pfSense

The widget detection function in index.php doesn't filter out invalid files. This means that if you patch a widget file, the original file (for example traffic_graphs.widget.php.orig) will also be detected, resulting in the Traffic Graphs being listed twice in "Available Widgets". The function also picks up dot files (eg VIM swap files), and whilst they're not added to the list of available widgets, they are added as hidden widgets to the page "<div id="-container" class="widgetdiv"

To repeat:
Copy or patch an existing widget, but with an altered extension (eg. .old, .orig), and then click the "Add Widget" button on the index page of the Web GUI - you will see that the patched widget has been duplicated. An inspection of the HTML will also verify this.

1. Ignore dot files - by checking that the position of the dot is zero
2. Ignore files that don't end in PHP. This may be more controversial as there's a slight possibility that people are going around creating widgets that aren't .php files.