From 93e066dbccde757ac54fce818bd97ef0043b6207 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Wed, 21 Dec 2011 00:03:21 +0100
Subject: bug 964: Patches from Brian Dawson: allow selection of keysize in IE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 includes/keygen.php  | 216 +++++++++++++++++++++++++++++++++++++++++++++++++++
 pages/account/17.php | 122 +----------------------------
 pages/account/4.php  | 175 +----------------------------------------
 3 files changed, 220 insertions(+), 293 deletions(-)
 create mode 100644 includes/keygen.php

diff --git a/includes/keygen.php b/includes/keygen.php
new file mode 100644
index 0000000..688f7a1
--- /dev/null
+++ b/includes/keygen.php
@@ -0,0 +1,216 @@
+<? /*
+    LibreSSL - CAcert web application
+    Copyright (C) 2004-2008  CAcert Inc.
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; version 2 of the License.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program; if not, write to the Free Software
+    Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+*/ ?>
+<? if(array_key_exists('HTTP_USER_AGENT',$_SERVER) && strstr($_SERVER['HTTP_USER_AGENT'], "MSIE")) { ?>
+<object classid="clsid:127698e4-e730-4e5c-a2b1-21490a70c8a1" codebase="/xenroll.cab#Version=5,131,3659,0" id="cec">
+<?=_("You must enable ActiveX for this to work. On Vista you have to add this website to the list of trusted sites in the internet-settings.")?><?=_("Go to Extras->Internet Options->Security->Trusted Websites, click on Custom Level, check ActiveX control elements that are not marked as safe initialized on start in scripts")?>
+</object>
+<form method="post" action="account.php" name="CertReqForm"><p>
+<input type="hidden" name="session" value="UsedXenroll">
+<?=_("Key Strength:")?> <select name="CspProvider"></select>
+<input type="hidden" name="oldid" value="<?=$id?>">
+<INPUT TYPE=HIDDEN NAME="CSR">
+<input type="hidden" name="keytype" value="MS">
+<input type="submit" name="GenReq" value="Create Certificate"><br>
+</p></form>
+<script type="text/vbscript" language="vbscript">
+<!--
+Function GetProviderList()
+  Dim CspList, cspIndex, ProviderName
+  On Error Resume Next
+
+  count = 0
+  base = 0
+  enhanced = 0
+  CspList = ""
+  ProviderName = ""
+
+  // Vista:
+  Set csps = CreateObject("X509Enrollment.CCspInformations")
+  If IsObject(csps) Then
+    csps.AddAvailableCsps()
+    Document.CertReqForm.keytype.value="VI"
+    For j = 0 to csps.Count-1
+      Set oOption = document.createElement("OPTION")
+      oOption.text = csps.ItemByIndex(j).Name
+      oOption.value = j
+      Document.CertReqForm.CspProvider.add(oOption)
+    Next
+
+  Else
+
+  // 2000,XP:
+
+   For ProvType = 0 to 13
+    cspIndex = 0
+    cec.ProviderType = ProvType
+    ProviderName = cec.enumProviders(cspIndex,0)
+
+    while ProviderName <> ""
+     Set oOption = document.createElement("OPTION")
+     oOption.text = ProviderName
+     oOption.value = ProvType
+     Document.CertReqForm.CspProvider.add(oOption)
+     if ProviderName = "Microsoft Base Cryptographic Provider v1.0" Then
+       base = count
+     end if
+     if ProviderName = "Microsoft Enhanced Cryptographic Provider v1.0" Then
+       enhanced = count
+     end if
+     cspIndex = cspIndex +1
+     ProviderName = ""
+     ProviderName = cec.enumProviders(cspIndex,0)
+     count = count + 1
+    wend
+   Next
+   Document.CertReqForm.CspProvider.selectedIndex = base
+   if enhanced then
+    Document.CertReqForm.CspProvider.selectedIndex = enhanced
+   end if
+  End If
+End Function
+
+Function CSR(keyflags)
+  CSR = ""
+  szName  = ""
+
+
+  // Vista
+  if Document.CertReqForm.keytype.value="VI" Then
+
+
+    Dim g_objClassFactory
+    Dim obj
+    Dim objPrivateKey
+    Dim g_objRequest
+    Dim g_objRequestCMC
+  
+    Set g_objClassFactory=CreateObject("X509Enrollment.CX509EnrollmentWebClassFactory")
+    Set obj=g_objClassFactory.CreateObject("X509Enrollment.CX509Enrollment")
+    Set objPrivateKey=g_objClassFactory.CreateObject("X509Enrollment.CX509PrivateKey")
+    Set objRequest=g_objClassFactory.CreateObject("X509Enrollment.CX509CertificateRequestPkcs10")
+    //Msgbox     exit function
+    objPrivateKey.ProviderName = Document.CertReqForm.CspProvider(Document.CertReqForm.CspProvider.selectedIndex).text
+    // "Microsoft Enhanced RSA and AES Cryptographic Provider"
+    objPrivateKey.ProviderType = "24"
+    objPrivateKey.KeySpec = "1"
+    objPrivateKey.ExportPolicy = 1
+    select case Document.CertReqForm.keySize
+      case "3072"
+	objPrivateKey.Length = &h0C000000
+      case "4096"
+	objPrivateKey.Length = &h10000000
+      case else
+	objPrivateKey.Length = &h08000000
+    end select
+    objRequest.InitializeFromPrivateKey 1, objPrivateKey, ""
+    Set objDN = g_objClassFactory.CreateObject("X509Enrollment.CX500DistinguishedName")
+    objDN.Encode("CN=CAcertRequest")
+    objRequest.Subject = objDN
+
+    //  obj.Initialize(1)
+    obj.InitializeFromRequest(objRequest)
+    obj.CertificateDescription="Description"
+    obj.CertificateFriendlyName="FriendlyName"
+    CSR=obj.CreateRequest(1)
+    If len(CSR)<>0 Then Exit Function
+    Msgbox "<?=_("Error while generating the certificate-request. Please make sure that you have added this website to the list of trusted sites in the Internet-Options menu!")?>"
+
+  else
+  // XP
+  Dim lngAltKeyFlag 
+
+  cec.HashAlgorithm = "MD5"
+  err.clear
+  On Error Resume Next
+  set options = document.all.CspProvider.options
+  index = options.selectedIndex
+  cec.providerName = options(index).text
+  tmpProviderType = options(index).value
+  cec.providerType = tmpProviderType
+  cec.KeySpec = 2
+  if tmpProviderType < 2 Then
+    cec.KeySpec = 1
+  end if
+  
+  select case Document.CertReqForm.keySize
+    case "3072"
+      cec.GenKeyFlags = &h0C000001
+      lngAltKeyFLag = &h0C000000
+    case "4096"
+      cec.GenKeyFlags = &h10000001
+      lngAltKeyFLag = &h10000000
+    case else
+      cec.GenKeyFlags = &h08000001
+      lngAltKeyFLag = &h08000000
+  end select
+  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
+  if len(CSR)<>0 then Exit Function
+  cec.GenKeyFlags = lngAltKeyFLag
+  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
+  if len(CSR)<>0 then Exit Function
+  if cec.providerName = "Microsoft Enhanced Cryptographic Provider v1.0" Then
+    if MsgBox("<?=_("The high encryption key generation failed. Would you like to try 512 instead?")?>", vbOkCancel)=vbOk Then
+      cec.providerName = "Microsoft Base Cryptographic Provider v1.0"
+    else
+      Exit Function
+    end if
+  end if
+  cec.GenKeyFlags = 1 OR keyflags
+  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
+  if len(CSR)<>0 then Exit Function
+  cec.GenKeyFlags = keyflags
+  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
+  if len(CSR)<>0 then Exit Function
+  cec.GenKeyFlags = 0
+  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
+  End if
+End Function
+
+Sub GenReq_OnClick
+  Dim TheForm
+  Set TheForm = Document.CertReqForm
+  err.clear
+  result = CSR(2)
+  if len(result)=0 Then
+    result = MsgBox("Unable to generate PKCS#10.", 0, "Alert")
+    Exit Sub
+  end if
+  TheForm.CSR.Value = result
+  TheForm.Submit
+  Exit Sub
+End Sub
+
+GetProviderList()
+-->
+</script>
+<? } else { ?>
+<p>
+<form method="post" action="account.php">
+Select Keysize: <select name="keySize" id="keySize">
+<option value="2048" selected="selected">2048</option>
+<option value="3072">3072</option>
+<option value="4096">4096</option>
+</select>
+<input type="hidden" name="keytype" value="NS">
+<?=_("Keysize:")?> <keygen name="SPKAC" challenge="<? $_SESSION['spkac_hash']=make_hash(); echo $_SESSION['spkac_hash']; ?>">
+
+<input type="submit" name="submit" value="<?=_("Create Certificate Request")?>">
+<input type="hidden" name="oldid" value="<?=$id?>">
+</form>
+</p>
+<? } ?>
diff --git a/pages/account/17.php b/pages/account/17.php
index 2ba5390..36b0c9f 100644
--- a/pages/account/17.php
+++ b/pages/account/17.php
@@ -14,124 +14,6 @@
     You should have received a copy of the GNU General Public License
     along with this program; if not, write to the Free Software
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
-*/ ?>
-<? if(array_key_exists('HTTP_USER_AGENT',$_SERVER) && strstr($_SERVER['HTTP_USER_AGENT'], "MSIE")) { ?>
-<object classid="clsid:127698e4-e730-4e5c-a2b1-21490a70c8a1" codebase="/xenroll.cab#Version=5,131,3659,0" id="cec">
-<?=_("You must enable ActiveX for this to work.")?>
-</object>
-<form method="post" action="account.php" name="CertReqForm"><p>
-<input type="hidden" name="session" value="UsedXenroll">
-<?=_("Key Strength:")?> <select name="CspProvider"></select>
-<input type="hidden" name="oldid" value="<?=$id?>">
-<INPUT TYPE=HIDDEN NAME="CSR">
-<input type="hidden" name="keytype" value="MS">
-<?=_("'Enhanced Provider' is generally the best option, which has a key size of 1024bit. If you need a bigger key size you will need to use a different browser.")?>
-<input type="submit" name="GenReq" value="Create Certificate"><br>
-</p></form>
-<script type="text/vbscript" language="vbscript">
-<!--
-Function GetProviderList()
-  Dim CspList, cspIndex, ProviderName
-  On Error Resume Next
+*/
 
-  count = 0
-  base = 0
-  enhanced = 0
-  CspList = ""
-  ProviderName = ""
-
-  For ProvType = 0 to 13
-    cspIndex = 0
-    cec.ProviderType = ProvType
-    ProviderName = cec.enumProviders(cspIndex,0)
-
-    while ProviderName <> ""
-     Set oOption = document.createElement("OPTION")
-     oOption.text = ProviderName
-     oOption.value = ProvType
-     Document.CertReqForm.CspProvider.add(oOption)
-     if ProviderName = "Microsoft Base Cryptographic Provider v1.0" Then
-       base = count
-     end if
-     if ProviderName = "Microsoft Enhanced Cryptographic Provider v1.0" Then
-       enhanced = count
-     end if
-     cspIndex = cspIndex +1
-     ProviderName = ""
-     ProviderName = cec.enumProviders(cspIndex,0)
-     count = count + 1
-   wend
-  Next
-  Document.CertReqForm.CspProvider.selectedIndex = base
-  if enhanced then
-    Document.CertReqForm.CspProvider.selectedIndex = enhanced
-  end if
-End Function
-
-Function CSR(keyflags)
-  CSR = ""
-  szName  = ""
-  cec.HashAlgorithm = "MD5"
-  err.clear
-  On Error Resume Next
-  set options = document.all.CspProvider.options
-  index = options.selectedIndex
-  cec.providerName = options(index).text
-  tmpProviderType = options(index).value
-  cec.providerType = tmpProviderType
-  cec.KeySpec = 2
-  if tmpProviderType < 2 Then
-    cec.KeySpec = 1
-  end if
-  cec.GenKeyFlags = &h04000001 OR keyflags
-  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-  if len(CSR)<>0 then Exit Function
-  cec.GenKeyFlags = &h04000000 OR keyflags
-  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-  if len(CSR)<>0 then Exit Function
-  if cec.providerName = "Microsoft Enhanced Cryptographic Provider v1.0" Then
-    if MsgBox("<?=_("The 1024-bit key generation failed. Would you like to try 512 instead?")?>", vbOkCancel)=vbOk Then
-      cec.providerName = "Microsoft Base Cryptographic Provider v1.0"
-    else
-      Exit Function
-    end if
-  end if
-  cec.GenKeyFlags = 1 OR keyflags
-  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-  if len(CSR)<>0 then Exit Function
-  cec.GenKeyFlags = keyflags
-  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-  if len(CSR)<>0 then Exit Function
-  cec.GenKeyFlags = 0
-  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-End Function
-
-Sub GenReq_OnClick
-  Dim TheForm
-  Set TheForm = Document.CertReqForm
-  err.clear
-  result = CSR(2)
-  if len(result)=0 Then
-    result = MsgBox("Unable to generate PKCS#10.", 0, "Alert")
-    Exit Sub
-  end if
-  TheForm.CSR.Value = result
-  TheForm.Submit
-  Exit Sub
-End Sub
-
-GetProviderList()
--->
-</script>
-<? } else { ?>
-<p>
-<form method="post" action="account.php">
-<input type="hidden" name="keytype" value="NS">
-<?=_("Keysize:")?> <keygen name="SPKAC" challenge="<? $_SESSION['spkac_hash']=make_hash(); echo $_SESSION['spkac_hash']; ?>">
-
-
-<input type="submit" name="submit" value="<?=_("Create Certificate Request")?>">
-<input type="hidden" name="oldid" value="<?=$id?>">
-</form>
-</p>
-<? } ?>
+require_once "../../includes/keygen.php";
diff --git a/pages/account/4.php b/pages/account/4.php
index a4d6597..36b0c9f 100644
--- a/pages/account/4.php
+++ b/pages/account/4.php
@@ -14,177 +14,6 @@
     You should have received a copy of the GNU General Public License
     along with this program; if not, write to the Free Software
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
-*/ ?>
-<? if(array_key_exists('HTTP_USER_AGENT',$_SERVER) && strstr($_SERVER['HTTP_USER_AGENT'], "MSIE")) { ?>
-<object classid="clsid:127698e4-e730-4e5c-a2b1-21490a70c8a1" codebase="/xenroll.cab#Version=5,131,3659,0" id="cec">
-<?=_("You must enable ActiveX for this to work. On Vista you have to add this website to the list of trusted sites in the internet-settings.")?><?=_("Go to Extras->Internet Options->Security->Trusted Websites, click on Custom Level, check ActiveX control elements that are not marked as safe initialized on start in scripts")?>
-</object>
-<form method="post" action="account.php" name="CertReqForm"><p>
-<input type="hidden" name="session" value="UsedXenroll">
-<?=_("Key Strength:")?> <select name="CspProvider"></select>
-<input type="hidden" name="oldid" value="<?=$id?>">
-<INPUT TYPE=HIDDEN NAME="CSR">
-<input type="hidden" name="keytype" value="MS">
-<input type="submit" name="GenReq" value="Create Certificate"><br>
-</p></form>
-<script type="text/vbscript" language="vbscript">
-<!--
-Function GetProviderList()
-  Dim CspList, cspIndex, ProviderName
-  On Error Resume Next
+*/
 
-  count = 0
-  base = 0
-  enhanced = 0
-  CspList = ""
-  ProviderName = ""
-
-  // Vista:
-  Set csps = CreateObject("X509Enrollment.CCspInformations")
-  If IsObject(csps) Then
-    csps.AddAvailableCsps()
-    Document.CertReqForm.keytype.value="VI"
-    For j = 0 to csps.Count-1
-      Set oOption = document.createElement("OPTION")
-      oOption.text = csps.ItemByIndex(j).Name
-      oOption.value = j
-      Document.CertReqForm.CspProvider.add(oOption)
-    Next
-
-  Else
-
-  // 2000,XP:
-
-   For ProvType = 0 to 13
-    cspIndex = 0
-    cec.ProviderType = ProvType
-    ProviderName = cec.enumProviders(cspIndex,0)
-
-    while ProviderName <> ""
-     Set oOption = document.createElement("OPTION")
-     oOption.text = ProviderName
-     oOption.value = ProvType
-     Document.CertReqForm.CspProvider.add(oOption)
-     if ProviderName = "Microsoft Base Cryptographic Provider v1.0" Then
-       base = count
-     end if
-     if ProviderName = "Microsoft Enhanced Cryptographic Provider v1.0" Then
-       enhanced = count
-     end if
-     cspIndex = cspIndex +1
-     ProviderName = ""
-     ProviderName = cec.enumProviders(cspIndex,0)
-     count = count + 1
-    wend
-   Next
-   Document.CertReqForm.CspProvider.selectedIndex = base
-   if enhanced then
-    Document.CertReqForm.CspProvider.selectedIndex = enhanced
-   end if
-  End If
-End Function
-
-Function CSR(keyflags)
-  CSR = ""
-  szName  = ""
-
-
-  // Vista
-  if Document.CertReqForm.keytype.value="VI" Then
-
-    Dim g_objClassFactory
-    Dim obj
-    Dim objPrivateKey
-    Dim g_objRequest
-    Dim g_objRequestCMC
-  
-    Set g_objClassFactory=CreateObject("X509Enrollment.CX509EnrollmentWebClassFactory")
-    Set obj=g_objClassFactory.CreateObject("X509Enrollment.CX509Enrollment")
-    Set objPrivateKey=g_objClassFactory.CreateObject("X509Enrollment.CX509PrivateKey")
-    Set objRequest=g_objClassFactory.CreateObject("X509Enrollment.CX509CertificateRequestPkcs10")
-    //Msgbox     exit function
-    objPrivateKey.ProviderName = Document.CertReqForm.CspProvider(Document.CertReqForm.CspProvider.selectedIndex).text
-    // "Microsoft Enhanced RSA and AES Cryptographic Provider"
-    objPrivateKey.ProviderType = "24"
-    objPrivateKey.KeySpec = "1"
-    objPrivateKey.ExportPolicy = 1
-    objRequest.InitializeFromPrivateKey 1, objPrivateKey, ""
-    Set objDN = g_objClassFactory.CreateObject("X509Enrollment.CX500DistinguishedName")
-    objDN.Encode("CN=CAcertRequest")
-    objRequest.Subject = objDN
-
-    //  obj.Initialize(1)
-    obj.InitializeFromRequest(objRequest)
-    obj.CertificateDescription="Description"
-    obj.CertificateFriendlyName="FriendlyName"
-    CSR=obj.CreateRequest(1)
-    If len(CSR)<>0 Then Exit Function
-    Msgbox "<?=_("Error while generating the certificate-request. Please make sure that you have added this website to the list of trusted sites in the Internet-Options menu!")?>"
-
-  else
-  // XP
-
-  cec.HashAlgorithm = "MD5"
-  err.clear
-  On Error Resume Next
-  set options = document.all.CspProvider.options
-  index = options.selectedIndex
-  cec.providerName = options(index).text
-  tmpProviderType = options(index).value
-  cec.providerType = tmpProviderType
-  cec.KeySpec = 2
-  if tmpProviderType < 2 Then
-    cec.KeySpec = 1
-  end if
-  cec.GenKeyFlags = &h04000001 OR keyflags
-  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-  if len(CSR)<>0 then Exit Function
-  cec.GenKeyFlags = &h04000000 OR keyflags
-  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-  if len(CSR)<>0 then Exit Function
-  if cec.providerName = "Microsoft Enhanced Cryptographic Provider v1.0" Then
-    if MsgBox("<?=_("The 1024-bit key generation failed. Would you like to try 512 instead?")?>", vbOkCancel)=vbOk Then
-      cec.providerName = "Microsoft Base Cryptographic Provider v1.0"
-    else
-      Exit Function
-    end if
-  end if
-  cec.GenKeyFlags = 1 OR keyflags
-  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-  if len(CSR)<>0 then Exit Function
-  cec.GenKeyFlags = keyflags
-  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-  if len(CSR)<>0 then Exit Function
-  cec.GenKeyFlags = 0
-  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-  End if
-End Function
-
-Sub GenReq_OnClick
-  Dim TheForm
-  Set TheForm = Document.CertReqForm
-  err.clear
-  result = CSR(2)
-  if len(result)=0 Then
-    result = MsgBox("Unable to generate PKCS#10.", 0, "Alert")
-    Exit Sub
-  end if
-  TheForm.CSR.Value = result
-  TheForm.Submit
-  Exit Sub
-End Sub
-
-GetProviderList()
--->
-</script>
-<? } else { ?>
-<p>
-<form method="post" action="account.php">
-<input type="hidden" name="keytype" value="NS">
-<?=_("Keysize:")?> <keygen name="SPKAC" challenge="<? $_SESSION['spkac_hash']=make_hash(); echo $_SESSION['spkac_hash']; ?>">
-
-<input type="submit" name="submit" value="<?=_("Create Certificate Request")?>">
-<input type="hidden" name="oldid" value="<?=$id?>">
-</form>
-</p>
-<? } ?>
+require_once "../../includes/keygen.php";
-- 
cgit v1.2.1


From d230aee9764e30d3fc8bdb4f58c1e06580993683 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Wed, 21 Dec 2011 00:31:06 +0100
Subject: bug 964: Format
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 includes/keygen.php | 381 +++++++++++++++++++++++++++-------------------------
 1 file changed, 195 insertions(+), 186 deletions(-)

diff --git a/includes/keygen.php b/includes/keygen.php
index 688f7a1..974d56e 100644
--- a/includes/keygen.php
+++ b/includes/keygen.php
@@ -1,6 +1,6 @@
 <? /*
     LibreSSL - CAcert web application
-    Copyright (C) 2004-2008  CAcert Inc.
+    Copyright (C) 2004-2011  CAcert Inc.
 
     This program is free software; you can redistribute it and/or modify
     it under the terms of the GNU General Public License as published by
@@ -14,203 +14,212 @@
     You should have received a copy of the GNU General Public License
     along with this program; if not, write to the Free Software
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
-*/ ?>
-<? if(array_key_exists('HTTP_USER_AGENT',$_SERVER) && strstr($_SERVER['HTTP_USER_AGENT'], "MSIE")) { ?>
-<object classid="clsid:127698e4-e730-4e5c-a2b1-21490a70c8a1" codebase="/xenroll.cab#Version=5,131,3659,0" id="cec">
-<?=_("You must enable ActiveX for this to work. On Vista you have to add this website to the list of trusted sites in the internet-settings.")?><?=_("Go to Extras->Internet Options->Security->Trusted Websites, click on Custom Level, check ActiveX control elements that are not marked as safe initialized on start in scripts")?>
-</object>
-<form method="post" action="account.php" name="CertReqForm"><p>
-<input type="hidden" name="session" value="UsedXenroll">
-<?=_("Key Strength:")?> <select name="CspProvider"></select>
-<input type="hidden" name="oldid" value="<?=$id?>">
-<INPUT TYPE=HIDDEN NAME="CSR">
-<input type="hidden" name="keytype" value="MS">
-<input type="submit" name="GenReq" value="Create Certificate"><br>
-</p></form>
-<script type="text/vbscript" language="vbscript">
+*/ 
+
+if (array_key_exists('HTTP_USER_AGENT',$_SERVER) && 
+        strstr($_SERVER['HTTP_USER_AGENT'], "MSIE")) { ?>
+    <object
+        classid="clsid:127698e4-e730-4e5c-a2b1-21490a70c8a1"
+        codebase="/xenroll.cab#Version=5,131,3659,0"
+        id="cec"
+    >
+        <?=_("You must enable ActiveX for this to work. On Vista you have to add this website to the list of trusted sites in the internet-settings.")?>
+        <?=_("Go to Extras->Internet Options->Security->Trusted Websites, click on Custom Level, check ActiveX control elements that are not marked as safe initialized on start in scripts")?>
+    </object>
+    
+    <form method="post" action="account.php" name="CertReqForm"><p>
+        <input type="hidden" name="session" value="UsedXenroll">
+        <?=_("Key Strength:")?> <select name="CspProvider"></select>
+        
+        <input type="hidden" name="oldid" value="<?=$id?>">
+        <INPUT TYPE=HIDDEN NAME="CSR">
+        <input type="hidden" name="keytype" value="MS">
+        <input type="submit" name="GenReq" value="Create Certificate"><br>
+    </p></form>
+    
+    <script type="text/vbscript" language="vbscript">
 <!--
 Function GetProviderList()
-  Dim CspList, cspIndex, ProviderName
-  On Error Resume Next
-
-  count = 0
-  base = 0
-  enhanced = 0
-  CspList = ""
-  ProviderName = ""
-
-  // Vista:
-  Set csps = CreateObject("X509Enrollment.CCspInformations")
-  If IsObject(csps) Then
-    csps.AddAvailableCsps()
-    Document.CertReqForm.keytype.value="VI"
-    For j = 0 to csps.Count-1
-      Set oOption = document.createElement("OPTION")
-      oOption.text = csps.ItemByIndex(j).Name
-      oOption.value = j
-      Document.CertReqForm.CspProvider.add(oOption)
-    Next
-
-  Else
-
-  // 2000,XP:
-
-   For ProvType = 0 to 13
-    cspIndex = 0
-    cec.ProviderType = ProvType
-    ProviderName = cec.enumProviders(cspIndex,0)
-
-    while ProviderName <> ""
-     Set oOption = document.createElement("OPTION")
-     oOption.text = ProviderName
-     oOption.value = ProvType
-     Document.CertReqForm.CspProvider.add(oOption)
-     if ProviderName = "Microsoft Base Cryptographic Provider v1.0" Then
-       base = count
-     end if
-     if ProviderName = "Microsoft Enhanced Cryptographic Provider v1.0" Then
-       enhanced = count
-     end if
-     cspIndex = cspIndex +1
-     ProviderName = ""
-     ProviderName = cec.enumProviders(cspIndex,0)
-     count = count + 1
-    wend
-   Next
-   Document.CertReqForm.CspProvider.selectedIndex = base
-   if enhanced then
-    Document.CertReqForm.CspProvider.selectedIndex = enhanced
-   end if
-  End If
+    Dim CspList, cspIndex, ProviderName
+    On Error Resume Next
+    
+    count = 0
+    base = 0
+    enhanced = 0
+    CspList = ""
+    ProviderName = ""
+    
+    // Vista:
+    Set csps = CreateObject("X509Enrollment.CCspInformations")
+    If IsObject(csps) Then
+        csps.AddAvailableCsps()
+        Document.CertReqForm.keytype.value="VI"
+        For j = 0 to csps.Count-1
+            Set oOption = document.createElement("OPTION")
+            oOption.text = csps.ItemByIndex(j).Name
+            oOption.value = j
+            Document.CertReqForm.CspProvider.add(oOption)
+        Next
+    
+    Else
+        
+        // 2000,XP:
+        
+        For ProvType = 0 to 13
+            cspIndex = 0
+            cec.ProviderType = ProvType
+            ProviderName = cec.enumProviders(cspIndex,0)
+            
+            while ProviderName <> ""
+                Set oOption = document.createElement("OPTION")
+                oOption.text = ProviderName
+                oOption.value = ProvType
+                Document.CertReqForm.CspProvider.add(oOption)
+                if ProviderName = "Microsoft Base Cryptographic Provider v1.0" Then
+                    base = count
+                end if
+                if ProviderName = "Microsoft Enhanced Cryptographic Provider v1.0" Then
+                    enhanced = count
+                end if
+                cspIndex = cspIndex +1
+                ProviderName = ""
+                ProviderName = cec.enumProviders(cspIndex,0)
+                count = count + 1
+            wend
+        Next
+        Document.CertReqForm.CspProvider.selectedIndex = base
+        if enhanced then
+            Document.CertReqForm.CspProvider.selectedIndex = enhanced
+        end if
+    End If
 End Function
 
 Function CSR(keyflags)
-  CSR = ""
-  szName  = ""
-
-
-  // Vista
-  if Document.CertReqForm.keytype.value="VI" Then
-
-
-    Dim g_objClassFactory
-    Dim obj
-    Dim objPrivateKey
-    Dim g_objRequest
-    Dim g_objRequestCMC
-  
-    Set g_objClassFactory=CreateObject("X509Enrollment.CX509EnrollmentWebClassFactory")
-    Set obj=g_objClassFactory.CreateObject("X509Enrollment.CX509Enrollment")
-    Set objPrivateKey=g_objClassFactory.CreateObject("X509Enrollment.CX509PrivateKey")
-    Set objRequest=g_objClassFactory.CreateObject("X509Enrollment.CX509CertificateRequestPkcs10")
-    //Msgbox     exit function
-    objPrivateKey.ProviderName = Document.CertReqForm.CspProvider(Document.CertReqForm.CspProvider.selectedIndex).text
-    // "Microsoft Enhanced RSA and AES Cryptographic Provider"
-    objPrivateKey.ProviderType = "24"
-    objPrivateKey.KeySpec = "1"
-    objPrivateKey.ExportPolicy = 1
-    select case Document.CertReqForm.keySize
-      case "3072"
-	objPrivateKey.Length = &h0C000000
-      case "4096"
-	objPrivateKey.Length = &h10000000
-      case else
-	objPrivateKey.Length = &h08000000
-    end select
-    objRequest.InitializeFromPrivateKey 1, objPrivateKey, ""
-    Set objDN = g_objClassFactory.CreateObject("X509Enrollment.CX500DistinguishedName")
-    objDN.Encode("CN=CAcertRequest")
-    objRequest.Subject = objDN
-
-    //  obj.Initialize(1)
-    obj.InitializeFromRequest(objRequest)
-    obj.CertificateDescription="Description"
-    obj.CertificateFriendlyName="FriendlyName"
-    CSR=obj.CreateRequest(1)
-    If len(CSR)<>0 Then Exit Function
-    Msgbox "<?=_("Error while generating the certificate-request. Please make sure that you have added this website to the list of trusted sites in the Internet-Options menu!")?>"
-
-  else
-  // XP
-  Dim lngAltKeyFlag 
-
-  cec.HashAlgorithm = "MD5"
-  err.clear
-  On Error Resume Next
-  set options = document.all.CspProvider.options
-  index = options.selectedIndex
-  cec.providerName = options(index).text
-  tmpProviderType = options(index).value
-  cec.providerType = tmpProviderType
-  cec.KeySpec = 2
-  if tmpProviderType < 2 Then
-    cec.KeySpec = 1
-  end if
-  
-  select case Document.CertReqForm.keySize
-    case "3072"
-      cec.GenKeyFlags = &h0C000001
-      lngAltKeyFLag = &h0C000000
-    case "4096"
-      cec.GenKeyFlags = &h10000001
-      lngAltKeyFLag = &h10000000
-    case else
-      cec.GenKeyFlags = &h08000001
-      lngAltKeyFLag = &h08000000
-  end select
-  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-  if len(CSR)<>0 then Exit Function
-  cec.GenKeyFlags = lngAltKeyFLag
-  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-  if len(CSR)<>0 then Exit Function
-  if cec.providerName = "Microsoft Enhanced Cryptographic Provider v1.0" Then
-    if MsgBox("<?=_("The high encryption key generation failed. Would you like to try 512 instead?")?>", vbOkCancel)=vbOk Then
-      cec.providerName = "Microsoft Base Cryptographic Provider v1.0"
+    CSR = ""
+    szName  = ""
+    
+    
+    // Vista
+    if Document.CertReqForm.keytype.value="VI" Then
+        Dim g_objClassFactory
+        Dim obj
+        Dim objPrivateKey
+        Dim g_objRequest
+        Dim g_objRequestCMC
+        
+        Set g_objClassFactory = CreateObject("X509Enrollment.CX509EnrollmentWebClassFactory")
+        Set obj = g_objClassFactory.CreateObject("X509Enrollment.CX509Enrollment")
+        Set objPrivateKey = g_objClassFactory.CreateObject("X509Enrollment.CX509PrivateKey")
+        Set objRequest = g_objClassFactory.CreateObject("X509Enrollment.CX509CertificateRequestPkcs10")
+        //Msgbox     exit function
+        objPrivateKey.ProviderName = Document.CertReqForm.CspProvider(Document.CertReqForm.CspProvider.selectedIndex).text
+        // "Microsoft Enhanced RSA and AES Cryptographic Provider"
+        objPrivateKey.ProviderType = "24"
+        objPrivateKey.KeySpec = "1"
+        objPrivateKey.ExportPolicy = 1
+        select case Document.CertReqForm.keySize
+            case "3072"
+                objPrivateKey.Length = &h0C000000
+            case "4096"
+                objPrivateKey.Length = &h10000000
+            case else
+                objPrivateKey.Length = &h08000000
+        end select
+        objRequest.InitializeFromPrivateKey 1, objPrivateKey, ""
+        Set objDN = g_objClassFactory.CreateObject("X509Enrollment.CX500DistinguishedName")
+        objDN.Encode("CN=CAcertRequest")
+        objRequest.Subject = objDN
+        
+        //  obj.Initialize(1)
+        obj.InitializeFromRequest(objRequest)
+        obj.CertificateDescription = "Description"
+        obj.CertificateFriendlyName = "FriendlyName"
+        CSR = obj.CreateRequest(1)
+        If len(CSR)<>0 Then Exit Function
+        Msgbox "<?=_("Error while generating the certificate-request. Please make sure that you have added this website to the list of trusted sites in the Internet-Options menu!")?>"
+        
     else
-      Exit Function
-    end if
-  end if
-  cec.GenKeyFlags = 1 OR keyflags
-  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-  if len(CSR)<>0 then Exit Function
-  cec.GenKeyFlags = keyflags
-  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-  if len(CSR)<>0 then Exit Function
-  cec.GenKeyFlags = 0
-  CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-  End if
+        // XP
+        Dim lngAltKeyFlag 
+        
+        cec.HashAlgorithm = "MD5"
+        err.clear
+        On Error Resume Next
+        set options = document.all.CspProvider.options
+        index = options.selectedIndex
+        cec.providerName = options(index).text
+        tmpProviderType = options(index).value
+        cec.providerType = tmpProviderType
+        cec.KeySpec = 2
+        if tmpProviderType < 2 Then
+            cec.KeySpec = 1
+        end if
+        
+        select case Document.CertReqForm.keySize
+            case "3072"
+                cec.GenKeyFlags = &h0C000001
+                lngAltKeyFLag = &h0C000000
+            case "4096"
+                cec.GenKeyFlags = &h10000001
+                lngAltKeyFLag = &h10000000
+            case else
+                cec.GenKeyFlags = &h08000001
+                lngAltKeyFLag = &h08000000
+        end select
+        CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
+        if len(CSR)<>0 then Exit Function
+        cec.GenKeyFlags = lngAltKeyFLag
+        CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
+        if len(CSR)<>0 then Exit Function
+        if cec.providerName = "Microsoft Enhanced Cryptographic Provider v1.0" Then
+            if MsgBox("<?=_("The high encryption key generation failed. Would you like to try 512 instead?")?>", vbOkCancel)=vbOk Then
+                cec.providerName = "Microsoft Base Cryptographic Provider v1.0"
+            else
+                Exit Function
+            end if
+        end if
+        cec.GenKeyFlags = 1 OR keyflags
+        CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
+        if len(CSR)<>0 then Exit Function
+        cec.GenKeyFlags = keyflags
+        CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
+        if len(CSR)<>0 then Exit Function
+        cec.GenKeyFlags = 0
+        CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
+    End if
 End Function
 
 Sub GenReq_OnClick
-  Dim TheForm
-  Set TheForm = Document.CertReqForm
-  err.clear
-  result = CSR(2)
-  if len(result)=0 Then
-    result = MsgBox("Unable to generate PKCS#10.", 0, "Alert")
+    Dim TheForm
+    Set TheForm = Document.CertReqForm
+    err.clear
+    result = CSR(2)
+    if len(result)=0 Then
+        result = MsgBox("Unable to generate PKCS#10.", 0, "Alert")
+        Exit Sub
+    end if
+    TheForm.CSR.Value = result
+    TheForm.Submit
     Exit Sub
-  end if
-  TheForm.CSR.Value = result
-  TheForm.Submit
-  Exit Sub
 End Sub
 
 GetProviderList()
 -->
-</script>
+    </script>
 <? } else { ?>
-<p>
-<form method="post" action="account.php">
-Select Keysize: <select name="keySize" id="keySize">
-<option value="2048" selected="selected">2048</option>
-<option value="3072">3072</option>
-<option value="4096">4096</option>
-</select>
-<input type="hidden" name="keytype" value="NS">
-<?=_("Keysize:")?> <keygen name="SPKAC" challenge="<? $_SESSION['spkac_hash']=make_hash(); echo $_SESSION['spkac_hash']; ?>">
-
-<input type="submit" name="submit" value="<?=_("Create Certificate Request")?>">
-<input type="hidden" name="oldid" value="<?=$id?>">
-</form>
-</p>
-<? } ?>
+    <p>
+    <form method="post" action="account.php">
+        Select Keysize: <select name="keySize" id="keySize">
+            <option value="2048" selected="selected">2048</option>
+            <option value="3072">3072</option>
+            <option value="4096">4096</option>
+        </select>
+        
+        <input type="hidden" name="keytype" value="NS">
+        <?=_("Keysize:")?> <keygen name="SPKAC" challenge="<? $_SESSION['spkac_hash']=make_hash(); echo $_SESSION['spkac_hash']; ?>">
+        
+        <input type="submit" name="submit" value="<?=_("Create Certificate Request")?>">
+        <input type="hidden" name="oldid" value="<?=$id?>">
+    </form>
+    </p>
+<? }
-- 
cgit v1.2.1


From 327d40464b9ad672db38ea6bd1e271c1f771afde Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Wed, 21 Dec 2011 01:04:47 +0100
Subject: bug 964: Doh. require() confusion.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 pages/account/17.php | 2 +-
 pages/account/4.php  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pages/account/17.php b/pages/account/17.php
index 36b0c9f..8ac8b65 100644
--- a/pages/account/17.php
+++ b/pages/account/17.php
@@ -16,4 +16,4 @@
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 */
 
-require_once "../../includes/keygen.php";
+require_once($_SESSION['_config']['filepath'].'/includes/keygen.php');
diff --git a/pages/account/4.php b/pages/account/4.php
index 36b0c9f..8ac8b65 100644
--- a/pages/account/4.php
+++ b/pages/account/4.php
@@ -16,4 +16,4 @@
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 */
 
-require_once "../../includes/keygen.php";
+require_once($_SESSION['_config']['filepath'].'/includes/keygen.php');
-- 
cgit v1.2.1


From 30ac5366838978bd685da21208974c83883cd9d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Wed, 21 Dec 2011 01:34:40 +0100
Subject: bug 964: Move the selection box to the right form
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 includes/keygen.php | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/includes/keygen.php b/includes/keygen.php
index 974d56e..fcbc48c 100644
--- a/includes/keygen.php
+++ b/includes/keygen.php
@@ -27,15 +27,21 @@ if (array_key_exists('HTTP_USER_AGENT',$_SERVER) &&
         <?=_("Go to Extras->Internet Options->Security->Trusted Websites, click on Custom Level, check ActiveX control elements that are not marked as safe initialized on start in scripts")?>
     </object>
     
-    <form method="post" action="account.php" name="CertReqForm"><p>
-        <input type="hidden" name="session" value="UsedXenroll">
-        <?=_("Key Strength:")?> <select name="CspProvider"></select>
+    <form method="post" action="account.php" name="CertReqForm">
+        <p><input type="hidden" name="session" value="UsedXenroll">
+        <?=_("Key Strength:")?> <select name="CspProvider"></select></p>
+        
+        <p>Select Keysize: <select name="keySize" id="keySize">
+            <option value="2048" selected="selected">2048</option>
+            <option value="3072">3072</option>
+            <option value="4096">4096</option>
+        </select></p>
         
         <input type="hidden" name="oldid" value="<?=$id?>">
         <INPUT TYPE=HIDDEN NAME="CSR">
         <input type="hidden" name="keytype" value="MS">
-        <input type="submit" name="GenReq" value="Create Certificate"><br>
-    </p></form>
+        <p><input type="submit" name="GenReq" value="Create Certificate"></p>
+    </form>
     
     <script type="text/vbscript" language="vbscript">
 <!--
@@ -209,12 +215,6 @@ GetProviderList()
 <? } else { ?>
     <p>
     <form method="post" action="account.php">
-        Select Keysize: <select name="keySize" id="keySize">
-            <option value="2048" selected="selected">2048</option>
-            <option value="3072">3072</option>
-            <option value="4096">4096</option>
-        </select>
-        
         <input type="hidden" name="keytype" value="NS">
         <?=_("Keysize:")?> <keygen name="SPKAC" challenge="<? $_SESSION['spkac_hash']=make_hash(); echo $_SESSION['spkac_hash']; ?>">
         
-- 
cgit v1.2.1


From 5b714005859356138690754ae8866c0ede8414d8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Mon, 23 Jul 2012 18:36:20 +0200
Subject: bug 964: Completely reimplement the IE key generation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 includes/keygen.php | 291 +++++++++----------------
 locale/Makefile     |   3 +-
 www/keygenIE.js     | 603 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 701 insertions(+), 196 deletions(-)
 create mode 100644 www/keygenIE.js

diff --git a/includes/keygen.php b/includes/keygen.php
index fcbc48c..414b087 100644
--- a/includes/keygen.php
+++ b/includes/keygen.php
@@ -16,202 +16,103 @@
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 */ 
 
-if (array_key_exists('HTTP_USER_AGENT',$_SERVER) && 
-        strstr($_SERVER['HTTP_USER_AGENT'], "MSIE")) { ?>
-    <object
-        classid="clsid:127698e4-e730-4e5c-a2b1-21490a70c8a1"
-        codebase="/xenroll.cab#Version=5,131,3659,0"
-        id="cec"
-    >
-        <?=_("You must enable ActiveX for this to work. On Vista you have to add this website to the list of trusted sites in the internet-settings.")?>
-        <?=_("Go to Extras->Internet Options->Security->Trusted Websites, click on Custom Level, check ActiveX control elements that are not marked as safe initialized on start in scripts")?>
-    </object>
-    
-    <form method="post" action="account.php" name="CertReqForm">
-        <p><input type="hidden" name="session" value="UsedXenroll">
-        <?=_("Key Strength:")?> <select name="CspProvider"></select></p>
-        
-        <p>Select Keysize: <select name="keySize" id="keySize">
-            <option value="2048" selected="selected">2048</option>
-            <option value="3072">3072</option>
-            <option value="4096">4096</option>
-        </select></p>
-        
-        <input type="hidden" name="oldid" value="<?=$id?>">
-        <INPUT TYPE=HIDDEN NAME="CSR">
-        <input type="hidden" name="keytype" value="MS">
-        <p><input type="submit" name="GenReq" value="Create Certificate"></p>
-    </form>
-    
-    <script type="text/vbscript" language="vbscript">
-<!--
-Function GetProviderList()
-    Dim CspList, cspIndex, ProviderName
-    On Error Resume Next
-    
-    count = 0
-    base = 0
-    enhanced = 0
-    CspList = ""
-    ProviderName = ""
-    
-    // Vista:
-    Set csps = CreateObject("X509Enrollment.CCspInformations")
-    If IsObject(csps) Then
-        csps.AddAvailableCsps()
-        Document.CertReqForm.keytype.value="VI"
-        For j = 0 to csps.Count-1
-            Set oOption = document.createElement("OPTION")
-            oOption.text = csps.ItemByIndex(j).Name
-            oOption.value = j
-            Document.CertReqForm.CspProvider.add(oOption)
-        Next
-    
-    Else
-        
-        // 2000,XP:
-        
-        For ProvType = 0 to 13
-            cspIndex = 0
-            cec.ProviderType = ProvType
-            ProviderName = cec.enumProviders(cspIndex,0)
-            
-            while ProviderName <> ""
-                Set oOption = document.createElement("OPTION")
-                oOption.text = ProviderName
-                oOption.value = ProvType
-                Document.CertReqForm.CspProvider.add(oOption)
-                if ProviderName = "Microsoft Base Cryptographic Provider v1.0" Then
-                    base = count
-                end if
-                if ProviderName = "Microsoft Enhanced Cryptographic Provider v1.0" Then
-                    enhanced = count
-                end if
-                cspIndex = cspIndex +1
-                ProviderName = ""
-                ProviderName = cec.enumProviders(cspIndex,0)
-                count = count + 1
-            wend
-        Next
-        Document.CertReqForm.CspProvider.selectedIndex = base
-        if enhanced then
-            Document.CertReqForm.CspProvider.selectedIndex = enhanced
-        end if
-    End If
-End Function
-
-Function CSR(keyflags)
-    CSR = ""
-    szName  = ""
-    
-    
-    // Vista
-    if Document.CertReqForm.keytype.value="VI" Then
-        Dim g_objClassFactory
-        Dim obj
-        Dim objPrivateKey
-        Dim g_objRequest
-        Dim g_objRequestCMC
-        
-        Set g_objClassFactory = CreateObject("X509Enrollment.CX509EnrollmentWebClassFactory")
-        Set obj = g_objClassFactory.CreateObject("X509Enrollment.CX509Enrollment")
-        Set objPrivateKey = g_objClassFactory.CreateObject("X509Enrollment.CX509PrivateKey")
-        Set objRequest = g_objClassFactory.CreateObject("X509Enrollment.CX509CertificateRequestPkcs10")
-        //Msgbox     exit function
-        objPrivateKey.ProviderName = Document.CertReqForm.CspProvider(Document.CertReqForm.CspProvider.selectedIndex).text
-        // "Microsoft Enhanced RSA and AES Cryptographic Provider"
-        objPrivateKey.ProviderType = "24"
-        objPrivateKey.KeySpec = "1"
-        objPrivateKey.ExportPolicy = 1
-        select case Document.CertReqForm.keySize
-            case "3072"
-                objPrivateKey.Length = &h0C000000
-            case "4096"
-                objPrivateKey.Length = &h10000000
-            case else
-                objPrivateKey.Length = &h08000000
-        end select
-        objRequest.InitializeFromPrivateKey 1, objPrivateKey, ""
-        Set objDN = g_objClassFactory.CreateObject("X509Enrollment.CX500DistinguishedName")
-        objDN.Encode("CN=CAcertRequest")
-        objRequest.Subject = objDN
-        
-        //  obj.Initialize(1)
-        obj.InitializeFromRequest(objRequest)
-        obj.CertificateDescription = "Description"
-        obj.CertificateFriendlyName = "FriendlyName"
-        CSR = obj.CreateRequest(1)
-        If len(CSR)<>0 Then Exit Function
-        Msgbox "<?=_("Error while generating the certificate-request. Please make sure that you have added this website to the list of trusted sites in the Internet-Options menu!")?>"
-        
-    else
-        // XP
-        Dim lngAltKeyFlag 
-        
-        cec.HashAlgorithm = "MD5"
-        err.clear
-        On Error Resume Next
-        set options = document.all.CspProvider.options
-        index = options.selectedIndex
-        cec.providerName = options(index).text
-        tmpProviderType = options(index).value
-        cec.providerType = tmpProviderType
-        cec.KeySpec = 2
-        if tmpProviderType < 2 Then
-            cec.KeySpec = 1
-        end if
-        
-        select case Document.CertReqForm.keySize
-            case "3072"
-                cec.GenKeyFlags = &h0C000001
-                lngAltKeyFLag = &h0C000000
-            case "4096"
-                cec.GenKeyFlags = &h10000001
-                lngAltKeyFLag = &h10000000
-            case else
-                cec.GenKeyFlags = &h08000001
-                lngAltKeyFLag = &h08000000
-        end select
-        CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-        if len(CSR)<>0 then Exit Function
-        cec.GenKeyFlags = lngAltKeyFLag
-        CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-        if len(CSR)<>0 then Exit Function
-        if cec.providerName = "Microsoft Enhanced Cryptographic Provider v1.0" Then
-            if MsgBox("<?=_("The high encryption key generation failed. Would you like to try 512 instead?")?>", vbOkCancel)=vbOk Then
-                cec.providerName = "Microsoft Base Cryptographic Provider v1.0"
-            else
-                Exit Function
-            end if
-        end if
-        cec.GenKeyFlags = 1 OR keyflags
-        CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-        if len(CSR)<>0 then Exit Function
-        cec.GenKeyFlags = keyflags
-        CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-        if len(CSR)<>0 then Exit Function
-        cec.GenKeyFlags = 0
-        CSR = cec.createPKCS10(szName, "1.3.6.1.5.5.7.3.2")
-    End if
-End Function
-
-Sub GenReq_OnClick
-    Dim TheForm
-    Set TheForm = Document.CertReqForm
-    err.clear
-    result = CSR(2)
-    if len(result)=0 Then
-        result = MsgBox("Unable to generate PKCS#10.", 0, "Alert")
-        Exit Sub
-    end if
-    TheForm.CSR.Value = result
-    TheForm.Submit
-    Exit Sub
-End Sub
+if (array_key_exists('HTTP_USER_AGENT',$_SERVER) &&
+		strstr($_SERVER['HTTP_USER_AGENT'], "MSIE")) { ?>
+	
+	<noscript>
+		<p><?=_('You have to enable JavaScript to generate certificates in '.
+				'the browser.')?></p>
+		<p><?=_('If you don\'t want to do that for any reason, you can use '.
+				'manually created certificate requests instead.')?></p>
+	</noscript>
+	
+	<div id="noActiveX" style="color:red">
+		<p><?=_('Could not initialize ActiveX object required for certificate '.
+				'generation.')?></p>
+		<p><?=_('You have to enable ActiveX for this to work. On Windows '.
+				'Vista, Windows 7 and later versions you have to add this '.
+				'website to the list of trusted sites in the internet '.
+				'settings.')?></p>
+		<p><?php
+			printf(_('Go to "Extras -> Internet Options -> Security -> Trusted '.
+				'Websites", click on "Custom Level", set "ActiveX control '.
+				'elements that are not marked as safe initialized on start in '.
+				'scripts" to "Confirm" and click "OK". Now click "Sites", add '.
+				'"%s" and "%s" to your list of trusted sites and make the '.
+				'changes come into effect by clicking "Close" and "OK".'),
+				'https://'.$_SESSION['_config']['normalhostname'],
+				'https://'.$_SESSION['_config']['securehostname'])?>
+		</p>
+	</div>
+	
+	<form method="post" style="display:none" action="account.php"
+			id="CertReqForm">
+		<input type="hidden" name="oldid" value="<?=$id?>" />
+		<input type="hidden" id="CSR" name="CSR" />
+		<input type="hidden" name="keytype" value="MS" />
 
-GetProviderList()
--->
-    </script>
+		<p><?=_('Security level')?>:
+			<select id="SecurityLevel">
+				<option value="high" selected="selected"><?=_('High')?></option>
+				<option value="medium"><?=_('Medium')?></option>
+				<option value="custom"><?=_('Custom')?>&hellip;</option>
+			</select>
+		</p>
+		
+		<fieldset id="customSettings" style="display:none">
+			<legend><?=_('Custom Parameters')?></legend>
+			
+			<p><?=_('Cryptography Provider')?>:
+				<select id="CspProvider"></select>
+			</p>
+			<p><?=_('Algorithm')?>: <select id="algorithm"></select></p>
+			<p><?=_('Keysize')?>:
+				<input id="keySize" type="number" />
+				<?=_('Minimum Size')?>: <span id="keySizeMin"></span>,
+				<?=_('Maximum Size')?>: <span id="keySizeMax"></span>,
+				<?php
+				// TRANSLATORS: this specifies the step between two valid key
+				// sizes. E.g. if the step is 512 and the minimum is 1024 and
+				// the maximum is 2048, then only 1024, 1536 and 2048 bits may
+				// be specified as key size.
+				_('Step')?>: <span id="keySizeStep"></span></p>
+			<p style="color:red"><?php
+				printf(_('Please note that RSA key sizes smaller than %d bit '.
+						'will not be accepted by CAcert.'),
+						1024)?>
+			</p>
+		</fieldset>
+		
+		<p><input type="submit" id="GenReq" name="GenReq"
+				value="<?=_('Create Certificate')?>" /></p>
+		<p id="generatingKeyNotice" style="display:none">
+			<?=_('Generating your key. Please wait')?>&hellip;</p>
+	</form>
+	
+		
+	<!-- Error messages used in the JavaScript. Defined here so they can be
+	translated without passing the JavaScript code through PHP -->
+	<p id="createRequestErrorChooseAlgorithm" style="display:none">
+		<?=_('Could not generate certificate request. Probably you need to '.
+				'choose a different algorithm.')?>
+	</p>
+	<p id="createRequestError" style="display:none">
+		<?=_('Could not generate certificate request.')?>
+	</p>
+	<p id="invalidKeySizeError" style="display:none">
+		<?=_('You have specified an invalid key size')?>
+	</p>
+	<p id="unsupportedPlatformError" style="display:none">
+		<?=_('Could not initialize the cryptographic module for your '.
+				'platform. Currently we support Microsoft Windows XP, Vista '.
+				'and 7. If you\'re using one of these platforms and see this '.
+				'error message anyway you might have to enable ActiveX as '.
+				'described in the red explanation text and accept loading of '.
+				'the module.')?>
+	</p>
+	
+	<script type="text/javascript" src="keygenIE.js"></script>
+	
 <? } else { ?>
     <p>
     <form method="post" action="account.php">
diff --git a/locale/Makefile b/locale/Makefile
index 1517066..4215a4f 100644
--- a/locale/Makefile
+++ b/locale/Makefile
@@ -176,7 +176,8 @@ upload.clean: template.clean
 messages.pot: $(GETTEXT_FILES)
 	xgettext --output - --sort-by-file --copyright-holder "CAcert Inc." \
 		--package-name "CAcert" --package-version "$(VERSION)" \
-		--msgid-bugs-address "translations-admin@cacert.org" $^ | \
+		--msgid-bugs-address "translations-admin@cacert.org" \
+		--add-comments=TRANSLATORS $^ | \
 		# replace place holders in the lines before the first msgid\
 		sed '1,/^msgid/ { s/SOME DESCRIPTIVE TITLE/$(DESCRITPION)/; s/YEAR/$(COPYRIGHT_YEAR)/; s/PACKAGE/$(PACKAGE)/ }' \
 		> $@
diff --git a/www/keygenIE.js b/www/keygenIE.js
new file mode 100644
index 0000000..fa4bce6
--- /dev/null
+++ b/www/keygenIE.js
@@ -0,0 +1,603 @@
+var CAcert_keygen_IE = function () {
+	
+	/// Makes a new DOM text node
+	var textnode = function (text) {
+		return document.createTextNode(text);
+	}
+	
+	
+	/// makes a new <p> element
+	var paragraph = function (text) {
+		var paragraph = document.createElement("p");
+		paragraph.appendChild(textnode(text));
+		return paragraph;
+	}
+	
+	
+	/// makes a new <pre> elemtent
+	var pre = function (text) {
+		var pre = document.createElement("pre");
+		pre.appendChild(textnode(text));
+		return pre;
+	}
+	
+	
+	/// makes a new <option> element
+	var option = function (text, value) {
+		var option = document.createElement("option");
+		if (value !== undefined) {
+			option.setAttribute("value", value);
+		}
+		option.appendChild(textnode(text));
+		return option;
+	}
+	
+	
+	/// Removes all child nodes from the element
+	var removeChildren = function (element) {
+		element.innerHTML = "";
+	}
+	
+	
+	// Get important elements from the DOM
+	var form = document.getElementById("CertReqForm");
+	var securityLevel = document.getElementById("SecurityLevel");
+	var customSettings = document.getElementById("customSettings");
+	var provider = document.getElementById("CspProvider");
+	var algorithm = document.getElementById("algorithm");
+	var algorithmParagraph = document.getElementById("algorithmParagraph");
+	var keySize = document.getElementById("keySize");
+	var keySizeMin = document.getElementById("keySizeMin");
+	var keySizeMax = document.getElementById("keySizeMax");
+	var keySizeStep = document.getElementById("keySizeStep");
+	var genReq = document.getElementById("GenReq");
+	var csr = document.getElementById("CSR");
+	var noActiveX = document.getElementById("noActiveX");
+	var generatingKeyNotice = document.getElementById("generatingKeyNotice");
+	var createRequestErrorChooseAlgorithm = document.getElementById("createRequestErrorChooseAlgorithm");
+	var createRequestError = document.getElementById("createRequestError");
+	var invalidKeySizeError = document.getElementById("invalidKeySizeError");
+	var unsupportedPlatformError = document.getElementById("unsupportedPlatformError");
+	
+	
+	/// Initialise the CertEnroll code (Vista and higher)
+	/// returns false if initialisation fails
+	var initCertEnroll = function () {
+		var factory = null;
+		var providerList = null;
+		var cspStats = null;
+		
+		// Try to initialise the ActiveX element. Requires permissions by the user
+		try {
+			factory = new ActiveXObject(
+				"X509Enrollment.CX509EnrollmentWebClassFactory");
+			if (!factory) {
+				throw {
+					name: "NoObjectError",
+					message: "Got null at object creation"
+				};
+			}
+			
+			// also try to create a useless object here so the library gets
+			// initialised and we don't need to check everytime later
+			factory.CreateObject("X509Enrollment.CObjectId");
+			
+			form.style.display = "";
+			noActiveX.style.display = "none";
+		} catch (e) {
+			return false;
+		}
+		
+		
+		/// Get the selected provider
+		var getProvider = function () {
+			var providerIndex = provider.options[provider.selectedIndex].value;
+			return providerList.ItemByIndex(providerIndex);
+		}
+		
+		
+		/// Get the selected algorithm
+		var getAlgorithm = function () {
+			var algorithmIndex = algorithm.options[algorithm.selectedIndex].value;
+			return alg = cspStats.ItemByIndex(algorithmIndex).CspAlgorithm;
+		}
+		
+		
+		/// Get the selected key size
+		var getKeySize = function () {
+			var alg = getAlgorithm();
+			
+			var bits = parseInt(keySize.value, 10);
+			if ( bits < alg.MinLength || bits > alg.MaxLength ||
+					(alg.IncrementLength &&
+						(bits - alg.MinLength) % alg.IncrementLength !== 0)
+				)
+			{
+				return false;
+			}
+			
+			return bits;
+		}
+		
+		
+		/// Fill the key size list
+		var getKeySizeList = function () {
+			if (!cspStats) {
+				return false;
+			}
+			
+			var alg = getAlgorithm();
+			
+			// HTML5 attributes
+			keySize.setAttribute("min", alg.MinLength);
+			keySize.setAttribute("max", alg.MaxLength);
+			keySize.setAttribute("step", alg.IncrementLength);
+			keySize.setAttribute("value", alg.DefaultLength);
+			keySize.value = ""+alg.DefaultLength;
+			
+			// ugly, but buggy otherwise if done with text nodes
+			keySizeMin.innerHTML = alg.MinLength;
+			keySizeMax.innerHTML = alg.MaxLength;
+			keySizeStep.innerHTML = alg.IncrementLength;
+			
+			return true;
+		}
+		
+		
+		/// Fill the algorithm list
+		var getAlgorithmList = function () {
+			var i;
+			
+			if (!providerList) {
+				return false;
+			}
+			
+			var csp = getProvider();
+			
+			cspStats = providerList.GetCspStatusesFromOperations(
+					0x1c, //XCN_NCRYPT_ANY_ASYMMETRIC_OPERATION
+					//0x10, //XCN_NCRYPT_SIGNATURE_OPERATION
+					//0x8, //XCN_NCRYPT_SECRET_AGREEMENT_OPERATION
+					//0x4, //XCN_NCRYPT_ASYMMETRIC_ENCRYPTION_OPERATION
+					csp
+				);
+			
+			removeChildren(algorithm);
+			for (i = 0; i < cspStats.Count; i++) {
+				var alg = cspStats.ItemByIndex(i).CspAlgorithm;
+				algorithm.appendChild(option(alg.Name, i));
+			}
+			
+			return getKeySizeList();
+		}
+		
+		
+		/// Fill the crypto provider list
+		var getProviderList = function () {
+			var i;
+			
+			var csps = factory.CreateObject("X509Enrollment.CCspInformations");
+			
+			// Get provider information
+			csps.AddAvailableCsps();
+			
+			removeChildren(provider);
+			
+			for (i = 0; i < csps.Count; i++) {
+				var csp = csps.ItemByIndex(i);
+				provider.appendChild(option(csp.Name, i));
+			}
+			
+			providerList = csps;
+			
+			return getAlgorithmList();
+		}
+		
+		
+		/// Generate a key and create and submit the actual CSR
+		var createCSR = function () {
+			var providerName, algorithmOid, bits;
+			
+			var level = securityLevel.options[securityLevel.selectedIndex];
+			if (level.value === "custom") {
+				providerName = getProvider().Name;
+				var alg = getAlgorithm();
+				algorithmOid = alg.GetAlgorithmOid(0, 0)
+				bits = getKeySize();
+				if (!bits) {
+					window.alert(invalidKeySizeError.innerHTML);
+					return false;
+				}
+				
+			} else {
+				
+				providerName = "Microsoft Software Key Storage Provider";
+				
+				algorithmOid = factory.CreateObject("X509Enrollment.CObjectId");
+				algorithmOid.InitializeFromValue("1.2.840.113549.1.1.1"); // RSA
+				//"1.2.840.10040.4.1" == DSA
+				//"1.2.840.10046.2.1" == DH
+				
+				if (level.value === "high") {
+					bits = 4096;
+				} else { // medium
+					bits = 2048;
+				}
+			}
+			
+			
+			var privateKey = factory.CreateObject("X509Enrollment.CX509PrivateKey");
+			privateKey.ProviderName = providerName;
+			privateKey.Algorithm = algorithmOid;
+			privateKey.Length = bits;
+			privateKey.KeyUsage = 0xffffff; // XCN_NCRYPT_ALLOW_ALL_USAGES
+			
+			var request = factory.CreateObject(
+				"X509Enrollment.CX509CertificateRequestPkcs10");
+			request.InitializeFromPrivateKey(
+					1, // ContextUser
+					privateKey,
+					"" // don't use a template
+				);
+			
+			var enroll = factory.CreateObject("X509Enrollment.CX509Enrollment");
+			enroll.InitializeFromRequest(request);
+			
+			generatingKeyNotice.style.display = "";
+			
+			
+			// The request needs to be created after we return so the "please wait"
+			// message gets rendered
+			var createCSRHandler = function () {
+				try {
+					csr.value = enroll.CreateRequest(0x1); //XCN_CRYPT_STRING_BASE64
+					form.submit();
+				} catch (e) {
+					window.alert(createRequestErrorChooseAlgorithm.innerHTML + "\n\nError: " + e.message);
+				}
+				
+				generatingKeyNotice.style.display = "none";
+			}
+			
+			window.setTimeout(createCSRHandler, 0);
+			
+			// Always return false, form is submitted by deferred method
+			return false;
+		}
+		
+		
+		/// Call if securityLevel has changed
+		var refreshSecurityLevel = function () {
+			var level = securityLevel.options[securityLevel.selectedIndex];
+			if (level.value === "custom") {
+				getProviderList();
+				customSettings.style.display = "";
+			} else {
+				customSettings.style.display = "none";
+			}
+		}
+		
+		securityLevel.onchange = refreshSecurityLevel;
+		provider.onchange = getAlgorithmList;
+		algorithm.onchange = getKeySizeList;
+		genReq.onclick = createCSR;
+		
+		return true;
+	} // end of initCertEnroll()
+	
+	
+	/// Initialise Xenroll code (XP and lower)
+	/// returns false if initialisation fails
+	var initXEnroll = function () {
+		cenroll = null;
+		
+		providerTypes = Array(
+				 1, //PROV_RSA_FULL
+				 2, //PROV_RSA_SIG
+				 3, //PROV_DSS
+				 4, //PROV_FORTEZZA
+				 5, //PROV_MS_EXCHANGE
+				 6, //PROV_SSL
+				12, //PROV_RSA_SCHANNEL
+				13, //PROV_DSS_DH
+				14, //PROV_EC_ECDSA_SIG
+				15, //PROV_EC_ECNRA_SIG
+				16, //PROV_EC_ECDSA_FULL
+				17, //PROV_EC_ECNRA_FULL
+				18, //PROV_DH_SCHANNEL
+				20, //PROV_SPYRUS_LYNKS
+				21, //PROV_RNG
+				22, //PROV_INTEL_SEC
+				23, //PROV_REPLACE_OWF
+				24  //PROV_RSA_AES
+			);
+		
+		algClasses = Array(
+				1 << 13, //ALG_CLASS_SIGNATURE
+				//2 << 13, //ALG_CLASS_MSG_ENCRYPT
+				//3 << 13, //ALG_CLASS_DATA_ENCRYPT
+				//4 << 13, //ALG_CLASS_HASH
+				5 << 13  //ALG_CLASS_KEY_EXCHANGE
+			);
+		
+		// Try to initialise the ActiveX element.
+		try {
+			cenroll = new ActiveXObject("CEnroll.CEnroll");
+			
+			if (!cenroll) {
+				throw {
+					name: "NoObjectError",
+					message: "Got null at object creation"
+				};
+			}
+			
+			form.style.display = "";
+			//algorithmParagraph.style.display = "none";
+			algorithm.disabled = true;
+			noActiveX.style.display = "none";
+		} catch (e) {
+			return false;
+		}
+		
+		
+		/// Get the name of the selected provider
+		var getProviderName = function () {
+			return provider.options[provider.selectedIndex].text;
+		}
+		
+		
+		/// Get the type of the selected provider
+		var getProviderType = function () {
+			return parseInt(provider.options[provider.selectedIndex].value, 10);
+		}
+		
+		
+		var refreshProvider = function () {
+			cenroll.ProviderName = getProviderName();
+			cenroll.ProviderType = getProviderType();
+		}
+		
+		
+		/// Get the ID of the selected algorithm
+		var getAlgorithmId = function () {
+			return parseInt(
+					algorithm.options[algorithm.selectedIndex].value, 10);
+		}
+		
+		
+		/// Minimum bit length for exchange keys
+		var getMinExKeyLength = function () {
+			refreshProvider();
+			
+			try {
+				return cenroll.GetKeyLen(true, true);
+			} catch (e) {
+				return false;
+			}
+		}
+		
+		
+		/// Maximum bit length for exchange keys
+		var getMaxExKeyLength = function () {
+			refreshProvider();
+			
+			try {
+				return cenroll.GetKeyLen(false, true);
+			} catch (e) {
+				return false;
+			}
+		}
+		
+		
+		/// Step size for exchange keys
+		/// This might not be available on older platforms
+		var getStepExKeyLength = function () {
+			refreshProvider();
+			
+			try {
+				return cenroll.GetKeyLenEx(3, 1);
+			} catch (e) {
+				return false;
+			}
+		}
+		
+		
+		/// Minimum bit length for signature keys
+		var getMinSigKeyLength = function () {
+			refreshProvider();
+			
+			try {
+				return cenroll.GetKeyLen(true, false);
+			} catch (e) {
+				return false;
+			}
+		}
+		
+		
+		/// Maximum bit length for signature keys
+		var getMaxSigKeyLength = function () {
+			refreshProvider();
+			
+			try {
+				return cenroll.GetKeyLen(false, false);
+			} catch (e) {
+				return false;
+			}
+		}
+		
+		
+		/// Step size for signature keys
+		/// This might not be available on older platforms
+		var getStepSigKeyLength = function () {
+			refreshProvider();
+			
+			try {
+				return cenroll.GetKeyLenEx(3, 2);
+			} catch (e) {
+				return false;
+			}
+		}
+		
+		
+		/// Get the selected key size
+		var getKeySize = function () {
+			var bits = parseInt(keySize.value, 10);
+			//TODO: check if the bits are sane
+			return bits;
+		}
+		
+		
+		var getKeySizeLimits = function () {
+			// HTML5 attributes
+			keySize.setAttribute("min", getMinSigKeyLength());
+			keySize.setAttribute("max", getMaxSigKeyLength());
+			if (getStepSigKeyLength()) {
+				keySize.setAttribute("step", getStepSigKeyLength());
+			}
+			//keySize.setAttribute("value", alg.DefaultLength);
+			//keySize.value = ""+alg.DefaultLength;
+			
+			// ugly, but buggy otherwise if done with text nodes
+			keySizeMin.innerHTML = getMinSigKeyLength();
+			keySizeMax.innerHTML = getMaxSigKeyLength();
+			keySizeStep.innerHTML = getStepSigKeyLength();
+			
+			return true;
+		}
+		
+		
+		/// Fill the algorithm selection box
+		var getAlgorithmList = function () {
+			var i, j;
+			
+			refreshProvider();
+			
+			removeChildren(algorithm);
+			
+			for (i = 0; i < algClasses.length; ++i) {
+				for (j = 0; true; ++j) {
+					try {
+						var algId = cenroll.EnumAlgs(j, algClasses[i]);
+						var algName = cenroll.GetAlgName(algId);
+						algorithm.appendChild(option(algName, algId));
+					} catch (e) {
+						break;
+					}
+				}
+			}
+			
+			getKeySizeLimits();
+		}
+		
+		
+		/// Fill the provider selection box
+		var getProviderList = function () {
+			var i, j;
+			
+			removeChildren(provider);
+			
+			for (i = 0; i < providerTypes.length; ++i) {
+				cenroll.providerType = providerTypes[i];
+				
+				var providerName = "invalid";
+				for (j = 0; true; ++j) {
+					try {
+						providerName = cenroll.enumProviders(j, 0);
+						provider.appendChild(
+								option(providerName, providerTypes[i]));
+					} catch (e) {
+						break;
+					}
+				}
+			}
+			
+			return getAlgorithmList();
+			//return getKeySizeLimits();
+		}
+		
+		
+		var createCSR = function () {
+			var providerName, bits;
+			
+			var level = securityLevel.options[securityLevel.selectedIndex];
+			if (level.value === "custom") {
+				
+				refreshProvider();
+				
+				bits = getKeySize();
+				if (bits === false) {
+					window.alert(invalidKeySizeError.innerHTML);
+					return false;
+				}
+				
+			} else {
+				
+				cenroll.ProviderName = "Microsoft Enhanced Cryptographic Provider v1.0";
+				cenroll.ProviderType = 1; //PROV_RSA_FULL
+				
+				if (level.value === "high") {
+					bits = 4096;
+				} else { // medium
+					bits = 2048;
+				}
+			}
+			
+			cenroll.GenKeyFlags = bits << 16; // keysize is encoded in the uper 16 bits
+			//cenroll.GenKeyFlags = cenroll.GenKeyFlags | 0x1; //CRYPT_EXPORTABLE
+			
+			generatingKeyNotice.style.display = "";
+			
+			
+			// The request needs to be created after we return so the "please wait"
+			// message gets rendered
+			var createCSRHandler = function () {
+				try {
+					csr.value = cenroll.createPKCS10("", "1.3.6.1.5.5.7.3.2");
+					form.submit();
+				} catch (e) {
+					window.alert(createRequestError.innerHTML + "\n\nError: " + e.message + " (" + e.number + ")");
+				}
+				
+				generatingKeyNotice.style.display = "none";
+				cenroll.Reset();
+			}
+			
+			window.setTimeout(createCSRHandler, 0);
+			
+			// Always return false, form is submitted by deferred method
+			return false;
+		}
+		
+		
+		/// Call if securityLevel has changed
+		var refreshSecurityLevel = function () {
+			var level = securityLevel.options[securityLevel.selectedIndex];
+			if (level.value === "custom") {
+				getProviderList();
+				customSettings.style.display = "";
+			} else {
+				customSettings.style.display = "none";
+			}
+		}
+		
+		securityLevel.onchange = refreshSecurityLevel;
+		provider.onchange = getAlgorithmList;
+		//provider.onchange = getKeySizeLimits;
+		algorithm.onchange = getKeySizeLimits;
+		genReq.onclick = createCSR;
+		
+		return true;
+	};
+	
+	
+	// Run the init functions until one is successful
+	if (initCertEnroll()) {
+		form.style.display = "";
+		noActiveX.style.display = "none";
+	} else if (initXEnroll()) {
+		form.style.display = "";
+		noActiveX.style.display = "none";
+	} else {
+		window.alert(unsupportedPlatformError.innerHTML);
+	}
+} ();
-- 
cgit v1.2.1


From b89cdbe09dd9428f349b0e104f2d2d9d959908d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Tue, 24 Jul 2012 23:04:47 +0200
Subject: bug 964: Respect whether to use the cert for login on IE too
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 includes/account.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/includes/account.php b/includes/account.php
index 72165df..8e7f207 100644
--- a/includes/account.php
+++ b/includes/account.php
@@ -421,6 +421,7 @@
 						`created`=FROM_UNIXTIME(UNIX_TIMESTAMP()),
 						`subject`='".mysql_real_escape_string($csrsubject)."',
 						`codesign`='".$_SESSION['_config']['codesign']."',
+						`disablelogin`='".($_SESSION['_config']['disablelogin']?1:0)."',
 						`rootcert`='".$_SESSION['_config']['rootcert']."'";
 			mysql_query($query);
 			$emailid = mysql_insert_id();
-- 
cgit v1.2.1


From 692181bc6f4d5abfe95dda4ef9c2357a9bc20397 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Tue, 24 Jul 2012 23:46:08 +0200
Subject: bug 964: Also show error code in hex on IE keygen
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 www/keygenIE.js | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/www/keygenIE.js b/www/keygenIE.js
index fa4bce6..5dc0f13 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -39,6 +39,16 @@
 	}
 	
 	
+	/// Show error message to user from exception
+	var showError = function (message, exception) {
+		window.alert(message +
+				"\n\nError: " + exception.message +
+				" (" + exception.number.toString(16) + " / " +
+				exception.number + ")");
+	}
+	
+	
+	
 	// Get important elements from the DOM
 	var form = document.getElementById("CertReqForm");
 	var securityLevel = document.getElementById("SecurityLevel");
@@ -253,7 +263,7 @@
 					csr.value = enroll.CreateRequest(0x1); //XCN_CRYPT_STRING_BASE64
 					form.submit();
 				} catch (e) {
-					window.alert(createRequestErrorChooseAlgorithm.innerHTML + "\n\nError: " + e.message);
+					showError(createRequestErrorChooseAlgorithm.innerHTML, e);
 				}
 				
 				generatingKeyNotice.style.display = "none";
@@ -555,7 +565,7 @@
 					csr.value = cenroll.createPKCS10("", "1.3.6.1.5.5.7.3.2");
 					form.submit();
 				} catch (e) {
-					window.alert(createRequestError.innerHTML + "\n\nError: " + e.message + " (" + e.number + ")");
+					showError(createRequestError.innerHTML, e);
 				}
 				
 				generatingKeyNotice.style.display = "none";
-- 
cgit v1.2.1


From e56ae655a0accdf638b44e58be3bd79d91c5e00f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Wed, 25 Jul 2012 00:33:35 +0200
Subject: bug 964: Doh, actually print "Step" string
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 includes/keygen.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/includes/keygen.php b/includes/keygen.php
index 414b087..1cb7738 100644
--- a/includes/keygen.php
+++ b/includes/keygen.php
@@ -75,7 +75,7 @@ if (array_key_exists('HTTP_USER_AGENT',$_SERVER) &&
 				// sizes. E.g. if the step is 512 and the minimum is 1024 and
 				// the maximum is 2048, then only 1024, 1536 and 2048 bits may
 				// be specified as key size.
-				_('Step')?>: <span id="keySizeStep"></span></p>
+				echo _('Step')?>: <span id="keySizeStep"></span></p>
 			<p style="color:red"><?php
 				printf(_('Please note that RSA key sizes smaller than %d bit '.
 						'will not be accepted by CAcert.'),
-- 
cgit v1.2.1


From 1a0d931c9902bb7a4aa6ea7e2914741601033e16 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Wed, 25 Jul 2012 00:34:57 +0200
Subject: bug 964: hopefully properly encode error codes in hex now
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 www/keygenIE.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/www/keygenIE.js b/www/keygenIE.js
index 5dc0f13..51da0ef 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -43,7 +43,7 @@
 	var showError = function (message, exception) {
 		window.alert(message +
 				"\n\nError: " + exception.message +
-				" (" + exception.number.toString(16) + " / " +
+				" (0x" + (-exception.number).toString(16) + " / " +
 				exception.number + ")");
 	}
 	
-- 
cgit v1.2.1


From 7743c2cdaaaf3d2c1817e668b26fa5e16c144b85 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Wed, 25 Jul 2012 00:36:21 +0200
Subject: bug 964: Add check for key size to the Xenroll code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 www/keygenIE.js | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/www/keygenIE.js b/www/keygenIE.js
index 51da0ef..7b5aed2 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -452,7 +452,15 @@
 		/// Get the selected key size
 		var getKeySize = function () {
 			var bits = parseInt(keySize.value, 10);
-			//TODO: check if the bits are sane
+			if ( bits < getMinSigKeyLength() || bits > getMaxSigKeyLength() ||
+					(getStepSigKeyLength() &&
+						(bits - getMinSigKeyLength()) %
+							getStepSigKeyLength() !== 0)
+				)
+			{
+				return false;
+			}
+			
 			return bits;
 		}
 		
-- 
cgit v1.2.1


From 15921f97db3990d7add6f6509f02c39e04e2b08c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Wed, 25 Jul 2012 00:50:42 +0200
Subject: bug 964: IE error codes as hex: now really.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 www/keygenIE.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/www/keygenIE.js b/www/keygenIE.js
index 7b5aed2..f25e6db 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -43,7 +43,7 @@
 	var showError = function (message, exception) {
 		window.alert(message +
 				"\n\nError: " + exception.message +
-				" (0x" + (-exception.number).toString(16) + " / " +
+				" (0x" + (1 << 32 + exception.number).toString(16) + " / " +
 				exception.number + ")");
 	}
 	
-- 
cgit v1.2.1


From 726bac01737f960bc6c7b3fd0ba59223803279b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Wed, 25 Jul 2012 01:14:21 +0200
Subject: bug 964: Usability improvement: if there's only one keysize to
 select, pre-fill the key size field.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 www/keygenIE.js | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/www/keygenIE.js b/www/keygenIE.js
index f25e6db..e546f62 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -480,6 +480,10 @@
 			keySizeMax.innerHTML = getMaxSigKeyLength();
 			keySizeStep.innerHTML = getStepSigKeyLength();
 			
+			if (getMinSigKeyLength() === getMaxSigKeyLength()) {
+				keySize.value = getMaxSigKeyLength();
+			}
+			
 			return true;
 		}
 		
-- 
cgit v1.2.1


From 5a51a1a6d854e0cbc36c2ad1ff86f347f79e1c50 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Wed, 25 Jul 2012 01:58:51 +0200
Subject: bug 964: New error message if the user declines the dialogue. Also a
 little bit of clean up
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 includes/keygen.php |  4 ++++
 www/keygenIE.js     | 12 ++++++------
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/includes/keygen.php b/includes/keygen.php
index 1cb7738..b489640 100644
--- a/includes/keygen.php
+++ b/includes/keygen.php
@@ -96,6 +96,10 @@ if (array_key_exists('HTTP_USER_AGENT',$_SERVER) &&
 		<?=_('Could not generate certificate request. Probably you need to '.
 				'choose a different algorithm.')?>
 	</p>
+	<p id="createRequestErrorConfirmDialogue" style="display:none">
+		<?=_('Could not generate certificate request. Please confirm the '.
+				'dialogue if you are asked if you want to generate the key.')?>
+	</p>
 	<p id="createRequestError" style="display:none">
 		<?=_('Could not generate certificate request.')?>
 	</p>
diff --git a/www/keygenIE.js b/www/keygenIE.js
index e546f62..31baa25 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -65,6 +65,7 @@
 	var noActiveX = document.getElementById("noActiveX");
 	var generatingKeyNotice = document.getElementById("generatingKeyNotice");
 	var createRequestErrorChooseAlgorithm = document.getElementById("createRequestErrorChooseAlgorithm");
+	var createRequestErrorConfirmDialogue = document.getElementById("createRequestErrorConfirmDialogue");
 	var createRequestError = document.getElementById("createRequestError");
 	var invalidKeySizeError = document.getElementById("invalidKeySizeError");
 	var unsupportedPlatformError = document.getElementById("unsupportedPlatformError");
@@ -342,7 +343,6 @@
 			}
 			
 			form.style.display = "";
-			//algorithmParagraph.style.display = "none";
 			algorithm.disabled = true;
 			noActiveX.style.display = "none";
 		} catch (e) {
@@ -472,8 +472,6 @@
 			if (getStepSigKeyLength()) {
 				keySize.setAttribute("step", getStepSigKeyLength());
 			}
-			//keySize.setAttribute("value", alg.DefaultLength);
-			//keySize.value = ""+alg.DefaultLength;
 			
 			// ugly, but buggy otherwise if done with text nodes
 			keySizeMin.innerHTML = getMinSigKeyLength();
@@ -534,7 +532,6 @@
 			}
 			
 			return getAlgorithmList();
-			//return getKeySizeLimits();
 		}
 		
 		
@@ -577,7 +574,11 @@
 					csr.value = cenroll.createPKCS10("", "1.3.6.1.5.5.7.3.2");
 					form.submit();
 				} catch (e) {
-					showError(createRequestError.innerHTML, e);
+					if (e.number === -2147023673) {
+						showError(createRequestErrorConfirmDialogue.innerHTML, e);
+					} else {
+						showError(createRequestError.innerHTML, e);
+					}
 				}
 				
 				generatingKeyNotice.style.display = "none";
@@ -604,7 +605,6 @@
 		
 		securityLevel.onchange = refreshSecurityLevel;
 		provider.onchange = getAlgorithmList;
-		//provider.onchange = getKeySizeLimits;
 		algorithm.onchange = getKeySizeLimits;
 		genReq.onclick = createCSR;
 		
-- 
cgit v1.2.1


From 4c79ad2ee246da7d7826094cedb8c0d0f9842ce5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Wed, 25 Jul 2012 02:10:03 +0200
Subject: bug 964: Add copyright/GPL notice
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 www/keygenIE.js | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/www/keygenIE.js b/www/keygenIE.js
index 31baa25..b7c1a97 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -1,4 +1,22 @@
-var CAcert_keygen_IE = function () {
+/*
+LibreSSL - CAcert web application
+Copyright (C) 2004-2012  CAcert Inc.
+
+This program is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License as published by
+the Free Software Foundation; version 2 of the License.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with this program; if not, write to the Free Software
+Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+var CAcert_keygen_IE = function () {
 	
 	/// Makes a new DOM text node
 	var textnode = function (text) {
-- 
cgit v1.2.1


From b65f5c60cd9d546584977504770c937254c68690 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Tue, 7 Aug 2012 23:42:40 +0200
Subject: bug 964: Hex is hexed => dehex
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 www/keygenIE.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/www/keygenIE.js b/www/keygenIE.js
index b7c1a97..c311b85 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -61,8 +61,8 @@ var CAcert_keygen_IE = function () {
 	var showError = function (message, exception) {
 		window.alert(message +
 				"\n\nError: " + exception.message +
-				" (0x" + (1 << 32 + exception.number).toString(16) + " / " +
-				exception.number + ")");
+				" (0x" + (0xFFFFFFFF + exception.number +1).toString(16) +
+				" / " + exception.number + ")");
 	}
 	
 	
-- 
cgit v1.2.1


From 567efe68327ca4568ecc4de0c6c597d247b17a2c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Wed, 8 Aug 2012 00:16:42 +0200
Subject: bug 964: Show an explicit error message for non-connected crypto
 devices
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 includes/keygen.php | 4 ++++
 www/keygenIE.js     | 5 +++++
 2 files changed, 9 insertions(+)

diff --git a/includes/keygen.php b/includes/keygen.php
index b489640..bf8bc5a 100644
--- a/includes/keygen.php
+++ b/includes/keygen.php
@@ -100,6 +100,10 @@ if (array_key_exists('HTTP_USER_AGENT',$_SERVER) &&
 		<?=_('Could not generate certificate request. Please confirm the '.
 				'dialogue if you are asked if you want to generate the key.')?>
 	</p>
+	<p id="createRequestErrorConnectDevice" style="display:none">
+		<?=_('Could not generate certificate request. Please make sure the '.
+				'cryptography device (e.g. the smartcard) is connected.')?>
+	</p>
 	<p id="createRequestError" style="display:none">
 		<?=_('Could not generate certificate request.')?>
 	</p>
diff --git a/www/keygenIE.js b/www/keygenIE.js
index c311b85..5e2b8c0 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -84,6 +84,7 @@ var CAcert_keygen_IE = function () {
 	var generatingKeyNotice = document.getElementById("generatingKeyNotice");
 	var createRequestErrorChooseAlgorithm = document.getElementById("createRequestErrorChooseAlgorithm");
 	var createRequestErrorConfirmDialogue = document.getElementById("createRequestErrorConfirmDialogue");
+	var createRequestErrorConnectDevice = document.getElementById("createRequestErrorConnectDevice"));
 	var createRequestError = document.getElementById("createRequestError");
 	var invalidKeySizeError = document.getElementById("invalidKeySizeError");
 	var unsupportedPlatformError = document.getElementById("unsupportedPlatformError");
@@ -593,7 +594,11 @@ var CAcert_keygen_IE = function () {
 					form.submit();
 				} catch (e) {
 					if (e.number === -2147023673) {
+						// 0x800704c7 => dialogue declined
 						showError(createRequestErrorConfirmDialogue.innerHTML, e);
+					} else if (e.number === -2146435043) {
+						// 0x8010001d => crypto-device not connected
+						showError(createRequestErrorConnectDevice.innerHTML, e);
 					} else {
 						showError(createRequestError.innerHTML, e);
 					}
-- 
cgit v1.2.1


From 726eb834f7d9a931129fb7de74930d11af93f73d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Michael=20T=C3=A4nzer?= <neo@nhng.de>
Date: Wed, 8 Aug 2012 00:51:15 +0200
Subject: bug 964: Doh, syntax error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Michael Tänzer <neo@nhng.de>
---
 www/keygenIE.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/www/keygenIE.js b/www/keygenIE.js
index 5e2b8c0..dad84bb 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -84,7 +84,7 @@ var CAcert_keygen_IE = function () {
 	var generatingKeyNotice = document.getElementById("generatingKeyNotice");
 	var createRequestErrorChooseAlgorithm = document.getElementById("createRequestErrorChooseAlgorithm");
 	var createRequestErrorConfirmDialogue = document.getElementById("createRequestErrorConfirmDialogue");
-	var createRequestErrorConnectDevice = document.getElementById("createRequestErrorConnectDevice"));
+	var createRequestErrorConnectDevice = document.getElementById("createRequestErrorConnectDevice");
 	var createRequestError = document.getElementById("createRequestError");
 	var invalidKeySizeError = document.getElementById("invalidKeySizeError");
 	var unsupportedPlatformError = document.getElementById("unsupportedPlatformError");
-- 
cgit v1.2.1


From 0766b152ab730d358191a5c81d49f93bc38e8aef Mon Sep 17 00:00:00 2001
From: Benny Baumann <BenBE@geshi.org>
Date: Tue, 19 Feb 2013 18:22:31 +0100
Subject: bug 964: Trailing whitespace cleanup

Also fixes one unnecessary BOM character in the keygen JS file
---
 includes/keygen.php |  23 +++--
 www/keygenIE.js     | 236 +++++++++++++++++++++-------------------------------
 2 files changed, 108 insertions(+), 151 deletions(-)

diff --git a/includes/keygen.php b/includes/keygen.php
index bf8bc5a..866c5f2 100644
--- a/includes/keygen.php
+++ b/includes/keygen.php
@@ -14,18 +14,18 @@
     You should have received a copy of the GNU General Public License
     along with this program; if not, write to the Free Software
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
-*/ 
+*/
 
 if (array_key_exists('HTTP_USER_AGENT',$_SERVER) &&
 		strstr($_SERVER['HTTP_USER_AGENT'], "MSIE")) { ?>
-	
+
 	<noscript>
 		<p><?=_('You have to enable JavaScript to generate certificates in '.
 				'the browser.')?></p>
 		<p><?=_('If you don\'t want to do that for any reason, you can use '.
 				'manually created certificate requests instead.')?></p>
 	</noscript>
-	
+
 	<div id="noActiveX" style="color:red">
 		<p><?=_('Could not initialize ActiveX object required for certificate '.
 				'generation.')?></p>
@@ -44,7 +44,7 @@ if (array_key_exists('HTTP_USER_AGENT',$_SERVER) &&
 				'https://'.$_SESSION['_config']['securehostname'])?>
 		</p>
 	</div>
-	
+
 	<form method="post" style="display:none" action="account.php"
 			id="CertReqForm">
 		<input type="hidden" name="oldid" value="<?=$id?>" />
@@ -58,10 +58,10 @@ if (array_key_exists('HTTP_USER_AGENT',$_SERVER) &&
 				<option value="custom"><?=_('Custom')?>&hellip;</option>
 			</select>
 		</p>
-		
+
 		<fieldset id="customSettings" style="display:none">
 			<legend><?=_('Custom Parameters')?></legend>
-			
+
 			<p><?=_('Cryptography Provider')?>:
 				<select id="CspProvider"></select>
 			</p>
@@ -82,14 +82,13 @@ if (array_key_exists('HTTP_USER_AGENT',$_SERVER) &&
 						1024)?>
 			</p>
 		</fieldset>
-		
+
 		<p><input type="submit" id="GenReq" name="GenReq"
 				value="<?=_('Create Certificate')?>" /></p>
 		<p id="generatingKeyNotice" style="display:none">
 			<?=_('Generating your key. Please wait')?>&hellip;</p>
 	</form>
-	
-		
+
 	<!-- Error messages used in the JavaScript. Defined here so they can be
 	translated without passing the JavaScript code through PHP -->
 	<p id="createRequestErrorChooseAlgorithm" style="display:none">
@@ -118,15 +117,15 @@ if (array_key_exists('HTTP_USER_AGENT',$_SERVER) &&
 				'described in the red explanation text and accept loading of '.
 				'the module.')?>
 	</p>
-	
+
 	<script type="text/javascript" src="keygenIE.js"></script>
-	
+
 <? } else { ?>
     <p>
     <form method="post" action="account.php">
         <input type="hidden" name="keytype" value="NS">
         <?=_("Keysize:")?> <keygen name="SPKAC" challenge="<? $_SESSION['spkac_hash']=make_hash(); echo $_SESSION['spkac_hash']; ?>">
-        
+
         <input type="submit" name="submit" value="<?=_("Create Certificate Request")?>">
         <input type="hidden" name="oldid" value="<?=$id?>">
     </form>
diff --git a/www/keygenIE.js b/www/keygenIE.js
index dad84bb..2c2018e 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -1,4 +1,4 @@
-/*
+/*
 LibreSSL - CAcert web application
 Copyright (C) 2004-2012  CAcert Inc.
 
@@ -17,29 +17,26 @@ Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 */
 
 var CAcert_keygen_IE = function () {
-	
+
 	/// Makes a new DOM text node
 	var textnode = function (text) {
 		return document.createTextNode(text);
 	}
-	
-	
+
 	/// makes a new <p> element
 	var paragraph = function (text) {
 		var paragraph = document.createElement("p");
 		paragraph.appendChild(textnode(text));
 		return paragraph;
 	}
-	
-	
+
 	/// makes a new <pre> elemtent
 	var pre = function (text) {
 		var pre = document.createElement("pre");
 		pre.appendChild(textnode(text));
 		return pre;
 	}
-	
-	
+
 	/// makes a new <option> element
 	var option = function (text, value) {
 		var option = document.createElement("option");
@@ -49,14 +46,12 @@ var CAcert_keygen_IE = function () {
 		option.appendChild(textnode(text));
 		return option;
 	}
-	
-	
+
 	/// Removes all child nodes from the element
 	var removeChildren = function (element) {
 		element.innerHTML = "";
 	}
-	
-	
+
 	/// Show error message to user from exception
 	var showError = function (message, exception) {
 		window.alert(message +
@@ -64,9 +59,7 @@ var CAcert_keygen_IE = function () {
 				" (0x" + (0xFFFFFFFF + exception.number +1).toString(16) +
 				" / " + exception.number + ")");
 	}
-	
-	
-	
+
 	// Get important elements from the DOM
 	var form = document.getElementById("CertReqForm");
 	var securityLevel = document.getElementById("SecurityLevel");
@@ -88,15 +81,14 @@ var CAcert_keygen_IE = function () {
 	var createRequestError = document.getElementById("createRequestError");
 	var invalidKeySizeError = document.getElementById("invalidKeySizeError");
 	var unsupportedPlatformError = document.getElementById("unsupportedPlatformError");
-	
-	
+
 	/// Initialise the CertEnroll code (Vista and higher)
 	/// returns false if initialisation fails
 	var initCertEnroll = function () {
 		var factory = null;
 		var providerList = null;
 		var cspStats = null;
-		
+
 		// Try to initialise the ActiveX element. Requires permissions by the user
 		try {
 			factory = new ActiveXObject(
@@ -107,36 +99,33 @@ var CAcert_keygen_IE = function () {
 					message: "Got null at object creation"
 				};
 			}
-			
+
 			// also try to create a useless object here so the library gets
 			// initialised and we don't need to check everytime later
 			factory.CreateObject("X509Enrollment.CObjectId");
-			
+
 			form.style.display = "";
 			noActiveX.style.display = "none";
 		} catch (e) {
 			return false;
 		}
-		
-		
+
 		/// Get the selected provider
 		var getProvider = function () {
 			var providerIndex = provider.options[provider.selectedIndex].value;
 			return providerList.ItemByIndex(providerIndex);
 		}
-		
-		
+
 		/// Get the selected algorithm
 		var getAlgorithm = function () {
 			var algorithmIndex = algorithm.options[algorithm.selectedIndex].value;
 			return alg = cspStats.ItemByIndex(algorithmIndex).CspAlgorithm;
 		}
-		
-		
+
 		/// Get the selected key size
 		var getKeySize = function () {
 			var alg = getAlgorithm();
-			
+
 			var bits = parseInt(keySize.value, 10);
 			if ( bits < alg.MinLength || bits > alg.MaxLength ||
 					(alg.IncrementLength &&
@@ -145,35 +134,33 @@ var CAcert_keygen_IE = function () {
 			{
 				return false;
 			}
-			
+
 			return bits;
 		}
-		
-		
+
 		/// Fill the key size list
 		var getKeySizeList = function () {
 			if (!cspStats) {
 				return false;
 			}
-			
+
 			var alg = getAlgorithm();
-			
+
 			// HTML5 attributes
 			keySize.setAttribute("min", alg.MinLength);
 			keySize.setAttribute("max", alg.MaxLength);
 			keySize.setAttribute("step", alg.IncrementLength);
 			keySize.setAttribute("value", alg.DefaultLength);
 			keySize.value = ""+alg.DefaultLength;
-			
+
 			// ugly, but buggy otherwise if done with text nodes
 			keySizeMin.innerHTML = alg.MinLength;
 			keySizeMax.innerHTML = alg.MaxLength;
 			keySizeStep.innerHTML = alg.IncrementLength;
-			
+
 			return true;
 		}
-		
-		
+
 		/// Fill the algorithm list
 		var getAlgorithmList = function () {
 			var i;
@@ -181,9 +168,9 @@ var CAcert_keygen_IE = function () {
 			if (!providerList) {
 				return false;
 			}
-			
+
 			var csp = getProvider();
-			
+
 			cspStats = providerList.GetCspStatusesFromOperations(
 					0x1c, //XCN_NCRYPT_ANY_ASYMMETRIC_OPERATION
 					//0x10, //XCN_NCRYPT_SIGNATURE_OPERATION
@@ -191,43 +178,41 @@ var CAcert_keygen_IE = function () {
 					//0x4, //XCN_NCRYPT_ASYMMETRIC_ENCRYPTION_OPERATION
 					csp
 				);
-			
+
 			removeChildren(algorithm);
 			for (i = 0; i < cspStats.Count; i++) {
 				var alg = cspStats.ItemByIndex(i).CspAlgorithm;
 				algorithm.appendChild(option(alg.Name, i));
 			}
-			
+
 			return getKeySizeList();
 		}
-		
-		
+
 		/// Fill the crypto provider list
 		var getProviderList = function () {
 			var i;
 			
 			var csps = factory.CreateObject("X509Enrollment.CCspInformations");
-			
+
 			// Get provider information
 			csps.AddAvailableCsps();
-			
+
 			removeChildren(provider);
-			
+
 			for (i = 0; i < csps.Count; i++) {
 				var csp = csps.ItemByIndex(i);
 				provider.appendChild(option(csp.Name, i));
 			}
-			
+
 			providerList = csps;
-			
+
 			return getAlgorithmList();
 		}
-		
-		
+
 		/// Generate a key and create and submit the actual CSR
 		var createCSR = function () {
 			var providerName, algorithmOid, bits;
-			
+
 			var level = securityLevel.options[securityLevel.selectedIndex];
 			if (level.value === "custom") {
 				providerName = getProvider().Name;
@@ -238,30 +223,27 @@ var CAcert_keygen_IE = function () {
 					window.alert(invalidKeySizeError.innerHTML);
 					return false;
 				}
-				
 			} else {
-				
 				providerName = "Microsoft Software Key Storage Provider";
-				
+
 				algorithmOid = factory.CreateObject("X509Enrollment.CObjectId");
 				algorithmOid.InitializeFromValue("1.2.840.113549.1.1.1"); // RSA
 				//"1.2.840.10040.4.1" == DSA
 				//"1.2.840.10046.2.1" == DH
-				
+
 				if (level.value === "high") {
 					bits = 4096;
 				} else { // medium
 					bits = 2048;
 				}
 			}
-			
-			
+
 			var privateKey = factory.CreateObject("X509Enrollment.CX509PrivateKey");
 			privateKey.ProviderName = providerName;
 			privateKey.Algorithm = algorithmOid;
 			privateKey.Length = bits;
 			privateKey.KeyUsage = 0xffffff; // XCN_NCRYPT_ALLOW_ALL_USAGES
-			
+
 			var request = factory.CreateObject(
 				"X509Enrollment.CX509CertificateRequestPkcs10");
 			request.InitializeFromPrivateKey(
@@ -269,13 +251,12 @@ var CAcert_keygen_IE = function () {
 					privateKey,
 					"" // don't use a template
 				);
-			
+
 			var enroll = factory.CreateObject("X509Enrollment.CX509Enrollment");
 			enroll.InitializeFromRequest(request);
-			
+
 			generatingKeyNotice.style.display = "";
-			
-			
+
 			// The request needs to be created after we return so the "please wait"
 			// message gets rendered
 			var createCSRHandler = function () {
@@ -288,14 +269,13 @@ var CAcert_keygen_IE = function () {
 				
 				generatingKeyNotice.style.display = "none";
 			}
-			
+
 			window.setTimeout(createCSRHandler, 0);
-			
+
 			// Always return false, form is submitted by deferred method
 			return false;
 		}
-		
-		
+
 		/// Call if securityLevel has changed
 		var refreshSecurityLevel = function () {
 			var level = securityLevel.options[securityLevel.selectedIndex];
@@ -306,21 +286,20 @@ var CAcert_keygen_IE = function () {
 				customSettings.style.display = "none";
 			}
 		}
-		
+
 		securityLevel.onchange = refreshSecurityLevel;
 		provider.onchange = getAlgorithmList;
 		algorithm.onchange = getKeySizeList;
 		genReq.onclick = createCSR;
-		
+
 		return true;
 	} // end of initCertEnroll()
-	
-	
+
 	/// Initialise Xenroll code (XP and lower)
 	/// returns false if initialisation fails
 	var initXEnroll = function () {
 		cenroll = null;
-		
+
 		providerTypes = Array(
 				 1, //PROV_RSA_FULL
 				 2, //PROV_RSA_SIG
@@ -341,7 +320,7 @@ var CAcert_keygen_IE = function () {
 				23, //PROV_REPLACE_OWF
 				24  //PROV_RSA_AES
 			);
-		
+
 		algClasses = Array(
 				1 << 13, //ALG_CLASS_SIGNATURE
 				//2 << 13, //ALG_CLASS_MSG_ENCRYPT
@@ -349,125 +328,114 @@ var CAcert_keygen_IE = function () {
 				//4 << 13, //ALG_CLASS_HASH
 				5 << 13  //ALG_CLASS_KEY_EXCHANGE
 			);
-		
+
 		// Try to initialise the ActiveX element.
 		try {
 			cenroll = new ActiveXObject("CEnroll.CEnroll");
-			
+
 			if (!cenroll) {
 				throw {
 					name: "NoObjectError",
 					message: "Got null at object creation"
 				};
 			}
-			
+
 			form.style.display = "";
 			algorithm.disabled = true;
 			noActiveX.style.display = "none";
 		} catch (e) {
 			return false;
 		}
-		
-		
+
 		/// Get the name of the selected provider
 		var getProviderName = function () {
 			return provider.options[provider.selectedIndex].text;
 		}
-		
-		
+
 		/// Get the type of the selected provider
 		var getProviderType = function () {
 			return parseInt(provider.options[provider.selectedIndex].value, 10);
 		}
-		
-		
+
 		var refreshProvider = function () {
 			cenroll.ProviderName = getProviderName();
 			cenroll.ProviderType = getProviderType();
 		}
-		
-		
+
 		/// Get the ID of the selected algorithm
 		var getAlgorithmId = function () {
 			return parseInt(
 					algorithm.options[algorithm.selectedIndex].value, 10);
 		}
-		
-		
+
 		/// Minimum bit length for exchange keys
 		var getMinExKeyLength = function () {
 			refreshProvider();
-			
+
 			try {
 				return cenroll.GetKeyLen(true, true);
 			} catch (e) {
 				return false;
 			}
 		}
-		
-		
+
 		/// Maximum bit length for exchange keys
 		var getMaxExKeyLength = function () {
 			refreshProvider();
-			
+
 			try {
 				return cenroll.GetKeyLen(false, true);
 			} catch (e) {
 				return false;
 			}
 		}
-		
-		
+
 		/// Step size for exchange keys
 		/// This might not be available on older platforms
 		var getStepExKeyLength = function () {
 			refreshProvider();
-			
+
 			try {
 				return cenroll.GetKeyLenEx(3, 1);
 			} catch (e) {
 				return false;
 			}
 		}
-		
-		
+
 		/// Minimum bit length for signature keys
 		var getMinSigKeyLength = function () {
 			refreshProvider();
-			
+
 			try {
 				return cenroll.GetKeyLen(true, false);
 			} catch (e) {
 				return false;
 			}
 		}
-		
-		
+
 		/// Maximum bit length for signature keys
 		var getMaxSigKeyLength = function () {
 			refreshProvider();
-			
+
 			try {
 				return cenroll.GetKeyLen(false, false);
 			} catch (e) {
 				return false;
 			}
 		}
-		
-		
+
 		/// Step size for signature keys
 		/// This might not be available on older platforms
 		var getStepSigKeyLength = function () {
 			refreshProvider();
-			
+
 			try {
 				return cenroll.GetKeyLenEx(3, 2);
 			} catch (e) {
 				return false;
 			}
 		}
-		
-		
+
 		/// Get the selected key size
 		var getKeySize = function () {
 			var bits = parseInt(keySize.value, 10);
@@ -479,11 +447,10 @@ var CAcert_keygen_IE = function () {
 			{
 				return false;
 			}
-			
+
 			return bits;
 		}
-		
-		
+
 		var getKeySizeLimits = function () {
 			// HTML5 attributes
 			keySize.setAttribute("min", getMinSigKeyLength());
@@ -491,28 +458,27 @@ var CAcert_keygen_IE = function () {
 			if (getStepSigKeyLength()) {
 				keySize.setAttribute("step", getStepSigKeyLength());
 			}
-			
+
 			// ugly, but buggy otherwise if done with text nodes
 			keySizeMin.innerHTML = getMinSigKeyLength();
 			keySizeMax.innerHTML = getMaxSigKeyLength();
 			keySizeStep.innerHTML = getStepSigKeyLength();
-			
+
 			if (getMinSigKeyLength() === getMaxSigKeyLength()) {
 				keySize.value = getMaxSigKeyLength();
 			}
-			
+
 			return true;
 		}
-		
-		
+
 		/// Fill the algorithm selection box
 		var getAlgorithmList = function () {
 			var i, j;
 			
 			refreshProvider();
-			
+
 			removeChildren(algorithm);
-			
+
 			for (i = 0; i < algClasses.length; ++i) {
 				for (j = 0; true; ++j) {
 					try {
@@ -524,20 +490,19 @@ var CAcert_keygen_IE = function () {
 					}
 				}
 			}
-			
+
 			getKeySizeLimits();
 		}
-		
-		
+
 		/// Fill the provider selection box
 		var getProviderList = function () {
 			var i, j;
 			
 			removeChildren(provider);
-			
+
 			for (i = 0; i < providerTypes.length; ++i) {
 				cenroll.providerType = providerTypes[i];
-				
+
 				var providerName = "invalid";
 				for (j = 0; true; ++j) {
 					try {
@@ -549,43 +514,38 @@ var CAcert_keygen_IE = function () {
 					}
 				}
 			}
-			
+
 			return getAlgorithmList();
 		}
-		
-		
+
 		var createCSR = function () {
 			var providerName, bits;
-			
+
 			var level = securityLevel.options[securityLevel.selectedIndex];
 			if (level.value === "custom") {
-				
 				refreshProvider();
-				
+
 				bits = getKeySize();
 				if (bits === false) {
 					window.alert(invalidKeySizeError.innerHTML);
 					return false;
 				}
-				
 			} else {
-				
 				cenroll.ProviderName = "Microsoft Enhanced Cryptographic Provider v1.0";
 				cenroll.ProviderType = 1; //PROV_RSA_FULL
-				
+
 				if (level.value === "high") {
 					bits = 4096;
 				} else { // medium
 					bits = 2048;
 				}
 			}
-			
+
 			cenroll.GenKeyFlags = bits << 16; // keysize is encoded in the uper 16 bits
 			//cenroll.GenKeyFlags = cenroll.GenKeyFlags | 0x1; //CRYPT_EXPORTABLE
-			
+
 			generatingKeyNotice.style.display = "";
-			
-			
+
 			// The request needs to be created after we return so the "please wait"
 			// message gets rendered
 			var createCSRHandler = function () {
@@ -603,18 +563,17 @@ var CAcert_keygen_IE = function () {
 						showError(createRequestError.innerHTML, e);
 					}
 				}
-				
+
 				generatingKeyNotice.style.display = "none";
 				cenroll.Reset();
 			}
-			
+
 			window.setTimeout(createCSRHandler, 0);
-			
+
 			// Always return false, form is submitted by deferred method
 			return false;
 		}
-		
-		
+
 		/// Call if securityLevel has changed
 		var refreshSecurityLevel = function () {
 			var level = securityLevel.options[securityLevel.selectedIndex];
@@ -625,16 +584,15 @@ var CAcert_keygen_IE = function () {
 				customSettings.style.display = "none";
 			}
 		}
-		
+
 		securityLevel.onchange = refreshSecurityLevel;
 		provider.onchange = getAlgorithmList;
 		algorithm.onchange = getKeySizeLimits;
 		genReq.onclick = createCSR;
-		
+
 		return true;
 	};
-	
-	
+
 	// Run the init functions until one is successful
 	if (initCertEnroll()) {
 		form.style.display = "";
-- 
cgit v1.2.1


From eb9bfa0ac504561920a9bf0ba6d5f8c4f6aa51d3 Mon Sep 17 00:00:00 2001
From: Benny Baumann <BenBE@geshi.org>
Date: Tue, 19 Feb 2013 18:24:34 +0100
Subject: bug 964: Unbreak lines and do some proper indentation and spacing

---
 includes/keygen.php | 57 ++++++++++++++++++++++++-----------------------------
 www/keygenIE.js     | 56 +++++++++++++++++++++++++---------------------------
 2 files changed, 53 insertions(+), 60 deletions(-)

diff --git a/includes/keygen.php b/includes/keygen.php
index 866c5f2..da80aa0 100644
--- a/includes/keygen.php
+++ b/includes/keygen.php
@@ -16,23 +16,19 @@
     Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
 */
 
-if (array_key_exists('HTTP_USER_AGENT',$_SERVER) &&
-		strstr($_SERVER['HTTP_USER_AGENT'], "MSIE")) { ?>
+if (array_key_exists('HTTP_USER_AGENT',$_SERVER) && strstr($_SERVER['HTTP_USER_AGENT'], "MSIE")) { ?>
 
 	<noscript>
-		<p><?=_('You have to enable JavaScript to generate certificates in '.
-				'the browser.')?></p>
+		<p><?=_('You have to enable JavaScript to generate certificates in the browser.')?></p>
 		<p><?=_('If you don\'t want to do that for any reason, you can use '.
-				'manually created certificate requests instead.')?></p>
+			'manually created certificate requests instead.')?></p>
 	</noscript>
 
 	<div id="noActiveX" style="color:red">
-		<p><?=_('Could not initialize ActiveX object required for certificate '.
-				'generation.')?></p>
-		<p><?=_('You have to enable ActiveX for this to work. On Windows '.
-				'Vista, Windows 7 and later versions you have to add this '.
-				'website to the list of trusted sites in the internet '.
-				'settings.')?></p>
+		<p><?=_('Could not initialize ActiveX object required for certificate generation.')?></p>
+		<p><?=_('You have to enable ActiveX for this to work. On Windows Vista, Windows 7 and '.
+			'later versions you have to add this website to the list of trusted sites '.
+			'in the internet settings.')?></p>
 		<p><?php
 			printf(_('Go to "Extras -> Internet Options -> Security -> Trusted '.
 				'Websites", click on "Custom Level", set "ActiveX control '.
@@ -78,13 +74,12 @@ if (array_key_exists('HTTP_USER_AGENT',$_SERVER) &&
 				echo _('Step')?>: <span id="keySizeStep"></span></p>
 			<p style="color:red"><?php
 				printf(_('Please note that RSA key sizes smaller than %d bit '.
-						'will not be accepted by CAcert.'),
-						1024)?>
+					'will not be accepted by CAcert.'),
+					1024)?>
 			</p>
 		</fieldset>
 
-		<p><input type="submit" id="GenReq" name="GenReq"
-				value="<?=_('Create Certificate')?>" /></p>
+		<p><input type="submit" id="GenReq" name="GenReq" value="<?=_('Create Certificate')?>" /></p>
 		<p id="generatingKeyNotice" style="display:none">
 			<?=_('Generating your key. Please wait')?>&hellip;</p>
 	</form>
@@ -93,15 +88,15 @@ if (array_key_exists('HTTP_USER_AGENT',$_SERVER) &&
 	translated without passing the JavaScript code through PHP -->
 	<p id="createRequestErrorChooseAlgorithm" style="display:none">
 		<?=_('Could not generate certificate request. Probably you need to '.
-				'choose a different algorithm.')?>
+			'choose a different algorithm.')?>
 	</p>
 	<p id="createRequestErrorConfirmDialogue" style="display:none">
 		<?=_('Could not generate certificate request. Please confirm the '.
-				'dialogue if you are asked if you want to generate the key.')?>
+			'dialogue if you are asked if you want to generate the key.')?>
 	</p>
 	<p id="createRequestErrorConnectDevice" style="display:none">
 		<?=_('Could not generate certificate request. Please make sure the '.
-				'cryptography device (e.g. the smartcard) is connected.')?>
+			'cryptography device (e.g. the smartcard) is connected.')?>
 	</p>
 	<p id="createRequestError" style="display:none">
 		<?=_('Could not generate certificate request.')?>
@@ -111,23 +106,23 @@ if (array_key_exists('HTTP_USER_AGENT',$_SERVER) &&
 	</p>
 	<p id="unsupportedPlatformError" style="display:none">
 		<?=_('Could not initialize the cryptographic module for your '.
-				'platform. Currently we support Microsoft Windows XP, Vista '.
-				'and 7. If you\'re using one of these platforms and see this '.
-				'error message anyway you might have to enable ActiveX as '.
-				'described in the red explanation text and accept loading of '.
-				'the module.')?>
+			'platform. Currently we support Microsoft Windows XP, Vista '.
+			'and 7. If you\'re using one of these platforms and see this '.
+			'error message anyway you might have to enable ActiveX as '.
+			'described in the red explanation text and accept loading of '.
+			'the module.')?>
 	</p>
 
 	<script type="text/javascript" src="keygenIE.js"></script>
 
 <? } else { ?>
-    <p>
-    <form method="post" action="account.php">
-        <input type="hidden" name="keytype" value="NS">
-        <?=_("Keysize:")?> <keygen name="SPKAC" challenge="<? $_SESSION['spkac_hash']=make_hash(); echo $_SESSION['spkac_hash']; ?>">
+	<p>
+		<form method="post" action="account.php">
+			<input type="hidden" name="keytype" value="NS">
+			<?=_("Keysize:")?> <keygen name="SPKAC" challenge="<? $_SESSION['spkac_hash']=make_hash(); echo $_SESSION['spkac_hash']; ?>">
 
-        <input type="submit" name="submit" value="<?=_("Create Certificate Request")?>">
-        <input type="hidden" name="oldid" value="<?=$id?>">
-    </form>
-    </p>
+			<input type="submit" name="submit" value="<?=_("Create Certificate Request")?>">
+			<input type="hidden" name="oldid" value="<?=$id?>">
+		</form>
+	</p>
 <? }
diff --git a/www/keygenIE.js b/www/keygenIE.js
index 2c2018e..3a63f9b 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -54,10 +54,12 @@ var CAcert_keygen_IE = function () {
 
 	/// Show error message to user from exception
 	var showError = function (message, exception) {
-		window.alert(message +
-				"\n\nError: " + exception.message +
-				" (0x" + (0xFFFFFFFF + exception.number +1).toString(16) +
-				" / " + exception.number + ")");
+		window.alert(
+			message +
+			"\n\nError: " + exception.message +
+			" (0x" + (0xFFFFFFFF + exception.number + 1).toString(16) +
+			" / " + exception.number + ")"
+			);
 	}
 
 	// Get important elements from the DOM
@@ -91,13 +93,12 @@ var CAcert_keygen_IE = function () {
 
 		// Try to initialise the ActiveX element. Requires permissions by the user
 		try {
-			factory = new ActiveXObject(
-				"X509Enrollment.CX509EnrollmentWebClassFactory");
+			factory = new ActiveXObject("X509Enrollment.CX509EnrollmentWebClassFactory");
 			if (!factory) {
 				throw {
 					name: "NoObjectError",
 					message: "Got null at object creation"
-				};
+					};
 			}
 
 			// also try to create a useless object here so the library gets
@@ -172,11 +173,11 @@ var CAcert_keygen_IE = function () {
 			var csp = getProvider();
 
 			cspStats = providerList.GetCspStatusesFromOperations(
-					0x1c, //XCN_NCRYPT_ANY_ASYMMETRIC_OPERATION
-					//0x10, //XCN_NCRYPT_SIGNATURE_OPERATION
-					//0x8, //XCN_NCRYPT_SECRET_AGREEMENT_OPERATION
-					//0x4, //XCN_NCRYPT_ASYMMETRIC_ENCRYPTION_OPERATION
-					csp
+				0x1c, //XCN_NCRYPT_ANY_ASYMMETRIC_OPERATION
+				//0x10, //XCN_NCRYPT_SIGNATURE_OPERATION
+				//0x8, //XCN_NCRYPT_SECRET_AGREEMENT_OPERATION
+				//0x4, //XCN_NCRYPT_ASYMMETRIC_ENCRYPTION_OPERATION
+				csp
 				);
 
 			removeChildren(algorithm);
@@ -228,8 +229,8 @@ var CAcert_keygen_IE = function () {
 
 				algorithmOid = factory.CreateObject("X509Enrollment.CObjectId");
 				algorithmOid.InitializeFromValue("1.2.840.113549.1.1.1"); // RSA
-				//"1.2.840.10040.4.1" == DSA
-				//"1.2.840.10046.2.1" == DH
+				// "1.2.840.10040.4.1" == DSA
+				// "1.2.840.10046.2.1" == DH
 
 				if (level.value === "high") {
 					bits = 4096;
@@ -244,12 +245,11 @@ var CAcert_keygen_IE = function () {
 			privateKey.Length = bits;
 			privateKey.KeyUsage = 0xffffff; // XCN_NCRYPT_ALLOW_ALL_USAGES
 
-			var request = factory.CreateObject(
-				"X509Enrollment.CX509CertificateRequestPkcs10");
+			var request = factory.CreateObject("X509Enrollment.CX509CertificateRequestPkcs10");
 			request.InitializeFromPrivateKey(
-					1, // ContextUser
-					privateKey,
-					"" // don't use a template
+				1, // ContextUser
+				privateKey,
+				"" // don't use a template
 				);
 
 			var enroll = factory.CreateObject("X509Enrollment.CX509Enrollment");
@@ -266,7 +266,7 @@ var CAcert_keygen_IE = function () {
 				} catch (e) {
 					showError(createRequestErrorChooseAlgorithm.innerHTML, e);
 				}
-				
+
 				generatingKeyNotice.style.display = "none";
 			}
 
@@ -322,11 +322,11 @@ var CAcert_keygen_IE = function () {
 			);
 
 		algClasses = Array(
-				1 << 13, //ALG_CLASS_SIGNATURE
-				//2 << 13, //ALG_CLASS_MSG_ENCRYPT
-				//3 << 13, //ALG_CLASS_DATA_ENCRYPT
-				//4 << 13, //ALG_CLASS_HASH
-				5 << 13  //ALG_CLASS_KEY_EXCHANGE
+			1 << 13, //ALG_CLASS_SIGNATURE
+			//2 << 13, //ALG_CLASS_MSG_ENCRYPT
+			//3 << 13, //ALG_CLASS_DATA_ENCRYPT
+			//4 << 13, //ALG_CLASS_HASH
+			5 << 13  //ALG_CLASS_KEY_EXCHANGE
 			);
 
 		// Try to initialise the ActiveX element.
@@ -364,8 +364,7 @@ var CAcert_keygen_IE = function () {
 
 		/// Get the ID of the selected algorithm
 		var getAlgorithmId = function () {
-			return parseInt(
-					algorithm.options[algorithm.selectedIndex].value, 10);
+			return parseInt(algorithm.options[algorithm.selectedIndex].value, 10);
 		}
 
 		/// Minimum bit length for exchange keys
@@ -507,8 +506,7 @@ var CAcert_keygen_IE = function () {
 				for (j = 0; true; ++j) {
 					try {
 						providerName = cenroll.enumProviders(j, 0);
-						provider.appendChild(
-								option(providerName, providerTypes[i]));
+						provider.appendChild(option(providerName, providerTypes[i]));
 					} catch (e) {
 						break;
 					}
-- 
cgit v1.2.1


From 387fde16ca52b6ccfc5a46be99219cd09a7411ce Mon Sep 17 00:00:00 2001
From: Benny Baumann <BenBE@geshi.org>
Date: Tue, 19 Feb 2013 18:25:51 +0100
Subject: bug 964: Reduce variable scope where possible

---
 www/keygenIE.js | 20 ++++++--------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/www/keygenIE.js b/www/keygenIE.js
index 3a63f9b..e6dd911 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -164,8 +164,6 @@ var CAcert_keygen_IE = function () {
 
 		/// Fill the algorithm list
 		var getAlgorithmList = function () {
-			var i;
-			
 			if (!providerList) {
 				return false;
 			}
@@ -181,7 +179,7 @@ var CAcert_keygen_IE = function () {
 				);
 
 			removeChildren(algorithm);
-			for (i = 0; i < cspStats.Count; i++) {
+			for (var i = 0; i < cspStats.Count; i++) {
 				var alg = cspStats.ItemByIndex(i).CspAlgorithm;
 				algorithm.appendChild(option(alg.Name, i));
 			}
@@ -191,8 +189,6 @@ var CAcert_keygen_IE = function () {
 
 		/// Fill the crypto provider list
 		var getProviderList = function () {
-			var i;
-			
 			var csps = factory.CreateObject("X509Enrollment.CCspInformations");
 
 			// Get provider information
@@ -200,7 +196,7 @@ var CAcert_keygen_IE = function () {
 
 			removeChildren(provider);
 
-			for (i = 0; i < csps.Count; i++) {
+			for (var i = 0; i < csps.Count; i++) {
 				var csp = csps.ItemByIndex(i);
 				provider.appendChild(option(csp.Name, i));
 			}
@@ -472,14 +468,12 @@ var CAcert_keygen_IE = function () {
 
 		/// Fill the algorithm selection box
 		var getAlgorithmList = function () {
-			var i, j;
-			
 			refreshProvider();
 
 			removeChildren(algorithm);
 
-			for (i = 0; i < algClasses.length; ++i) {
-				for (j = 0; true; ++j) {
+			for (var i = 0; i < algClasses.length; ++i) {
+				for (var j = 0; true; ++j) {
 					try {
 						var algId = cenroll.EnumAlgs(j, algClasses[i]);
 						var algName = cenroll.GetAlgName(algId);
@@ -495,15 +489,13 @@ var CAcert_keygen_IE = function () {
 
 		/// Fill the provider selection box
 		var getProviderList = function () {
-			var i, j;
-			
 			removeChildren(provider);
 
-			for (i = 0; i < providerTypes.length; ++i) {
+			for (var i = 0; i < providerTypes.length; ++i) {
 				cenroll.providerType = providerTypes[i];
 
 				var providerName = "invalid";
-				for (j = 0; true; ++j) {
+				for (var j = 0; true; ++j) {
 					try {
 						providerName = cenroll.enumProviders(j, 0);
 						provider.appendChild(option(providerName, providerTypes[i]));
-- 
cgit v1.2.1


From 15e708ae893f19f5df7756efb6099d83417f4259 Mon Sep 17 00:00:00 2001
From: Benny Baumann <BenBE@geshi.org>
Date: Tue, 19 Feb 2013 18:29:21 +0100
Subject: bug 964: Be a bit more paranoid here ...

---
 includes/keygen.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/keygen.php b/includes/keygen.php
index da80aa0..09ec7f9 100644
--- a/includes/keygen.php
+++ b/includes/keygen.php
@@ -43,7 +43,7 @@ if (array_key_exists('HTTP_USER_AGENT',$_SERVER) && strstr($_SERVER['HTTP_USER_A
 
 	<form method="post" style="display:none" action="account.php"
 			id="CertReqForm">
-		<input type="hidden" name="oldid" value="<?=$id?>" />
+		<input type="hidden" name="oldid" value="<?=intval($id)?>" />
 		<input type="hidden" id="CSR" name="CSR" />
 		<input type="hidden" name="keytype" value="MS" />
 
@@ -122,7 +122,7 @@ if (array_key_exists('HTTP_USER_AGENT',$_SERVER) && strstr($_SERVER['HTTP_USER_A
 			<?=_("Keysize:")?> <keygen name="SPKAC" challenge="<? $_SESSION['spkac_hash']=make_hash(); echo $_SESSION['spkac_hash']; ?>">
 
 			<input type="submit" name="submit" value="<?=_("Create Certificate Request")?>">
-			<input type="hidden" name="oldid" value="<?=$id?>">
+			<input type="hidden" name="oldid" value="<?=intval($id)?>">
 		</form>
 	</p>
 <? }
-- 
cgit v1.2.1


From 324c036d5823739afd6735e4c2a23b95b4dbcea6 Mon Sep 17 00:00:00 2001
From: Benny Baumann <BenBE@geshi.org>
Date: Tue, 19 Feb 2013 19:19:13 +0100
Subject: bug 964: Make the structure of some queries more easy to read

---
 www/keygenIE.js | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)

diff --git a/www/keygenIE.js b/www/keygenIE.js
index e6dd911..50faf76 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -128,11 +128,14 @@ var CAcert_keygen_IE = function () {
 			var alg = getAlgorithm();
 
 			var bits = parseInt(keySize.value, 10);
-			if ( bits < alg.MinLength || bits > alg.MaxLength ||
-					(alg.IncrementLength &&
-						(bits - alg.MinLength) % alg.IncrementLength !== 0)
+			if (
+				(bits < alg.MinLength) ||
+				(bits > alg.MaxLength) ||
+				(
+					alg.IncrementLength &&
+					((bits - alg.MinLength) % alg.IncrementLength !== 0)
 				)
-			{
+			) {
 				return false;
 			}
 
@@ -434,12 +437,14 @@ var CAcert_keygen_IE = function () {
 		/// Get the selected key size
 		var getKeySize = function () {
 			var bits = parseInt(keySize.value, 10);
-			if ( bits < getMinSigKeyLength() || bits > getMaxSigKeyLength() ||
-					(getStepSigKeyLength() &&
-						(bits - getMinSigKeyLength()) %
-							getStepSigKeyLength() !== 0)
+			if (
+				(bits < getMinSigKeyLength()) ||
+				(bits > getMaxSigKeyLength()) ||
+				(
+					getStepSigKeyLength() &&
+					((bits - getMinSigKeyLength()) % getStepSigKeyLength() !== 0)
 				)
-			{
+			) {
 				return false;
 			}
 
-- 
cgit v1.2.1


From 92b6e7dfe7c8e2a3ee8fa9ecbcb38634d288a8f4 Mon Sep 17 00:00:00 2001
From: Benny Baumann <BenBE@geshi.org>
Date: Wed, 20 Feb 2013 00:14:47 +0100
Subject: Revert "bug 964: Reduce variable scope where possible"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit 387fde16ca52b6ccfc5a46be99219cd09a7411ce.
Decision based on discussion with Michael Tänzer.
---
 www/keygenIE.js | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/www/keygenIE.js b/www/keygenIE.js
index 50faf76..be2d184 100644
--- a/www/keygenIE.js
+++ b/www/keygenIE.js
@@ -167,6 +167,8 @@ var CAcert_keygen_IE = function () {
 
 		/// Fill the algorithm list
 		var getAlgorithmList = function () {
+			var i;
+			
 			if (!providerList) {
 				return false;
 			}
@@ -182,7 +184,7 @@ var CAcert_keygen_IE = function () {
 				);
 
 			removeChildren(algorithm);
-			for (var i = 0; i < cspStats.Count; i++) {
+			for (i = 0; i < cspStats.Count; i++) {
 				var alg = cspStats.ItemByIndex(i).CspAlgorithm;
 				algorithm.appendChild(option(alg.Name, i));
 			}
@@ -192,6 +194,8 @@ var CAcert_keygen_IE = function () {
 
 		/// Fill the crypto provider list
 		var getProviderList = function () {
+			var i;
+			
 			var csps = factory.CreateObject("X509Enrollment.CCspInformations");
 
 			// Get provider information
@@ -199,7 +203,7 @@ var CAcert_keygen_IE = function () {
 
 			removeChildren(provider);
 
-			for (var i = 0; i < csps.Count; i++) {
+			for (i = 0; i < csps.Count; i++) {
 				var csp = csps.ItemByIndex(i);
 				provider.appendChild(option(csp.Name, i));
 			}
@@ -473,12 +477,14 @@ var CAcert_keygen_IE = function () {
 
 		/// Fill the algorithm selection box
 		var getAlgorithmList = function () {
+			var i, j;
+			
 			refreshProvider();
 
 			removeChildren(algorithm);
 
-			for (var i = 0; i < algClasses.length; ++i) {
-				for (var j = 0; true; ++j) {
+			for (i = 0; i < algClasses.length; ++i) {
+				for (j = 0; true; ++j) {
 					try {
 						var algId = cenroll.EnumAlgs(j, algClasses[i]);
 						var algName = cenroll.GetAlgName(algId);
@@ -494,13 +500,15 @@ var CAcert_keygen_IE = function () {
 
 		/// Fill the provider selection box
 		var getProviderList = function () {
+			var i, j;
+			
 			removeChildren(provider);
 
-			for (var i = 0; i < providerTypes.length; ++i) {
+			for (i = 0; i < providerTypes.length; ++i) {
 				cenroll.providerType = providerTypes[i];
 
 				var providerName = "invalid";
-				for (var j = 0; true; ++j) {
+				for (j = 0; true; ++j) {
 					try {
 						providerName = cenroll.enumProviders(j, 0);
 						provider.appendChild(option(providerName, providerTypes[i]));
-- 
cgit v1.2.1