Binary files 2.0.4/wp-admin/.DS_Store and 2.0.5/wp-admin/.DS_Store differ
diff -ruN 2.0.4/wp-admin/admin-db.php 2.0.5/wp-admin/admin-db.php
--- 2.0.4/wp-admin/admin-db.php	2006-07-23 13:27:00.000000000 -0500
+++ 2.0.5/wp-admin/admin-db.php	2006-10-31 09:05:37.000000000 -0600
@@ -34,7 +34,7 @@
 		return false;
 	} else {
 		$editable = join(',', $editable);
-		$authors = $wpdb->get_results( "SELECT * FROM $wpdb->users WHERE ID IN ($editable)" );
+		$authors = $wpdb->get_results( "SELECT * FROM $wpdb->users WHERE ID IN ($editable) ORDER BY display_name" );
 	}
 
 	return apply_filters('get_editable_authors', $authors);
@@ -266,23 +266,55 @@
 	extract($linkdata);
 
 	$update = false;
+
 	if ( !empty($link_id) )
 		$update = true;
 
+	if( trim( $link_name ) == '' )
+		return 0;
+	$link_name = apply_filters('pre_link_name', $link_name);
+
+	if( trim( $link_url ) == '' )
+		return 0;
+	$link_url = apply_filters('pre_link_url', $link_url);
+
 	if ( empty($link_rating) )
 		$link_rating = 0;	
+	else
+		$link_rating = (int) $link_rating;
+
+	if ( empty($link_image) )
+		$link_image = '';
+	$link_image = apply_filters('pre_link_image', $link_image);
 
 	if ( empty($link_target) )
 		$link_target = '';	
+	$link_target = apply_filters('pre_link_target', $link_target);
 
 	if ( empty($link_visible) )
 		$link_visible = 'Y';
-		
+	$link_visibile = preg_replace('/[^YNyn]/', '', $link_visible);
+
 	if ( empty($link_owner) )
 		$link_owner = $current_user->id;
+	else
+		$link_owner = (int) $link_owner;
 
 	if ( empty($link_notes) )
 		$link_notes = '';
+	$link_notes = apply_filters('pre_link_notes', $link_notes);
+
+	if ( empty($link_description) )
+		$link_description = '';
+	$link_description = apply_filters('pre_link_description', $link_description);
+
+	if ( empty($link_rss) )
+		$link_rss = '';
+	$link_rss = apply_filters('pre_link_rss', $link_rss);
+
+	if ( empty($link_rel) )
+		$link_rel = '';
+	$link_rel = apply_filters('pre_link_rel', $link_rel);
 
 	if ( $update ) {
 		$wpdb->query("UPDATE $wpdb->links SET link_url='$link_url',
diff -ruN 2.0.4/wp-admin/admin-footer.php 2.0.5/wp-admin/admin-footer.php
--- 2.0.4/wp-admin/admin-footer.php	2006-01-28 18:12:14.000000000 -0600
+++ 2.0.5/wp-admin/admin-footer.php	2006-10-31 09:05:37.000000000 -0600
@@ -2,7 +2,7 @@
 <div id="footer"><p><a href="http://wordpress.org/" id="wordpress-logo"><img src="images/wordpress-logo.png" alt="WordPress" /></a></p>
 <p>
 <a href="http://codex.wordpress.org/"><?php _e('Documentation'); ?></a> &#8212; <a href="http://wordpress.org/support/"><?php _e('Support Forums'); ?></a> <br />
-<?php bloginfo('version'); ?> &#8212; <?php printf(__('%s seconds'), number_format(timer_stop(), 2)); ?>
+<?php bloginfo('version'); ?> &#8212; <?php printf(__('%s seconds'), timer_stop(0, 2)); ?>
 </p>
 
 </div>
diff -ruN 2.0.4/wp-admin/admin-functions.php 2.0.5/wp-admin/admin-functions.php
--- 2.0.4/wp-admin/admin-functions.php	2006-07-26 17:56:56.000000000 -0500
+++ 2.0.5/wp-admin/admin-functions.php	2006-10-31 09:05:37.000000000 -0600
@@ -265,6 +265,8 @@
 	$post->post_title = format_to_edit($post->post_title);
 	$post->post_title = apply_filters('title_edit_pre', $post->post_title);
 
+    $post->post_password = format_to_edit($post->post_password); 
+
 	if ($post->post_status == 'static')
 		$post->page_template = get_post_meta($id, '_wp_page_template', true);
 
@@ -333,6 +335,23 @@
 	return $category;
 }
 
+function get_user_to_edit($user_id) {
+	$user = new WP_User($user_id);
+	$user->user_login = wp_specialchars($user->user_login, 1);
+	$user->user_email = wp_specialchars($user->user_email, 1);
+	$user->user_url = wp_specialchars($user->user_url, 1);
+	$user->first_name = wp_specialchars($user->first_name, 1);
+	$user->last_name = wp_specialchars($user->last_name, 1);
+	$user->display_name = wp_specialchars($user->display_name, 1);
+	$user->nickname = wp_specialchars($user->nickname, 1);
+	$user->aim = wp_specialchars($user->aim, 1);
+	$user->yim = wp_specialchars($user->yim, 1);
+	$user->jabber = wp_specialchars($user->jabber, 1);
+	$user->description = wp_specialchars($user->description);
+
+	return $user;
+}
+
 // Creates a new user from the "Users" form using $_POST information.
 
 function add_user() {
@@ -381,7 +400,7 @@
 	if (isset ($_POST['display_name']))
 		$user->display_name = wp_specialchars(trim($_POST['display_name']));
 	if (isset ($_POST['description']))
-		$user->description = wp_specialchars(trim($_POST['description']));
+		$user->description = trim($_POST['description']);
 	if (isset ($_POST['jabber']))
 		$user->jabber = wp_specialchars(trim($_POST['jabber']));
 	if (isset ($_POST['aim']))
@@ -447,13 +466,16 @@
 
 function get_link_to_edit($link_id) {
 	$link = get_link($link_id);
-	
+
 	$link->link_url = wp_specialchars($link->link_url, 1);
 	$link->link_name = wp_specialchars($link->link_name, 1);
-	$link->link_description = wp_specialchars($link->link_description);
+	$link->link_image = wp_specialchars($link->link_image, 1);
+	$link->link_description = wp_specialchars($link->link_description, 1);
 	$link->link_notes = wp_specialchars($link->link_notes);
-	$link->link_rss = wp_specialchars($link->link_rss);
-	
+	$link->link_rss = wp_specialchars($link->link_rss, 1);
+	$link->link_rel = wp_specialchars($link->link_rel, 1);
+	$link->post_category = $link->link_category;
+
 	return $link;
 }
 
@@ -826,6 +848,20 @@
 			$style = '';
 		if ('_' == $entry['meta_key'] { 0 })
 			$style .= ' hidden';
+
+		if ( is_serialized($entry['meta_value']) ) {
+			if ( is_serialized_string($entry['meta_value']) ) {
+				// this is a serialized string, so we should display it
+				$entry['meta_value'] = maybe_unserialize($entry['meta_value']);
+			} else {
+				// this is a serialized array/object so we should NOT display it
+				--$count;
+				continue;
+			}
+		}
+
+		$entry['meta_key'] = wp_specialchars( $entry['meta_key'], true );
+		$entry['meta_value'] = wp_specialchars( $entry['meta_value'], true );
 		echo "
 			<tr class='$style'>
 				<td valign='top'><input name='meta[{$entry['meta_id']}][key]' tabindex='6' type='text' size='20' value='{$entry['meta_key']}' /></td>
@@ -876,6 +912,7 @@
 <?php
 
 	foreach ($keys as $key) {
+		$key = wp_specialchars($key, 1);
 		echo "\n\t<option value='$key'>$key</option>";
 	}
 ?>
@@ -897,7 +934,8 @@
 
 	$metakeyselect = $wpdb->escape(stripslashes(trim($_POST['metakeyselect'])));
 	$metakeyinput = $wpdb->escape(stripslashes(trim($_POST['metakeyinput'])));
-	$metavalue = $wpdb->escape(stripslashes(trim($_POST['metavalue'])));
+	$metavalue = maybe_serialize(stripslashes((trim($_POST['metavalue']))));
+	$metavalue = $wpdb->escape($metavalue);
 
 	if ( ('0' === $metavalue || !empty ($metavalue)) && ((('#NONE#' != $metakeyselect) && !empty ($metakeyselect)) || !empty ($metakeyinput)) ) {
 		// We have a key/value pair. If both the select and the 
@@ -925,7 +963,9 @@
 
 function update_meta($mid, $mkey, $mvalue) {
 	global $wpdb;
-
+	$mvalue = maybe_serialize(stripslashes($mvalue));
+	$mvalue = $wpdb->escape($mvalue);
+	$mid = (int) $mid;
 	return $wpdb->query("UPDATE $wpdb->postmeta SET meta_key = '$mkey', meta_value = '$mvalue' WHERE meta_id = '$mid'");
 }
 
@@ -1547,25 +1587,23 @@
 		}
 	}
 
-	if (!$plugins_dir || !$plugin_files) {
+	if ( !$plugins_dir || !$plugin_files )
 		return $wp_plugins;
-	}
-
-	sort($plugin_files);
 
-	foreach ($plugin_files as $plugin_file) {
+	foreach ( $plugin_files as $plugin_file ) {
 		if ( !is_readable("$plugin_root/$plugin_file"))
 			continue;
 
 		$plugin_data = get_plugin_data("$plugin_root/$plugin_file");
 
-		if (empty ($plugin_data['Name'])) {
+		if ( empty ($plugin_data['Name']) )
 			continue;
-		}
 
 		$wp_plugins[plugin_basename($plugin_file)] = $plugin_data;
 	}
 
+	uasort($wp_plugins, create_function('$a, $b', 'return strnatcasecmp($a["Name"], $b["Name"]);'));
+
 	return $wp_plugins;
 }
 
diff -ruN 2.0.4/wp-admin/edit-form-advanced.php 2.0.5/wp-admin/edit-form-advanced.php
--- 2.0.4/wp-admin/edit-form-advanced.php	2006-07-06 01:35:28.000000000 -0500
+++ 2.0.5/wp-admin/edit-form-advanced.php	2006-10-31 09:05:37.000000000 -0600
@@ -39,7 +39,7 @@
 	$pings = '<p>'. __('Already pinged:') . '</p><ul>';
 	$already_pinged = explode("\n", trim($post->pinged));
 	foreach ($already_pinged as $pinged_url) {
-		$pings .= "\n\t<li>$pinged_url</li>";
+		$pings .= "\n\t<li>" . wp_specialchars($pinged_url) . "</li>";
 	}
 	$pings .= '</ul>';
 }
@@ -97,7 +97,7 @@
 <div id="categorychecklist"><?php dropdown_categories(get_settings('default_category')); ?></div></div>
 </fieldset>
 
-<fieldset class="dbx-box">
+<fieldset id="poststatusdiv" class="dbx-box">
 <h3 class="dbx-handle"><?php _e('Post Status') ?></h3> 
 <div class="dbx-content"><?php if ( current_user_can('publish_posts') ) : ?>
 <label for="post_status_publish" class="selectit"><input id="post_status_publish" name="post_status" type="radio" value="publish" <?php checked($post->post_status, 'publish'); ?> /> <?php _e('Published') ?></label>
@@ -107,7 +107,7 @@
 </fieldset>
 
 <?php if ( current_user_can('edit_posts') ) : ?>
-<fieldset class="dbx-box">
+<fieldset id="posttimestampdiv" class="dbx-box">
 <h3 class="dbx-handle"><?php _e('Post Timestamp'); ?>:</h3>
 <div class="dbx-content"><?php touch_time(($action == 'edit')); ?></div>
 </fieldset>
@@ -151,6 +151,7 @@
  }
 ?>
 <?php the_quicktags(); ?>
+</fieldset>
 
 <div><textarea <?php if ( user_can_richedit() ) echo 'title="true" '; ?>rows="<?php echo $rows; ?>" cols="40" name="content" tabindex="2" id="content"><?php echo user_can_richedit() ? wp_richedit_pre($post->post_content) : $post->post_content; ?></textarea></div>
 </fieldset>
@@ -225,7 +226,7 @@
 	$uploading_iframe_src = wp_nonce_url("inline-uploading.php?action=view&amp;post=$uploading_iframe_ID", 'inlineuploading');
 	$uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
 	if ( false != $uploading_iframe_src )
-		echo '<iframe id="uploading" border="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
+		echo '<iframe id="uploading" frameborder="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
 }
 ?>
 
@@ -243,7 +244,7 @@
 </div>
 
 <div class="dbx-box-wrapper">
-<fieldset class="dbx-box">
+<fieldset id="trackbacksdiv" class="dbx-box">
 <div class="dbx-handle-wrapper">
 <h3 class="dbx-handle"><?php _e('Trackbacks') ?></h3>
 </div>
@@ -276,6 +277,7 @@
 	meta_form();
 ?>
 </div>
+</div>
 </fieldset>
 </div>
 
diff -ruN 2.0.4/wp-admin/edit-page-form.php 2.0.5/wp-admin/edit-page-form.php
--- 2.0.4/wp-admin/edit-page-form.php	2006-07-23 12:14:20.000000000 -0500
+++ 2.0.5/wp-admin/edit-page-form.php	2006-10-31 09:05:37.000000000 -0600
@@ -193,7 +193,7 @@
 	$uploading_iframe_src = wp_nonce_url("inline-uploading.php?action=view&amp;post=$uploading_iframe_ID", 'inlineuploading');
 	$uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
 	if ( false != $uploading_iframe_src )
-		echo '<iframe id="uploading" border="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
+		echo '<iframe id="uploading" frameborder="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
 }
 ?>
 
@@ -224,8 +224,8 @@
 	$delete_nonce = wp_create_nonce( 'delete-page_' . $post_ID ); ?>
 	<input name="deletepost" class="button" type="submit" id="deletepost" tabindex="10" value="<?php _e('Delete this page') ?>" <?php echo "onclick=\"if ( confirm('" . sprintf(__("You are about to delete this page \'%s\'\\n  \'Cancel\' to stop, \'OK\' to delete."), js_escape($post->post_title) ) . "') ) { document.forms.post._wpnonce.value = '$delete_nonce'; return true;}return false;\""; ?> />
 <?php endif; ?>
-</form>
-
 </div>
 
+</form>
+
 </div>
diff -ruN 2.0.4/wp-admin/import/blogger.php 2.0.5/wp-admin/import/blogger.php
--- 2.0.4/wp-admin/import/blogger.php	2006-06-27 18:10:02.000000000 -0500
+++ 2.0.5/wp-admin/import/blogger.php	2006-10-31 09:05:37.000000000 -0600
@@ -135,13 +135,13 @@
 		curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
 		if ($header) curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
 		$response = curl_exec ($ch);
-	
+
 		if ($parse) {
 			$response = $this->parse_response($response);
 			$response['url'] = $url;
 			return $response;
 		}
-	
+
 		return $response;
 	}
 
@@ -210,7 +210,7 @@
 		$this->import['blogs'][$_GET['blog']]['nextstep'] = $step;
 		update_option('import-blogger', $this->import);
 	}
-	
+
 	// Redirects to next step
 	function do_next_step() {
 		wp_redirect("admin.php?import=blogger&noheader=true&blog={$_GET['blog']}");
@@ -224,13 +224,13 @@
 			if ( ! ( $_POST['user'] && $_POST['pass'] ) ) {
 				$this->login_form(__('The script will log into your Blogger account, change some settings so it can read your blog, and restore the original settings when it\'s done. Here\'s what you do:').'</p><ol><li>'.__('Back up your Blogger template.').'</li><li>'.__('Back up any other Blogger settings you might need later.').'</li><li>'.__('Log out of Blogger').'</li><li>'.__('Log in <em>here</em> with your Blogger username and password.').'</li><li>'.__('On the next screen, click one of your Blogger blogs.').'</li><li>'.__('Do not close this window or navigate away until the process is complete.').'</li></ol>');
 			}
-		
-			// Try logging in. If we get an array of cookies back, we at least connected.		
+
+			// Try logging in. If we get an array of cookies back, we at least connected.
 			$this->import['cookies'] = $this->login_blogger($_POST['user'], $_POST['pass']);
 			if ( !is_array( $this->import['cookies'] ) ) {
 				$this->login_form(__('Login failed. Please enter your credentials again.'));
 			}
-			
+
 			// Save the password so we can log the browser in when it's time to publish.
 			$this->import['pass'] = $_POST['pass'];
 			$this->import['user'] = $_POST['user'];
@@ -341,7 +341,7 @@
 				$form = "<div style='height:0px;width:0px;overflow:hidden;'>";
 				$form.= $body;
 				$form.= "</div><script type='text/javascript'>forms=document.getElementsByTagName('form');for(i=0;i<forms.length;i++){if(forms[i].action.search('{$blog_opt}')){forms[i].submit();break;}}</script>";
-				$output.= '<p>'.sprintf('<strong>%s</strong> in progress, please wait...', $blog_opt)."</p>\n";
+				$output.= '<p>'.sprintf(__('<strong>%s</strong> in progress, please wait...'), $blog_opt)."</p>\n";
 			} else {
 				$output.= "<p>$blog_opt</p>\n";
 			}
@@ -395,7 +395,7 @@
 				update_option('import-blogger', $import);
 				$archive = $this->get_blogger($url);
 				if ( $archive['code'] > 200 )
-					continue;	
+					continue;
 				$posts = explode('<wordpresspost>', $archive['body']);
 				for ($i = 1; $i < count($posts); $i = $i + 1) {
 					$postparts = explode('<wordpresscomment>', $posts[$i]);
@@ -409,7 +409,7 @@
 					$post_title = ( $postinfo[4] != '' ) ? $postinfo[4] : $postinfo[3];
 					$post_author_name = $wpdb->escape(trim($postinfo[1]));
 					$post_author_email = $postinfo[5] ? $postinfo[5] : 'user@wordpress.org';
-	
+
 					if ( $this->lump_authors ) {
 						// Ignore Blogger authors. Use the current user_ID for all posts imported.
 						$post_author = $GLOBALS['user_ID'];
@@ -420,7 +420,7 @@
 							$user_email = $wpdb->escape($post_author_email);
 							$user_password = substr(md5(uniqid(microtime())), 0, 6);
 							$result = wp_create_user( $user_login, $user_password, $user_email );
-							$status.= sprintf('Registered user <strong>%s</strong>.', $user_login);
+							$status.= sprintf(__('Registered user <strong>%s</strong>.'), $user_login);
 							$this->import['blogs'][$_GET['blog']]['newusers'][] = $user_login;
 						}
 						$userdata = get_userdatabylogin( $post_author_name );
@@ -435,21 +435,21 @@
 					$posthour = zeroise($post_date_His[0], 2);
 					$postminute = zeroise($post_date_His[1], 2);
 					$postsecond = zeroise($post_date_His[2], 2);
-	
+
 					if (($post_date[2] == 'PM') && ($posthour != '12'))
 						$posthour = $posthour + 12;
 					else if (($post_date[2] == 'AM') && ($posthour == '12'))
 						$posthour = '00';
-	
+
 					$post_date = "$postyear-$postmonth-$postday $posthour:$postminute:$postsecond";
-	
+
 					$post_content = addslashes($post_content);
 					$post_content = str_replace(array('<br>','<BR>','<br/>','<BR/>','<br />','<BR />'), "\n", $post_content); // the XHTML touch... ;)
-	
+
 					$post_title = addslashes($post_title);
-			
+
 					$post_status = 'publish';
-	
+
 					if ( $ID = post_exists($post_title, '', $post_date) ) {
 						$post_array[$i]['ID'] = $ID;
 						$skippedpostcount++;
@@ -509,7 +509,7 @@
 					}
 				}
 				$status = sprintf(__('%s post(s) parsed, %s skipped...'), $postcount,  $skippedpostcount).' '.
-					sprintf(__('%s comment(s) parsed, %s skipped...'), $commentcoun, $skippedcommentcount).' '.
+					sprintf(__('%s comment(s) parsed, %s skipped...'), $commentcount, $skippedcommentcount).' '.
 					' <strong>'.__('Done').'</strong>';
 				$import = $this->import;
 				$import['blogs'][$_GET['blog']]['archives']["$url"] = $status;
@@ -546,7 +546,7 @@
 						$response = $this->get_blogger("http://www.blogger.com/blog-publishing.g?blogID={$_GET['blog']}&publishMode={$optary['backup']['publishMode']}", $headers);
 						sleep(2);
 						if ( $response['code'] >= 400 )
-							die('<h1>Error restoring publishMode.</h1><p>Please tell the devs.</p>' . addslashes(print_r($response, 1)) );
+							die('<h1>'.__('Error restoring publishMode').'</h1><p>'.__('Please tell the devs.').'</p>' . addslashes(print_r($response, 1)) );
 					}
 				}
 				if ( $optary['backup'] != $optary['modify'] ) {
@@ -597,11 +597,11 @@
 		if ( $_GET['restart'] == 'true' ) {
 			$this->restart();
 		}
-		
+
 		if ( isset($_GET['noheader']) ) {
 			header('Content-Type: text/html; charset=utf-8');
 
-			$this->import = get_settings('import-blogger');
+			$this->import = get_option('import-blogger');
 
 			if ( false === $this->import ) {
 				$step = 0;
@@ -649,7 +649,7 @@
 					break;
 			}
 			die;
-			
+
 		} else {
 			$this->greet();
 		}
@@ -662,6 +662,6 @@
 
 $blogger_import = new Blogger_Import();
 
-register_importer('blogger', 'Blogger', __('Import posts and comments from a Blogger account'), array ($blogger_import, 'start'));
+register_importer('blogger', __('Blogger and Blogspot'), __('Import <strong>posts and comments</strong> from your Blogger account'), array ($blogger_import, 'start'));
 
 ?>
diff -ruN 2.0.4/wp-admin/import/dotclear.php 2.0.5/wp-admin/import/dotclear.php
--- 2.0.4/wp-admin/import/dotclear.php	2006-07-05 11:48:55.000000000 -0500
+++ 2.0.5/wp-admin/import/dotclear.php	2006-10-31 09:05:37.000000000 -0600
@@ -626,15 +626,15 @@
 		echo '<h3>'.__('Preserving Authors').'</h3>';
 		echo '<p>'.__('Secondly, we have attempted to preserve post authors.  If you are the only author or contributor to your blog, then you are safe.  In most cases, we are successful in this preservation endeavor.  However, if we cannot ascertain the name of the writer due to discrepancies between database tables, we assign it to you, the administrative user.').'</p>';
 		echo '<h3>'.__('Textile').'</h3>';
-		echo '<p>'.__('Also, since you\'re coming from Dotclear, you probably have been using Textile to format your comments and posts.  If this is the case, we recommend downloading and installing <a href="http://www.huddledmasses.org/2004/04/19/wordpress-plugin-textile-20/">Textile for WordPress</a>.  Trust me... You\'ll want it.').'</p>';
+		echo '<p>'.__('Also, since you\'re coming from Dotclear, you probably have been using Textile to format your comments and posts.  If this is the case, we recommend downloading and installing <a href="http://www.huddledmasses.org/category/development/wordpress/textile/">Textile for WordPress</a>.  Trust me... You\'ll want it.').'</p>';
 		echo '<h3>'.__('WordPress Resources').'</h3>';
 		echo '<p>'.__('Finally, there are numerous WordPress resources around the internet.  Some of them are:').'</p>';
 		echo '<ul>';
 		echo '<li>'.__('<a href="http://www.wordpress.org">The official WordPress site</a>').'</li>';
-		echo '<li>'.__('<a href="http://wordpress.org/support/">The WordPress support forums').'</li>';
+		echo '<li>'.__('<a href="http://wordpress.org/support/">The WordPress support forums</a>').'</li>';
 		echo '<li>'.__('<a href="http://codex.wordpress.org">The Codex (In other words, the WordPress Bible)</a>').'</li>';
 		echo '</ul>';
-		echo '<p>'.sprintf(__('That\'s it! What are you waiting for? Go <a href="%1$s">login</a>!'), '/wp-login.php').'</p>';
+		echo '<p>'.sprintf(__('That\'s it! What are you waiting for? Go <a href="%1$s">login</a>!'), '../wp-login.php').'</p>';
 	}
 	
 	function db_form()
@@ -737,5 +737,5 @@
 }
 
 $dc_import = new Dotclear_Import();
-register_importer('dotclear', 'Dotclear', __('Import posts from a Dotclear Blog'), array ($dc_import, 'dispatch'));
+register_importer('dotclear', __('Dotclear'), __('Import posts from a Dotclear Blog'), array ($dc_import, 'dispatch'));
 ?>
diff -ruN 2.0.4/wp-admin/import/greymatter.php 2.0.5/wp-admin/import/greymatter.php
--- 2.0.4/wp-admin/import/greymatter.php	2005-11-15 18:52:14.000000000 -0600
+++ 2.0.5/wp-admin/import/greymatter.php	2006-10-31 09:05:37.000000000 -0600
@@ -0,0 +1,313 @@
+<?php
+
+class GM_Import {
+
+	var $gmnames = array ();
+
+	function header() {
+		echo '<div class="wrap">';
+		echo '<h2>'.__('Import Greymatter').'</h2>';
+	}
+
+	function footer() {
+		echo '</div>';
+	}
+
+	function greet() {
+		$this->header();
+?>
+<p><?php _e('This is a basic GreyMatter to WordPress import script.') ?></p>
+<p><?php _e('What it does:') ?></p>
+<ul>
+<li><?php _e('Parses gm-authors.cgi to import (new) authors. Everyone is imported at level 1.') ?></li>
+<li><?php _e('Parses the entries cgi files to import posts, comments, and karma on posts (although karma is not used on WordPress yet).<br />If authors are found not to be in gm-authors.cgi, imports them at level 0.') ?></li>
+<li><?php _e("Detects duplicate entries or comments. If you don't import everything the first time, or this import should fail in the middle, duplicate entries will not be made when you try again.") ?></li>
+</ul>
+<p><?php _e('What it does not:') ?></p>
+<ul>
+<li><?php _e('Parse gm-counter.cgi, gm-banlist.cgi, gm-cplog.cgi (you can make a CP log hack if you really feel like it, but I question the need of a CP log).') ?></li>
+<li><?php _e('Import gm-templates.') ?></li>
+<li><?php _e("Doesn't keep entries on top.")?></li>
+</ul>
+<p>&nbsp;</p>
+
+<form name="stepOne" method="get">
+<input type="hidden" name="import" value="greymatter" />
+<input type="hidden" name="step" value="1" />
+<h3><?php _e('Second step: GreyMatter details:') ?></h3>
+<p><table cellpadding="0">
+<tr>
+<td><?php _e('Path to GM files:') ?></td>
+<td><input type="text" style="width:300px" name="gmpath" value="/home/my/site/cgi-bin/greymatter/" /></td>
+</tr>
+<tr>
+<td><?php _e('Path to GM entries:') ?></td>
+<td><input type="text" style="width:300px" name="archivespath" value="/home/my/site/cgi-bin/greymatter/archives/" /></td>
+</tr>
+<tr>
+<td colspan="2"><br /><?php _e("This importer will search for files 00000001.cgi to 000-whatever.cgi,<br />so you need to enter the number of the last GM post here.<br />(if you don't know that number, just log into your FTP and look it out<br />in the entries' folder)") ?></td>
+</tr>
+<tr>
+<td><?php _e("Last entry's number:") ?></td>
+<td><input type="text" name="lastentry" value="00000001" /></td>
+</tr>
+</table>
+</p>
+<p><?php _e("When you're ready, click OK to start importing: ") ?><input type="submit" name="submit" value="<?php _e('OK') ?>" class="search" /></p>
+</form>
+<p>&nbsp</p>
+<?php
+		$this->footer();
+	}
+
+
+
+	function gm2autobr($string) { // transforms GM's |*| into b2's <br />\n
+		$string = str_replace("|*|","<br />\n",$string);
+		return($string);
+	}
+	
+	function import() {
+		global $wpdb;
+	
+		$wpvarstoreset = array('gmpath', 'archivespath', 'lastentry');
+		for ($i=0; $i<count($wpvarstoreset); $i += 1) {
+			$wpvar = $wpvarstoreset[$i];
+			if (!isset($$wpvar)) {
+				if (empty($_POST["$wpvar"])) {
+					if (empty($_GET["$wpvar"])) {
+						$$wpvar = '';
+					} else {
+						$$wpvar = $_GET["$wpvar"];
+					}
+				} else {
+					$$wpvar = $_POST["$wpvar"];
+				}
+			}
+		}
+
+		if (!chdir($archivespath))
+			die(sprintf(__("Wrong path, %s\ndoesn't exist\non the server"), $archivespath));
+
+		if (!chdir($gmpath))
+			die(sprintf(__("Wrong path, %s\ndoesn't exist\non the server"), $gmpath));
+			
+		$this->header();
+?>
+<p><?php _e('The importer is running...') ?></p>
+<ul>
+<li><?php _e('importing users...') ?><ul><?php
+
+	chdir($gmpath);
+	$userbase = file("gm-authors.cgi");
+
+	foreach($userbase as $user) {
+		$userdata=explode("|", $user);
+
+		$user_ip="127.0.0.1";
+		$user_domain="localhost";
+		$user_browser="server";
+
+		$s=$userdata[4];
+		$user_joindate=substr($s,6,4)."-".substr($s,0,2)."-".substr($s,3,2)." 00:00:00";
+
+		$user_login=$wpdb->escape($userdata[0]);
+		$pass1=$wpdb->escape($userdata[1]);
+		$user_nickname=$wpdb->escape($userdata[0]);
+		$user_email=$wpdb->escape($userdata[2]);
+		$user_url=$wpdb->escape($userdata[3]);
+		$user_joindate=$wpdb->escape($user_joindate);
+
+		$user_id = username_exists($user_login);
+		if ($user_id) {
+			printf('<li>'.__('user %s').'<strong>'.__('Already exists').'</strong></li>', "<em>$user_login</em>");
+			$this->gmnames[$userdata[0]] = $user_id;
+			continue;
+		}
+
+		$user_info = array("user_login"=>"$user_login", "user_pass"=>"$pass1", "user_nickname"=>"$user_nickname", "user_email"=>"$user_email", "user_url"=>"$user_url", "user_ip"=>"$user_ip", "user_domain"=>"$user_domain", "user_browser"=>"$user_browser", "dateYMDhour"=>"$user_joindate", "user_level"=>"1", "user_idmode"=>"nickname");
+		$user_id = wp_insert_user($user_info);
+		$this->gmnames[$userdata[0]] = $user_id;
+		
+		printf('<li>'.__('user %s...').' <strong>'.__('Done').'</strong></li>', "<em>$user_login</em>");
+	}
+
+?></ul><strong><?php _e('Done') ?></strong></li>
+<li><?php _e('importing posts, comments, and karma...') ?><br /><ul><?php
+
+	chdir($archivespath);
+	
+	for($i = 0; $i <= $lastentry; $i = $i + 1) {
+		
+		$entryfile = "";
+		
+		if ($i<10000000) {
+			$entryfile .= "0";
+			if ($i<1000000) {
+				$entryfile .= "0";
+				if ($i<100000) {
+					$entryfile .= "0";
+					if ($i<10000) {
+						$entryfile .= "0";
+						if ($i<1000) {
+							$entryfile .= "0";
+							if ($i<100) {
+								$entryfile .= "0";
+								if ($i<10) {
+									$entryfile .= "0";
+		}}}}}}}
+
+		$entryfile .= "$i";
+
+		if (is_file($entryfile.".cgi")) {
+
+			$entry=file($entryfile.".cgi");
+			$postinfo=explode("|",$entry[0]);
+			$postmaincontent=$this->gm2autobr($entry[2]);
+			$postmorecontent=$this->gm2autobr($entry[3]);
+
+			$post_author=trim($wpdb->escape($postinfo[1]));
+
+			$post_title=$this->gm2autobr($postinfo[2]);
+			printf('<li>'.__('entry # %s : %s : by %s'), $entryfile, $post_title, $postinfo[1]);
+			$post_title=$wpdb->escape($post_title);
+
+			$postyear=$postinfo[6];
+			$postmonth=zeroise($postinfo[4],2);
+			$postday=zeroise($postinfo[5],2);
+			$posthour=zeroise($postinfo[7],2);
+			$postminute=zeroise($postinfo[8],2);
+			$postsecond=zeroise($postinfo[9],2);
+
+			if (($postinfo[10]=="PM") && ($posthour!="12"))
+				$posthour=$posthour+12;
+
+			$post_date="$postyear-$postmonth-$postday $posthour:$postminute:$postsecond";
+
+			$post_content=$postmaincontent;
+			if (strlen($postmorecontent)>3)
+				$post_content .= "<!--more--><br /><br />".$postmorecontent;
+			$post_content=$wpdb->escape($post_content);
+
+			$post_karma=$postinfo[12];
+
+			$post_status = 'publish'; //in greymatter, there are no drafts
+			$comment_status = 'open';
+			$ping_status = 'closed';
+			
+			if ($post_ID = post_exists($post_title, '', $post_date)) {
+				echo ' ';
+				_e('(already exists)');
+			} else {
+				//just so that if a post already exists, new users are not created by checkauthor
+				// we'll check the author is registered, or if it's a deleted author
+				$user_id = username_exists($post_author);
+				if (!$user_id) {	// if deleted from GM, we register the author as a level 0 user
+					$user_ip="127.0.0.1";
+					$user_domain="localhost";
+					$user_browser="server";
+					$user_joindate="1979-06-06 00:41:00";
+					$user_login=$wpdb->escape($post_author);
+					$pass1=$wpdb->escape("password");
+					$user_nickname=$wpdb->escape($post_author);
+					$user_email=$wpdb->escape("user@deleted.com");
+					$user_url=$wpdb->escape("");
+					$user_joindate=$wpdb->escape($user_joindate);
+					
+					$user_info = array("user_login"=>$user_login, "user_pass"=>$pass1, "user_nickname"=>$user_nickname, "user_email"=>$user_email, "user_url"=>$user_url, "user_ip"=>$user_ip, "user_domain"=>$user_domain, "user_browser"=>$user_browser, "dateYMDhour"=>$user_joindate, "user_level"=>0, "user_idmode"=>"nickname");
+					$user_id = wp_insert_user($user_info);
+					$this->gmnames[$postinfo[1]] = $user_id;
+					
+					echo ': ';
+					printf(__('registered deleted user %s at level 0 '), "<em>$user_login</em>");
+				}
+			
+				if (array_key_exists($postinfo[1], $this->gmnames)) {
+					$post_author = $this->gmnames[$postinfo[1]];
+				} else {
+					$post_author = $user_id;
+				}
+			
+				$postdata = compact('post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_title', 'post_excerpt', 'post_status', 'comment_status', 'ping_status', 'post_modified', 'post_modified_gmt');
+				$post_ID = wp_insert_post($postdata);
+			}
+
+			$c=count($entry);
+			if ($c>4) {
+				$numAddedComments = 0;
+				$numComments = 0;
+				for ($j=4;$j<$c;$j++) {
+					$entry[$j]=$this->gm2autobr($entry[$j]);
+					$commentinfo=explode("|",$entry[$j]);
+					$comment_post_ID=$post_ID;
+					$comment_author=$wpdb->escape($commentinfo[0]);
+					$comment_author_email=$wpdb->escape($commentinfo[2]);
+					$comment_author_url=$wpdb->escape($commentinfo[3]);
+					$comment_author_IP=$wpdb->escape($commentinfo[1]);
+
+					$commentyear=$commentinfo[7];
+					$commentmonth=zeroise($commentinfo[5],2);
+					$commentday=zeroise($commentinfo[6],2);
+					$commenthour=zeroise($commentinfo[8],2);
+					$commentminute=zeroise($commentinfo[9],2);
+					$commentsecond=zeroise($commentinfo[10],2);
+					if (($commentinfo[11]=="PM") && ($commenthour!="12"))
+						$commenthour=$commenthour+12;
+					$comment_date="$commentyear-$commentmonth-$commentday $commenthour:$commentminute:$commentsecond";
+
+					$comment_content=$wpdb->escape($commentinfo[12]);
+
+					if (!comment_exists($comment_author, $comment_date)) {
+						$commentdata = compact('comment_post_ID', 'comment_author', 'comment_author_url', 'comment_author_email', 'comment_author_IP', 'comment_date', 'comment_content', 'comment_approved');
+						$commentdata = wp_filter_comment($commentdata);
+						wp_insert_comment($commentdata);
+						$numAddedComments++;
+					}
+					$numComments++;
+				}
+				if ($numAddedComments > 0) {
+					echo ': ';
+					printf(__('imported %d comment(s)'), $numAddedComments);
+				}
+				$preExisting = $numComments - numAddedComments;
+				if ($preExisting > 0) {
+					echo ' ';
+					printf(__('ignored %d pre-existing comments'), $preExisting);
+				}
+			}
+			echo '... <strong>'.__('Done').'</strong></li>';
+		}
+	}
+	?>
+</ul><strong><?php _e('Done') ?></strong></li></ul>
+<p>&nbsp;</p>
+<p><?php _e('Completed Greymatter import!') ?></p>
+<?php
+	$this->footer();
+	}
+
+	function dispatch() {
+		if (empty ($_GET['step']))
+			$step = 0;
+		else
+			$step = (int) $_GET['step'];
+
+		switch ($step) {
+			case 0 :
+				$this->greet();
+				break;
+			case 1:
+				$this->import();
+				break;
+		}
+	}
+
+	function GM_Import() {
+		// Nothing.	
+	}
+}
+
+$gm_import = new GM_Import();
+
+register_importer('greymatter', __('Greymatter'), __('Import posts and comments from your Greymatter blog'), array ($gm_import, 'dispatch'));
+?>
diff -ruN 2.0.4/wp-admin/import/livejournal.php 2.0.5/wp-admin/import/livejournal.php
--- 2.0.4/wp-admin/import/livejournal.php	2006-01-04 23:35:09.000000000 -0600
+++ 2.0.5/wp-admin/import/livejournal.php	2006-10-31 09:05:37.000000000 -0600
@@ -167,5 +167,5 @@
 
 $livejournal_import = new LJ_Import();
 
-register_importer('livejournal', 'LiveJournal', __('Import posts from LiveJournal'), array ($livejournal_import, 'dispatch'));
+register_importer('livejournal', __('LiveJournal'), __('Import posts from LiveJournal'), array ($livejournal_import, 'dispatch'));
 ?>
diff -ruN 2.0.4/wp-admin/import/mt.php 2.0.5/wp-admin/import/mt.php
--- 2.0.4/wp-admin/import/mt.php	2006-05-19 01:22:55.000000000 -0500
+++ 2.0.5/wp-admin/import/mt.php	2006-10-31 09:05:37.000000000 -0600
@@ -11,7 +11,7 @@
 
 	function header() {
 		echo '<div class="wrap">';
-		echo '<h2>'.__('Import Movable Type').'</h2>';
+		echo '<h2>'.__('Import Movable Type and Typepad').'</h2>';
 	}
 
 	function footer() {
@@ -32,7 +32,7 @@
 		global $wpdb, $testing;
 		$users = $wpdb->get_results("SELECT * FROM $wpdb->users ORDER BY ID");
 ?><select name="userselect[<?php echo $n; ?>]">
-	<option value="#NONE#">- Select -</option>
+	<option value="#NONE#"><?php _e('- Select -') ?></option>
 	<?php
 
 
@@ -134,6 +134,8 @@
 
 	function mt_authors_form() {
 ?>
+<div class="wrap">
+<h2><?php _e('Assign Authors'); ?></h2>
 <p><?php _e('To make it easier for you to edit and save the imported posts and drafts, you may want to change the name of the author of the posts. For example, you may want to import all the entries as <code>admin</code>s entries.'); ?></p>
 <p><?php _e('Below, you can see the names of the authors of the MovableType posts in <i>italics</i>. For each of these names, you can either pick an author in your WordPress installation from the menu, or enter a name for the author in the textbox.'); ?></p>
 <p><?php _e('If a new user is created by WordPress, the password will be set, by default, to "changeme". Quite suggestive, eh? ;)'); ?></p>
@@ -146,22 +148,24 @@
 		$j = -1;
 		foreach ($authors as $author) {
 			++ $j;
-			echo '<li><i>'.$author.'</i><br />'.'<input type="text" value="'.$author.'" name="'.'user[]'.'" maxlength="30">';
+			echo '<li>'.__('Current author:').' <strong>'.$author.'</strong><br />'.sprintf(__('Create user %1$s or map to existing'), ' <input type="text" value="'.$author.'" name="'.'user[]'.'" maxlength="30"> <br />');
 			$this->users_form($j);
 			echo '</li>';
 		}
 
-		echo '<input type="submit" value="Submit">'.'<br/>';
+		echo '<input type="submit" value="'.__('Submit').'">'.'<br/>';
 		echo '</form>';
-		echo '</ol>';
+		echo '</ol></div>';
 
-		flush();
 	}
 
 	function select_authors() {
 		$file = wp_import_handle_upload();
 		if ( isset($file['error']) ) {
-			echo $file['error'];
+			$this->header();
+			echo '<p>'.__('Sorry, there has been an error').'.</p>';
+			echo '<p><strong>' . $file['error'] . '</strong></p>';
+			$this->footer();
 			return;
 		}
 		$this->file = $file['file'];
@@ -174,7 +178,7 @@
 	function process_posts() {
 		global $wpdb;
 		$i = -1;
-		echo "<ol>";
+		echo "<div class='wrap'><ol>";
 		foreach ($this->posts as $post) {
 			if ('' != trim($post)) {
 				++ $i;
@@ -330,7 +334,7 @@
 					}
 				}
 				if ( $num_comments )
-					printf(__('(%s comments)'), $num_comments);
+					printf(' '.__('(%s comments)'), $num_comments);
 
 				// Finally the pings
 				// fix the double newline on the first one
@@ -378,22 +382,22 @@
 					}
 				}
 				if ( $num_pings )
-					printf(__('(%s pings)'), $num_pings);
-				
+					printf(' '.__('(%s pings)'), $num_pings);
+
 				echo "</li>";
 			}
-			flush();
 		}
 
 		echo '</ol>';
 
 		wp_import_cleanup($this->id);
 
-		echo '<h3>'.sprintf(__('All done. <a href="%s">Have fun!</a>'), get_option('home')).'</h3>';
+		echo '<h3>'.sprintf(__('All done. <a href="%s">Have fun!</a>'), get_option('home')).'</h3></div>';
 	}
 
 	function import() {
 		$this->id = (int) $_GET['id'];
+		
 		$this->file = get_attached_file($this->id);
 		$this->get_authors_from_post();
 		$this->get_entries();
@@ -420,11 +424,11 @@
 	}
 
 	function MT_Import() {
-		// Nothing.	
+		// Nothing.
 	}
 }
 
 $mt_import = new MT_Import();
 
-register_importer('mt', 'Movable Type', __('Import posts and comments from your Movable Type blog'), array ($mt_import, 'dispatch'));
+register_importer('mt', __('Movable Type and Typepad'), __('Imports <strong>posts and comments</strong> from your Movable Type or Typepad blog'), array ($mt_import, 'dispatch'));
 ?>
diff -ruN 2.0.4/wp-admin/import/rss.php 2.0.5/wp-admin/import/rss.php
--- 2.0.4/wp-admin/import/rss.php	2005-12-28 14:24:12.000000000 -0600
+++ 2.0.5/wp-admin/import/rss.php	2006-10-31 09:05:37.000000000 -0600
@@ -38,21 +38,22 @@
 		$index = 0;
 		foreach ($this->posts as $post) {
 			preg_match('|<title>(.*?)</title>|is', $post, $post_title);
-			$post_title = $wpdb->escape(trim($post_title[1]));
+			$post_title = str_replace(array('<![CDATA[', ']]>'), '', $wpdb->escape( trim($post_title[1]) ));
 
-			preg_match('|<pubdate>(.*?)</pubdate>|is', $post, $post_date);
+			preg_match('|<pubdate>(.*?)</pubdate>|is', $post, $post_date_gmt);
 
-			if ($post_date) {
-				$post_date = strtotime($post_date[1]);
+			if ($post_date_gmt) {
+				$post_date_gmt = strtotime($post_date_gmt[1]);
 			} else {
 				// if we don't already have something from pubDate
-				preg_match('|<dc:date>(.*?)</dc:date>|is', $post, $post_date);
-				$post_date = preg_replace('|([-+])([0-9]+):([0-9]+)$|', '\1\2\3', $post_date[1]);
-				$post_date = str_replace('T', ' ', $post_date);
-				$post_date = strtotime($post_date);
+				preg_match('|<dc:date>(.*?)</dc:date>|is', $post, $post_date_gmt);
+				$post_date_gmt = preg_replace('|([-+])([0-9]+):([0-9]+)$|', '\1\2\3', $post_date_gmt[1]);
+				$post_date_gmt = str_replace('T', ' ', $post_date_gmt);
+				$post_date_gmt = strtotime($post_date_gmt);
 			}
 
-			$post_date = gmdate('Y-m-d H:i:s', $post_date);
+			$post_date_gmt = gmdate('Y-m-d H:i:s', $post_date_gmt);
+			$post_date = get_date_from_gmt( $post_date_gmt );
 
 			preg_match_all('|<category>(.*?)</category>|is', $post, $categories);
 			$categories = $categories[1];
@@ -90,7 +91,7 @@
 
 			$post_author = 1;
 			$post_status = 'publish';
-			$this->posts[$index] = compact('post_author', 'post_date', 'post_content', 'post_title', 'post_status', 'guid', 'categories');
+			$this->posts[$index] = compact('post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_title', 'post_status', 'guid', 'categories');
 			$index++;
 		}
 	}
@@ -167,5 +168,5 @@
 
 $rss_import = new RSS_Import();
 
-register_importer('rss', 'RSS', __('Import posts from an RSS feed'), array ($rss_import, 'dispatch'));
+register_importer('rss', __('RSS'), __('Import posts from an RSS feed'), array ($rss_import, 'dispatch'));
 ?>
diff -ruN 2.0.4/wp-admin/import/textpattern.php 2.0.5/wp-admin/import/textpattern.php
--- 2.0.4/wp-admin/import/textpattern.php	2006-07-05 11:48:55.000000000 -0500
+++ 2.0.5/wp-admin/import/textpattern.php	2006-10-31 09:05:37.000000000 -0600
@@ -555,12 +555,12 @@
 		echo '<h3>'.__('Preserving Authors').'</h3>';
 		echo '<p>'.__('Secondly, we have attempted to preserve post authors.  If you are the only author or contributor to your blog, then you are safe.  In most cases, we are successful in this preservation endeavor.  However, if we cannot ascertain the name of the writer due to discrepancies between database tables, we assign it to you, the administrative user.').'</p>';
 		echo '<h3>'.__('Textile').'</h3>';
-		echo '<p>'.__('Also, since you\'re coming from Textpattern, you probably have been using Textile to format your comments and posts.  If this is the case, we recommend downloading and installing <a href="http://www.huddledmasses.org/2004/04/19/wordpress-plugin-textile-20/">Textile for WordPress</a>.  Trust me... You\'ll want it.').'</p>';
+		echo '<p>'.__('Also, since you\'re coming from Textpattern, you probably have been using Textile to format your comments and posts.  If this is the case, we recommend downloading and installing <a href="http://www.huddledmasses.org/category/development/wordpress/textile/">Textile for WordPress</a>.  Trust me... You\'ll want it.').'</p>';
 		echo '<h3>'.__('WordPress Resources').'</h3>';
 		echo '<p>'.__('Finally, there are numerous WordPress resources around the internet.  Some of them are:').'</p>';
 		echo '<ul>';
 		echo '<li>'.__('<a href="http://www.wordpress.org">The official WordPress site</a>').'</li>';
-		echo '<li>'.__('<a href="http://wordpress.org/support/">The WordPress support forums').'</li>';
+		echo '<li>'.__('<a href="http://wordpress.org/support/">The WordPress support forums</a>').'</li>';
 		echo '<li>'.__('<a href="http://codex.wordpress.org">The Codex (In other words, the WordPress Bible)</a>').'</li>';
 		echo '</ul>';
 		echo '<p>'.sprintf(__('That\'s it! What are you waiting for? Go <a href="%1$s">login</a>!'), '/wp-login.php').'</p>';
@@ -659,5 +659,5 @@
 }
 
 $txp_import = new Textpattern_Import();
-register_importer('textpattern', 'Textpattern', __('Import posts from a Textpattern Blog'), array ($txp_import, 'dispatch'));
+register_importer('textpattern', __('Textpattern'), __('Import posts from a Textpattern Blog'), array ($txp_import, 'dispatch'));
 ?>
diff -ruN 2.0.4/wp-admin/index.php 2.0.5/wp-admin/index.php
--- 2.0.4/wp-admin/index.php	2006-07-04 14:24:41.000000000 -0500
+++ 2.0.5/wp-admin/index.php	2006-10-31 09:05:37.000000000 -0600
@@ -25,7 +25,7 @@
 $rss->items = array_slice($rss->items, 0, 10);
 foreach ($rss->items as $item ) {
 ?>
-	<li><a href="<?php echo wp_filter_kses($item['link']); ?>"><?php echo wp_specialchars($item['title']); ?></a></li>
+	<li><a href="<?php echo wp_filter_kses($item['link']); ?>"><?php echo wptexturize(wp_specialchars($item['title'])); ?></a></li>
 <?php } ?>
 </ul>
 </div>
diff -ruN 2.0.4/wp-admin/inline-uploading.php 2.0.5/wp-admin/inline-uploading.php
--- 2.0.4/wp-admin/inline-uploading.php	2006-07-05 15:21:45.000000000 -0500
+++ 2.0.5/wp-admin/inline-uploading.php	2006-10-31 09:05:37.000000000 -0600
@@ -24,6 +24,8 @@
 	}
 }
 
+$all = ( 'true' == $all ) ? 'true' : 'false';
+$start = (int) $start;
 $post = (int) $post;
 $images_width = 1;
 
diff -ruN 2.0.4/wp-admin/link-categories.php 2.0.5/wp-admin/link-categories.php
--- 2.0.4/wp-admin/link-categories.php	2006-07-23 13:41:48.000000000 -0500
+++ 2.0.5/wp-admin/link-categories.php	2006-10-31 09:05:37.000000000 -0600
@@ -309,7 +309,7 @@
          . " show_rating, show_updated, sort_order, sort_desc, text_before_link, text_after_link, "
          . " text_after_all, list_limit FROM $wpdb->linkcategories ORDER BY cat_id");
 $i = 1;
-foreach ($results as $row) {
+foreach ( (array) $results as $row) {
     if ($row->list_limit == -1) {
         $row->list_limit = __('none');
     }
@@ -356,7 +356,12 @@
                 <td nowrap="nowrap"><?php echo wp_specialchars($row->text_after_all)?></td>
                 <td><?php echo $row->list_limit ?></td>
                 <td><a href="link-categories.php?cat_id=<?php echo $row->cat_id?>&amp;action=Edit" class="edit"><?php _e('Edit') ?></a></td>
-                <td><a href="<?php echo wp_nonce_url("link-categories.php?cat_id=$row->cat_id?>&amp;action=Delete", 'delete-link-category_' . $row->cat_id) ?>" onclick="return deleteSomething( 'link category', <?php echo $row->cat_id . ", '" . sprintf(__("You are about to delete the &quot;%s&quot; link category.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), js_escape($row->cat_name)); ?>' );" class="delete"><?php _e('Delete') ?></a></td>
+                <td>
+				<?php if (1 == $row->cat_id ) { 
+					_e('Default');
+				} else { ?>
+					<a href="<?php echo wp_nonce_url("link-categories.php?cat_id=$row->cat_id?>&amp;action=Delete", 'delete-link-category_' . $row->cat_id) ?>" onclick="return deleteSomething( 'link category', <?php echo $row->cat_id . ", '" . sprintf(__("You are about to delete the &quot;%s&quot; link category.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), js_escape($row->cat_name)); ?>' );" class="delete"><?php _e('Delete') ?></a></td>
+				<?php } ?>
               </tr>
 <?php
         ++$i;
diff -ruN 2.0.4/wp-admin/menu.php 2.0.5/wp-admin/menu.php
--- 2.0.4/wp-admin/menu.php	2005-11-21 03:29:19.000000000 -0600
+++ 2.0.5/wp-admin/menu.php	2006-10-31 09:05:37.000000000 -0600
@@ -55,7 +55,7 @@
 }
 
 do_action('admin_menu', '');
-ksort($menu); // make it all pretty
+uksort($menu, "strnatcasecmp"); // make it all pretty
 
 if (! user_can_access_admin_page()) {
 	die( __('You do not have sufficient permissions to access this page.') );
diff -ruN 2.0.4/wp-admin/options-discussion.php 2.0.5/wp-admin/options-discussion.php
--- 2.0.4/wp-admin/options-discussion.php	2006-05-11 18:05:45.000000000 -0500
+++ 2.0.5/wp-admin/options-discussion.php	2006-10-31 09:05:37.000000000 -0600
@@ -71,7 +71,7 @@
 </fieldset>
 <fieldset class="options">
 <legend><?php _e('Comment Moderation') ?></legend>
-<p><?php printf(__('Hold a comment in the queue if it contains more than %s links. (A common characteristic of comment spam is a large number of hyperlinks.)'), '<input name="comment_max_links" type="text" id="comment_max_links" size="3" value="' . get_settings('comment_max_links'). '" />' ) ?></p>
+<p><?php printf(__('Hold a comment in the queue if it contains %s or more links. (A common characteristic of comment spam is a large number of hyperlinks.)'), '<input name="comment_max_links" type="text" id="comment_max_links" size="3" value="' . get_settings('comment_max_links'). '" />' ) ?></p>
 
 <p><?php _e('When a comment contains any of these words in its content, name, URI, e-mail, or IP, hold it in the moderation queue: (Separate multiple words with new lines.) <a href="http://codex.wordpress.org/Spam_Words">Common spam words</a>.') ?></p>
 <p> 
diff -ruN 2.0.4/wp-admin/options-general.php 2.0.5/wp-admin/options-general.php
--- 2.0.4/wp-admin/options-general.php	2006-05-11 18:05:45.000000000 -0500
+++ 2.0.5/wp-admin/options-general.php	2006-10-31 09:05:37.000000000 -0600
@@ -83,7 +83,7 @@
 </tr> 
 <tr>
 <th scope="row">&nbsp;</th>
-<td><?php _e('<a href="http://codex.wordpress.org/Formatting_Date_and_Time">Documentation on date formatting</a>. Save option to update sample output.') ?> </td>
+<td><?php _e('<a href="http://codex.wordpress.org/Formatting_Date_and_Time">Documentation on date formatting</a>. Click "Update options" to update sample output.') ?> </td>
 </tr>
 <tr>
 <th scope="row"><?php _e('Weeks in the calendar should start on:') ?></th>
diff -ruN 2.0.4/wp-admin/options-misc.php 2.0.5/wp-admin/options-misc.php
--- 2.0.4/wp-admin/options-misc.php	2006-05-11 18:05:45.000000000 -0500
+++ 2.0.5/wp-admin/options-misc.php	2006-10-31 09:05:37.000000000 -0600
@@ -17,7 +17,7 @@
 <table class="editform optiontable">
 <tr valign="top">
 <th scope="row"><?php _e('Store uploads in this folder'); ?>:</th>
-<td><input name="upload_path" type="text" id="upload_path" class="code" value="<?php echo str_replace(ABSPATH, '', get_settings('upload_path')); ?>" size="40" />
+<td><input name="upload_path" type="text" id="upload_path" class="code" value="<?php echo wp_specialchars(str_replace(ABSPATH, '', get_settings('upload_path')), 1); ?>" size="40" />
 <br />
 <?php _e('Default is <code>wp-content/uploads</code>'); ?>
 </td>
diff -ruN 2.0.4/wp-admin/options-permalink.php 2.0.5/wp-admin/options-permalink.php
--- 2.0.4/wp-admin/options-permalink.php	2006-05-11 18:05:45.000000000 -0500
+++ 2.0.5/wp-admin/options-permalink.php	2006-10-31 09:05:37.000000000 -0600
@@ -148,7 +148,7 @@
 </label>
 <br />
 </p>
-<p id="customstructure"><?php _e('Custom structure'); ?>: <input name="permalink_structure" id="permalink_structure" type="text" class="code" style="width: 60%;" value="<?php echo $permalink_structure; ?>" size="50" /></p>
+<p id="customstructure"><?php _e('Custom structure'); ?>: <input name="permalink_structure" id="permalink_structure" type="text" class="code" style="width: 60%;" value="<?php echo wp_specialchars($permalink_structure, 1); ?>" size="50" /></p>
 
 <h3><?php _e('Optional'); ?></h3>
 <?php if ($is_apache) : ?>
@@ -157,7 +157,7 @@
 	<p><?php _e('If you like, you may enter a custom prefix for your category URIs here. For example, <code>/index.php/taxonomy/tags</code> would make your category links like <code>http://example.org/index.php/taxonomy/tags/uncategorized/</code>. If you leave this blank the default will be used.') ?></p>
 <?php endif; ?>
 	<p> 
-  <?php _e('Category base'); ?>: <input name="category_base" type="text" class="code"  value="<?php echo $category_base; ?>" size="30" /> 
+  <?php _e('Category base'); ?>: <input name="category_base" type="text" class="code"  value="<?php echo wp_specialchars($category_base, 1); ?>" size="30" /> 
      </p> 
     <p class="submit"> 
       <input type="submit" name="submit" value="<?php _e('Update Permalink Structure &raquo;') ?>" /> 
diff -ruN 2.0.4/wp-admin/options.php 2.0.5/wp-admin/options.php
--- 2.0.4/wp-admin/options.php	2006-06-24 00:41:59.000000000 -0500
+++ 2.0.5/wp-admin/options.php	2006-10-31 09:05:37.000000000 -0600
@@ -24,6 +24,67 @@
 if ( !current_user_can('manage_options') )
 	die ( __('Cheatin&#8217; uh?') );
 
+function sanitize_option($option, $value) {
+
+	switch ($option) {
+		case 'admin_email':
+			$value = sanitize_email($value);
+			break;
+
+		case 'default_post_edit_rows':
+		case 'mailserver_port':
+		case 'comment_max_links':
+			$value = abs((int) $value);
+			break;
+
+		case 'posts_per_page':
+		case 'posts_per_rss':
+			$value = (int) $value;
+			if ( empty($value) ) $value = 1;
+			if ( $value < -1 ) $value = abs($value);
+			break;
+
+		case 'default_ping_status':
+		case 'default_comment_status':
+			// Options that if not there have 0 value but need to be something like "closed"
+			if ( $value == '0' || $value == '')
+				$value = 'closed';
+			break;
+
+		case 'blogdescription':
+		case 'blogname':
+			if (current_user_can('unfiltered_html') == false)
+				$value = wp_filter_post_kses( $value );
+			break;
+
+		case 'blog_charset':
+			$value = preg_replace('/[^a-zA-Z0-9_-]/', '', $value);
+			break;
+
+		case 'date_format':
+		case 'time_format':
+		case 'mailserver_url':
+		case 'mailserver_login':
+		case 'mailserver_pass':
+		case 'ping_sites':
+		case 'upload_path':
+			$value = strip_tags($value);
+			$value = wp_filter_kses($value);
+			break;
+
+		case 'gmt_offset':
+			$value = preg_replace('/[^0-9:.-]/', '', $value);
+			break;
+
+		case 'siteurl':
+		case 'home':
+			$value = clean_url($value);
+			break;
+	}
+
+	return $value;	
+}
+
 switch($action) {
 
 case 'update':
@@ -31,9 +92,10 @@
 	
 	check_admin_referer('update-options');
 
-	if (!$_POST['page_options']) {
-		foreach ($_POST as $key => $value) {
-			$options[] = $key;
+	if ( !$_POST['page_options'] ) {
+		foreach ( (array) $_POST as $key => $value) {
+			if ( !in_array($key, array('_wpnonce', '_wp_http_referer')) )
+				$options[] = $key;
 		}
 	} else {
 		$options = explode(',', stripslashes($_POST['page_options']));
@@ -43,19 +105,11 @@
 	$old_siteurl = get_settings('siteurl');
 	$old_home = get_settings('home');
 
-	// HACK
-	// Options that if not there have 0 value but need to be something like "closed"
-	$nonbools = array('default_ping_status', 'default_comment_status');
 	if ($options) {
 		foreach ($options as $option) {
 			$option = trim($option);
 			$value = trim(stripslashes($_POST[$option]));
-				if( in_array($option, $nonbools) && ( $value == '0' || $value == '') )
-				$value = 'closed';
-			
-			if( $option == 'blogdescription' || $option == 'blogname' )
-				if (current_user_can('unfiltered_html') == false)
-					$value = wp_filter_post_kses( $value );
+			$value = sanitize_option($option, $value);
 			
 			if (update_option($option, $value) ) {
 				$any_changed++;
@@ -87,26 +141,48 @@
 	include('admin-header.php'); ?>
 
 <div class="wrap">
-  <h2><?php _e('All options'); ?></h2>
-  <form name="form" action="options.php" method="post">
+  <h2><?php _e('All Options'); ?></h2>
+  <form name="form" action="options.php" method="post" id="all-options">
   <?php wp_nonce_field('update-options') ?>
   <input type="hidden" name="action" value="update" />
   <table width="98%">
 <?php
 $options = $wpdb->get_results("SELECT * FROM $wpdb->options ORDER BY option_name");
 
-foreach ($options as $option) :
-	$value = wp_specialchars($option->option_value);
+foreach ( (array) $options as $option) :
+	$disabled = '';
+	if ( is_serialized($option->option_value) ) {
+		if ( is_serialized_string($option->option_value) ) {
+			// this is a serialized string, so we should display it
+			$value = wp_specialchars(maybe_unserialize($option->option_value), 'single');
+			$options_to_update[] = $option->option_name;
+			$class = 'all-options';
+		} else {
+			$value = 'SERIALIZED DATA';
+			$disabled = ' disabled="disabled"';
+			$class = 'all-options disabled';
+		}
+	} else {
+		$value = wp_specialchars($option->option_value, 'single');
+		$options_to_update[] = $option->option_name;
+		$class = 'all-options';
+	}
 	echo "
 <tr>
 	<th scope='row'><label for='$option->option_name'>$option->option_name</label></th>
-	<td><input type='text' name='$option->option_name' id='$option->option_name' size='30' value='" . $value . "' /></td>
+<td>";
+
+	if (stristr($value, "\n")) echo "<textarea class='$class' name='$option->option_name' id='$option->option_name' cols='30' rows='5'>$value</textarea>";
+	else echo "<input class='$class' type='text' name='$option->option_name' id='$option->option_name' size='30' value='" . $value . "'$disabled />";
+	
+	echo "</td>
 	<td>$option->option_description</td>
 </tr>";
 endforeach;
 ?>
   </table>
-<p class="submit"><input type="submit" name="Update" value="<?php _e('Update Settings &raquo;') ?>" /></p>
+<?php $options_to_update = implode(',', $options_to_update); ?>
+<p class="submit"><input type="hidden" name="page_options" value="<?php echo wp_specialchars($options_to_update, true); ?>" /><input type="submit" name="Update" value="<?php _e('Update Options &raquo;') ?>" /></p>
   </form>
 </div>
 
diff -ruN 2.0.4/wp-admin/page-new.php 2.0.5/wp-admin/page-new.php
--- 2.0.4/wp-admin/page-new.php	2006-05-11 18:05:45.000000000 -0500
+++ 2.0.5/wp-admin/page-new.php	2006-10-31 09:05:37.000000000 -0600
@@ -7,7 +7,7 @@
 ?>
 
 <?php if ( isset($_GET['saved']) ) : ?>
-<div id="message" class="updated fade"><p><strong><?php _e('Page saved.') ?> <a href="edit-pages.php"><?php _e('Manage pages'); ?> &raquo;</a></strong></p></div>
+<div id="message" class="updated fade"><p><strong><?php _e('Page saved.') ?></strong> <a href="edit-pages.php"><?php _e('Manage pages'); ?></a> | <a href="<?php echo get_page_link( $_GET['saved'] ); ?>"><?php _e('View page'); ?> &raquo;</a></p></div>
 <?php endif; ?>
 
 <?php
@@ -20,4 +20,4 @@
 }
 ?>
 
-<?php include('admin-footer.php'); ?> 
\ No newline at end of file
+<?php include('admin-footer.php'); ?>
diff -ruN 2.0.4/wp-admin/plugins.php 2.0.5/wp-admin/plugins.php
--- 2.0.4/wp-admin/plugins.php	2006-06-27 18:10:02.000000000 -0500
+++ 2.0.5/wp-admin/plugins.php	2006-10-31 09:05:37.000000000 -0600
@@ -88,12 +88,6 @@
 <?php
 	$style = '';
 
-	function sort_plugins($plug1, $plug2) {
-		return strnatcasecmp($plug1['Name'], $plug2['Name']);
-	}
-	
-	uksort($plugins, 'sort_plugins');
-
 	foreach($plugins as $plugin_file => $plugin_data) {
 		$style = ('class="alternate"' == $style|| 'class="alternate active"' == $style) ? '' : 'alternate';
 
diff -ruN 2.0.4/wp-admin/post.php 2.0.5/wp-admin/post.php
--- 2.0.4/wp-admin/post.php	2006-07-28 17:09:09.000000000 -0500
+++ 2.0.5/wp-admin/post.php	2006-10-31 09:05:37.000000000 -0600
@@ -48,11 +48,11 @@
 			break;
 		}
 	} else {
-		$location = 'post.php?posted=true';
+		$location = "post.php?posted=$post_ID";
 	}
 
 	if ( 'static' == $_POST['post_status'] )
-		$location = "page-new.php?saved=true";
+		$location = "page-new.php?saved=$post_ID";
 
 	if ( isset($_POST['save']) )
 		$location = "post.php?action=edit&post=$post_ID";
@@ -81,7 +81,7 @@
 	?>
 	<div id='preview' class='wrap'>
 	<h2 id="preview-post"><?php _e('Post Preview (updated when post is saved)'); ?> <small class="quickjump"><a href="#write-post"><?php _e('edit &uarr;'); ?></a></small></h2>
-		<iframe src="<?php echo add_query_arg('preview', 'true', get_permalink($post->ID)); ?>" width="100%" height="600" ></iframe>
+		<iframe src="<?php echo wp_specialchars(apply_filters('preview_post_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
 	</div>
 	<?php
 	break;
@@ -335,12 +335,9 @@
 
 	edit_comment();
 
-	$referredby = $_POST['referredby'];
-	if (!empty($referredby)) {
-		wp_redirect($referredby);
-	} else {
-		wp_redirect("edit.php?p=$comment_post_ID&c=1#comments");
-	}
+	$location = ( empty($_POST['referredby']) ? "edit.php?p=$comment_post_ID&c=1" : $_POST['referredby'] ) . '#comment-' . $comment_ID;
+	$location = apply_filters('comment_edit_redirect', $location, $comment_ID);
+	wp_redirect($location);
 
 	break;
 
@@ -349,7 +346,7 @@
 	require_once ('./admin-header.php');
 ?>
 <?php if ( isset($_GET['posted']) ) : ?>
-<div id="message" class="updated fade"><p><?php printf(__('Post saved. <a href="%s">View site &raquo;</a>'), get_bloginfo('home') . '/'); ?></p></div>
+<div id="message" class="updated fade"><p><strong><?php _e('Post saved.'); ?></strong> <a href="<?php echo get_permalink( $_GET['posted'] ); ?>"><?php _e('View post'); ?> &raquo;</a></p></div>
 <?php endif; ?>
 <?php
 	if ( current_user_can('edit_posts') ) {
@@ -384,7 +381,7 @@
 
 		include('edit-form-advanced.php');
 ?>
-<div class="wrap">
+<div id="wp-bookmarklet" class="wrap">
 <?php echo '<h3>'.__('WordPress bookmarklet').'</h3>
 <p>'.__('Right click on the following link and choose "Add to favorites" to create a posting shortcut.').'</p>'; ?>
 <p>
diff -ruN 2.0.4/wp-admin/profile.php 2.0.5/wp-admin/profile.php
--- 2.0.4/wp-admin/profile.php	2006-05-26 18:31:24.000000000 -0500
+++ 2.0.5/wp-admin/profile.php	2006-10-31 09:05:37.000000000 -0600
@@ -5,7 +5,7 @@
 
 $parent_file = 'profile.php';
 include_once('admin-header.php');
-$profileuser = new WP_User($user_ID);
+$profileuser = get_user_to_edit($user_ID);
 
 $bookmarklet_height= 440;
 ?>
diff -ruN 2.0.4/wp-admin/templates.php 2.0.5/wp-admin/templates.php
--- 2.0.4/wp-admin/templates.php	2006-06-27 18:10:02.000000000 -0500
+++ 2.0.5/wp-admin/templates.php	2006-10-31 09:05:37.000000000 -0600
@@ -71,14 +71,17 @@
 
 	update_recently_edited($file);
 
-	if (!is_file($real_file))
+	if ( !is_file($real_file) ) {
 		$error = true;
-	
-	if (!$error) {
+	} else {
 		$f = @ fopen($real_file, 'r');
 		if ( $f ) {
-			$content = fread($f, filesize($real_file));
-			$content = htmlspecialchars($content);
+			if ( filesize($real_file ) > 0 ) {
+				$content = fread($f, filesize($real_file));
+				$content = htmlspecialchars($content);
+			} else {
+				$content = '';
+			}
 		} else {
 			$error = true;
 		}
@@ -108,7 +111,7 @@
 <?php
 echo '<ol>';
 foreach ($recents as $recent) :
-	echo "<li><a href='templates.php?file=$recent'>" . get_file_description(basename($recent)) . "</a></li>";
+	echo "<li><a href='templates.php?file=" . wp_specialchars($recent, true) . "'>" . get_file_description(basename($recent)) . "</a></li>";
 endforeach;
 echo '</ol>';
 endif;
diff -ruN 2.0.4/wp-admin/theme-editor.php 2.0.5/wp-admin/theme-editor.php
--- 2.0.4/wp-admin/theme-editor.php	2006-06-27 18:10:02.000000000 -0500
+++ 2.0.5/wp-admin/theme-editor.php	2006-10-31 09:05:37.000000000 -0600
@@ -58,11 +58,15 @@
 		$f = fopen($real_file, 'w+');
 		fwrite($f, $newcontent);
 		fclose($f);
-		wp_redirect("theme-editor.php?file=$file&theme=$theme&a=te");
+		$location = "theme-editor.php?file=$file&theme=$theme&a=te";
 	} else {
-		wp_redirect("theme-editor.php?file=$file&theme=$theme");
+		$location = "theme-editor.php?file=$file&theme=$theme";
 	}
 
+	$location = wp_kses_no_null($location);
+	$strip = array('%0d', '%0a');
+	$location = str_replace($strip, '', $location);
+	header("Location: $location");
 	exit();
 
 break;
diff -ruN 2.0.4/wp-admin/user-edit.php 2.0.5/wp-admin/user-edit.php
--- 2.0.4/wp-admin/user-edit.php	2006-06-27 18:10:02.000000000 -0500
+++ 2.0.5/wp-admin/user-edit.php	2006-10-31 09:05:37.000000000 -0600
@@ -21,6 +21,11 @@
 	}
 }
 
+$user_id = (int) $user_id;
+
+if ( !$user_id )
+	die(__('Invalid user ID.'));
+
 switch ($action) {
 case 'switchposts':
 
@@ -37,7 +42,7 @@
 $errors = array();
 
 if (!current_user_can('edit_users'))
-	$errors['head'] = __('You do not have permission to edit this user.');
+	die(__('You do not have permission to edit this user.'));
 else
 	$errors = edit_user($user_id);
 
@@ -49,9 +54,11 @@
 default:
 include ('admin-header.php');
 
-$profileuser = new WP_User($user_id);
+$profileuser = get_user_to_edit($user_id);
+
+if (!current_user_can('edit_users')) 
+	die__('You do not have permission to edit this user.');
 
-if (!current_user_can('edit_users')) $errors['head'] = __('You do not have permission to edit this user.');
 ?>
 
 <?php if ( isset($_GET['updated']) ) : ?>
diff -ruN 2.0.4/wp-admin/users.php 2.0.5/wp-admin/users.php
--- 2.0.4/wp-admin/users.php	2006-06-27 18:10:02.000000000 -0500
+++ 2.0.5/wp-admin/users.php	2006-10-31 09:05:37.000000000 -0600
@@ -206,7 +206,7 @@
   <table cellpadding="3" cellspacing="3" width="100%">
 	<?php
 	foreach($roleclasses as $role => $roleclass) {
-		ksort($roleclass);
+		uksort($roleclass, "strnatcasecmp");
 		?>
 
 	<tr>
diff -ruN 2.0.4/wp-admin/wp-admin.css 2.0.5/wp-admin/wp-admin.css
--- 2.0.4/wp-admin/wp-admin.css	2006-07-06 01:35:28.000000000 -0500
+++ 2.0.5/wp-admin/wp-admin.css	2006-10-31 09:05:37.000000000 -0600
@@ -357,6 +357,14 @@
 	text-align: center;
 }
 
+textarea.all-options, input.all-options {
+	width: 250px;
+}
+
+input.disabled, textarea.disabled {
+	background: #ccc;
+}
+
 #adminmenu {
 	background: #6da6d1;
 	border-top: 3px solid #448abd;
diff -ruN 2.0.4/wp-comments-post.php 2.0.5/wp-comments-post.php
--- 2.0.4/wp-comments-post.php	2006-05-11 18:05:45.000000000 -0500
+++ 2.0.5/wp-comments-post.php	2006-10-31 09:05:37.000000000 -0600
@@ -57,8 +57,9 @@
 	setcookie('comment_author_url_' . COOKIEHASH, clean_url($comment->comment_author_url), time() + 30000000, COOKIEPATH, COOKIE_DOMAIN);
 endif;
 
-$location = ( empty( $_POST['redirect_to'] ) ) ? get_permalink( $comment_post_ID ) : $_POST['redirect_to']; 
+$location = ( empty($_POST['redirect_to']) ? get_permalink($comment_post_ID) : $_POST['redirect_to'] ) . '#comment-' . $comment_id;
+$location = apply_filters('comment_post_redirect', $location, $comment);
 
-wp_redirect( $location );
+wp_redirect($location);
 
 ?>
Binary files 2.0.4/wp-content/.DS_Store and 2.0.5/wp-content/.DS_Store differ
Binary files 2.0.4/wp-content/plugins/akismet/akismet.gif and 2.0.5/wp-content/plugins/akismet/akismet.gif differ
diff -ruN 2.0.4/wp-content/plugins/akismet/akismet.php 2.0.5/wp-content/plugins/akismet/akismet.php
--- 2.0.4/wp-content/plugins/akismet/akismet.php	2006-07-26 17:35:57.000000000 -0500
+++ 2.0.5/wp-content/plugins/akismet/akismet.php	2006-10-31 09:05:37.000000000 -0600
@@ -2,9 +2,8 @@
 /*
 Plugin Name: Akismet
 Plugin URI: http://akismet.com/
-Description: Akismet checks your comments against the Akismet web serivce to see if they look like spam or not. You need a <a href="http://wordpress.com/api-keys/">WordPress.com API key</a> to use this service. You can review the spam it catches under "Manage" and it automatically deletes old spam after 15 days. Hat tip: <a href="http://ioerror.us/">Michael Hampton</a> and <a href="http://chrisjdavis.org/">Chris J. Davis</a> for help with the plugin.
-Author: Matt Mullenweg
-Version: 1.15
+Description: Akismet checks your comments against the Akismet web serivce to see if they look like spam or not. You need a <a href="http://wordpress.com/api-keys/">WordPress.com API key</a> to use this service. You can review the spam it catches under "Manage" and it automatically deletes old spam after 15 days. To show off your Akismet stats just put <code>&lt;?php akismet_counter(); ?></code> in your template.
+Version: 1.2.1
 Author URI: http://photomatt.net/
 */
 
@@ -25,13 +24,13 @@
 function ksd_config_page() {
 	global $wpdb;
 	if ( function_exists('add_submenu_page') )
-		add_submenu_page('plugins.php', __('Akismet Configuration'), __('Akismet Configuration'), 'manage_options', __FILE__, 'akismet_conf');
+		add_submenu_page('plugins.php', __('Akismet Configuration'), __('Akismet Configuration'), 'manage_options', 'akismet-key-config', 'akismet_conf');
 }
 
 function akismet_conf() {
 	global $akismet_nonce;
 	if ( isset($_POST['submit']) ) {
-		if ( !current_user_can('manage_options') )
+		if ( function_exists('current_user_can') && !current_user_can('manage_options') )
 			die(__('Cheatin&#8217; uh?'));
 
 		check_admin_referer($akismet_nonce);
@@ -74,9 +73,8 @@
 
 if ( !get_option('wordpress_api_key') && !isset($_POST['submit']) ) {
 	function akismet_warning() {
-	$path = plugin_basename(__FILE__);
 		echo "
-		<div id='akismet-warning' class='updated fade-ff0000'><p><strong>".__('Akismet is not active.')."</strong> ".sprintf(__('You must <a href="%1$s">enter your WordPress.com API key</a> for it to work.'), "plugins.php?page=$path")."</p></div>
+		<div id='akismet-warning' class='updated fade-ff0000'><p><strong>".__('Akismet is not active.')."</strong> ".sprintf(__('You must <a href="%1$s">enter your WordPress.com API key</a> for it to work.'), "plugins.php?page=akismet-key-config")."</p></div>
 		<style type='text/css'>
 		#adminmenu { margin-bottom: 5em; }
 		#akismet-warning { position: absolute; top: 7em; }
@@ -89,7 +87,7 @@
 
 $ksd_api_host = get_option('wordpress_api_key') . '.rest.akismet.com';
 $ksd_api_port = 80;
-$ksd_user_agent = "WordPress/$wp_version | Akismet/1.15";
+$ksd_user_agent = "WordPress/$wp_version | Akismet/1.2.1";
 
 // Returns array with headers in $response[0] and entity in $response[1]
 function ksd_http_post($request, $host, $path, $port = 80) {
@@ -97,14 +95,14 @@
 
 	$http_request  = "POST $path HTTP/1.0\r\n";
 	$http_request .= "Host: $host\r\n";
-	$http_request .= "Content-Type: application/x-www-form-urlencoded; charset=" . get_settings('blog_charset') . "\r\n";
+	$http_request .= "Content-Type: application/x-www-form-urlencoded; charset=" . get_option('blog_charset') . "\r\n";
 	$http_request .= "Content-Length: " . strlen($request) . "\r\n";
 	$http_request .= "User-Agent: $ksd_user_agent\r\n";
 	$http_request .= "\r\n";
 	$http_request .= $request;
 
 	$response = '';
-	if( false !== ( $fs = @fsockopen($host, $port, $errno, $errstr, 10) ) ) {
+	if( false != ( $fs = @fsockopen($host, $port, $errno, $errstr, 10) ) ) {
 		fwrite($fs, $http_request);
 
 		while ( !feof($fs) )
@@ -202,13 +200,14 @@
 	global $wpdb;
 	$count = sprintf(__('Akismet Spam (%s)'), ksd_spam_count());
 	if ( function_exists('add_management_page') )
-		add_management_page(__('Akismet Spam'), $count, 'moderate_comments', __FILE__, 'ksd_caught');
+		add_management_page(__('Akismet Spam'), $count, 'moderate_comments', 'akismet-admin', 'ksd_caught');
 }
 
 function ksd_caught() {
 	global $wpdb, $comment;
+	
 	if (isset($_POST['submit']) && 'recover' == $_POST['action'] && ! empty($_POST['not_spam'])) {
-		if ( ! current_user_can('moderate_comments') )
+		if ( function_exists('current_user_can') && !current_user_can('moderate_comments') )
 			die(__('You do not have sufficient permission to moderate comments.'));
 		
 		$i = 0;
@@ -224,7 +223,7 @@
 		echo '<div class="updated"><p>' . sprintf(__('%1$s comments recovered.'), $i) . "</p></div>";
 	}
 	if ('delete' == $_POST['action']) {
-		if ( ! current_user_can('moderate_comments') )
+		if ( function_exists('current_user_can') && !current_user_can('moderate_comments') )
 			die(__('You do not have sufficient permission to moderate comments.'));
 
 		$delete_time = addslashes( $_POST['display_time'] );
@@ -264,10 +263,51 @@
 <h2><?php _e('Latest Spam'); ?></h2>
 <?php echo '<p>'.__('These are the latest comments identified as spam by Akismet. If you see any mistakes, simply mark the comment as "not spam" and Akismet will learn from the submission. If you wish to recover a comment from spam, simply select the comment, and click Not Spam. After 15 days we clean out the junk for you.').'</p>'; ?>
 <?php
-$comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_approved = 'spam' ORDER BY comment_date DESC LIMIT 150");
+if ( isset( $_GET['apage'] ) )
+	$page = (int) $_GET['apage'];
+else
+	$page = 1;
+$start = ( $page - 1 ) * 50;
+$end = $start + 50;
+$comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_approved = 'spam' ORDER BY comment_date DESC LIMIT $start, $end");
+$total = $wpdb->get_var( "SELECT COUNT(*) FROM $wpdb->comments WHERE comment_approved = 'spam'" );
 
 if ($comments) {
 ?>
+
+<?php if ( $total > 50 ) {
+$total_pages = ceil( $total / 50 );
+$r = '';
+if ( 1 < $page ) {
+	$args['apage'] = ( 1 == $page - 1 ) ? '' : $page - 1;
+	$r .=  '<a class="prev" href="' . add_query_arg( $args ) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
+}
+if ( ( $total_pages = ceil( $total / 50 ) ) > 1 ) {
+	for ( $page_num = 1; $page_num <= $total_pages; $page_num++ ) :
+		if ( $page == $page_num ) :
+			$r .=  "<span>$page_num</span>\n";
+		else :
+			$p = false;
+			if ( $page_num < 3 || ( $page_num >= $page - 3 && $page_num <= $page + 3 ) || $page_num > $total_pages - 3 ) :
+				$args['apage'] = ( 1 == $page_num ) ? '' : $page_num;
+				$r .= '<a class="page-numbers" href="' . add_query_arg($args) . '">' . ( $page_num ) . "</a>\n";
+				$in = true;
+			elseif ( $in == true ) :
+				$r .= "...\n";
+				$in = false;
+			endif;
+		endif;
+	endfor;
+}
+if ( ( $page ) * 50 < $total || -1 == $total ) {
+	$args['apage'] = $page + 1;
+	$r .=  '<a class="next" href="' . add_query_arg($args) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
+}
+echo "<p>$r</p>";
+?>
+
+<?php } ?>
+
 <form method="post" action="<?php echo $_SERVER['REQUEST_URI']; ?>">
 <input type="hidden" name="action" value="recover" />
 <ul id="spam-list" class="commentlist" style="list-style: none; margin: 0; padding: 0;">
@@ -275,7 +315,7 @@
 $i = 0;
 foreach($comments as $comment) {
 	$i++;
-	$comment_date = mysql2date(get_settings("date_format") . " @ " . get_settings("time_format"), $comment->comment_date);
+	$comment_date = mysql2date(get_option("date_format") . " @ " . get_option("time_format"), $comment->comment_date);
 	$post = get_post($comment->comment_post_ID);
 	$post_title = $post->post_title;
 	if ($i % 2) $class = 'class="alternate"';
@@ -326,9 +366,170 @@
 		return;
 	$path = plugin_basename(__FILE__);
 	echo '<h3>'.__('Spam').'</h3>';
-	echo '<p>'.sprintf(__('<a href="%1$s">Akismet</a> has protected your site from <a href="%2$s">%3$s spam comments</a>.'), 'http://akismet.com/', "edit.php?page=$path", number_format($count) ).'</p>';
+	echo '<p>'.sprintf(__('<a href="%1$s">Akismet</a> has protected your site from <a href="%2$s">%3$s spam comments</a>.'), 'http://akismet.com/', "edit.php?page=akismet-admin", number_format($count) ).'</p>';
 }
 
 add_action('activity_box_end', 'akismet_stats');
 
+function widget_akismet_register() {
+	if ( function_exists('register_sidebar_widget') ) :
+	function widget_akismet($args) {
+		extract($args);
+		$options = get_option('widget_akismet');
+		$count = number_format(get_option('akismet_spam_count'));
+		$text = __('%d spam comments have been blocked by <a href="http://akismet.com">Akismet</a>.');
+		?>
+			<?php echo $before_widget; ?>
+				<?php echo $before_title . $options['title'] . $after_title; ?>
+				<div id="akismetwrap"><div id="akismetstats"><a id="aka" href="http://akismet.com" title=""><div id="akismet1"><span id="akismetcount"><?php echo $count; ?></span> <span id="akismetsc"><?php _e('spam comments') ?></span></div> <div id="akismet2"><span id="akismetbb"><?php _e('blocked by') ?></span><br /><span id="akismeta">Akismet</span></div></a></div></div>
+			<?php echo $after_widget; ?>
+	<?php
+	}
+	
+	function widget_akismet_style() {
+		?>
+		<style type="text/css">
+#aka, #aka:link, #aka:hover, #aka:visited, #aka:active {
+	color: #fff;
+	text-decoration: none;
+}
+
+#aka:hover{
+	border: none;
+	text-decoration: none;
+}
+
+#aka:hover #akismet1{
+	display: none;
+}
+
+#aka:hover #akismet2{
+	display: block;
+}
+
+#akismet1{
+	display: block;
+}
+
+#akismet2{
+	display: none;
+	padding-top: 2px;
+}
+
+#akismeta{
+	font-size: 16px;
+	font-weight: bold;
+	line-height: 18px;
+	text-decoration: none;
+}
+
+#akismetcount{
+	display: block;
+	font: 15px Verdana,Arial,Sans-Serif;
+	font-weight: bold;
+	text-decoration: none;
+}
+
+#akismetwrap #akismetstats{
+	background: url(<?php echo get_option('siteurl'); ?>/wp-content/plugins/akismet/akismet.gif) no-repeat top left;
+	border: none;
+	color: #fff;
+	font: 11px 'Trebuchet MS','Myriad Pro',sans-serif;
+	height: 40px;
+	line-height: 100%;
+	overflow: hidden;
+	padding: 8px 0 0;
+	text-align: center;
+	width: 120px;
+}
+
+
+		</style>
+		<?php
+	}
+
+	function widget_akismet_control() {
+		$options = $newoptions = get_option('widget_akismet');
+		if ( $_POST["akismet-submit"] ) {
+			$newoptions['title'] = strip_tags(stripslashes($_POST["akismet-title"]));
+			if ( empty($newoptions['title']) ) $newoptions['title'] = 'Spam Blocked';
+		}
+		if ( $options != $newoptions ) {
+			$options = $newoptions;
+			update_option('widget_akismet', $options);
+		}
+		$title = htmlspecialchars($options['title'], ENT_QUOTES);
+	?>
+				<p><label for="akismet-title"><?php _e('Title:'); ?> <input style="width: 250px;" id="akismet-title" name="akismet-title" type="text" value="<?php echo $title; ?>" /></label></p>
+				<input type="hidden" id="akismet-submit" name="akismet-submit" value="1" />
+	<?php
+	}
+
+	register_sidebar_widget('Akismet', 'widget_akismet', null, 'akismet');
+	register_widget_control('Akismet', 'widget_akismet_control', 300, 75, 'akismet');
+	if ( is_active_widget('widget_akismet') )
+		add_action('wp_head', 'widget_akismet_style');
+	endif;
+}
+add_action('init', 'widget_akismet_register');
+
+// Counter for non-widget users
+function akismet_counter() {
+?>
+<style type="text/css">
+#akismetwrap #aka,#aka:link,#aka:hover,#aka:visited,#aka:active{color:#fff;text-decoration:none}
+#aka:hover{border:none;text-decoration:none}
+#aka:hover #akismet1{display:none}
+#aka:hover #akismet2,#akismet1{display:block}
+#akismet2{display:none;padding-top:2px}
+#akismeta{font-size:16px;font-weight:bold;line-height:18px;text-decoration:none}
+#akismetcount{display:block;font:15px Verdana,Arial,Sans-Serif;font-weight:bold;text-decoration:none}
+#akismetwrap #akismetstats{background:url(<?php echo get_option('siteurl'); ?>/wp-content/plugins/akismet/akismet.gif) no-repeat top left;border:none;color:#fff;font:11px 'Trebuchet MS','Myriad Pro',sans-serif;height:40px;line-height:100%;overflow:hidden;padding:8px 0 0;text-align:center;width:120px}
+</style>
+<?php
+$count = number_format(get_option('akismet_spam_count'));
 ?>
+<div id="akismetwrap"><div id="akismetstats"><a id="aka" href="http://akismet.com" title=""><div id="akismet1"><span id="akismetcount"><?php echo $count; ?></span> <span id="akismetsc"><?php _e('spam comments') ?></span></div> <div id="akismet2"><span id="akismetbb"><?php _e('blocked by') ?></span><br /><span id="akismeta">Akismet</span></div></a></div></div>
+<?php
+}
+
+if ( 'moderation.php' == $pagenow ) {
+	function akismet_recheck_button( $page ) {
+		$button = "<a href='edit.php?page=akismet-admin&amp;recheckqueue=true' style='display: block; width: 100px; position: absolute; right: 7%; padding: 5px; font-size: 14px; text-decoration: underline; background: #fff; border: 1px solid #ccc;'>Recheck Queue for Spam</a>";
+		$page = str_replace( '<div class="wrap">', '<div class="wrap">' . $button, $page );
+		return $page;
+	}
+
+	if ( $wpdb->get_var( "SELECT COUNT(*) FROM $wpdb->comments WHERE comment_approved = '0'" ) )
+		ob_start( 'akismet_recheck_button' );
+}
+
+function akismet_recheck_queue() {
+	global $wpdb, $ksd_api_host, $ksd_api_port;
+
+	if ( !isset( $_GET['recheckqueue'] ) )
+		return;
+
+	$moderation = $wpdb->get_results( "SELECT * FROM $wpdb->comments WHERE comment_approved = '0'", ARRAY_A );
+	foreach ( $moderation as $c ) {
+		$c['user_ip']    = $c['comment_author_IP'];
+		$c['user_agent'] = $c['comment_agent'];
+		$c['referrer']   = '';
+		$c['blog']       = get_option('home');
+		$id = $c['comment_ID'];
+		
+		$query_string = '';
+		foreach ( $c as $key => $data )
+		$query_string .= $key . '=' . urlencode( stripslashes($data) ) . '&';
+		
+		$response = ksd_http_post($query_string, $ksd_api_host, '/1.1/comment-check', $ksd_api_port);
+		if ( 'true' == $response[1] ) {
+			$wpdb->query( "UPDATE $wpdb->comments SET comment_approved = 'spam' WHERE comment_ID = $id" );
+		}
+	}
+	wp_redirect( $_SERVER['HTTP_REFERER'] );
+	exit;
+}
+add_action( 'load-manage_page_akismet-admin', 'akismet_recheck_queue' );
+
+?>
\ No newline at end of file
diff -ruN 2.0.4/wp-content/plugins/wp-db-backup.php 2.0.5/wp-content/plugins/wp-db-backup.php
--- 2.0.4/wp-content/plugins/wp-db-backup.php	2006-07-26 17:56:56.000000000 -0500
+++ 2.0.5/wp-content/plugins/wp-db-backup.php	2006-10-31 09:05:37.000000000 -0600
@@ -4,7 +4,7 @@
 Plugin URI: http://www.skippy.net/blog/plugins/
 Description: On-demand backup of your WordPress database.
 Author: Scott Merrill
-Version: 1.7
+Version: 1.8
 Author URI: http://www.skippy.net/
 
 Much of this was modified from Mark Ghosh's One Click Backup, which
@@ -69,7 +69,8 @@
 			$via = isset($_GET['via']) ? $_GET['via'] : 'http';
 			
 			$this->backup_file = $_GET['backup'];
-			
+			$this->validate_file($this->backup_file);
+
 			switch($via) {
 			case 'smtp':
 			case 'email':
@@ -95,6 +96,7 @@
 		}
 		if (isset($_GET['fragment'] )) {
 			list($table, $segment, $filename) = explode(':', $_GET['fragment']);
+			$this->validate_file($filename);
 			$this->backup_fragment($table, $segment, $filename);
 		}
 
@@ -881,6 +883,18 @@
 		
 		return;
 	} // wp_cron_db_backup
+
+	function validate_file($file) {
+		if (false !== strpos($file, '..'))
+			die(__("Cheatin' uh ?"));
+
+		if (false !== strpos($file, './'))
+			die(__("Cheatin' uh ?"));
+
+		if (':' == substr($file, 1, 1))
+			die(__("Cheatin' uh ?"));
+	}
+
 }
 
 function wpdbBackup_init() {
diff -ruN 2.0.4/wp-content/themes/classic/sidebar.php 2.0.5/wp-content/themes/classic/sidebar.php
--- 2.0.4/wp-content/themes/classic/sidebar.php	2005-02-02 04:57:07.000000000 -0600
+++ 2.0.5/wp-content/themes/classic/sidebar.php	2006-10-31 09:05:37.000000000 -0600
@@ -12,7 +12,7 @@
  </li>
  <li id="search">
    <label for="s"><?php _e('Search:'); ?></label>	
-   <form id="searchform" method="get" action="<?php echo $_SERVER['PHP_SELF']; ?>">
+   <form id="searchform" method="get" action="<?php bloginfo('home'); ?>">
 	<div>
 		<input type="text" name="s" id="s" size="15" /><br />
 		<input type="submit" value="<?php _e('Search'); ?>" />
Binary files 2.0.4/wp-includes/.DS_Store and 2.0.5/wp-includes/.DS_Store differ
diff -ruN 2.0.4/wp-includes/class-snoopy.php 2.0.5/wp-includes/class-snoopy.php
--- 2.0.4/wp-includes/class-snoopy.php	2006-07-23 16:28:36.000000000 -0500
+++ 2.0.5/wp-includes/class-snoopy.php	2006-10-31 09:05:37.000000000 -0600
@@ -1239,7 +1239,7 @@
 
 						$fp = fopen($file_name, "r");
 						while (!feof($fp)) {
-							$file_content = fread($fp, filesize($file_name));
+							$file_content .= fread($fp, filesize($file_name));
 						}
 						fclose($fp);
 						$base_name = basename($file_name);
diff -ruN 2.0.4/wp-includes/classes.php 2.0.5/wp-includes/classes.php
--- 2.0.4/wp-includes/classes.php	2006-07-04 15:01:31.000000000 -0500
+++ 2.0.5/wp-includes/classes.php	2006-10-31 09:05:37.000000000 -0600
@@ -109,7 +109,7 @@
 			// If year, month, day, hour, minute, and second are set, a single 
 			// post is being queried.        
 			$this->is_single = true;
-		} elseif ('' != $qv['static'] || '' != $qv['pagename'] || '' != $qv['page_id']) {
+		} elseif ('' != $qv['static'] || '' != $qv['pagename'] || (int) $qv['page_id']) {
 			$this->is_page = true;
 			$this->is_single = false;
 		} elseif (!empty($qv['s'])) {
@@ -246,8 +246,12 @@
 	}
 
 	function set_404() {
+		$is_feed = $this->is_feed;
+
 		$this->init_query_flags();
-		$this->is_404 = true;	
+		$this->is_404 = true;
+
+		$this->is_feed = $is_feed;
 	}
 	
 	function get($query_var) {
@@ -805,7 +809,7 @@
 		$list = array_unique( $list );
 		$this->spam_words = $list;
 
-		$this->comment_list = $wpdb->get_results("SELECT comment_ID AS ID, comment_content AS text, comment_approved AS approved, comment_author_url AS url, comment_author_ip AS ip, comment_author_email AS email FROM $wpdb->comments ORDER BY comment_ID ASC");
+		$this->comment_list = (array) $wpdb->get_results("SELECT comment_ID AS ID, comment_content AS text, comment_approved AS approved, comment_author_url AS url, comment_author_ip AS ip, comment_author_email AS email FROM $wpdb->comments ORDER BY comment_ID ASC");
 	}	// End of class constructor
 
 	function move_spam( $id_list ) {
@@ -818,9 +822,9 @@
 				$cnt++;
 			}
 		}
-		echo "<div class='updated'><p>$cnt comment";
-		if ($cnt != 1 ) echo "s";
-		echo " moved to the moderation queue.</p></div>\n";
+		echo "<div class='updated'><p> ";
+		printf(__('%d comment(s) moved to the moderation queue.'), $cnt);
+		echo "</p></div>\n";
 	}	// End function move_spam
 
 	function find_spam() {
@@ -849,7 +853,7 @@
 		$numfound = count($counters[found]);
 		$numqueue = $counters[in_queue];
 
-		$body = '<p>' . sprintf(__('Suspected spam comments: <strong>%s</strong>'), $numfound) . '</p>';
+		$body = '<p>' . sprintf(__('Suspected spam comments: %s'), "<strong>$numfound</strong>") . '</p>';
 
 		if ( count($counters[found]) > 0 ) {
 			$id_list = implode( ',', $counters[found] );
@@ -1032,6 +1036,7 @@
 				$front = $front . 'date/';
 				break;
 			}
+			$tok_index++;
 		}
 
 		$this->date_structure = $front . $date_endian;
@@ -1499,7 +1504,7 @@
 
 			$pathinfo = $_SERVER['PATH_INFO'];
 			$pathinfo_array = explode('?', $pathinfo);
-			$pathinfo = $pathinfo_array[0];
+			$pathinfo = str_replace("%", "%25", $pathinfo_array[0]);
 			$req_uri = $_SERVER['REQUEST_URI'];
 			$req_uri_array = explode('?', $req_uri);
 			$req_uri = $req_uri_array[0];
@@ -1616,6 +1621,8 @@
 			nocache_headers();
 		if ( !empty($this->query_vars['error']) && '404' == $this->query_vars['error'] ) {
 			status_header( 404 );
+			if ( !is_user_logged_in() )
+				nocache_headers();
 			@header('Content-type: ' . get_option('html_type') . '; charset=' . get_option('blog_charset'));
 		} else if ( empty($this->query_vars['feed']) ) {
 			@header('Content-type: ' . get_option('html_type') . '; charset=' . get_option('blog_charset'));
@@ -1705,6 +1712,7 @@
 		if ( (0 == count($wp_query->posts)) && !is_404() && !is_search() && ( $this->did_permalink || (!empty($_SERVER['QUERY_STRING']) && (false === strpos($_SERVER['REQUEST_URI'], '?'))) ) ) {
 			$wp_query->set_404();
 			status_header( 404 );
+			nocache_headers();
 		}	elseif( is_404() != true ) {
 			status_header( 200 );
 		}
diff -ruN 2.0.4/wp-includes/comment-functions.php 2.0.5/wp-includes/comment-functions.php
--- 2.0.4/wp-includes/comment-functions.php	2006-07-05 21:27:53.000000000 -0500
+++ 2.0.5/wp-includes/comment-functions.php	2006-10-31 09:05:37.000000000 -0600
@@ -109,8 +109,6 @@
 	global $wpdb;
 	extract($commentdata);
 
-	$comment_user_domain = apply_filters('pre_comment_user_domain', gethostbyaddr($comment_author_IP) );
-
 	// Simple duplicate check
 	$dupe = "SELECT comment_ID FROM $wpdb->comments WHERE comment_post_ID = '$comment_post_ID' AND ( comment_author = '$comment_author' ";
 	if ( $comment_author_email )
@@ -217,7 +215,9 @@
 
 function clean_url( $url ) {
 	if ('' == $url) return $url;
-	$url = preg_replace('|[^a-z0-9-~+_.?#=&;,/:]|i', '', $url);
+	$url = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%]|i', '', $url);
+	$strip = array('%0d', '%0a');
+	$url = str_replace($strip, '', $url);
 	$url = str_replace(';//', '://', $url);
 	$url = (!strstr($url, '://')) ? 'http://'.$url : $url;
 	$url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&#038;$1', $url);
@@ -833,7 +833,7 @@
 
 	if (1 == get_settings('comment_moderation')) return false; // If moderation is set to manual
 
-	if ( (count(explode('http:', $comment)) - 1) >= get_settings('comment_max_links') )
+	if ( preg_match_all("|(href\t*?=\t*?['\"]?)?(https?:)?//|i", $comment, $out) >= get_option('comment_max_links') )
 		return false; // Check # of external links
 
 	$mod_keys = trim( get_settings('moderation_keys') );
diff -ruN 2.0.4/wp-includes/default-filters.php 2.0.5/wp-includes/default-filters.php
--- 2.0.4/wp-includes/default-filters.php	2006-07-26 12:40:30.000000000 -0500
+++ 2.0.5/wp-includes/default-filters.php	2006-10-31 09:05:37.000000000 -0600
@@ -57,6 +57,31 @@
 add_filter('pre_category_name', 'wp_specialchars', 30);
 add_filter('pre_category_description', 'wp_filter_kses');
 
+//Links
+add_filter('pre_link_name', 'strip_tags');
+add_filter('pre_link_name', 'trim');
+add_filter('pre_link_name', 'wp_filter_kses');
+add_filter('pre_link_name', 'wp_specialchars', 30);
+add_filter('pre_link_description', 'wp_filter_kses');
+add_filter('pre_link_notes', 'wp_filter_kses');
+add_filter('pre_link_url', 'strip_tags');
+add_filter('pre_link_url', 'trim');
+add_filter('pre_link_url', 'clean_url');
+add_filter('pre_link_image', 'strip_tags');
+add_filter('pre_link_image', 'trim');
+add_filter('pre_link_image', 'clean_url');
+add_filter('pre_link_rss', 'strip_tags');
+add_filter('pre_link_rss', 'trim');
+add_filter('pre_link_rss', 'clean_url');
+add_filter('pre_link_target', 'strip_tags');
+add_filter('pre_link_target', 'trim');
+add_filter('pre_link_target', 'wp_filter_kses');
+add_filter('pre_link_target', 'wp_specialchars', 30);
+add_filter('pre_link_rel', 'strip_tags');
+add_filter('pre_link_rel', 'trim');
+add_filter('pre_link_rel', 'wp_filter_kses');
+add_filter('pre_link_rel', 'wp_specialchars', 30);
+
 // Users
 add_filter('pre_user_display_name', 'strip_tags');
 add_filter('pre_user_display_name', 'trim');
@@ -115,6 +140,9 @@
 add_filter('bloginfo_rss', 'ent2ncr', 8);
 add_filter('the_author', 'ent2ncr', 8);
 
+// Misc filters
+add_filter('option_blog_charset', 'wp_specialchars');
+
 // Actions
 add_action('publish_post', 'generic_ping');
 add_action('wp_head', 'rsd_link');
diff -ruN 2.0.4/wp-includes/feed-functions.php 2.0.5/wp-includes/feed-functions.php
--- 2.0.4/wp-includes/feed-functions.php	2005-12-15 16:20:06.000000000 -0600
+++ 2.0.5/wp-includes/feed-functions.php	2006-10-31 09:05:37.000000000 -0600
@@ -134,9 +134,9 @@
     foreach ($categories as $category) {
         $category->cat_name = convert_chars($category->cat_name);
         if ('rdf' == $type) {
-            $the_list .= "\n\t<dc:subject>$category->cat_name</dc:subject>";
+            $the_list .= "\n\t\t<dc:subject>$category->cat_name</dc:subject>\n";
         } else {
-            $the_list .= "\n\t<category>$category->cat_name</category>";
+            $the_list .= "\n\t\t<category>$category->cat_name</category>\n";
         }
     }
     echo apply_filters('the_category_rss', $the_list, $type);
diff -ruN 2.0.4/wp-includes/functions-formatting.php 2.0.5/wp-includes/functions-formatting.php
--- 2.0.4/wp-includes/functions-formatting.php	2006-07-26 17:57:15.000000000 -0500
+++ 2.0.5/wp-includes/functions-formatting.php	2006-10-31 09:05:37.000000000 -0600
@@ -1,6 +1,7 @@
 <?php
 
 function wptexturize($text) {
+	global $wp_cockneyreplace;
 	$output = '';
 	// Capture tags and everything inside them
 	$textarr = preg_split("/(<.*>)/Us", $text, -1, PREG_SPLIT_DELIM_CAPTURE);
@@ -16,9 +17,15 @@
 			$curl = str_replace('...', '&#8230;', $curl);
 			$curl = str_replace('``', '&#8220;', $curl);
 
-			// This is a hack, look at this more later. It works pretty well though.
-			$cockney = array("'tain't","'twere","'twas","'tis","'twill","'til","'bout","'nuff","'round","'cause");
-			$cockneyreplace = array("&#8217;tain&#8217;t","&#8217;twere","&#8217;twas","&#8217;tis","&#8217;twill","&#8217;til","&#8217;bout","&#8217;nuff","&#8217;round","&#8217;cause");
+			// if a plugin has provided an autocorrect array, use it
+			if ( isset($wp_cockneyreplace) ) {
+				$cockney = array_keys($wp_cockneyreplace);
+				$cockney_replace = array_values($wp_cockneyreplace);
+			} else {
+				$cockney = array("'tain't","'twere","'twas","'tis","'twill","'til","'bout","'nuff","'round","'cause");
+				$cockneyreplace = array("&#8217;tain&#8217;t","&#8217;twere","&#8217;twas","&#8217;tis","&#8217;twill","&#8217;til","&#8217;bout","&#8217;nuff","&#8217;round","&#8217;cause");
+			}
+
 			$curl = str_replace($cockney, $cockneyreplace, $curl);
 
 			$curl = preg_replace("/'s/", '&#8217;s', $curl);
@@ -72,7 +79,7 @@
 	$pee = preg_replace('!(</?(?:table|thead|tfoot|caption|colgroup|tbody|tr|td|th|div|dl|dd|dt|ul|ol|li|pre|select|form|blockquote|address|math|p|h[1-6])[^>]*>)\s*</p>!', "$1", $pee); 
 	if ($br) $pee = preg_replace('|(?<!<br />)\s*\n|', "<br />\n", $pee); // optionally make line breaks
 	$pee = preg_replace('!(</?(?:table|thead|tfoot|caption|tbody|tr|td|th|div|dl|dd|dt|ul|ol|li|pre|select|form|blockquote|address|math|p|h[1-6])[^>]*>)\s*<br />!', "$1", $pee);
-	$pee = preg_replace('!<br />(\s*</?(?:p|li|div|dl|dd|dt|th|pre|td|ul|ol)>)!', '$1', $pee);
+	$pee = preg_replace('!<br />(\s*</?(?:p|li|div|dl|dd|dt|th|pre|td|ul|ol)[^>]*>)!', '$1', $pee);
 	$pee = preg_replace('!(<pre.*?>)(.*?)</pre>!ise', " stripslashes('$1') .  stripslashes(clean_pre('$2'))  . '</pre>' ", $pee);
 	
 	return $pee; 
@@ -245,8 +252,10 @@
 		chr(197).chr(188) => 'z', chr(197).chr(189) => 'Z',
 		chr(197).chr(190) => 'z', chr(197).chr(191) => 's',
 		// Euro Sign
-		chr(226).chr(130).chr(172) => 'E');
-		
+		chr(226).chr(130).chr(172) => 'E',
+		// GBP (Pound) Sign
+		chr(194).chr(163) => '');
+
 		$string = strtr($string, $chars);
 	} else {
 		// Assume ISO-8859-1 if not UTF-8
@@ -582,16 +591,24 @@
 
 function make_clickable($ret) {
 	$ret = ' ' . $ret;
-	$ret = preg_replace("#(^|[\n ])([\w]+?://[\w\#$%&~/.\-;:=,?@\[\]+]*)#is", "$1<a href='$2' rel='nofollow'>$2</a>", $ret);
-	$ret = preg_replace("#(^|[\n ])((www|ftp)\.[\w\#$%&~/.\-;:=,?@\[\]+]*)#is", "$1<a href='http://$2' rel='nofollow'>$2</a>", $ret);
-	$ret = preg_replace("#(\s)([a-z0-9\-_.]+)@([^,< \n\r]+)#i", "$1<a href=\"mailto:$2@$3\">$2@$3</a>", $ret);
-	$ret = substr($ret, 1);
+	// in testing, using arrays here was found to be faster
+	$ret = preg_replace(
+		array(
+			'#([\s>])([\w]+?://[\w\#$%&~/.\-;:=,?@\[\]+]*)#is',
+			'#([\s>])((www|ftp)\.[\w\#$%&~/.\-;:=,?@\[\]+]*)#is',
+			'#([\s>])([a-z0-9\-_.]+)@([^,< \n\r]+)#i'),
+		array(
+			'$1<a href="$2" rel="nofollow">$2</a>',
+			'$1<a href="http://$2" rel="nofollow">$2</a>',
+			'$1<a href="mailto:$2@$3">$2@$3</a>'),$ret);
+	// this one is not in an array because we need it to run last, for cleanup of accidental links within links
+	$ret = preg_replace("#(<a( [^>]+?>|>))<a [^>]+?>([^>]+?)</a></a>#i", "$1$3</a>", $ret);
 	$ret = trim($ret);
 	return $ret;
 }
 
 function wp_rel_nofollow( $text ) {
-	$text = preg_replace('|<a (.+?)>|i', '<a $1 rel="nofollow">', $text);
+	$text = preg_replace('|<a (.+?)>|ie', "'<a ' . str_replace(' rel=\"nofollow\"','',stripslashes('$1')) . ' rel=\"nofollow\">'", $text);
 	return $text;
 }
 
diff -ruN 2.0.4/wp-includes/functions-post.php 2.0.5/wp-includes/functions-post.php
--- 2.0.4/wp-includes/functions-post.php	2006-07-04 16:40:41.000000000 -0500
+++ 2.0.5/wp-includes/functions-post.php	2006-10-31 09:05:37.000000000 -0600
@@ -683,6 +683,7 @@
 
 function wp_proxy_check($ipnum) {
 	if ( get_option('open_proxy_check') && isset($ipnum) ) {
+		$ipnum = preg_replace( '/([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/', '$1', $ipnum );
 		$rev_ip = implode( '.', array_reverse( explode( '.', $ipnum ) ) );
 		$lookup = $rev_ip . '.sbl-xbl.spamhaus.org.';
 		if ( $lookup != gethostbyname( $lookup ) )
diff -ruN 2.0.4/wp-includes/functions.php 2.0.5/wp-includes/functions.php
--- 2.0.4/wp-includes/functions.php	2006-07-26 12:45:19.000000000 -0500
+++ 2.0.5/wp-includes/functions.php	2006-10-31 09:05:37.000000000 -0600
@@ -262,10 +262,38 @@
 
 
 function maybe_unserialize($original) {
-	if ( false !== $gm = @ unserialize($original) )
-		return $gm;
-	else
-		return $original;
+	if ( is_serialized($original) ) // don't attempt to unserialize data that wasn't serialized going in
+		if ( false !== $gm = @ unserialize($original) )
+			return $gm;
+	return $original;
+}
+
+function maybe_serialize($data) {
+	if ( is_string($data) )
+		$data = trim($data);
+	elseif ( is_array($data) || is_object($data) )
+		return serialize($data);
+	if ( is_serialized($data) )
+		return serialize($data);
+	return $data;
+}
+
+function is_serialized($data) {
+	if ( !is_string($data) ) // if it isn't a string, it isn't serialized
+		return false;
+	$data = trim($data);
+	if ( preg_match("/^[adobis]:[0-9]+:.*[;}]/si",$data) ) // this should fetch all legitimately serialized data
+		return true;
+	return false;
+}
+
+function is_serialized_string($data) {
+	if ( !is_string($data) ) // if it isn't a string, it isn't a serialized string
+		return false;
+	$data = trim($data);
+	if ( preg_match("/^s:[0-9]+:.*[;}]/si",$data) ) // this should fetch all serialized strings
+		return true;
+	return false;
 }
 
 /* Options functions */
@@ -321,7 +349,7 @@
 }
 
 function form_option($option) {
-	echo htmlspecialchars( get_option($option), ENT_QUOTES );
+	echo wp_specialchars( get_option($option), 1 );
 }
 
 function get_alloptions() {
@@ -365,8 +393,7 @@
 	}
 
 	$_newvalue = $newvalue;
-	if ( is_array($newvalue) || is_object($newvalue) )
-		$newvalue = serialize($newvalue);
+	$newvalue = maybe_serialize($newvalue);
 
 	wp_cache_set($option_name, $newvalue, 'options');
 
@@ -395,8 +422,7 @@
 	if ( false !== get_option($name) )
 		return;
 
-	if ( is_array($value) || is_object($value) )
-		$value = serialize($value);
+	$value = maybe_serialize($value);
 
 	wp_cache_set($name, $value, 'options');
 
@@ -421,20 +447,20 @@
 function add_post_meta($post_id, $key, $value, $unique = false) {
 	global $wpdb, $post_meta_cache;
 
+	$post_id = (int) $post_id;
+
 	if ( $unique ) {
-		if ( $wpdb->get_var("SELECT meta_key FROM $wpdb->postmeta WHERE meta_key
-= '$key' AND post_id = '$post_id'") ) {
+		if ( $wpdb->get_var("SELECT meta_key FROM $wpdb->postmeta WHERE meta_key = '$key' AND post_id = '$post_id'") ) {
 			return false;
 		}
 	}
 
-	$original = $value;
-	if ( is_array($value) || is_object($value) )
-		$value = $wpdb->escape(serialize($value));
+	$post_meta_cache[$post_id][$key][] = $value;
 
-	$wpdb->query("INSERT INTO $wpdb->postmeta (post_id,meta_key,meta_value) VALUES ('$post_id','$key','$value')");
+	$value = maybe_serialize($value);
+	$value = $wpdb->escape($value);
 
-	$post_meta_cache['$post_id'][$key][] = $original;
+	$wpdb->query("INSERT INTO $wpdb->postmeta (post_id,meta_key,meta_value) VALUES ('$post_id','$key','$value')");
 
 	return true;
 }
@@ -442,31 +468,29 @@
 function delete_post_meta($post_id, $key, $value = '') {
 	global $wpdb, $post_meta_cache;
 
+	$post_id = (int) $post_id;
+
 	if ( empty($value) ) {
-		$meta_id = $wpdb->get_var("SELECT meta_id FROM $wpdb->postmeta WHERE
-post_id = '$post_id' AND meta_key = '$key'");
+		$meta_id = $wpdb->get_var("SELECT meta_id FROM $wpdb->postmeta WHERE post_id = '$post_id' AND meta_key = '$key'");
 	} else {
-		$meta_id = $wpdb->get_var("SELECT meta_id FROM $wpdb->postmeta WHERE
-post_id = '$post_id' AND meta_key = '$key' AND meta_value = '$value'");
+		$meta_id = $wpdb->get_var("SELECT meta_id FROM $wpdb->postmeta WHERE post_id = '$post_id' AND meta_key = '$key' AND meta_value = '$value'");
 	}
 
 	if ( !$meta_id )
 		return false;
 
 	if ( empty($value) ) {
-		$wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = '$post_id'
-AND meta_key = '$key'");
-		unset($post_meta_cache['$post_id'][$key]);
-	} else {
-		$wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = '$post_id'
-AND meta_key = '$key' AND meta_value = '$value'");
-		$cache_key = $post_meta_cache['$post_id'][$key];
+		$wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = '$post_id' AND meta_key = '$key'");
+		unset($post_meta_cache[$post_id][$key]);
+	} else {
+		$wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = '$post_id' AND meta_key = '$key' AND meta_value = '$value'");
+		$cache_key = $post_meta_cache[$post_id][$key];
 		if ($cache_key) foreach ( $cache_key as $index => $data )
 			if ( $data == $value )
-				unset($post_meta_cache['$post_id'][$key][$index]);
+				unset($post_meta_cache[$post_id][$key][$index]);
 	}
 
-	unset($post_meta_cache['$post_id'][$key]);
+	unset($post_meta_cache[$post_id][$key]);
 
 	return true;
 }
@@ -474,6 +498,8 @@
 function get_post_meta($post_id, $key, $single = false) {
 	global $wpdb, $post_meta_cache;
 
+	$post_id = (int) $post_id;
+
 	if ( isset($post_meta_cache[$post_id][$key]) ) {
 		if ( $single ) {
 			return maybe_unserialize( $post_meta_cache[$post_id][$key][0] );
@@ -507,34 +533,33 @@
 function update_post_meta($post_id, $key, $value, $prev_value = '') {
 	global $wpdb, $post_meta_cache;
 
+	$post_id = (int) $post_id;
+
 	$original_value = $value;
-	if ( is_array($value) || is_object($value) )
-		$value = $wpdb->escape(serialize($value));
+	$value = maybe_serialize($value);
+	$value = $wpdb->escape($value);
 
 	$original_prev = $prev_value;
-	if ( is_array($prev_value) || is_object($prev_value) )
-		$prev_value = $wpdb->escape(serialize($prev_value));
+	$prev_value = maybe_serialize($prev_value);
+	$prev_value = $wpdb->escape($prev_value);
 
-	if (! $wpdb->get_var("SELECT meta_key FROM $wpdb->postmeta WHERE meta_key
-= '$key' AND post_id = '$post_id'") ) {
+	if (! $wpdb->get_var("SELECT meta_key FROM $wpdb->postmeta WHERE meta_key = '$key' AND post_id = '$post_id'") ) {
 		return false;
 	}
 
 	if ( empty($prev_value) ) {
-		$wpdb->query("UPDATE $wpdb->postmeta SET meta_value = '$value' WHERE
-meta_key = '$key' AND post_id = '$post_id'");
-		$cache_key = $post_meta_cache['$post_id'][$key];
+		$wpdb->query("UPDATE $wpdb->postmeta SET meta_value = '$value' WHERE meta_key = '$key' AND post_id = '$post_id'");
+		$cache_key = $post_meta_cache[$post_id][$key];
 		if ( !empty($cache_key) )
 			foreach ($cache_key as $index => $data)
-				$post_meta_cache['$post_id'][$key][$index] = $original_value;
+				$post_meta_cache[$post_id][$key][$index] = $original_value;
 	} else {
-		$wpdb->query("UPDATE $wpdb->postmeta SET meta_value = '$value' WHERE
-meta_key = '$key' AND post_id = '$post_id' AND meta_value = '$prev_value'");
-		$cache_key = $post_meta_cache['$post_id'][$key];
+		$wpdb->query("UPDATE $wpdb->postmeta SET meta_value = '$value' WHERE meta_key = '$key' AND post_id = '$post_id' AND meta_value = '$prev_value'");
+		$cache_key = $post_meta_cache[$post_id][$key];
 		if ( !empty($cache_key) )
 			foreach ($cache_key as $index => $data)
 				if ( $data == $original_prev )
-					$post_meta_cache['$post_id'][$key][$index] = $original_value;
+					$post_meta_cache[$post_id][$key][$index] = $original_value;
 	}
 
 	return true;
@@ -844,9 +869,10 @@
 	$mtime = $mtime[1] + $mtime[0];
 	$timeend = $mtime;
 	$timetotal = $timeend-$timestart;
+	$r = number_format($timetotal, $precision);
 	if ( $display )
-		echo number_format($timetotal,$precision);
-	return $timetotal;
+		echo $r;
+	return $r;
 }
 
 function weblog_ping($server = '', $path = '') {
@@ -1193,7 +1219,7 @@
 	}
 
 	if ( isset($wp_filter[$tag]) )
-		ksort( $wp_filter[$tag] );
+		uksort( $wp_filter[$tag], "strnatcasecmp" );
 }
 
 function apply_filters($tag, $string) {
@@ -1443,7 +1469,7 @@
 		// Change from flat structure to hierarchical:
 		$post_meta_cache = array();
 		foreach ($meta_list as $metarow) {
-			$mpid = $metarow['post_id'];
+			$mpid = (int) $metarow['post_id'];
 			$mkey = $metarow['meta_key'];
 			$mval = $metarow['meta_value'];
 
@@ -2085,6 +2111,11 @@
 			$uri = @func_get_arg(2);
 	}
 
+	if ( $frag = strstr($uri, '#') )
+		$uri = substr($uri, 0, -strlen($frag));
+	else
+		$frag = '';
+
 	if ( preg_match('|^https?://|i', $uri, $matches) ) {
 		$protocol = $matches[0];
 		$uri = substr($uri, strlen($protocol));
@@ -2124,7 +2155,7 @@
 			$ret .= "$k=$v";
 		}
 	}
-	$ret = $protocol . $base . $ret;
+	$ret = $protocol . $base . $ret . $frag;
 	return trim($ret, '?');
 }
 
@@ -2246,9 +2277,11 @@
 		return false;
 	$meta_key = preg_replace('|[^a-z0-9_]|i', '', $meta_key);
 
-	if ( is_array($meta_value) || is_object($meta_value) )
-		$meta_value = serialize($meta_value);
-	$meta_value = trim( $meta_value );
+	// FIXME: usermeta data is assumed to be already escaped
+	if ( is_string($meta_value) )
+		$meta_value = stripslashes($meta_value);
+	$meta_value = maybe_serialize($meta_value);
+	$meta_value = $wpdb->escape($meta_value);
 	
 	if (empty($meta_value)) {
 		delete_usermeta($user_id, $meta_key);
@@ -2413,7 +2446,7 @@
 		}
 	}
 
-	return __('Are you sure you want to do this');
+	return __('Are you sure you want to do this?');
 }
 
 function wp_nonce_ays($action) {
@@ -2503,4 +2536,4 @@
 	die();
 }
 
-?>
\ No newline at end of file
+?>
diff -ruN 2.0.4/wp-includes/pluggable-functions.php 2.0.5/wp-includes/pluggable-functions.php
--- 2.0.4/wp-includes/pluggable-functions.php	2006-07-27 02:11:46.000000000 -0500
+++ 2.0.5/wp-includes/pluggable-functions.php	2006-10-31 09:05:37.000000000 -0600
@@ -78,9 +78,7 @@
 
 	if ($metavalues) {
 		foreach ( $metavalues as $meta ) {
-			@ $value = unserialize($meta->meta_value);
-			if ($value === FALSE)
-				$value = $meta->meta_value;
+			$value = maybe_unserialize($meta->meta_value);
 			$user->{$meta->meta_key} = $value;
 
 			// We need to set user_level from meta, not row
@@ -131,9 +129,7 @@
 
 	if ($metavalues) {
 		foreach ( $metavalues as $meta ) {
-			@ $value = unserialize($meta->meta_value);
-			if ($value === FALSE)
-				$value = $meta->meta_value;
+			$value = maybe_unserialize($meta->meta_value);
 			$user->{$meta->meta_key} = $value;
 
 			// We need to set user_level from meta, not row
@@ -258,7 +254,7 @@
 // Cookie safe redirect.  Works around IIS Set-Cookie bug.
 // http://support.microsoft.com/kb/q176113/
 if ( !function_exists('wp_redirect') ) :
-function wp_redirect($location) {
+function wp_redirect($location, $status = 302) {
 	global $is_IIS;
 
 	$location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%]|i', '', $location);
@@ -266,10 +262,12 @@
 	$strip = array('%0d', '%0a');
 	$location = str_replace($strip, '', $location);
 
-	if ($is_IIS)
+	if ( $is_IIS ) {
 		header("Refresh: 0;url=$location");
-	else
+	} else {
+		status_header($status); // This causes problems on IIS
 		header("Location: $location");
+	}
 }
 endif;
 
@@ -335,7 +333,7 @@
 
 	if ('' == $user->user_email) return false; // If there's no email to send the comment to
 
-	$comment_author_domain = gethostbyaddr($comment->comment_author_IP);
+	$comment_author_domain = @gethostbyaddr($comment->comment_author_IP);
 
 	$blogname = get_settings('blogname');
 	
@@ -412,7 +410,7 @@
 	$comment = $wpdb->get_row("SELECT * FROM $wpdb->comments WHERE comment_ID='$comment_id' LIMIT 1");
 	$post = $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID='$comment->comment_post_ID' LIMIT 1");
 
-	$comment_author_domain = gethostbyaddr($comment->comment_author_IP);
+	$comment_author_domain = @gethostbyaddr($comment->comment_author_IP);
 	$comments_waiting = $wpdb->get_var("SELECT count(comment_ID) FROM $wpdb->comments WHERE comment_approved = '0'");
 
 	$notify_message  = sprintf( __('A new comment on the post #%1$s "%2$s" is waiting for your approval'), $post->ID, $post->post_title ) . "\r\n";
@@ -511,4 +509,4 @@
 }
 endif;
 
-?>
+?>
\ No newline at end of file
diff -ruN 2.0.4/wp-includes/template-functions-author.php 2.0.5/wp-includes/template-functions-author.php
--- 2.0.4/wp-includes/template-functions-author.php	2006-07-28 05:50:21.000000000 -0500
+++ 2.0.5/wp-includes/template-functions-author.php	2006-10-31 09:05:37.000000000 -0600
@@ -1,14 +1,15 @@
 <?php
 
-function get_the_author($idmode = '') {
+function get_the_author($deprecated = '') {
 	global $authordata;
 	return apply_filters('the_author', $authordata->display_name);
 }
 
-function the_author($idmode = '', $echo = true) {
-	if ( $echo )
-		echo get_the_author($idmode);
-	return get_the_author($idmode);
+// Using echo = false is deprecated.  Use get_the_author instead.
+function the_author($deprecated = '', $deprecated_echo = true) {
+	if ( $deprecated_echo )
+		echo get_the_author();
+	return get_the_author();
 }
 
 function get_the_author_description() {
@@ -127,10 +128,10 @@
 }
 
 /* the_author_posts_link() requires no get_, use get_author_link() */
-function the_author_posts_link($idmode='') {
+function the_author_posts_link($deprecated = '') {
 	global $authordata;
 
-	echo '<a href="' . get_author_link(0, $authordata->ID, $authordata->user_nicename) . '" title="' . sprintf(__("Posts by %s"), wp_specialchars(the_author($idmode, false))) . '">' . the_author($idmode, false) . '</a>';
+	echo '<a href="' . get_author_link(0, $authordata->ID, $authordata->user_nicename) . '" title="' . sprintf(__("Posts by %s"), wp_specialchars(get_the_author())) . '">' . get_the_author() . '</a>';
 }
 
 function get_author_link($echo = false, $author_id, $author_nicename = '') {
diff -ruN 2.0.4/wp-includes/template-functions-category.php 2.0.5/wp-includes/template-functions-category.php
--- 2.0.4/wp-includes/template-functions-category.php	2005-12-21 22:31:48.000000000 -0600
+++ 2.0.5/wp-includes/template-functions-category.php	2006-10-31 09:05:37.000000000 -0600
@@ -318,7 +318,7 @@
 	$num_found=0;
 	$thelist = "";
 
-	foreach ( $categories as $category ) {
+	foreach ( (array) $categories as $category ) {
 		if ( ( intval($hide_empty) == 0 || $category->category_count) && (!$hierarchical || $category->category_parent == $child_of) ) {
 			$num_found++;
 			$link = '<a href="'.get_category_link($category->cat_ID).'" ';
diff -ruN 2.0.4/wp-includes/template-functions-general.php 2.0.5/wp-includes/template-functions-general.php
--- 2.0.4/wp-includes/template-functions-general.php	2006-07-21 14:03:21.000000000 -0500
+++ 2.0.5/wp-includes/template-functions-general.php	2006-10-31 09:05:37.000000000 -0600
@@ -63,6 +63,8 @@
 		!strstr($show, 'home')) {
 		$info = apply_filters('bloginfo', $info, $show);
 		$info = convert_chars($info);
+	} else {
+		$info = apply_filters('bloginfo_url', $info, $show);
 	}
 
 	echo $info;
@@ -433,8 +435,8 @@
 		else
 				$thismonth = ''.zeroise(intval(substr($m, 4, 2)), 2);
 	} else {
-		$thisyear = gmdate('Y', current_time('timestamp') + get_settings('gmt_offset') * 3600);
-		$thismonth = gmdate('m', current_time('timestamp') + get_settings('gmt_offset') * 3600);
+		$thisyear = gmdate('Y', current_time('timestamp'));
+		$thismonth = gmdate('m', current_time('timestamp'));
 	}
 
 	$unixmonth = mktime(0, 0 , 0, $thismonth, 1, $thisyear);
diff -ruN 2.0.4/wp-includes/template-functions-post.php 2.0.5/wp-includes/template-functions-post.php
--- 2.0.4/wp-includes/template-functions-post.php	2006-01-25 01:38:43.000000000 -0600
+++ 2.0.5/wp-includes/template-functions-post.php	2006-10-31 09:05:37.000000000 -0600
@@ -77,6 +77,9 @@
 	else
 		$file = $pagenow; //$_SERVER['PHP_SELF'];
 
+	if ( $page > count($pages) ) // if the requested page doesn't exist
+		$page = count($pages); // give them the highest numbered page that DOES exist
+
 	$content = $pages[$page-1];
 	$content = explode('<!--more-->', $content, 2);
 	if ( (preg_match('/<!--noteaser-->/', $post->post_content) && ((!$multipage) || ($page==1))) )
@@ -197,6 +200,8 @@
 	if ( ! $post_id )
 		$post_id = $id;
 
+	$post_id = (int) $post_id;
+
 	if ( isset($post_meta_cache[$post_id]) )
 		return $post_meta_cache[$post_id];
 
@@ -204,7 +209,7 @@
 		// Change from flat structure to hierarchical:
 		$post_meta_cache = array();
 		foreach ( $meta_list as $metarow ) {
-			$mpid = $metarow['post_id'];
+			$mpid = (int) $metarow['post_id'];
 			$mkey = $metarow['meta_key'];
 			$mval = $metarow['meta_value'];
 
@@ -253,11 +258,14 @@
 
 // this will probably change at some point...
 function the_meta() {
-	global $id, $post_meta_cache;
+	global $id;
 
 	if ( $keys = get_post_custom_keys() ) {
 		echo "<ul class='post-meta'>\n";
 		foreach ( $keys as $key ) {
+			$keyt = trim($key);
+			if ( '_' == $keyt{0} )
+				continue;
 			$values = array_map('trim', get_post_custom_values($key));
 			$value = implode($values,', ');
 			echo "<li><span class='post-meta-key'>$key:</span> $value</li>\n";
@@ -410,13 +418,13 @@
 
 	foreach ( $page_tree[$parent]['children'] as $page_id ) {
 		$cur_page = $page_tree[$page_id];
-		$title = $cur_page['title'];
+		$title = wp_specialchars($cur_page['title']);
 
 		$css_class = 'page_item';
 		if ( $page_id == $queried_obj->ID )
 			$css_class .= ' current_page_item';
 
-		$output .= $indent . '<li class="' . $css_class . '"><a href="' . get_page_link($page_id) . '" title="' . wp_specialchars($title) . '">' . $title . '</a>';
+		$output .= $indent . '<li class="' . $css_class . '"><a href="' . get_page_link($page_id) . '" title="' . $title . '">' . $title . '</a>';
 
 		if ( isset($cur_page['ts']) ) {
 			$format = get_settings('date_format');
diff -ruN 2.0.4/wp-includes/version.php 2.0.5/wp-includes/version.php
--- 2.0.4/wp-includes/version.php	2006-07-28 18:38:34.000000000 -0500
+++ 2.0.5/wp-includes/version.php	2006-10-31 09:05:37.000000000 -0600
@@ -2,7 +2,7 @@
 
 // This just holds the version number, in a separate file so we can bump it without cluttering the SVN
 
-$wp_version = '2.0.4';
-$wp_db_version = 3440;
+$wp_version = '2.0.5';
+$wp_db_version = 3441;
 
 ?>
diff -ruN 2.0.4/wp-includes/wp-db.php 2.0.5/wp-includes/wp-db.php
--- 2.0.4/wp-includes/wp-db.php	2006-07-28 20:44:58.000000000 -0500
+++ 2.0.5/wp-includes/wp-db.php	2006-10-31 09:05:37.000000000 -0600
@@ -122,7 +122,7 @@
 	//	Kill cached query results
 
 	function flush() {
-		$this->last_result = null;
+		$this->last_result = array();
 		$this->col_info = null;
 		$this->last_query = null;
 	}
diff -ruN 2.0.4/wp-rss2.php 2.0.5/wp-rss2.php
--- 2.0.4/wp-rss2.php	2005-11-28 18:16:04.000000000 -0600
+++ 2.0.5/wp-rss2.php	2006-10-31 09:05:37.000000000 -0600
@@ -47,7 +47,7 @@
 		<content:encoded><![CDATA[<?php the_excerpt_rss() ?>]]></content:encoded>
 	<?php endif; ?>
 <?php endif; ?>
-		<wfw:commentRSS><?php echo comments_rss(); ?></wfw:commentRSS>
+		<wfw:commentRss><?php echo comments_rss(); ?></wfw:commentRss>
 <?php rss_enclosure(); ?>
 	<?php do_action('rss2_item'); ?>
 	</item>
diff -ruN 2.0.4/xmlrpc.php 2.0.5/xmlrpc.php
--- 2.0.4/xmlrpc.php	2006-07-26 17:56:56.000000000 -0500
+++ 2.0.5/xmlrpc.php	2006-10-31 09:05:37.000000000 -0600
@@ -58,31 +58,8 @@
 	return str_repeat('*', $i);
 }
 
-logIO("I", $HTTP_RAW_POST_DATA);
-
-
-function mkdir_p($target) {
-	// from php.net/mkdir user contributed notes 
-	if (file_exists($target)) {
-	  if (!is_dir($target)) {
-	    return false;
-	  } else {
-	    return true;
-	  }
-	}
-
-	// Attempting to create the directory may clutter up our display.
-	if (@mkdir($target)) {
-	  return true;
-	}
-
-	// If the above failed, attempt to create the parent node, then try again.
-	if (mkdir_p(dirname($target))) {
-	  return mkdir_p($target);
-	}
-
-	return false;
-}
+if ( isset($HTTP_RAW_POST_DATA) )
+  logIO("I", $HTTP_RAW_POST_DATA);
 
 
 class wp_xmlrpc_server extends IXR_Server {
@@ -157,7 +134,7 @@
 	function escape(&$array) {
 		global $wpdb;
 
-		foreach ($array as $k => $v) {
+		foreach ( (array) $array as $k => $v ) {
 			if (is_array($v)) {
 				$this->escape($array[$k]);
 			} else if (is_object($v)) {
