diff --git a/.gitignore b/.gitignore
index f56c925342..7e09c0d4e9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -77,6 +77,7 @@ emhttp/plugins/pnpm-lock.yaml
 
 # api source code
 unraid-api/
+unraid/
 
 # Node.js version
 .node-version
@@ -88,6 +89,9 @@ lib/node_modules
 bin/
 sbin/unraid-api
 
+# Provided by Unraid API
+emhttp/redirect.htm
+
 # Unraid API readme/changelog
 emhttp/plugins/dynamix.unraid.net
 
diff --git a/emhttp/auth-request.php b/emhttp/auth-request.php
index b1c5ebea2d..dc21578877 100644
--- a/emhttp/auth-request.php
+++ b/emhttp/auth-request.php
@@ -14,8 +14,52 @@
   session_write_close();
 }
 
-// Include JS caching functions
-require_once '/usr/local/emhttp/webGui/include/JSCache.php';
+function isPathInDocroot(string $realPath, string $docroot): bool {
+  return $realPath === $docroot || str_starts_with($realPath, $docroot . '/');
+}
+
+function getCanonicalRequestUri(string $docroot): string {
+  $requestUri = getRequestUriPath();
+
+  $realRequestPath = realpath($docroot . '/' . ltrim($requestUri, '/'));
+  if (!is_string($realRequestPath) || !isPathInDocroot($realRequestPath, $docroot)) {
+    return '';
+  }
+
+  $canonicalRequestUri = substr($realRequestPath, strlen($docroot));
+  return $canonicalRequestUri === '' ? '/' : $canonicalRequestUri;
+}
+
+function isWebComponentsRequest(string $requestUri): bool {
+  $webComponentsDirectory = '/plugins/dynamix.my.servers/unraid-components';
+  return $requestUri === $webComponentsDirectory || str_starts_with($requestUri, $webComponentsDirectory . '/');
+}
+
+function getRequestUriPath(): string {
+  $requestUri = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
+  return is_string($requestUri) ? $requestUri : '/';
+}
+
+function getAllowedExternalPublicAssetTargets(): array {
+  return [
+    '/webGui/images/case-model.png' => '/boot/config/plugins/dynamix/case-model.png',
+  ];
+}
+
+function isAllowedPublicAssetRequest(string $requestUri, string $docroot, array $arrWhitelist): bool {
+  if (!in_array($requestUri, $arrWhitelist, true)) {
+    return false;
+  }
+
+  $realRequestPath = realpath($docroot . '/' . ltrim($requestUri, '/'));
+  if (is_string($realRequestPath) && isPathInDocroot($realRequestPath, $docroot)) {
+    return true;
+  }
+
+  $allowedExternalTargets = getAllowedExternalPublicAssetTargets();
+  return isset($allowedExternalTargets[$requestUri]) &&
+    $realRequestPath === $allowedExternalTargets[$requestUri];
+}
 
 // Base whitelist of files
 $arrWhitelist = [
@@ -54,12 +98,22 @@
   '/manifest.json'
 ];
 
-// Whitelist ALL files from the unraid-components directory
-$webComponentsDirectory = '/plugins/dynamix.my.servers/unraid-components/';
-$requestUri = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH) ?? '/';
+// Use canonical filesystem path checks against the trusted docroot.
+$docroot = '/usr/local/emhttp';
+$requestUri = getRequestUriPath();
+$canonicalRequestUri = getCanonicalRequestUri($docroot);
+
+// Allow explicit public assets with strict target checks.
+if (isAllowedPublicAssetRequest($requestUri, $docroot, $arrWhitelist)) {
+  http_response_code(200);
+  exit;
+}
 
-// Check if the request is for any file in the unraid-components directory
-if (str_starts_with($requestUri, $webComponentsDirectory) || in_array($requestUri, $arrWhitelist)) {
+// Allow canonical requests under unraid-components.
+if (
+  $canonicalRequestUri !== '' &&
+  isWebComponentsRequest($canonicalRequestUri)
+) {
   // authorized
   http_response_code(200);
 } else {
diff --git a/emhttp/languages/en_US/helptext.txt b/emhttp/languages/en_US/helptext.txt
index 08a4d856c9..e66f84d57f 100644
--- a/emhttp/languages/en_US/helptext.txt
+++ b/emhttp/languages/en_US/helptext.txt
@@ -2367,6 +2367,12 @@ Generally speaking, it is recommended to leave this setting to its default value
 IMPORTANT NOTE:  If adjusting port mappings, do not modify the settings for the Container port as only the Host port can be adjusted.
 :end
 
+:docker_fixed_mac_help:
+Assigns the container's MAC address on the selected Docker network endpoint. Use a valid unicast MAC address; the first octet must be even, e.g. 02:42:9a:0d:7e:c0.
+
+This avoids using the legacy container-level --mac-address option in Extra Parameters.
+:end
+
 :docker_container_network_help:
 This allows your container to utilize the network configuration of another container. Select the appropriate container from the list.<br>This setup can be particularly beneficial if you wish to route your container's traffic through a VPN.
 :end
diff --git a/emhttp/plugins/dynamix.docker.manager/DockerContainers.page b/emhttp/plugins/dynamix.docker.manager/DockerContainers.page
index 8cf6e687ca..053c6d9585 100755
--- a/emhttp/plugins/dynamix.docker.manager/DockerContainers.page
+++ b/emhttp/plugins/dynamix.docker.manager/DockerContainers.page
@@ -37,7 +37,7 @@ $cpus    = cpu_list();
                 <th><a id="resetsort" class="nohand" onclick="resetSorting()" title="_(Reset sorting)_"><i class="fa fa-th-list"></i></a>_(Application)_</th>
                 <th>_(Version)_</th>
                 <th>_(Network)_</th>
-                <th>_(Container IP)_</th>
+                <th>_(Container IP)_ <span class="advanced">/ _(MAC)_</span></th>
                 <th>_(Container Port)_</th>
                 <th>_(LAN IP:Port)_</th>
                 <th>_(Volume Mappings)_ <small>(_(App to Host)_)</small></th>
@@ -46,7 +46,7 @@ $cpus    = cpu_list();
                 <th class="five">_(Uptime)_</th>
             </tr>
         </thead>
-        <tbody id="docker_list" class="js-fill-available-height"><tr><td colspan='9'></td></tr></tbody>
+        <tbody id="docker_list" class="js-fill-available-height"><tr><td colspan='10'></td></tr></tbody>
     </table>
 </div>
 
diff --git a/emhttp/plugins/dynamix.docker.manager/DockerSettings.page b/emhttp/plugins/dynamix.docker.manager/DockerSettings.page
index d6f7893d26..5329d04309 100644
--- a/emhttp/plugins/dynamix.docker.manager/DockerSettings.page
+++ b/emhttp/plugins/dynamix.docker.manager/DockerSettings.page
@@ -115,6 +115,17 @@ function base_net($route) {
   return substr(explode('/',$route)[0],0,-2);
 }
 
+// Derive the IPv4 gateway rc.docker would use when none is configured:
+// the subnet's first usable host (e.g. 192.168.10.0/24 -> 192.168.10.1).
+// Calls the same scripts/derive_gateway helper rc.docker uses, so the logic
+// is not duplicated. Returns '' if not derivable.
+function derive_gw($route) {
+  global $docroot;
+  $route = trim((string)$route);
+  if ($route === '') return '';
+  return exec($docroot."/plugins/dynamix.docker.manager/scripts/derive_gateway ".escapeshellarg($route));
+}
+
 $bgcolor = $themeHelper->isLightTheme() ? '#f2f2f2' : '#1c1c1c'; // $themeHelper set in DefaultPageLayout.php
 
 //Check if docker.cfg does exist
@@ -315,6 +326,7 @@ _(Preserve user defined networks)_:
 $net = normalize($network);
 $docker_auto = "DOCKER_AUTO_$net";
 $docker_dhcp = "DOCKER_DHCP_$net";
+$docker_gw   = "DOCKER_GATEWAY_$net";
 ?>
 <input type="hidden" name="<?=$docker_auto?>" value="<?=_var($dockercfg,$docker_auto)?>">
 
@@ -369,8 +381,9 @@ _(IPv4 custom network on interface)_ <?=$network?> (_(optional)_):
       <span class="<?=$ip4class?>">
         <strong><?=_('Subnet')?>:</strong> <?=str_replace(' ', '<br><b>'._('Subnet').': </b>', $route)?>
       </span>
-      <span class="<?=$gw4class?>">
-        <strong><?=_('Gateway')?>:</strong> <?=$gateway[$network] ?: '---'?>
+      <span class="<?=$gw4class?> flex flex-row items-center gap-2">
+        <strong><?=_('Gateway')?>:</strong>
+        <input type="text" id="<?=$docker_dhcp?>_gw" name="<?=$docker_gw?>" class="ip4" value="<?=htmlspecialchars(_var($dockercfg,$docker_gw))?>" placeholder="<?=htmlspecialchars($gateway[$network] ?: derive_gw($route))?>" title="_(IPv4 address A.B.C.D)_"<?=$autoDisabled?>>
       </span>
       <span class="flex flex-row items-center gap-2">
         <span class="flex flex-row items-center gap-2">
@@ -464,6 +477,7 @@ _(IPv4 custom network on interface)_ <?=$network?> (_(optional)_):
 $net = normalize($network);
 $docker_auto  = "DOCKER_AUTO_$net";
 $docker_dhcp6 = "DOCKER_DHCP6_$net";
+$docker_gw6   = "DOCKER_GATEWAY6_$net";
 ?>
 <?if ($network != 'wlan0' || lan_port('wlan0',true) == 1):?>
 
@@ -485,7 +499,10 @@ _(IPv6 custom network on interface)_ <?=$network?> (_(optional)_):
     </label>
     <span id="<?=$docker_dhcp6?>_line" class="<?=$auto6Disabled?>">
       <span class="ip6">**_(Subnet)_:** <?=str_replace(' ', '<br><b>'._('Subnet').': </b>', $route)?></span>
-      <span class="gw6">**_(Gateway)_:** <?=$gateway6[$network] ?: '---'?></span>
+      <span class="gw6 flex flex-row items-center gap-2">
+        <strong><?=_('Gateway')?>:</strong>
+        <input type="text" id="<?=$docker_dhcp6?>_gw" name="<?=$docker_gw6?>" class="gw6" value="<?=htmlspecialchars(_var($dockercfg,$docker_gw6))?>" placeholder="<?=htmlspecialchars($gateway6[$network] ?: '')?>" title="_(IPv6 address nnnn:xxxx::yyyy)_"<?=$auto6Disabled?>>
+      </span>
     </span>
   </span>
 
@@ -591,7 +608,7 @@ $docker_dhcp = "DOCKER_DHCP_$net";
 _(IPv4 custom network on interface)_ <?=$network?>:
 : <span class="flex flex-row flex-wrap items-center gap-4">
     <span class="<?=$gw4class?>">**_(Subnet)_:** <?=str_replace(' ', '<br><b>'._('Subnet').': </b>', $route)?></span>
-    <span class="<?=$gw4class?>">**_(Gateway)_:** <?=$gateway[$network] ?: '---'?></span>
+    <span class="<?=$gw4class?>">**_(Gateway)_:** <?=$gateway[$network] ?: (_var($dockercfg,"DOCKER_GATEWAY_$net") ?: (derive_gw($route) ?: '---'))?></span>
     <span>**_(DHCP pool)_:** <?=_var($dockercfg,$docker_dhcp) ?: "_(not set)_"?><?if (isset($dockercfg[$docker_dhcp])):?>&nbsp;&nbsp;(<?=pow(2,32-my_explode('/',$dockercfg[$docker_dhcp])[1])?> _(hosts)_)<?endif;?></span>
   </span>
 
@@ -784,7 +801,9 @@ function prepareDocker(form) {
     $(mask).prop('disabled',true);
   });
   $(form).find('input[name^="DOCKER_GATEWAY_"]').each(function(){
-    var edit = '#'+$(this).attr('name').replace('GATEWAY','CUSTOM')+'_edit';
+    var custom = '#'+$(this).attr('name').replace('GATEWAY','CUSTOM')+'_edit';
+    var auto = '#'+$(this).attr('name').replace('GATEWAY','DHCP')+'_edit';
+    var edit = $(custom).length ? custom : auto;
     if (!$(edit).prop('checked')) $(this).val('').prop('disabled',false);
   });
   $(form).find('input[name^="DOCKER_RANGE_"]').each(function(){
@@ -809,7 +828,9 @@ function prepareDocker(form) {
     $(mask6).prop('disabled',true);
   });
   $(form).find('input[name^="DOCKER_GATEWAY6_"]').each(function(){
-    var edit6 = '#'+$(this).attr('name').replace('GATEWAY','CUSTOM')+'_edit';
+    var custom6 = '#'+$(this).attr('name').replace('GATEWAY','CUSTOM')+'_edit';
+    var auto6 = '#'+$(this).attr('name').replace('GATEWAY','DHCP')+'_edit';
+    var edit6 = $(custom6).length ? custom6 : auto6;
     if (!$(edit6).prop('checked')) $(this).val('').prop('disabled',false);
   });
   $(form).find('input[name^="DOCKER_RANGE6_"]').each(function(){
@@ -842,6 +863,7 @@ function changeEdit(id, ip) {
     auto.val(auto.val().replace(ip,''));
     if (auto.val() == '') auto.val('no');
   }
+  $(id1+'gw').prop('disabled',!checked);
   changeDHCP(id, ip, $('#'+id.replace('edit','dhcp')).prop('checked'));
 }
 
diff --git a/emhttp/plugins/dynamix.docker.manager/include/CreateDocker.php b/emhttp/plugins/dynamix.docker.manager/include/CreateDocker.php
index 794faadfbe..2966cf214a 100755
--- a/emhttp/plugins/dynamix.docker.manager/include/CreateDocker.php
+++ b/emhttp/plugins/dynamix.docker.manager/include/CreateDocker.php
@@ -202,10 +202,9 @@ function cpu_pinning() {
     if (preg_match('/^container:(.*)/', $Network)) {
       $Net_Container = str_replace("container:", "", $Network);
     } else {
-      preg_match("/--(net|network)=container:[^\s]+/", $ExtraParams, $NetworkParam);
-      if (!empty($NetworkParam[0])) {
-        $Net_Container = explode(':', $NetworkParam[0])[1];
-        $Net_Container = str_replace(['"', "'"], '', $Net_Container);
+      preg_match("/--(?:net|network)(?:=|\s+)(['\"]?)container:([^'\"\s]+)\\1/", $ExtraParams, $NetworkParam);
+      if (!empty($NetworkParam[2])) {
+        $Net_Container = $NetworkParam[2];
       }
     }
     // check if the container still exists from which the network should be used, if it doesn't exist any more recreate container with network none and don't start it
@@ -213,7 +212,7 @@ function cpu_pinning() {
       $Net_Container_ID = $DockerClient->getContainerID($Net_Container);
       if (empty($Net_Container_ID)) {
         $cmd = str_replace('/docker run -d ', '/docker create ', $cmd);
-        $cmd = preg_replace("/--(net|network)=(['\"]?)container:[^'\"]+\\2/", "--network=none ", $cmd);
+        $cmd = preg_replace("/--(?:net|network)(?:=|\s+)(['\"]?)container:[^'\"\s]+\\1/", "--network=none ", $cmd);
       }
     }
     // force kill container if still running after time-out
@@ -736,6 +735,8 @@ function removeConfig(num) {
 
 function prepareConfig(form) {
   var types = [], values = [], targets = [], vcpu = [];
+  var myMAC = $(form).find('input[name="contMyMAC"]').val().trim().replaceAll('-', ':').toLowerCase();
+  $(form).find('input[name="contMyMAC"]').val(myMAC);
   if ($('select[name="contNetwork"]').val()=='host') {
     $(form).find('input[name="confType[]"]').each(function(){types.push($(this).val());});
     $(form).find('input[name="confValue[]"]').each(function(){values.push($(this));});
@@ -744,6 +745,7 @@ function prepareConfig(form) {
   }
   $(form).find('input[id^="box"]').each(function(){if ($(this).prop('checked')) vcpu.push($('#'+$(this).prop('id').replace('box','cpu')).text());});
   form.contCPUset.value = vcpu.join(',');
+  return true;
 }
 
 function makeName(type) {
@@ -893,7 +895,7 @@ function prepareCategory() {
 ?>
 
 <div id="canvas">
-<form markdown="1" method="POST" autocomplete="off" onsubmit="prepareConfig(this)">
+<form markdown="1" method="POST" autocomplete="off" onsubmit="return prepareConfig(this)">
 <input type="hidden" name="csrf_token" value="<?=$var['csrf_token']?>">
 <input type="hidden" name="contCPUset" value="">
 <?if ($xmlType=='edit'):?>
@@ -1111,6 +1113,14 @@ function prepareCategory() {
 
 </div>
 
+<div markdown="1" class="myMAC noshow">
+_(Fixed MAC address)_ (_(optional)_):
+: <input type="text" name="contMyMAC" pattern="([0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}|[0-9A-Fa-f]{12}">
+
+:docker_fixed_mac_help:
+
+</div>
+
 <div markdown="1" class="netCONT noshow">
 _(Container Network)_:
 : <select name="netCONT" id="netCONT">
@@ -1560,9 +1570,17 @@ function prepareCategory() {
 <?endforeach;?>
 
 function showSubnet(bridge) {
-  if (bridge.match(/^(bridge|host|none)$/i) !== null) {
+  if (bridge.match(/^(host|none)$/i) !== null) {
     $('.myIP').hide();
     $('input[name="contMyIP"]').val('');
+    $('.myMAC').hide();
+    $('input[name="contMyMAC"]').val('');
+    $('.netCONT').hide();
+    $('#netCONT').val('');
+  } else if (bridge.match(/^(bridge)$/i) !== null) {
+    $('.myIP').hide();
+    $('input[name="contMyIP"]').val('');
+    $('.myMAC').show();
     $('.netCONT').hide();
     $('#netCONT').val('');
   } else if (bridge.match(/^(container)$/i) !== null) {
@@ -1570,9 +1588,12 @@ function showSubnet(bridge) {
     $('#netCONT').val('<?php echo (isset($xml) && isset($xml['Network'][1])) ? $xml['Network'][1] : ''; ?>');
     $('.myIP').hide();
     $('input[name="contMyIP"]').val('');
+    $('.myMAC').hide();
+    $('input[name="contMyMAC"]').val('');
   } else {
     $('.myIP').show();
     $('#myIP').html('<?=_('Subnet')?>: '+subnet[bridge]);
+    $('.myMAC').show();
     $('.netCONT').hide();
     $('#netCONT').val('');
   }
@@ -1932,4 +1953,3 @@ function load_contOverview() {
 }
 </script>
 <?END:?>
-
diff --git a/emhttp/plugins/dynamix.docker.manager/include/DockerClient.php b/emhttp/plugins/dynamix.docker.manager/include/DockerClient.php
index c6d5685fd7..88f5e958ee 100755
--- a/emhttp/plugins/dynamix.docker.manager/include/DockerClient.php
+++ b/emhttp/plugins/dynamix.docker.manager/include/DockerClient.php
@@ -960,11 +960,22 @@ public function getDockerContainers() {
 		if (is_array($this::$containersCache)) return $this::$containersCache;
 		$this::$containersCache = [];
 		foreach ($this->getDockerJSON("/containers/json?all=1") as $ct) {
+			if (!is_array($ct) || empty($ct['Id'])) {
+				continue;
+			}
+			// Docker can leave stale "dead" entries after shutdown races; filter them from the UI list.
+			if (($ct['State'] ?? '') === 'dead' || stripos($ct['Status'] ?? '', 'dead') === 0) {
+				continue;
+			}
 			$info = $this->getContainerDetails($ct['Id']);
+			// If inspect fails for a stale entry, skip it from the UI list.
+			if (empty($info) || !is_array($info) || !empty($info['message']) || empty($info['Config']) || empty($info['State'])) {
+				continue;
+			}
 			$c = [];
 			$c['Image']       = DockerUtil::ensureImageTag($info['Config']['Image']);
 			$c['ImageId']     = $this->extractID($ct['ImageID']);
-			$c['Name']        = substr($info['Name'], 1);
+			$c['Name']        = ltrim(($info['Name'] ?? $ct['Names'][0] ?? ''), '/');
 			$c['Status']      = $ct['Status'] ?: 'None';
 			$c['Running']     = $info['State']['Running'];
 			$c['Paused']      = $info['State']['Paused'];
@@ -1005,15 +1016,23 @@ public function getDockerContainers() {
 				$ports = &$info['Config']['ExposedPorts'];
 			}
 			foreach($ct['NetworkSettings']['Networks'] as $netName => $netVals) {
+				$networkDetails = $info['NetworkSettings']['Networks'][$netName] ?? $netVals;
 				$i = $c['NetworkMode']=='host' ? $host : $netVals['IPAddress'];
-				$c['Networks'][$netName] = [ 'IPAddress' => $i ];
+				$c['Networks'][$netName] = [
+					'IPAddress' => $i,
+					'MacAddress' => $networkDetails['MacAddress'] ?? ''
+				];
 				if ( isset($driver[$netName]) && ($driver[$netName]=='ipvlan' || $driver[$netName]=='macvlan') ) {
 					if (!isset($c['Ports']['vlan'])) $c['Ports']['vlan'] = [];
 					$c['Ports']['vlan']["$i"] = $i;
 				}
 			}
+			$networkDetails = $info['NetworkSettings']['Networks'][$c['NetworkMode']] ?? $ct['NetworkSettings']['Networks'][$c['NetworkMode']] ?? [];
 			$ip = $c['NetworkMode']=='host' ? $host : $ct['NetworkSettings']['Networks'][$c['NetworkMode']]['IPAddress'] ?? null;
-			$c['Networks'][$c['NetworkMode']] = [ 'IPAddress' => $ip ];
+			$c['Networks'][$c['NetworkMode']] = [
+				'IPAddress' => $ip,
+				'MacAddress' => $networkDetails['MacAddress'] ?? ''
+			];
 			$ports = (isset($ports) && is_array($ports)) ? $ports : [];
 			foreach ($ports as $port => $value) {
 				if (!isset($info['HostConfig']['PortBindings'][$port])) {
diff --git a/emhttp/plugins/dynamix.docker.manager/include/DockerContainers.php b/emhttp/plugins/dynamix.docker.manager/include/DockerContainers.php
index 3f7e0e7d6d..8a14f607cb 100644
--- a/emhttp/plugins/dynamix.docker.manager/include/DockerContainers.php
+++ b/emhttp/plugins/dynamix.docker.manager/include/DockerContainers.php
@@ -28,7 +28,7 @@
 $autostart_file  = $dockerManPaths['autostart-file'];
 
 if (!$containers && !$images) {
-  echo "<tr><td colspan='7' style='text-align:center;padding-top:12px'>"._('No Docker containers installed')."</td></tr>";
+  echo "<tr><td colspan='10' style='text-align:center;padding-top:12px'>"._('No Docker containers installed')."</td></tr>";
   return;
 }
 
@@ -154,7 +154,9 @@ function my_lang_log($text) {
   }
   foreach($ct['Networks'] as $netName => $netVals) {
     $networks[] = $netName;
-    $network_ips[] = $running ? $netVals['IPAddress'] : null;
+    $network_ip = $running ? htmlspecialchars((string)$netVals['IPAddress']) : '';
+    $network_mac = $running ? htmlspecialchars((string)($netVals['MacAddress'] ?? '')) : '';
+    $network_ips[] = $network_mac ? "$network_ip<span class='advanced'><br>$network_mac</span>" : $network_ip;
     if (isset($ct['Networks']['host'])) {
       $ports_external[] = sprintf('%s', $netVals['IPAddress']);
       $ports_internal[0] = sprintf('%s', 'all');
diff --git a/emhttp/plugins/dynamix.docker.manager/include/Helpers.php b/emhttp/plugins/dynamix.docker.manager/include/Helpers.php
index 723ee22af3..3df738c90d 100644
--- a/emhttp/plugins/dynamix.docker.manager/include/Helpers.php
+++ b/emhttp/plugins/dynamix.docker.manager/include/Helpers.php
@@ -32,6 +32,66 @@ function xml_decode($string) {
   return strval(html_entity_decode($string, ENT_XML1, 'UTF-8'));
 }
 
+function extraParamsWithQuotedValuesMasked($extraParams) {
+  return preg_replace('/"[^"\\\\]*(?:\\\\.[^"\\\\]*)*"|\'[^\']*\'/', '""', $extraParams);
+}
+
+function replaceUnquotedExtraParams($extraParams, $callback) {
+  $parts = preg_split('/("[^"\\\\]*(?:\\\\.[^"\\\\]*)*"|\'[^\']*\')/', $extraParams, -1, PREG_SPLIT_DELIM_CAPTURE);
+  if ($parts === false) {
+    return $extraParams;
+  }
+  foreach ($parts as $i => $part) {
+    if ($part === '' || $part[0] === '"' || $part[0] === "'") {
+      continue;
+    }
+    $parts[$i] = $callback($part);
+  }
+  return implode('', $parts);
+}
+
+function extractMacAddressParam($extraParams) {
+  if (!is_string($extraParams)) {
+    return '';
+  }
+  $extraParams = extraParamsWithQuotedValuesMasked($extraParams);
+  if (preg_match('/(?:^|\s)--mac-address=([^\s\'"]+)/', $extraParams, $match)) {
+    return trim($match[1]);
+  }
+  if (preg_match('/(?:^|\s)--mac-address\s+([^\s\'"]+)/', $extraParams, $match)) {
+    return trim($match[1]);
+  }
+  return '';
+}
+
+function removeMacAddressParam($extraParams) {
+  if (!is_string($extraParams) || $extraParams === '') {
+    return '';
+  }
+  $extraParams = replaceUnquotedExtraParams($extraParams, function($part) {
+    $part = preg_replace('/(^|\s)--mac-address=[^\s\'"]+/', '$1', $part);
+    return preg_replace('/(^|\s)--mac-address\s+[^\s\'"]+/', '$1', $part);
+  });
+  return trim($extraParams);
+}
+
+function hasNetworkParam($extraParams) {
+  return is_string($extraParams) && preg_match('/(?:^|\s)--net(?:work)?(?:=|\s+)[^\s\'"]+/', extraParamsWithQuotedValuesMasked($extraParams));
+}
+
+function normalizeMacAddress($mac) {
+  $mac = strtolower(trim($mac ?? ''));
+  if ($mac === '') {
+    return '';
+  }
+  if (preg_match('/^[0-9a-f]{12}$/', $mac)) {
+    $mac = implode(':', str_split($mac, 2));
+  } else {
+    $mac = str_replace('-', ':', $mac);
+  }
+  return preg_match('/^([0-9a-f]{2}:){5}[0-9a-f]{2}$/', $mac) ? $mac : '';
+}
+
 function generateTSwebui($url, $serve, $webUI) {
   if (!isset($webUI)) {
     return '';
@@ -75,16 +135,20 @@ function postToXML($post, $setOwnership=false) {
     $xml->Network                  = xml_encode($post['contNetwork']);
   }
   $xml->MyIP                       = xml_encode($post['contMyIP']);
+  $extraNetwork                    = hasNetworkParam($post['contExtraParams'] ?? '');
+  $myMAC                           = $extraNetwork ? '' : normalizeMacAddress(trim($post['contMyMAC'] ?? '') ?: extractMacAddressParam($post['contExtraParams'] ?? ''));
+  $xml->MyMAC                      = xml_encode($myMAC);
   $xml->Shell                      = xml_encode($post['contShell']);
   $xml->Privileged                 = strtolower($post['contPrivileged']??'')=='on' ? 'true' : 'false';
   $xml->Support                    = xml_encode($post['contSupport']);
   $xml->Project                    = xml_encode($post['contProject']);
+  $xml->ReadMe                     = xml_encode($post['contReadMe']);
   $xml->Overview                   = xml_encode($post['contOverview']);
   $xml->Category                   = xml_encode($post['contCategory']);
   $xml->WebUI                      = xml_encode(trim($post['contWebUI']));
   $xml->TemplateURL                = xml_encode($post['contTemplateURL']);
   $xml->Icon                       = xml_encode(trim($post['contIcon']));
-  $xml->ExtraParams                = xml_encode($post['contExtraParams']);
+  $xml->ExtraParams                = xml_encode($myMAC && !$extraNetwork ? removeMacAddressParam($post['contExtraParams']) : $post['contExtraParams']);
   $xml->PostArgs                   = xml_encode($post['contPostArgs']);
   $xml->CPUset                     = xml_encode($post['contCPUset']);
   $xml->DateInstalled              = xml_encode(time());
@@ -148,16 +212,20 @@ function xmlToVar($xml) {
   $out['Registry']                     = xml_decode($xml->Registry);
   $out['Network']                      = xml_decode($xml->Network);
   $out['MyIP']                         = xml_decode($xml->MyIP ?? '');
+  $extraParams                         = xml_decode($xml->ExtraParams ?? '');
+  $extraNetwork                        = hasNetworkParam($extraParams);
+  $out['MyMAC']                        = $extraNetwork ? '' : normalizeMacAddress(xml_decode($xml->MyMAC ?? '') ?: extractMacAddressParam($extraParams));
   $out['Shell']                        = xml_decode($xml->Shell ?? 'sh');
   $out['Privileged']                   = xml_decode($xml->Privileged);
   $out['Support']                      = xml_decode($xml->Support);
   $out['Project']                      = xml_decode($xml->Project);
+  $out['ReadMe']                       = xml_decode($xml->ReadMe);
   $out['Overview']                     = stripslashes(xml_decode($xml->Overview));
   $out['Category']                     = xml_decode($xml->Category);
   $out['WebUI']                        = xml_decode($xml->WebUI);
   $out['TemplateURL']                  = xml_decode($xml->TemplateURL);
   $out['Icon']                         = xml_decode($xml->Icon);
-  $out['ExtraParams']                  = xml_decode($xml->ExtraParams);
+  $out['ExtraParams']                  = $extraParams;
   $out['PostArgs']                     = xml_decode($xml->PostArgs);
   $out['CPUset']                       = xml_decode($xml->CPUset);
   $out['DonateText']                   = xml_decode($xml->DonateText);
@@ -323,13 +391,29 @@ function xmlToCommand($xml, $create_paths=false) {
   $xml           = xmlToVar($xml);
   $cmdName       = strlen($xml['Name']) ? '--name='.escapeshellarg($xml['Name']) : '';
   $cmdPrivileged = strtolower($xml['Privileged'])=='true' ? '--privileged=true' : '';
+  $extraNetwork  = hasNetworkParam($xml['ExtraParams']);
+  $cmdMyIP       = '';
   if (preg_match('/^container:(.*)/', $xml['Network'])) {
-    $cmdNetwork  = preg_match('/\-\-net(work)?=/',$xml['ExtraParams']) ? "" : '--net='.escapeshellarg($xml['Network']);
+    $cmdNetwork  = $extraNetwork ? "" : '--net='.escapeshellarg($xml['Network']);
   } else {
-    $cmdNetwork  = preg_match('/\-\-net(work)?=/',$xml['ExtraParams']) ? "" : '--net='.escapeshellarg(strtolower($xml['Network']));
+    $networkName = strtolower($xml['Network']);
+    if ($extraNetwork) {
+      $cmdNetwork = "";
+    } elseif (strlen($xml['MyMAC']) && !in_array($networkName, ['host','none'])) {
+      $xml['ExtraParams'] = removeMacAddressParam($xml['ExtraParams']);
+      $networkEndpoint = ['name='.$networkName];
+      foreach (explode(' ',str_replace(',',' ',$xml['MyIP'])) as $myIP) {
+        if ($myIP) $networkEndpoint[] = (strpos($myIP,':') !== false ? 'ip6=' : 'ip=').$myIP;
+      }
+      $networkEndpoint[] = 'mac-address='.$xml['MyMAC'];
+      $cmdNetwork = '--network='.escapeshellarg(implode(',', $networkEndpoint));
+    } else {
+      $cmdNetwork  = '--net='.escapeshellarg($networkName);
+    }
+  }
+  if (!strlen($xml['MyMAC']) || preg_match('/^container:(.*)/', $xml['Network']) || $extraNetwork) {
+    foreach (explode(' ',str_replace(',',' ',$xml['MyIP'])) as $myIP) if ($myIP) $cmdMyIP .= (strpos($myIP,':') !== false ? '--ip6=' : '--ip=').escapeshellarg($myIP).' ';
   }
-  $cmdMyIP       = '';
-  foreach (explode(' ',str_replace(',',' ',$xml['MyIP'])) as $myIP) if ($myIP) $cmdMyIP .= (strpos($myIP,':')?'--ip6=':'--ip=').escapeshellarg($myIP).' ';
   $cmdCPUset     = strlen($xml['CPUset']) ? '--cpuset-cpus='.escapeshellarg($xml['CPUset']) : '';
   $Volumes       = [''];
   $Ports         = [''];
diff --git a/emhttp/plugins/dynamix.docker.manager/javascript/docker.js b/emhttp/plugins/dynamix.docker.manager/javascript/docker.js
index ad46fa3850..fd8599c337 100644
--- a/emhttp/plugins/dynamix.docker.manager/javascript/docker.js
+++ b/emhttp/plugins/dynamix.docker.manager/javascript/docker.js
@@ -51,6 +51,8 @@ function addDockerContainerContext(container, image, template, started, paused,
   }
   context.destroy('#'+id);
   context.attach('#'+id, opts);
+  $('#dropdown-'+id).css('z-index', 10001)
+    .append('<li class="docker-dropdown-spacer" aria-hidden="true" style="position:absolute;top:100%;left:0;width:1px;height:60px;pointer-events:none;list-style:none"></li>');
 }
 function addDockerImageContext(image, imageTag) {
   var opts = [];
diff --git a/emhttp/plugins/dynamix.docker.manager/scripts/derive_gateway b/emhttp/plugins/dynamix.docker.manager/scripts/derive_gateway
new file mode 100755
index 0000000000..30c1e227a1
--- /dev/null
+++ b/emhttp/plugins/dynamix.docker.manager/scripts/derive_gateway
@@ -0,0 +1,21 @@
+#!/bin/bash
+# Derive the IPv4 gateway for a subnet: the first usable host address
+# (e.g. 192.168.10.0/24 -> 192.168.10.1). Prints nothing if not derivable.
+#
+# Restores the pre-Docker-28 behavior where macvlan/ipvlan networks created
+# without an explicit gateway implicitly used the subnet's first address.
+# Shared by etc/rc.d/rc.docker and the Docker Settings page so the logic
+# lives in one place.
+#
+# Usage: derive_gateway "<subnet-cidr>"   (a space-separated list is accepted;
+#        only the first subnet is used)
+CIDR=${1%% *}
+IP=${CIDR%/*}; MASK=${CIDR#*/}
+[[ $IP == *.*.*.* && $MASK =~ ^[0-9]+$ ]] || exit 0
+(( MASK >= 1 && MASK <= 30 )) || exit 0
+IFS=. read -r A B C D <<< "$IP"
+IPNUM=$(( (A<<24) + (B<<16) + (C<<8) + D ))
+MASKNUM=$(( (0xFFFFFFFF << (32-MASK)) & 0xFFFFFFFF ))
+NET=$(( IPNUM & MASKNUM ))
+HOST=$(( NET + 1 ))
+printf '%d.%d.%d.%d\n' $(( (HOST>>24)&255 )) $(( (HOST>>16)&255 )) $(( (HOST>>8)&255 )) $(( HOST&255 ))
diff --git a/emhttp/plugins/dynamix.plugin.manager/scripts/language b/emhttp/plugins/dynamix.plugin.manager/scripts/language
index 0515669096..a448ff0366 100755
--- a/emhttp/plugins/dynamix.plugin.manager/scripts/language
+++ b/emhttp/plugins/dynamix.plugin.manager/scripts/language
@@ -86,6 +86,26 @@ function run($command) {
   return pclose($run);
 }
 
+function remove_tree(string $dir): bool {
+  if (!is_dir($dir)) return false;
+  $items = scandir($dir);
+  if ($items === false) return false;
+  foreach ($items as $item) {
+    if ($item === '.' || $item === '..') continue;
+    $entry = "$dir/$item";
+    if (is_dir($entry) && !is_link($entry)) {
+      if (!remove_tree($entry)) return false;
+    } elseif (!@unlink($entry)) {
+      return false;
+    }
+  }
+  return @rmdir($dir);
+}
+
+function valid_language_pack_name($name): bool {
+  return is_string($name) && $name !== '' && preg_match('/^[A-Za-z0-9._$-]+$/', $name);
+}
+
 // Run hooked scripts before correct execution of "method"
 // method = install, update, remove, check
 // hook programs receives three parameters: type=language and method and language-name
@@ -159,7 +179,11 @@ function language($method, $xml_file, &$error) {
   switch ($method) {
   case 'install':
     $url = $xml->LanguageURL;
-    $name = $xml->LanguagePack;
+    $name = (string)$xml->LanguagePack;
+    if (!valid_language_pack_name($name)) {
+      $error = "invalid language pack";
+      return false;
+    }
     $save = "$boot/dynamix/lang-$name.zip";
     if (!file_exists($save)) {
       if ($url) {
@@ -173,22 +197,54 @@ function language($method, $xml_file, &$error) {
       }
     }
     $path = "$docroot/languages/$name";
-    exec("mkdir -p $path");
+    if (!is_dir($path) && !@mkdir($path, 0777, true)) {
+      $error = "failed to create language directory";
+      return false;
+    }
     @unlink("$docroot/webGui/javascript/translate.$name.js");
-    foreach (glob("$path/*.dot",GLOB_NOSORT) as $dot_file) unlink($dot_file);
-    exec("unzip -qqLjo -d $path $save", $dummy, $err);
+    foreach (['*.dot', '*.txt', '*.json'] as $pattern) {
+      foreach (glob("$path/$pattern", GLOB_NOSORT) as $lang_file) @unlink($lang_file);
+    }
+    $err = 0;
+    $zip = new ZipArchive();
+    if ($zip->open($save) === true) {
+      for ($i = 0; $i < $zip->numFiles; $i++) {
+        $entry = $zip->getNameIndex($i);
+        if ($entry === false) continue;
+        if (substr($entry, -1) === '/') continue;
+        $content = $zip->getFromIndex($i);
+        if ($content === false) {
+          $err = 2;
+          break;
+        }
+        $entryName = strtolower(basename($entry));
+        if ($entryName === '') continue;
+        if (!preg_match('/\.(dot|txt|json)$/', $entryName)) continue;
+        if (file_put_contents("$path/$entryName", $content) === false) {
+          $err = 2;
+          break;
+        }
+      }
+      $zip->close();
+    } else {
+      $err = 2;
+    }
     if ($err > 1) {
       @unlink($save);
-      exec("rm -rf $path");
+      remove_tree($path);
       $error = "unzip failed. Error code $err";
       return false;
     }
     return true;
   case 'remove':
-    $name = $xml->LanguagePack;
+    $name = (string)$xml->LanguagePack;
     if ($name) {
+      if (!valid_language_pack_name($name)) {
+        $error = "invalid language pack";
+        return false;
+      }
       $path = "$docroot/languages/$name";
-      exec("rm -rf $path");
+      if (is_dir($path)) remove_tree($path);
       @unlink("$docroot/webGui/javascript/translate.$name.js");
       @unlink("$boot/lang-$name.xml");
       @unlink("$plugins/lang-$name.xml");
diff --git a/emhttp/plugins/dynamix.vm.manager/VMMachines.page b/emhttp/plugins/dynamix.vm.manager/VMMachines.page
index b6da578d33..e29bcb6a95 100755
--- a/emhttp/plugins/dynamix.vm.manager/VMMachines.page
+++ b/emhttp/plugins/dynamix.vm.manager/VMMachines.page
@@ -496,7 +496,12 @@ function loadlist() {
 $(function() {
 <?if ($msg):?>
   <?$color = strpos($msg, "rror:")!==false ? 'red-text':'green-text'?>
-  $('#countdown').html("<span class='<?=$color?>'><?=_($msg)?></span>");
+  $('#countdown').empty().append(
+    $('<span/>', {
+      class: '<?=$color?>',
+      text: <?=json_encode(_($msg), JSON_HEX_TAG|JSON_HEX_AMP|JSON_HEX_APOS|JSON_HEX_QUOT)?>
+    })
+  );
 <?endif;?>
   $('#btnAddVM').click(function AddVMEvent(){$('.tab>input#tab2').click();});
   $.removeCookie('lockbutton');
diff --git a/emhttp/plugins/dynamix.vm.manager/include/libvirt_helpers.php b/emhttp/plugins/dynamix.vm.manager/include/libvirt_helpers.php
index 379ff86282..4f98a41e2c 100644
--- a/emhttp/plugins/dynamix.vm.manager/include/libvirt_helpers.php
+++ b/emhttp/plugins/dynamix.vm.manager/include/libvirt_helpers.php
@@ -1871,7 +1871,11 @@ function write_snapshots_database($vm,$name,$state,$desc,$method="QEMU") {
 		$noxml = "";
 		$snaps_json = file_get_contents($dbpath."/snapshots.db");
 		$snaps = json_decode($snaps_json,true);
-		$snapshot_res=$lv->domain_snapshot_lookup_by_name($vm,$name);
+		$snapshot_xml = @file_get_contents("/etc/libvirt/qemu/snapshot/{$vm}/{$name}.xml");
+		if (empty($snapshot_xml)) {
+			$snapshot_xml = trim(shell_exec("virsh snapshot-dumpxml ".escapeshellarg($vm)." ".escapeshellarg($name)." 2>/dev/null"));
+		}
+		$snapshot_res = !empty($snapshot_xml);
 		if (!$snapshot_res) {
 			 # Manual Snap no XML
 		if ($state == "shutoff" && ($method == "ZFS" || $method == "BTRFS")) {
@@ -1888,7 +1892,7 @@ function write_snapshots_database($vm,$name,$state,$desc,$method="QEMU") {
 			$noxml = "noxml";
 		}
 		} else {
-		$snapshot_xml=$lv->domain_snapshot_get_xml($snapshot_res);
+
 		$a = simplexml_load_string($snapshot_xml);
 		$a = json_encode($a);
 		$b = json_decode($a, TRUE);
@@ -2097,7 +2101,9 @@ function vm_snapshot($vm,$snapshotname, $snapshotdescinput, $free = "yes", $meth
 		if ($logging) qemu_log($vm,"Success write snap db");
 		$ret = write_snapshots_database("$vm","$name",$state,$snapshotdescinput,$method);
 		#remove meta data
-		if ($ret != "noxml") $ret = $lv->domain_snapshot_delete($vm, "$name" ,2);
+		if ($ret != "noxml") {
+			exec("virsh snapshot-delete ".escapeshellarg($vm)." ".escapeshellarg($name)." --metadata 2>&1", $snapDelOut, $snapDelRtn);
+		}
 		}
 		return $arrResponse;
 
diff --git a/emhttp/plugins/dynamix.vm.manager/novnc/defaults.json b/emhttp/plugins/dynamix.vm.manager/novnc/defaults.json
new file mode 100644
index 0000000000..0967ef424b
--- /dev/null
+++ b/emhttp/plugins/dynamix.vm.manager/novnc/defaults.json
@@ -0,0 +1 @@
+{}
diff --git a/emhttp/plugins/dynamix.vm.manager/novnc/mandatory.json b/emhttp/plugins/dynamix.vm.manager/novnc/mandatory.json
new file mode 100644
index 0000000000..0967ef424b
--- /dev/null
+++ b/emhttp/plugins/dynamix.vm.manager/novnc/mandatory.json
@@ -0,0 +1 @@
+{}
diff --git a/emhttp/plugins/dynamix.vm.manager/scripts/qemu.php b/emhttp/plugins/dynamix.vm.manager/scripts/qemu.php
index 5a8a9626a5..cd4bd5f038 100755
--- a/emhttp/plugins/dynamix.vm.manager/scripts/qemu.php
+++ b/emhttp/plugins/dynamix.vm.manager/scripts/qemu.php
@@ -15,7 +15,7 @@ function detect_user_share(&$arg) {
   $arg = preg_replace_callback('|(/mnt/user/[^,"]+\.[^,"\s]*)|', function($match) {
     if (is_file($match[0])) {
       // resolve the actual disk or cache backing device for this user share path
-      $realdisk = trim(shell_exec("getfattr --absolute-names --only-values -n system.LOCATION ".escapeshellarg($match[0])." 2>/dev/null"));
+      $realdisk = trim(shell_exec("getfattr --absolute-names --only-values -n system.LOCATION ".escapeshellarg($match[0])." 2>/dev/null") ?? '');
       if (!empty($realdisk)) {
         $replacement = str_replace('/mnt/user/', "/mnt/$realdisk/", $match[0]);
         if (is_file($replacement)) {
diff --git a/emhttp/plugins/dynamix/ArrayOperation.page b/emhttp/plugins/dynamix/ArrayOperation.page
index 74381e295b..f08dc3c605 100644
--- a/emhttp/plugins/dynamix/ArrayOperation.page
+++ b/emhttp/plugins/dynamix/ArrayOperation.page
@@ -394,6 +394,10 @@ mymonitor.on('message', function(state) {
 <?if (_var($var,'shareUser') == 'e' && $pool_devices):?>
     $('#mover-button').prop('disabled',false);
     $('#mover-text').html("<b>_(Move)_</b> _(will immediately invoke the Mover)_.&nbsp;<a href=\"/Main/Settings/Scheduler\"<?if($tabbed):?> onclick=\"$.cookie('one','tab2')\"<?endif;?>>(_(Schedule)_)</a>");
+<?endif;?>
+<?if (_var($var,'shareUser') == 'e' && !$pool_devices):?>
+    $('#mover-button').prop('disabled',false);
+    $('#mover-text').html("<b>_(Empty)_</b> _(will immediately invoke the Mover to Empty a disk)_.&nbsp;<a href=\"/Main/Settings/Scheduler\"<?if($tabbed):?> onclick=\"$.cookie('one','tab2')\"<?endif;?>>(_(Schedule)_)</a>");
 <?endif;?>
     break;
   case '1': // parity running
@@ -406,6 +410,10 @@ mymonitor.on('message', function(state) {
 <?if (_var($var,'shareUser') == 'e' && $pool_devices):?>
     $('#mover-button').prop('disabled',true);
     $('#mover-text').html("_(Disabled)_ -- _(Parity operation is running)_");
+<?endif;?>
+<?if (_var($var,'shareUser') == 'e' && !$pool_devices):?>
+    $('#mover-button').prop('disabled',true);
+    $('#mover-text').html("<b>_(Empty)_</b> _(will immediately invoke the Mover to Empty a disk)_.&nbsp;<a href=\"/Main/Settings/Scheduler\"<?if($tabbed):?> onclick=\"$.cookie('one','tab2')\"<?endif;?>>(_(Schedule)_)</a>");
 <?endif;?>
     break;
   case '2': // mover running
@@ -414,6 +422,10 @@ mymonitor.on('message', function(state) {
 <?if (_var($var,'shareUser') == 'e' && $pool_devices):?>
     $('#mover-button').prop('disabled',true);
     $('#mover-text').html("_(Disabled)_ - _(Mover is running)_.");
+<?endif;?>
+<?if (_var($var,'shareUser') == 'e' && !$pool_devices):?>
+    $('#mover-button').prop('disabled',true);
+    $('#mover-text').html("<b>_(Empty)_</b> _(will immediately invoke the Mover to Empty a disk)_.&nbsp;<a href=\"/Main/Settings/Scheduler\"<?if($tabbed):?> onclick=\"$.cookie('one','tab2')\"<?endif;?>>(_(Schedule)_)</a>");
 <?endif;?>
     break;
   case '3': // btrfs running
@@ -422,6 +434,10 @@ mymonitor.on('message', function(state) {
 <?if (_var($var,'shareUser') == 'e' && $pool_devices):?>
     $('#mover-button').prop('disabled',true);
     $('#mover-text').html("_(Disabled)_ -- _(BTRFS operation is running)_");
+<?endif;?>
+<?if (_var($var,'shareUser') == 'e' && !$pool_devices):?>
+    $('#mover-button').prop('disabled',true);
+    $('#mover-text').html("<b>_(Empty)_</b> _(will immediately invoke the Mover to Empty a disk)_.&nbsp;<a href=\"/Main/Settings/Scheduler\"<?if($tabbed):?> onclick=\"$.cookie('one','tab2')\"<?endif;?>>(_(Schedule)_)</a>");
 <?endif;?>
     break;
   }
@@ -832,6 +848,13 @@ endswitch;
 </table>
 </form>
 <?endif;?>
+<?if (_var($var,'shareUser') == 'e' && !$pool_devices):?>
+<form name="mover_schedule" method="POST" action="/update.htm" target="progressFrame">
+<table markdown="1" class="ArrayOperation-Table array_status noshift">
+<tr><td></td><td><input type="submit" id="mover-button" name="cmdStartMover" value="_(Empty)_"></td><td id="mover-text"></td></tr>
+</table>
+</form>
+<?endif;?>
 <?elseif ($wrong && $keyfile):?>
 <form name="delete_keyfile" method="POST" action="/update.php" target="progressFrame">
 <input type="hidden" name="#file" value="unused">
diff --git a/emhttp/plugins/dynamix/DashStats.page b/emhttp/plugins/dynamix/DashStats.page
index 5522666aed..1bb1677358 100755
--- a/emhttp/plugins/dynamix/DashStats.page
+++ b/emhttp/plugins/dynamix/DashStats.page
@@ -151,34 +151,45 @@ $total = exec("awk '/^MemTotal/{print $2*1024}' /proc/meminfo");
 unset($ports); exec("ls --indicator-style=none /sys/class/net|grep -Po '^(bond|eth|wlan)\d+$'",$ports);
 $ports[] = 'lo';
 
-$sizes = ['MB','GB','TB'];
+$memory_units = [
+  // dmidecode reports memory capacities using binary math; treat both SI and IEC labels as base-1024.
+  // This keeps parsing consistent across dmidecode versions that may print GB/TB or GiB/TiB.
+  'kb' => 1/1024, 'kib' => 1/1024,
+  'mb' => 1,      'mib' => 1,
+  'gb' => 1024,   'gib' => 1024,
+  'tb' => 1048576,'tib' => 1048576,
+  'pb' => 1073741824, 'pib' => 1073741824
+];
+$parse_memory_to_mib = function($value) use ($memory_units) {
+  if (!preg_match('/([0-9.]+)\s*([A-Za-z]+)/',$value ?? '',$match)) return 0;
+  $size = (float)$match[1];
+  $unit = strtolower($match[2]);
+  return isset($memory_units[$unit]) ? (int)round($size*$memory_units[$unit]) : 0;
+};
 $memory_type = $ecc = '';
 $memory_installed = $memory_maximum = 0;
 $memory_devices = dmidecode('Memory Device','17');
 foreach ($memory_devices as $device) {
-  if (!is_numeric($device['Size'][0])) continue;
-  [$size, $unit] = my_explode(' ',$device['Size']??'');
-  $base = array_search($unit,$sizes);
-  if ($base!==false) $memory_installed += $size*pow(1024,$base);
+  $memory_installed += $parse_memory_to_mib($device['Size'] ?? '');
   if (!$memory_type && isset($device['Type']) && $device['Type']!='Unknown') $memory_type = $device['Type'];
 }
 $memory_array = dmidecode('Physical Memory Array','16');
 foreach ($memory_array as $device) {
-  [$size, $unit] = my_explode(' ',$device['Maximum Capacity']??'');
-  $base = array_search($unit,$sizes);
-  if ($base>=1) $memory_maximum += $size*pow(1024,$base);
+  $memory_maximum += $parse_memory_to_mib($device['Maximum Capacity'] ?? '');
   if (!$ecc && isset($device['Error Correction Type']) && $device['Error Correction Type']!='None') $ecc = "{$device['Error Correction Type']} ";
 }
 if ($memory_installed >= 1048576) {
   $memory_installed = round($memory_installed/1048576);
   $memory_maximum = round($memory_maximum/1048576);
-  $unit = 'TiB';
+  $memory_unit = 'TiB';
 } else { 
 if ($memory_installed >= 1024) {
   $memory_installed = round($memory_installed/1024);
   $memory_maximum = round($memory_maximum/1024);
-  $unit = 'GiB';}
-else $unit = 'MiB'; }
+  $memory_unit = 'GiB';}
+else $memory_unit = 'MiB'; }
+
+$unit = $memory_unit;
 
 // get system resources size
 exec("df --output=size /boot /var/log /var/lib/docker 2>/dev/null|awk '(NR>1){print $1*1024}'",$df);
@@ -433,7 +444,7 @@ switch ($themeHelper->getThemeName()) { // $themeHelper set in DefaultPageLayout
                                         <span class='flex flex-row flex-wrap items-center gap-4'>
                                             <span class="head_info">
                                                 <span>
-                                                    <i class='ups fa fa-line-chart'></i>_(Memory)_: <?="$memory_installed $unit $memory_type $ecc"?>
+                                                    <i class='ups fa fa-line-chart'></i>_(Memory)_: <?="$memory_installed $memory_unit $memory_type $ecc"?>
                                                 </span>
                                             </span>
                                             <span class="switch">
@@ -464,7 +475,7 @@ switch ($themeHelper->getThemeName()) { // $themeHelper set in DefaultPageLayout
                                 <div class="tile-system-memory-labels">
                                     <div>
                                         <i class='ups fa fa-compress'></i>_(Usable size)_: <?=$ramsize?><br>
-                                        <i class='ups fa fa-expand'></i>_(Maximum size)_: <?="$memory_maximum $unit"?><?=$low?'*':''?>
+                                        <i class='ups fa fa-expand'></i>_(Maximum size)_: <?="$memory_maximum $memory_unit"?><?=$low?'*':''?>
                                     </div>
                                     <div>
                                         <legend>_(Legend)_</legend>
diff --git a/emhttp/plugins/dynamix/MoverSettings.page b/emhttp/plugins/dynamix/MoverSettings.page
index e6576111a4..e67f46f949 100755
--- a/emhttp/plugins/dynamix/MoverSettings.page
+++ b/emhttp/plugins/dynamix/MoverSettings.page
@@ -18,13 +18,15 @@ Tag="calendar-check-o"
 $mode = ['Disabled','Hourly','Daily','Weekly','Monthly'];
 $days = ['Sunday','Monday','Tuesday','Wednesday','Thursday','Friday','Saturday'];
 $setup = true;
+$buttontext = _('Move now');
 if (!$pool_devices) {
-  echo "<p class='notice'>"._('No Cache device present')."!</p>";
-  $setup = false;
+  echo "<p class='notice'>"._('No Cache device present only empty function will run')."!</p>";
+  $setup = true;
+  $buttontext = _('Empty now');
 } elseif ($var['shareUser']=='-') {
   echo "<p class='notice'>"._('User shares not enabled')."!</p>";
   $setup = false;
-}
+} 
 if (empty($var['shareMoverSchedule'])) {
   $cron = explode(' ', "* * * * *");
   $move = 0;
@@ -32,7 +34,7 @@ if (empty($var['shareMoverSchedule'])) {
   $cron = explode(' ', $var['shareMoverSchedule']);
   $move = $cron[2]!='*' ? 4 : ($cron[4]!='*' ? 3 : (substr($cron[1],0,1)!='*' ? 2 : 1));
 }
-$showMoverButton = $setup && $pool_devices;
+$showMoverButton = $setup;
 $moverRunning = file_exists('/var/run/mover.pid');
 ?>
 <script>
@@ -138,7 +140,7 @@ _(Mover logging)_:
     <input type="submit" name="changeMover" value="_(Apply)_" disabled>
     <input type="button" value="_(Done)_" onclick="done()">
     <?if ($showMoverButton):?>
-      <input type="submit" name="cmdStartMover" value="_(Move now)_"<?if ($moverRunning):?> disabled<?endif;?>>
+      <input type="submit" name="cmdStartMover" value="<?=$buttontext?>"<?if ($moverRunning):?> disabled<?endif;?>>
       <?if ($moverRunning):?><span>_(Mover is running)_</span><?endif;?>
     <?endif;?>
   </span>
diff --git a/emhttp/plugins/dynamix/agents/Discord.xml b/emhttp/plugins/dynamix/agents/Discord.xml
index f086531fcc..1fc39b16cd 100644
--- a/emhttp/plugins/dynamix/agents/Discord.xml
+++ b/emhttp/plugins/dynamix/agents/Discord.xml
@@ -50,6 +50,18 @@ LINK="${LINK:-}"
 HOSTNAME="${HOSTNAME:-$(hostname)}"
 TIMESTAMP="${TIMESTAMP:-$(date +%s)}"
 
+# Convert literal \n sequences into real line breaks for reports.
+if [[ -n "${DESCRIPTION}" ]]; then
+  DESCRIPTION=${DESCRIPTION//\\r\\n/$'\n'}
+  DESCRIPTION=${DESCRIPTION//\\n/$'\n'}
+  DESCRIPTION=${DESCRIPTION//\\r/$'\n'}
+fi
+if [[ -n "${CONTENT}" ]]; then
+  CONTENT=${CONTENT//\\r\\n/$'\n'}
+  CONTENT=${CONTENT//\\n/$'\n'}
+  CONTENT=${CONTENT//\\r/$'\n'}
+fi
+
 # ensure link has a host
 if [[ -n "${LINK}" ]] && [[ ${LINK} != http* ]]; then
   if [[ -r /usr/local/emhttp/state/nginx.ini ]]; then
diff --git a/emhttp/plugins/dynamix/agents/tests/discord_newline_test.sh b/emhttp/plugins/dynamix/agents/tests/discord_newline_test.sh
new file mode 100644
index 0000000000..3fa4cce347
--- /dev/null
+++ b/emhttp/plugins/dynamix/agents/tests/discord_newline_test.sh
@@ -0,0 +1,72 @@
+#!/bin/bash
+set -euo pipefail
+
+script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+agent_xml="${script_dir}/../Discord.xml"
+
+tmp_dir="$(mktemp -d)"
+trap 'rm -rf "$tmp_dir"' EXIT
+
+stub_dir="${tmp_dir}/bin"
+payload="${tmp_dir}/payload.json"
+script_path="${tmp_dir}/Discord.sh"
+
+mkdir -p "$stub_dir"
+
+cat > "${stub_dir}/curl" <<'EOF'
+#!/bin/bash
+out="${DISCORD_TEST_OUT:-/tmp/discord_payload.json}"
+for ((i=1; i<=$#; i++)); do
+  if [[ "${!i}" == "--data-binary" ]]; then
+    j=$((i+1))
+    printf '%s' "${!j}" > "$out"
+    exit 0
+  fi
+done
+exit 0
+EOF
+chmod +x "${stub_dir}/curl"
+
+cat > "${stub_dir}/date" <<'EOF'
+#!/bin/bash
+if [[ "$*" == *"-d "* ]]; then
+  printf '%s\n' "1970-01-01T00:00:00.000Z"
+  exit 0
+fi
+exec /bin/date "$@"
+EOF
+chmod +x "${stub_dir}/date"
+
+awk '
+  index($0, "<![CDATA[") { in_block=1; next }
+  index($0, "]]>") { in_block=0; next }
+  in_block { print }
+' "$agent_xml" | sed 's/{0}//' > "$script_path"
+chmod +x "$script_path"
+
+run_case() {
+  local desc="$1"
+  local content="$2"
+  local expected="$3"
+
+  rm -f "$payload"
+  DISCORD_TEST_OUT="$payload" \
+  WEBH_URL="http://example.invalid" \
+  DESCRIPTION="$desc" \
+  CONTENT="$content" \
+  PATH="$stub_dir:$PATH" \
+  bash "$script_path" >/dev/null
+
+  actual="$(jq -r '.embeds[0].fields[0].value' "$payload")"
+  if [[ "$actual" != "$expected" ]]; then
+    echo "Discord newline test failed." >&2
+    printf 'Expected:\n%s\n' "$expected" >&2
+    printf 'Actual:\n%s\n' "$actual" >&2
+    exit 1
+  fi
+}
+
+run_case "Line1\\nLine2" "Line3\\nLine4" $'Line1\nLine2\n\nLine3\nLine4'
+run_case "Line1\\nLine2" "" $'Line1\nLine2'
+
+echo "OK"
diff --git a/emhttp/plugins/dynamix/include/FileUpload.php b/emhttp/plugins/dynamix/include/FileUpload.php
index 27aca0503a..80ff432075 100644
--- a/emhttp/plugins/dynamix/include/FileUpload.php
+++ b/emhttp/plugins/dynamix/include/FileUpload.php
@@ -21,6 +21,28 @@
 $safeexts  = ['.png'];
 $result    = false;
 
+function in_safe_path(string $path, string $base): bool {
+  $path = rtrim($path, '/').'/';
+  $base = rtrim($base, '/').'/';
+  return strpos($path, $base) === 0;
+}
+
+function remove_tree(string $dir): bool {
+  if (!is_dir($dir)) return false;
+  $items = scandir($dir);
+  if ($items === false) return false;
+  foreach ($items as $item) {
+    if ($item === '.' || $item === '..') continue;
+    $entry = "$dir/$item";
+    if (is_dir($entry) && !is_link($entry)) {
+      if (!remove_tree($entry)) return false;
+    } elseif (!@unlink($entry)) {
+      return false;
+    }
+  }
+  return @rmdir($dir);
+}
+
 require_once "$docroot/webGui/include/Helpers.php";
 
 switch ($_POST['cmd'] ?? 'load') {
@@ -47,20 +69,37 @@
 case 'save':
   // move uploaded file ($verifiedPNG) to final destination
   $verifiedPNG = "$temp/".basename($file);
-  $path = $_POST['path'];
+  $path = $_POST['path'] ?? '';
+  $outputRaw = $_POST['output'] ?? '';
+  $output = basename($outputRaw);
+  $outputExt = strtolower(substr($output, -4));
+  $isValidFilename = $output !== '' && $output === $outputRaw && preg_match('/^[A-Za-z0-9._$-]+$/', $output);
   foreach ($safepaths as $safepath) {
-    if (strpos(dirname("$path/{$_POST['output']}"),$safepath)===0 && in_array(substr(basename($_POST['output']),-4),$safeexts)) {
-      exec("mkdir -p ".escapeshellarg(realpath($path)));
-      $result = @rename($verifiedPNG, "$path/{$_POST['output']}");
+    $safeBase = realpath($safepath);
+    $targetDir = realpath($path);
+    if (!$targetDir && $safeBase) {
+      $parentDir = realpath(dirname($path));
+      if ($parentDir && in_safe_path($parentDir, $safeBase) && @mkdir($path, 0777, true)) {
+        $targetDir = realpath($path);
+      }
+    }
+    if ($targetDir && $safeBase && in_safe_path($targetDir, $safeBase) && $isValidFilename && in_array($outputExt, $safeexts, true)) {
+      if (is_dir($targetDir)) {
+        $result = @rename($verifiedPNG, "$targetDir/$output");
+      }
       break;
     }
   }
   break;
 case 'delete':
-  $path = $_POST['path'];
+  $path = $_POST['path'] ?? '';
+  $file = basename($file);
+  $targetFile = realpath("$path/$file");
+  $targetExt = $targetFile ? strtolower(substr($targetFile, -4)) : '';
   foreach ($safepaths as $safepath) {
-    if (strpos(realpath("$path/$file"), $safepath) === 0 && in_array(substr(realpath("$path/$file"), -4), $safeexts)) {
-      exec("rm -f ".escapeshellarg(realpath("$path/$file")));
+    $safeBase = realpath($safepath);
+    if ($targetFile && $safeBase && in_safe_path($targetFile, $safeBase) && in_array($targetExt, $safeexts, true)) {
+      @unlink($targetFile);
       $result = true;
       break;
     }
@@ -70,14 +109,37 @@
   $file = basename($file);
   $path = "$docroot/languages/$file";
   $save = "/tmp/lang-$file.zip";
-  exec("mkdir -p $path");
+  if (!is_dir($path) && !@mkdir($path, 0777, true)) break;
   if ($result = file_put_contents($save,base64_decode(preg_replace('/^data:.*;base64,/','',$_POST['filedata'])))) {
     @unlink("$docroot/webGui/javascript/translate.$file.js");
     foreach (glob("$path/*.dot",GLOB_NOSORT) as $dot_file) unlink($dot_file);
-    exec("unzip -qqjLo -d $path $save", $dummy, $err);
+    $err = 0;
+    $zip = new ZipArchive();
+    if ($zip->open($save) === true) {
+      for ($i = 0; $i < $zip->numFiles; $i++) {
+        $entry = $zip->getNameIndex($i);
+        if ($entry === false) continue;
+        if (substr($entry, -1) === '/') continue;
+        $content = $zip->getFromIndex($i);
+        if ($content === false) {
+          $err = 2;
+          break;
+        }
+        $name = strtolower(basename($entry));
+        if ($name === '') continue;
+        if (!preg_match('/\.(dot|txt|json)$/', $name)) continue;
+        if (file_put_contents("$path/$name", $content) === false) {
+          $err = 2;
+          break;
+        }
+      }
+      $zip->close();
+    } else {
+      $err = 2;
+    }
     @unlink($save);
     if ($err > 1) {
-      exec("rm -rf $path");
+      remove_tree($path);
       $result = false;
       break;
     }
@@ -101,7 +163,7 @@
   $file = basename($file);
   $path = "$docroot/languages/$file";
   if ($result = is_dir($path)) {
-    exec("rm -rf $path");
+    $result = remove_tree($path);
     @unlink("$docroot/webGui/javascript/translate.$file.js");
     @unlink("$boot/lang-$file.xml");
     @unlink("$plugins/lang-$file.xml");
diff --git a/emhttp/plugins/dynamix/include/SMTPtest.php b/emhttp/plugins/dynamix/include/SMTPtest.php
index 2d3b2f1e31..9e6854f1cc 100644
--- a/emhttp/plugins/dynamix/include/SMTPtest.php
+++ b/emhttp/plugins/dynamix/include/SMTPtest.php
@@ -40,7 +40,7 @@ function PsKill($pid) {
 if (PsExecute("$docroot/webGui/scripts/notify -s 'Unraid SMTP Test' -d 'Test message received!' -i 'alert' -l '/Settings/Notifications' -t")) {
   $result = exec("tail -3 /var/log/syslog|awk '/sSMTP/ {getline;print}'|cut -d']' -f2|cut -d'(' -f1");
   $color = strpos($result, 'Sent mail') ? 'green' : 'red';
-  echo _("Test result")."<span class='$color'>$result</span>";
+  echo _("Test result")."<span class='$color'>".htmlspecialchars($result)."</span>";
 } else {
   echo _("Test result")."<span class='red'>: "._('No reply from mail server')."</span>";
 }
diff --git a/emhttp/plugins/dynamix/include/ToggleState.php b/emhttp/plugins/dynamix/include/ToggleState.php
index 63e4e87dcd..d940e75169 100644
--- a/emhttp/plugins/dynamix/include/ToggleState.php
+++ b/emhttp/plugins/dynamix/include/ToggleState.php
@@ -19,7 +19,7 @@
 $action = $_POST['action']??'';
 
 function emcmd($cmd) {
-  exec("emcmd '$cmd'");
+  exec("emcmd ".escapeshellarg($cmd));
 }
 switch ($device) {
 case 'New':
diff --git a/emhttp/plugins/dynamix/scripts/diagnostics b/emhttp/plugins/dynamix/scripts/diagnostics
index 97563e220f..027b04ae2f 100755
--- a/emhttp/plugins/dynamix/scripts/diagnostics
+++ b/emhttp/plugins/dynamix/scripts/diagnostics
@@ -497,7 +497,7 @@ run("lscpu 2>/dev/null|todos >".escapeshellarg("/$diag/system/lscpu.txt"));
 run("lsscsi -vgl 2>/dev/null|todos >".escapeshellarg("/$diag/system/lsscsi.txt"));
 run("lspci -knn 2>/dev/null|todos >".escapeshellarg("/$diag/system/lspci.txt"));
 run("lspci -vv 2>/dev/null| awk -b '/ASPM/{print $0}' RS=|grep -P '(^[a-z0-9:.]+|ASPM |Disabled;|Enabled;)'|todos >".escapeshellarg("/$diag/system/aspm-status.txt"));
-run("lsusb 2>/dev/null|todos >".escapeshellarg("/$diag/system/lsusb.txt"));
+run("lsusb -vt 2>/dev/null|todos >".escapeshellarg("/$diag/system/lsusb.txt"));
 run("free -mth 2>/dev/null|todos >".escapeshellarg("/$diag/system/memory.txt"));
 run("lsof -Pni 2>/dev/null|todos >".escapeshellarg("/$diag/system/lsof.txt"));
 run("lsmod|sort 2>/dev/null|todos >".escapeshellarg("/$diag/system/lsmod.txt"));
diff --git a/emhttp/plugins/dynamix/scripts/system_information b/emhttp/plugins/dynamix/scripts/system_information
index 32433d786b..ed91c8f18d 100755
--- a/emhttp/plugins/dynamix/scripts/system_information
+++ b/emhttp/plugins/dynamix/scripts/system_information
@@ -83,38 +83,57 @@ if (!empty($iommu_groups)) {
   $iommu .= '</a>';
 }
 
+$normalize_binary_unit = function($value) {
+  return preg_replace_callback('/\b([KMGTPE]?)(?:i)?B\b/i',function($match) {
+    $prefix = strtoupper($match[1] ?? '');
+    return $prefix ? "{$prefix}iB" : 'B';
+  },$value ?? '');
+};
+
 $cache_installed = [];
 $cache_devices = dmidecode('Cache Information',7);
-foreach ($cache_devices as $device) $cache_installed[] = $device['Socket Designation'].": ".str_replace(['kB','B'],['KB','iB'],$device['Installed Size']);
+foreach ($cache_devices as $device) {
+  $cache_installed[] = $device['Socket Designation'].": ".$normalize_binary_unit($device['Installed Size'] ?? '');
+}
 
 /*
  Memory Device (16) will get us each ram chip. By matching on MB it'll filter out Flash/Bios chips
- Sum up all the Memory Devices to get the amount of system memory installed. Convert MB to GB
+ Sum up all the Memory Devices to get the amount of system memory installed. Convert MiB to GiB
  Physical Memory Array (16) usually one of these for a desktop-class motherboard but higher-end xeon motherboards
- might have two or more of these.  The trick is to filter out any Flash/Bios types by matching on GB
+ might have two or more of these.  The trick is to filter out any Flash/Bios types by matching on GiB
  Sum up all the Physical Memory Arrays to get the motherboard's total memory capacity
  Extract error correction type, if none, do not include additional information in the output
  If maximum < installed then roundup maximum to the next power of 2 size of installed. E.g. 6 -> 8 or 12 -> 16
 */
-$sizes = ['MB','GB','TB'];
+$memory_units = [
+  // dmidecode reports memory capacities using binary math; treat both SI and IEC labels as base-1024.
+  // This keeps parsing consistent across dmidecode versions that may print GB/TB or GiB/TiB.
+  'kb' => 1/1024, 'kib' => 1/1024,
+  'mb' => 1,      'mib' => 1,
+  'gb' => 1024,   'gib' => 1024,
+  'tb' => 1048576,'tib' => 1048576,
+  'pb' => 1073741824, 'pib' => 1073741824
+];
+$parse_memory_to_mib = function($value) use ($memory_units) {
+  if (!preg_match('/([0-9.]+)\s*([A-Za-z]+)/',$value ?? '',$match)) return 0;
+  $size = (float)$match[1];
+  $unit = strtolower($match[2]);
+  return isset($memory_units[$unit]) ? (int)round($size*$memory_units[$unit]) : 0;
+};
 $memory_type = $ecc = '';
 $memory_installed = $memory_maximum = 0;
 $memory_devices = dmidecode('Memory Device',17);
 $modules = 0;
 foreach ($memory_devices as $device) {
   if (empty($device['Type']) || $device['Type']=='Unknown') continue;
-  [$size, $unit] = my_explode(' ',$device['Size']);
-  $base = array_search($unit,$sizes);
-  if ($base!==false) $memory_installed += $size*pow(1024,$base);
+  $memory_installed += $parse_memory_to_mib($device['Size'] ?? '');
   if (!$memory_type) $memory_type = $device['Type'];
   $modules++;
 }
 $memory = $modules > 1 ? "<span class='link blue-text' onclick=\"$('tr.ram').toggle()\">"._('Memory').":</span>" : _('Memory').':';
 $memory_array = dmidecode('Physical Memory Array',16);
 foreach ($memory_array as $device) {
-  [$size, $unit] = my_explode(' ',$device['Maximum Capacity']);
-  $base = array_search($unit,$sizes);
-  if ($base>=1) $memory_maximum += $size*pow(1024,$base);
+  $memory_maximum += $parse_memory_to_mib($device['Maximum Capacity'] ?? '');
   if (!$ecc && isset($device['Error Correction Type']) && $device['Error Correction Type']!='None') $ecc = $device['Error Correction Type']." ";
 }
 if ($memory_installed >= 1048576) {
@@ -152,7 +171,7 @@ span.link{text-decoration:underline;cursor:pointer}
 <?
 foreach ($memory_devices as $device) {
   if (empty($device['Type']) || $device['Type']=='Unknown') continue;
-  $size = preg_replace('/( .)B$/','$1iB',_var($device,'Size',0));
+  $size = $normalize_binary_unit(_var($device,'Size',0));
   echo "<tr class='ram'><td></td><td>",$device['Locator'],": ",_var($device,'Manufacturer')," ",_var($device,'Part Number'),", $size ",_var($device,'Type')," @ ",_var($device,'Configured Memory Speed'),"</td></tr>";
 }
 
diff --git a/emhttp/plugins/unRAIDServer/EULA.page b/emhttp/plugins/unRAIDServer/EULA.page
new file mode 100644
index 0000000000..71668ad473
--- /dev/null
+++ b/emhttp/plugins/unRAIDServer/EULA.page
@@ -0,0 +1,21 @@
+Menu="About"
+Title="EULA"
+Icon="icon-eula"
+Tag="file-text-o"
+---
+<?PHP
+/* Copyright 2005-2019, Lime Technology
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License version 2,
+ * as published by the Free Software Foundation.
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ */
+?>
+<?
+$file = "/boot/license.txt";
+if (file_exists($file)) echo Markdown(file_get_contents($file)); else echo Markdown("** No license file present! **");
+?>
+<button type="button" onclick="done()">Done</button>
diff --git a/emhttp/plugins/unRAIDServer/README.md b/emhttp/plugins/unRAIDServer/README.md
new file mode 100644
index 0000000000..0692574c3b
--- /dev/null
+++ b/emhttp/plugins/unRAIDServer/README.md
@@ -0,0 +1,3 @@
+**Unraid OS**
+
+Unraid OS by [Lime Technology, Inc.](https://lime-technology.com).
diff --git a/emhttp/plugins/unRAIDServer/icons/eula.png b/emhttp/plugins/unRAIDServer/icons/eula.png
new file mode 100644
index 0000000000..09c5757ed6
Binary files /dev/null and b/emhttp/plugins/unRAIDServer/icons/eula.png differ
diff --git a/emhttp/plugins/unRAIDServer/icons/license.png b/emhttp/plugins/unRAIDServer/icons/license.png
new file mode 100644
index 0000000000..d6e06fae5a
Binary files /dev/null and b/emhttp/plugins/unRAIDServer/icons/license.png differ
diff --git a/emhttp/plugins/unRAIDServer/images/unRAIDServer.png b/emhttp/plugins/unRAIDServer/images/unRAIDServer.png
new file mode 100644
index 0000000000..d22f233133
Binary files /dev/null and b/emhttp/plugins/unRAIDServer/images/unRAIDServer.png differ
diff --git a/emhttp/plugins/unRAIDServer/unRAIDServer.plg b/emhttp/plugins/unRAIDServer/unRAIDServer.plg
new file mode 100644
index 0000000000..a9ddf690a3
--- /dev/null
+++ b/emhttp/plugins/unRAIDServer/unRAIDServer.plg
@@ -0,0 +1,420 @@
+<!DOCTYPE PLUGIN [
+<!ENTITY name      "unRAIDServer">
+<!ENTITY author    "LimeTech">
+<!ENTITY version   "">
+<!ENTITY date      "">
+<!ENTITY date0     "">
+<!ENTITY kernel    "">
+<!ENTITY api       "">
+<!ENTITY category  "">
+<!ENTITY pluginURL "">
+<!ENTITY zip       "">
+<!ENTITY md5       "">
+<!ENTITY notes     "">
+<!ENTITY files     "bz*,make_bootable.bat,make_bootable_linux,make_bootable_mac,memtest*,changes.txt,license.txt,syslinux/syslinux.cfg-">
+<!ENTITY infozip   "infozip-6.0-i486-1.txz">
+]>
+
+<PLUGIN  name="&name;"
+         author="&author;"
+         version="&version;"
+         date="&date;"
+         date0="&date0;"
+         kernel="&kernel;"
+         api="&api;"
+         category="&category;"
+         pluginURL="&pluginURL;">
+
+<CHANGES>
+# Version &version; &date;
+
+## Changes
+
+Refer to [Release Notes](&notes;)
+
+## Linux kernel
+
+* version &kernel;
+
+</CHANGES>
+
+<!--
+Be compatible with unRAID-5 installplg
+-->
+<FILE Name="/tmp/&name;.sh" Run="/bin/bash">
+<INLINE>
+rm /tmp/&name;.sh
+# cleanup possibly failed previous download/install attempt
+rm -rf /tmp/&name;*
+mkdir /tmp/&name;
+# check if this is unRAID-5
+source /etc/unraid-version
+if [[ "${version:0:2}" == "5." ]]; then
+  # prevent endless install loop
+  rm -rf /boot/plugins/&name;.plg
+  rm -rf /boot/config/plugins/&name;.plg
+  # check if 64-bit capable CPU
+  if ! grep -q " lm" /proc/cpuinfo ; then
+    echo "CPU is not 64-bit capable"
+    exit 1
+  fi
+  # Wait until network is ready by pinging google - thanks bonienl!
+  ip=8.8.4.4
+  timer=30
+  while [[ $timer -gt 0 ]]; do
+    if [[ -n $(route -n|awk '/^0.0.0.0/{print $2}') &amp;&amp; $(ping -qnc1 $ip|awk '/received/{print $4}') -eq 1 ]]; then
+      break
+    fi
+    ((timer--))
+    sleep 1
+  done
+  if [[ $timer -eq 0 ]]; then
+    echo "No network communication !!!"
+    exit 1
+  fi
+  # unRAID-5 needs infozip
+  if [ ! -f /boot/extra/&infozip; ]; then
+    echo "Downloading &infozip; package"
+    mkdir -p /boot/extra
+    wget http://slackware.cs.utah.edu/pub/slackware/slackware-13.1/slackware/a/&infozip; -O /boot/extra/&infozip;
+    upgradepkg --install-new /boot/extra/&infozip;
+  fi
+  # download the release
+  if ! wget --no-check-certificate &zip; -O /tmp/&name;.zip ; then
+    echo "&zip; download error $?"
+    exit 1
+  fi
+  if ! wget --no-check-certificate &md5; -O /tmp/&name;.md5 ; then
+    echo "&md5; download error $?"
+    exit 1
+  fi
+fi
+</INLINE>
+</FILE>
+
+<!--
+Block upgrade when ReiserFS filesystems are present
+-->
+<FILE Run="/bin/bash" Method="install">
+<INLINE>
+version="&version;"
+<![CDATA[
+if [[ $(php -r "echo version_compare('$version', '7.3.0-beta.0.1');") -lt 0 ]]; then
+  exit 0
+fi
+
+REISER_DEVICES=$(/sbin/blkid -c /dev/null -t TYPE=reiserfs -o device 2>/dev/null)
+if [[ -n "$REISER_DEVICES" ]]; then
+  echo "***"
+  echo "*** ReiserFS filesystem(s) detected:"
+  echo "$REISER_DEVICES"
+  echo "*** Upgrading to this Unraid version is blocked while ReiserFS is in use."
+  echo "*** Please migrate all ReiserFS disks to a supported filesystem and retry."
+  echo "***"
+  exit 1
+fi
+exit 0
+]]>
+</INLINE>
+</FILE>
+
+<!--
+If Unraid Connect is installed, ensure it is current
+-->
+<FILE Run="/bin/bash" Method="install">
+<INLINE>
+NEW_UNRAID_VERSION="&version;"
+NEW_API="&api;"
+<![CDATA[
+PLUGIN=/usr/local/sbin/plugin
+PLG=dynamix.unraid.net.plg
+INSTALLED_PLUGIN_FILE="/boot/config/plugins/$PLG"
+NEXTBOOT_PLUGIN_FILE="/boot/config/plugins-nextboot/$PLG"
+API_PLUGIN_FILE="$INSTALLED_PLUGIN_FILE"
+
+if [[ -f "$INSTALLED_PLUGIN_FILE" ]]; then
+
+  # Check if the download method is available in plugin script
+  if grep -q "method === 'download'" "$PLUGIN" 2>/dev/null; then
+    echo "Checking for a newer version of Unraid Connect"
+    # Get the currently installed version of the Connect plugin
+    INSTALLED_VERSION=$($PLUGIN version "$INSTALLED_PLUGIN_FILE" 2>/dev/null)
+
+    # Check for latest version (downloads to /tmp/plugins/$PLG and outputs version)
+    # Extract version from output (version is on its own line, filter out hook messages)
+    LATEST_VERSION=$($PLUGIN check "$PLG" 2>/dev/null | grep -E '^[0-9]+\.[0-9]+\.[0-9]+' | head -n1)
+
+    # Compare versions using PHP's version_compare (returns -1 if latest < installed, 0 if equal, 1 if latest > installed)
+    if [[ -n "$INSTALLED_VERSION" && -n "$LATEST_VERSION" ]]; then
+      if [[ $(php -r "echo version_compare('$LATEST_VERSION', '$INSTALLED_VERSION');") -gt 0 ]]; then
+        # Latest version of Connect is newer, download files without installing
+        # The 'download' method expects the 'check' method to have put the updated plugin in /tmp/plugins/
+        # The 'download' method downloads files but skips Run commands, and stages the plugin in /boot/config/plugins-nextboot/
+        echo "Downloading newer version of Unraid Connect"
+        if ! $PLUGIN download "$PLG" "$NEW_UNRAID_VERSION" 2>/dev/null; then
+          echo "Warning: Failed to download newer version of Unraid Connect"
+        elif [[ -f "$NEXTBOOT_PLUGIN_FILE" ]]; then
+          API_PLUGIN_FILE="$NEXTBOOT_PLUGIN_FILE"
+        fi
+      fi
+    fi
+  fi
+
+  # If a newer Connect plugin was already staged by a previous run, prefer that staged file
+  # for the API check even when this execution path did not just download it.
+  if [[ "$API_PLUGIN_FILE" == "$INSTALLED_PLUGIN_FILE" && -f "$NEXTBOOT_PLUGIN_FILE" ]]; then
+    NEXTBOOT_VERSION=$($PLUGIN version "$NEXTBOOT_PLUGIN_FILE" 2>/dev/null)
+    INSTALLED_VERSION=${INSTALLED_VERSION:-$($PLUGIN version "$INSTALLED_PLUGIN_FILE" 2>/dev/null)}
+    if [[ -n "$NEXTBOOT_VERSION" && ( -z "$INSTALLED_VERSION" || $(php -r "echo version_compare('$NEXTBOOT_VERSION', '$INSTALLED_VERSION');") -gt 0 ) ]]; then
+      API_PLUGIN_FILE="$NEXTBOOT_PLUGIN_FILE"
+    fi
+  fi
+
+  # Get the API version from the Unraid Connect plugin that will be used after reboot.
+  INSTALLED_API=$(grep -o 'ENTITY api_version "[^"]*"' "$API_PLUGIN_FILE" | sed 's/ENTITY api_version "//;s/"//')
+  [[ -z "$INSTALLED_API" ]] && exit 0
+
+  # Ensure the API version for this new version of Unraid is defined
+  [[ -z "$NEW_API" ]] && exit 0
+
+  # Strip build strings (everything after +) from both versions before comparison
+  INSTALLED_API=${INSTALLED_API%+*}
+  NEW_API=${NEW_API%+*}
+
+  # Compare API versions - if installed plugin has older API than the new unRAID version, require update
+  if [[ $(php -r "echo version_compare('$INSTALLED_API', '$NEW_API');") -lt 0 ]]; then
+    echo "***"
+    echo "*** Please update the Unraid Connect plugin before upgrading Unraid!"
+    echo "***"
+    exit 1
+  fi
+
+fi
+
+exit 0
+]]>
+</INLINE>
+</FILE>
+
+<!--
+Download release from S3
+For unRAID-5 this will be skipped because already downloaded above
+For unRAID-6 we download here, verifying certificiate
+-->
+<FILE Name="/tmp/&name;.zip">
+<URL>&zip;</URL>
+</FILE>
+<FILE Name="/tmp/&name;.md5">
+<URL>&md5;</URL>
+</FILE>
+
+<FILE Name="/tmp/&name;.sh" Run="/bin/bash">
+<INLINE>
+rm /tmp/&name;.sh
+# check download and extract
+sum1=$(/usr/bin/md5sum /tmp/&name;.zip)
+sum2=$(cat /tmp/&name;.md5)
+if [[ "${sum1:0:32}" != "${sum2:0:32}" ]]; then
+  echo "wrong md5"
+  exit 1
+fi
+# check if enough free space on flash
+have=$(df -B1 /boot | awk 'END {print $4}')
+need=$(unzip -l /tmp/&name;.zip | awk 'END {print $1}')
+source /etc/unraid-version
+if [[ "${version:0:2}" == "5." ]]; then
+  # to permit another upgrade
+  need=$(($need * 2))
+fi
+if [[ $need -gt $have ]]; then
+  echo "boot device shows $have free but upgrade needs $need"
+  exit 1
+fi
+# detect if Plugin-Update-Helper for third party driver plugins is running and update it
+plg_update_helper=$(ps aux | grep -E "inotifywait -q /boot/changes.txt -e move_self,delete_self" | grep -v "grep -E inotifywait" | awk '{print $2}')
+if [ ! -z "${plg_update_helper}" ]; then
+  echo "Plugin-Update-Helper for 3rd party driver plugins found, updating..."
+  kill ${plg_update_helper} 2>/dev/null
+  wget -q -T 5 -O /usr/bin/plugin_update_helper "https://raw.githubusercontent.com/ich777/unraid-plugin_update_helper/master/plugin_update_helper"
+  chmod +x /usr/bin/plugin_update_helper 2>/dev/null
+  echo "/usr/bin/plugin_update_helper" | at now > /dev/null 2>&amp;1
+fi
+# move release files to flash
+echo
+echo "writing flash device - please wait..."
+mkdir -p /boot/&name;
+rm -rf /boot/&name;/*
+files=&files;
+unzip -d /boot/&name; /tmp/&name;.zip ${files//,/ } || exit 1
+# ensure writes to USB flash boot device have completed and bz*.sha256 matches
+sync -f /boot ; echo 3 > /proc/sys/vm/drop_caches
+for sha in /boot/&name;/*.sha256; do
+  file=${sha%.sha256}
+  echo "checking sha256 on ${file}"
+  sha256expect=$(cat "${sha}")
+  sha256actual=$(/usr/bin/sha256sum "${file}")
+  if [[ "${sha256actual:0:64}" != "${sha256expect:0:64}" ]]; then
+    echo "*** bad sha256 on ${file}"
+    badsha256="yes"
+  fi
+done
+if [[ -v badsha256 ]]; then
+  echo "***"
+  echo "*** The upgrade failed, but no changes were made to your configuration."
+  echo "*** Your USB Flash is likely failing."
+  echo "***"
+  exit 1
+fi
+# preserve previous version
+source /etc/unraid-version
+if [[ "${version:0:2}" == "5." ]]; then
+  mkdir -p /boot/unRAID5
+  rm -rf /boot/unRAID5/*
+  # preserve all files in root of flash except ldlinux.sys needed to boot
+  find /boot -maxdepth 1 -type f -not -name ldlinux.sys -exec mv {} /boot/unRAID5 \;
+  # preserve a few directories
+  mv /boot/extra /boot/unRAID5 &amp;&gt; /dev/null
+  mv /boot/packages /boot/unRAID5 &amp;&gt; /dev/null
+  mv /boot/plugins /boot/unRAID5 &amp;&gt; /dev/null
+  mkdir /boot/unRAID5/config
+  mv /boot/config/plugins /boot/unRAID5/config &amp;&gt; /dev/null
+  # grab a fresh 'go' file
+  mv /boot/config/go /boot/unRAID5/config
+  unzip -d /boot /tmp/&name;.zip config/go || exit 1
+  # ensure key file is in the 'config' directory
+  cp /boot/unRAID5/*.key /boot/config &amp;&gt; /dev/null
+else
+  mkdir -p /boot/previous
+  # check for earlier upgrade without reboot
+  if ! /sbin/mount | grep -q "/boot/previous/bz" ; then
+    rm -rf /boot/previous/*
+    mv /boot/{&files;} /boot/previous  &amp;&gt; /dev/null
+  fi
+fi
+# capture the current hardware list
+/sbin/lspci -nnmm > /boot/previous/hardware
+# move new version files into place
+mv /boot/&name;/{&files;} /boot
+rm -r /boot/&name;
+# Unraid-6/7 specific
+if [[ "${version:0:2}" == "6." || "${version:0:2}" == "7." ]]; then
+  # replace the readme file
+  echo "**REBOOT REQUIRED!**" &gt; /usr/local/emhttp/plugins/&name;/README.md
+  # update pre-6.12.2 wireguard configuration files
+  if [[ $(php -r "echo version_compare('$version', '6.12.2');") -lt 0 ]]; then
+    for wg in /boot/config/wireguard/*.conf; do
+      sed -ri "s/^(Post(Up|Down)=logger -t wireguard .*(started|stopped)).*/\1';\/usr\/local\/emhttp\/webGui\/scripts\/update_services/" $wg
+    done
+  fi
+  # when upgrading any version prior to 6.10
+  if [[ $(php -r "echo version_compare('$version', '6.10');") -lt 0 ]]; then
+    if [[ -f /boot/config/ssl/certs/certificate_bundle.pem ]]; then
+      if grep -q 'USE_SSL="no"' /boot/config/ident.cfg &amp;&gt; /dev/null ; then
+        rm /boot/config/ssl/certs/certificate_bundle.pem
+      else
+        sed -i 's|USE_SSL="auto"|USE_SSL="yes"|g' /boot/config/ident.cfg
+      fi
+    else
+      sed -i 's|USE_SSL="auto"|USE_SSL="no"|g' /boot/config/ident.cfg
+    fi
+  fi
+fi
+# if Unraid-6.3 ensure GUI Safe Mode syslinux option exists
+if [[ "${version:0:3}" == "6.3" ]]; then
+  if ! grep -q 'initrd=/bzroot,/bzroot-gui unraidsafemode' /boot/syslinux/syslinux.cfg &amp;&gt; /dev/null ; then
+    sed -i 's|label Memtest86+|label unRAID OS GUI Safe Mode (no plugins)\r\n  kernel /bzimage\r\n  append initrd=/bzroot,/bzroot-gui unraidsafemode\r\nlabel Memtest86+|g' /boot/syslinux/syslinux.cfg &amp;&gt; /dev/null
+  fi
+fi
+# when upgrading any version prior to 6.2
+if [[ "${version:0:3}" &lt; "6.2" ]]; then
+  if ! grep -q '/bzroot-gui' /boot/syslinux/syslinux.cfg &amp;&gt; /dev/null ; then
+    sed -i 's|menu title Lime Technology\r|menu title Lime Technology, Inc.\r|g' /boot/syslinux/syslinux.cfg &amp;&gt; /dev/null
+    sed -i 's|label unRAID OS Safe Mode (no plugins)|label unRAID OS GUI Mode\r\n  kernel /bzimage\r\n  append initrd=/bzroot,/bzroot-gui\r\nlabel unRAID OS Safe Mode (no plugins, no GUI)|g' /boot/syslinux/syslinux.cfg &amp;&gt; /dev/null
+  fi
+fi
+# when upgrading any version prior to 6.1
+if [[ "${version:0:3}" &lt; "6.1" ]]; then
+  if ! grep -q 'shareDisk' /boot/config/share.cfg &amp;&gt; /dev/null ; then
+    echo 'shareDisk="yes"' &gt;&gt; /boot/config/share.cfg
+  fi
+fi
+# when upgrading from 6.0.x
+if [[ "${version:0:3}" == "6.0" ]]; then
+  sed -i 's|dynamix.docker.manager/dockerupdate.php|dynamix.docker.manager/scripts/dockerupdate.php|g' /boot/config/plugins/dynamix/docker-update.cron &amp;&gt; /dev/null
+  sed -i 's|sbin/monitor|emhttp/plugins/dynamix/scripts/monitor|g' /boot/config/plugins/dynamix/monitor.cron &amp;&gt; /dev/null
+  sed -i 's|/root/mdcmd|/usr/local/sbin/mdcmd|g' /boot/config/plugins/dynamix/parity-check.cron &amp;&gt; /dev/null
+  sed -i 's|sbin/plugincheck|emhttp/plugins/dynamix.plugin.manager/scripts/plugincheck|g' /boot/config/plugins/dynamix/plugin-check.cron &amp;&gt; /dev/null
+  sed -i 's|sbin/statuscheck|emhttp/plugins/dynamix/scripts/statuscheck|g' /boot/config/plugins/dynamix/status-check.cron &amp;&gt; /dev/null
+fi
+# if template-repos does not exist
+if [[ ! -e /boot/config/plugins/dockerMan/template-repos ]]; then
+  mkdir -p /boot/config/plugins/dockerMan
+  echo "https://github.com/limetech/docker-templates" &gt; /boot/config/plugins/dockerMan/template-repos
+fi
+# if EFI or EFI- directory does not exist on vfat file system
+if [[ ! -e /boot/efi &amp;&amp; ! -e /boot/efi- ]]; then
+  unzip -d /boot /tmp/&name;.zip EFI/* || exit 1
+  sed -i 's|default /syslinux/menu.c32|default menu.c32|g' /boot/syslinux/syslinux.cfg &amp;&gt; /dev/null
+fi
+# if metric appended to GATEWAY get rid of it
+if [[ -f /boot/config/network.cfg ]]; then
+  sed -ri 's|^(GATEWAY.+)#[0-9]+|\1|' /boot/config/network.cfg
+fi
+# if legacy dynamix.plg file exists, delete it
+rm -f /boot/config/plugins/dynamix.plg
+# download any patches for this version before rebooting
+if [[ -x /usr/local/emhttp/plugins/unraid.patch/scripts/patch.php ]]; then
+  /usr/local/emhttp/plugins/unraid.patch/scripts/patch.php check &version;
+fi
+# ensure writes to USB flash boot device have completed
+sync -f /boot
+if [ -z "${plg_update_helper}" ]; then
+  echo "Update successful - PLEASE REBOOT YOUR SERVER"
+else
+  echo "Third party plugins found - PLEASE CHECK YOUR UNRAID NOTIFICATIONS AND WAIT FOR THE MESSAGE THAT IT IS SAFE TO REBOOT!"
+fi
+</INLINE>
+</FILE>
+
+<!--
+The 'remove' script.
+-->
+<FILE Name="/tmp/&name;.sh" Run="/bin/bash" Method="remove">
+<INLINE>
+rm /tmp/&name;.sh
+# unRAID-5 doesn't support 'remove' method, so we're done
+source /etc/unraid-version
+if [[ "${version:0:2}" == "5." ]]; then
+  exit 0
+fi
+if [[ -d /boot/previous ]]; then
+  # restore previous Unraid-6 release
+  rm -f /boot/previous/hardware
+  mv /boot/previous/* /boot
+  rmdir /boot/previous
+  echo "**REBOOT REQUIRED!**" &gt; /usr/local/emhttp/plugins/&name;/README.md
+elif [[ -d /boot/unRAID5 ]]; then
+  # restore previous unRAID-5 release
+  rm -rf /boot/extra
+  mv /boot/unRAID5/extra /boot &amp;&gt; /dev/null
+  rm -rf /boot/plugins
+  mv /boot/unRAID5/plugins /boot &amp;&gt; /dev/null
+  rm -rf /boot/packages
+  mv /boot/unRAID5/packages /boot &amp;&gt; /dev/null
+  rm -rf /boot/config/plugins
+  mv /boot/unRAID5/config/plugins /boot/config &amp;&gt; /dev/null
+  mv /boot/unRAID5/config/go /boot/config
+  rmdir /boot/unRAID5/config
+  mv /boot/unRAID5/* /boot
+  rmdir /boot/unRAID5
+else
+  echo "Cannot remove, no previous version"
+  exit 1
+fi
+echo "syncing..."
+sync
+echo "Remove successful - PLEASE REBOOT YOUR SERVER"
+</INLINE>
+</FILE>
+
+</PLUGIN>
diff --git a/emhttp/redirect.htm b/emhttp/redirect.htm
deleted file mode 100644
index 8d4be51332..0000000000
--- a/emhttp/redirect.htm
+++ /dev/null
@@ -1,50 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Redirect Page</title>
-</head>
-
-<body>
-    <div id="text" style="text-align: center; margin-top: calc(100vh - 75%); display: none; font-family: sans-serif;">
-        <h1>Redirecting...</h1>
-
-        <h2><a id="redirectButton" href="/Main">Click here if you are not redirected automatically</a></h2>
-    </div>
-    <div>
-    </div>
-    <script>
-        function parseRedirectTarget(target) {
-            if (target && target !== '/') {
-                // parse target and ensure it is a bare path with no query parameters
-                const url = new URL(target, window.location.origin);
-                return url.pathname;
-            }
-            return '/Main';
-        }
-
-        function getRedirectUrl() {
-            const search = new URLSearchParams(window.location.search);
-            const targetRoute = parseRedirectTarget(search.get('target'));
-            if (search.has('data') && (search.size === 1 || search.size === 2)) {
-                return `${window.location.origin}${targetRoute}?data=${encodeURIComponent(search.get('data'))}`;
-            }
-            return `${window.location.origin}${targetRoute}`;
-        }
-
-        function showText() {
-            document.getElementById('text').style.display = 'block';
-        }
-
-        document.getElementById('redirectButton').attributes.href.value = getRedirectUrl();
-
-        setTimeout(() => {
-            showText();
-        }, 750);
-        window.location.href = getRedirectUrl();
-    </script>
-</body>
-
-</html>
diff --git a/emhttp/update.php b/emhttp/update.php
index b1b91fee6b..4046ca4a89 100644
--- a/emhttp/update.php
+++ b/emhttp/update.php
@@ -114,7 +114,7 @@ function write_log($string) {
   if (strpos($command, $docroot) !== 0)
     $command = "$docroot/$command";
   $command = realpath($command);
-  if ($command === false)
+  if ($command === false || strpos($command, rtrim(realpath($docroot), '/') . '/') !== 0)
     syslog(LOG_INFO, "Invalid #command: {$_POST['#command']}");
   else {
     $command = escapeshellcmd($command);
diff --git a/etc/rc.d/rc.M b/etc/rc.d/rc.M
index 714bdf993f..04bbd07409 100755
--- a/etc/rc.d/rc.M
+++ b/etc/rc.d/rc.M
@@ -246,7 +246,8 @@ fi
 # Start avahi:
 if [[ -x /etc/rc.d/rc.avahidaemon ]]; then
   /etc/rc.d/rc.avahidaemon start
-  /etc/rc.d/rc.avahidnsconfd start
+  # disable by default, users can start manually if needed
+  # /etc/rc.d/rc.avahidnsconfd start
 fi
 
 # Start Samba (a file/print server for Windows machines).
diff --git a/etc/rc.d/rc.docker b/etc/rc.d/rc.docker
index e9ac334d98..cbfbeac560 100755
--- a/etc/rc.d/rc.docker
+++ b/etc/rc.d/rc.docker
@@ -192,6 +192,51 @@ network(){
   docker network ls --filter driver="$1" --format='{{.Name}}' 2>/dev/null | grep -P "^[a-z]+$2(\$|\.)" | tr '\n' ' '
 }
 
+configured_gateway(){
+  local NETWORK=$1
+  local KEY=$2
+  local CFG=${NETWORK_CFG:-/boot/config/network.cfg}
+  [[ -s $CFG ]] || return
+
+  (
+    declare -A VLANID USE_DHCP IPADDR NETMASK GATEWAY METRIC USE_DHCP6 IPADDR6 NETMASK6 GATEWAY6 METRIC6 PRIVACY6 DESCRIPTION PROTOCOL
+    local BASE=${NETWORK%%.*}
+    local VLAN=
+    local IFACE ETH VALUE
+    local CANDIDATE
+    local -a CANDIDATES
+    local i j
+
+    [[ $NETWORK == *.* ]] && VLAN=${NETWORK#*.}
+    . <(fromdos <"$CFG")
+
+    for ((i=0; i<${SYSNICS:-1}; i++)); do
+      IFACE=${IFNAME[$i]:-eth$i}
+      ETH=${IFACE/#br/eth}
+      ETH=${ETH/#bond/eth}
+      CANDIDATES=("$IFACE" "$ETH" "${BRNAME[$i]}" "${BONDNAME[$i]}")
+      if [[ $i -eq 0 ]]; then
+        [[ ${BRIDGING:-} == yes ]] && CANDIDATES+=("br0")
+        [[ ${BONDING:-} == yes ]] && CANDIDATES+=("bond0")
+      fi
+      for CANDIDATE in "${CANDIDATES[@]}"; do
+        [[ -n $CANDIDATE && $CANDIDATE == "$BASE" ]] || continue
+        if [[ -z $VLAN ]]; then
+          [[ $KEY == GATEWAY6 ]] && VALUE=${GATEWAY6[$i]} || VALUE=${GATEWAY[$i]}
+          [[ -n $VALUE ]] && printf '%s\n' "$VALUE"
+          exit
+        fi
+        for ((j=1; j<${VLANS[$i]:-0}; j++)); do
+          [[ ${VLANID[$i,$j]} == "$VLAN" ]] || continue
+          [[ $KEY == GATEWAY6 ]] && VALUE=${GATEWAY6[$i,$j]} || VALUE=${GATEWAY[$i,$j]}
+          [[ -n $VALUE ]] && printf '%s\n' "$VALUE"
+          exit
+        done
+      done
+    done
+  )
+}
+
 # Is container running?
 container_running(){
   local CONTAINER
@@ -227,6 +272,97 @@ read_dom(){
   read -d \< ENTITY CONTENT
 }
 
+netrestore_add(){
+  local NETWORK=$1
+  local CONTAINER=$2
+  local IPS=$3
+  local MAC=$4
+  local ENTRY="${CONTAINER}|${IPS}|${MAC}"
+  if [[ -n ${NETRESTORE[$NETWORK]} ]]; then
+    NETRESTORE[$NETWORK]+=$'\n'
+  fi
+  NETRESTORE[$NETWORK]+=$ENTRY
+}
+
+netrestore_connect(){
+  local NETWORK=$1
+  local CONTAINER=$2
+  local MY_TT=$3
+  local MY_MAC=$4
+  local MY_IP=
+  local MY_IPV4=
+  local MY_IPV6=
+  local IP=
+  local IPAM_JSON=
+  local ENDPOINT_JSON=
+  local CONNECT_JSON=
+  local CODE=
+  local BODY=
+  local ENDPOINT_ID=
+  local ENDPOINT_MAC=
+  local OUT=
+
+  container_exist "$CONTAINER" || return 0
+  docker network inspect "$NETWORK" >/dev/null 2>&1 || return 0
+
+  if [[ -n ${REBUILD_CONTAINERS[$CONTAINER]} && ${PRIMARY_NETWORK[$CONTAINER]} == $NETWORK ]]; then
+    log "rebuild container $CONTAINER"
+    if OUT=$(/usr/local/emhttp/plugins/dynamix.docker.manager/scripts/rebuild_container "$CONTAINER" 2>&1); then
+      unset REBUILD_CONTAINERS[$CONTAINER]
+      return 0
+    fi
+    log "failed to rebuild container $CONTAINER: $OUT"
+    return 1
+  fi
+
+  for IP in ${MY_TT//;/ }; do
+    [[ -n $IP ]] || continue
+    if [[ $IP =~ ^([0-9]{1,3}\.){3}[0-9]{1,3}$ ]]; then
+      MY_IPV4=$IP
+      MY_IP="$MY_IP --ip $IP"
+    elif [[ $IP =~ : ]]; then
+      MY_IPV6=$IP
+      MY_IP="$MY_IP --ip6 $IP"
+    else
+      log "skipping invalid stored IP for $CONTAINER on network $NETWORK: $IP"
+    fi
+  done
+
+  ENDPOINT_ID=$(docker inspect --format="{{with index .NetworkSettings.Networks \"$NETWORK\"}}{{.EndpointID}}{{end}}" "$CONTAINER" 2>/dev/null)
+  if [[ -n $ENDPOINT_ID ]]; then
+    [[ -n $MY_MAC ]] || return 0
+    ENDPOINT_MAC=$(docker inspect --format="{{with index .NetworkSettings.Networks \"$NETWORK\"}}{{.MacAddress}}{{end}}" "$CONTAINER" 2>/dev/null)
+    [[ ${ENDPOINT_MAC,,} == ${MY_MAC,,} ]] && return 0
+    log "reconnecting $CONTAINER to network $NETWORK to restore MAC $MY_MAC"
+    if ! OUT=$(docker network disconnect -f "$NETWORK" "$CONTAINER" 2>&1); then
+      log "failed to disconnect $CONTAINER from network $NETWORK: $OUT"
+      return 1
+    fi
+  fi
+
+  if [[ -n $MY_MAC ]]; then
+    [[ -n $MY_IPV4 ]] && IPAM_JSON="\"IPv4Address\":\"$MY_IPV4\""
+    [[ -n $MY_IPV6 ]] && IPAM_JSON="${IPAM_JSON:+$IPAM_JSON,}\"IPv6Address\":\"$MY_IPV6\""
+    ENDPOINT_JSON="\"MacAddress\":\"$MY_MAC\""
+    [[ -n $IPAM_JSON ]] && ENDPOINT_JSON="\"IPAMConfig\":{$IPAM_JSON},$ENDPOINT_JSON"
+    CONNECT_JSON="{\"Container\":\"$CONTAINER\",\"EndpointConfig\":{$ENDPOINT_JSON}}"
+    OUT=$(curl --unix-socket /var/run/docker.sock -sS -w $'\n%{http_code}' -X POST -H "Content-Type: application/json" --data "$CONNECT_JSON" "http://localhost/networks/$NETWORK/connect" 2>&1)
+    CODE=${OUT##*$'\n'}
+    BODY=${OUT%$'\n'$CODE}
+    if [[ $CODE != 2* ]]; then
+      log "failed to connect $CONTAINER to network $NETWORK: $BODY"
+      return 1
+    fi
+    return 0
+  fi
+
+  log "connecting $CONTAINER to network $NETWORK"
+  if ! OUT=$(docker network connect $MY_IP $NETWORK $CONTAINER 2>&1); then
+    log "failed to connect $CONTAINER to network $NETWORK: $OUT"
+    return 1
+  fi
+}
+
 container_add_route(){
   local CT=($(docker inspect --format='{{.State.Pid}} {{.NetworkSettings.Networks}}' $1))
   local PID=${CT[0]}
@@ -267,7 +403,7 @@ docker_network_start(){
   done <<< $(ls --indicator-style=none $SYSTEM | grep -P '^(bond|eth|wlan)[0-9]+')
   if ! docker_running; then return 1; fi
   # get container settings for custom networks to reconnect later
-  declare -A NETRESTORE CTRESTORE
+  declare -A NETRESTORE PRIMARY_NETWORK REBUILD_CONTAINERS USED_SUBNETS4 USED_SUBNETS6 RESTORED_NETWORKS
   for CONTAINER in $(docker container ls -a --format='{{.Names}}'); do
     # the file case (due to fat32) might be different so use find to match
     XMLFILE=$(find /boot/config/plugins/dockerMan/templates-user -maxdepth 1 -iname my-${CONTAINER}.xml)
@@ -279,33 +415,41 @@ docker_network_start(){
         [[ ${NIC:0:3} == eth ]] && NIC=$(active $NIC)
         X=${NIC//[^0-9]/}
         REF=$(grep -Pom1 "<Network>\K(br|bond|eth|wlan)$X" $XMLFILE)
-        [[ $X == 0 && ! $(carrier $NIC 1) ]] && continue
+        if [[ $X == 0 ]] && ! carrier $NIC 1; then
+          continue
+        fi
         [[ $X == 0 && $NIC != wlan0 ]] && MAIN=$NIC
         [[ $NIC == wlan0 && -n $MAIN ]] && continue
         if [[ -n $REF && $REF != $NIC ]]; then
           sed -ri "s/<Network>(br|bond|eth|wlan)$X(\.[0-9]+)?<\/Network>/<Network>$NIC\2<\/Network>/" $XMLFILE
-          # flag container for later rebuild
           REBUILD=1
         fi
       done
-      MY_NETWORK= MY_IP=
+      MY_NETWORK= MY_IP= MY_MAC= XML_MAC= TEMPLATE_MAC= CUSTOM_PRIMARY=
       while read_dom; do
         [[ $ENTITY == Network ]] && MY_NETWORK=$CONTENT
         [[ $ENTITY == MyIP ]] && MY_IP=${CONTENT// /,} && MY_IP=$(echo "$MY_IP" | tr -s "," ";")
+        [[ $ENTITY == MyMAC ]] && XML_MAC=${CONTENT// /}
       done <$XMLFILE
       # only restore valid networks
       if [[ -n $MY_NETWORK ]]; then
-        NETRESTORE[$MY_NETWORK]="$CONTAINER,$MY_IP ${NETRESTORE[$MY_NETWORK]}"
-        # save container name for later rebuild
-        CTRESTORE[$MY_NETWORK]=$REBUILD
+        [[ $MY_NETWORK =~ ^(br|bond|eth|wlan)[0-9]+(\.[0-9]+)?$ ]] && CUSTOM_PRIMARY=1
+        TEMPLATE_MAC=$(sed -nE 's@.*<ExtraParams>.*--mac-address(=|[[:space:]]+)([^ <]+).*@\2@p' "$XMLFILE" | head -n1)
+        if [[ -n $XML_MAC ]]; then
+          MY_MAC=$XML_MAC
+        else
+          MY_MAC=$(docker inspect --format="{{with index .NetworkSettings.Networks \"$MY_NETWORK\"}}{{.MacAddress}}{{end}}" $CONTAINER 2>/dev/null)
+          [[ -n $MY_MAC ]] || MY_MAC=$TEMPLATE_MAC
+        fi
+        netrestore_add "$MY_NETWORK" "$CONTAINER" "$MY_IP" "$MY_MAC"
+        PRIMARY_NETWORK[$CONTAINER]=$MY_NETWORK
+        [[ -n $REBUILD || (-z $XML_MAC && -n $TEMPLATE_MAC && -n $CUSTOM_PRIMARY) ]] && REBUILD_CONTAINERS[$CONTAINER]=1
       fi
     fi
     # restore user defined networks
-    USER_NETWORKS=$(docker inspect --format='{{range $key,$value:=.NetworkSettings.Networks}}{{$key}};{{if $value.IPAMConfig}}{{if $value.IPAMConfig.IPv4Address}}{{$value.IPAMConfig.IPv4Address}}{{end}}{{if $value.IPAMConfig.IPv6Address}},{{$value.IPAMConfig.IPv6Address}}{{end}}{{end}} {{end}}' $CONTAINER)
-    for ROW in $USER_NETWORKS; do
-      ROW=(${ROW/;/ })
-      USER_NETWORK=${ROW[0]}
-      USER_IP=${ROW[1]/,/;}
+    USER_NETWORKS=$(docker inspect --format='{{range $key,$value:=.NetworkSettings.Networks}}{{printf "%s;%s;" $key $value.MacAddress}}{{if $value.IPAMConfig}}{{if $value.IPAMConfig.IPv4Address}}{{$value.IPAMConfig.IPv4Address}}{{end}}{{if $value.IPAMConfig.IPv6Address}},{{$value.IPAMConfig.IPv6Address}}{{end}}{{end}}{{println}}{{end}}' $CONTAINER)
+    while IFS=';' read -r USER_NETWORK USER_MAC USER_IP; do
+      USER_IP=${USER_IP//,/;}
       if [[ -n $USER_NETWORK && $USER_NETWORK != $MY_NETWORK ]]; then
         LABEL=${USER_NETWORK//[0-9.]/}
         IF_NO_PARTS=${USER_NETWORK#"$LABEL"}
@@ -316,9 +460,9 @@ docker_network_start(){
           USER_NETWORK=${USER_NETWORK/$LABEL/${PORT:0:-1}}
         fi
         log "container $CONTAINER has an additional network that will be restored: $USER_NETWORK"
-        NETRESTORE[$USER_NETWORK]="$CONTAINER,$USER_IP ${NETRESTORE[$USER_NETWORK]}"
+        netrestore_add "$USER_NETWORK" "$CONTAINER" "$USER_IP" "$USER_MAC"
       fi
-    done
+    done <<< "$USER_NETWORKS"
   done
   # detach custom networks
   for NIC in $NICS; do
@@ -354,6 +498,9 @@ docker_network_start(){
       if [[ -n $IPV4 ]]; then
         SUBNET=$(ip -4 route show dev $NETWORK | sort | awk -v ORS=" " '$1 !~ /^default/ {print $1}' | sed 's/ $//')
         GATEWAY=$(ip -4 route show to default dev $NETWORK | awk '{print $3;exit}')
+        [[ -n $GATEWAY ]] || GATEWAY=$(configured_gateway "$NETWORK" GATEWAY)
+        [[ -n $GATEWAY ]] || { DEVICE=${NETWORK/./_}; DEVICE=${DEVICE^^}; DGW=DOCKER_GATEWAY_$DEVICE; GATEWAY=${!DGW}; }
+        [[ -n $GATEWAY ]] || GATEWAY=$(/usr/local/emhttp/plugins/dynamix.docker.manager/scripts/derive_gateway "$SUBNET")
         SERVER=${IPV4%/*}
         DHCP=${NETWORK/./_}
         DHCP=DOCKER_DHCP_${DHCP^^}
@@ -365,6 +512,8 @@ docker_network_start(){
       if [[ -n $IPV6 ]]; then
         SUBNET6=$(ip -6 route show dev $NETWORK | sort | awk -v ORS=" " '$1 !~ /^(default|fe80)/ {print $1}' | sed 's/ $//')
         GATEWAY6=$(ip -6 route show to default dev $NETWORK | awk '{print $3;exit}')
+        [[ -n $GATEWAY6 ]] || GATEWAY6=$(configured_gateway "$NETWORK" GATEWAY6)
+        [[ -n $GATEWAY6 ]] || { DEVICE=${NETWORK/./_}; DEVICE=${DEVICE^^}; DGW=DOCKER_GATEWAY6_$DEVICE; GATEWAY6=${!DGW}; }
       fi
     else
       # add user defined networks
@@ -384,6 +533,24 @@ docker_network_start(){
       GATEWAY6=DOCKER_GATEWAY6_$DEVICE
       GATEWAY6=${!GATEWAY6}
     fi
+    SKIP_NETWORK=
+    for CANDIDATE in $SUBNET; do
+      if [[ -n ${USED_SUBNETS4[$CANDIDATE]} ]]; then
+        log "skipping network $NETWORK: IPv4 subnet $CANDIDATE is already used by ${USED_SUBNETS4[$CANDIDATE]}"
+        SKIP_NETWORK=1
+        break
+      fi
+    done
+    if [[ -z $SKIP_NETWORK ]]; then
+      for CANDIDATE in $SUBNET6; do
+        if [[ -n ${USED_SUBNETS6[$CANDIDATE]} ]]; then
+          log "skipping network $NETWORK: IPv6 subnet $CANDIDATE is already used by ${USED_SUBNETS6[$CANDIDATE]}"
+          SKIP_NETWORK=1
+          break
+        fi
+      done
+    fi
+    [[ -n $SKIP_NETWORK ]] && continue
     # set parameters for custom network creation
     [[ -n $SUBNET ]] && SET4=1 || SET4=0
     [[ -n $SUBNET6 ]] && SET6=1 || SET6=0
@@ -415,22 +582,18 @@ docker_network_start(){
       log "Processing... $NETWORK"
       docker network rm $NETWORK &>/dev/null
       docker network create -d $ATTACH $SUBNET $GATEWAY $SERVER $RANGE $SUBNET6 $GATEWAY6 -o parent=$VHOST $NETWORK | xargs docker network inspect -f "created network $ATTACH {{.Name}} with subnets: {{range .IPAM.Config}}{{.Subnet}}; {{end}}" 2>/dev/null | log
-      # connect containers to this new network
-      for CONNECT in ${NETRESTORE[$NETWORK]}; do
-        CONTAINER=${CONNECT%,*}
-        MY_TT=${CONNECT#*,}
-        MY_IP=
-        for IP in ${MY_TT//;/ }; do
-          [[ $IP =~ ':' ]] && MY_IP="$MY_IP --ip6 $IP" || MY_IP="$MY_IP --ip $IP"
-        done
-        log "connecting $CONTAINER to network $NETWORK"
-        docker network connect $MY_IP $NETWORK $CONTAINER >/dev/null
-        if [[ -n ${CTRESTORE[$NETWORK]} ]]; then
-          # rebuild the container to use changed network
-          log "rebuild container $CONTAINER"
-          /usr/local/emhttp/plugins/dynamix.docker.manager/scripts/rebuild_container $CONTAINER
-        fi
+      for CANDIDATE in ${SUBNET//--subnet=/ }; do
+        [[ -n $CANDIDATE ]] && USED_SUBNETS4[$CANDIDATE]=$NETWORK
+      done
+      for CANDIDATE in ${SUBNET6//--ipv6 / }; do
+        [[ $CANDIDATE == --subnet=* ]] && USED_SUBNETS6[${CANDIDATE#--subnet=}]=$NETWORK
       done
+      # connect containers to this new network
+      while IFS='|' read -r CONTAINER MY_TT MY_MAC; do
+        [[ -n $CONTAINER ]] || continue
+        netrestore_connect "$NETWORK" "$CONTAINER" "$MY_TT" "$MY_MAC"
+      done <<< "${NETRESTORE[$NETWORK]}"
+      RESTORED_NETWORKS[$NETWORK]=1
       # hack to let containers talk to host
       if [[ $TYPE == br ]]; then
         SHIM=shim-$NETWORK
@@ -484,6 +647,13 @@ docker_network_start(){
       fi
     fi
   done
+  for NETWORK in "${!NETRESTORE[@]}"; do
+    [[ -n ${RESTORED_NETWORKS[$NETWORK]} ]] && continue
+    while IFS='|' read -r CONTAINER MY_TT MY_MAC; do
+      [[ -n $CONTAINER ]] || continue
+      netrestore_connect "$NETWORK" "$CONTAINER" "$MY_TT" "$MY_MAC"
+    done <<< "${NETRESTORE[$NETWORK]}"
+  done
 #  # create IPv6 forward accept rule
 #  if [[ $IPV6_FORWARD == accept ]]; then
 #    ip6tables -P FORWARD ACCEPT
diff --git a/etc/rc.d/rc.library.source b/etc/rc.d/rc.library.source
index fb5f5f9d03..29b19049ec 100644
--- a/etc/rc.d/rc.library.source
+++ b/etc/rc.d/rc.library.source
@@ -57,7 +57,7 @@ good(){
 show(){
   case $# in
     1) ip -br addr show scope global primary -deprecated to $1 2>/dev/null | awk '{gsub("@.+","",$1);print $1;exit}' ;;
-    2) ip -br addr show scope global primary -deprecated $1 $2 2>/dev/null | awk '{$1=$2="";print;exit}' | sed -r 's/ metric [0-9]+//g' ;;
+    2) ip -br addr show scope global primary -deprecated $1 $2 2>/dev/null | awk '{$1=$2="";print;exit}' | sed -r 's/ metric [0-9]+//g;s/ peer [0-9a-fA-F:.]+\/[0-9]+//g;s/^ +//g' ;;
   esac
 }
 
diff --git a/etc/rc.d/rc.sshd b/etc/rc.d/rc.sshd
index aa82e5620f..8ac53a2bc9 100755
--- a/etc/rc.d/rc.sshd
+++ b/etc/rc.d/rc.sshd
@@ -126,6 +126,9 @@ sshd_update(){
   if sshd_running && check && [[ "$(this ListenAddress)" != "${BIND[@]}" ]]; then
     log "Updating $DAEMON..."
     sshd_reload
+  elif ! sshd_running && [[ $USE_SSH == yes ]]; then
+    log "Recovering $DAEMON..."
+    sshd_start
   fi
 }
 
diff --git a/share/docker/tailscale_container_hook b/share/docker/tailscale_container_hook
index 817e22eb10..4ed51963ed 100755
--- a/share/docker/tailscale_container_hook
+++ b/share/docker/tailscale_container_hook
@@ -298,6 +298,13 @@ while true; do
   sleep 2
 done
 
+# Clear persisted Serve/Funnel state before applying the current template mode.
+# Without this, switching the template from Funnel/Serve to No leaves the old
+# config active in the existing Tailscale state directory after restart.
+echo "Resetting Tailscale Serve/Funnel configuration"
+tailscale funnel reset >/dev/null 2>&1 || true
+tailscale serve reset >/dev/null 2>&1 || true
+
 if [ ! -z "${TAILSCALE_SERVE_PORT}" ] && [ "$(tailscale status --json | jq -r '.CurrentTailnet.MagicDNSEnabled')" != "false" ] && [ -z "$(tailscale status --json | jq -r '.Self.Capabilities[] | select(. == "https")')" ]; then
   echo "ERROR: Enable MagicDNS and HTTPS on your Tailscale account to use Tailscale Serve/Funnel."
   echo "See: https://tailscale.com/kb/1153/enabling-https"