diff -x .svn -aruN 3.62.src/createaccount.php 3.64.src/createaccount.php
--- 3.62.src/createaccount.php	2012-08-28 15:42:43.000000000 -0500
+++ 3.64.src/createaccount.php	2012-08-28 15:42:34.000000000 -0500
@@ -3,12 +3,13 @@
 	//include $DIR_LIBS."ACTION.php";
 	include_libs('ACTION.php',false,false);
 	
-	if (isset ($_POST['showform'])&&$_POST['showform']==1) {
+	if (isset ($_POST['showform']) && $_POST['showform']==1) {
 		$showform = 1;
 	}
 	else {
 		$showform = 0;
 	}
+	sendContentType('text/html', 'createaccount', _CHARSET);
 ?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html>
@@ -88,22 +89,22 @@
 	
 		Login Name (required): 
 		<br />
-		<input name="name" size="32" maxlength="32" <?php if(isset($_POST['name'])){echo 'value="'.$_POST['name'].'"';}?>/> <small>(only a-z, 0-9)</small>
+		<input name="name" size="32" maxlength="32" <?php if(isset($_POST['name'])){echo 'value="'.htmlspecialchars($_POST['name']).'"';}?>/> <small>(only a-z, 0-9)</small>
 		<br />
 		<br />		
 		Real Name (required): 
 		<br />
-		<input name="realname" size="40" <?php if(isset($_POST['realname'])){echo 'value="'.$_POST['realname'].'"';}?>/>
+		<input name="realname" size="40" <?php if(isset($_POST['realname'])){echo 'value="'.htmlspecialchars($_POST['realname']).'"';}?>/>
 		<br />
 		<br />		
 		Email (required):
 		<br />
-		<input name="email" size="40" <?php if(isset($_POST['email'])){echo 'value="'.$_POST['email'].'"';}?>/> <small>(must be valid, because an activation link will be sent over there)</small>
+		<input name="email" size="40" <?php if(isset($_POST['email'])){echo 'value="'.htmlspecialchars($_POST['email']).'"';}?>/> <small>(must be valid, because an activation link will be sent over there)</small>
 		<br />
 		<br />		
 		URL: 
 		<br />
-		<input name="url" size="60" <?php if(isset($_POST['url'])){echo 'value="'.$_POST['url'].'"';}?>/>
+		<input name="url" size="60" <?php if(isset($_POST['url'])){echo 'value="'.htmlspecialchars($_POST['url']).'"';}?>/>
 		<br />
 		<?php
 		// add extra fields from plugin, like NP_Profile
diff -x .svn -aruN 3.62.src/nucleus/documentation/help.html 3.64.src/nucleus/documentation/help.html
--- 3.62.src/nucleus/documentation/help.html	2012-08-28 15:42:43.000000000 -0500
+++ 3.64.src/nucleus/documentation/help.html	2012-08-28 15:42:34.000000000 -0500
@@ -1,7 +1,7 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
-	<!-- $Id: help.html 1457 2010-10-26 15:47:41Z ftruscot $ -->
+	<!-- $Id: help.html 1500 2011-03-01 19:32:53Z ftruscot $ -->
 
 	<title>Nucleus Admin Help</title>
 	<style type="text/css">
@@ -577,7 +577,7 @@
   categorylist listitem (repeated)
 categorylist footer</pre>
 
-<p>Available variables: (in the header and footer, only <tt>blogid</tt>, <tt>blogurl</tt> and <tt>self</tt> are allowed)</p>
+<p>Available variables: (in the header and footer, only <tt>blogid</tt>, <tt>blogurl</tt>, <tt>self</tt>, <tt>catiscurrent</tt>, and <tt>currentcat</tt> are allowed)</p>
 
 <table><tr>
 	<th>Name</th>
diff -x .svn -aruN 3.62.src/nucleus/documentation/history.html 3.64.src/nucleus/documentation/history.html
--- 3.62.src/nucleus/documentation/history.html	2012-08-28 15:42:43.000000000 -0500
+++ 3.64.src/nucleus/documentation/history.html	2012-08-28 15:42:34.000000000 -0500
@@ -2,7 +2,7 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" lang="en-us" xml:lang="en-us">
 <head>
-	<!-- $Id: history.html 1493 2011-01-06 19:03:55Z ftruscot $ -->
+	<!-- $Id: history.html 1507 2011-03-14 16:59:39Z ftruscot $ -->
     <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
     <meta http-equiv="Content-Style-Type" content="text/css" />
     <meta http-equiv="Content-Script-Type" content="text/javascript" />
@@ -28,21 +28,38 @@
 
 <ul>
 	<li>
+		<strong>Nucleus v3.64 (March 14, 2011)</strong>
+		<ul>
+			<li>FIX: security issue in comments. Thanks Katsumi and John Leitch of AutoSec Tools. (gRegorlove)</li>
+			<li>ADD: labels in the installation form (kg)</li>
+			<li>FIX: minor problems with invalid XHTML in the installation form (kg)</li>
+			<li>CHANGE: Clean up and improvements in comment handling. (gRegorlove)</li>
+		</ul>
+	</li>
+	<li>
+		<strong>Nucleus v3.63 (March 1, 2011)</strong>
+		<ul>
+			<li>FIX: security issue in createaccount.php. Thanks Katsumi. (ftruscot)</li>
+			<li>FIX: call of special skin parts using fancy url scheme like special/specialname was not working. Thanks slightlysome. (ftruscot)</li>
+			<li>FIX: extra params in generated links with fancy urls on were not using the designated keys. Thanks slightlysome. (ftruscot)</li>
+			<li>ADD: catiscurrent variable to Category List Header and Footer. Thanks slightlysome. (ftruscot)</li>
+		</ul>
+	</li>
+	<li>
 		<strong>Nucleus v3.62 (January 6, 2011)</strong>
 		<ul>
 			<li>CHANGE: add redundant safeguards against security issues caused by case where register_globals is on and the config.php file is missing (Rare!!!) (ftruscot)</li>
 			<li>CHANGE: make CONF variable, AdminCSS, to hold name of admin area style to use. default to original. (ftruscot)</li>
 			<li>FIX: use of strripos in cleanFileName() not PHP4 compatible, switched to use of strrpos() since no functionality lost. (ftruscot)</li>
 			<li>FIX: replace ereg* functions in remaining core files, including core plugins. (ftruscot).</li>
-			<li>FIX: multiple newlines in comment body being reduced to only one newline. (gRegor)</li>
+			<li>FIX: multiple newlines in comment body being reduced to only one newline. (gRegorlove)</li>
 			<li>FIX: highlight() function still using ereg* functions. (ftruscot)</li>
 			<li>CHANGE: cleanFileName() function simplified to replace all but a-z0-9-. (ftruscot)</li>
 			<li>FIX: install problem when only mysqli _* is available. (ftruscot)</li>
-			<li>FIX: fix comment body text not appearing on Edit Comment form (gRegor)</li>
+			<li>FIX: fix comment body text not appearing on Edit Comment form (gRegorlove)</li>
 		</ul>
 	</li>
 	<li>
-	<li>
 		<strong>Nucleus v3.61 (December 19, 2010)</strong>
 		<ul>
 			<li>FIX: fix comment body being lost (ftruscot)</li>
diff -x .svn -aruN 3.62.src/nucleus/language/english.php 3.64.src/nucleus/language/english.php
--- 3.62.src/nucleus/language/english.php	2012-08-28 15:42:43.000000000 -0500
+++ 3.64.src/nucleus/language/english.php	2012-08-28 15:42:34.000000000 -0500
@@ -17,10 +17,16 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: english.php 1489 2010-12-22 23:00:39Z ftruscot $
+ * @version $Id: english.php 1507 2011-03-14 16:59:39Z ftruscot $
  */
- 
- 
+
+/********************************************
+ *        Start New for 3.6x                *
+ ********************************************/
+define('_ERROR_USER_TOO_LONG', 'Please enter a name shorter than 40 characters.');
+define('_ERROR_EMAIL_TOO_LONG', 'Please enter an email shorter than 100 characters.');
+define('_ERROR_URL_TOO_LONG', 'Please enter a website shorter than 100 characters.');
+
 /********************************************
  *        Start New for 3.62                *
  ********************************************/
diff -x .svn -aruN 3.62.src/nucleus/libs/ACTION.php 3.64.src/nucleus/libs/ACTION.php
--- 3.62.src/nucleus/libs/ACTION.php	2012-08-28 15:42:43.000000000 -0500
+++ 3.64.src/nucleus/libs/ACTION.php	2012-08-28 15:42:34.000000000 -0500
@@ -15,10 +15,11 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: ACTION.php 1378 2009-07-10 14:03:01Z shizuki $
+ * @version $Id: ACTION.php 1507 2011-03-14 16:59:39Z ftruscot $
  */
 class ACTION
 {
+
 	/**
 	 *  Constructor for an new ACTION object
 	 */
@@ -27,113 +28,147 @@
 		// do nothing
 	}
 
+
 	/**
 	 *  Calls functions that handle an action called from action.php
 	 */
 	function doAction($action)
 	{
-		switch($action) {
+		switch($action)
+		{
 			case 'autodraft':
 				return $this->autoDraft();
-				break;
+			break;
+		
 			case 'updateticket':
 				return $this->updateTicket();
-				break;
+			break;
+
 			case 'addcomment':
 				return $this->addComment();
-				break;
+			break;
+
 			case 'sendmessage':
 				return $this->sendMessage();
-				break;
+			break;
+
 			case 'createaccount':
 				return $this->createAccount();
-				break;
+			break;
+
 			case 'forgotpassword':
 				return $this->forgotPassword();
-				break;
+			break;
+
 			case 'votepositive':
 				return $this->doKarma('pos');
-				break;
+			break;
+
 			case 'votenegative':
 				return $this->doKarma('neg');
-				break;
+			break;
+
 			case 'plugin':
 				return $this->callPlugin();
-				break;
+			break;
+
 			default:
 				doError(_ERROR_BADACTION);
+			break;
 		}
 	}
 
+
 	/**
 	 *  Adds a new comment to an item (if IP isn't banned)
 	 */
-	function addComment() {
+	function addComment()
+	{
 		global $CONF, $errormessage, $manager;
 
-		$post['itemid'] =	intPostVar('itemid');
-		$post['user'] = 	postVar('user');
-		$post['userid'] = 	postVar('userid');
-		$post['email'] =   postVar('email');
-		$post['body'] = 	postVar('body');
+		$post['itemid']		= intPostVar('itemid');
+		$post['user']		= postVar('user');
+		$post['userid']		= postVar('userid');
+		$post['email']		= postVar('email');
+		$post['body']		= postVar('body');
+		$post['remember']	= intPostVar('remember');
 
 		// set cookies when required
-		$remember = intPostVar('remember');
-		if ($remember == 1) {
-			$lifetime = time()+2592000;
-			setcookie($CONF['CookiePrefix'] . 'comment_user',$post['user'],$lifetime,'/','',0);
-			setcookie($CONF['CookiePrefix'] . 'comment_userid', $post['userid'],$lifetime,'/','',0);
-			setcookie($CONF['CookiePrefix'] . 'comment_email',  $post['email'], $lifetime,'/','',0);
-		}
+		#$remember = intPostVar('remember');
+
+		// begin if: "Remember Me" box checked
+		if ( $post['remember'] == 1 )
+		{
+			$lifetime = time() + 2592000;
+			setcookie($CONF['CookiePrefix'] . 'comment_user', $post['user'], $lifetime, '/', '', 0);
+			setcookie($CONF['CookiePrefix'] . 'comment_userid', $post['userid'], $lifetime, '/', '', 0);
+			setcookie($CONF['CookiePrefix'] . 'comment_email', $post['email'], $lifetime, '/', '', 0);
+		} // end if
 
 		$comments = new COMMENTS($post['itemid']);
 
-		$blogid = getBlogIDFromItemID($post['itemid']);
-		$this->checkban($blogid);
-		$blog =& $manager->getBlog($blogid);
+		$blog_id = getBlogIDFromItemID($post['itemid']);
+		$this->checkban($blog_id);
+		$blog =& $manager->getBlog($blog_id);
 
 		// note: PreAddComment and PostAddComment gets called somewhere inside addComment
-		$errormessage = $comments->addComment($blog->getCorrectTime(),$post);
+		$errormessage = $comments->addComment($blog->getCorrectTime(), $post);
 
-		if ($errormessage == '1') {
+		// begin if:
+		if ( $errormessage == '1' )
+		{
 			// redirect when adding comments succeeded
-			if (postVar('url')) {
-				redirect(postVar('url'));
-			} else {
+			if ( postVar('url') )
+			{
+				redirect(postVar('url') );
+			}
+			else
+			{
 				$url = createItemLink($post['itemid']);
 				redirect($url);
-			}
-		} else {
-			// else, show error message using default skin for blog
+			} // end if
+
+		}
+		// else, show error message using default skin for blo
+		else
+		{
 			return array(
-				'message' => $errormessage,
-				'skinid' => $blog->getDefaultSkin()
+				'message'	=> $errormessage,
+				'skinid'	=> $blog->getDefaultSkin()
 			);
-		}
+		} // end if
 
 		exit;
 	}
 
+
 	/**
 	 *  Sends a message from the current member to the member given as argument
 	 */
-	function sendMessage() {
+	function sendMessage()
+	{
 		global $CONF, $member;
 
 		$error = $this->validateMessage();
-		if ($error != '')
+
+		if ( $error != '' )
+		{
 			return array('message' => $error);
+		}
 
-		if (!$member->isLoggedIn()) {
+		if ( !$member->isLoggedIn() )
+		{
 			$fromMail = postVar('frommail');
 			$fromName = _MMAIL_FROMANON;
-		} else {
+		}
+		else
+		{
 			$fromMail = $member->getEmail();
 			$fromName = $member->getDisplayName();
 		}
 
 		$tomem = new MEMBER();
-		$tomem->readFromId(postVar('memberid'));
+		$tomem->readFromId(postVar('memberid') );
 
 		$message  = _MMAIL_MSG . ' ' . $fromName . "\n"
 			  . '(' . _MMAIL_FROMNUC. ' ' . $CONF['IndexURL'] .") \n\n"
@@ -144,105 +179,136 @@
 		$title = _MMAIL_TITLE . ' ' . $fromName;
 		mail($tomem->getEmail(), $title, $message, 'From: '. $fromMail);
 
-		if (postVar('url')) {
-			redirect(postVar('url'));
-		} else {
+		if ( postVar('url') )
+		{
+			redirect(postVar('url') );
+		}
+		else
+		{
 			$CONF['MemberURL'] = $CONF['IndexURL'];
-			if ($CONF['URLMode'] == 'pathinfo')
+
+			if ( $CONF['URLMode'] == 'pathinfo' )
 			{
-				$url = createLink('member', array('memberid' => $tomem->getID(), 'name' => $tomem->getDisplayName()));
+				$url = createLink('member', array('memberid' => $tomem->getID(), 'name' => $tomem->getDisplayName() ) );
 			}
 			else
 			{
 				$url = $CONF['IndexURL'] . createMemberLink($tomem->getID());
 			}
+
 			redirect($url);
 		}
+
 		exit;
 	}
 
+
 	/**
 	 *  Checks if a mail to a member is allowed
 	 *  Returns a string with the error message if the mail is disallowed
 	 */
-	function validateMessage() {
+	function validateMessage()
+	{
 		global $CONF, $member, $manager;
 
-		if (!$CONF['AllowMemberMail'])
+		if ( !$CONF['AllowMemberMail'] )
+		{
 			return _ERROR_MEMBERMAILDISABLED;
+		}
 
-		if (!$member->isLoggedIn() && !$CONF['NonmemberMail'])
+		if ( !$member->isLoggedIn() && !$CONF['NonmemberMail'] )
+		{
 			return _ERROR_DISALLOWED;
+		}
 
-		if (!$member->isLoggedIn() && (!isValidMailAddress(postVar('frommail'))))
+		if ( !$member->isLoggedIn() && (!isValidMailAddress(postVar('frommail') ) ) )
+		{
 			return _ERROR_BADMAILADDRESS;
+		}
 
 		// let plugins do verification (any plugin which thinks the comment is invalid
 		// can change 'error' to something other than '')
 		$result = '';
-		$manager->notify('ValidateForm', array('type' => 'membermail', 'error' => &$result));
+		$manager->notify('ValidateForm', array('type' => 'membermail', 'error' => &$result) );
 
 		return $result;
 
 	}
 
+
 	/**
 	 *  Creates a new user account
 	 */
-	function createAccount() {
+	function createAccount()
+	{
 		global $CONF, $manager;
 
-		if (!$CONF['AllowMemberCreate'])
+		if ( !$CONF['AllowMemberCreate'] )
+		{
 			doError(_ERROR_MEMBERCREATEDISABLED);
+		}
 
 		// evaluate content from FormExtra
 		$result = 1;
 		$data = array('type' => 'membermail', 'error' => &$result);
 		$manager->notify('ValidateForm', &$data);
 
-		if ($result!=1) {
+		if ( $result != 1 )
+		{
 			return $result;
 		}
-		else {
+		else
+		{
 
-		// even though the member can not log in, set some random initial password. One never knows.
-		srand((double)microtime()*1000000);
-		$initialPwd = md5(uniqid(rand(), true));
+			// even though the member can not log in, set some random initial password. One never knows.
+			srand( (double) microtime() * 1000000);
+			$initialPwd = md5(uniqid(rand(), TRUE) );
 
-		// create member (non admin/can not login/no notes/random string as password)
-		$name = shorten(postVar('name'),32,'');
-		$r = MEMBER::create($name, postVar('realname'), $initialPwd, postVar('email'), postVar('url'), 0, 0, '');
+			// create member (non admin/can not login/no notes/random string as password)
+			$name = shorten(postVar('name'), 32, '');
+			$r = MEMBER::create($name, postVar('realname'), $initialPwd, postVar('email'), postVar('url'), 0, 0, '');
 
-			if ($r != 1) {
+			if ( $r != 1 )
+			{
 				return $r;
 			}
 
-		// send message containing password.
-		$newmem = new MEMBER();
-		$newmem->readFromName($name);
-		$newmem->sendActivationLink('register');
-
-		$manager->notify('PostRegister',array('member' => &$newmem));
-
-		if (postVar('desturl')) {
-			redirect(postVar('desturl'));
-		} else {
-			echo _MSG_ACTIVATION_SENT;
-			echo '<br /><br />Return to <a href="'.$CONF['IndexURL'].'" title="'.$CONF['SiteName'].'">'.$CONF['SiteName'].'</a>';
-			echo "\n</body>\n</html>";
+			// send message containing password.
+			$newmem = new MEMBER();
+			$newmem->readFromName($name);
+			$newmem->sendActivationLink('register');
+
+			$manager->notify('PostRegister', array('member' => &$newmem) );
+
+			if ( postVar('desturl') )
+			{
+				redirect(postVar('desturl') );
+			}
+			else
+			{
+				echo _MSG_ACTIVATION_SENT;
+				echo '<br /><br />Return to <a href="'.$CONF['IndexURL'].'" title="'.$CONF['SiteName'].'">'.$CONF['SiteName'].'</a>';
+				echo "\n</body>\n</html>";
+			}
+
+			exit;
 		}
-		exit;
-	}
+
 	}
 
+
 	/**
 	 *  Sends a new password
 	 */
-	function forgotPassword() {
-		$membername = trim(postVar('name'));
+	function forgotPassword()
+	{
+		$membername = trim(postVar('name') );
 
-		if (!MEMBER::exists($membername))
+		if ( !MEMBER::exists($membername) )
+		{
 			doError(_ERROR_NOSUCHMEMBER);
+		}
+
 		$mem = MEMBER::createFromName($membername);
 		
 		/* below keeps regular users from resetting passwords using forgot password feature
@@ -251,30 +317,40 @@
 			doError(_ERROR_NOLOGON_NOACTIVATE);*/
 
 		// check if e-mail address is correct
-		if (!($mem->getEmail() == postVar('email')))
+		if ( !($mem->getEmail() == postVar('email') ) )
+		{
 			doError(_ERROR_INCORRECTEMAIL);
+		}
 
 		// send activation link
 		$mem->sendActivationLink('forgot');
 
-		if (postVar('url')) {
-			redirect(postVar('url'));
-		} else {
+		if ( postVar('url') )
+		{
+			redirect(postVar('url') );
+		}
+		else
+		{
 			echo _MSG_ACTIVATION_SENT;
 			echo '<br /><br />Return to <a href="'.$CONF['IndexURL'].'" title="'.$CONF['SiteName'].'">'.$CONF['SiteName'].'</a>';
 		}
+
 		exit;
 	}
 
+
 	/**
 	 *  Handle karma votes
 	 */
-	function doKarma($type) {
+	function doKarma($type)
+	{
 		global $itemid, $member, $CONF, $manager;
 
 		// check if itemid exists
-		if (!$manager->existsItem($itemid,0,0))
+		if ( !$manager->existsItem($itemid, 0, 0) )
+		{
 			doError(_ERROR_NOSUCHITEM);
+		}
 
 		$blogid = getBlogIDFromItemID($itemid);
 		$this->checkban($blogid);
@@ -282,28 +358,36 @@
 		$karma =& $manager->getKarma($itemid);
 
 		// check if not already voted
-		if (!$karma->isVoteAllowed(serverVar('REMOTE_ADDR')))
+		if ( !$karma->isVoteAllowed(serverVar('REMOTE_ADDR') ) )
+		{
 			doError(_ERROR_VOTEDBEFORE);
+		}
 
 		// check if item does allow voting
-		$item =& $manager->getItem($itemid,0,0);
-		if ($item['closed'])
+		$item =& $manager->getItem($itemid, 0, 0);
+
+		if ( $item['closed'] )
+		{
 			doError(_ERROR_ITEMCLOSED);
+		}
 
-		switch($type) {
+		switch ( $type )
+		{
 			case 'pos':
 				$karma->votePositive();
-				break;
+			break;
+
 			case 'neg':
 				$karma->voteNegative();
-				break;
+			break;
 		}
 
 //		$blogid = getBlogIDFromItemID($itemid);
 		$blog =& $manager->getBlog($blogid);
 
 		// send email to notification address, if any
-		if ($blog->getNotifyAddress() && $blog->notifyOnVote()) {
+		if ( $blog->getNotifyAddress() && $blog->notifyOnVote() )
+		{
 
 			$mailto_msg = _NOTIFY_KV_MSG . ' ' . $itemid . "\n";
 //			if ($CONF['URLMode'] == 'pathinfo') {
@@ -312,15 +396,21 @@
 //				$itemLink = $CONF['IndexURL'] . createItemLink(intval($itemid));
 //			}
 //			$mailto_msg .= $CONF['IndexURL'] . 'index.php?itemid=' . $itemid . "\n\n";
-            $itemLink = createItemLink(intval($itemid));
-            $temp = parse_url($itemLink);
-            if (!$temp['scheme']) {
-                $itemLink = $CONF['IndexURL'] . $itemLink;
-            }
+			$itemLink = createItemLink(intval($itemid) );
+			$temp = parse_url($itemLink);
+
+			if ( !$temp['scheme'] )
+			{
+				$itemLink = $CONF['IndexURL'] . $itemLink;
+			}
+
 			$mailto_msg .= $itemLink . "\n\n";
-			if ($member->isLoggedIn()) {
+
+			if ( $member->isLoggedIn() )
+			{
 				$mailto_msg .= _NOTIFY_MEMBER . ' ' . $member->getDisplayName() . ' (ID=' . $member->getID() . ")\n";
 			}
+
 			$mailto_msg .= _NOTIFY_IP . ' ' . serverVar('REMOTE_ADDR') . "\n";
 			$mailto_msg .= _NOTIFY_HOST . ' ' .  gethostbyaddr(serverVar('REMOTE_ADDR'))  . "\n";
 			$mailto_msg .= _NOTIFY_VOTE . "\n " . $type . "\n";
@@ -330,100 +420,133 @@
 
 			$frommail = $member->getNotifyFromMailAddress();
 
-			$notify = new NOTIFICATION($blog->getNotifyAddress());
-			$notify->notify($mailto_title, $mailto_msg , $frommail);
+			$notify = new NOTIFICATION($blog->getNotifyAddress() );
+			$notify->notify($mailto_title, $mailto_msg, $frommail);
 		}
 
-
 		$refererUrl = serverVar('HTTP_REFERER');
-		if ($refererUrl) {
+
+		if ( $refererUrl )
+		{
 			$url = $refererUrl;
-		} else {
+		}
+		else
+		{
 //			$url = $CONF['IndexURL'] . 'index.php?itemid=' . $itemid;
 			$url = $itemLink;
 		}
+
 		redirect($url);
 		exit;
 	}
 
+
 	/**
 	  * Calls a plugin action
 	  */
-	function callPlugin() {
+	function callPlugin()
+	{
 		global $manager;
 
 		$pluginName = 'NP_' . requestVar('name');
 		$actionType = requestVar('type');
 
 		// 1: check if plugin is installed
-		if (!$manager->pluginInstalled($pluginName))
+		if ( !$manager->pluginInstalled($pluginName) )
+		{
 			doError(_ERROR_NOSUCHPLUGIN);
+		}
 
 		// 2: call plugin
 		$pluginObject =& $manager->getPlugin($pluginName);
-		if ($pluginObject)
+
+		if ( $pluginObject )
+		{
 			$error = $pluginObject->doAction($actionType);
+		}
 		else
+		{
 			$error = 'Could not load plugin (see actionlog)';
+		}
 
 		// doAction returns error when:
 		// - an error occurred (duh)
 		// - no actions are allowed (doAction is not implemented)
-		if ($error)
+		if ( $error )
+		{
 			doError($error);
+		}
 
 		exit;
 
 	}
 
+
 	/**
 	 *  Checks if an IP or IP range is banned
 	 */
-	function checkban($blogid) {
+	function checkban($blogid)
+	{
 		// check if banned
-		$ban = BAN::isBanned($blogid, serverVar('REMOTE_ADDR'));
-		if ($ban != 0) {
+		$ban = BAN::isBanned($blogid, serverVar('REMOTE_ADDR') );
+
+		if ( $ban != 0 )
+		{
 			doError(_ERROR_BANNED1 . $ban->iprange . _ERROR_BANNED2 . $ban->message . _ERROR_BANNED3);
 		}
 
 	}
 
+
 	/**
 	 * Gets a new ticket
 	 */
-	function updateTicket() {
+	function updateTicket()
+	{
 		global $manager;
-		if ($manager->checkTicket()) {
+
+		if ( $manager->checkTicket() )
+		{
 			echo $manager->getNewTicket();
 		}
-		else {
+		else
+		{
             echo _ERROR . ':' . _ERROR_BADTICKET;
 		}
-		return false;
+
+		return FALSE;
 	}
 
+
 	/**
 	 * Handles AutoSaveDraft
 	 */
-	function autoDraft() {
+	function autoDraft()
+	{
 		global $manager;
-		if ($manager->checkTicket()) {
+
+		if ( $manager->checkTicket() )
+		{
 			$manager->loadClass('ITEM');
 			$info = ITEM::createDraftFromRequest();
-			if ($info['status'] == 'error') {
+
+			if ( $info['status'] == 'error' )
+			{
 				echo $info['message'];
 			}
-			else {
+			else
+			{
 				echo $info['draftid'];
 			}
 		}
-		else {
+		else
+		{
             echo _ERROR . ':' . _ERROR_BADTICKET;
 		}
-		return false;
-	}
 
+		return FALSE;
+	}
 
 }
 
-?>
+?>
\ No newline at end of file
diff -x .svn -aruN 3.62.src/nucleus/libs/BaseActions.php 3.64.src/nucleus/libs/BaseActions.php
--- 3.62.src/nucleus/libs/BaseActions.php	2012-08-28 15:42:43.000000000 -0500
+++ 3.64.src/nucleus/libs/BaseActions.php	2012-08-28 15:42:34.000000000 -0500
@@ -17,7 +17,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: BaseActions.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: BaseActions.php 1498 2011-02-04 16:35:39Z ftruscot $
  */
 
 class BaseActions {
@@ -75,18 +75,11 @@
 	function parse_parsedinclude($filename) {
 		// check current level
 		if ($this->level > 3) return;	// max. depth reached (avoid endless loop)
-		global $skinid;
-		$skin = new SKIN($skinid);
 		$file = $this->getIncludeFileName($filename);
-		if (!$skin->isValid && !file_exists($file)) {
-			return;
-		}
-		$contents = $skin->getContent($filename);
-		if (!$contents) {
-            if (!file_exists($file)) return;
-            $contents = file_get_contents($file);
-            if (empty($contents)) return;
-		}
+		if (!file_exists($file)) return;
+        $contents = file_get_contents($file);
+        if (empty($contents)) return;
+		
 		$this->level = $this->level + 1;
 		// parse file contents
 		$this->parser->parse($contents);
diff -x .svn -aruN 3.62.src/nucleus/libs/BLOG.php 3.64.src/nucleus/libs/BLOG.php
--- 3.62.src/nucleus/libs/BLOG.php	2012-08-28 15:42:43.000000000 -0500
+++ 3.64.src/nucleus/libs/BLOG.php	2012-08-28 15:42:34.000000000 -0500
@@ -16,7 +16,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: BLOG.php 1469 2010-11-24 18:05:48Z ftruscot $
+ * @version $Id: BLOG.php 1500 2011-03-01 19:32:53Z ftruscot $
  */
 
 if ( !function_exists('requestVar') ) exit;
@@ -665,12 +665,23 @@
 		//$blogurl = createBlogLink($this->getURL(), $linkparams);
 
 		$template =& $manager->getTemplate($template);
+		
+		//: Change: Set nocatselected variable
+		if ($this->getSelectedCategory()) {
+			$nocatselected = 'no';
+		}
+		else {
+			$nocatselected = 'yes';
+		} 
 
 		echo TEMPLATE::fill((isset($template['CATLIST_HEADER']) ? $template['CATLIST_HEADER'] : null),
 							array(
 								'blogid' => $this->getID(),
 								'blogurl' => $blogurl,
-								'self' => $CONF['Self']
+								'self' => $CONF['Self'],
+								//: Change: Set catiscurrent template variable for header
+								'catiscurrent' => $nocatselected,
+								'currentcat' => $nocatselected 
 							));
 
 		$query = 'SELECT catid, cdesc as catdesc, cname as catname FROM '.sql_table('category').' WHERE cblog=' . $this->getID() . ' ORDER BY cname ASC';
@@ -691,15 +702,18 @@
 			$data['self'] = $CONF['Self'];
 			
 			//catiscurrent
+			//: Change: Bugfix for catiscurrent logic so it gives catiscurrent = no when no category is selected.
+			$data['catiscurrent'] = 'no';
+			$data['currentcat'] = 'no'; 
 			if ($this->getSelectedCategory()) {
 				if ($this->getSelectedCategory() == $data['catid']) {
 					$data['catiscurrent'] = 'yes';
 					$data['currentcat'] = 'yes';
 				}
-				else {
+				/*else {
 					$data['catiscurrent'] = 'no';
 					$data['currentcat'] = 'no';
-				}
+				}*/
 			}
 			else {
 				global $itemid;
@@ -710,10 +724,10 @@
 						$data['catiscurrent'] = 'yes';
 						$data['currentcat'] = 'yes';
 					}
-					else {
+					/*else {
 						$data['catiscurrent'] = 'no';
 						$data['currentcat'] = 'no';
-					}
+					}*/
 				}
 			}
 
@@ -736,7 +750,10 @@
 							array(
 								'blogid' => $this->getID(),
 								'blogurl' => $blogurl,
-								'self' => $CONF['Self']
+								'self' => $CONF['Self'],
+								//: Change: Set catiscurrent template variable for footer
+								'catiscurrent' => $nocatselected,
+								'currentcat' => $nocatselected  
 							));
 	}
 
diff -x .svn -aruN 3.62.src/nucleus/libs/COMMENTACTIONS.php 3.64.src/nucleus/libs/COMMENTACTIONS.php
--- 3.62.src/nucleus/libs/COMMENTACTIONS.php	2012-08-28 15:42:43.000000000 -0500
+++ 3.64.src/nucleus/libs/COMMENTACTIONS.php	2012-08-28 15:42:34.000000000 -0500
@@ -14,7 +14,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: COMMENTACTIONS.php 1472 2010-12-03 19:33:53Z gregorlove $
+ * @version $Id: COMMENTACTIONS.php 1507 2011-03-14 16:59:39Z ftruscot $
  */
 
 class COMMENTACTIONS extends BaseActions {
@@ -83,15 +83,15 @@
 	function setParser(&$parser) {
 		$this->parser =& $parser;
 	}
-	
+
 	function setCommentsObj(&$commentsObj) {
 		$this->commentsObj =& $commentsObj;
 	}
-	
+
 	function setTemplate($template) {
 		$this->template =& $template;
 	}
-	
+
 	function setCurrentComment(&$comment) {
 
 		global $manager;
@@ -204,7 +204,7 @@
 	function parse_commentcount() {
 			echo $this->commentsObj->commentcount;
 	}
-	
+
 	/**
 	 * Parse templatevar commentid
 	 */
@@ -245,7 +245,7 @@
 	function parse_excerpt() {
 		echo stringToXML(shorten($this->currentComment['body'], 60, '...'));
 	}
-	
+
 	/**
 	 * Parse templatevar host
 	 */
@@ -319,7 +319,7 @@
 				$this->currentComment['timestamp']
 			);
 	}
-	
+
 	/**
 	 * Parse templatevar timestamp
 	 */
@@ -359,17 +359,23 @@
 
 	/**
 	 * Parse templatevar user
+	 * @param string $mode
 	 */
-	function parse_user($mode='') {
+	function parse_user($mode = '')
+	{
 		global $manager;
-		if ($mode == 'realname' && $this->currentComment['memberid'] > 0) {
+
+		if ( $mode == 'realname' && $this->currentComment['memberid'] > 0 )
+		{
 			$member =& $manager->getMember($this->currentComment['memberid']);
 			echo $member->getRealName();
-		} else {
-			echo $this->currentComment['user'];
+		}
+		else
+		{
+			echo htmlspecialchars($this->currentComment['user'], ENT_QUOTES);
 		}
 	}
-	
+
 	/**
 	 * Parse templatevar useremail
 	 */
@@ -392,14 +398,14 @@
 //				echo str_replace('mailto:', '', $this->currentComment['userlinkraw']);
 		}
 	}
-	
+
 	/**
 	 * Parse templatevar userid
 	 */
 	function parse_userid() {
 			echo $this->currentComment['userid'];
 	}
-	
+
 
 	/**
 	 * Parse templatevar userlink
@@ -411,7 +417,7 @@
 			echo $this->currentComment['user'];
 		}
 	}
-	
+
 	/**
 	 * Parse templatevar userlinkraw
 	 */
@@ -426,7 +432,7 @@
 		if (!(strpos($this->currentComment['userlinkraw'], 'http://') === false))
 			echo $this->currentComment['userlinkraw'];
 	}
-	
+
 	/**
 	 * Parse templatevar userwebsitelink
 	 */
@@ -437,9 +443,9 @@
 			echo $this->currentComment['user'];
 		}
 	}
-	
+
 	// function to enable if-else-elseif-elseifnot-ifnot-endif to comment template fields
-	
+
 	/**
 	 * Checks conditions for if statements
 	 *
@@ -488,7 +494,7 @@
 				break;
 			case 'archivenextexists':
 				$condition = ($archivenextexists == true);
-				break; 
+				break;
 			case 'skintype':
 				$condition = ($name == $this->skintype);
 				break; */
@@ -500,8 +506,8 @@
 				break;
 		}
 		return $condition;
-	}	
-	
+	}
+
 	/**
 	 *  Different checks for a category
 	 */
@@ -525,16 +531,16 @@
 
 		return false;
 	}
-	
-		
+
+
 	/**
 	 *  Different checks for an author
 	 */
 	function _ifAuthor($name = '', $value='') {
 		global $member, $manager;
-		
+
 		if ($this->currentComment['memberid'] == 0) return false;
-		
+
 		$mem =& $manager->getMember($this->currentComment['memberid']);
 		$b =& $manager->getBlog(getBlogIDFromItemID($this->currentComment['itemid']));
 		$citem =& $manager->getItem($this->currentComment['itemid'],1,1);
@@ -547,26 +553,26 @@
 		// check comment author name
 		if ($name == 'name') {
 			$value = trim(strtolower($value));
-			if ($value == '') 
+			if ($value == '')
 				return false;
 			if ($value == strtolower($mem->getDisplayName()))
 				return true;
 		}
 
 		// check if comment author is admin
-		if ($name == 'isadmin') {			
-			$blogid = intval($b->getID());			
+		if ($name == 'isadmin') {
+			$blogid = intval($b->getID());
 			if ($mem->isAdmin())
 				return true;
-				
+
 			return $mem->isBlogAdmin($blogid);
 		}
-		
+
 		// check if comment author is item author
-		if ($name == 'isauthor') {			
+		if ($name == 'isauthor') {
 			return (intval($citem['authorid']) == intval($this->currentComment['memberid']));
 		}
-		
+
 		// check if comment author is on team
 		if ($name == 'isonteam') {
 			return $mem->teamRights(intval($b->getID()));
@@ -574,13 +580,13 @@
 
 		return false;
 	}
-	
+
 	/**
 	 *  Different checks for a category
 	 */
 	function _ifItemCategory($name = '', $value='') {
 		global $catid, $manager;
-		
+
 		$b =& $manager->getBlog(getBlogIDFromItemID($this->currentComment['itemid']));
 		$citem =& $manager->getItem($this->currentComment['itemid'],1,1);
 		$icatid = $citem['catid'];
@@ -588,7 +594,7 @@
 		// when no parameter is defined, just check if a category is selected
 		if (($name != 'catname' && $name != 'catid') || ($value == ''))
 			return $b->isValidCategory($icatid);
-			
+
 		// check category name
 		if ($name == 'catname') {
 			$value = $b->getCategoryIdFromName($value);
@@ -603,15 +609,15 @@
 		return false;
 	}
 
-	
+
 	/**
 	 *  Checks if a member is on the team of a blog and return his rights
 	 */
 	function _ifOnTeam($blogName = '') {
 		global $blog, $member, $manager;
-		
+
 		$b =& $manager->getBlog(getBlogIDFromItemID($this->currentComment['itemid']));
-		
+
 		// when no blog found
 		if (($blogName == '') && (!is_object($b)))
 			return 0;
@@ -634,7 +640,7 @@
 		global $blog, $member, $manager;
 
 		$b =& $manager->getBlog(getBlogIDFromItemID($this->currentComment['itemid']));
-		
+
 		// when no blog found
 		if (($blogName == '') && (!is_object($b)))
 			return 0;
@@ -650,7 +656,7 @@
 		return $member->isBlogAdmin($blogid);
 	}
 
-	
+
 	/**
 	 *	hasplugin,PlugName
 	 *	   -> checks if plugin exists
diff -x .svn -aruN 3.62.src/nucleus/libs/COMMENT.php 3.64.src/nucleus/libs/COMMENT.php
--- 3.62.src/nucleus/libs/COMMENT.php	2012-08-28 15:42:43.000000000 -0500
+++ 3.64.src/nucleus/libs/COMMENT.php	2012-08-28 15:42:34.000000000 -0500
@@ -15,7 +15,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2007 The Nucleus Group
- * @version $Id: COMMENT.php 1487 2010-12-21 17:19:05Z gregorlove $
+ * @version $Id: COMMENT.php 1507 2011-03-14 16:59:39Z ftruscot $
  */
 class COMMENT {
 
@@ -44,7 +44,8 @@
 	  *
 	  * @static
 	  */
-	function prepare($comment) {
+	function prepare($comment)
+	{
 		$comment['user'] = strip_tags($comment['user']);
 		$comment['userid'] = strip_tags($comment['userid']);
 		$comment['email'] = strip_tags($comment['email']);
@@ -55,7 +56,8 @@
 		$comment['email'] = trim(strtr($comment['email'], "\'\"\n", '-- ') );
 
 		// begin if: a comment userid is supplied, but does not have an "http://" or "https://" at the beginning - prepend an "http://"
-		if ( !empty($comment['userid']) && (strpos($comment['userid'], 'http://') !== 0) && (strpos($comment['userid'], 'https://') !== 0) ) {
+		if ( !empty($comment['userid']) && (strpos($comment['userid'], 'http://') !== 0) && (strpos($comment['userid'], 'https://') !== 0) )
+		{
 			$comment['userid'] = 'http://' . $comment['userid'];
 		} // end if
 
@@ -92,23 +94,21 @@
 
 		// create hyperlinks for http:// addresses
 		// there's a testcase for this in /build/testcases/urllinking.txt
-		$replaceFrom = array(
-			'/([^:\/\/\w]|^)((https:\/\/)([\w\.-]+)([\/\w+\.~%&?@=_:;#,-]+))/ie',
-			'/([^:\/\/\w]|^)((http:\/\/|www\.)([\w\.-]+)([\/\w+\.~%&?@=_:;#,-]+))/ie',
-			'/([^:\/\/\w]|^)((ftp:\/\/|ftp\.)([\w\.-]+)([\/\w+\.~%&?@=_:;#,-]+))/ie',
-			'/([^:\/\/\w]|^)(mailto:(([a-zA-Z\@\%\.\-\+_])+))/ie'
-		);
-		$replaceTo = array(
-			'COMMENT::createLinkCode("\\1", "\\2", "https")',
-			'COMMENT::createLinkCode("\\1", "\\2", "http")',
-			'COMMENT::createLinkCode("\\1", "\\2", "ftp")',
-			'COMMENT::createLinkCode("\\1", "\\3", "mailto")'
+
+		$replace_from = array(
+			'/([^:\/\/\w]|^)((https:\/\/)([\w\.-]+)([\/\w+\.~%&?@=_:;#,-]+))/i',
+			'/([^:\/\/\w]|^)((http:\/\/|www\.)([\w\.-]+)([\/\w+\.~%&?@=_:;#,-]+))/i',
+			'/([^:\/\/\w]|^)((ftp:\/\/|ftp\.)([\w\.-]+)([\/\w+\.~%&?@=_:;#,-]+))/i',
+			'/([^:\/\/\w]|^)(mailto:(([a-zA-Z\@\%\.\-\+_])+))/i'
 		);
-		$body = preg_replace($replaceFrom, $replaceTo, $body);
+
+		$body = preg_replace_callback($replace_from, array('self', 'prepareBody_cb'), $body);
 
 		return $body;
 	}
 
+
+
 	/**
 	 * Creates a link code for unlinked URLs with different protocols
 	 *
@@ -165,6 +165,39 @@
 		return $pre . '<a href="' . $linkedUrl . '" rel="nofollow">' . shorten($displayedUrl,30,'...') . '</a>' . $post;
 	}
 
+
+	/**
+	 * This method is a callback for creating link codes
+	 * @param array $match
+	 * @return string
+	 */
+	function prepareBody_cb($match)
+	{
+		if ( !preg_match('/^[a-z]+/i', $match[2], $protocol) )
+		{
+			return $match[0];
+		}
+
+		switch( strtolower($protocol[0]) )
+		{
+			case 'https':
+				return self::createLinkCode($match[1], $match[2], 'https');
+			break;
+
+			case 'ftp':
+				return self::createLinkCode($match[1], $match[2], 'ftp');
+			break;
+
+			case 'mailto':
+				return self::createLinkCode($match[1], $match[3], 'mailto');
+			break;
+
+			default:
+				return self::createLinkCode($match[1], $match[2], 'http');
+			break;
+		}
+	}
+
 }
 
 ?>
\ No newline at end of file
diff -x .svn -aruN 3.62.src/nucleus/libs/COMMENTS.php 3.64.src/nucleus/libs/COMMENTS.php
--- 3.62.src/nucleus/libs/COMMENTS.php	2012-08-28 15:42:43.000000000 -0500
+++ 3.64.src/nucleus/libs/COMMENTS.php	2012-08-28 15:42:34.000000000 -0500
@@ -15,7 +15,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: COMMENTS.php 1474 2010-12-04 20:10:32Z gregorlove $
+ * @version $Id: COMMENTS.php 1507 2011-03-14 16:59:39Z ftruscot $
  */
 
 if ( !function_exists('requestVar') ) exit;
@@ -133,8 +133,12 @@
 
 	/**
 	 * Adds a new comment to the database
+	 * @param string $timestamp
+	 * @param array $comment
+	 * @return mixed
 	 */
-	function addComment($timestamp, $comment) {
+	function addComment($timestamp, $comment)
+	{
 		global $CONF, $member, $manager;
 
 		$blogid = getBlogIDFromItemID($this->itemid);
@@ -142,105 +146,167 @@
 		$settings =& $manager->getBlog($blogid);
 		$settings->readSettings();
 
-		if (!$settings->commentsEnabled())
+		// begin if: comments disabled
+		if ( !$settings->commentsEnabled() )
+		{
 			return _ERROR_COMMENTS_DISABLED;
+		} // end if
 
-		if (!$settings->isPublic() && !$member->isLoggedIn())
+		// begin if: public cannot comment
+		if ( !$settings->isPublic() && !$member->isLoggedIn() )
+		{
 			return _ERROR_COMMENTS_NONPUBLIC;
+		} // end if
 
-		// member name protection
-		if ($CONF['ProtectMemNames'] && !$member->isLoggedIn() && MEMBER::isNameProtected($comment['user']))
+		// begin if: comment uses a protected member name
+		if ( $CONF['ProtectMemNames'] && !$member->isLoggedIn() && MEMBER::isNameProtected($comment['user']) )
+		{
 			return _ERROR_COMMENTS_MEMBERNICK;
+		} // end if
 
-		// email required protection
-		if ($settings->emailRequired() && strlen($comment['email']) == 0 && !$member->isLoggedIn()) {
+		// begin if: email required, but missing (doesn't apply to members)
+		if ( $settings->emailRequired() && strlen($comment['email']) == 0 && !$member->isLoggedIn() )
+		{
 			return _ERROR_EMAIL_REQUIRED;
-		}
+		} // end if
+
+		## Note usage of mb_strlen() vs strlen() below ##
+
+		// begin if: commenter's name is too long
+		if ( strlen($comment['user']) > 40 )
+		{
+			return _ERROR_USER_TOO_LONG;
+		} // end if
+
+		// begin if: commenter's email is too long
+		if ( strlen($comment['email']) > 100 )
+		{
+			return _ERROR_EMAIL_TOO_LONG;
+		} // end if
+
+		// begin if: commenter's url is too long
+		if ( strlen($comment['userid']) > 100 )
+		{
+			return _ERROR_URL_TOO_LONG;
+		} // end if
 
 		$comment['timestamp'] = $timestamp;
-		$comment['host'] = gethostbyaddr(serverVar('REMOTE_ADDR'));
+		$comment['host'] = gethostbyaddr(serverVar('REMOTE_ADDR') );
 		$comment['ip'] = serverVar('REMOTE_ADDR');
 
-		// if member is logged in, use that data
-		if ($member->isLoggedIn()) {
+		// begin if: member is logged in, use that data
+		if ( $member->isLoggedIn() )
+		{
 			$comment['memberid'] = $member->getID();
 			$comment['user'] = '';
 			$comment['userid'] = '';
 			$comment['email'] = '';
-		} else {
+		}
+		else
+		{
 			$comment['memberid'] = 0;
 		}
 
 		// spam check
-		$continue = false;
+		$continue = FALSE;
 		$plugins = array();
 
-		if (isset($manager->subscriptions['ValidateForm']))
+		if ( isset($manager->subscriptions['ValidateForm']) )
+		{
 			$plugins = array_merge($plugins, $manager->subscriptions['ValidateForm']);
+		}
 
-		if (isset($manager->subscriptions['PreAddComment']))
+		if ( isset($manager->subscriptions['PreAddComment']) )
+		{
 			$plugins = array_merge($plugins, $manager->subscriptions['PreAddComment']);
+		}
 
-		if (isset($manager->subscriptions['PostAddComment']))
+		if ( isset($manager->subscriptions['PostAddComment']) )
+		{
 			$plugins = array_merge($plugins, $manager->subscriptions['PostAddComment']);
+		}
 
 		$plugins = array_unique($plugins);
 
-		while (list(,$plugin) = each($plugins)) {
+		while ( list(, $plugin) = each($plugins) )
+		{
 			$p = $manager->getPlugin($plugin);
 			$continue = $continue || $p->supportsFeature('handleSpam');
 		}
 
-		$spamcheck = array (
+		$spamcheck = array(
 			'type'  	=> 'comment',
 			'body'		=> $comment['body'],
 			'id'        => $comment['itemid'],
-			'live'   	=> true,
+			'live'   	=> TRUE,
 			'return'	=> $continue
 		);
 
-		if ($member->isLoggedIn()) {
+		// begin if: member logged in
+		if ( $member->isLoggedIn() )
+		{
 			$spamcheck['author'] = $member->displayname;
 			$spamcheck['email'] = $member->email;
-		} else {
+		}
+		// else: public
+		else
+		{
 			$spamcheck['author'] = $comment['user'];
 			$spamcheck['email'] = $comment['email'];
 			$spamcheck['url'] = $comment['userid'];
-		}
+		} // end if
 
-		$manager->notify('SpamCheck', array ('spamcheck' => &$spamcheck));
+		$manager->notify('SpamCheck', array('spamcheck' => &$spamcheck) );
 
-		if (!$continue && isset($spamcheck['result']) && $spamcheck['result'] == true)
+		if ( !$continue && isset($spamcheck['result']) && $spamcheck['result'] == TRUE )
+		{
 			return _ERROR_COMMENTS_SPAM;
-
+		}
 
 		// isValidComment returns either "1" or an error message
 		$isvalid = $this->isValidComment($comment, $spamcheck);
-		if ($isvalid != 1)
+
+		if ( $isvalid != 1 )
+		{
 			return $isvalid;
+		}
 
-		// send email to notification address, if any
-		if ($settings->getNotifyAddress() && $settings->notifyOnComment()) {
+		// begin if: send email to notification address
+		if ( $settings->getNotifyAddress() && $settings->notifyOnComment() )
+		{
 
 			$mailto_msg = _NOTIFY_NC_MSG . ' ' . $this->itemid . "\n";
 //			$mailto_msg .= $CONF['IndexURL'] . 'index.php?itemid=' . $this->itemid . "\n\n";
 			$temp = parse_url($CONF['Self']);
-			if ($temp['scheme']) {
+
+			if ( $temp['scheme'] )
+			{
 				$mailto_msg .= createItemLink($this->itemid) . "\n\n";
-			} else {
+			}
+			else
+			{
 				$tempurl = $settings->getURL();
-				if (substr($tempurl, -1) == '/' || substr($tempurl, -4) == '.php') {
+
+				if ( substr($tempurl, -1) == '/' || substr($tempurl, -4) == '.php' )
+				{
 					$mailto_msg .= $tempurl . '?itemid=' . $this->itemid . "\n\n";
-				} else {
+				}
+				else
+				{
 					$mailto_msg .= $tempurl . '/?itemid=' . $this->itemid . "\n\n";
 				}
 			}
-			if ($comment['memberid'] == 0) {
+
+			if ( $comment['memberid'] == 0 )
+			{
 				$mailto_msg .= _NOTIFY_USER . ' ' . $comment['user'] . "\n";
 				$mailto_msg .= _NOTIFY_USERID . ' ' . $comment['userid'] . "\n";
-			} else {
+			}
+			else
+			{
 				$mailto_msg .= _NOTIFY_MEMBER .' ' . $member->getDisplayName() . ' (ID=' . $member->getID() . ")\n";
 			}
+
 			$mailto_msg .= _NOTIFY_HOST . ' ' . $comment['host'] . "\n";
 			$mailto_msg .= _NOTIFY_COMMENT . "\n " . $comment['body'] . "\n";
 			$mailto_msg .= getMailFooter();
@@ -250,13 +316,13 @@
 
 			$frommail = $member->getNotifyFromMailAddress($comment['email']);
 
-			$notify =& new NOTIFICATION($settings->getNotifyAddress());
+			$notify =& new NOTIFICATION($settings->getNotifyAddress() );
 			$notify->notify($mailto_title, $mailto_msg , $frommail);
 		}
 
 		$comment = COMMENT::prepare($comment);
 
-		$manager->notify('PreAddComment',array('comment' => &$comment, 'spamcheck' => &$spamcheck));
+		$manager->notify('PreAddComment', array('comment' => &$comment, 'spamcheck' => &$spamcheck) );
 
 		$name		= sql_real_escape_string($comment['user']);
 		$url		= sql_real_escape_string($comment['userid']);
@@ -277,7 +343,9 @@
 					. ' AND citem   = "' . $itemid . '"'
 					. ' AND cblog   = "' . $blogid . '"';
 		$result     = (integer) quickQuery($qSql);
-		if ($result > 0) {
+
+		if ( $result > 0 )
+		{
 			return _ERROR_BADACTION;
 		}
 
@@ -288,12 +356,13 @@
 
 		// post add comment
 		$commentid = sql_insert_id();
-		$manager->notify('PostAddComment',array('comment' => &$comment, 'commentid' => &$commentid, 'spamcheck' => &$spamcheck));
+		$manager->notify('PostAddComment', array('comment' => &$comment, 'commentid' => &$commentid, 'spamcheck' => &$spamcheck) );
 
 		// succeeded !
-		return true;
+		return TRUE;
 	}
 
+
 	/**
 	 * Checks if a comment is valid and call plugins
 	 * that can check if the comment is a spam comment	  
diff -x .svn -aruN 3.62.src/nucleus/libs/globalfunctions.php 3.64.src/nucleus/libs/globalfunctions.php
--- 3.62.src/nucleus/libs/globalfunctions.php	2012-08-28 15:42:43.000000000 -0500
+++ 3.64.src/nucleus/libs/globalfunctions.php	2012-08-28 15:42:34.000000000 -0500
@@ -13,14 +13,14 @@
 /**
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: globalfunctions.php 1493 2011-01-06 19:03:55Z ftruscot $
+ * @version $Id: globalfunctions.php 1507 2011-03-14 16:59:39Z ftruscot $
 
  */
 
 // needed if we include globalfunctions from install.php
 global $nucleus, $CONF, $DIR_LIBS, $DIR_LANG, $manager, $member;
 
-$nucleus['version'] = 'v3.62';
+$nucleus['version'] = 'v3.64';
 $nucleus['codename'] = '';
 
 // check and die if someone is trying to override internal globals (when register_globals turn on)
@@ -49,7 +49,10 @@
         directory) are still on the server.
 */
 
-$CONF['alertOnHeadersSent']  = 1;
+if (!isset($CONF['alertOnHeadersSent']) || (isset($CONF['alertOnHeadersSent'])&& $CONF['alertOnHeadersSent'] !== 0))
+{
+	$CONF['alertOnHeadersSent']  = 1;
+}
 $CONF['alertOnSecurityRisk'] = 1;
 /*$CONF['ItemURL']           = $CONF['Self'];
 $CONF['ArchiveURL']          = $CONF['Self'];
@@ -497,7 +500,8 @@
                     $i++;
 
                     if ($i < sizeof($data) ) {
-                        $_REQUEST['special'] = $data[$i];
+                        $special = $data[$i];
+						$_REQUEST['special'] = $special;	
                     }
                     break;
 
@@ -559,7 +563,7 @@
   * returns the currently used version (100 = 1.00, 101 = 1.01, etc...)
   */
 function getNucleusVersion() {
-    return 362;
+    return 364;
 }
 
 /**
@@ -1589,7 +1593,37 @@
         if ($CONF['URLMode'] == 'pathinfo') {
 
             foreach ($params as $param => $value) {
-                $link .= '/' . $param . '/' . urlencode($value);
+                // change in 3.63 to fix problem where URL generated with extra params mike look like category/4/blogid/1
+				// but they should use the URL keys like this: category/4/blog/1
+				// if user wants old urls back, set $CONF['NoURLKeysInExtraParams'] = 1; in config.php
+                if (isset($CONF['NoURLKeysInExtraParams']) && $CONF['NoURLKeysInExtraParams'] == 1) 
+				{
+					$link .= '/' . $param . '/' . urlencode($value);
+				} else {
+					switch ($param) {
+						case 'itemid':
+							$link .= '/' . $CONF['ItemKey'] . '/' . urlencode($value);
+						break;
+						case 'memberid':
+							$link .= '/' . $CONF['MemberKey'] . '/' . urlencode($value);
+						break;
+						case 'catid':
+							$link .= '/' . $CONF['CategoryKey'] . '/' . urlencode($value);
+						break;
+						case 'archivelist':
+							$link .= '/' . $CONF['ArchivesKey'] . '/' . urlencode($value);
+						break;
+						case 'archive':
+							$link .= '/' . $CONF['ArchiveKey'] . '/' . urlencode($value);
+						break;
+						case 'blogid':
+							$link .= '/' . $CONF['BlogKey'] . '/' . urlencode($value);
+						break;
+						default:
+							$link .= '/' . $param . '/' . urlencode($value);
+						break;
+					}
+				}
             }
 
         } else {
@@ -2296,23 +2330,11 @@
  * @return String cleaned filename ready for use
  */
 function cleanFileName($str) {
-	// below commented out because of issues with UTF-8 compatibility
-	/*$cleaner = array();
-	$cleaner[] = array('expression'=>"/[]/",'replace'=>"a");
-	$cleaner[] = array('expression'=>"/[]/",'replace'=>"e");
-	$cleaner[] = array('expression'=>"/[]/",'replace'=>"i");
-	$cleaner[] = array('expression'=>"/[]/",'replace'=>"o");
-	$cleaner[] = array('expression'=>"/[]/",'replace'=>"u");
-	$cleaner[] = array('expression'=>"/[]/",'replace'=>"n");
-	$cleaner[] = array('expression'=>"/[]/",'replace'=>"c");*/
-	
 	$str = strtolower($str);
 	$ext_point = strrpos($str,".");
 	if ($ext_point===false) return false;
 	$ext = substr($str,$ext_point,strlen($str));
 	$str = substr($str,0,$ext_point);
-	
-	//foreach( $cleaner as $cv ) $str = preg_replace($cv["expression"],$cv["replace"],$str);
 
 	return preg_replace("/[^a-z0-9-]/","_",$str).$ext;
 }
