diff -crN phpbb2019/admin/admin_board.php phpbb2020/admin/admin_board.php
*** phpbb2019/admin/admin_board.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/admin/admin_board.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: admin_board.php,v 1.51.2.13 2005/12/29 11:51:11 acydburn Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: admin_board.php,v 1.51.2.15 2006/02/10 22:19:01 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 49,55 ****
  
  		if ($config_name == 'cookie_name')
  		{
! 			$cookie_name = str_replace('.', '_', $new['cookie_name']);
  		}
  
  		if( isset($HTTP_POST_VARS['submit']) )
--- 49,62 ----
  
  		if ($config_name == 'cookie_name')
  		{
! 			$new['cookie_name'] = str_replace('.', '_', $new['cookie_name']);
! 		}
! 
! 		// Attempt to prevent a common mistake with this value,
! 		// http:// is the protocol and not part of the server name
! 		if ($config_name == 'server_name')
! 		{
! 			$new['server_name'] = str_replace('http://', '', $new['server_name']);
  		}
  
  		if( isset($HTTP_POST_VARS['submit']) )
***************
*** 191,196 ****
--- 198,205 ----
  	"L_MAX_POLL_OPTIONS" => $lang['Max_poll_options'],
  	"L_FLOOD_INTERVAL" => $lang['Flood_Interval'],
  	"L_FLOOD_INTERVAL_EXPLAIN" => $lang['Flood_Interval_explain'], 
+ 	"L_SEARCH_FLOOD_INTERVAL" => $lang['Search_Flood_Interval'],
+ 	"L_SEARCH_FLOOD_INTERVAL_EXPLAIN" => $lang['Search_Flood_Interval_explain'], 
  
  	'L_MAX_LOGIN_ATTEMPTS'			=> $lang['Max_login_attempts'],
  	'L_MAX_LOGIN_ATTEMPTS_EXPLAIN'	=> $lang['Max_login_attempts_explain'],
***************
*** 276,281 ****
--- 285,291 ----
  	"BOARD_EMAIL_FORM_DISABLE" => $board_email_form_no, 
  	"MAX_POLL_OPTIONS" => $new['max_poll_options'], 
  	"FLOOD_INTERVAL" => $new['flood_interval'],
+ 	"SEARCH_FLOOD_INTERVAL" => $new['search_flood_interval'],
  	"TOPICS_PER_PAGE" => $new['topics_per_page'],
  	"POSTS_PER_PAGE" => $new['posts_per_page'],
  	"HOT_TOPIC" => $new['hot_threshold'],
diff -crN phpbb2019/admin/admin_db_utilities.php phpbb2020/admin/admin_db_utilities.php
*** phpbb2019/admin/admin_db_utilities.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/admin/admin_db_utilities.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
  *     copyright            : (C) 2001 The phpBB Group
  *     email                : support@phpbb.com
  *
! *     $Id: admin_db_utilities.php,v 1.42.2.12 2005/11/05 21:18:12 grahamje Exp $
  *
  ****************************************************************************/
  
--- 6,12 ----
  *     copyright            : (C) 2001 The phpBB Group
  *     email                : support@phpbb.com
  *
! *     $Id: admin_db_utilities.php,v 1.42.2.14 2006/02/10 20:35:40 grahamje Exp $
  *
  ****************************************************************************/
  
***************
*** 499,507 ****
  
  	while($row = $db->sql_fetchrow($result))
  	{
! 		unset($schema_vals);
! 		unset($schema_fields);
! 		unset($schema_insert);
  		//
  		// Build the SQL statement to recreate the data.
  		//
--- 499,507 ----
  
  	while($row = $db->sql_fetchrow($result))
  	{
! 		$schema_vals = '';
! 		$schema_fields = '';
! 		$schema_insert = '';
  		//
  		// Build the SQL statement to recreate the data.
  		//
***************
*** 516,522 ****
  			}
  			elseif (eregi("date|timestamp", $aryType[$i]))
  			{
! 				if ($empty($strVal))
  				{
  					$strQuote = "";
  				}
--- 516,522 ----
  			}
  			elseif (eregi("date|timestamp", $aryType[$i]))
  			{
! 				if (empty($strVal))
  				{
  					$strQuote = "";
  				}
diff -crN phpbb2019/admin/admin_forums.php phpbb2020/admin/admin_forums.php
*** phpbb2019/admin/admin_forums.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/admin/admin_forums.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: admin_forums.php,v 1.40.2.12 2005/05/07 22:18:10 acydburn Exp $
   *
   ***************************************************************************/
  
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: admin_forums.php,v 1.40.2.13 2006/03/09 21:55:09 grahamje Exp $
   *
   ***************************************************************************/
  
***************
*** 39,46 ****
  $forum_auth_ary = array(
  	"auth_view" => AUTH_ALL, 
  	"auth_read" => AUTH_ALL, 
! 	"auth_post" => AUTH_ALL, 
! 	"auth_reply" => AUTH_ALL, 
  	"auth_edit" => AUTH_REG, 
  	"auth_delete" => AUTH_REG, 
  	"auth_sticky" => AUTH_MOD, 
--- 39,46 ----
  $forum_auth_ary = array(
  	"auth_view" => AUTH_ALL, 
  	"auth_read" => AUTH_ALL, 
! 	"auth_post" => AUTH_REG, 
! 	"auth_reply" => AUTH_REG, 
  	"auth_edit" => AUTH_REG, 
  	"auth_delete" => AUTH_REG, 
  	"auth_sticky" => AUTH_MOD, 
diff -crN phpbb2019/admin/admin_groups.php phpbb2020/admin/admin_groups.php
*** phpbb2019/admin/admin_groups.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/admin/admin_groups.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: admin_groups.php,v 1.25.2.9 2004/03/25 15:57:20 acydburn Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: admin_groups.php,v 1.25.2.13 2006/03/09 19:42:41 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 104,124 ****
  	//
  	// Ok, now we know everything about them, let's show the page.
  	//
! 	$sql = "SELECT user_id, username
! 		FROM " . USERS_TABLE . "
! 		WHERE user_id <> " . ANONYMOUS . "
! 		ORDER BY username";
! 	if ( !($result = $db->sql_query($sql)) )
  	{
! 		message_die(GENERAL_ERROR, 'Could not obtain user info for moderator list', '', __LINE__, __FILE__, $sql);
! 	}
  
! 	while ( $row = $db->sql_fetchrow($result) )
! 	{
! 		if ( $row['user_id'] == $group_info['group_moderator'] ) 
  		{
! 			$group_moderator = $row['username'];
  		}
  	}
  
  	$group_open = ( $group_info['group_type'] == GROUP_OPEN ) ? ' checked="checked"' : '';
--- 104,129 ----
  	//
  	// Ok, now we know everything about them, let's show the page.
  	//
! 	if ($group_info['group_moderator'] != '')
  	{
! 		$sql = "SELECT user_id, username
! 			FROM " . USERS_TABLE . "
! 			WHERE user_id = " . $group_info['group_moderator'];
! 		if ( !($result = $db->sql_query($sql)) )
! 		{
! 			message_die(GENERAL_ERROR, 'Could not obtain user info for moderator list', '', __LINE__, __FILE__, $sql);
! 		}
  
! 		if ( !($row = $db->sql_fetchrow($result)) )
  		{
! 			message_die(GENERAL_ERROR, 'Could not obtain user info for moderator list', '', __LINE__, __FILE__, $sql);
  		}
+ 
+ 		$group_moderator = $row['username'];
+ 	}
+ 	else
+ 	{
+ 		$group_moderator = '';
  	}
  
  	$group_open = ( $group_info['group_type'] == GROUP_OPEN ) ? ' checked="checked"' : '';
***************
*** 250,256 ****
  	else
  	{
  		$group_type = isset($HTTP_POST_VARS['group_type']) ? intval($HTTP_POST_VARS['group_type']) : GROUP_OPEN;
! 		$group_name = isset($HTTP_POST_VARS['group_name']) ? trim($HTTP_POST_VARS['group_name']) : '';
  		$group_description = isset($HTTP_POST_VARS['group_description']) ? trim($HTTP_POST_VARS['group_description']) : '';
  		$group_moderator = isset($HTTP_POST_VARS['username']) ? $HTTP_POST_VARS['username'] : '';
  		$delete_old_moderator = isset($HTTP_POST_VARS['delete_old_moderator']) ? true : false;
--- 255,261 ----
  	else
  	{
  		$group_type = isset($HTTP_POST_VARS['group_type']) ? intval($HTTP_POST_VARS['group_type']) : GROUP_OPEN;
! 		$group_name = isset($HTTP_POST_VARS['group_name']) ? htmlspecialchars(trim($HTTP_POST_VARS['group_name'])) : '';
  		$group_description = isset($HTTP_POST_VARS['group_description']) ? trim($HTTP_POST_VARS['group_description']) : '';
  		$group_moderator = isset($HTTP_POST_VARS['username']) ? $HTTP_POST_VARS['username'] : '';
  		$delete_old_moderator = isset($HTTP_POST_VARS['delete_old_moderator']) ? true : false;
diff -crN phpbb2019/admin/admin_ranks.php phpbb2020/admin/admin_ranks.php
*** phpbb2019/admin/admin_ranks.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/admin/admin_ranks.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: admin_ranks.php,v 1.13.2.5 2005/12/18 13:57:50 grahamje Exp $
   *
   ***************************************************************************/
  
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: admin_ranks.php,v 1.13.2.7 2006/01/23 19:47:19 grahamje Exp $
   *
   ***************************************************************************/
  
***************
*** 19,26 ****
   *
   ***************************************************************************/
  
- define('IN_PHPBB', 1);
- 
  if( !empty($setmodules) )
  {
  	$file = basename(__FILE__);
--- 19,24 ----
***************
*** 28,33 ****
--- 26,33 ----
  	return;
  }
  
+ define('IN_PHPBB', 1);
+ 
  //
  // Let's set the root dir for phpBB
  //
***************
*** 37,43 ****
  
  if( isset($HTTP_GET_VARS['mode']) || isset($HTTP_POST_VARS['mode']) )
  {
! 	$mode = ($HTTP_GET_VARS['mode']) ? $HTTP_GET_VARS['mode'] : $HTTP_POST_VARS['mode'];
  	$mode = htmlspecialchars($mode);
  }
  else 
--- 37,43 ----
  
  if( isset($HTTP_GET_VARS['mode']) || isset($HTTP_POST_VARS['mode']) )
  {
! 	$mode = (isset($HTTP_GET_VARS['mode'])) ? $HTTP_GET_VARS['mode'] : $HTTP_POST_VARS['mode'];
  	$mode = htmlspecialchars($mode);
  }
  else 
***************
*** 59,64 ****
--- 59,66 ----
  	}
  }
  
+ // Restrict mode input to valid options
+ $mode = ( in_array($mode, array('add', 'edit', 'save', 'delete')) ) ? $mode : '';
  
  if( $mode != "" )
  {
***************
*** 213,220 ****
  		{
  			$rank_id = 0;
  		}
  		
! 		if( $rank_id )
  		{
  			$sql = "DELETE FROM " . RANKS_TABLE . "
  				WHERE rank_id = $rank_id";
--- 215,224 ----
  		{
  			$rank_id = 0;
  		}
+ 
+ 		$confirm = isset($HTTP_POST_VARS['confirm']);
  		
! 		if( $rank_id && $confirm )
  		{
  			$sql = "DELETE FROM " . RANKS_TABLE . "
  				WHERE rank_id = $rank_id";
***************
*** 238,372 ****
  			message_die(GENERAL_MESSAGE, $message);
  
  		}
! 		else
! 		{
! 			message_die(GENERAL_MESSAGE, $lang['Must_select_rank']);
! 		}
! 	}
! 	else
! 	{
! 		//
! 		// They didn't feel like giving us any information. Oh, too bad, we'll just display the
! 		// list then...
! 		//
! 		$template->set_filenames(array(
! 			"body" => "admin/ranks_list_body.tpl")
! 		);
! 		
! 		$sql = "SELECT * FROM " . RANKS_TABLE . "
! 			ORDER BY rank_min, rank_title";
! 		if( !$result = $db->sql_query($sql) )
! 		{
! 			message_die(GENERAL_ERROR, "Couldn't obtain ranks data", "", __LINE__, __FILE__, $sql);
! 		}
! 		
! 		$rank_rows = $db->sql_fetchrowset($result);
! 		$rank_count = count($rank_rows);
! 		
! 		$template->assign_vars(array(
! 			"L_RANKS_TITLE" => $lang['Ranks_title'],
! 			"L_RANKS_TEXT" => $lang['Ranks_explain'],
! 			"L_RANK" => $lang['Rank_title'],
! 			"L_RANK_MINIMUM" => $lang['Rank_minimum'],
! 			"L_SPECIAL_RANK" => $lang['Special_rank'],
! 			"L_EDIT" => $lang['Edit'],
! 			"L_DELETE" => $lang['Delete'],
! 			"L_ADD_RANK" => $lang['Add_new_rank'],
! 			"L_ACTION" => $lang['Action'],
! 			
! 			"S_RANKS_ACTION" => append_sid("admin_ranks.$phpEx"))
! 		);
! 		
! 		for( $i = 0; $i < $rank_count; $i++)
  		{
! 			$rank = $rank_rows[$i]['rank_title'];
! 			$special_rank = $rank_rows[$i]['rank_special'];
! 			$rank_id = $rank_rows[$i]['rank_id'];
! 			$rank_min = $rank_rows[$i]['rank_min'];
  
! 			if($special_rank)
! 			{
! 				$rank_min = $rank_max = "-";
! 			}
! 			
! 			$row_color = ( !($i % 2) ) ? $theme['td_color1'] : $theme['td_color2'];
! 			$row_class = ( !($i % 2) ) ? $theme['td_class1'] : $theme['td_class2'];
! 	
! 			$template->assign_block_vars("ranks", array(
! 				"ROW_COLOR" => "#" . $row_color,
! 				"ROW_CLASS" => $row_class,
! 				"RANK" => $rank,
! 				"RANK_MIN" => $rank_min,
  
! 				"SPECIAL_RANK" => ( $special_rank == 1 ) ? $lang['Yes'] : $lang['No'],
  
! 				"U_RANK_EDIT" => append_sid("admin_ranks.$phpEx?mode=edit&amp;id=$rank_id"),
! 				"U_RANK_DELETE" => append_sid("admin_ranks.$phpEx?mode=delete&amp;id=$rank_id"))
  			);
  		}
  	}
  }
! else
  {
! 	//
! 	// Show the default page
! 	//
! 	$template->set_filenames(array(
! 		"body" => "admin/ranks_list_body.tpl")
! 	);
! 	
! 	$sql = "SELECT * FROM " . RANKS_TABLE . "
! 		ORDER BY rank_min ASC, rank_special ASC";
! 	if( !$result = $db->sql_query($sql) )
! 	{
! 		message_die(GENERAL_ERROR, "Couldn't obtain ranks data", "", __LINE__, __FILE__, $sql);
! 	}
! 	$rank_count = $db->sql_numrows($result);
  
! 	$rank_rows = $db->sql_fetchrowset($result);
  	
! 	$template->assign_vars(array(
! 		"L_RANKS_TITLE" => $lang['Ranks_title'],
! 		"L_RANKS_TEXT" => $lang['Ranks_explain'],
! 		"L_RANK" => $lang['Rank_title'],
! 		"L_RANK_MINIMUM" => $lang['Rank_minimum'],
! 		"L_SPECIAL_RANK" => $lang['Rank_special'],
! 		"L_EDIT" => $lang['Edit'],
! 		"L_DELETE" => $lang['Delete'],
! 		"L_ADD_RANK" => $lang['Add_new_rank'],
! 		"L_ACTION" => $lang['Action'],
! 		
! 		"S_RANKS_ACTION" => append_sid("admin_ranks.$phpEx"))
! 	);
  	
! 	for($i = 0; $i < $rank_count; $i++)
  	{
! 		$rank = $rank_rows[$i]['rank_title'];
! 		$special_rank = $rank_rows[$i]['rank_special'];
! 		$rank_id = $rank_rows[$i]['rank_id'];
! 		$rank_min = $rank_rows[$i]['rank_min'];
! 		
! 		if( $special_rank == 1 )
! 		{
! 			$rank_min = $rank_max = "-";
! 		}
  
! 		$row_color = ( !($i % 2) ) ? $theme['td_color1'] : $theme['td_color2'];
! 		$row_class = ( !($i % 2) ) ? $theme['td_class1'] : $theme['td_class2'];
  
! 		$rank_is_special = ( $special_rank ) ? $lang['Yes'] : $lang['No'];
! 		
! 		$template->assign_block_vars("ranks", array(
! 			"ROW_COLOR" => "#" . $row_color,
! 			"ROW_CLASS" => $row_class,
! 			"RANK" => $rank,
! 			"SPECIAL_RANK" => $rank_is_special,
! 			"RANK_MIN" => $rank_min,
  
! 			"U_RANK_EDIT" => append_sid("admin_ranks.$phpEx?mode=edit&amp;id=$rank_id"),
! 			"U_RANK_DELETE" => append_sid("admin_ranks.$phpEx?mode=delete&amp;id=$rank_id"))
! 		);
! 	}
  }
  
  $template->pparse("body");
--- 242,336 ----
  			message_die(GENERAL_MESSAGE, $message);
  
  		}
! 		elseif( $rank_id && !$confirm)
  		{
! 			// Present the confirmation screen to the user
! 			$template->set_filenames(array(
! 				'body' => 'admin/confirm_body.tpl')
! 			);
  
! 			$hidden_fields = '<input type="hidden" name="mode" value="delete" /><input type="hidden" name="id" value="' . $rank_id . '" />';
  
! 			$template->assign_vars(array(
! 				'MESSAGE_TITLE' => $lang['Confirm'],
! 				'MESSAGE_TEXT' => $lang['Confirm_delete_rank'],
  
! 				'L_YES' => $lang['Yes'],
! 				'L_NO' => $lang['No'],
! 
! 				'S_CONFIRM_ACTION' => append_sid("admin_ranks.$phpEx"),
! 				'S_HIDDEN_FIELDS' => $hidden_fields)
  			);
  		}
+ 		else
+ 		{
+ 			message_die(GENERAL_MESSAGE, $lang['Must_select_rank']);
+ 		}
  	}
+ 
+ 	$template->pparse("body");
+ 
+ 	include('./page_footer_admin.'.$phpEx);
  }
! 
! //
! // Show the default page
! //
! $template->set_filenames(array(
! 	"body" => "admin/ranks_list_body.tpl")
! );
! 
! $sql = "SELECT * FROM " . RANKS_TABLE . "
! 	ORDER BY rank_min ASC, rank_special ASC";
! if( !$result = $db->sql_query($sql) )
  {
! 	message_die(GENERAL_ERROR, "Couldn't obtain ranks data", "", __LINE__, __FILE__, $sql);
! }
! $rank_count = $db->sql_numrows($result);
  
! $rank_rows = $db->sql_fetchrowset($result);
! 
! $template->assign_vars(array(
! 	"L_RANKS_TITLE" => $lang['Ranks_title'],
! 	"L_RANKS_TEXT" => $lang['Ranks_explain'],
! 	"L_RANK" => $lang['Rank_title'],
! 	"L_RANK_MINIMUM" => $lang['Rank_minimum'],
! 	"L_SPECIAL_RANK" => $lang['Rank_special'],
! 	"L_EDIT" => $lang['Edit'],
! 	"L_DELETE" => $lang['Delete'],
! 	"L_ADD_RANK" => $lang['Add_new_rank'],
! 	"L_ACTION" => $lang['Action'],
  	
! 	"S_RANKS_ACTION" => append_sid("admin_ranks.$phpEx"))
! );
! 
! for($i = 0; $i < $rank_count; $i++)
! {
! 	$rank = $rank_rows[$i]['rank_title'];
! 	$special_rank = $rank_rows[$i]['rank_special'];
! 	$rank_id = $rank_rows[$i]['rank_id'];
! 	$rank_min = $rank_rows[$i]['rank_min'];
  	
! 	if( $special_rank == 1 )
  	{
! 		$rank_min = $rank_max = "-";
! 	}
  
! 	$row_color = ( !($i % 2) ) ? $theme['td_color1'] : $theme['td_color2'];
! 	$row_class = ( !($i % 2) ) ? $theme['td_class1'] : $theme['td_class2'];
  
! 	$rank_is_special = ( $special_rank ) ? $lang['Yes'] : $lang['No'];
! 	
! 	$template->assign_block_vars("ranks", array(
! 		"ROW_COLOR" => "#" . $row_color,
! 		"ROW_CLASS" => $row_class,
! 		"RANK" => $rank,
! 		"SPECIAL_RANK" => $rank_is_special,
! 		"RANK_MIN" => $rank_min,
  
! 		"U_RANK_EDIT" => append_sid("admin_ranks.$phpEx?mode=edit&amp;id=$rank_id"),
! 		"U_RANK_DELETE" => append_sid("admin_ranks.$phpEx?mode=delete&amp;id=$rank_id"))
! 	);
  }
  
  $template->pparse("body");
diff -crN phpbb2019/admin/admin_smilies.php phpbb2020/admin/admin_smilies.php
*** phpbb2019/admin/admin_smilies.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/admin/admin_smilies.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
  *     copyright            : (C) 2001 The phpBB Group
  *     email                : support@phpbb.com
  *
! *     $Id: admin_smilies.php,v 1.22.2.16 2005/10/30 15:17:13 acydburn Exp $
  *
  ****************************************************************************/
  
--- 6,12 ----
  *     copyright            : (C) 2001 The phpBB Group
  *     email                : support@phpbb.com
  *
! *     $Id: admin_smilies.php,v 1.22.2.17 2006/01/28 12:46:53 grahamje Exp $
  *
  ****************************************************************************/
  
***************
*** 316,332 ****
  			$smiley_id = ( !empty($HTTP_POST_VARS['id']) ) ? $HTTP_POST_VARS['id'] : $HTTP_GET_VARS['id'];
  			$smiley_id = intval($smiley_id);
  
! 			$sql = "DELETE FROM " . SMILIES_TABLE . "
! 				WHERE smilies_id = " . $smiley_id;
! 			$result = $db->sql_query($sql);
! 			if( !$result )
  			{
! 				message_die(GENERAL_ERROR, "Couldn't delete smiley", "", __LINE__, __FILE__, $sql);
  			}
  
! 			$message = $lang['smiley_del_success'] . "<br /><br />" . sprintf($lang['Click_return_smileadmin'], "<a href=\"" . append_sid("admin_smilies.$phpEx") . "\">", "</a>") . "<br /><br />" . sprintf($lang['Click_return_admin_index'], "<a href=\"" . append_sid("index.$phpEx?pane=right") . "\">", "</a>");
  
! 			message_die(GENERAL_MESSAGE, $message);
  			break;
  
  		case 'edit':
--- 316,358 ----
  			$smiley_id = ( !empty($HTTP_POST_VARS['id']) ) ? $HTTP_POST_VARS['id'] : $HTTP_GET_VARS['id'];
  			$smiley_id = intval($smiley_id);
  
! 			$confirm = isset($HTTP_POST_VARS['confirm']);
! 
! 			if( $confirm )
  			{
! 				$sql = "DELETE FROM " . SMILIES_TABLE . "
! 					WHERE smilies_id = " . $smiley_id;
! 				$result = $db->sql_query($sql);
! 				if( !$result )
! 				{
! 					message_die(GENERAL_ERROR, "Couldn't delete smiley", "", __LINE__, __FILE__, $sql);
! 				}
! 
! 				$message = $lang['smiley_del_success'] . "<br /><br />" . sprintf($lang['Click_return_smileadmin'], "<a href=\"" . append_sid("admin_smilies.$phpEx") . "\">", "</a>") . "<br /><br />" . sprintf($lang['Click_return_admin_index'], "<a href=\"" . append_sid("index.$phpEx?pane=right") . "\">", "</a>");
! 
! 				message_die(GENERAL_MESSAGE, $message);
  			}
+ 			else
+ 			{
+ 				// Present the confirmation screen to the user
+ 				$template->set_filenames(array(
+ 					'body' => 'admin/confirm_body.tpl')
+ 				);
  
! 				$hidden_fields = '<input type="hidden" name="mode" value="delete" /><input type="hidden" name="id" value="' . $smiley_id . '" />';
  
! 				$template->assign_vars(array(
! 					'MESSAGE_TITLE' => $lang['Confirm'],
! 					'MESSAGE_TEXT' => $lang['Confirm_delete_smiley'],
! 
! 					'L_YES' => $lang['Yes'],
! 					'L_NO' => $lang['No'],
! 
! 					'S_CONFIRM_ACTION' => append_sid("admin_smilies.$phpEx"),
! 					'S_HIDDEN_FIELDS' => $hidden_fields)
! 				);
! 				$template->pparse('body');
! 			}
  			break;
  
  		case 'edit':
***************
*** 402,412 ****
  			// Get the submitted data, being careful to ensure that we only
  			// accept the data we are looking for.
  			//
! 			$smile_code = ( isset($HTTP_POST_VARS['smile_code']) ) ? trim($HTTP_POST_VARS['smile_code']) : trim($HTTP_GET_VARS['smile_code']);
! 			$smile_url = ( isset($HTTP_POST_VARS['smile_url']) ) ? trim($HTTP_POST_VARS['smile_url']) : trim($HTTP_GET_VARS['smile_url']);
  			$smile_url = phpbb_ltrim(basename($smile_url), "'");
! 			$smile_emotion = ( isset($HTTP_POST_VARS['smile_emotion']) ) ? trim($HTTP_POST_VARS['smile_emotion']) : trim($HTTP_GET_VARS['smile_emotion']);
! 			$smile_id = ( isset($HTTP_POST_VARS['smile_id']) ) ? intval($HTTP_POST_VARS['smile_id']) : intval($HTTP_GET_VARS['smile_id']);
  
  			// If no code was entered complain ...
  			if ($smile_code == '' || $smile_url == '')
--- 428,440 ----
  			// Get the submitted data, being careful to ensure that we only
  			// accept the data we are looking for.
  			//
! 			$smile_code = ( isset($HTTP_POST_VARS['smile_code']) ) ? trim($HTTP_POST_VARS['smile_code']) : '';
! 			$smile_url = ( isset($HTTP_POST_VARS['smile_url']) ) ? trim($HTTP_POST_VARS['smile_url']) : '';
  			$smile_url = phpbb_ltrim(basename($smile_url), "'");
! 			$smile_emotion = ( isset($HTTP_POST_VARS['smile_emotion']) ) ? htmlspecialchars(trim($HTTP_POST_VARS['smile_emotion'])) : '';
! 			$smile_id = ( isset($HTTP_POST_VARS['smile_id']) ) ? intval($HTTP_POST_VARS['smile_id']) : 0;
! 			$smile_code = trim($smile_code);
! 			$smile_url = trim($smile_url);
  
  			// If no code was entered complain ...
  			if ($smile_code == '' || $smile_url == '')
***************
*** 445,457 ****
  			// Get the submitted data being careful to ensure the the data
  			// we recieve and process is only the data we are looking for.
  			//
! 			$smile_code = ( isset($HTTP_POST_VARS['smile_code']) ) ? $HTTP_POST_VARS['smile_code'] : $HTTP_GET_VARS['smile_code'];
! 			$smile_url = ( isset($HTTP_POST_VARS['smile_url']) ) ? $HTTP_POST_VARS['smile_url'] : $HTTP_GET_VARS['smile_url'];
  			$smile_url = phpbb_ltrim(basename($smile_url), "'");
! 			$smile_emotion = ( isset($HTTP_POST_VARS['smile_emotion']) ) ? $HTTP_POST_VARS['smile_emotion'] : $HTTP_GET_VARS['smile_emotion'];
  			$smile_code = trim($smile_code);
  			$smile_url = trim($smile_url);
- 			$smile_emotion = trim($smile_emotion);
  
  			// If no code was entered complain ...
  			if ($smile_code == '' || $smile_url == '')
--- 473,484 ----
  			// Get the submitted data being careful to ensure the the data
  			// we recieve and process is only the data we are looking for.
  			//
! 			$smile_code = ( isset($HTTP_POST_VARS['smile_code']) ) ? $HTTP_POST_VARS['smile_code'] : '';
! 			$smile_url = ( isset($HTTP_POST_VARS['smile_url']) ) ? $HTTP_POST_VARS['smile_url'] : '';
  			$smile_url = phpbb_ltrim(basename($smile_url), "'");
! 			$smile_emotion = ( isset($HTTP_POST_VARS['smile_emotion']) ) ? htmlspecialchars(trim($HTTP_POST_VARS['smile_emotion'])) : '';
  			$smile_code = trim($smile_code);
  			$smile_url = trim($smile_url);
  
  			// If no code was entered complain ...
  			if ($smile_code == '' || $smile_url == '')
diff -crN phpbb2019/admin/admin_users.php phpbb2020/admin/admin_users.php
*** phpbb2019/admin/admin_users.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/admin/admin_users.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: admin_users.php,v 1.57.2.31 2005/12/20 20:42:28 grahamje Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: admin_users.php,v 1.57.2.35 2006/03/26 14:43:24 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 261,270 ****
  		$allowbbcode = ( isset( $HTTP_POST_VARS['allowbbcode']) ) ? intval( $HTTP_POST_VARS['allowbbcode'] ) : $board_config['allow_bbcode'];
  		$allowsmilies = ( isset( $HTTP_POST_VARS['allowsmilies']) ) ? intval( $HTTP_POST_VARS['allowsmilies'] ) : $board_config['allow_smilies'];
  
! 		$user_style = ( $HTTP_POST_VARS['style'] ) ? intval( $HTTP_POST_VARS['style'] ) : $board_config['default_style'];
  		$user_lang = ( $HTTP_POST_VARS['language'] ) ? $HTTP_POST_VARS['language'] : $board_config['default_lang'];
  		$user_timezone = ( isset( $HTTP_POST_VARS['timezone']) ) ? doubleval( $HTTP_POST_VARS['timezone'] ) : $board_config['board_timezone'];
- 		$user_template = ( $HTTP_POST_VARS['template'] ) ? $HTTP_POST_VARS['template'] : $board_config['board_template'];
  		$user_dateformat = ( $HTTP_POST_VARS['dateformat'] ) ? trim( $HTTP_POST_VARS['dateformat'] ) : $board_config['default_dateformat'];
  
  		$user_avatar_local = ( isset( $HTTP_POST_VARS['avatarselect'] ) && !empty($HTTP_POST_VARS['submitavatar'] ) && $board_config['allow_avatar_local'] ) ? $HTTP_POST_VARS['avatarselect'] : ( ( isset( $HTTP_POST_VARS['avatarlocal'] )  ) ? $HTTP_POST_VARS['avatarlocal'] : '' );
--- 261,269 ----
  		$allowbbcode = ( isset( $HTTP_POST_VARS['allowbbcode']) ) ? intval( $HTTP_POST_VARS['allowbbcode'] ) : $board_config['allow_bbcode'];
  		$allowsmilies = ( isset( $HTTP_POST_VARS['allowsmilies']) ) ? intval( $HTTP_POST_VARS['allowsmilies'] ) : $board_config['allow_smilies'];
  
! 		$user_style = ( isset( $HTTP_POST_VARS['style'] ) ) ? intval( $HTTP_POST_VARS['style'] ) : $board_config['default_style'];
  		$user_lang = ( $HTTP_POST_VARS['language'] ) ? $HTTP_POST_VARS['language'] : $board_config['default_lang'];
  		$user_timezone = ( isset( $HTTP_POST_VARS['timezone']) ) ? doubleval( $HTTP_POST_VARS['timezone'] ) : $board_config['board_timezone'];
  		$user_dateformat = ( $HTTP_POST_VARS['dateformat'] ) ? trim( $HTTP_POST_VARS['dateformat'] ) : $board_config['default_dateformat'];
  
  		$user_avatar_local = ( isset( $HTTP_POST_VARS['avatarselect'] ) && !empty($HTTP_POST_VARS['submitavatar'] ) && $board_config['allow_avatar_local'] ) ? $HTTP_POST_VARS['avatarselect'] : ( ( isset( $HTTP_POST_VARS['avatarlocal'] )  ) ? $HTTP_POST_VARS['avatarlocal'] : '' );
***************
*** 696,708 ****
  						message_die(GENERAL_ERROR, 'Error removing user session', '', __LINE__, __FILE__, $sql);
  					}
  				}
  				
  				$message .= $lang['Admin_user_updated'];
  			}
  			else
  			{
! 				$error = TRUE;
! 				$error_msg .= ( ( isset($error_msg) ) ? '<br />' : '' ) . $lang['Admin_user_fail'];
  			}
  
  			$message .= '<br /><br />' . sprintf($lang['Click_return_useradmin'], '<a href="' . append_sid("admin_users.$phpEx") . '">', '</a>') . '<br /><br />' . sprintf($lang['Click_return_admin_index'], '<a href="' . append_sid("index.$phpEx?pane=right") . '">', '</a>');
--- 695,713 ----
  						message_die(GENERAL_ERROR, 'Error removing user session', '', __LINE__, __FILE__, $sql);
  					}
  				}
+ 
+ 				// We remove all stored login keys since the password has been updated
+ 				// and change the current one (if applicable)
+ 				if ( !empty($passwd_sql) )
+ 				{
+ 					session_reset_keys($user_id, $user_ip);
+ 				}
  				
  				$message .= $lang['Admin_user_updated'];
  			}
  			else
  			{
! 				message_die(GENERAL_ERROR, 'Admin_user_fail', '', __LINE__, __FILE__, $sql);
  			}
  
  			$message .= '<br /><br />' . sprintf($lang['Click_return_useradmin'], '<a href="' . append_sid("admin_users.$phpEx") . '">', '</a>') . '<br /><br />' . sprintf($lang['Click_return_admin_index'], '<a href="' . append_sid("index.$phpEx?pane=right") . '">', '</a>');
diff -crN phpbb2019/admin/admin_words.php phpbb2020/admin/admin_words.php
*** phpbb2019/admin/admin_words.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/admin/admin_words.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: admin_words.php,v 1.10.2.4 2005/12/18 13:57:51 grahamje Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: admin_words.php,v 1.10.2.5 2006/01/23 21:24:40 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 20,27 ****
   *
   ***************************************************************************/
  
- define('IN_PHPBB', 1);
- 
  if( !empty($setmodules) )
  {
  	$file = basename(__FILE__);
--- 20,25 ----
***************
*** 29,34 ****
--- 27,34 ----
  	return;
  }
  
+ define('IN_PHPBB', 1);
+ 
  //
  // Load default header
  //
***************
*** 38,44 ****
  
  if( isset($HTTP_GET_VARS['mode']) || isset($HTTP_POST_VARS['mode']) )
  {
! 	$mode = ($HTTP_GET_VARS['mode']) ? $HTTP_GET_VARS['mode'] : $HTTP_POST_VARS['mode'];
  	$mode = htmlspecialchars($mode);
  }
  else 
--- 38,44 ----
  
  if( isset($HTTP_GET_VARS['mode']) || isset($HTTP_POST_VARS['mode']) )
  {
! 	$mode = (isset($HTTP_GET_VARS['mode'])) ? $HTTP_GET_VARS['mode'] : $HTTP_POST_VARS['mode'];
  	$mode = htmlspecialchars($mode);
  }
  else 
***************
*** 60,65 ****
--- 60,68 ----
  	}
  }
  
+ // Restrict mode input to valid options
+ $mode = ( in_array($mode, array('add', 'edit', 'save', 'delete')) ) ? $mode : '';
+ 
  if( $mode != "" )
  {
  	if( $mode == "edit" || $mode == "add" )
***************
*** 70,75 ****
--- 73,79 ----
  			"body" => "admin/words_edit_body.tpl")
  		);
  
+ 		$word_info = array('word' => '', 'replacement' => '');
  		$s_hidden_fields = '';
  
  		if( $mode == "edit" )
***************
*** 158,164 ****
  			$word_id = 0;
  		}
  
! 		if( $word_id )
  		{
  			$sql = "DELETE FROM " . WORDS_TABLE . " 
  				WHERE word_id = $word_id";
--- 162,170 ----
  			$word_id = 0;
  		}
  
! 		$confirm = isset($HTTP_POST_VARS['confirm']);
! 
! 		if( $word_id && $confirm )
  		{
  			$sql = "DELETE FROM " . WORDS_TABLE . " 
  				WHERE word_id = $word_id";
***************
*** 172,177 ****
--- 178,203 ----
  
  			message_die(GENERAL_MESSAGE, $message);
  		}
+ 		elseif( $word_id && !$confirm)
+ 		{
+ 			// Present the confirmation screen to the user
+ 			$template->set_filenames(array(
+ 				'body' => 'admin/confirm_body.tpl')
+ 			);
+ 
+ 			$hidden_fields = '<input type="hidden" name="mode" value="delete" /><input type="hidden" name="id" value="' . $word_id . '" />';
+ 
+ 			$template->assign_vars(array(
+ 				'MESSAGE_TITLE' => $lang['Confirm'],
+ 				'MESSAGE_TEXT' => $lang['Confirm_delete_word'],
+ 
+ 				'L_YES' => $lang['Yes'],
+ 				'L_NO' => $lang['No'],
+ 
+ 				'S_CONFIRM_ACTION' => append_sid("admin_words.$phpEx"),
+ 				'S_HIDDEN_FIELDS' => $hidden_fields)
+ 			);
+ 		}
  		else
  		{
  			message_die(GENERAL_MESSAGE, $lang['No_word_selected']);
***************
*** 193,198 ****
--- 219,225 ----
  	}
  
  	$word_rows = $db->sql_fetchrowset($result);
+ 	$db->sql_freeresult($result);
  	$word_count = count($word_rows);
  
  	$template->assign_vars(array(
diff -crN phpbb2019/admin/page_header_admin.php phpbb2020/admin/page_header_admin.php
*** phpbb2019/admin/page_header_admin.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/admin/page_header_admin.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: page_header_admin.php,v 1.12.2.6 2005/03/26 14:15:59 acydburn Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: page_header_admin.php,v 1.12.2.7 2006/01/29 21:19:02 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 132,137 ****
--- 132,149 ----
  	'T_SPAN_CLASS3' => $theme['span_class3'])
  );
  
+ // Work around for "current" Apache 2 + PHP module which seems to not
+ // cope with private cache control setting
+ if (!empty($HTTP_SERVER_VARS['SERVER_SOFTWARE']) && strstr($HTTP_SERVER_VARS['SERVER_SOFTWARE'], 'Apache/2'))
+ {
+ 	header ('Cache-Control: no-cache, pre-check=0, post-check=0');
+ }
+ else
+ {
+ 	header ('Cache-Control: private, pre-check=0, post-check=0, max-age=0');
+ }
+ header ('Expires: 0');
+ header ('Pragma: no-cache');
  
  $template->pparse('header');
  
diff -crN phpbb2019/admin/pagestart.php phpbb2020/admin/pagestart.php
*** phpbb2019/admin/pagestart.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/admin/pagestart.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: pagestart.php,v 1.1.2.9 2005/06/26 14:39:30 acydburn Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: pagestart.php,v 1.1.2.10 2006/01/22 17:11:09 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 49,61 ****
  
  if ($HTTP_GET_VARS['sid'] != $userdata['session_id'])
  {
- 	$url = str_replace(preg_replace('#^\/?(.*?)\/?$#', '\1', trim($board_config['server_name'])), '', $HTTP_SERVER_VARS['REQUEST_URI']);
- 	$url = str_replace(preg_replace('#^\/?(.*?)\/?$#', '\1', trim($board_config['script_path'])), '', $url);
- 	$url = str_replace('//', '/', $url);
- 	$url = preg_replace('/sid=([^&]*)(&?)/i', '', $url);
- 	$url = preg_replace('/\?$/', '', $url);
- 	$url .= ((strpos($url, '?')) ? '&' : '?') . 'sid=' . $userdata['session_id'];
- 
  	redirect("index.$phpEx?sid=" . $userdata['session_id']);
  }
  
--- 49,54 ----
diff -crN phpbb2019/common.php phpbb2020/common.php
*** phpbb2019/common.php	Fri Dec 30 11:38:19 2005
--- phpbb2020/common.php	Wed Apr  5 18:53:37 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: common.php,v 1.74.2.22 2005/12/30 09:51:01 acydburn Exp $
   *
   ***************************************************************************/
  
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: common.php,v 1.74.2.23 2006/02/26 17:34:50 grahamje Exp $
   *
   ***************************************************************************/
  
***************
*** 170,175 ****
--- 170,176 ----
  $images = array();
  $lang = array();
  $nav_links = array();
+ $dss_seeded = false;
  $gen_simple_header = FALSE;
  
  include($phpbb_root_path . 'config.'.$phpEx);
diff -crN phpbb2019/db/mssql.php phpbb2020/db/mssql.php
*** phpbb2019/db/mssql.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/db/mssql.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : supportphpbb.com
   *
!  *   $Id: mssql.php,v 1.22.2.2 2002/12/21 18:31:53 psotfx Exp $
   *
   ***************************************************************************/
  
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : supportphpbb.com
   *
!  *   $Id: mssql.php,v 1.22.2.4 2006/03/09 19:57:37 grahamje Exp $
   *
   ***************************************************************************/
  
***************
*** 289,295 ****
  
  			while( list($key, $value) = @each($row) )
  			{
! 				$row[$key] = stripslashes($value);
  			}
  			@reset($row);
  
--- 289,295 ----
  
  			while( list($key, $value) = @each($row) )
  			{
! 				$row[$key] = ($value === ' ') ? '' : stripslashes($value);
  			}
  			@reset($row);
  
***************
*** 317,323 ****
  			{
  				while( list($key, $value) = @each($row) )
  				{
! 					$rowset[$i][$key] = stripslashes($value);
  				}
  				$i++;
  			}
--- 317,323 ----
  			{
  				while( list($key, $value) = @each($row) )
  				{
! 					$rowset[$i][$key] = ($value === ' ') ? '' : stripslashes($value);
  				}
  				$i++;
  			}
***************
*** 356,362 ****
  				if( empty($this->row[$query_id]) )
  				{
  					$this->row[$query_id] = @mssql_fetch_array($query_id);
! 					$result = stripslashes($this->row[$query_id][$field]);
  				}
  			}
  
--- 356,362 ----
  				if( empty($this->row[$query_id]) )
  				{
  					$this->row[$query_id] = @mssql_fetch_array($query_id);
! 					$result = ($this->row[$query_id][$field] === ' ') ? '' : stripslashes($this->row[$query_id][$field]);
  				}
  			}
  
diff -crN phpbb2019/includes/auth.php phpbb2020/includes/auth.php
*** phpbb2019/includes/auth.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/includes/auth.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group        
   *   email                : support@phpbb.com                           
   *                                                          
!  *   $Id: auth.php,v 1.37.2.5 2004/03/01 16:49:03 psotfx Exp $                                                           
   *                                                            
   * 
   ***************************************************************************/ 
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group        
   *   email                : support@phpbb.com                           
   *                                                          
!  *   $Id: auth.php,v 1.37.2.7 2006/03/06 17:28:51 grahamje Exp $                                                           
   *                                                            
   * 
   ***************************************************************************/ 
***************
*** 234,239 ****
--- 234,240 ----
  			{
  				$value = $f_access[$k][$key];
  				$f_forum_id = $f_access[$k]['forum_id'];
+ 				$u_access[$f_forum_id] = isset($u_access[$f_forum_id]) ? $u_access[$f_forum_id] : array();
  
  				switch( $value )
  				{
***************
*** 282,287 ****
--- 283,289 ----
  		for($k = 0; $k < count($f_access); $k++)
  		{
  			$f_forum_id = $f_access[$k]['forum_id'];
+ 			$u_access[$f_forum_id] = isset($u_access[$f_forum_id]) ? $u_access[$f_forum_id] : array();
  
  			$auth_user[$f_forum_id]['auth_mod'] = ( $userdata['session_logged_in'] ) ? auth_check_user(AUTH_MOD, 'auth_mod', $u_access[$f_forum_id], $is_admin) : 0;
  		}
diff -crN phpbb2019/includes/bbcode.php phpbb2020/includes/bbcode.php
*** phpbb2019/includes/bbcode.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/includes/bbcode.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: bbcode.php,v 1.36.2.39 2005/12/29 15:12:20 acydburn Exp $
   *
   ***************************************************************************/
  
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: bbcode.php,v 1.36.2.41 2006/02/26 17:34:50 grahamje Exp $
   *
   ***************************************************************************/
  
***************
*** 196,210 ****
  
  	// [img]image_url_here[/img] code..
  	// This one gets first-passed..
! 	$patterns[] = "#\[img:$uid\]([^?].*?)\[/img:$uid\]#i";
  	$replacements[] = $bbcode_tpl['img'];
  
  	// matches a [url]xxxx://www.phpbb.com[/url] code..
! 	$patterns[] = "#\[url\]([\w]+?://([\w\#$%&~/.\-;:=,?@\]+]|\[(?!url=))*?)\[/url\]#is";
  	$replacements[] = $bbcode_tpl['url1'];
  
  	// [url]www.phpbb.com[/url] code.. (no xxxx:// prefix).
! 	$patterns[] = "#\[url\]((www|ftp)\.([\w\#$%&~/.\-;:=,?@\]+]|\[(?!url=))*?)\[/url\]#is";
  	$replacements[] = $bbcode_tpl['url2'];
  
  	// [url=xxxx://www.phpbb.com]phpBB[/url] code..
--- 196,210 ----
  
  	// [img]image_url_here[/img] code..
  	// This one gets first-passed..
! 	$patterns[] = "#\[img:$uid\]([^?](?:[^\[]+|\[(?!url))*?)\[/img:$uid\]#i";
  	$replacements[] = $bbcode_tpl['img'];
  
  	// matches a [url]xxxx://www.phpbb.com[/url] code..
! 	$patterns[] = "#\[url\]([\w]+?://([\w\#$%&~/.\-;:=,?@\]+]+|\[(?!url=))*?)\[/url\]#is";
  	$replacements[] = $bbcode_tpl['url1'];
  
  	// [url]www.phpbb.com[/url] code.. (no xxxx:// prefix).
! 	$patterns[] = "#\[url\]((www|ftp)\.([\w\#$%&~/.\-;:=,?@\]+]+|\[(?!url=))*?)\[/url\]#is";
  	$replacements[] = $bbcode_tpl['url2'];
  
  	// [url=xxxx://www.phpbb.com]phpBB[/url] code..
***************
*** 235,241 ****
  {
  	// Unique ID for this message..
  
! 	$uid = md5(mt_rand());
  	$uid = substr($uid, 0, BBCODE_UID_LEN);
  
  	return $uid;
--- 235,241 ----
  {
  	// Unique ID for this message..
  
! 	$uid = dss_rand();
  	$uid = substr($uid, 0, BBCODE_UID_LEN);
  
  	return $uid;
diff -crN phpbb2019/includes/functions.php phpbb2020/includes/functions.php
*** phpbb2019/includes/functions.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/includes/functions.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: functions.php,v 1.133.2.38 2005/12/19 18:01:36 acydburn Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: functions.php,v 1.133.2.44 2006/02/26 19:37:50 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 139,144 ****
--- 139,175 ----
  	return $str;
  }
  
+ /**
+ * Our own generator of random values
+ * This uses a constantly changing value as the base for generating the values
+ * The board wide setting is updated once per page if this code is called
+ * With thanks to Anthrax101 for the inspiration on this one
+ * Added in phpBB 2.0.20
+ */
+ function dss_rand()
+ {
+ 	global $db, $board_config, $dss_seeded;
+ 
+ 	$val = $board_config['rand_seed'] . microtime();
+ 	$val = md5($val);
+ 	$board_config['rand_seed'] = md5($board_config['rand_seed'] . $val . 'a');
+    
+ 	if($dss_seeded !== true)
+ 	{
+ 		$sql = "UPDATE " . CONFIG_TABLE . " SET
+ 			config_value = '" . $board_config['rand_seed'] . "'
+ 			WHERE config_name = 'rand_seed'";
+ 		
+ 		if( !$db->sql_query($sql) )
+ 		{
+ 			message_die(GENERAL_ERROR, "Unable to reseed PRNG", "", __LINE__, __FILE__, $sql);
+ 		}
+ 
+ 		$dss_seeded = true;
+ 	}
+ 
+ 	return substr($val, 16);
+ }
  //
  // Get Userdata, $user can be username or user_id. If force_str is true, the username will be forced.
  //
***************
*** 372,378 ****
  
  	if ( !($row = $db->sql_fetchrow($result)) )
  	{
! 		message_die(CRITICAL_ERROR, "Could not get theme data for themes_id [$style]");
  	}
  
  	$template_path = 'templates/' ;
--- 403,442 ----
  
  	if ( !($row = $db->sql_fetchrow($result)) )
  	{
! 		// We are trying to setup a style which does not exist in the database
! 		// Try to fallback to the board default (if the user had a custom style)
! 		// and then any users using this style to the default if it succeeds
! 		if ( $style != $board_config['default_style'])
! 		{
! 			$sql = 'SELECT *
! 				FROM ' . THEMES_TABLE . '
! 				WHERE themes_id = ' . $board_config['default_style'];
! 			if ( !($result = $db->sql_query($sql)) )
! 			{
! 				message_die(CRITICAL_ERROR, 'Could not query database for theme info');
! 			}
! 
! 			if ( $row = $db->sql_fetchrow($result) )
! 			{
! 				$db->sql_freeresult($result);
! 
! 				$sql = 'UPDATE ' . USERS_TABLE . '
! 					SET user_style = ' . $board_config['default_style'] . "
! 					WHERE user_style = $style";
! 				if ( !($result = $db->sql_query($sql)) )
! 				{
! 					message_die(CRITICAL_ERROR, 'Could not update user theme info');
! 				}
! 			}
! 			else
! 			{
! 				message_die(CRITICAL_ERROR, "Could not get theme data for themes_id [$style]");
! 			}
! 		}
! 		else
! 		{
! 			message_die(CRITICAL_ERROR, "Could not get theme data for themes_id [$style]");
! 		}
  	}
  
  	$template_path = 'templates/' ;
***************
*** 634,640 ****
  
  		if ( $err_line != '' && $err_file != '' )
  		{
! 			$debug_text .= '</br /><br />Line : ' . $err_line . '<br />File : ' . basename($err_file);
  		}
  	}
  
--- 698,704 ----
  
  		if ( $err_line != '' && $err_file != '' )
  		{
! 			$debug_text .= '<br /><br />Line : ' . $err_line . '<br />File : ' . basename($err_file);
  		}
  	}
  
***************
*** 661,671 ****
  			}
  		}
  
! 		if ( empty($template) )
! 		{
! 			$template = new Template($phpbb_root_path . 'templates/' . $board_config['board_template']);
! 		}
! 		if ( empty($theme) )
  		{
  			$theme = setup_style($board_config['default_style']);
  		}
--- 725,731 ----
  			}
  		}
  
! 		if ( empty($template) || empty($theme) )
  		{
  			$theme = setup_style($board_config['default_style']);
  		}
diff -crN phpbb2019/includes/functions_post.php phpbb2020/includes/functions_post.php
*** phpbb2019/includes/functions_post.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/includes/functions_post.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: functions_post.php,v 1.9.2.40 2005/12/22 11:34:02 acydburn Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: functions_post.php,v 1.9.2.49 2006/03/14 20:40:32 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 46,102 ****
  
  	if ($html_on)
  	{
! 		$allowed_html_tags = split(',', $board_config['allow_html_tags']);
  
! 		$end_html = 0;
! 		$start_html = 1;
! 		$tmp_message = '';
! 		$message = ' ' . $message . ' ';
  
! 		while ($start_html = strpos($message, '<', $start_html))
! 		{
! 			$tmp_message .= preg_replace($html_entities_match, $html_entities_replace, substr($message, $end_html + 1, ($start_html - $end_html - 1)));
! 
! 			if ($end_html = strpos($message, '>', $start_html))
! 			{
! 				$length = $end_html - $start_html + 1;
! 				$hold_string = substr($message, $start_html, $length);
  
! 				if (($unclosed_open = strrpos(' ' . $hold_string, '<')) != 1)
! 				{
! 					$tmp_message .= preg_replace($html_entities_match, $html_entities_replace, substr($hold_string, 0, $unclosed_open - 1));
! 					$hold_string = substr($hold_string, $unclosed_open - 1);
! 				}
! 
! 				$tagallowed = false;
! 				for ($i = 0; $i < sizeof($allowed_html_tags); $i++)
! 				{
! 					$match_tag = trim($allowed_html_tags[$i]);
! 					if (preg_match('#^<\/?' . $match_tag . '[> ]#i', $hold_string))
! 					{
! 						$tagallowed = (preg_match('#^<\/?' . $match_tag . ' .*?(style[\t ]*?=|on[\w]+[\t ]*?=)#i', $hold_string)) ? false : true;
! 					}
! 				}
! 
! 				$tmp_message .= ($length && !$tagallowed) ? preg_replace($html_entities_match, $html_entities_replace, $hold_string) : $hold_string;
! 
! 				$start_html += $length;
! 			}
! 			else
! 			{
! 				$tmp_message .= preg_replace($html_entities_match, $html_entities_replace, substr($message, $start_html, strlen($message)));
! 
! 				$start_html = strlen($message);
! 				$end_html = $start_html;
! 			}
! 		}
! 
! 		if (!$end_html || ($end_html != strlen($message) && $tmp_message != ''))
  		{
! 			$tmp_message .= preg_replace($html_entities_match, $html_entities_replace, substr($message, $end_html + 1));
  		}
  
! 		$message = ($tmp_message != '') ? trim($tmp_message) : trim($message);
  	}
  	else
  	{
--- 46,70 ----
  
  	if ($html_on)
  	{
! 		// If HTML is on, we try to make it safe
! 		// This approach is quite agressive and anything that does not look like a valid tag
! 		// is going to get converted to HTML entities
! 		$message = stripslashes($message);
! 		$html_match = '#<[^\w<]*(\w+)((?:"[^"]*"|\'[^\']*\'|[^<>\'"])+)?>#';
! 		$matches = array();
  
! 		$message_split = preg_split($html_match, $message);
! 		preg_match_all($html_match, $message, $matches);
  
! 		$message = '';
  
! 		foreach ($message_split as $part)
  		{
! 			$tag = array(array_shift($matches[0]), array_shift($matches[1]), array_shift($matches[2]));
! 			$message .= htmlspecialchars($part) . clean_html($tag);
  		}
  
! 		$message = addslashes($message);
  	}
  	else
  	{
***************
*** 187,193 ****
  				$option_text = trim($option_text);
  				if (!empty($option_text))
  				{
! 					$temp_option_text[$option_id] = htmlspecialchars($option_text);
  				}
  			}
  			$option_text = $temp_option_text;
--- 155,161 ----
  				$option_text = trim($option_text);
  				if (!empty($option_text))
  				{
! 					$temp_option_text[intval($option_id)] = htmlspecialchars($option_text);
  				}
  			}
  			$option_text = $temp_option_text;
***************
*** 850,853 ****
--- 818,883 ----
  	}
  }
  
+ /**
+ * Called from within prepare_message to clean included HTML tags if HTML is
+ * turned on for that post
+ * @param array $tag Matching text from the message to parse
+ */
+ function clean_html($tag)
+ {
+ 	global $board_config;
+ 
+ 	if (empty($tag[0]))
+ 	{
+ 		return '';
+ 	}
+ 
+ 	$allowed_html_tags = preg_split('/, */', strtolower($board_config['allow_html_tags']));
+ 	$disallowed_attributes = '/^(?:style|on)/i';
+ 
+ 	// Check if this is an end tag
+ 	preg_match('/<[^\w\/]*\/[\W]*(\w+)/', $tag[0], $matches);
+ 	if (sizeof($matches))
+ 	{
+ 		if (in_array(strtolower($matches[1]), $allowed_html_tags))
+ 		{
+ 			return  '</' . $matches[1] . '>';
+ 		}
+ 		else
+ 		{
+ 			return  htmlspecialchars('</' . $matches[1] . '>');
+ 		}
+ 	}
+ 
+ 	// Check if this is an allowed tag
+ 	if (in_array(strtolower($tag[1]), $allowed_html_tags))
+ 	{
+ 		$attributes = '';
+ 		if (!empty($tag[2]))
+ 		{
+ 			preg_match_all('/[\W]*?(\w+)[\W]*?=[\W]*?(["\'])((?:(?!\2).)*)\2/', $tag[2], $test);
+ 			for ($i = 0; $i < sizeof($test[0]); $i++)
+ 			{
+ 				if (preg_match($disallowed_attributes, $test[1][$i]))
+ 				{
+ 					continue;
+ 				}
+ 				$attributes .= ' ' . $test[1][$i] . '=' . $test[2][$i] . str_replace(array('[', ']'), array('&#91;', '&#93;'), htmlspecialchars($test[3][$i])) . $test[2][$i];
+ 			}
+ 		}
+ 		if (in_array(strtolower($tag[1]), $allowed_html_tags))
+ 		{
+ 			return '<' . $tag[1] . $attributes . '>';
+ 		}
+ 		else
+ 		{
+ 			return htmlspecialchars('<' . $tag[1] . $attributes . '>');
+ 		}
+ 	}
+ 	// Finally, this is not an allowed tag so strip all the attibutes and escape it
+ 	else
+ 	{
+ 		return htmlspecialchars('<' .   $tag[1] . '>');
+ 	}
+ }
  ?>
\ No newline at end of file
diff -crN phpbb2019/includes/prune.php phpbb2020/includes/prune.php
*** phpbb2019/includes/prune.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/includes/prune.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
  *   copyright            : (C) 2001 The phpBB Group
  *   email                : support@phpbb.com
  *
! *   $Id: prune.php,v 1.19.2.6 2003/03/18 23:23:57 acydburn Exp $
  *
  *
  ***************************************************************************/
--- 6,12 ----
  *   copyright            : (C) 2001 The phpBB Group
  *   email                : support@phpbb.com
  *
! *   $Id: prune.php,v 1.19.2.7 2006/01/29 17:31:16 grahamje Exp $
  *
  *
  ***************************************************************************/
***************
*** 31,36 ****
--- 31,51 ----
  {
  	global $db, $lang;
  
+ 	// Before pruning, lets try to clean up the invalid topic entries
+ 	$sql = 'SELECT topic_id FROM ' . TOPICS_TABLE . '
+ 		WHERE topic_last_post_id = 0';
+ 	if ( !($result = $db->sql_query($sql)) )
+ 	{
+ 		message_die(GENERAL_ERROR, 'Could not obtain lists of topics to sync', '', __LINE__, __FILE__, $sql);
+ 	}
+ 
+ 	while( $row = $db->sql_fetchrow($result) )
+ 	{
+ 		sync('topic', $row['topic_id']);
+ 	}
+ 
+ 	$db->sql_freeresult($result);
+ 
  	$prune_all = ($prune_all) ? '' : 'AND t.topic_vote = 0 AND t.topic_type <> ' . POST_ANNOUNCE;
  	//
  	// Those without polls and announcements ... unless told otherwise!
***************
*** 39,46 ****
  		FROM " . POSTS_TABLE . " p, " . TOPICS_TABLE . " t
  		WHERE t.forum_id = $forum_id
  			$prune_all 
! 			AND ( p.post_id = t.topic_last_post_id 
! 				OR t.topic_last_post_id = 0 )";
  	if ( $prune_date != '' )
  	{
  		$sql .= " AND p.post_time < $prune_date";
--- 54,60 ----
  		FROM " . POSTS_TABLE . " p, " . TOPICS_TABLE . " t
  		WHERE t.forum_id = $forum_id
  			$prune_all 
! 			AND p.post_id = t.topic_last_post_id";
  	if ( $prune_date != '' )
  	{
  		$sql .= " AND p.post_time < $prune_date";
diff -crN phpbb2019/includes/sessions.php phpbb2020/includes/sessions.php
*** phpbb2019/includes/sessions.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/includes/sessions.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: sessions.php,v 1.58.2.16 2005/10/30 15:17:14 acydburn Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: sessions.php,v 1.58.2.23 2006/04/05 12:42:23 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 177,185 ****
  			AND session_ip = '$user_ip'";
  	if ( !$db->sql_query($sql) || !$db->sql_affectedrows() )
  	{
! 		list($sec, $usec) = explode(' ', microtime());
! 		mt_srand((float) $sec + ((float) $usec * 100000));
! 		$session_id = md5(uniqid(mt_rand(), true));
  
  		$sql = "INSERT INTO " . SESSIONS_TABLE . "
  			(session_id, session_user_id, session_start, session_time, session_ip, session_page, session_logged_in, session_admin)
--- 177,183 ----
  			AND session_ip = '$user_ip'";
  	if ( !$db->sql_query($sql) || !$db->sql_affectedrows() )
  	{
! 		$session_id = md5(dss_rand());
  
  		$sql = "INSERT INTO " . SESSIONS_TABLE . "
  			(session_id, session_user_id, session_start, session_time, session_ip, session_page, session_logged_in, session_admin)
***************
*** 212,220 ****
  		//
  		if ($enable_autologin)
  		{
! 			list($sec, $usec) = explode(' ', microtime());
! 			mt_srand(hexdec(substr($session_id, 0, 8)) + (float) $sec + ((float) $usec * 1000000));
! 			$auto_login_key = uniqid(mt_rand(), true);
  			
  			if (isset($sessiondata['autologinid']) && (string) $sessiondata['autologinid'] != '')
  			{
--- 210,216 ----
  		//
  		if ($enable_autologin)
  		{
! 			$auto_login_key = dss_rand() . dss_rand();
  			
  			if (isset($sessiondata['autologinid']) && (string) $sessiondata['autologinid'] != '')
  			{
***************
*** 496,501 ****
--- 492,556 ----
  	return true;
  }
  
+ /**
+ * Reset all login keys for the specified user
+ * Called on password changes
+ */
+ function session_reset_keys($user_id, $user_ip)
+ {
+ 	global $db, $userdata;
+ 
+ 	$key_sql = ($user_id == $userdata['user_id'] && !empty($userdata['session_key'])) ? "AND key_id != '" . md5($userdata['session_key']) . "'" : '';
+ 
+ 	$sql = 'DELETE FROM ' . SESSIONS_KEYS_TABLE . '
+ 		WHERE user_id = ' . (int) $user_id . "
+ 			$key_sql";
+ 
+ 	if ( !$db->sql_query($sql) )
+ 	{
+ 		message_die(CRITICAL_ERROR, 'Error removing auto-login keys', '', __LINE__, __FILE__, $sql);
+ 	}
+ 
+ 	$where_sql = 'session_user_id = ' . (int) $user_id;
+ 	$where_sql .= ($user_id == $userdata['user_id']) ? " AND session_id <> '" . $userdata['session_id'] . "'" : '';
+ 	$sql = 'DELETE FROM ' . SESSIONS_TABLE . "
+ 		WHERE $where_sql";
+ 	if ( !$db->sql_query($sql) )
+ 	{
+ 		message_die(CRITICAL_ERROR, 'Error removing user session(s)', '', __LINE__, __FILE__, $sql);
+ 	}
+ 
+ 	if ( !empty($key_sql) )
+ 	{
+ 		$auto_login_key = dss_rand() . dss_rand();
+ 
+ 		$current_time = time();
+ 		
+ 		$sql = 'UPDATE ' . SESSIONS_KEYS_TABLE . "
+ 			SET last_ip = '$user_ip', key_id = '" . md5($auto_login_key) . "', last_login = $current_time
+ 			WHERE key_id = '" . md5($userdata['session_key']) . "'";
+ 		
+ 		if ( !$db->sql_query($sql) )
+ 		{
+ 			message_die(CRITICAL_ERROR, 'Error updating session key', '', __LINE__, __FILE__, $sql);
+ 		}
+ 
+ 		// And now rebuild the cookie
+ 		$sessiondata['userid'] = $user_id;
+ 		$sessiondata['autologinid'] = $autologin_id;
+ 		$cookiename = $board_config['cookie_name'];
+ 		$cookiepath = $board_config['cookie_path'];
+ 		$cookiedomain = $board_config['cookie_domain'];
+ 		$cookiesecure = $board_config['cookie_secure'];
+ 
+ 		setcookie($cookiename . '_data', serialize($sessiondata), $current_time + 31536000, $cookiepath, $cookiedomain, $cookiesecure);
+ 		
+ 		$userdata['session_key'] = $auto_login_key;
+ 		unset($sessiondata);
+ 		unset($auto_login_key);
+ 	}
+ }
+ 
  //
  // Append $SID to a url. Borrowed from phplib and modified. This is an
  // extra routine utilised by the session code above and acts as a wrapper
diff -crN phpbb2019/includes/usercp_avatar.php phpbb2020/includes/usercp_avatar.php
*** phpbb2019/includes/usercp_avatar.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/includes/usercp_avatar.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: usercp_avatar.php,v 1.8.2.22 2005/10/30 15:17:14 acydburn Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: usercp_avatar.php,v 1.8.2.23 2006/01/27 21:23:22 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 100,105 ****
--- 100,107 ----
  		$avatar_filename = 'http://' . $avatar_filename;
  	}
  
+ 	$avatar_filename = substr($avatar_filename, 0, 100);
+ 
  	if ( !preg_match("#^((ht|f)tp://)([^ \?&=\#\"\n\r\t<]*?(\.(jpg|jpeg|gif|png))$)#is", $avatar_filename) )
  	{
  		$error = true;
diff -crN phpbb2019/includes/usercp_confirm.php phpbb2020/includes/usercp_confirm.php
*** phpbb2019/includes/usercp_confirm.php	Fri Dec 30 11:38:18 2005
--- phpbb2020/includes/usercp_confirm.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: usercp_confirm.php,v 1.1.2.2 2005/12/29 11:51:11 acydburn Exp $
   *
   ***************************************************************************/
  
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: usercp_confirm.php,v 1.1.2.3 2006/03/25 14:22:43 grahamje Exp $
   *
   ***************************************************************************/
  
***************
*** 155,161 ****
  {
  	$_png = define_raw_pngs();
  
! 	$char = substr($code, -1);
  	header('Content-Type: image/png');
  	header('Cache-control: no-cache, no-store');
  	echo base64_decode($_png[$char]);
--- 155,163 ----
  {
  	$_png = define_raw_pngs();
  
! 	$c = intval($HTTP_GET_VARS['c']);
! 	$char = substr($code, $c - 1, 1);
! 	
  	header('Content-Type: image/png');
  	header('Cache-control: no-cache, no-store');
  	echo base64_decode($_png[$char]);
diff -crN phpbb2019/includes/usercp_register.php phpbb2020/includes/usercp_register.php
*** phpbb2019/includes/usercp_register.php	Fri Dec 30 11:38:19 2005
--- phpbb2020/includes/usercp_register.php	Wed Apr  5 18:53:36 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: usercp_register.php,v 1.20.2.70 2005/12/29 11:51:11 acydburn Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: usercp_register.php,v 1.20.2.74 2006/04/05 12:42:23 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 132,138 ****
  		}
  	}
  
! 	$signature = str_replace('<br />', "\n", $signature);
  
  	// Run some validation on the optional fields. These are pass-by-ref, so they'll be changed to
  	// empty strings if they fail.
--- 132,139 ----
  		}
  	}
  
! 	$signature = (isset($signature)) ? str_replace('<br />', "\n", $signature) : '';
! 	$signature_bbcode_uid = '';
  
  	// Run some validation on the optional fields. These are pass-by-ref, so they'll be changed to
  	// empty strings if they fail.
***************
*** 296,307 ****
  
  			if ($row = $db->sql_fetchrow($result))
  			{
- 				// Only compare one char if the zlib-extension is not loaded
- 				if (!@extension_loaded('zlib'))
- 				{
- 					$row['code'] = substr($row['code'], -1);
- 				}
- 
  				if ($row['code'] != $confirm_code)
  				{
  					$error = TRUE;
--- 297,302 ----
***************
*** 527,532 ****
--- 522,534 ----
  				message_die(GENERAL_ERROR, 'Could not update users table', '', __LINE__, __FILE__, $sql);
  			}
  
+ 			// We remove all stored login keys since the password has been updated
+ 			// and change the current one (if applicable)
+ 			if ( !empty($passwd_sql) )
+ 			{
+ 				session_reset_keys($user_id, $user_ip);
+ 			}
+ 
  			if ( !$user_active )
  			{
  				//
***************
*** 769,774 ****
--- 771,777 ----
  	//
  	$username = stripslashes($username);
  	$email = stripslashes($email);
+ 	$cur_password = '';
  	$new_password = '';
  	$password_confirm = '';
  
***************
*** 793,798 ****
--- 796,802 ----
  	$user_id = $userdata['user_id'];
  	$username = $userdata['username'];
  	$email = $userdata['user_email'];
+ 	$cur_password = '';
  	$new_password = '';
  	$password_confirm = '';
  
***************
*** 984,1000 ****
  		}
  		$db->sql_freeresult($result);
  		
! 		$confirm_chars = array('A', 'B', 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J',  'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', 'S', 'T',  'U', 'V', 'W', 'X', 'Y', 'Z', '1', '2', '3', '4', '5', '6', '7', '8', '9');
! 
! 		list($usec, $sec) = explode(' ', microtime()); 
! 		mt_srand($sec * $usec); 
! 
! 		$max_chars = count($confirm_chars) - 1;
! 		$code = '';
! 		for ($i = 0; $i < 6; $i++)
! 		{
! 			$code .= $confirm_chars[mt_rand(0, $max_chars)];
! 		}
  
  		$confirm_id = md5(uniqid($user_ip));
  
--- 988,997 ----
  		}
  		$db->sql_freeresult($result);
  		
! 		// Generate the required confirmation code
! 		// NB 0 (zero) could get confused with O (the letter) so we make change it
! 		$code = dss_rand();
! 		$code = strtoupper(str_replace('0', 'o', substr($code, 6)));
  
  		$confirm_id = md5(uniqid($user_ip));
  
***************
*** 1022,1032 ****
  	$form_enctype = ( @$ini_val('file_uploads') == '0' || strtolower(@$ini_val('file_uploads') == 'off') || phpversion() == '4.0.4pl1' || !$board_config['allow_avatar_upload'] || ( phpversion() < '4.0.3' && @$ini_val('open_basedir') != '' ) ) ? '' : 'enctype="multipart/form-data"';
  
  	$template->assign_vars(array(
! 		'USERNAME' => $username,
! 		'CUR_PASSWORD' => $cur_password,
! 		'NEW_PASSWORD' => $new_password,
! 		'PASSWORD_CONFIRM' => $password_confirm,
! 		'EMAIL' => $email,
  		'CONFIRM_IMG' => $confirm_image, 
  		'YIM' => $yim,
  		'ICQ' => $icq,
--- 1019,1029 ----
  	$form_enctype = ( @$ini_val('file_uploads') == '0' || strtolower(@$ini_val('file_uploads') == 'off') || phpversion() == '4.0.4pl1' || !$board_config['allow_avatar_upload'] || ( phpversion() < '4.0.3' && @$ini_val('open_basedir') != '' ) ) ? '' : 'enctype="multipart/form-data"';
  
  	$template->assign_vars(array(
! 		'USERNAME' => isset($username) ? $username : '',
! 		'CUR_PASSWORD' => isset($cur_password) ? $cur_password : '',
! 		'NEW_PASSWORD' => isset($new_password) ? $new_password : '',
! 		'PASSWORD_CONFIRM' => isset($password_confirm) ? $password_confirm : '',
! 		'EMAIL' => isset($email) ? $email : '',
  		'CONFIRM_IMG' => $confirm_image, 
  		'YIM' => $yim,
  		'ICQ' => $icq,
diff -crN phpbb2019/index.php phpbb2020/index.php
*** phpbb2019/index.php	Fri Dec 30 11:38:20 2005
--- phpbb2020/index.php	Wed Apr  5 18:53:37 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: index.php,v 1.99.2.6 2005/10/30 15:17:13 acydburn Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: index.php,v 1.99.2.7 2006/01/28 11:13:39 acydburn Exp $
   *
   *
   ***************************************************************************/
***************
*** 119,125 ****
  }
  
  $category_rows = array();
! while( $category_rows[] = $db->sql_fetchrow($result) );
  $db->sql_freeresult($result);
  
  if( ( $total_categories = count($category_rows) ) )
--- 119,128 ----
  }
  
  $category_rows = array();
! while ($row = $db->sql_fetchrow($result))
! {
! 	$category_rows[] = $row;
! }
  $db->sql_freeresult($result);
  
  if( ( $total_categories = count($category_rows) ) )
***************
*** 300,305 ****
--- 303,321 ----
  	);
  
  	//
+ 	// Let's decide which categories we should display
+ 	//
+ 	$display_categories = array();
+ 
+ 	for ($i = 0; $i < $total_forums; $i++ )
+ 	{
+ 		if ($is_auth_ary[$forum_data[$i]['forum_id']]['auth_view'])
+ 		{
+ 			$display_categories[$forum_data[$i]['cat_id']] = true;
+ 		}
+ 	}
+ 
+ 	//
  	// Okay, let's build the index
  	//
  	for($i = 0; $i < $total_categories; $i++)
***************
*** 307,328 ****
  		$cat_id = $category_rows[$i]['cat_id'];
  
  		//
- 		// Should we display this category/forum set?
- 		//
- 		$display_forums = false;
- 		for($j = 0; $j < $total_forums; $j++)
- 		{
- 			if ( $is_auth_ary[$forum_data[$j]['forum_id']]['auth_view'] && $forum_data[$j]['cat_id'] == $cat_id )
- 			{
- 				$display_forums = true;
- 			}
- 		}
- 
- 		//
  		// Yes, we should, so first dump out the category
  		// title, then, if appropriate the forum list
  		//
! 		if ( $display_forums )
  		{
  			$template->assign_block_vars('catrow', array(
  				'CAT_ID' => $cat_id,
--- 323,332 ----
  		$cat_id = $category_rows[$i]['cat_id'];
  
  		//
  		// Yes, we should, so first dump out the category
  		// title, then, if appropriate the forum list
  		//
! 		if (isset($display_categories[$cat_id]) && $display_categories[$cat_id])
  		{
  			$template->assign_block_vars('catrow', array(
  				'CAT_ID' => $cat_id,
diff -crN phpbb2019/language/lang_english/email/group_request.tpl phpbb2020/language/lang_english/email/group_request.tpl
*** phpbb2019/language/lang_english/email/group_request.tpl	Fri Dec 30 11:38:19 2005
--- phpbb2020/language/lang_english/email/group_request.tpl	Wed Apr  5 18:53:37 2006
***************
*** 3,9 ****
  
  Dear {GROUP_MODERATOR},
  
! A user has requested to join a group you moderator on {SITENAME}.
  To approve or deny this request for group membership please visit the following link:
  
  {U_GROUPCP}
--- 3,9 ----
  
  Dear {GROUP_MODERATOR},
  
! A user has requested to join a group you moderate on {SITENAME}.
  To approve or deny this request for group membership please visit the following link:
  
  {U_GROUPCP}
diff -crN phpbb2019/language/lang_english/email/user_activate_passwd.tpl phpbb2020/language/lang_english/email/user_activate_passwd.tpl
*** phpbb2019/language/lang_english/email/user_activate_passwd.tpl	Fri Dec 30 11:38:19 2005
--- phpbb2020/language/lang_english/email/user_activate_passwd.tpl	Wed Apr  5 18:53:37 2006
***************
*** 9,15 ****
  
  {U_ACTIVATE}
  
! If sucessful you will be able to login using the following password:
  
  Password: {PASSWORD}
  
--- 9,15 ----
  
  {U_ACTIVATE}
  
! If successful you will be able to login using the following password:
  
  Password: {PASSWORD}
  
diff -crN phpbb2019/language/lang_english/lang_admin.php phpbb2020/language/lang_english/lang_admin.php
*** phpbb2019/language/lang_english/lang_admin.php	Fri Dec 30 11:38:19 2005
--- phpbb2020/language/lang_english/lang_admin.php	Wed Apr  5 18:53:37 2006
***************
*** 7,13 ****
   *     copyright            : (C) 2001 The phpBB Group
   *     email                : support@phpbb.com
   *
!  *     $Id: lang_admin.php,v 1.35.2.13 2005/12/29 11:51:12 acydburn Exp $
   *
   ****************************************************************************/
  
--- 7,13 ----
   *     copyright            : (C) 2001 The phpBB Group
   *     email                : support@phpbb.com
   *
!  *     $Id: lang_admin.php,v 1.35.2.17 2006/02/05 15:59:48 grahamje Exp $
   *
   ****************************************************************************/
  
***************
*** 341,346 ****
--- 341,350 ----
  $lang['Autologin_time'] = 'Automatic login key expiry';
  $lang['Autologin_time_explain'] = 'How long a autologin key is valid for in days if the user does not visit the board. Set to zero to disable expiry.';
  
+ // Search Flood Control - added 2.0.20
+ $lang['Search_Flood_Interval'] = 'Search Flood Interval';
+ $lang['Search_Flood_Interval_explain'] = 'Number of seconds a user must wait between search requests'; 
+ 
  //
  // Forum Management
  //
***************
*** 425,430 ****
--- 429,435 ----
  $lang['smiley_del_success'] = 'The Smiley was successfully removed';
  $lang['Click_return_smileadmin'] = 'Click %sHere%s to return to Smiley Administration';
  
+ $lang['Confirm_delete_smiley'] = 'Are you sure you want to delete this Smiley?';
  
  //
  // User Management
***************
*** 518,523 ****
--- 523,530 ----
  
  $lang['Click_return_wordadmin'] = 'Click %sHere%s to return to Word Censor Administration';
  
+ $lang['Confirm_delete_word'] = 'Are you sure you want to delete this word censor?';
+ 
  
  //
  // Mass Email
***************
*** 557,562 ****
--- 564,570 ----
  
  $lang['Click_return_rankadmin'] = 'Click %sHere%s to return to Rank Administration';
  
+ $lang['Confirm_delete_rank'] = 'Are you sure you want to delete this rank?';
  
  //
  // Disallow Username Admin
diff -crN phpbb2019/language/lang_english/lang_main.php phpbb2020/language/lang_english/lang_main.php
*** phpbb2019/language/lang_english/lang_main.php	Fri Dec 30 11:38:19 2005
--- phpbb2020/language/lang_english/lang_main.php	Wed Apr  5 18:53:37 2006
***************
*** 6,12 ****
   *     copyright            : (C) 2001 The phpBB Group
   *     email                : support@phpbb.com
   *
!  *     $Id: lang_main.php,v 1.85.2.20 2005/12/30 09:51:02 acydburn Exp $
   *
   ****************************************************************************/
  
--- 6,12 ----
   *     copyright            : (C) 2001 The phpBB Group
   *     email                : support@phpbb.com
   *
!  *     $Id: lang_main.php,v 1.85.2.21 2006/02/05 15:59:48 grahamje Exp $
   *
   ****************************************************************************/
  
***************
*** 784,789 ****
--- 784,790 ----
  $lang['No_search_match'] = 'No topics or posts met your search criteria';
  $lang['Found_search_match'] = 'Search found %d match'; // eg. Search found 1 match
  $lang['Found_search_matches'] = 'Search found %d matches'; // eg. Search found 24 matches
+ $lang['Search_Flood_Error'] = 'You cannot make another search so soon after your last; please try again in a short while.';
  
  $lang['Close_window'] = 'Close Window';
  
diff -crN phpbb2019/login.php phpbb2020/login.php
*** phpbb2019/login.php	Fri Dec 30 11:38:20 2005
--- phpbb2020/login.php	Wed Apr  5 18:53:37 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: login.php,v 1.47.2.21 2005/12/29 11:51:13 acydburn Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: login.php,v 1.47.2.23 2006/01/13 20:10:02 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 82,88 ****
  				
  				// Check to see if user is allowed to login again... if his tries are exceeded
  				if ($row['user_last_login_try'] && $board_config['login_reset_time'] && $board_config['max_login_attempts'] && 
! 					$row['user_last_login_try'] >= (time() - ($board_config['login_reset_time'] * 60)) && $row['user_login_tries'] >= $board_config['max_login_attempts'])
  				{
  					message_die(GENERAL_MESSAGE, sprintf($lang['Login_attempts_exceeded'], $board_config['max_login_attempts'], $board_config['login_reset_time']));
  				}
--- 82,88 ----
  				
  				// Check to see if user is allowed to login again... if his tries are exceeded
  				if ($row['user_last_login_try'] && $board_config['login_reset_time'] && $board_config['max_login_attempts'] && 
! 					$row['user_last_login_try'] >= (time() - ($board_config['login_reset_time'] * 60)) && $row['user_login_tries'] >= $board_config['max_login_attempts'] && $userdata['user_level'] != ADMIN)
  				{
  					message_die(GENERAL_MESSAGE, sprintf($lang['Login_attempts_exceeded'], $board_config['max_login_attempts'], $board_config['login_reset_time']));
  				}
***************
*** 107,113 ****
  						message_die(CRITICAL_ERROR, "Couldn't start session : login", "", __LINE__, __FILE__);
  					}
  				}
! 				else
  				{
  					// Save login tries and last login
  					if ($row['user_id'] != ANONYMOUS)
--- 107,114 ----
  						message_die(CRITICAL_ERROR, "Couldn't start session : login", "", __LINE__, __FILE__);
  					}
  				}
! 				// Only store a failed login attempt for an active user - inactive users can't login even with a correct password
! 				elseif( $row['user_active'] )
  				{
  					// Save login tries and last login
  					if ($row['user_id'] != ANONYMOUS)
diff -crN phpbb2019/memberlist.php phpbb2020/memberlist.php
*** phpbb2019/memberlist.php	Fri Dec 30 11:38:20 2005
--- phpbb2020/memberlist.php	Wed Apr  5 18:53:37 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: memberlist.php,v 1.36.2.11 2005/09/14 18:14:30 acydburn Exp $
   *
   ***************************************************************************/
  
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: memberlist.php,v 1.36.2.12 2006/02/07 20:42:51 grahamje Exp $
   *
   ***************************************************************************/
  
***************
*** 228,235 ****
  		$yim = ( $row['user_yim'] ) ? '<a href="http://edit.yahoo.com/config/send_webmesg?.target=' . $row['user_yim'] . '&amp;.src=pg">' . $lang['YIM'] . '</a>' : '';
  
  		$temp_url = append_sid("search.$phpEx?search_author=" . urlencode($username) . "&amp;showresults=posts");
! 		$search_img = '<a href="' . $temp_url . '"><img src="' . $images['icon_search'] . '" alt="' . $lang['Search_user_posts'] . '" title="' . $lang['Search_user_posts'] . '" border="0" /></a>';
! 		$search = '<a href="' . $temp_url . '">' . $lang['Search_user_posts'] . '</a>';
  
  		$row_color = ( !($i % 2) ) ? $theme['td_color1'] : $theme['td_color2'];
  		$row_class = ( !($i % 2) ) ? $theme['td_class1'] : $theme['td_class2'];
--- 228,235 ----
  		$yim = ( $row['user_yim'] ) ? '<a href="http://edit.yahoo.com/config/send_webmesg?.target=' . $row['user_yim'] . '&amp;.src=pg">' . $lang['YIM'] . '</a>' : '';
  
  		$temp_url = append_sid("search.$phpEx?search_author=" . urlencode($username) . "&amp;showresults=posts");
! 		$search_img = '<a href="' . $temp_url . '"><img src="' . $images['icon_search'] . '" alt="' . sprintf($lang['Search_user_posts'], $username) . '" title="' . sprintf($lang['Search_user_posts'], $username) . '" border="0" /></a>';
! 		$search = '<a href="' . $temp_url . '">' . sprintf($lang['Search_user_posts'], $username) . '</a>';
  
  		$row_color = ( !($i % 2) ) ? $theme['td_color1'] : $theme['td_color2'];
  		$row_class = ( !($i % 2) ) ? $theme['td_class1'] : $theme['td_class2'];
diff -crN phpbb2019/modcp.php phpbb2020/modcp.php
*** phpbb2019/modcp.php	Fri Dec 30 11:38:20 2005
--- phpbb2020/modcp.php	Wed Apr  5 18:53:38 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: modcp.php,v 1.71.2.27 2005/09/14 18:14:30 acydburn Exp $
   *
   ***************************************************************************/
  
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: modcp.php,v 1.71.2.28 2006/01/20 19:50:27 grahamje Exp $
   *
   ***************************************************************************/
  
***************
*** 230,235 ****
--- 230,240 ----
  
  		if ( $confirm )
  		{
+   			if ( empty($HTTP_POST_VARS['topic_id_list']) && empty($topic_id) )
+ 			{
+ 				message_die(GENERAL_MESSAGE, $lang['None_selected']);
+ 			}
+ 
  			include($phpbb_root_path . 'includes/functions_search.'.$phpEx);
  
  			$topics = ( isset($HTTP_POST_VARS['topic_id_list']) ) ? $HTTP_POST_VARS['topic_id_list'] : array($topic_id);
***************
*** 256,261 ****
--- 261,271 ----
  			}
  			$db->sql_freeresult($result);
  
+ 			if ( $topic_id_sql == '')
+ 			{
+ 				message_die(GENERAL_MESSAGE, $lang['None_selected']);
+ 			}
+ 
  			$sql = "SELECT poster_id, COUNT(post_id) AS posts 
  				FROM " . POSTS_TABLE . " 
  				WHERE topic_id IN ($topic_id_sql) 
***************
*** 737,742 ****
--- 747,757 ----
  			}
  			$db->sql_freeresult($result);
  
+ 			if ($post_id_sql == '')
+ 			{
+ 				message_die(GENERAL_MESSAGE, $lang['None_selected']);
+ 			}
+ 
  			$sql = "SELECT post_id, poster_id, topic_id, post_time
  				FROM " . POSTS_TABLE . "
  				WHERE post_id IN ($post_id_sql) 
***************
*** 987,993 ****
  		}
  
  		$ip_this_post = decode_ip($post_row['poster_ip']);
! 		$ip_this_post = ( $rdns_ip_num == $ip_this_post ) ? gethostbyaddr($ip_this_post) : $ip_this_post;
  
  		$poster_id = $post_row['poster_id'];
  
--- 1002,1008 ----
  		}
  
  		$ip_this_post = decode_ip($post_row['poster_ip']);
! 		$ip_this_post = ( $rdns_ip_num == $ip_this_post ) ? htmlspecialchars(gethostbyaddr($ip_this_post)) : $ip_this_post;
  
  		$poster_id = $post_row['poster_id'];
  
***************
*** 1033,1039 ****
  				}
  
  				$ip = decode_ip($row['poster_ip']);
! 				$ip = ( $rdns_ip_num == $row['poster_ip'] || $rdns_ip_num == 'all') ? gethostbyaddr($ip) : $ip;
  
  				$row_color = ( !($i % 2) ) ? $theme['td_color1'] : $theme['td_color2'];
  				$row_class = ( !($i % 2) ) ? $theme['td_class1'] : $theme['td_class2'];
--- 1048,1054 ----
  				}
  
  				$ip = decode_ip($row['poster_ip']);
! 				$ip = ( $rdns_ip_num == $row['poster_ip'] || $rdns_ip_num == 'all') ? htmlspecialchars(gethostbyaddr($ip)) : $ip;
  
  				$row_color = ( !($i % 2) ) ? $theme['td_color1'] : $theme['td_color2'];
  				$row_class = ( !($i % 2) ) ? $theme['td_class1'] : $theme['td_class2'];
diff -crN phpbb2019/posting.php phpbb2020/posting.php
*** phpbb2019/posting.php	Fri Dec 30 11:38:20 2005
--- phpbb2020/posting.php	Wed Apr  5 18:53:38 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: posting.php,v 1.159.2.27 2005/10/30 15:17:13 acydburn Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: posting.php,v 1.159.2.28 2006/01/28 14:56:51 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 627,633 ****
  			}
  			else if ( !empty($option_text) ) 
  			{
! 				$poll_options[$option_id] = htmlspecialchars(trim(stripslashes($option_text)));
  			}
  		}
  	}
--- 627,633 ----
  			}
  			else if ( !empty($option_text) ) 
  			{
! 				$poll_options[intval($option_id)] = htmlspecialchars(trim(stripslashes($option_text)));
  			}
  		}
  	}
diff -crN phpbb2019/privmsg.php phpbb2020/privmsg.php
*** phpbb2019/privmsg.php	Fri Dec 30 11:38:20 2005
--- phpbb2020/privmsg.php	Wed Apr  5 18:53:38 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: privmsg.php,v 1.96.2.44 2005/12/22 12:54:56 acydburn Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: privmsg.php,v 1.96.2.48 2006/03/18 12:33:06 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 1187,1193 ****
  			$error_msg .= ( ( !empty($error_msg) ) ? '<br />' : '' ) . $lang['No_to_user'];
  		}
  
! 		$privmsg_subject = trim(strip_tags($HTTP_POST_VARS['subject']));
  		if ( empty($privmsg_subject) )
  		{
  			$error = TRUE;
--- 1187,1193 ----
  			$error_msg .= ( ( !empty($error_msg) ) ? '<br />' : '' ) . $lang['No_to_user'];
  		}
  
! 		$privmsg_subject = trim(htmlspecialchars($HTTP_POST_VARS['subject']));
  		if ( empty($privmsg_subject) )
  		{
  			$error = TRUE;
***************
*** 1309,1315 ****
  
  		if ( !$db->sql_query($sql, END_TRANSACTION) )
  		{
! 			message_die(GENERAL_ERROR, "Could not insert/update private message sent text.", "", __LINE__, __FILE__, $sql_info);
  		}
  
  		if ( $mode != 'edit' )
--- 1309,1315 ----
  
  		if ( !$db->sql_query($sql, END_TRANSACTION) )
  		{
! 			message_die(GENERAL_ERROR, "Could not insert/update private message sent text.", "", __LINE__, __FILE__, $sql);
  		}
  
  		if ( $mode != 'edit' )
***************
*** 1374,1380 ****
  		//
  		$to_username = (isset($HTTP_POST_VARS['username']) ) ? trim(htmlspecialchars(stripslashes($HTTP_POST_VARS['username']))) : '';
  
! 		$privmsg_subject = ( isset($HTTP_POST_VARS['subject']) ) ? trim(strip_tags(stripslashes($HTTP_POST_VARS['subject']))) : '';
  		$privmsg_message = ( isset($HTTP_POST_VARS['message']) ) ? trim($HTTP_POST_VARS['message']) : '';
  		$privmsg_message = preg_replace('#<textarea>#si', '&lt;textarea&gt;', $privmsg_message);
  		if ( !$preview )
--- 1374,1380 ----
  		//
  		$to_username = (isset($HTTP_POST_VARS['username']) ) ? trim(htmlspecialchars(stripslashes($HTTP_POST_VARS['username']))) : '';
  
! 		$privmsg_subject = ( isset($HTTP_POST_VARS['subject']) ) ? trim(htmlspecialchars(stripslashes($HTTP_POST_VARS['subject']))) : '';
  		$privmsg_message = ( isset($HTTP_POST_VARS['message']) ) ? trim($HTTP_POST_VARS['message']) : '';
  		$privmsg_message = preg_replace('#<textarea>#si', '&lt;textarea&gt;', $privmsg_message);
  		if ( !$preview )
***************
*** 1507,1513 ****
--- 1507,1517 ----
  				redirect(append_sid("privmsg.$phpEx?folder=$folder", true));
  			}
  
+ 			$orig_word = $replacement_word = array();
+ 			obtain_word_list($orig_word, $replace_word);
+ 
  			$privmsg_subject = ( ( !preg_match('/^Re:/', $privmsg['privmsgs_subject']) ) ? 'Re: ' : '' ) . $privmsg['privmsgs_subject'];
+ 			$privmsg_subject = preg_replace($orig_word, $replacement_word, $privmsg_subject);
  
  			$to_username = $privmsg['username'];
  			$to_userid = $privmsg['user_id'];
***************
*** 1520,1525 ****
--- 1524,1530 ----
  				$privmsg_message = preg_replace("/\:(([a-z0-9]:)?)$privmsg_bbcode_uid/si", '', $privmsg_message);
  				$privmsg_message = str_replace('<br />', "\n", $privmsg_message);
  				$privmsg_message = preg_replace('#</textarea>#si', '&lt;/textarea&gt;', $privmsg_message);
+ 				$privmsg_message = preg_replace($orig_word, $replacement_word, $privmsg_message);
  				
  				$msg_date =  create_date($board_config['default_dateformat'], $privmsg['privmsgs_date'], $board_config['board_timezone']); 
  
***************
*** 1741,1749 ****
  	//
  	generate_smilies('inline', PAGE_PRIVMSGS);
  
- 	$privmsg_subject = preg_replace($html_entities_match, $html_entities_replace, $privmsg_subject);
- 	$privmsg_subject = str_replace('"', '&quot;', $privmsg_subject);
- 
  	$template->assign_vars(array(
  		'SUBJECT' => $privmsg_subject, 
  		'USERNAME' => $to_username,
--- 1746,1751 ----
diff -crN phpbb2019/profile.php phpbb2020/profile.php
*** phpbb2019/profile.php	Fri Dec 30 11:38:20 2005
--- phpbb2020/profile.php	Wed Apr  5 18:53:38 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: profile.php,v 1.193.2.5 2004/11/18 17:49:37 acydburn Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: profile.php,v 1.193.2.6 2006/02/26 17:34:50 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 60,77 ****
  //
  function gen_rand_string($hash)
  {
! 	$chars = array( 'a', 'A', 'b', 'B', 'c', 'C', 'd', 'D', 'e', 'E', 'f', 'F', 'g', 'G', 'h', 'H', 'i', 'I', 'j', 'J',  'k', 'K', 'l', 'L', 'm', 'M', 'n', 'N', 'o', 'O', 'p', 'P', 'q', 'Q', 'r', 'R', 's', 'S', 't', 'T',  'u', 'U', 'v', 'V', 'w', 'W', 'x', 'X', 'y', 'Y', 'z', 'Z', '1', '2', '3', '4', '5', '6', '7', '8', '9', '0');
! 	
! 	$max_chars = count($chars) - 1;
! 	srand( (double) microtime()*1000000);
! 	
! 	$rand_str = '';
! 	for($i = 0; $i < 8; $i++)
! 	{
! 		$rand_str = ( $i == 0 ) ? $chars[rand(0, $max_chars)] : $rand_str . $chars[rand(0, $max_chars)];
! 	}
  
! 	return ( $hash ) ? md5($rand_str) : $rand_str;
  }
  //
  // End page specific functions
--- 60,68 ----
  //
  function gen_rand_string($hash)
  {
! 	$rand_str = dss_rand();
  
! 	return ( $hash ) ? md5($rand_str) : substr($rand_str, 8);
  }
  //
  // End page specific functions
diff -crN phpbb2019/search.php phpbb2020/search.php
*** phpbb2019/search.php	Fri Dec 30 11:38:20 2005
--- phpbb2020/search.php	Wed Apr  5 18:53:38 2006
***************
*** 6,12 ****
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: search.php,v 1.72.2.17 2005/09/14 18:14:30 acydburn Exp $
   *
   *
   ***************************************************************************/
--- 6,12 ----
   *   copyright            : (C) 2001 The phpBB Group
   *   email                : support@phpbb.com
   *
!  *   $Id: search.php,v 1.72.2.19 2006/02/05 15:59:48 grahamje Exp $
   *
   *
   ***************************************************************************/
***************
*** 153,164 ****
--- 153,183 ----
  	//
  	// Search ID Limiter, decrease this value if you experience further timeout problems with searching forums
  	$limiter = 5000;
+ 	$current_time = time();
  
  	//
  	// Cycle through options ...
  	//
  	if ( $search_id == 'newposts' || $search_id == 'egosearch' || $search_id == 'unanswered' || $search_keywords != '' || $search_author != '' )
  	{
+ 		//
+ 		// Flood control
+ 		//
+ 		$where_sql = ($userdata['user_id'] == ANONYMOUS) ? "se.session_ip = '$user_ip'" : 'se.session_user_id = ' . $userdata['user_id'];
+ 		$sql = 'SELECT MAX(sr.search_time) AS last_search_time
+ 			FROM ' . SEARCH_TABLE . ' sr, ' . SESSIONS_TABLE . " se
+ 			WHERE sr.session_id = se.session_id
+ 				AND $where_sql";
+ 		if ($result = $db->sql_query($sql))
+ 		{
+ 			if ($row = $db->sql_fetchrow($result))
+ 			{
+ 				if (intval($row['last_search_time']) > 0 && ($current_time - intval($row['last_search_time'])) < intval($board_config['search_flood_interval']))
+ 				{
+ 					message_die(GENERAL_MESSAGE, $lang['Search_Flood_Error']);
+ 				}
+ 			}
+ 		}
  		if ( $search_id == 'newposts' || $search_id == 'egosearch' || ( $search_author != '' && $search_keywords == '' )  )
  		{
  			if ( $search_id == 'newposts' )
***************
*** 197,209 ****
  			}
  			else
  			{
! 				if (preg_match('#^[\*%]+$#', trim($search_author)) || preg_match('#^[^\*]{1,2}$#', str_replace(array('*', '%'), '', trim($search_author))))
  				{
  					$search_author = '';
  				}
  
- 				$search_author = str_replace('*', '%', trim($search_author));
- 				
  				$sql = "SELECT user_id
  					FROM " . USERS_TABLE . "
  					WHERE username LIKE '" . str_replace("\'", "''", $search_author) . "'";
--- 216,228 ----
  			}
  			else
  			{
! 				$search_author = str_replace('*', '%', trim($search_author));
! 
! 				if( ( strpos($search_author, '%') !== false ) && ( strlen(str_replace('%', '', $search_author)) < 3 ) )
  				{
  					$search_author = '';
  				}
  
  				$sql = "SELECT user_id
  					FROM " . USERS_TABLE . "
  					WHERE username LIKE '" . str_replace("\'", "''", $search_author) . "'";
***************
*** 420,431 ****
  		//
  		if ( $search_author != '' )
  		{
! 			if (preg_match('#^[\*%]+$#', trim($search_author)) || preg_match('#^[^\*]{1,2}$#', str_replace(array('*', '%'), '', trim($search_author))))
  			{
  				$search_author = '';
  			}
- 
- 			$search_author = str_replace('*', '%', trim(str_replace("\'", "''", $search_author)));
  		}
  
  		if ( $total_match_count )
--- 439,450 ----
  		//
  		if ( $search_author != '' )
  		{
! 			$search_author = str_replace('*', '%', trim($search_author));
! 
! 			if( ( strpos($search_author, '%') !== false ) && ( strlen(str_replace('%', '', $search_author)) < 3 ) )
  			{
  				$search_author = '';
  			}
  		}
  
  		if ( $total_match_count )
***************
*** 629,656 ****
  		}
  
  		//
! 		// Finish building query (for all combinations)
! 		// and run it ...
  		//
! 		$sql = "SELECT session_id 
! 			FROM " . SESSIONS_TABLE;
! 		if ( $result = $db->sql_query($sql) )
  		{
! 			$delete_search_ids = array();
! 			while( $row = $db->sql_fetchrow($result) )
! 			{
! 				$delete_search_ids[] = "'" . $row['session_id'] . "'";
! 			}
! 
! 			if ( count($delete_search_ids) )
! 			{
! 				$sql = "DELETE FROM " . SEARCH_TABLE . " 
! 					WHERE session_id NOT IN (" . implode(", ", $delete_search_ids) . ")";
! 				if ( !$result = $db->sql_query($sql) )
! 				{
! 					message_die(GENERAL_ERROR, 'Could not delete old search id sessions', '', __LINE__, __FILE__, $sql);
! 				}
! 			}
  		}
  
  		//
--- 648,660 ----
  		}
  
  		//
! 		// Delete old data from the search result table
  		//
! 		$sql = 'DELETE FROM ' . SEARCH_TABLE . '
! 			WHERE search_time < ' . ($current_time - (int) $board_config['session_length']);
! 		if ( !$result = $db->sql_query($sql) )
  		{
! 			message_die(GENERAL_ERROR, 'Could not delete old search id sessions', '', __LINE__, __FILE__, $sql);
  		}
  
  		//
***************
*** 691,702 ****
  		$search_id = mt_rand();
  
  		$sql = "UPDATE " . SEARCH_TABLE . " 
! 			SET search_id = $search_id, search_array = '" . str_replace("\'", "''", $result_array) . "'
  			WHERE session_id = '" . $userdata['session_id'] . "'";
  		if ( !($result = $db->sql_query($sql)) || !$db->sql_affectedrows() )
  		{
! 			$sql = "INSERT INTO " . SEARCH_TABLE . " (search_id, session_id, search_array) 
! 				VALUES($search_id, '" . $userdata['session_id'] . "', '" . str_replace("\'", "''", $result_array) . "')";
  			if ( !($result = $db->sql_query($sql)) )
  			{
  				message_die(GENERAL_ERROR, 'Could not insert search results', '', __LINE__, __FILE__, $sql);
--- 695,706 ----
  		$search_id = mt_rand();
  
  		$sql = "UPDATE " . SEARCH_TABLE . " 
! 			SET search_id = $search_id, search_time = $current_time, search_array = '" . str_replace("\'", "''", $result_array) . "'
  			WHERE session_id = '" . $userdata['session_id'] . "'";
  		if ( !($result = $db->sql_query($sql)) || !$db->sql_affectedrows() )
  		{
! 			$sql = "INSERT INTO " . SEARCH_TABLE . " (search_id, session_id, search_time, search_array) 
! 				VALUES($search_id, '" . $userdata['session_id'] . "', $current_time, '" . str_replace("\'", "''", $result_array) . "')";
  			if ( !($result = $db->sql_query($sql)) )
  			{
  				message_die(GENERAL_ERROR, 'Could not insert search results', '', __LINE__, __FILE__, $sql);
diff -crN phpbb2019/templates/subSilver/admin/board_config_body.tpl phpbb2020/templates/subSilver/admin/board_config_body.tpl
*** phpbb2019/templates/subSilver/admin/board_config_body.tpl	Fri Dec 30 11:38:19 2005
--- phpbb2020/templates/subSilver/admin/board_config_body.tpl	Wed Apr  5 18:53:37 2006
***************
*** 56,61 ****
--- 56,65 ----
  		<td class="row2"><input class="post" type="text" size="3" maxlength="4" name="flood_interval" value="{FLOOD_INTERVAL}" /></td>
  	</tr>
  	<tr>
+ 		<td class="row1">{L_SEARCH_FLOOD_INTERVAL} <br /><span class="gensmall">{L_SEARCH_FLOOD_INTERVAL_EXPLAIN}</span></td>
+ 		<td class="row2"><input class="post" type="text" size="3" maxlength="4" name="search_flood_interval" value="{SEARCH_FLOOD_INTERVAL}" /></td>
+ 	</tr>
+ 	<tr>
  		<td class="row1">{L_MAX_LOGIN_ATTEMPTS}<br /><span class="gensmall">{L_MAX_LOGIN_ATTEMPTS_EXPLAIN}</span></td>
  		<td class="row2"><input class="post" type="text" size="3" maxlength="4" name="max_login_attempts" value="{MAX_LOGIN_ATTEMPTS}" /></td>
  	</tr>
diff -crN phpbb2019/templates/subSilver/admin/confirm_body.tpl phpbb2020/templates/subSilver/admin/confirm_body.tpl
*** phpbb2019/templates/subSilver/admin/confirm_body.tpl	Thu Jan  1 01:00:00 1970
--- phpbb2020/templates/subSilver/admin/confirm_body.tpl	Wed Apr  5 18:53:37 2006
***************
*** 0 ****
--- 1,11 ----
+  
+ <table class="forumline" width="100%" cellspacing="1" cellpadding="4" border="0">
+ 	<tr>
+ 		<th class="thHead" height="25" valign="middle">{MESSAGE_TITLE}</th>
+ 	</tr>
+ 	<tr>
+ 		<td class="row1" align="center"><form action="{S_CONFIRM_ACTION}" method="post"><span class="gen"><br />{MESSAGE_TEXT}<br /><br />{S_HIDDEN_FIELDS}<input type="submit" name="confirm" value="{L_YES}" class="mainoption" />&nbsp;&nbsp;<input type="submit" name="cancel" value="{L_NO}" class="liteoption" /></span></form></td>
+ 	</tr>
+ </table>
+ 
+ <br clear="all" />
diff -crN phpbb2019/templates/subSilver/confirm_body.tpl phpbb2020/templates/subSilver/confirm_body.tpl
*** phpbb2019/templates/subSilver/confirm_body.tpl	Fri Dec 30 11:38:19 2005
--- phpbb2020/templates/subSilver/confirm_body.tpl	Wed Apr  5 18:53:37 2006
***************
*** 7,13 ****
  
  <table class="forumline" width="100%" cellspacing="1" cellpadding="3" border="0">
  	<tr>
! 		<th class="thHead" height="25" valign="middle"><span class="tableTitle">{MESSAGE_TITLE}</span></th>
  	</tr>
  	<tr>
  		<td class="row1" align="center"><form action="{S_CONFIRM_ACTION}" method="post"><span class="gen"><br />{MESSAGE_TEXT}<br /><br />{S_HIDDEN_FIELDS}<input type="submit" name="confirm" value="{L_YES}" class="mainoption" />&nbsp;&nbsp;<input type="submit" name="cancel" value="{L_NO}" class="liteoption" /></span></form></td>
--- 7,13 ----
  
  <table class="forumline" width="100%" cellspacing="1" cellpadding="3" border="0">
  	<tr>
! 		<th class="thHead" height="25" valign="middle">{MESSAGE_TITLE}</th>
  	</tr>
  	<tr>
  		<td class="row1" align="center"><form action="{S_CONFIRM_ACTION}" method="post"><span class="gen"><br />{MESSAGE_TEXT}<br /><br />{S_HIDDEN_FIELDS}<input type="submit" name="confirm" value="{L_YES}" class="mainoption" />&nbsp;&nbsp;<input type="submit" name="cancel" value="{L_NO}" class="liteoption" /></span></form></td>
