes = 0;

usr/local/sbin/ppp-linkup

@@ -1,5 +1,10 @@
 #!/bin/sh
 
+# let the configuration system know that the ip has changed.
+/bin/echo $4 > /tmp/$1_router
+/bin/echo $3 > /tmp/$1_ip
+/usr/bin/touch /tmp/$1up
+
 ALLOWOVERRIDE=`/usr/bin/grep dnsallowoverride /conf/config.xml | /usr/bin/wc -l`
 if [ $ALLOWOVERRIDE -gt 0 ]; then
 	# write nameservers to file
@@ -14,13 +19,9 @@ if [ $ALLOWOVERRIDE -gt 0 ]; then
 		/sbin/route delete $9
 		/sbin/route add $9 $4
 	fi
+	/usr/local/sbin/pfSctl -c 'service reload dns'
+	/bin/sleep 1
 fi
 
-# let the configuration system know that the ip has changed.
-/bin/echo $4 > /tmp/$1_router
-/bin/echo $3 > /tmp/$1_ip
-/usr/bin/touch /tmp/$1up
-/usr/local/sbin/pfSctl -c 'service reload dns'
-/bin/sleep 1
 /usr/local/sbin/pfSctl -c "interface newip $1"
 exit 0

usr/local/www/interfaces.php

@@ -597,11 +597,11 @@ if ($_POST['apply']) {
 		}
 	}
 	if (!$input_errors) {
-		if ($wancfg['type'] != $_POST['type']) {
+		if ($wancfg['ipaddr'] != $_POST['type']) {
 			if (in_array($wancfg['ipaddr'], array("ppp", "pppoe", "pptp", "l2tp"))) {
 				$wancfg['if'] = $a_ppps[$pppid]['ports'];
 				unset($a_ppps[$pppid]);
-			} else if ($wancfg['type'] == "dhcp") {
+			} else if ($wancfg['ipaddr'] == "dhcp") {
 				$pid = find_dhclient_process($realif);
 				if($pid)
 					posix_kill($pid, SIGTERM);

usr/local/www/status_dhcp_leases.php

@@ -208,6 +208,10 @@ while($i < $leases_count) {
 				/* skip the next binding statement */
 				$f = $f+3;
 				break;
+			case "rewind":
+				/* skip the rewind binding statement */
+				$f = $f+3;
+				break;
 			case "hardware":
 				$leases[$l]['mac'] = $data[$f+2];
 				/* check if it's online and the lease is active */

usr/local/www/status_filter_reload.php

@@ -70,7 +70,7 @@ include("head.inc");
 <br/>
 <form action="status_filter_reload.php" method="POST" name="filter">
 <input type="submit" value="Reload Filter" name="reloadfilter" id="reloadfilter">
-<?php if (is_array($config["installedpackages"]["carpsettings"]["config"][0]) && $config["installedpackages"]["carpsettings"]["config"][0]["pfsyncpeerip"] != ""): ?>
+<?php if (is_array($config["installedpackages"]["carpsettings"]["config"][0]) && $config["installedpackages"]["carpsettings"]["config"][0]["synchronizetoip"] != ""): ?>
 &nbsp;&nbsp;&nbsp;&nbsp;
 <input type="submit" value="Force Config Sync" name="syncfilter" id="syncfilter">
 <? endif; ?>

usr/local/www/system_advanced_admin.php

@@ -57,6 +57,7 @@ $pconfig['disableconsolemenu'] = isset($config['system']['disableconsolemenu']);
 $pconfig['noantilockout'] = isset($config['system']['webgui']['noantilockout']);
 $pconfig['nodnsrebindcheck'] = isset($config['system']['webgui']['nodnsrebindcheck']);
 $pconfig['nohttpreferercheck'] = isset($config['system']['webgui']['nohttpreferercheck']);
+$pconfig['noautocomplete'] = isset($config['system']['webgui']['noautocomplete']);
 $pconfig['althostnames'] = $config['system']['webgui']['althostnames'];
 $pconfig['enableserial'] = $config['system']['enableserial'];
 $pconfig['enablesshd'] = $config['system']['enablesshd'];
@@ -152,6 +153,11 @@ if ($_POST) {
 		else
 			unset($config['system']['webgui']['nohttpreferercheck']);
 
+		if ($_POST['noautocomplete'] == "yes")
+			$config['system']['webgui']['noautocomplete'] = true;
+		else
+			unset($config['system']['webgui']['noautocomplete']);
+
 		if ($_POST['althostnames'])
 			$config['system']['webgui']['althostnames'] = $_POST['althostnames'];
 		else
@@ -322,11 +328,23 @@ function prot_change() {
 									<strong><?=gettext("Disable webConfigurator redirect rule"); ?></strong>
 									<br/>
 									<?php echo gettext("When this is unchecked, access to the webConfigurator " .
-									"is always permitted even on port 80, regardless of the listening port configured." .
+									"is always permitted even on port 80, regardless of the listening port configured. " .
 									"Check this box to disable this automatically added redirect rule. ");
 									?>
 								</td>
 							</tr>
+							<tr>
+								<td width="22%" valign="top" class="vncell"><?=gettext("WebGUI Login Autocomplete"); ?></td>
+								<td width="78%" class="vtable">
+									<input name="noautocomplete" type="checkbox" id="noautocomplete" value="yes" <?php if ($pconfig['noautocomplete']) echo "checked"; ?> />
+									<strong><?=gettext("Disable webConfigurator login autocomplete"); ?></strong>
+									<br/>
+									<?php echo gettext("When this is unchecked, login credentials for the webConfigurator " .
+									"may be saved by the browser. While convenient, some security standards require this to be disabled. " .
+									"Check this box to disable autocomplete on the login form so that browsers will not prompt to save credentials (NOTE: Some browsers do not respect this option). ");
+									?>
+								</td>
+							</tr>
 							<tr>
 								<td width="22%" valign="top" class="vncell"><?=gettext("WebGUI login messages"); ?></td>
 								<td width="78%" class="vtable">

usr/local/www/system_camanager.php

@@ -62,6 +62,11 @@ if (!is_array($config['cert']))
 
 $a_cert =& $config['cert'];
 
+if (!is_array($config['crl']))
+	$config['crl'] = array();
+
+$a_crl =& $config['crl'];
+
 $act = $_GET['act'];
 if ($_POST['act'])
 	$act = $_POST['act'];
@@ -78,10 +83,15 @@ if ($act == "del") {
 		if ($a_cert[$index]['caref'] == $a_ca[$id]['refid'])
 			unset($a_cert[$index]);
 
+	$index = count($a_crl) - 1;
+	for (;$index >=0; $index--)
+		if ($a_crl[$index]['caref'] == $a_ca[$id]['refid'])
+			unset($a_crl[$index]);
+
 	$name = $a_ca[$id]['descr'];
 	unset($a_ca[$id]);
 	write_config();
-	$savemsg = sprintf(gettext("Certificate Authority %s successfully deleted"), $name) . "<br/>";
+	$savemsg = sprintf(gettext("Certificate Authority %s and its CRLs (if any) successfully deleted"), $name) . "<br/>";
 }
 
 if ($act == "edit") {
@@ -533,7 +543,7 @@ function method_change() {
 								<img src="/themes/<?= $g['theme'];?>/images/icons/icon_down.gif" title="<?=gettext("export ca private key");?>" alt="<?=gettext("export ca private key");?>" width="17" height="17" border="0" />
 							</a>
 							<?php endif; ?>
-							<a href="system_camanager.php?act=del&id=<?=$i;?>" onclick="return confirm('<?=gettext("Do you really want to delete this Certificate Authority and all associated certificates?");?>')">
+							<a href="system_camanager.php?act=del&id=<?=$i;?>" onclick="return confirm('<?=gettext("Do you really want to delete this Certificate Authority and its CRLs, and unreference any associated certificates?");?>')">
 								<img src="/themes/<?= $g['theme'];?>/images/icons/icon_x.gif" title="<?=gettext("delete ca");?>" alt="<?=gettext("delete ca"); ?>" width="17" height="17" border="0" />
 							</a>
 						</td>

usr/local/www/system_crlmanager.php

@@ -223,6 +223,7 @@ if ($_POST) {
 
 		$crl['descr'] = $pconfig['descr'];
 		$crl['caref'] = $pconfig['caref'];
+		$crl['method'] = $pconfig['method'];
 
 		if ($pconfig['method'] == "existing") {
 			$crl['text'] = base64_encode($pconfig['crltext']);