Source code taken from cacert-20110728.tar.bz2

10 files changed, 256 insertions, 166 deletions

diff --git a/includes/account_stuff.php b/includes/account_stuff.php
index 7c8980c..b6fdd7a 100644
--- a/includes/account_stuff.php
+++ b/includes/account_stuff.php
@@ -278,7 +278,7 @@ function hideall() {
       </div>
     </div>
   <div id="siteInfo"><a href="account.php?id=37"><?=_("About Us")?></a> | <a href="account.php?id=38"><?=_("Donations")?></a> | <a href="http://wiki.cacert.org/wiki/CAcertIncorporated"><?=_("Association Membership")?></a> |
-	<a href="account.php?id=39"><?=_("Privacy Policy")?></a> | <a href="account.php?id=40"><?=_("Contact Us")?></a>
+	<a href="/policy/PrivacyPolicy.html"><?=_("Privacy Policy")?></a> | <a href="account.php?id=40"><?=_("Contact Us")?></a>
 		| &copy;2002-<?=date("Y")?> <?=_("by CAcert")?></div>
 </div>  
 </body>             
diff --git a/includes/general_stuff.php b/includes/general_stuff.php
index 6747c84..088c39e 100644
--- a/includes/general_stuff.php
+++ b/includes/general_stuff.php
@@ -132,7 +132,7 @@ if(!function_exists("showfooter"))
   <? include("sponsorinfo.php") ?>
   <div id="siteInfo">
 	<a href="/index.php?id=12"><?=_("About Us")?></a> | <a href="/index.php?id=13"><?=_("Donations")?></a> | <a href="http://wiki.cacert.org/wiki/CAcertIncorporated"><?=_("Association Membership")?></a> |
-        <a href="/index.php?id=10"><?=_("Privacy Policy")?></a> |
+        <a href="/policy/PrivacyPolicy.html"><?=_("Privacy Policy")?></a> |
         <a href="/index.php?id=51"><?=_("Mission Statement")?></a> | <a href="/index.php?id=11"><?=_("Contact Us")?></a> |
 	&copy;2002-<?=date("Y")?> <?=_("by CAcert")?></div>
 </div>  
diff --git a/pages/account/39.php b/pages/account/39.php
index f89187d..9e09bb8 100755
--- a/pages/account/39.php
+++ b/pages/account/39.php
@@ -15,76 +15,10 @@
     along with this program; if not, write to the Free Software
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 */ ?>
-<h3><?=_("Privacy Policy")?></h3>
-
-<p>
-<?=_("This policy discloses what information we gather about you when you visit any of our Web site, and when you issue or use our certificates. It describes how we use that information and how you can control it.")?>
-</p>
-
-<h4>1. <?=_("Website information")?></h4>
-<p>
-<?=_("We collect two kinds of information about website users: 1) data that users volunteer by signing up to our website or when you send us an email via our contact form; and 2) aggregated tracking data we collect when users interact with our site.")?>
-</p>
-
-<h4>2. <?=_("Personal information")?></h4>
-<p>
-<?=_("When you post to the contact form, you must provide your name and email address. When you sign up to the website, you must provide your name, email address, date of birth and some lost pass phrase question and answers.")?>
-</p>
-<p>
-<?=_("We only share your information with any other organisation when so instructed by a CAcert arbitrator.")?>
-</p>
-
-<h4>3. <?=_("Aggregated tracking information")?></h4>
-<p>
-<?=_("We analyse visitors' use of our sites by tracking information such as page views, traffic flow, search terms, and click through. We use this information to improve our sites. We also share this anonymous traffic and demographic information in aggregate form with advertisers and other business partners. We do not share any information with advertisers that can identify an individual user.")?>
-</p>
-
-<h4>4. <?=_("Cookies")?></h4>
-<p>
-<?=_("Some of our advertisers use a third-party ad server to display ads. These ads may contain cookies. The ad server receives these cookies, and we don't have access to them.")?>
-</p>
-<p>
-<?=_("We don't use cookies to store personal information, we do use sessions, and if cookies are enabled, the session will be stored in a cookie, and we do not look for cookies, apart from the session id. However if cookies are disabled then no information will be stored on or looked for on your computer.")?>
-</p>
-
-<h4>5. <?=_("Notification of changes")?></h4>
-<p>
-<?=_("If we change our Privacy Policy, we will post those changes on www.CAcert.org. If we decide to use personally identifiable information in a manner different from that stated at the time it was collected, we will notify users via email. Users will be able to opt out of any new use of their personal information.")?>
-</p>
-
-<h4>6. <?=_("How to update, correct, or delete your information")?></h4>
-<p>
-<?=_("You are able to update, add and remove your information at any time via our web interface, log into the 'My Account' and then click on the 'My Details' section, and then click the relevant link")?>
-</p>
-
-<h4>7. <?=_("Privacy of certificates")?></h4>
-<p>
-<?=_("CAcert does not automatically publish the certificates through a directory service or the website to other people than the user who requested the certificate. In the future, the user might be able to opt-in for publication of the certificates through a directory server by CAcert.")?>
-</p>
-
-<h4>8. <?=_("Privacy of user data")?></h4>
-<p>
-<?=_("CAcert Assurers can see the name, birthday and the number of points by looking up the correct email address. No other person related data is published by CAcert.")?>
-</p>
-
-<h4>9. <?=_("Exceptions")?></h4>
-<p>
-<?=_("A CAcert arbitrator may override this policy in a dispute.")?>
-<?=_("To obtain access to confidential data, a dispute has to be filed.")?>
-</p>
-
-<h4>10. <?=_("Legal mandates")?></h4>
-<p>
-<?=_("CAcert adopts the Australian privacy regulations.")?>
-<?=_("Please see <a href='http://www.privacy.gov.au/'>http://www.privacy.gov.au/</a> for further details.")?>
-<?=_("Governmental warrants and civil supoenas will be processed through the dispute resolution system, which ensures that valid authority is given to whoever complies with the supoena or the warrant.")?>
-</p>
-
-
-<p><?=_("If you need to contact us in writing, address your mail to:")?></p>
-<p>
-CAcert Inc.<br>
-P.O. Box 4107<br>
-Denistone East NSW 2112<br>
-Australia
+<p style="background-color: #FF8080; font-size: 150%">
+<?
+printf(_('This page has been moved to the %spolicy directory%s. Please update '.
+		'your bookmarks and report any broken links.'),
+	'<a href="/policy/PrivacyPolicy.html">', '</a>');
+?>
 </p>
diff --git a/pages/index/10.php b/pages/index/10.php
index f89187d..9e09bb8 100644
--- a/pages/index/10.php
+++ b/pages/index/10.php
@@ -15,76 +15,10 @@
     along with this program; if not, write to the Free Software
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 */ ?>
-<h3><?=_("Privacy Policy")?></h3>
-
-<p>
-<?=_("This policy discloses what information we gather about you when you visit any of our Web site, and when you issue or use our certificates. It describes how we use that information and how you can control it.")?>
-</p>
-
-<h4>1. <?=_("Website information")?></h4>
-<p>
-<?=_("We collect two kinds of information about website users: 1) data that users volunteer by signing up to our website or when you send us an email via our contact form; and 2) aggregated tracking data we collect when users interact with our site.")?>
-</p>
-
-<h4>2. <?=_("Personal information")?></h4>
-<p>
-<?=_("When you post to the contact form, you must provide your name and email address. When you sign up to the website, you must provide your name, email address, date of birth and some lost pass phrase question and answers.")?>
-</p>
-<p>
-<?=_("We only share your information with any other organisation when so instructed by a CAcert arbitrator.")?>
-</p>
-
-<h4>3. <?=_("Aggregated tracking information")?></h4>
-<p>
-<?=_("We analyse visitors' use of our sites by tracking information such as page views, traffic flow, search terms, and click through. We use this information to improve our sites. We also share this anonymous traffic and demographic information in aggregate form with advertisers and other business partners. We do not share any information with advertisers that can identify an individual user.")?>
-</p>
-
-<h4>4. <?=_("Cookies")?></h4>
-<p>
-<?=_("Some of our advertisers use a third-party ad server to display ads. These ads may contain cookies. The ad server receives these cookies, and we don't have access to them.")?>
-</p>
-<p>
-<?=_("We don't use cookies to store personal information, we do use sessions, and if cookies are enabled, the session will be stored in a cookie, and we do not look for cookies, apart from the session id. However if cookies are disabled then no information will be stored on or looked for on your computer.")?>
-</p>
-
-<h4>5. <?=_("Notification of changes")?></h4>
-<p>
-<?=_("If we change our Privacy Policy, we will post those changes on www.CAcert.org. If we decide to use personally identifiable information in a manner different from that stated at the time it was collected, we will notify users via email. Users will be able to opt out of any new use of their personal information.")?>
-</p>
-
-<h4>6. <?=_("How to update, correct, or delete your information")?></h4>
-<p>
-<?=_("You are able to update, add and remove your information at any time via our web interface, log into the 'My Account' and then click on the 'My Details' section, and then click the relevant link")?>
-</p>
-
-<h4>7. <?=_("Privacy of certificates")?></h4>
-<p>
-<?=_("CAcert does not automatically publish the certificates through a directory service or the website to other people than the user who requested the certificate. In the future, the user might be able to opt-in for publication of the certificates through a directory server by CAcert.")?>
-</p>
-
-<h4>8. <?=_("Privacy of user data")?></h4>
-<p>
-<?=_("CAcert Assurers can see the name, birthday and the number of points by looking up the correct email address. No other person related data is published by CAcert.")?>
-</p>
-
-<h4>9. <?=_("Exceptions")?></h4>
-<p>
-<?=_("A CAcert arbitrator may override this policy in a dispute.")?>
-<?=_("To obtain access to confidential data, a dispute has to be filed.")?>
-</p>
-
-<h4>10. <?=_("Legal mandates")?></h4>
-<p>
-<?=_("CAcert adopts the Australian privacy regulations.")?>
-<?=_("Please see <a href='http://www.privacy.gov.au/'>http://www.privacy.gov.au/</a> for further details.")?>
-<?=_("Governmental warrants and civil supoenas will be processed through the dispute resolution system, which ensures that valid authority is given to whoever complies with the supoena or the warrant.")?>
-</p>
-
-
-<p><?=_("If you need to contact us in writing, address your mail to:")?></p>
-<p>
-CAcert Inc.<br>
-P.O. Box 4107<br>
-Denistone East NSW 2112<br>
-Australia
+<p style="background-color: #FF8080; font-size: 150%">
+<?
+printf(_('This page has been moved to the %spolicy directory%s. Please update '.
+		'your bookmarks and report any broken links.'),
+	'<a href="/policy/PrivacyPolicy.html">', '</a>');
+?>
 </p>
diff --git a/scripts/DumpWeakCerts.pl b/scripts/DumpWeakCerts.pl
index 85648fe..580390e 100644
--- a/scripts/DumpWeakCerts.pl
+++ b/scripts/DumpWeakCerts.pl
@@ -1,6 +1,7 @@
 #!/usr/bin/perl
 # Script to dump weak RSA certs (Exponent 3 or Modulus size < 1024) according to https://bugs.cacert.org/view.php?id=918
 # and https://wiki.cacert.org/Arbitrations/a20110312.1
+# Extended to be used for https://bugs.cacert.org/view.php?id=954
 
 use strict;
 use warnings;
@@ -26,12 +27,15 @@ my $cert_CN;
 my $cert_expire;
 my $cert_filename;
 my $cert_serial;
+my $cert_recid;
 
 my $user_email;
 my $user_firstname;
 
 my $reason;
 
+my $grace_time_days = 0; # 14 used for bug#918
+
 my @row;
 
 sub IsWeak($) {
@@ -40,6 +44,16 @@ sub IsWeak($) {
   my $ModulusSize = 0;
   my $Exponent = 0;
   my $result = 0;
+
+
+# Code for Testing only! Hardcoding some filenames to fail the tests.
+#
+#  if ($CertFileName eq '../crt/server/301/server-301988.crt' ||
+#      $CertFileName eq '../crt/client/258/client-258856.crt' ||
+#      $CertFileName eq '../crt/orgserver/2/orgserver-2635.crt' ||
+#      $CertFileName eq '../crt/orgclient/0/orgclient-808.crt') {
+#    return "Test";
+#  }
   
   # Do key size and exponent checking for RSA keys
   open(CERTTEXT, '-|', "openssl x509 -in $CertFileName -noout -text") || die "Cannot start openssl";
@@ -76,9 +90,9 @@ sub IsWeak($) {
 # Select only certificates expiring in more than two weeks, since two weeks will probably be needed as turnaround time
 # Get all domain certificates
 $sth_certs = $dbh->prepare(
-  "SELECT `dc`.`domid`, `dc`.`CN`, `dc`.`expire`, `dc`.`crt_name`, `dc`.`serial` ".
+  "SELECT `dc`.`domid`, `dc`.`CN`, `dc`.`expire`, `dc`.`crt_name`, `dc`.`serial`, `dc`.`id` ".
   "  FROM `domaincerts` AS `dc` ".
-  "  WHERE `dc`.`revoked`=0 AND `dc`.`expire` > DATE_ADD(NOW(), INTERVAL 14 DAY)");
+  "  WHERE `dc`.`revoked`=0 AND `dc`.`expire` > DATE_ADD(NOW(), INTERVAL $grace_time_days DAY)");
 $sth_certs->execute();
 
 $sth_userdata = $dbh->prepare(
@@ -86,13 +100,13 @@ $sth_userdata = $dbh->prepare(
   "  FROM `domains` AS `d`, `users` AS `u` ".
   "  WHERE `d`.`memid`=`u`.`id` AND `d`.`id`=?");
   
-while(($cert_domid, $cert_CN, $cert_expire, $cert_filename, $cert_serial) = $sth_certs->fetchrow_array) {
+while(($cert_domid, $cert_CN, $cert_expire, $cert_filename, $cert_serial, $cert_recid) = $sth_certs->fetchrow_array) {
   if (-f $cert_filename) {
     $reason = IsWeak($cert_filename);
     if ($reason) {
       $sth_userdata->execute($cert_domid);
       ($user_email, $user_firstname) = $sth_userdata->fetchrow_array();
-      print join("\t", ('DomainCert', $user_email, $user_firstname, $cert_expire, $cert_CN, $reason, $cert_serial)). "\n";
+      print join("\t", ('DomainCert', $user_email, $user_firstname, $cert_expire, $cert_CN, $reason, $cert_serial, $cert_recid)). "\n";
       $sth_userdata->finish();
     }
   }
@@ -101,9 +115,9 @@ $sth_certs->finish();
 
 # Get all email certificates
 $sth_certs = $dbh->prepare(
-  "SELECT `ec`.`memid`, `ec`.`CN`, `ec`.`expire`, `ec`.`crt_name`, `ec`.`serial` ".
+  "SELECT `ec`.`memid`, `ec`.`CN`, `ec`.`expire`, `ec`.`crt_name`, `ec`.`serial`, `ec`.`id` ".
   "  FROM `emailcerts` AS `ec` ".
-  "  WHERE `ec`.`revoked`=0 AND `ec`.`expire` > DATE_ADD(NOW(), INTERVAL 14 DAY)");
+  "  WHERE `ec`.`revoked`=0 AND `ec`.`expire` > DATE_ADD(NOW(), INTERVAL $grace_time_days DAY)");
 $sth_certs->execute();
 
 $sth_userdata = $dbh->prepare(
@@ -111,13 +125,13 @@ $sth_userdata = $dbh->prepare(
   "  FROM `users` AS `u` ".
   "  WHERE `u`.`id`=?");
   
-while(($cert_userid, $cert_CN, $cert_expire, $cert_filename, $cert_serial) = $sth_certs->fetchrow_array) {
+while(($cert_userid, $cert_CN, $cert_expire, $cert_filename, $cert_serial, $cert_recid) = $sth_certs->fetchrow_array) {
   if (-f $cert_filename) {
     $reason = IsWeak($cert_filename);
     if ($reason) {
       $sth_userdata->execute($cert_userid);
       ($user_email, $user_firstname) = $sth_userdata->fetchrow_array();
-      print join("\t", ('EmailCert', $user_email, $user_firstname, $cert_expire, $cert_CN, $reason, $cert_serial)). "\n";
+      print join("\t", ('EmailCert', $user_email, $user_firstname, $cert_expire, $cert_CN, $reason, $cert_serial, $cert_recid)). "\n";
       $sth_userdata->finish();
     }
   }
@@ -126,9 +140,9 @@ $sth_certs->finish();
 
 # Get all Org Server certificates, notify all admins of the Org!
 $sth_certs = $dbh->prepare(
-  "SELECT `dc`.`orgid`, `dc`.`CN`, `dc`.`expire`, `dc`.`crt_name`, `dc`.`serial` ".
+  "SELECT `dc`.`orgid`, `dc`.`CN`, `dc`.`expire`, `dc`.`crt_name`, `dc`.`serial`, `dc`.`id` ".
   "  FROM `orgdomaincerts` AS `dc` ".
-  "  WHERE `dc`.`revoked`=0 AND `dc`.`expire` > DATE_ADD(NOW(), INTERVAL 14 DAY)");
+  "  WHERE `dc`.`revoked`=0 AND `dc`.`expire` > DATE_ADD(NOW(), INTERVAL $grace_time_days DAY)");
 $sth_certs->execute();
 
 $sth_userdata = $dbh->prepare(
@@ -136,13 +150,13 @@ $sth_userdata = $dbh->prepare(
   "  FROM `users` AS `u`, `org` ".
   "  WHERE `u`.`id`=`org`.`memid` and `org`.`orgid`=?");
   
-while(($cert_orgid, $cert_CN, $cert_expire, $cert_filename, $cert_serial) = $sth_certs->fetchrow_array) {
+while(($cert_orgid, $cert_CN, $cert_expire, $cert_filename, $cert_serial, $cert_recid) = $sth_certs->fetchrow_array) {
   if (-f $cert_filename) {
     $reason = IsWeak($cert_filename);
     if ($reason) {
       $sth_userdata->execute($cert_orgid);
       while(($user_email, $user_firstname) = $sth_userdata->fetchrow_array()) {
-        print join("\t", ('OrgServerCert', $user_email, $user_firstname, $cert_expire, $cert_CN, $reason, $cert_serial)). "\n";
+        print join("\t", ('OrgServerCert', $user_email, $user_firstname, $cert_expire, $cert_CN, $reason, $cert_serial, $cert_recid)). "\n";
       }
       $sth_userdata->finish();
     }
@@ -152,9 +166,9 @@ $sth_certs->finish();
 
 # Get all Org Email certificates, notify all admins of the Org!
 $sth_certs = $dbh->prepare(
-  "SELECT `ec`.`orgid`, `ec`.`CN`, `ec`.`expire`, `ec`.`crt_name`, `ec`.`serial` ".
+  "SELECT `ec`.`orgid`, `ec`.`CN`, `ec`.`expire`, `ec`.`crt_name`, `ec`.`serial`, `ec`.`id` ".
   "  FROM `orgemailcerts` AS `ec` ".
-  "  WHERE `ec`.`revoked`=0 AND `ec`.`expire` > DATE_ADD(NOW(), INTERVAL 14 DAY)");
+  "  WHERE `ec`.`revoked`=0 AND `ec`.`expire` > DATE_ADD(NOW(), INTERVAL $grace_time_days DAY)");
 $sth_certs->execute();
 
 $sth_userdata = $dbh->prepare(
@@ -162,13 +176,13 @@ $sth_userdata = $dbh->prepare(
   "  FROM `users` AS `u`, `org` ".
   "  WHERE `u`.`id`=`org`.`memid` and `org`.`orgid`=?");
   
-while(($cert_orgid, $cert_CN, $cert_expire, $cert_filename, $cert_serial) = $sth_certs->fetchrow_array) {
+while(($cert_orgid, $cert_CN, $cert_expire, $cert_filename, $cert_serial, $cert_recid) = $sth_certs->fetchrow_array) {
   if (-f $cert_filename) {
     $reason = IsWeak($cert_filename);
     if ($reason) {
       $sth_userdata->execute($cert_orgid);
       while(($user_email, $user_firstname) = $sth_userdata->fetchrow_array()) {
-        print join("\t", ('OrgEmailCert', $user_email, $user_firstname, $cert_expire, $cert_CN, $reason, $cert_serial)). "\n";
+        print join("\t", ('OrgEmailCert', $user_email, $user_firstname, $cert_expire, $cert_CN, $reason, $cert_serial, $cert_recid)). "\n";
       }
       $sth_userdata->finish();
     }
diff --git a/scripts/mass-revoke.php b/scripts/mass-revoke.php
new file mode 100644
index 0000000..18c036b
--- /dev/null
+++ b/scripts/mass-revoke.php
@@ -0,0 +1,89 @@
+#!/usr/bin/php -q
+<? /*
+    LibreSSL - CAcert web application
+    Copyright (C) 2004-2011  CAcert Inc.
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; version 2 of the License.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+*/
+
+# Companion script to DumpWeakCerts.pl, takes output and revokes weak certs
+# Only first and last column ($cert_type and $cert_recid) are used, the others
+# are ignored
+
+include_once("../includes/mysql.php");
+# Main
+
+$num_domain = 0;
+$num_client = 0;
+$num_orgdomain = 0;
+$num_orgclient = 0;
+
+$num_failures = 0;
+
+$in = fopen("php://stdin", "r");
+
+# The restriction on revoked timestamp os only "to be sure" for non-Org certs,
+# but Org certs (email and serer) may be included multiple times in the output
+# of DumpWeakCerts.pl (once for each OrgAdmin).
+while($in_string = rtrim(fgets($in))) {
+	list($cert_type, $cert_email, $owner_name, $cert_expire, $cert_CN, $reason,
+		$cert_serial, $cert_recid) = explode("\t", $in_string);
+	
+	if ($cert_type == "DomainCert") {
+		$query = "UPDATE `domaincerts` SET `revoked`='1970-01-01 10:00:01'
+			where `id`='$cert_recid' AND `revoked`<'1970-01-01 10:00:01'";
+		
+		if (!mysql_query($query)) {
+			$num_failures++;
+		}
+		$num_domain+=mysql_affected_rows();
+		
+	} else if ($cert_type == "EmailCert") {
+		$query = "UPDATE `emailcerts` SET `revoked`='1970-01-01 10:00:01'
+			where `id`='$cert_recid' AND `revoked`<'1970-01-01 10:00:01'";
+		
+		if (!mysql_query($query)) {
+			$num_failures++;
+		}
+		$num_client+=mysql_affected_rows();
+		
+	} else if ($cert_type == "OrgServerCert") {
+		$query = "UPDATE `orgdomaincerts` SET `revoked`='1970-01-01 10:00:01'
+			where `id`='$cert_recid' AND `revoked`<'1970-01-01 10:00:01'";
+		
+		if (!mysql_query($query)) {
+			$num_failures++;
+		}
+		$num_orgdomain+=mysql_affected_rows();
+		
+	} else if ($cert_type == "OrgEmailCert") {
+		$query = "UPDATE `orgemailcerts` SET `revoked`='1970-01-01 10:00:01'
+			where `id`='$cert_recid' AND `revoked`<'1970-01-01 10:00:01'";
+		
+		if (!mysql_query($query)) {
+			$num_failures++;
+		}
+		$num_orgclient+=mysql_affected_rows();
+	}
+}
+
+fclose($in);
+
+echo "Certificates revoked: ".
+	"$num_domain server certs, ".
+	"$num_client client certs, ".
+	"$num_orgdomain Org server certs, ".
+	"$num_orgclient Org client certs.\n";
+echo "Update failures: $num_failures\n";
+?>
diff --git a/www/policy/CAcertCommunityAgreement.php b/www/policy/CAcertCommunityAgreement.php
index cf9b4e6..3106eb1 100644
--- a/www/policy/CAcertCommunityAgreement.php
+++ b/www/policy/CAcertCommunityAgreement.php
@@ -457,7 +457,7 @@ You are also bound by
     <a href="http://www.cacert.org/policy/DisputeResolutionPolicy.php">
     Dispute Resolution Policy</a> (DRP => COD7).
   </li><li>
-    <a href="http://www.cacert.org/index.php?id=10">
+    <a href="PrivacyPolicy.html">
     Privacy Policy</a> (PP => COD5).
   </li><li>
     <a href="http://svn.cacert.org/CAcert/principles.html">
diff --git a/www/policy/CertificationPracticeStatement.php b/www/policy/CertificationPracticeStatement.php
index 9d16805..e17056b 100644
--- a/www/policy/CertificationPracticeStatement.php
+++ b/www/policy/CertificationPracticeStatement.php
@@ -69,7 +69,7 @@ a:hover {
 <a href="PolicyOnPolicy.html"><img src="cacert-draft.png" alt="CAcert Policy Status" height="31" width="88" style="border-style: none;" /></a><br />
 Creation date: 20060726<br />
 Status: DRAFT p20091108<br />
-<!-- $Id: CertificationPracticeStatement.php,v 1.1 2009-11-21 22:34:00 philipp Exp $ -->
+<!-- $Id: CertificationPracticeStatement.php,v 1.2 2011-07-27 10:41:01 wytze Exp $ -->
 
 
 <font size="-1">
@@ -3623,7 +3623,7 @@ or rulings by Arbitrator.
 Privacy is covered by the
 CCA (COD9)
 and the Privacy Policy
-(<a href="http://www.cacert.org/index.php?id=10">COD5</a>).
+(<a href="PrivacyPolicy.html">COD5</a>).
 </p>
 
 <h4><a name="p9.4.1" id="p9.4.1">9.4.1. Privacy plan</a></h4>
@@ -3999,7 +3999,7 @@ obligations, risks and liabilities on the parties.
 
 <p>
 See the Privacy Policy
-(<a href="http://www.cacert.org/index.php?id=10">COD5</a>).
+(<a href="PrivacyPolicy.html">COD5</a>).
 </p>
 
 <h3><a name="p9.15.3" id="p9.15.3">9.15.3 Legal Process from External Forums</a></h3>
diff --git a/www/policy/PrivacyPolicy.html b/www/policy/PrivacyPolicy.html
new file mode 100644
index 0000000..6670e92
--- /dev/null
+++ b/www/policy/PrivacyPolicy.html
@@ -0,0 +1,114 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
+
+<html>
+<head><title>Privacy Policy</title></head>
+<body>
+
+<table width="100%">
+
+<tr>
+<td> PP </td>
+<td>&nbsp;</td>
+<td width="20%"> &nbsp; </td>
+</tr>
+
+<tr>
+<td> POLICY&nbsp;<a href="http://wiki.cacert.org/wiki/PolicyDecisions">m20060629</a> </td>
+<td> &nbsp; </td>
+<td>
+  20060629
+</td>
+</tr>
+
+<tr>
+<td> COD5 </td>
+<td>&nbsp;</td>
+<td>&nbsp;</td>
+</tr>
+
+
+<tr>
+<td>&nbsp;</td>
+<td > <b>Privacy&nbsp;Policy</b> </td>
+<td>&nbsp;</td>
+</tr>
+
+</table>
+
+<h2> 0. Preliminaries </h2>
+<p>
+    This policy discloses what information we gather about you when you visit any of our Web site, and when you issue or use our certificates. It describes how we use that information and how you can control it.
+</p>
+
+
+
+<h2>1. Website information</h2>
+<p>
+We collect two kinds of information about website users: 1) data that users volunteer by signing up to our website or when you send us an email via our contact form; and 2) aggregated tracking data we collect when users interact with our site.
+</p>
+
+<h2>2. Personal information</h2>
+<p>
+When you post to the contact form, you must provide your name and email address. When you sign up to the website, you must provide your name, email address, date of birth and some lost pass phrase question and answers.
+</p>
+<p>
+We only share your information with any other organisation when so instructed by a CAcert arbitrator.
+</p>
+
+<h2>3. Aggregated tracking information</h2>
+<p>
+We analyse visitors' use of our sites by tracking information such as page views, traffic flow, search terms, and click through. We use this information to improve our sites. We also share this anonymous traffic and demographic information in aggregate form with advertisers and other business partners. We do not share any information with advertisers that can identify an individual user.
+</p>
+
+<h2>4. Cookies</h2>
+<p>
+Some of our advertisers use a third-party ad server to display ads. These ads may contain cookies. The ad server receives these cookies, and we don't have access to them.
+</p>
+<p>
+We don't use cookies to store personal information, we do use sessions, and if cookies are enabled, the session will be stored in a cookie, and we do not look for cookies, apart from the session id. However if cookies are disabled then no information will be stored on or looked for on your computer.
+</p>
+
+<h2>5. Notification of changes</h2>
+<p>
+If we change our Privacy Policy, we will post those changes on www.CAcert.org. If we decide to use personally identifiable information in a manner different from that stated at the time it was collected, we will notify users via email. Users will be able to opt out of any new use of their personal information.
+</p>
+
+<h2>6. How to update, correct, or delete your information</h2>
+<p>
+You are able to update, add and remove your information at any time via our web interface, log into the 'My Account' and then click on the 'My Details' section, and then click the relevant link
+</p>
+
+<h2>7. Privacy of certificates</h2>
+<p>
+CAcert does not automatically publish the certificates through a directory service or the website to other people than the user who requested the certificate. In the future, the user might be able to opt-in for publication of the certificates through a directory server by CAcert.
+</p>
+
+<h2>8. Privacy of user data</h2>
+<p>
+CAcert Assurers can see the name, birthday and the number of points by looking up the correct email address. No other person related data is published by CAcert.
+</p>
+
+<h2>9. Exceptions</h2>
+<p>
+A CAcert arbitrator may override this policy in a dispute.
+To obtain access to confidential data, a dispute has to be filed.
+</p>
+
+<h2>10. Legal mandates</h2>
+<p>
+CAcert adopts the Australian privacy regulations.
+Please see <a href='http://www.privacy.gov.au/'>http://www.privacy.gov.au/</a> for further details.
+Governmental warrants and civil supoenas will be processed through the dispute resolution system, which ensures that valid authority is given to whoever complies with the supoena or the warrant.
+</p>
+
+
+<p>If you need to contact us in writing, address your mail to:</p>
+<p>
+CAcert Inc.<br>
+P.O. Box 4107<br>
+Denistone East NSW 2112<br>
+Australia
+</p>
+
+</body>
+</html>
diff --git a/www/policy/index.php b/www/policy/index.php
index d3bfb06..7101c1f 100644
--- a/www/policy/index.php
+++ b/www/policy/index.php
@@ -23,6 +23,11 @@ showheader(_("CAcert - Policies"));
 <ul>
 <?php
 
+foreach (glob("*.html") as $filename) 
+{
+	echo "<li><a href='$filename'>$filename</a></li>\n";
+}
+
 foreach (glob("*.php") as $filename) 
 {
    if($filename != "index.php" && $filename != "NRPDisclaimerAndLicence.php")