FreeNAS Code

Hardening WebGUI to prevent cross-site request forgery attacks (JPCERT/CC JVN#15267895).

Make sure it is not possible to execute anything if session has been timed out. Because of that 'auth.inc' MUST be included at FIRST in EACH php script.

Get rid of errors described here: http://apps.sourceforge.net/phpbb/freenas/viewtopic.php?f=92&t=2293&sid=439490061028970163884d501adf95f3

Comment: I never had such problems, so i do not know where the problem exactly is. Hopefully these code changes will fix that forever.

Refactor update notification implementation. Use SQLite as database.

- Rename 'Status|Information' to 'Services|Status'.
- Get array reference after processing delete notifications, otherwise already deleted entries are displayed.

Remove useless html <img> width/height parameter.

Display deletion state via red icon.

Introduce UI notification registry to simplify handling of this issues.

Fix WebGUI update bug. WebGUI is not updated correctly if more than one object has been deleted (e.g. mount point/harddisk/RAID).

Modify WebGUI tabs look.