diff -x .svn -aruN 3.51.src/config.php.sample 3.61.src/config.php.sample
--- 3.51.src/config.php.sample	1969-12-31 18:00:00.000000000 -0600
+++ 3.61.src/config.php.sample	2010-12-19 00:16:52.000000000 -0600
@@ -0,0 +1,42 @@
+<?php
+
+// This file contains variables with the locations of the data dirs
+// and basic functions that every page can use
+
+// mySQL connection information
+$MYSQL_HOST = 'hostname';
+$MYSQL_USER = 'username';
+$MYSQL_PASSWORD = 'password';
+$MYSQL_DATABASE = 'databasename';
+$MYSQL_PREFIX = '';
+
+// new in 3.50. first element is db handler, the second is the db driver used by the handler
+// default is $MYSQL_HANDLER = array('mysql','mysql');
+//$MYSQL_HANDLER = array('mysql','mysql');
+//$MYSQL_HANDLER = array('pdo','mysql');
+$MYSQL_HANDLER = array('mysql','');
+
+// main nucleus directory
+$DIR_NUCLEUS = '/your/path/to/nucleus/';
+
+// media dir
+$DIR_MEDIA = '/your/path/to/media/';
+
+// extra skin files for imported skins
+$DIR_SKINS = '/your/path/to/skins/';
+
+// these dirs are normally subdirs of the nucleus dir, but
+// you can redefine them if you wish
+$DIR_PLUGINS = $DIR_NUCLEUS . 'plugins/';
+$DIR_LANG = $DIR_NUCLEUS . 'language/';
+$DIR_LIBS = $DIR_NUCLEUS . 'libs/';
+
+if (!@file_exists($DIR_LIBS . 'globalfunctions.php')) {
+	echo "Configuration error, please run the install script or modify config.php";
+	exit;
+}
+
+// include libs
+include($DIR_LIBS.'globalfunctions.php');
+
+?>
\ No newline at end of file
diff -x .svn -aruN 3.51.src/install_lang_english.php 3.61.src/install_lang_english.php
--- 3.51.src/install_lang_english.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/install_lang_english.php	1969-12-31 18:00:00.000000000 -0600
@@ -1,155 +0,0 @@
-<?php
-/*
- * Nucleus: PHP/MySQL Weblog CMS (http://nucleuscms.org/)
- * Copyright (C) 2002-2007 The Nucleus Group
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version 2
- * of the License, or (at your option) any later version.
- * (see nucleus/documentation/index.html#license for more info)
- */
-
-/**
- * @license http://nucleuscms.org/license.txt GNU General Public License
- * @copyright Copyright (C) 2002-2007 The Nucleus Group
- * @version $Id: install.php 1227 2007-12-14 16:48:40Z ehui $
- */
-
-define('_ERROR1',	'Your PHP version does not have support for MySQL :(');
-define('_ERROR2',	'mySQL database name missing');
-define('_ERROR3',	'mySQL prefix was selected, but prefix is empty');
-define('_ERROR4',	'mySQL prefix should only contain characters from the ranges A-Z, a-z, 0-9 or underscores');
-define('_ERROR5',	'One of the URLs does not end with a slash, or action url does not end with \'action.php\'');
-define('_ERROR6',	'The path of the administration area does not end with a slash');
-define('_ERROR7',	'The media path does not end with a slash');
-define('_ERROR8',	'The skins path does not end with a slash');
-define('_ERROR9',	'The path of the administration area does not exist on your server');
-define('_ERROR10',	'Invalid e-mail address given for user');
-define('_ERROR11',	'User name is not a valid display name (allowed chars: a-zA-Z0-9 and spaces)');
-define('_ERROR12',	'User password is empty');
-define('_ERROR13',	'User password do not match');
-define('_ERROR14',	'Invalid short name given for blog (allowed chars: a-z0-9, no spaces)');
-define('_ERROR15',	'Could not connect to mySQL server');
-define('_ERROR16',	'Could not create database. Make sure you have the rights to do so. SQL error was');
-define('_ERROR17',	'Could not select database. Make sure it exists');
-define('_ERROR18',	'Error while executing query');
-define('_ERROR19',	'Error while setting member settings');
-define('_ERROR20',	'Error while setting weblog settings');
-define('_ERROR21',	'Error with query');
-define('_ERROR22',	'Unable to install plugin ');
-define('_ERROR23_1',	'Unable to import ');
-define('_ERROR23_2',	'file does not exist');
-define('_ERROR24',	'Unable to import ');
-define('_ERROR25_1',	'File <b>');
-define('_ERROR25_2',	'</b> is missing or not readable.');
-define('_ERROR26',	'Query error while trying to update config');
-define('_ERROR27',	'Error!');
-define('_ERROR28',	'Error message was');
-define('_ERROR29',	'Error message were');
-define('_ERROR30',	'Error while executing query');
-
-define('_NOTIFICATION1',	'Not available');
-
-define('_TITLE',	'Nuclues Install');
-define('_TITLE2',	'Skin/Plugin Install Errors');
-define('_TITLE3',	'Installation Almost Complete!');
-define('_TITLE4',	'Installation complete!');
-define('_TITLE5',	'Fight against Spam');
-
-define('_HEADER1', 	'Install Nucleus');
-define('_TEXT1',	'<p>This script will help you to install Nucleus. It will set up your MySQL database tables and provide you with the information you need to enter in <i>config.php</i>. In order to do all this, you need to enter some information.</p><p>All fields are mandatory. Optional information can be set from the Nucleus admin-area when installation is completed.</p>');
-
-define('_HEADER2',	'PHP &amp; MySQL Versions');
-define('_TEXT2',	'<p>Below are the version numbers of the PHP interpreter and the MySQL server on your webhost. When reporting problems on the Nucleus Support Forum, please include this information.</p>');
-define('_TEXT2_WARN',	'WARNING: Nucleus requires at least PHP ');
-define('_TEXT2_WARN2',	'INFORMATION: Nucleus requires at least MySQL ');
-define('_TEXT2_WARN3',	'WARNING: You are installing NucleusCMS on a older version of PHP. PHP4 support will be depreciated in the next release, please consider upgrade to PHP5!');
-
-define('_HEADER3',	'Automatic <i>config.php</i> Update');
-define('_TEXT3',	'<p>If you want Nucleus to automatically update the <em>config.php</em> file, you\'ll need to make it writable. You can do this by changing the file permissions to <strong>666</strong>. After Nucleus is successfully installed, you can change the permissions back to <strong>444</strong> (<a href="nucleus/documentation/tips.html#filepermissions">Quick guide on how to change file permissions</a>).</p> <p>If you choose not to make your file writable (or are unable to do so): don\'t worry. The installation process will provide you with the contents of the <em>config.php</em> file so you can upload it yourself.</p>');
-
-define('_HEADER4',	'MySQL Login Data');
-define('_TEXT4',	'<p>Enter your MySQL data below. This install script needs it to be able to create and fill your database tables. Afterwards, you\'ll also need to fill it out in <i>config.php</i>.</p> <p>If you don\'t know this information, contact your system administrator for more info. Often, the hostname will be \'localhost\'. If Nucleus found a \'default MySQL host\' in the PHP settings of your server, this host is already listed in the \'hostname\' field. There\'s no guarantee that this information is correct, though.</p>');
-define('_TEXT4_TAB_HEAD',	'General Database Settings');
-define('_TEXT4_TAB_FIELD1',	'Hostname');
-define('_TEXT4_TAB_FIELD2',	'Username');
-define('_TEXT4_TAB_FIELD3',	'Password');
-define('_TEXT4_TAB_FIELD4',	'Database');
-define('_TEXT4_TAB_FIELD4_ADD',	'needs to be created');
-
-define('_TEXT4_TAB2_HEAD',	'Advanced Database Settings');
-define('_TEXT4_TAB2_FIELD',	'Use table prefix');
-define('_TEXT4_TAB2_ADD',	'<p>Unless you\'re installing multiple Nucleus installations in one single database and know what you\'re doing, <strong>you really shouldn\'t change this</strong>.</p> <p>All database tables generated by Nucleus will start with this prefix.</p>');
-
-define('_HEADER5',	'Directories and URLs');
-define('_TEXT5',	'<p>This install script has attempted to find out the directories and URLs in which Nucleus is installed. Please check the values below and correct if necessary. The URLs and file paths should end with a slash.</p>');
-
-define('_TEXT5_TAB_HEAD',	'URLs and directories');
-define('_TEXT5_TAB_FIELD1',	'Site <strong>URL</strong>');
-define('_TEXT5_TAB_FIELD2',	'Admin-area <strong>URL</strong>');
-define('_TEXT5_TAB_FIELD3',	'Admin-area <strong>path</strong>');
-define('_TEXT5_TAB_FIELD4',	'Media files <strong>URL</strong>');
-define('_TEXT5_TAB_FIELD5',	'Media directory <strong>path</strong>');
-define('_TEXT5_TAB_FIELD6',	'Extra skin files <strong>URL</strong>');
-define('_TEXT5_TAB_FIELD7',	'Extra skin files directory <strong>path</strong>');
-define('_TEXT5_TAB_FIELD7_2',	'this is where imported skins can place their extra files');
-define('_TEXT5_TAB_FIELD8',	'Plugin files <strong>URL</strong>');
-define('_TEXT5_TAB_FIELD9',	'Action <strong>URL</strong>');
-define('_TEXT5_TAB_FIELD9_2',	'absolute location of the <tt>action.php</tt> file');
-define('_TEXT5_2',	'<p class="note"><strong>Note: Use absolute paths</strong> instead of relative paths. Usually, an absolute path will start with something like <tt>/home/username/public_html/</tt>. On Unix systems (most servers), paths should start with a slash. If you have trouble filling out this information, you should ask your administrator what to fill out.</p>');
-
-define('_HEADER6',	'Administrator User');
-define('_TEXT6',	'<p>Below, you need to enter some information to create the first user of your site.</p>');
-define('_TEXT6_TAB_HEAD',	'Administrator User');
-define('_TEXT6_TAB_FIELD1',	'Display Name');
-define('_TEXT6_TAB_FIELD1_2',	'allowed characters: a-z and 0-9, spaces allowed inside');
-define('_TEXT6_TAB_FIELD2',	'Real Name');
-define('_TEXT6_TAB_FIELD3',	'Password');
-define('_TEXT6_TAB_FIELD4',	'Password Again');
-define('_TEXT6_TAB_FIELD5',	'E-mail Address');
-define('_TEXT6_TAB_FIELD5_2',	'needs to be a valid e-mail address');
-
-define('_HEADER7',	'Weblog Data');
-define('_TEXT7',	'<p>Below, you need to enter some information to create a default weblog. The name of this weblog will also be used as name for your site</p>');
-define('_TEXT7_TAB_HEAD',	'Weblog Data');
-define('_TEXT7_TAB_FIELD1',	'Blog Name');
-define('_TEXT7_TAB_FIELD2',	'Blog Short Name');
-define('_TEXT7_TAB_FIELD2_2',	'allowed characters: a-z and 0-9, no spaces allowed');
-
-define('_HEADER8',	'Weblog Ping');
-define('_TEXT8_TAB_HEADER',	'Weblog Ping');
-define('_TEXT8_TAB_FIELD1',	'Install NP_Ping weblog pinging plugin');
-
-define('_HEADER9',	'Submit');
-define('_TEXT9',	'<p>Verify the data above, and click the button below to set up your database tables and initial data. This can take a while, so have patience. <strong>ONLY CLICK THE BUTTON ONCE !</strong></p>');
-
-define('_TEXT10',	'<p>The database tables have been initialized successfully. What still needs to be done is to change the contents of <i>config.php</i>. Below is how it should look like (the mysql password is masked, so you\'ll have to fill that out yourself)</p>');
-define('_TEXT11',	'<p>After you changed the file on your computer, upload it to your web server using FTP. Make sure you use ASCII mode to send over the files.</p>');
-define('_TEXT12',	'<b>Note:</b> Make sure that you have no spaces at the beginning or end of the <i>config.php</i> file. These would cause errors to happen when performing certain actions.<br /> Thus, the first character of config.php should be "&lt;", and the last character should be "&gt;".');
-define('_TEXT13',	'<p>Nucleus has been installed, and your <code>config.php</code> has been updated for you.</p> <p>Don\'t forget to change the permissions on <code>config.php</code> back to 444 for security (<a href="nucleus/documentation/tips.html#filepermissions">Quick guide on how to change file permissions</a>).</p>');
-define('_TEXT14',	'<p>Nucleus CMS allows every visitor to write comments in blogs. So there is a high risk that spammers abuse this function. We recommend that you protect your blog with one of the following methods:</p>');
-define('_TEXT14_L1',	'If you don\\\'t want comments you can disable them individually for each blog: Go to the hompage of the Admin area and choose <b>Your Weblog > Settings > Comments enabled > No</b>.');
-define('_TEXT14_L2',	'Install one of serveral plugins that help to avoid spam comments: <a href="http://faq.nucleuscms.org/item/45">How can I stop comment and trackback spam?</a> (you could bookmark this page to read it later).');
-define('_HEADER10',	'Delete your install files');
-define('_TEXT15',	'<p>Files you should delete from your web server:</p>');
-define('_TEXT15_L1',	'<b>install.sql</b>: file containing table structures');
-define('_TEXT15_L2',	'<b>install.php</b>: this file');
-
-define('_TEXT16',	'<p>If you don\\\'t delete these files, you won\\\'t be able to open the admin area</p>');
-
-define('_HEADER11',	'Visit your web site');
-define('_TEXT16_H',	'Your web site is now ready to use.');
-define('_TEXT16_L1',	'Login to the admin area to configure your site');
-define('_TEXT16_L2',	'Visit your site now');
-
-define('_TEXT17',	'Go Back');
-
-define('_BUTTON1',	'Install Nucleus');
-
-define('_1ST_POST_TITLE',	'Welcome to Nucleus CMS v3.5');
-define('_1ST_POST',	'This is the first post on your Nucleus CMS. Nucleus offers you the building blocks you need to create a web presence. Whether you want to
-create a personal blog, a family page, or an online business site, Nucleus CMS can help you achieve your goals.<br /> <br /> We\\\'ve loaded this first entry with links and information to get you started. Though you can delete this entry, it will eventually scroll off the main page as you add content to your site. Add your comments while you learn to work with Nucleus CMS, or bookmark this page so you can come back to it when you need to.');
-define('_1ST_POST2',	'<b>Home - <a href=\"http://nucleuscms.org/\" title=\"Nucleus CMS home\">nucleuscms.org</a></b><br /> Welcome to the world of Nucleus CMS. In 2001 a set of PHP scripts were let loose on the open Internet. Those scripts, which took user-generated data and used it to dynamically create html pages, contained the ideas and the algorithms that are the core of today\\\'s Nucleus CMS. Though Nucleus CMS 3.5 is far more flexible and powerful than the scripts from which it emerged, it still expresses the values that guided its birth: flexibility, security, and computational elegance.<br /> <br /> Thanks to an international community of sophisticated developers and designers, Nucleus CMS remains simple enough for anyone to learn, and expandable enough to allow you to build almost any website you can imagine. Nucleus CMS lets you integrate text, images, and user comments in a seamless package that will make your web presence as serious, professional, personal, or fun as you want it to be. We hope you enjoy its power.<br /> <br /> <b>Documentation - <a href=\"http://docs.nucleuscms.org/\" title=\"Nucleus CMS Documentation\">docs.nucleuscms.org</a></b><br /> The install process places a <a href=\"nucleus/documentation/\">user</a> and a <a href=\"nucleus/documentation/devdocs/\">developer</a> documentation on your web server. Pop-up <a href=\"/nucleus/documentation/help.html\">help</a> is available throughout the administration area to assist you in maintaining and customizing your site. When in the Nucleus CMS admin area, click on this symbol <img src=\"nucleus/documentation/icon-help.gif\" width=\"15\" height=\"15\" alt=\"help icon\" /> for context-sensitive help. You can also read this documentation online under <a href=\"http://docs.nucleuscms.org/\" title=\"Nucleus CMS Documentation\">docs.nucleuscms.org</a>.<br /> <br /> <b>Frequently Asked Questions - <a nicetitle=\"Nucleus CMS FAQ\" href=\"http://faq.nucleuscms.org/\">faq.nucleuscms.org</a></b><br /> If you need more information about managing, extending or troubleshooting your Nucleus CMS the Nucleus FAQ is the first place to search information. Over 170 frequently asked questions are answered from experienced Nucleus users.<br /> <br /> <b>Support - <a href=\"http://forum.nucleuscms.org/\" title=\"Nucleus CMS Support Forum\">forum.nucleuscms.org</a></b><br /> Should you require assistance, please don\\\'t hesitate to <a href=\"http://forum.nucleuscms.org/faq.php\">join</a> the 6,800+ registered users on our forums. With its built-in search capability of the 73,000+ posted articles, your answers are just a few clicks away. Remember: almost any question you think of has already been asked on the forums, and almost anything you want to do with Nucleus has been tried and explained there. Be sure to check them out.<br /> <br /> <b>Demonstration - <a href=\"http://demo.nucleuscms.org/\" title=\"Nucleus CMS Demonstration\">demo.nucleuscms.org</a></b><br /> Want to play around, test changes or tell a friend or relative about Nucleus CMS? Visit our live <a href=\"http://demo.nucleuscms.org/\">demo site</a>.<br /> <br /> <b>Skins - <a href=\"http://skins.nucleuscms.org/\" title=\"Nucleus CMS Skins\">skins.nucleuscms.org</a></b><br /> The combination of multi-weblogs and skins/templates make for a powerful duo in personalizing your site or designing one for a friend, relative or business client. Import new skins to change the look of your website, or create your own skins and share them with the Nucleus community! Help designing or modifying skins is only a few clicks away in the Nucleus forums.<br /> <br /> <b>Plugins - <a href=\"http://plugins.nucleuscms.org/\" title=\"Nucleus plugins\">plugins.nucleuscms.org</a></b><br /> Looking to add some extra functionality to the base Nucleus CMS package? Our <a href=\"http://wiki.nucleuscms.org/plugin\">plugin repository</a> gives you plenty of ways to extend and expand what Nucleus CMS can do; your imagination and creativity are the only limit on how Nucleus CMS can work for you.<br /> <br /> <b>Development - <a href=\"http://dev.nucleuscms.org/\" title=\"Nucleus Development\">dev.nucleuscms.org</a></b><br /> If you need more information about the Nucleus development you can find Informations in the developer documents at <a href=\"http://dev.nucleuscms.org/\" title=\"Nucleus Development\">dev.nucleuscms.org</a> or in the <a href=\"http://forum.nucleuscms.org/\">Support Forum</a>. Sourceforge.net graciously hosts our <a href=\"http://sourceforge.net/projects/nucleuscms/\">Open Source project page</a> which contains our software downloads and CVS repository.<br /> <br /> <b>Donators</b><br /> We would like to thank these <a href=\"http://nucleuscms.org/donators.php\">nice people</a> for their <a href=\"http://nucleuscms.org/donate.php\">support</a>. <em>Thanks all!</em><br /> <br /> <b>Vote for Nucleus CMS</b><br /> Like Nucleus CMS? Vote for us at <a href=\"http://www.hotscripts.com/Detailed/13368.html?RID=nucleus@demuynck.org\">HotScripts</a> and <a href=\"http://www.opensourcecms.com/index.php?option=content&task=view&id=145\">opensourceCMS</a>.<br /> <br /> <b>License</b><br /> When we speak of free software, we are referring to freedom, not price. Our <a href=\"http://www.gnu.org/licenses/gpl.html\">General Public Licenses</a> are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things.');
-
-?>
diff -x .svn -aruN 3.51.src/nucleus/documentation/devdocs/plugins.html 3.61.src/nucleus/documentation/devdocs/plugins.html
--- 3.51.src/nucleus/documentation/devdocs/plugins.html	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/documentation/devdocs/plugins.html	2010-12-19 00:16:50.000000000 -0600
@@ -1,7 +1,7 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xml:lang="en" xmlns="http://www.w3.org/1999/xhtml">
 <head>
-	<!-- $Id: plugins.html 1393 2009-07-24 21:06:40Z ftruscot $ -->
+	<!-- $Id: plugins.html 1473 2010-12-03 22:57:39Z ftruscot $ -->
 	<title>Nucleus - Plugin API</title>
 	<link rel="stylesheet" type="text/css" href="styles/manual.css" />
 	<style type="text/css">
@@ -30,7 +30,7 @@
 
 <div class="heading">
 Plugin API
-<i>January 20, 2008</i>
+<i>December 7, 2010</i>
 </div>
 
 <div class="note"><strong>Notes:</strong>
@@ -1575,7 +1575,7 @@
 
 	<tr>
 		<td>PrePasswordSet</td>
-		<td>(v3.50)  Called when user tries to set password in admin area or during activation. Allows for plugins to enforce password complexity rules.</td>
+		<td>(v3.50) Called when user tries to set password in admin area or during activation. Allows for plugins to enforce password complexity rules.</td>
 		<td><dl>
 			<dt class="ro">password</dt>
 			<dd>String containing the user-entered password.</dd>
@@ -1585,6 +1585,23 @@
 			<dd>Boolean indicating whether the proposed password is valid. Default is true. Plugin code should check this value to verify it is not already false before processing a password</dd>
 		</dl></td>
 	</tr>
+	
+	<tr>
+		<td>PostParseURL</td>
+		<td>(v3.60) Triggers right after the url is fully parsed (by ParseURL in globalfunctions). Useful to tweak global variables before selector() runs or to set something based on path-related globals.</td>
+		<td><dl>
+			<dt class="ro">type</dt>
+			<dd>Type of the page, e.g. item, blog, ...</dd>
+			<dt class="ro">info</dt>
+			<dd>The full URL which should be resolved (the name is derived from the old fashion variable <code>pathinfo</code>).</dd>
+		</dl></td>
+	</tr>
+	
+	<tr>
+		<td>MediaUploadFormExtras</td>
+		<td>(v3.60) Add fields to File Upload page of Nucleus Media Manager. All output should be valid XHTML 1.0. You must also subscribe to the PreMediaUpload event and get values from your added fields using requestVar(). </td>
+		<td>No Data is passed.</td>
+	</tr>
 <!--	<tr>
 		<td></td>
 		<td></td>
diff -x .svn -aruN 3.51.src/nucleus/documentation/devdocs/sqltables.html 3.61.src/nucleus/documentation/devdocs/sqltables.html
--- 3.51.src/nucleus/documentation/devdocs/sqltables.html	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/documentation/devdocs/sqltables.html	2010-12-19 00:16:50.000000000 -0600
@@ -1,7 +1,7 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xml:lang="en" xmlns="http://www.w3.org/1999/xhtml">
 <head>
-	<!-- $Id: sqltables.html 1377 2009-07-10 07:39:01Z ehui $ -->
+	<!-- $Id: sqltables.html 1457 2010-10-26 15:47:41Z ftruscot $ -->
 	<title>Nucleus - SQL Table Structure</title>
 	<link rel="stylesheet" type="text/css" href="styles/manual.css" />
 	<style type="text/css">
@@ -52,7 +52,7 @@
 
 <div class="heading">
 SQL Table Reference
-<i>January 15, 2009</i>
+<i>November 1, 2010</i>
 </div>
 
 <h1>Introduction</h1>
@@ -65,7 +65,7 @@
 This document contains information on the fields inside the Nucleus database tables.
 </p>
 
-<p class="note">The structure as presented here is for <strong>Nucleus v3.4</strong>.</p>
+<p class="note">The structure as presented here is for <strong>Nucleus v3.6</strong>.</p>
 
 <h1><a name="toc" id="toc"></a>Table Of Contents</h1>
 
@@ -200,7 +200,7 @@
 
 </tr><tr>
 	<td class="toremove">bnotify</td>
-	<td>varchar(60)</td>
+	<td>varchar(128)</td>
 	<td>NULL</td>
 	<td>Notify e-mail address. On certain events (see <code>bnotifytype</code> for the exact definition of these events), a notification e-mail is sent out to this e-mail address.</td>
 
@@ -498,7 +498,7 @@
 
 </tr><tr>
 	<td class="notnull unique">mname</td>
-	<td>varchar(16)</td>
+	<td>varchar(32)</td>
 	<td>''</td>
 	<td>Display name (the one used to login)</td>
 
diff -x .svn -aruN 3.51.src/nucleus/documentation/help.html 3.61.src/nucleus/documentation/help.html
--- 3.51.src/nucleus/documentation/help.html	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/documentation/help.html	2010-12-19 00:16:50.000000000 -0600
@@ -1,7 +1,7 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
-	<!-- $Id: help.html 1405 2009-08-14 15:56:06Z ftruscot $ -->
+	<!-- $Id: help.html 1457 2010-10-26 15:47:41Z ftruscot $ -->
 
 	<title>Nucleus Admin Help</title>
 	<style type="text/css">
@@ -2080,7 +2080,7 @@
 <h2>Skintypes</h2>
 
 <p>
-index, archive, archivelist, search, item
+index, archive, archivelist, search, item, [error, member, special if blogname parameter specified]
 </p>
 
 <h2>Examples</h2>
@@ -2611,6 +2611,9 @@
 	<ul>
 		<li><strong><em>linktext</em></strong>: when present, a full <code>&lt;a href...</code> tag will be outputted, rather than a raw link</li>
 		<li><strong><em>amount</em></strong>: for search and index skins: the amount of items to go forward/backward</li>
+		<li><strong><em>recount</em></strong>: for search and index skins: set to yes to force extra query to recount items on page. 
+		This is useful for more complex pages where the blog skinvar may be called multiple times because of the use of the offset. 
+		Try setting this if nextlink seems to be not advancing the expected number of items.</li>
 	</ul>
 </p>
 
@@ -2625,6 +2628,9 @@
 
 <pre>
 &lt;%nextlink%&gt;
+&lt;%nextlink(Next Page,10)%&gt;
+&lt;%nextlink(,10)%&gt;
+&lt;%nextlink(,10,yes)%&gt;
 </pre>
 
 </div>
@@ -2916,6 +2922,7 @@
 	    	<li><em>yoururl</em>: URL of the members website</li>
 	    	<li><em>youremail</em>: email address </li>
 	    	<li><em>yourid</em>: ID</li>
+	    	<li><em>yourprofileurl</em>: URL of the members profile (member details) page</li>
 	    </ul>
 	    <p>Information on the requested member (only available on member detail pages):</p>
 	    <ul>
@@ -3382,7 +3389,7 @@
 <a name="skinvar-elseif"></a>
 <h1>Skinvars: if/ifnot/else/elseif/elseifnot/endif</h1>
 
-<p>Inserts a content block only when certain conditions are fullfilled</p>
+<p>Inserts a content block only when certain conditions are fullfilled. Can be used in the item and comment fields of templates as of 3.60, as well as in Item bodies (same as item template fields).</p>
 
 <h2>Arguments</h2>
 <p>Only the <code>if</code>, <code>ifnot</code>, <code>elseif</code>, and <code>elseifnot</code> skinvars have options</p>
@@ -3426,6 +3433,24 @@
 			<li><strong><em>PluginName</em>,<em>AttributeName</em>,<em>AttributeValue</em></strong>: uses <em>PluginName</em> plugin to check if <em>AttributeName</em> is <em>AttributeValue</em></li>
 		</ul>
 	</li>
+	<li><strong>itemcategory</strong>: checks conditions related to the category of the current item (item and comment template fields only)
+		<ul>
+			<li><strong>itemcategory</strong>: checks if current item has a category (always true)</li>
+			<li><strong>itemcategory,catname,<em>CategoryName</em></strong>: checks if the category of the current item is <em>CategoryName</em></li>
+			<li><strong>itemcategory,catid,<em>CategoryId</em></strong>: checks if the id of the item's category is <em>CategoryId</em></li>
+		</ul>
+	</li>
+	<li><strong>itemblogsetting</strong>: checks if the value <em>name</em> blogsetting of the current item's blog equals <em>value</em> (the name is the column name from the nucleus_blog sql table) (item and comment template fields only)</li>
+	<li><strong>author</strong>: checks conditions related to the author of the current item (item and comment template fields only)
+		<ul>
+			<li><strong>author</strong>: checks if the current visitor is the author of the item</li>
+			<li><strong>author,isadmin</strong>: checks if the author of the item is an admin of the blog</li>
+			<li><strong>author,name,<em>AuthorName</em></strong>: checks if the user name of the item's author is <em>AuthorName</em></li>
+			<li><strong>author,isauthor</strong>: checks if the comment author is also the author of the item. (comment template fields only)</li>
+			<li><strong>author,isonteam</strong>: checks if the comment author is a member of blog team of current item. (comment template fields only)</li>
+		</ul>
+	</li>
+	
 </ul>
 
 <h2>Skintypes</h2>
@@ -3845,6 +3870,9 @@
 	<td><a href="#skinvar-phpinclude">phpinclude</a></td>
 	<td>includes a file, parsing by PHP</td>
 </tr><tr>
+	<td><a href="#skinvar-if">if-ifnot-else-elseif-elseifnot-endif</a></td>
+	<td>performs condition statements in templates (3.60)</td>
+</tr><tr>
 	<td><a href="#skinvar-plugin">plugin</a></td>
 	<td>executes a plugin</td>
 </tr><tr>
@@ -3967,6 +3995,9 @@
 	<td>timestamp</td>
 	<td>time at which comment was added</td>
 </tr><tr>
+	<td><a href="#skinvar-if">if-ifnot-else-elseif-elseifnot-endif</a></td>
+	<td>performs condition statements in templates (3.60)</td>
+</tr><tr>
 	<td><a href="#skinvar-include" title="include(filename)">include</a></td>
 	<td>includes a file, whithout parsing</td>
 </tr><tr>
diff -x .svn -aruN 3.51.src/nucleus/documentation/history.html 3.61.src/nucleus/documentation/history.html
--- 3.51.src/nucleus/documentation/history.html	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/documentation/history.html	2010-12-19 00:24:42.000000000 -0600
@@ -2,7 +2,7 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" lang="en-us" xml:lang="en-us">
 <head>
-	<!-- $Id: history.html 1421 2009-11-01 13:45:44Z kaigreve $ -->
+	<!-- $Id: history.html 1483 2010-12-19 05:24:46Z ftruscot $ -->
     <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
     <meta http-equiv="Content-Style-Type" content="text/css" />
     <meta http-equiv="Content-Script-Type" content="text/javascript" />
@@ -28,6 +28,49 @@
 
 <ul>
 	<li>
+		<strong>Nucleus v3.61 (December 19, 2010)</strong>
+		<ul>
+			<li>FIX: fix comment body being lost (ftruscot)</li>
+			<li>FIX: fix edit comment form formatting (ftruscot)</li>
+			<li>FIX: fix search title and body of items not displayed in search results (ftruscot)</li>
+		</ul>
+	</li>
+	<li>
+	<strong>Nucleus v3.60</strong>
+	<ul>
+		<li>ADD: MediaUploadFormExtras event to nucleus/media.php to allow plugin to add extra fields to media uploader form. See NP_ImageLimitSize (0.20+) for example of using event. (ftruscot)</li>
+		<li>CHANGE: use sql_real_escape_string() function in place of addslashes() in all but 2 places where sql_real_escape_string() doesn't make sense. (ftruscot)</li>
+		<li>ADD: mysql_real_escape_string() function to wrapper for mysqli (libs/mysql.php). (ftruscot)</li>
+		<li>FIX: globalfunctions.php. PostParseUrl event only firing when using urlmode=pathinfo (fancyurls). (ftruscot)</li>
+		<li>FIX: sql_affected_rows() function in nucleus/libs/sql/mysql.php. Was causing error in ban deletion. (ftruscot)</li>
+		<li>CHANGE: ACTIONS::_searchlink() to improve creation of next/prev link for index skin parts. Also, add $navigationItems global that can be set by plugin to affect next/prev link when plugin lists items on index page, see NP_Ordered 1.37. (ftruscot)</li>
+		<li>ADD: if-else-elseif-ifnot-ifelsenot-endif to the Item Body actions. Same as in Item Templates. see help.html for details. (ftruscot)</li>
+		<li>ADD: cleanFileName() function to globalfunctions.php and then use in nucleus/media and in MEDIA.php to clean up filenames of uploaded files to avoid problems with spaces and other characters. Thanks WillyP. (ftruscot)</li>
+		<li>ADD: global $currentcomentid and $currentcommentarray during item template processing so can get comment info in phpinclude called from comment template. (ftruscot)</li>
+		<li>ADD: if-else-elseif-ifnot-ifelsenot-endif to the comment field templates. see help.html for details. (ftruscot)</li>
+		<li>ADD: global $currentitemid during item template processing so can get item info in phpinclude called from item template. (ftruscot)</li>
+		<li>ADD: if-else-elseif-ifnot-ifelsenot-endif to the item field templates. see help.html for details. (ftruscot)</li>
+		<li>FIX: bug where categorylist with blogname parameter did not work on member, error, or special skin parts. (ftruscot)</li>
+		<li>FIX: bug in commentform skinvar where form showing to nonmembers when bpublic=0. Thanks WillyP. (ftruscot)</li>
+		<li>CHANGE: length of bnotify column in blog table to 128 characters to allow for longer lists of notification recipients. (ftruscot)</li>
+		<li>ADD: recount parameter to nextlink skinvar to force recalculation of iAmountOnPage for nextlink instead of using amountfound from last blog skinvar. Helpful in more advanced situations where multiple blog skinvars used on single page. (ftruscot)</li>
+		<li>FIX: tightened security around includes in PLUGINADMIN class. (ehui)</li>
+		<li>ADD: globalfunctions: include_libs() and include_plugins() to be used to safely include libs and plugins. (ehui).</li>
+		<li>REMOVE: config.php. rename to config.php.sample to avoid overwrite during upgrade. config.php created by build.xml during generation of full install package and modified by install.php. (ehui)</li>
+		<li>FIX: tune db tables in sqlinstall. (ehui)</li>
+		<li>ADD: yourprofileurl parameter value to member skinvar to produce url to logged on member's profile for use in link to member profile. (ftruscot)</li>
+		<li>FIX: Fixes to NP_SecurityEnforcer suggested by cacher at <a href="http://japan.nucleuscms.org/bb/viewtopic.php?t=4502" title="Fixes to NP_SecurityEnforcer">Japanese Forum</a>. (ftruscot)</li>
+		<li>FIX: When changing settings for a member, call to PrePasswordSet event was happening even if password not being changed. Admin.php, action_changemembersettings() method. (ftruscot)</li>
+		<li>ADD: PostParseURL event to globalfunctions. Triggers right after url is fully parsed (by ParseURL in globalfunctions). Useful to tweak global variables before selector() runs or to set something based on path-related globals. Used by new version of NP_EventBlog (min 3.60) to display future posts (events) on item pages skin part. (ftruscot)</li>
+		<li>CHANGE: selector() itemid, change itemexists check to be aware of allowDrafts and allowFuture. (ftruscot)</li>
+		<li>ADD: $CONF settings for allowDrafts and allowFuture so can set selector to permit showing of these items if needed. Can be set in config.php or in plugin event (probably authentication related for timing). (ftruscot)</li>
+		<li>CHANGE: BLOG::readLogFromList() and BLOG::getSqlItemList() methods to add parameters permitting drafts or future items to be shown. (ftruscot)</li>
+		<li>FIX: unloaded ITEM class error casued by NP_Ping when creating new weblog. See <a href="http://forum.nucleuscms.org/viewtopic.php?t=19411" title="Error on New Weblog">here</a> (ftruscot)</li>
+		<li>FIX: convert/livejournal.php set to use sql_table for prefixes. suggested by quandary (see <a href="http://forum.nucleuscms.org/viewtopic.php?t=19366" title="livejournal converter fix">here</a>). (ftruscot)</li>
+		<li>FIX: improvements to isValidMailAddress() function as suggested by quandary <a href="http://forum.nucleuscms.org/viewtopic.php?t=19349" title="isValidMailAddress">here</a> (ftruscot)</li>
+	</ul>
+	</li>
+	<li>
 		<strong>Nucleus v3.51 (November 1, 2009)</strong>
 		<ul>
 			<li>FIX: fix warning caused by unreachable code in PDO (admun)</li>
diff -x .svn -aruN 3.51.src/nucleus/documentation/index.html 3.61.src/nucleus/documentation/index.html
--- 3.51.src/nucleus/documentation/index.html	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/documentation/index.html	2010-12-19 00:16:50.000000000 -0600
@@ -1,7 +1,7 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
-	<!-- $Id: index.html 1175 2007-06-16 22:14:16Z kaigreve $ -->
+	<!-- $Id: index.html 1457 2010-10-26 15:47:41Z ftruscot $ -->
 	<title>Nucleus CMS - Manual</title>
 	<link rel="stylesheet" type="text/css" href="styles/manual.css" />
 </head>
@@ -75,8 +75,8 @@
 </p>
 
 <ul>
-	<li><a href="http://www.php.net/">PHP</a> (version 4.0.6 or higher)</li>
-	<li>Access to a <a href="http://www.mysql.com/">MySQL</a> database (version 3.23.38 or higher)</li>
+	<li><a href="http://www.php.net/">PHP</a> (version 5.0.0 or higher, may still work on version 4.0.6 or higher)</li>
+	<li>Access to a <a href="http://www.mysql.com/">MySQL</a> database (version 4 or higher)</li>
 	<li>Some <acronym title="Hypertext Markup Language">HTML</acronym> and <acronym title="Cascading Style Sheets">CSS</acronym> knowledge, to edit skins and templates</li>
 </ul>
 
diff -x .svn -aruN 3.51.src/nucleus/documentation/skins.html 3.61.src/nucleus/documentation/skins.html
--- 3.51.src/nucleus/documentation/skins.html	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/documentation/skins.html	2010-12-19 00:16:50.000000000 -0600
@@ -1,7 +1,7 @@
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xml:lang="en" xmlns="http://www.w3.org/1999/xhtml">
 <head>
-	<!-- $Id: skins.html 756 2005-08-11 20:28:57Z ehui $ -->
+	<!-- $Id: skins.html 1457 2010-10-26 15:47:41Z ftruscot $ -->
 	<title>Nucleus - Skins and Templates</title>
 	<link rel="stylesheet" type="text/css" href="styles/manual.css" />
 </head>
@@ -22,6 +22,7 @@
 	<li>Go with the default skin/templates that comes with Nucleus</li>
 	<li>Start from the default skin/templates, and modify it to your needs (colors, etc...)</li>
 	<li>Start your own skin/templates, and define your own CSS stylesheets</li>
+	<li>Download one of the dozens of free skins available on the <a href="http://skins.nucleuscms.org/" title="Nucleus CMS skins">Nucleus Skins site</a>.</li>
 </ol>
 <p>This document tries to help you with doing this.</p>
 
diff -x .svn -aruN 3.51.src/nucleus/documentation/tips.html 3.61.src/nucleus/documentation/tips.html
--- 3.51.src/nucleus/documentation/tips.html	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/documentation/tips.html	2010-12-19 00:16:50.000000000 -0600
@@ -3,7 +3,7 @@
 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
-	<!-- $Id: tips.html 1368 2009-06-17 22:18:57Z ftruscot $ -->
+	<!-- $Id: tips.html 1463 2010-11-08 21:40:13Z ftruscot $ -->
 	<title>Nucleus - Tips and suggestions</title>
 	<link rel="stylesheet" type="text/css" href="styles/manual.css" />
 </head>
@@ -261,7 +261,7 @@
 	<td><code>selectSpecialSkinType('construction');</code></td>
 	<td>Makes sure a certain special skin type gets used (note: if used by itself, it will only show that special skin type). Try this to show the special page only to non-members: <pre><code>if (!$member->isLoggedIn()) {
 	selectSpecialSkinType('login');
-}</code></pre> or this to show the special skin type only for the main page: <pre><code>if (empty($blogid) && empty($catid) && empty($itemid)&& empty($archive) && empty($archivelist)) {
+}</code></pre> or this to show the special skin type only for the main page: <pre><code>if (empty($blogid) && empty($catid) && empty($itemid)&& empty($archive) && empty($archivelist) && empty($special)) {
 	selectSpecialSkinType('welcome');
 }</code></pre></td>
 </tr></table>
diff -x .svn -aruN 3.51.src/nucleus/forms/commentform-closedtopublic.template 3.61.src/nucleus/forms/commentform-closedtopublic.template
--- 3.51.src/nucleus/forms/commentform-closedtopublic.template	1969-12-31 18:00:00.000000000 -0600
+++ 3.61.src/nucleus/forms/commentform-closedtopublic.template	2010-12-19 00:16:46.000000000 -0600
@@ -0,0 +1 @@
+<div class="commentform"><%text(_ERROR_COMMENTS_NONPUBLIC)%></div>
diff -x .svn -aruN 3.51.src/nucleus/forms/commentform-loggedin.template 3.61.src/nucleus/forms/commentform-loggedin.template
--- 3.51.src/nucleus/forms/commentform-loggedin.template	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/forms/commentform-loggedin.template	2010-12-19 00:16:46.000000000 -0600
@@ -1,4 +1,4 @@
-<a id="nucleus_cf"></a>
+<a id="nucleus_cf">&nbsp;</a>
 <form method="post" action="#nucleus_cf">
 	<div class="commentform">
 <input type="hidden" name="action" value="addcomment" />
diff -x .svn -aruN 3.51.src/nucleus/forms/commentform-notloggedin.template 3.61.src/nucleus/forms/commentform-notloggedin.template
--- 3.51.src/nucleus/forms/commentform-notloggedin.template	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/forms/commentform-notloggedin.template	2010-12-19 00:16:46.000000000 -0600
@@ -1,4 +1,4 @@
-<a id="nucleus_cf"></a>
+<a id="nucleus_cf">&nbsp;</a>
 <form method="post" action="#nucleus_cf">
 	<div class="commentform">
 <input type="hidden" name="action" value="addcomment" />
diff -x .svn -aruN 3.51.src/nucleus/forms/loginform-loggedin.template 3.61.src/nucleus/forms/loginform-loggedin.template
--- 3.51.src/nucleus/forms/loginform-loggedin.template	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/forms/loginform-loggedin.template	2010-12-19 00:16:46.000000000 -0600
@@ -1,4 +1,4 @@
-<a id="nucleus_lf"></a>
+<a id="nucleus_lf">&nbsp;</a>
 <div class="loginform">
 	<%text(_LOGINFORM_YOUARE)%> <%formdata(membername)%> ! (<a href="<%self%>?action=logout" title="<%text(_LOGOUT)%>"><%text(_LOGOUT)%></a>)
 </div>
diff -x .svn -aruN 3.51.src/nucleus/forms/loginform-notloggedin.template 3.61.src/nucleus/forms/loginform-notloggedin.template
--- 3.51.src/nucleus/forms/loginform-notloggedin.template	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/forms/loginform-notloggedin.template	2010-12-19 00:16:46.000000000 -0600
@@ -1,4 +1,4 @@
-<a id="nucleus_lf"></a>
+<a id="nucleus_lf">&nbsp;</a>
 <form method="post" action="#nucleus_lf">
 	<div class="loginform">
 <input type="hidden" name="action" value="login" />
diff -x .svn -aruN 3.51.src/nucleus/forms/membermailform-loggedin.template 3.61.src/nucleus/forms/membermailform-loggedin.template
--- 3.51.src/nucleus/forms/membermailform-loggedin.template	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/forms/membermailform-loggedin.template	2010-12-19 00:16:48.000000000 -0600
@@ -1,4 +1,4 @@
-<a id="nucleus_mf"></a>
+<a id="nucleus_mf">&nbsp;</a>
 <form method="post" action="#nucleus_mf">
 	<div class="mailform">
 <input type="hidden" name="memberid" value="<%formdata(memberid)%>" />
diff -x .svn -aruN 3.51.src/nucleus/forms/membermailform-notloggedin.template 3.61.src/nucleus/forms/membermailform-notloggedin.template
--- 3.51.src/nucleus/forms/membermailform-notloggedin.template	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/forms/membermailform-notloggedin.template	2010-12-19 00:16:46.000000000 -0600
@@ -1,4 +1,4 @@
-<a id="nucleus_mf"></a>
+<a id="nucleus_mf">&nbsp;</a>
 <form method="post" action="#nucleus_mf">
 	<div class="mailform">
 <input type="hidden" name="memberid" value="<%formdata(memberid)%>" />
diff -x .svn -aruN 3.51.src/nucleus/language/english.php 3.61.src/nucleus/language/english.php
--- 3.51.src/nucleus/language/english.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/language/english.php	2010-12-19 00:16:46.000000000 -0600
@@ -17,7 +17,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: english.php 1393 2009-07-24 21:06:40Z ftruscot $
+ * @version $Id: english.php 1448 2010-08-16 16:51:36Z ftruscot $
  */
 
 /********************************************
@@ -407,15 +407,15 @@
 define('_MSG_ACTIVATION_SENT',		'An activation link has been sent by e-mail.');
 
 // activation link emails
-define('_ACTIVATE_REGISTER_MAIL',	"Hi <%memberName%>,\n\nYou need to activate your account at <%siteName%> (<%siteUrl%>).\nYou can do this by visiting the link below: \n\n\t<%activationUrl%>\n\nYou have 2 days to do this. After this, the activation link becomes invalid.");
+define('_ACTIVATE_REGISTER_MAIL',	"Hi <%memberName%>,\n\nYou need to activate your account at <%siteName%> (<%siteUrl%>).\nYou can do this by visiting the link below: \n\n\t<%activationUrl%>\n\nYou have <%activationDays%> days to do this. After this, the activation link becomes invalid.");
 define('_ACTIVATE_REGISTER_MAILTITLE',	"Activate your '<%memberName%>' account");
 define('_ACTIVATE_REGISTER_TITLE',	'Welcome <%memberName%>');
 define('_ACTIVATE_REGISTER_TEXT',	'You\'re almost there. Please choose a password for your account below.');
-define('_ACTIVATE_FORGOT_MAIL',		"Hi <%memberName%>,\n\nUsing the link below, you can choose a new password for your account at <%siteName%> (<%siteUrl%>) by choosing a new password.\n\n\t<%activationUrl%>\n\nYou have 2 days to do this. After this, the activation link becomes invalid.");
+define('_ACTIVATE_FORGOT_MAIL',		"Hi <%memberName%>,\n\nUsing the link below, you can choose a new password for your account at <%siteName%> (<%siteUrl%>) by choosing a new password.\n\n\t<%activationUrl%>\n\nYou have <%activationDays%> days to do this. After this, the activation link becomes invalid.");
 define('_ACTIVATE_FORGOT_MAILTITLE',"Re-activate your '<%memberName%>' account");
 define('_ACTIVATE_FORGOT_TITLE',	'Welcome <%memberName%>');
 define('_ACTIVATE_FORGOT_TEXT',		'You can choose a new password for your account below:');
-define('_ACTIVATE_CHANGE_MAIL',		"Hi <%memberName%>,\n\nSince your e-mail address has changed, you'll need to re-activate your account at <%siteName%> (<%siteUrl%>).\nYou can do this by visiting the link below: \n\n\t<%activationUrl%>\n\nYou have 2 days to do this. After this, the activation link becomes invalid.");
+define('_ACTIVATE_CHANGE_MAIL',		"Hi <%memberName%>,\n\nSince your e-mail address has changed, you'll need to re-activate your account at <%siteName%> (<%siteUrl%>).\nYou can do this by visiting the link below: \n\n\t<%activationUrl%>\n\nYou have <%activationDays%> days to do this. After this, the activation link becomes invalid.");
 define('_ACTIVATE_CHANGE_MAILTITLE',"Re-activate your '<%memberName%>' account");
 define('_ACTIVATE_CHANGE_TITLE',	'Welcome <%memberName%>');
 define('_ACTIVATE_CHANGE_TEXT',		'Your address change has been verified. Thanks!');
diff -x .svn -aruN 3.51.src/nucleus/libs/ACTIONLOG.php 3.61.src/nucleus/libs/ACTIONLOG.php
--- 3.51.src/nucleus/libs/ACTIONLOG.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/ACTIONLOG.php	2010-12-19 00:16:48.000000000 -0600
@@ -14,7 +14,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: ACTIONLOG.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: ACTIONLOG.php 1470 2010-11-29 22:10:16Z ftruscot $
  */
 define('ERROR',1);		// only errors
 define('WARNING',2);	// errors and warnings
@@ -36,7 +36,7 @@
 		if ($member && $member->isLoggedIn())
 			$message = "[" . $member->getDisplayName() . "] " . $message;
 
-		$message = addslashes($message);		// add slashes
+		$message = sql_real_escape_string($message);		// add slashes
 		$timestamp = date("Y-m-d H:i:s",time());	// format timestamp
 		$query = "INSERT INTO " . sql_table('actionlog') . " (timestamp, message) VALUES ('$timestamp', '$message')";
 
diff -x .svn -aruN 3.51.src/nucleus/libs/ACTIONS.php 3.61.src/nucleus/libs/ACTIONS.php
--- 3.51.src/nucleus/libs/ACTIONS.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/ACTIONS.php	2010-12-19 00:16:48.000000000 -0600
@@ -18,7 +18,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: ACTIONS.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: ACTIONS.php 1459 2010-11-01 21:46:58Z ftruscot $
  */
 
 class ACTIONS extends BaseActions {
@@ -282,24 +282,46 @@
 	 *		When present, the output will be a full <a href...> link. When empty,
 	 *		only a raw link will be outputted
 	 */
-	function _searchlink($maxresults, $startpos, $direction, $linktext = '') {
+	function _searchlink($maxresults, $startpos, $direction, $linktext = '', $recount = '') {
 		global $CONF, $blog, $query, $amount;
 		// TODO: Move request uri to linkparams. this is ugly. sorry for that.
 		$startpos	= intval($startpos);		// will be 0 when empty.
 		$parsed		= parse_url(serverVar('REQUEST_URI'));
+		$path		= $parsed['path'];
 		$parsed		= $parsed['query'];
 		$url		= '';
-
+		
 		switch ($direction) {
 			case 'prev':
 				if ( intval($startpos) - intval($maxresults) >= 0) {
 					$startpos 	= intval($startpos) - intval($maxresults);
-					$url		= $CONF['SearchURL'].'?'.alterQueryStr($parsed,'startpos',$startpos);
+					//$url		= $CONF['SearchURL'].'?'.alterQueryStr($parsed,'startpos',$startpos);
+					switch ($this->skintype)
+					{
+						case 'index':
+							$url = $path;
+							break;
+						case 'search':
+							$url = $CONF['SearchURL'];
+							break;
+					}
+					$url .= '?'.alterQueryStr($parsed,'startpos',$startpos);
 				}
+				
 				break;
 			case 'next':
-				$iAmountOnPage = $this->amountfound;
-				if ($iAmountOnPage == 0)
+				global $navigationItems;
+				if (!isset($navigationItems)) $navigationItems = 0;
+				
+				if ($recount)
+					$iAmountOnPage = 0;
+				else 
+					$iAmountOnPage = $this->amountfound;
+				
+				if (intval($navigationItems) > 0) {
+					$iAmountOnPage = intval($navigationItems) - intval($startpos);
+				}
+				elseif ($iAmountOnPage == 0)
 				{
 					// [%nextlink%] or [%prevlink%] probably called before [%blog%] or [%searchresults%]
 					// try a count query
@@ -307,18 +329,24 @@
 					{
 						case 'index':
 							$sqlquery = $blog->getSqlBlog('', 'count');
+							$url = $path;
 							break;
 						case 'search':
+							$unused_highlight = '';
 							$sqlquery = $blog->getSqlSearch($query, $amount, $unused_highlight, 'count');
+							$url = $CONF['SearchURL'];
 							break;
 					}
 					if ($sqlquery)
 						$iAmountOnPage = intval(quickQuery($sqlquery)) - intval($startpos);
 				}
+				
 				if (intval($iAmountOnPage) >= intval($maxresults)) {
 					$startpos 	= intval($startpos) + intval($maxresults);
-					$url		= $CONF['SearchURL'].'?'.alterQueryStr($parsed,'startpos',$startpos);
+					//$url		= $CONF['SearchURL'].'?'.alterQueryStr($parsed,'startpos',$startpos);
+					$url		.= '?'.alterQueryStr($parsed,'startpos',$startpos);
 				}
+				else $url = '';
 				break;
 			default:
 				break;
@@ -602,6 +630,10 @@
 	function parse_categorylist($template, $blogname = '') {
 		global $blog, $manager;
 
+		// when no blog found
+		if (($blogName == '') && (!is_object($blog)))
+			return 0;
+			
 		if ($blogname == '') {
 			$this->_preBlogContent('categorylist',$blog);
 			$blog->showCategoryList($template);
@@ -642,6 +674,11 @@
 			$this->doForm('commentform-closed');
 			return;
 		}
+		
+		if (!$blog->isPublic() && !$member->isLoggedIn()) {
+			$this->doForm('commentform-closedtopublic');
+			return;
+		}
 
 		if (!$destinationurl)
 		{
@@ -867,7 +904,7 @@
 	 * (includes a member info thingie)	 
 	 */
 	function parse_member($what) {
-		global $memberinfo, $member;
+		global $memberinfo, $member, $CONF;
 
 		// 1. only allow the member-details-page specific variables on member pages
 		if ($this->skintype == 'member') {
@@ -916,6 +953,12 @@
 				case 'yourid':
 					echo $member->getID();
 					break;
+				case 'yourprofileurl':
+					if ($CONF['URLMode'] == 'pathinfo')
+						echo createMemberLink($member->getID());
+					else
+						echo $CONF['IndexURL'] . createMemberLink($member->getID());
+					break;
 			}
 		}
 
@@ -999,12 +1042,12 @@
 	/**
 	 * Parse skinvar nextlink
 	 */
-	function parse_nextlink($linktext = '', $amount = 10) {
+	function parse_nextlink($linktext = '', $amount = 10, $recount = '') {
 		global $itemidnext, $archivenext, $startpos;
 		if ($this->skintype == 'item')
 			$this->_itemlink($itemidnext, $linktext);
 		else if ($this->skintype == 'search' || $this->skintype == 'index')
-			$this->_searchlink($amount, $startpos, 'next', $linktext);
+			$this->_searchlink($amount, $startpos, 'next', $linktext, $recount);
 		else
 			$this->_archivelink($archivenext, $linktext);
 	}
diff -x .svn -aruN 3.51.src/nucleus/libs/ADMIN.php 3.61.src/nucleus/libs/ADMIN.php
--- 3.51.src/nucleus/libs/ADMIN.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/ADMIN.php	2010-12-19 00:24:42.000000000 -0600
@@ -14,7 +14,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: ADMIN.php 1416 2009-09-24 15:58:08Z ftruscot $
+ * @version $Id: ADMIN.php 1483 2010-12-19 05:24:46Z ftruscot $
 
  */
 
@@ -346,7 +346,7 @@
                . ' WHERE iblog=bnumber and iauthor=mnumber and icat=catid and iblog=' . $blogid;
 
         if ($search)
-            $query .= ' and ((ititle LIKE "%' . addslashes($search) . '%") or (ibody LIKE "%' . addslashes($search) . '%") or (imore LIKE "%' . addslashes($search) . '%"))';
+            $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 
         // non-blog-admins can only edit/delete their own items
         if (!$member->blogAdminRights($blogid))
@@ -913,7 +913,7 @@
                . ' WHERE iauthor='. $member->getID() .' and iauthor=mnumber and iblog=bnumber and icat=catid';
 
         if ($search)
-            $query .= ' and ((ititle LIKE "%' . addslashes($search) . '%") or (ibody LIKE "%' . addslashes($search) . '%") or (imore LIKE "%' . addslashes($search) . '%"))';
+            $query .= ' and ((ititle LIKE "%' . sql_real_escape_string($search) . '%") or (ibody LIKE "%' . sql_real_escape_string($search) . '%") or (imore LIKE "%' . sql_real_escape_string($search) . '%"))';
 
         $query .= ' ORDER BY itime DESC'
                 . " LIMIT $start,$amount";
@@ -969,7 +969,7 @@
         $query = 'SELECT cbody, cuser, cmail, cemail, mname, ctime, chost, cnumber, cip, citem FROM ' . sql_table('comment') . ' LEFT OUTER JOIN ' . sql_table('member') . ' ON mnumber = cmember WHERE citem = ' . $itemid;
 
         if ($search)
-            $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
+            $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
 
         $query .= ' ORDER BY ctime ASC'
                 . " LIMIT $start,$amount";
@@ -1011,7 +1011,7 @@
         $query =  'SELECT cbody, cuser, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cmember=' . $member->getID();
 
         if ($search)
-            $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
+            $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
 
         $query .= ' ORDER BY ctime DESC'
                 . " LIMIT $start,$amount";
@@ -1067,7 +1067,7 @@
         $query =  'SELECT cbody, cuser, cemail, cmail, mname, ctime, chost, cnumber, cip, citem FROM '.sql_table('comment').' LEFT OUTER JOIN '.sql_table('member').' ON mnumber=cmember WHERE cblog=' . intval($blogid);
 
         if ($search != '')
-            $query .= ' and cbody LIKE "%' . addslashes($search) . '%"';
+            $query .= ' and cbody LIKE "%' . sql_real_escape_string($search) . '%"';
 
 
         $query .= ' ORDER BY ctime DESC'
@@ -1453,24 +1453,28 @@
         }
     }
 
-    /**
-     * Allows to edit previously made comments
-     */
-    function action_commentedit() {
-        global $member, $manager;
+	/**
+	 * Allows to edit previously made comments
+	 **/
+	function action_commentedit() {
 
-        $commentid = intRequestVar('commentid');
+		global $member, $manager;
 
-        $member->canAlterComment($commentid) or $this->disallow();
+		$commentid = intRequestVar('commentid');
 
-        $comment = COMMENT::getComment($commentid);
+		$member->canAlterComment($commentid) or $this->disallow();
+
+		$comment = COMMENT::getComment($commentid);
 
-        $manager->notify('PrepareCommentForEdit',array('comment' => &$comment));
+		$manager->notify('PrepareCommentForEdit', array('comment' => &$comment) );
 
-        // change <br /> to \n
-        $comment['body'] = str_replace('<br />','',$comment['body']);
+		// change <br /> to \n
+		$comment['body'] = str_replace('<br />', '', $comment['body']);
 
-        $comment['body'] = eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>","\\1",$comment['body']);
+		// replaced eregi_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
+		/* original eregi_replace: eregi_replace("<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>", "\\1", $comment['body']) */
+
+        $comment['body'] = preg_replace("#<a href=['\"]([^'\"]+)['\"]( rel=\"nofollow\")?>[^<]*</a>#I", "\\1", $comment['body']);
 
         $this->pagehead();
 
@@ -1539,16 +1543,26 @@
         $email = postVar('email');
         $body = postVar('body');
 
-        // intercept words that are too long
-        if (eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}",$body) != false)
-            $this->error(_ERROR_COMMENT_LONGWORD);
-
-        // check length
-        if (strlen($body)<3)
-            $this->error(_ERROR_COMMENT_NOCOMMENT);
-        if (strlen($body)>5000)
-            $this->error(_ERROR_COMMENT_TOOLONG);
-
+		# replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
+		# original eregi: eregi("[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}", $body) != FALSE
+		# important note that '\' must be matched with '\\\\' in preg* expressions
+
+		// intercept words that are too long
+		if (preg_match('#[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}#', $body) != FALSE)
+		{
+			$this->error(_ERROR_COMMENT_LONGWORD);
+		}
+
+		// check length
+		if (strlen($body) < 3)
+		{
+			$this->error(_ERROR_COMMENT_NOCOMMENT);
+		}
+
+		if (strlen($body) > 5000)
+		{
+			$this->error(_ERROR_COMMENT_TOOLONG);
+		}
 
         // prepare body
         $body = COMMENT::prepareBody($body);
@@ -1557,7 +1571,7 @@
         $manager->notify('PreUpdateComment',array('body' => &$body));
 
         $query = 'UPDATE ' . sql_table('comment')
-               . " SET cmail = '" . addslashes($url) . "', cemail = '" . addslashes($email) . "', cbody = '" . addslashes($body) . "'"
+               . " SET cmail = '" . sql_real_escape_string($url) . "', cemail = '" . sql_real_escape_string($email) . "', cbody = '" . sql_real_escape_string($body) . "'"
                . " WHERE cnumber = " . $commentid;
         sql_query($query);
 
@@ -1833,19 +1847,34 @@
                 <?php               // show a dropdown list of all available languages
                 global $DIR_LANG;
                 $dirhandle = opendir($DIR_LANG);
-                while ($filename = readdir($dirhandle)) {
-                    if (ereg("^(.*)\.php$",$filename,$matches)) {
-                        $name = $matches[1];
-                        echo "<option value='$name'";
-                        if ($name == $mem->getLanguage())
-                            echo " selected='selected'";
-                        echo ">$name</option>";
-                    }
-                }
-                closedir($dirhandle);
 
-                ?>
-                </select>
+				while ($filename = readdir($dirhandle))
+				{
+
+					# replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
+					# original ereg: ereg("^(.*)\.php$", $filename, $matches)
+
+					if (preg_match('#^(.*)\.php$#', $filename, $matches) )
+					{
+
+						$name = $matches[1];
+						echo "<option value=\"$name\"";
+
+						if ($name == $mem->getLanguage() )
+						{
+							echo " selected=\"selected\"";
+						}
+
+						echo ">$name</option>";
+
+					}
+
+				}
+
+				closedir($dirhandle);
+
+				?>
+				</select>
 
             </td>
         </tr>
@@ -1897,9 +1926,14 @@
         $email          = strip_tags(postVar('email'));
         $url            = strip_tags(postVar('url'));
 
-        // Sometimes user didn't prefix the URL with http://, this cause a malformed URL. Let's fix it.
-        if (!eregi("^https?://", $url))
-            $url = "http://".$url;
+		# replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
+		# original eregi: !eregi("^https?://", $url)
+
+		// begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.
+		if (!preg_match('#^https?://#', $url) )
+		{
+			$url = 'http://' . $url;
+		}
 
         $admin          = postVar('admin');
         $canlogin       = postVar('canlogin');
@@ -1922,12 +1956,14 @@
             if ($password && (strlen($password) < 6))
                 $this->error(_ERROR_PASSWORDTOOSHORT);
                 
-            $pwdvalid = true;
-            $pwderror = '';
-            $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
-            if (!$pwdvalid) {
-                $this->error($pwderror);
-            }
+            if ($password) {
+				$pwdvalid = true;
+				$pwderror = '';
+				$manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
+				if (!$pwdvalid) {
+					$this->error($pwderror);
+				}
+			}
         }
 
         if (!isValidMailAddress($email))
@@ -2173,13 +2209,15 @@
         if ($password && (strlen($password) < 6))
             return $this->_showActivationPage($key, _ERROR_PASSWORDTOOSHORT);
             
-        $pwdvalid = true;
-        $pwderror = '';
-		global $manager;
-        $manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
-        if (!$pwdvalid) {
-            return $this->_showActivationPage($key,$pwderror);
-        }
+        if ($password) {
+			$pwdvalid = true;
+			$pwderror = '';
+			global $manager;
+			$manager->notify('PrePasswordSet',array('password' => $password, 'errormessage' => &$pwderror, 'valid' => &$pwdvalid));
+			if (!$pwdvalid) {
+				return $this->_showActivationPage($key,$pwderror);
+			}
+		}
 
         $error = '';
         
@@ -2505,7 +2543,7 @@
          <td><?php $this->input_yesno('reqemail',$blog->emailRequired(),72); ?></td>
       </tr><tr>
             <td><?php echo _EBLOG_NOTIFY?> <?php help('blognotify'); ?></td>
-            <td><input name="notify" tabindex="80" maxlength="60" size="40" value="<?php echo  htmlspecialchars($blog->getNotifyAddress()); ?>" /></td>
+            <td><input name="notify" tabindex="80" maxlength="128" size="40" value="<?php echo  htmlspecialchars($blog->getNotifyAddress()); ?>" /></td>
         </tr><tr>
             <td><?php echo _EBLOG_NOTIFY_ON?></td>
             <td>
@@ -2628,7 +2666,7 @@
         if (!isValidCategoryName($cname))
             $this->error(_ERROR_BADCATEGORYNAME);
 
-        $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . addslashes($cname).'\' and cblog=' . intval($blogid);
+        $query = 'SELECT * FROM '.sql_table('category') . ' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid);
         $res = sql_query($query);
         if (sql_num_rows($res) > 0)
             $this->error(_ERROR_DUPCATEGORYNAME);
@@ -2718,14 +2756,14 @@
         if (!isValidCategoryName($cname))
             $this->error(_ERROR_BADCATEGORYNAME);
 
-        $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . addslashes($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
+        $query = 'SELECT * FROM '.sql_table('category').' WHERE cname=\'' . sql_real_escape_string($cname).'\' and cblog=' . intval($blogid) . " and not(catid=$catid)";
         $res = sql_query($query);
         if (sql_num_rows($res) > 0)
             $this->error(_ERROR_DUPCATEGORYNAME);
 
         $query =  'UPDATE '.sql_table('category').' SET'
-               . " cname='" . addslashes($cname) . "',"
-               . " cdesc='" . addslashes($cdesc) . "'"
+               . " cname='" . sql_real_escape_string($cname) . "',"
+               . " cdesc='" . sql_real_escape_string($cdesc) . "'"
                . " WHERE catid=" . $catid;
 
         sql_query($query);
@@ -3154,7 +3192,7 @@
 
         /* unlink comments from memberid */
         if ($memberid) {
-            $query = 'UPDATE ' . sql_table('comment') . ' SET cmember="0", cuser="'. addslashes($mem->getDisplayName())
+            $query = 'UPDATE ' . sql_table('comment') . ' SET cmember="0", cuser="'. sql_real_escape_string($mem->getDisplayName())
                         .'" WHERE cmember='.$memberid;
             sql_query($query);
         }
@@ -3294,11 +3332,11 @@
 
 
         // add slashes for sql queries
-        $bname =        addslashes($bname);
-        $bshortname =   addslashes($bshortname);
-        $btimeoffset =  addslashes($btimeoffset);
-        $bdesc =        addslashes($bdesc);
-        $bdefskin =     addslashes($bdefskin);
+        $bname =        sql_real_escape_string($bname);
+        $bshortname =   sql_real_escape_string($bshortname);
+        $btimeoffset =  sql_real_escape_string($btimeoffset);
+        $bdesc =        sql_real_escape_string($bdesc);
+        $bdefskin =     sql_real_escape_string($bdefskin);
 
         // create blog
         $query = 'INSERT INTO '.sql_table('blog')." (bname, bshortname, bdesc, btimeoffset, bdefskin) VALUES ('$bname', '$bshortname', '$bdesc', '$btimeoffset', '$bdefskin')";
@@ -3761,7 +3799,7 @@
         $member->isAdmin() or $this->disallow();
 
         $extrahead = '<script type="text/javascript" src="javascript/templateEdit.js"></script>';
-        $extrahead .= '<script type="text/javascript">setTemplateEditText("'.addslashes(_EDITTEMPLATE_EMPTY).'");</script>';
+        $extrahead .= '<script type="text/javascript">setTemplateEditText("'.sql_real_escape_string(_EDITTEMPLATE_EMPTY).'");</script>';
 
         $this->pagehead($extrahead);
 
@@ -3933,8 +3971,8 @@
             $this->error(_ERROR_DUPTEMPLATENAME);
 
 
-        $name = addslashes($name);
-        $desc = addslashes($desc);
+        $name = sql_real_escape_string($name);
+        $desc = sql_real_escape_string($desc);
 
         // 1. Remove all template parts
         $query = 'DELETE FROM '.sql_table('template').' WHERE tdesc=' . $templateid;
@@ -4000,8 +4038,8 @@
      * @todo document this
      */
     function addToTemplate($id, $partname, $content) {
-        $partname = addslashes($partname);
-        $content = addslashes($content);
+        $partname = sql_real_escape_string($partname);
+        $content = sql_real_escape_string($content);
 
         $id = intval($id);
 
@@ -4637,7 +4675,7 @@
         $newid = intval($newid);
         $content = $skin->getContent($type);
         if ($content) {
-            $query = 'INSERT INTO '.sql_table('skin')." (sdesc, scontent, stype) VALUES ($newid,'". addslashes($content)."', '". addslashes($type)."')";
+            $query = 'INSERT INTO '.sql_table('skin')." (sdesc, scontent, stype) VALUES ($newid,'". sql_real_escape_string($content)."', '". sql_real_escape_string($type)."')";
             sql_query($query);
         }
     }
@@ -4719,19 +4757,34 @@
                 <?php               // show a dropdown list of all available languages
                 global $DIR_LANG;
                 $dirhandle = opendir($DIR_LANG);
-                while ($filename = readdir($dirhandle)) {
-                    if (ereg("^(.*)\.php$",$filename,$matches)) {
-                        $name = $matches[1];
-                        echo "<option value='$name'";
-                        if ($name == $CONF['Language'])
-                            echo " selected='selected'";
-                        echo ">$name</option>";
-                    }
-                }
-                closedir($dirhandle);
 
-                ?>
-                </select>
+				while ($filename = readdir($dirhandle) )
+				{
+
+					# replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
+					# original ereg: ereg("^(.*)\.php$",$filename,$matches)
+
+					if (preg_match('#^(.*)\.php$#', $filename, $matches) )
+					{
+
+						$name = $matches[1];
+						echo "<option value=\"$name\"";
+
+						if ($name == $CONF['Language'])
+						{
+							echo " selected=\"selected\"";
+						}
+
+						echo ">$name</option>";
+
+					}
+
+				}
+
+				closedir($dirhandle);
+
+				?>
+				</select>
 
             </td>
         </tr><tr>
@@ -5128,8 +5181,8 @@
      * @todo document this
      */
     function updateConfig($name, $val) {
-        $name = addslashes($name);
-        $val = trim(addslashes($val));
+        $name = sql_real_escape_string($name);
+        $val = trim(sql_real_escape_string($val));
 
         $query = 'UPDATE '.sql_table('config')
                . " SET value='$val'"
@@ -5888,57 +5941,80 @@
         $template['tabindex'] = 10;
         showlist($query, 'table', $template);
 
-        ?>
-            <h3><?php echo _PLUGS_TITLE_UPDATE?></h3>
+?>
+			<h3><?php echo _PLUGS_TITLE_UPDATE?></h3>
 
-            <p><?php echo _PLUGS_TEXT_UPDATE?></p>
+			<p><?php echo _PLUGS_TEXT_UPDATE?></p>
 
-            <form method="post" action="index.php"><div>
-                <input type="hidden" name="action" value="pluginupdate" />
-                <?php $manager->addTicketHidden() ?>
-                <input type="submit" value="<?php echo _PLUGS_BTN_UPDATE ?>" tabindex="20" />
-            </div></form>
+			<form method="post" action="index.php"><div>
+				<input type="hidden" name="action" value="pluginupdate" />
+				<?php $manager->addTicketHidden() ?>
+				<input type="submit" value="<?php echo _PLUGS_BTN_UPDATE ?>" tabindex="20" />
+			</div></form>
 
-            <h3><?php echo _PLUGS_TITLE_NEW?></h3>
+			<h3><?php echo _PLUGS_TITLE_NEW?></h3>
 
-            <?php               // find a list of possibly non-installed plugins
-                $candidates = array();
-                global $DIR_PLUGINS;
-                $dirhandle = opendir($DIR_PLUGINS);
-                while ($filename = readdir($dirhandle)) {
-                    if (ereg('^NP_(.*)\.php$',$filename,$matches)) {
-                        $name = $matches[1];
-                        // only show in list when not yet installed
-                        $res = sql_query('SELECT * FROM '.sql_table('plugin').' WHERE pfile="NP_'.addslashes($name).'"');
-                        if (sql_num_rows($res) == 0)
-                            array_push($candidates,$name);
-                    }
-                }
-                closedir($dirhandle);
+<?php
+		// find a list of possibly non-installed plugins
+		$candidates = array();
 
-                if (sizeof($candidates) > 0) {
-            ?>
+		global $DIR_PLUGINS;
 
-            <p><?php echo _PLUGS_ADD_TEXT?></p>
+		$dirhandle = opendir($DIR_PLUGINS);
 
+		while ($filename = readdir($dirhandle) )
+		{
 
-            <form method='post' action='index.php'><div>
-                <input type='hidden' name='action' value='pluginadd' />
-                <?php $manager->addTicketHidden() ?>
-                <select name="filename" tabindex="30">
-                <?php                   foreach($candidates as $name)
-                        echo '<option value="NP_',$name,'">',htmlspecialchars($name),'</option>';
-                ?>
-                </select>
-                <input type='submit' tabindex="40" value='<?php echo _PLUGS_BTN_INSTALL?>' />
-            </div></form>
+			# replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
+			# original ereg: ereg('^NP_(.*)\.php$',$filename,$matches)
 
-        <?php           } else {    // sizeof(candidates) == 0
-                echo '<p>',_PLUGS_NOCANDIDATES,'</p>';
-            }
+			if (preg_match('#^NP_(.*)\.php$#', $filename, $matches) )
+			{
 
-        $this->pagefoot();
-    }
+				$name = $matches[1];
+				// only show in list when not yet installed
+				$res = sql_query('SELECT * FROM ' . sql_table('plugin') . ' WHERE `pfile` = "NP_' . sql_real_escape_string($name) . '"');
+
+				if (sql_num_rows($res) == 0)
+				{
+					array_push($candidates, $name);
+				}
+
+			}
+
+		}
+
+		closedir($dirhandle);
+
+		if (sizeof($candidates) > 0)
+		{
+?>
+			<p><?php echo _PLUGS_ADD_TEXT?></p>
+
+			<form method='post' action='index.php'><div>
+				<input type='hidden' name='action' value='pluginadd' />
+				<?php $manager->addTicketHidden() ?>
+				<select name="filename" tabindex="30">
+<?php
+			foreach($candidates as $name)
+			{
+				echo '<option value="NP_',$name,'">',htmlspecialchars($name),'</option>';
+			}
+?>
+				</select>
+				<input type='submit' tabindex="40" value='<?php echo _PLUGS_BTN_INSTALL?>' />
+			</div></form>
+
+<?php
+		}
+		else
+		{
+			echo '<p>', _PLUGS_NOCANDIDATES, '</p>';
+		}
+
+		$this->pagefoot();
+
+	}
 
     /**
      * @todo document this
@@ -6007,7 +6083,7 @@
         );
 
         // do this before calling getPlugin (in case the plugin id is used there)
-        $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.addslashes($name).'")';
+        $query = 'INSERT INTO '.sql_table('plugin').' (porder, pfile) VALUES ('.$newOrder.',"'.sql_real_escape_string($name).'")';
         sql_query($query);
         $iPid = sql_insert_id();
 
@@ -6093,7 +6169,7 @@
             {
                 $eventList = $plug->getEventList();
                 foreach ($eventList as $eventName)
-                    sql_query('INSERT INTO '.sql_table('plugin_event').' (pid, event) VALUES ('.$pid.', \''.addslashes($eventName).'\')');
+                    sql_query('INSERT INTO '.sql_table('plugin_event').' (pid, event) VALUES ('.$pid.', \''.sql_real_escape_string($eventName).'\')');
             }
         }
 
@@ -6398,7 +6474,7 @@
 
         // get list of oids per pid
         $query = 'SELECT * FROM ' . sql_table('plugin_option_desc') . ',' . sql_table('plugin')
-               . ' WHERE opid=pid and ocontext=\''.addslashes($context).'\' ORDER BY porder, oid ASC';
+               . ' WHERE opid=pid and ocontext=\''.sql_real_escape_string($context).'\' ORDER BY porder, oid ASC';
         $res = sql_query($query);
         $aOptions = array();
         while ($o = sql_fetch_object($res)) {
diff -x .svn -aruN 3.51.src/nucleus/libs/backup.php 3.61.src/nucleus/libs/backup.php
--- 3.51.src/nucleus/libs/backup.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/backup.php	2010-12-19 00:16:48.000000000 -0600
@@ -16,7 +16,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: backup.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: backup.php 1470 2010-11-29 22:10:16Z ftruscot $
  */
 
 
@@ -297,7 +297,7 @@
 					echo ' NULL';
 				} elseif ($row[$j] != '') {
 					// data
-					echo " '" . addslashes($row[$j]) . "'";
+					echo " '" . sql_real_escape_string($row[$j]) . "'";
 				} else {
 					// empty column (!= no data!)
 					echo "''";
diff -x .svn -aruN 3.51.src/nucleus/libs/BAN.php 3.61.src/nucleus/libs/BAN.php
--- 3.51.src/nucleus/libs/BAN.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/BAN.php	2010-12-19 00:16:48.000000000 -0600
@@ -14,7 +14,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: BAN.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: BAN.php 1470 2010-11-29 22:10:16Z ftruscot $
  */
 
 class BAN {
@@ -56,7 +56,7 @@
 		);
 
 		$query = 'INSERT INTO '.sql_table('ban')." (blogid, iprange, reason) VALUES "
-			   . "($blogid,'".addslashes($iprange)."','".addslashes($reason)."')";
+			   . "($blogid,'".sql_real_escape_string($iprange)."','".sql_real_escape_string($reason)."')";
 		$res = sql_query($query);
 
 		$manager->notify(
@@ -81,7 +81,7 @@
 
 		$manager->notify('PreDeleteBan', array('blogid' => $blogid, 'range' => $iprange));
 
-		$query = 'DELETE FROM '.sql_table('ban')." WHERE blogid=$blogid and iprange='" .addslashes($iprange). "'";
+		$query = 'DELETE FROM '.sql_table('ban')." WHERE blogid=$blogid and iprange='" .sql_real_escape_string($iprange). "'";
 		sql_query($query);
 
 		$result = (sql_affected_rows() > 0);
diff -x .svn -aruN 3.51.src/nucleus/libs/BLOG.php 3.61.src/nucleus/libs/BLOG.php
--- 3.51.src/nucleus/libs/BLOG.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/BLOG.php	2010-12-19 00:16:48.000000000 -0600
@@ -16,7 +16,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: BLOG.php 1398 2009-08-05 22:14:07Z ftruscot $
+ * @version $Id: BLOG.php 1469 2010-11-24 18:05:48Z ftruscot $
  */
 
 if ( !function_exists('requestVar') ) exit;
@@ -266,9 +266,9 @@
 
 		$manager->notify('PreAddItem',array('title' => &$title, 'body' => &$body, 'more' => &$more, 'blog' => &$this, 'authorid' => &$authorid, 'timestamp' => &$timestamp, 'closed' => &$closed, 'draft' => &$draft, 'catid' => &$catid));
 
-		$title = addslashes($title);
-		$body = addslashes($body);
-		$more = addslashes($more);
+		$title = sql_real_escape_string($title);
+		$body = sql_real_escape_string($body);
+		$more = sql_real_escape_string($more);
 
 		$query = 'INSERT INTO '.sql_table('item').' (ITITLE, IBODY, IMORE, IBLOG, IAUTHOR, ITIME, ICLOSED, IDRAFT, ICAT, IPOSTED) '
 			   . "VALUES ('$title', '$body', '$more', $blogid, $authorid, '$timestamp', $closed, $draft, $catid, $posted)";
@@ -364,7 +364,7 @@
 				)
 			);
 
-			$query = 'INSERT INTO '.sql_table('category').' (cblog, cname, cdesc) VALUES (' . $this->getID() . ", '" . addslashes($catName) . "', '" . addslashes($catDescription) . "')";
+			$query = 'INSERT INTO '.sql_table('category').' (cblog, cname, cdesc) VALUES (' . $this->getID() . ", '" . sql_real_escape_string($catName) . "', '" . sql_real_escape_string($catDescription) . "')";
 			sql_query($query);
 			$catid = sql_insert_id();
 
@@ -854,8 +854,8 @@
 			$offset = intval($offset);
 
 		$query =  'UPDATE '.sql_table('blog')
-			   . " SET bname='" . addslashes($this->getName()) . "',"
-			   . "     bshortname='". addslashes($this->getShortName()) . "',"
+			   . " SET bname='" . sql_real_escape_string($this->getName()) . "',"
+			   . "     bshortname='". sql_real_escape_string($this->getShortName()) . "',"
 			   . "     bcomments=". intval($this->commentsEnabled()) . ","
 			   . "     bmaxcomments=" . intval($this->getMaxComments()) . ","
 			   . "     btimeoffset=" . $offset . ","
@@ -863,11 +863,11 @@
 			   . "     breqemail=" . intval($this->emailRequired()) . ","
 			   . "     bconvertbreaks=" . intval($this->convertBreaks()) . ","
 			   . "     ballowpast=" . intval($this->allowPastPosting()) . ","
-			   . "     bnotify='" . addslashes($this->getNotifyAddress()) . "',"
+			   . "     bnotify='" . sql_real_escape_string($this->getNotifyAddress()) . "',"
 			   . "     bnotifytype=" . intval($this->getNotifyType()) . ","
-			   . "     burl='" . addslashes($this->getURL()) . "',"
-			   . "     bupdate='" . addslashes($this->getUpdateFile()) . "',"
-			   . "     bdesc='" . addslashes($this->getDescription()) . "',"
+			   . "     burl='" . sql_real_escape_string($this->getURL()) . "',"
+			   . "     bupdate='" . sql_real_escape_string($this->getUpdateFile()) . "',"
+			   . "     bdesc='" . sql_real_escape_string($this->getDescription()) . "',"
 			   . "     bdefcat=" . intval($this->getDefaultCategory()) . ","
 			   . "     bdefskin=" . intval($this->getDefaultSkin()) . ","
 			   . "     bincludesearch=" . intval($this->getSearchable())
@@ -907,7 +907,7 @@
 	}
 
 	function getCategoryIdFromName($name) {
-		$res = sql_query('SELECT catid FROM '.sql_table('category').' WHERE cblog='.$this->getID().' and cname="' . addslashes($name) . '"');
+		$res = sql_query('SELECT catid FROM '.sql_table('category').' WHERE cblog='.$this->getID().' and cname="' . sql_real_escape_string($name) . '"');
 		if (sql_num_rows($res) > 0) {
 			$o = sql_fetch_object($res);
 			return $o->catid;
@@ -1153,7 +1153,7 @@
 
 	// returns true if there is a blog with the given shortname (static)
 	function exists($name) {
-		$r = sql_query('select * FROM '.sql_table('blog').' WHERE bshortname="'.addslashes($name).'"');
+		$r = sql_query('select * FROM '.sql_table('blog').' WHERE bshortname="'.sql_real_escape_string($name).'"');
 		return (sql_num_rows($r) != 0);
 	}
 
@@ -1209,7 +1209,7 @@
 		}
 	}
 
-	/**
+/**
 	 * Shows the given list of items for this blog
 	 *
 	 * @param $itemarray
@@ -1222,12 +1222,16 @@
 	 *		1=show comments 0=don't show comments
 	 * @param $dateheads
 	 *		1=show dateheads 0=don't show dateheads
+	 * @param $showDrafts
+	 *		0=do not show drafts 1=show drafts
+	 * @param $showFuture
+	 *		0=do not show future posts 1=show future posts
 	 * @returns int
 	 *		amount of items shown
 	 */
-	function readLogFromList($itemarray, $template, $highlight = '', $comments = 1, $dateheads = 1) {
+	function readLogFromList($itemarray, $template, $highlight = '', $comments = 1, $dateheads = 1,$showDrafts = 0, $showFuture = 0) {
 
-		$query = $this->getSqlItemList($itemarray);
+		$query = $this->getSqlItemList($itemarray,$showDrafts,$showFuture);
 
 		return $this->showUsingQuery($template, $query, $highlight, $comments, $dateheads);
 	}
@@ -1237,14 +1241,20 @@
 	 *
 	 * @param $itemarray
 	 *		an array holding the item numbers of the items to be displayed
+	 * @param $showDrafts
+	 *		0=do not show drafts 1=show drafts
+	 * @param $showFuture
+	 *		0=do not show future posts 1=show future posts
 	 * @returns
 	 *		either a full SQL query, or an empty string
 	 * @note
 	 *		No LIMIT clause is added. (caller should add this if multiple pages are requested)
 	 */
-	function getSqlItemList($itemarray)
+	function getSqlItemList($itemarray,$showDrafts = 0,$showFuture = 0)
 	{
 		if (!is_array($itemarray)) return '';
+		$showDrafts = intval($showDrafts);
+		$showFuture = intval($showFuture);
 		$items = array();
 		foreach ($itemarray as $value) {
 			if (intval($value)) $items[] = intval($value);
@@ -1277,10 +1287,9 @@
 					. ' WHERE'
 				    .    ' i.iblog='.$this->blogid
 				   . ' and i.iauthor=m.mnumber'
-				   . ' and i.icat=c.catid'
-				   . ' and i.idraft=0'	// exclude drafts
-						// don't show future items
-				   . ' and i.itime<=' . mysqldate($this->getCorrectTime());
+				   . ' and i.icat=c.catid';
+			if (!$showDrafts) $query .= ' and i.idraft=0';	// exclude drafts						
+			if (!$showFuture) $query .= ' and i.itime<=' . mysqldate($this->getCorrectTime()); // don't show future items
 
 			//$query .= ' and i.inumber IN ('.$itemlist.')';
 			$query .= ' and i.inumber='.intval($value);
diff -x .svn -aruN 3.51.src/nucleus/libs/BODYACTIONS.php 3.61.src/nucleus/libs/BODYACTIONS.php
--- 3.51.src/nucleus/libs/BODYACTIONS.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/BODYACTIONS.php	2010-12-19 00:16:48.000000000 -0600
@@ -15,7 +15,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: BODYACTIONS.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: BODYACTIONS.php 1457 2010-10-26 15:47:41Z ftruscot $
  */
 
 class BODYACTIONS extends BaseActions {
@@ -30,6 +30,8 @@
 	
 	function setCurrentItem(&$item) {
 		$this->currentItem =& $item;
+		global $currentitemid;
+		$currentitemid = $this->currentItem->itemid;
 	}
 	
 	function setTemplate($template) {
@@ -37,7 +39,7 @@
 	}
 
 	function getDefinedActions() {
-		return array('image', 'media', 'popup', 'plugin');
+		return array('image', 'media', 'popup', 'plugin', 'if', 'else', 'endif', 'elseif', 'ifnot', 'elseifnot');
 	}
 
 	function parse_plugin($pluginName) {
@@ -147,6 +149,247 @@
 
 		echo TEMPLATE::fill($this->template['POPUP_CODE'],$vars);
 	}
+	
+	// function to enable if-else-elseif-elseifnot-ifnot-endif to item template fields
+	
+	/**
+	 * Checks conditions for if statements
+	 *
+	 * @param string $field type of <%if%>
+	 * @param string $name property of field
+	 * @param string $value value of property
+	 */
+	function checkCondition($field, $name='', $value = '') {
+		global $catid, $blog, $member, $itemidnext, $itemidprev, $manager, $archiveprevexists, $archivenextexists;
+
+		$condition = 0;
+		switch($field) {
+			case 'category':
+				$condition = ($blog && $this->_ifCategory($name,$value));
+				break;
+			case 'itemcategory':
+				$condition = ($this->_ifItemCategory($name,$value));
+				break;
+			case 'blogsetting':
+				$condition = ($blog && ($blog->getSetting($name) == $value));
+				break;
+			case 'itemblogsetting':
+				$b =& $manager->getBlog(getBlogIDFromItemID($this->currentItem->itemid));
+				$condition = ($b && ($b->getSetting($name) == $value));
+				break;
+			case 'loggedin':
+				$condition = $member->isLoggedIn();
+				break;
+			case 'onteam':
+				$condition = $member->isLoggedIn() && $this->_ifOnTeam($name);
+				break;
+			case 'admin':
+				$condition = $member->isLoggedIn() && $this->_ifAdmin($name);
+				break;
+			case 'author':
+				$condition = ($this->_ifAuthor($name,$value));
+				break;
+/*			case 'nextitem':
+				$condition = ($itemidnext != '');
+				break;
+			case 'previtem':
+				$condition = ($itemidprev != '');
+				break;
+			case 'archiveprevexists':
+				$condition = ($archiveprevexists == true);
+				break;
+			case 'archivenextexists':
+				$condition = ($archivenextexists == true);
+				break; 
+			case 'skintype':
+				$condition = ($name == $this->skintype);
+				break; */
+			case 'hasplugin':
+				$condition = $this->_ifHasPlugin($name, $value);
+				break;
+			default:
+				$condition = $manager->pluginInstalled('NP_' . $field) && $this->_ifPlugin($field, $name, $value);
+				break;
+		}
+		return $condition;
+	}	
+	
+	/**
+	 *  Different checks for a category
+	 */
+	function _ifCategory($name = '', $value='') {
+		global $blog, $catid;
+
+		// when no parameter is defined, just check if a category is selected
+		if (($name != 'catname' && $name != 'catid') || ($value == ''))
+			return $blog->isValidCategory($catid);
+
+		// check category name
+		if ($name == 'catname') {
+			$value = $blog->getCategoryIdFromName($value);
+			if ($value == $catid)
+				return $blog->isValidCategory($catid);
+		}
+
+		// check category id
+		if (($name == 'catid') && ($value == $catid))
+			return $blog->isValidCategory($catid);
+
+		return false;
+	}
+	
+		
+	/**
+	 *  Different checks for an author
+	 */
+	function _ifAuthor($name = '', $value='') {
+		global $member, $manager;
+		
+		$b =& $manager->getBlog(getBlogIDFromItemID($this->currentItem->itemid));
+
+		// when no parameter is defined, just check if author is current visitor
+		if (($name != 'isadmin' && $name != 'name') || ($name == 'name' && $value == '')) {
+			return (intval($member->getID()) > 0 && intval($member->getID()) == intval($this->currentItem->authorid));
+		}
+
+		// check author name
+		if ($name == 'name') {
+			$value = strtolower($value);
+			if ($value == strtolower($this->currentItem->author))
+				return true;
+		}
+
+		// check if author is admin
+		if (($name == 'isadmin')) {			
+			$aid = intval($this->currentItem->authorid);
+			$blogid = intval($b->getID());			
+			$amember =& $manager->getMember($aid);
+			if ($amember->isAdmin())
+				return true;
+				
+			return $amember->isBlogAdmin($blogid);
+		}
+
+		return false;
+	}
+	
+	/**
+	 *  Different checks for a category
+	 */
+	function _ifItemCategory($name = '', $value='') {
+		global $catid, $manager;
+		
+		$b =& $manager->getBlog(getBlogIDFromItemID($this->currentItem->itemid));
+
+		// when no parameter is defined, just check if a category is selected
+		if (($name != 'catname' && $name != 'catid') || ($value == ''))
+			return $b->isValidCategory($catid);
+			
+		$icatid = $this->currentItem->catid;
+		//$icategory = $this->currentItem->category;
+
+		// check category name
+		if ($name == 'catname') {
+			$value = $b->getCategoryIdFromName($value);
+			if ($value == $icatid)
+				return $b->isValidCategory($icatid);
+		}
+
+		// check category id
+		if (($name == 'catid') && ($value == $icatid))
+			return $b->isValidCategory($icatid);
+
+		return false;
+	}
+
+	
+	/**
+	 *  Checks if a member is on the team of a blog and return his rights
+	 */
+	function _ifOnTeam($blogName = '') {
+		global $blog, $member, $manager;
+
+		// when no blog found
+		if (($blogName == '') && (!is_object($blog)))
+			return 0;
+
+		// explicit blog selection
+		if ($blogName != '')
+			$blogid = getBlogIDFromName($blogName);
+
+		if (($blogName == '') || !$manager->existsBlogID($blogid))
+			// use current blog
+			$blogid = $blog->getID();
+
+		return $member->teamRights($blogid);
+	}
+
+	/**
+	 *  Checks if a member is admin of a blog
+	 */
+	function _ifAdmin($blogName = '') {
+		global $blog, $member, $manager;
+
+		// when no blog found
+		if (($blogName == '') && (!is_object($blog)))
+			return 0;
+
+		// explicit blog selection
+		if ($blogName != '')
+			$blogid = getBlogIDFromName($blogName);
+
+		if (($blogName == '') || !$manager->existsBlogID($blogid))
+			// use current blog
+			$blogid = $blog->getID();
+
+		return $member->isBlogAdmin($blogid);
+	}
+
+	
+	/**
+	 *	hasplugin,PlugName
+	 *	   -> checks if plugin exists
+	 *	hasplugin,PlugName,OptionName
+	 *	   -> checks if the option OptionName from plugin PlugName is not set to 'no'
+	 *	hasplugin,PlugName,OptionName=value
+	 *	   -> checks if the option OptionName from plugin PlugName is set to value
+	 */
+	function _ifHasPlugin($name, $value) {
+		global $manager;
+		$condition = false;
+		// (pluginInstalled method won't write a message in the actionlog on failure)
+		if ($manager->pluginInstalled('NP_'.$name)) {
+			$plugin =& $manager->getPlugin('NP_' . $name);
+			if ($plugin != NULL) {
+				if ($value == "") {
+					$condition = true;
+				} else {
+					list($name2, $value2) = explode('=', $value, 2);
+					if ($value2 == "" && $plugin->getOption($name2) != 'no') {
+						$condition = true;
+					} else if ($plugin->getOption($name2) == $value2) {
+						$condition = true;
+					}
+				}
+			}
+		}
+		return $condition;
+	}
+
+	/**
+	 * Checks if a plugin exists and call its doIf function
+	 */
+	function _ifPlugin($name, $key = '', $value = '') {
+		global $manager;
+
+		$plugin =& $manager->getPlugin('NP_' . $name);
+		if (!$plugin) return;
+
+		$params = func_get_args();
+		array_shift($params);
+
+		return call_user_func_array(array(&$plugin, 'doIf'), $params);
+	}
 
 }
 ?>
diff -x .svn -aruN 3.51.src/nucleus/libs/COMMENTACTIONS.php 3.61.src/nucleus/libs/COMMENTACTIONS.php
--- 3.51.src/nucleus/libs/COMMENTACTIONS.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/COMMENTACTIONS.php	2010-12-19 00:16:48.000000000 -0600
@@ -14,7 +14,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: COMMENTACTIONS.php 1405 2009-08-14 15:56:06Z ftruscot $
+ * @version $Id: COMMENTACTIONS.php 1472 2010-12-03 19:33:53Z gregorlove $
  */
 
 class COMMENTACTIONS extends BaseActions {
@@ -70,7 +70,13 @@
 			'plugin',
 			'include',
 			'phpinclude',
-			'parsedinclude'
+			'parsedinclude',
+			'if',
+			'else',
+			'endif',
+			'elseif',
+			'ifnot',
+			'elseifnot'
 		);
 	}
 
@@ -87,16 +93,27 @@
 	}
 	
 	function setCurrentComment(&$comment) {
+
 		global $manager;
-		if ($comment['memberid'] != 0) {
+
+		// begin if: member comment
+		if ($comment['memberid'] != 0)
+		{
 			$comment['authtext'] = $template['COMMENTS_AUTH'];
 
 			$mem =& $manager->getMember($comment['memberid']);
 			$comment['user'] = $mem->getDisplayName();
-			if ($mem->getURL())
+
+			// begin if: member URL exists, set it as the userid
+			if ($mem->getURL() )
+			{
 				$comment['userid'] = $mem->getURL();
+			}
+			// else: set the email as the userid
 			else
+			{
 				$comment['userid'] = $mem->getEmail();
+			} // end if
 
 			$comment['userlinkraw'] = createLink(
 										'member',
@@ -105,28 +122,48 @@
 											'name' => $mem->getDisplayName(),
 											'extra' => $this->commentsObj->itemActions->linkparams
 										)
-									  );
+									);
 
-		} else {
+		}
+		// else: non-member comment
+		else
+		{
 
 			// create smart links
-/*			if (isValidMailAddress($comment['userid']))
-				$comment['userlinkraw'] = 'mailto:'.$comment['userid'];
-			elseif (strstr($comment['userid'],'http://') != false)
-				$comment['userlinkraw'] = $comment['userid'];
-			elseif (strstr($comment['userid'],'www') != false)
-				$comment['userlinkraw'] = 'http://'.$comment['userid'];*/
-			if (strstr($comment['userid'],'http://') != false)
-				$comment['userlinkraw'] = $comment['userid'];
-			elseif (strstr($comment['userid'],'www') != false)
-				$comment['userlinkraw'] = 'http://'.$comment['userid'];
-			elseif (isValidMailAddress($comment['email']))
-				$comment['userlinkraw'] = 'mailto:'.$comment['email'];
-			elseif (isValidMailAddress($comment['userid']))
-				$comment['userlinkraw'] = 'mailto:'.$comment['userid'];
-		}
+
+			// begin if: comment userid is not empty
+			if (!empty($comment['userid']) )
+			{
+
+				// begin if: comment userid has either "http://" or "https://" at the beginning
+				if ( (strpos($comment['userid'], 'http://') === 0) || (strpos($comment['userid'], 'https://') === 0) )
+				{
+					$comment['userlinkraw'] = $comment['userid'];
+				}
+				// else: prepend the "http://" (backwards compatibility before rev 1471)
+				else
+				{
+					$comment['userlinkraw'] = 'http://' . $comment['userid'];
+				} // end if
+
+			}
+			// else if: comment email is valid
+			else if (isValidMailAddress($comment['email']) )
+			{
+				$comment['userlinkraw'] = 'mailto:' . $comment['email'];
+			}
+			// else if: comment userid is a valid email
+			else if (isValidMailAddress($comment['userid']) )
+			{
+				$comment['userlinkraw'] = 'mailto:' . $comment['userid'];
+			} // end if
+
+		} // end if
 
 		$this->currentComment =& $comment;
+		global $currentcommentid, $currentcommentarray;
+		$currentcommentid = $comment['commentid'];
+		$currentcommentarray = $comment;
 	}
 
 	/**
@@ -400,6 +437,264 @@
 			echo $this->currentComment['user'];
 		}
 	}
+	
+	// function to enable if-else-elseif-elseifnot-ifnot-endif to comment template fields
+	
+	/**
+	 * Checks conditions for if statements
+	 *
+	 * @param string $field type of <%if%>
+	 * @param string $name property of field
+	 * @param string $value value of property
+	 */
+	function checkCondition($field, $name='', $value = '') {
+		global $catid, $blog, $member, $itemidnext, $itemidprev, $manager, $archiveprevexists, $archivenextexists;
+
+		$condition = 0;
+		switch($field) {
+			case 'category':
+				$condition = ($blog && $this->_ifCategory($name,$value));
+				break;
+			case 'itemcategory':
+				$condition = ($this->_ifItemCategory($name,$value));
+				break;
+			case 'blogsetting':
+				$condition = ($blog && ($blog->getSetting($name) == $value));
+				break;
+			case 'itemblogsetting':
+				$b =& $manager->getBlog(getBlogIDFromItemID($this->currentComment['itemid']));
+				$condition = ($b && ($b->getSetting($name) == $value));
+				break;
+			case 'loggedin':
+				$condition = $member->isLoggedIn();
+				break;
+			case 'onteam':
+				$condition = $member->isLoggedIn() && $this->_ifOnTeam($name);
+				break;
+			case 'admin':
+				$condition = $member->isLoggedIn() && $this->_ifAdmin($name);
+				break;
+			case 'author':
+				$condition = ($this->_ifAuthor($name,$value));
+				break;
+/*			case 'nextitem':
+				$condition = ($itemidnext != '');
+				break;
+			case 'previtem':
+				$condition = ($itemidprev != '');
+				break;
+			case 'archiveprevexists':
+				$condition = ($archiveprevexists == true);
+				break;
+			case 'archivenextexists':
+				$condition = ($archivenextexists == true);
+				break; 
+			case 'skintype':
+				$condition = ($name == $this->skintype);
+				break; */
+			case 'hasplugin':
+				$condition = $this->_ifHasPlugin($name, $value);
+				break;
+			default:
+				$condition = $manager->pluginInstalled('NP_' . $field) && $this->_ifPlugin($field, $name, $value);
+				break;
+		}
+		return $condition;
+	}	
+	
+	/**
+	 *  Different checks for a category
+	 */
+	function _ifCategory($name = '', $value='') {
+		global $blog, $catid;
+
+		// when no parameter is defined, just check if a category is selected
+		if (($name != 'catname' && $name != 'catid') || ($value == ''))
+			return $blog->isValidCategory($catid);
+
+		// check category name
+		if ($name == 'catname') {
+			$value = $blog->getCategoryIdFromName($value);
+			if ($value == $catid)
+				return $blog->isValidCategory($catid);
+		}
+
+		// check category id
+		if (($name == 'catid') && ($value == $catid))
+			return $blog->isValidCategory($catid);
+
+		return false;
+	}
+	
+		
+	/**
+	 *  Different checks for an author
+	 */
+	function _ifAuthor($name = '', $value='') {
+		global $member, $manager;
+		
+		if ($this->currentComment['memberid'] == 0) return false;
+		
+		$mem =& $manager->getMember($this->currentComment['memberid']);
+		$b =& $manager->getBlog(getBlogIDFromItemID($this->currentComment['itemid']));
+		$citem =& $manager->getItem($this->currentComment['itemid'],1,1);
+
+		// when no parameter is defined, just check if item author is current visitor
+		if (($name != 'isadmin' && $name != 'name' && $name != 'isauthor' && $name != 'isonteam')) {
+			return (intval($member->getID()) > 0 && intval($member->getID()) == intval($citem['authorid']));
+		}
+
+		// check comment author name
+		if ($name == 'name') {
+			$value = trim(strtolower($value));
+			if ($value == '') 
+				return false;
+			if ($value == strtolower($mem->getDisplayName()))
+				return true;
+		}
+
+		// check if comment author is admin
+		if ($name == 'isadmin') {			
+			$blogid = intval($b->getID());			
+			if ($mem->isAdmin())
+				return true;
+				
+			return $mem->isBlogAdmin($blogid);
+		}
+		
+		// check if comment author is item author
+		if ($name == 'isauthor') {			
+			return (intval($citem['authorid']) == intval($this->currentComment['memberid']));
+		}
+		
+		// check if comment author is on team
+		if ($name == 'isonteam') {
+			return $mem->teamRights(intval($b->getID()));
+		}
+
+		return false;
+	}
+	
+	/**
+	 *  Different checks for a category
+	 */
+	function _ifItemCategory($name = '', $value='') {
+		global $catid, $manager;
+		
+		$b =& $manager->getBlog(getBlogIDFromItemID($this->currentComment['itemid']));
+		$citem =& $manager->getItem($this->currentComment['itemid'],1,1);
+		$icatid = $citem['catid'];
+
+		// when no parameter is defined, just check if a category is selected
+		if (($name != 'catname' && $name != 'catid') || ($value == ''))
+			return $b->isValidCategory($icatid);
+			
+		// check category name
+		if ($name == 'catname') {
+			$value = $b->getCategoryIdFromName($value);
+			if ($value == $icatid)
+				return $b->isValidCategory($icatid);
+		}
+
+		// check category id
+		if (($name == 'catid') && ($value == $icatid))
+			return $b->isValidCategory($icatid);
+
+		return false;
+	}
+
+	
+	/**
+	 *  Checks if a member is on the team of a blog and return his rights
+	 */
+	function _ifOnTeam($blogName = '') {
+		global $blog, $member, $manager;
+		
+		$b =& $manager->getBlog(getBlogIDFromItemID($this->currentComment['itemid']));
+		
+		// when no blog found
+		if (($blogName == '') && (!is_object($b)))
+			return 0;
+
+		// explicit blog selection
+		if ($blogName != '')
+			$blogid = getBlogIDFromName($blogName);
+
+		if (($blogName == '') || !$manager->existsBlogID($blogid))
+			// use current blog
+			$blogid = $b->getID();
+
+		return $member->teamRights($blogid);
+	}
+
+	/**
+	 *  Checks if a member is admin of a blog
+	 */
+	function _ifAdmin($blogName = '') {
+		global $blog, $member, $manager;
+
+		$b =& $manager->getBlog(getBlogIDFromItemID($this->currentComment['itemid']));
+		
+		// when no blog found
+		if (($blogName == '') && (!is_object($b)))
+			return 0;
+
+		// explicit blog selection
+		if ($blogName != '')
+			$blogid = getBlogIDFromName($blogName);
+
+		if (($blogName == '') || !$manager->existsBlogID($blogid))
+			// use current blog
+			$blogid = $b->getID();
+
+		return $member->isBlogAdmin($blogid);
+	}
+
+	
+	/**
+	 *	hasplugin,PlugName
+	 *	   -> checks if plugin exists
+	 *	hasplugin,PlugName,OptionName
+	 *	   -> checks if the option OptionName from plugin PlugName is not set to 'no'
+	 *	hasplugin,PlugName,OptionName=value
+	 *	   -> checks if the option OptionName from plugin PlugName is set to value
+	 */
+	function _ifHasPlugin($name, $value) {
+		global $manager;
+		$condition = false;
+		// (pluginInstalled method won't write a message in the actionlog on failure)
+		if ($manager->pluginInstalled('NP_'.$name)) {
+			$plugin =& $manager->getPlugin('NP_' . $name);
+			if ($plugin != NULL) {
+				if ($value == "") {
+					$condition = true;
+				} else {
+					list($name2, $value2) = explode('=', $value, 2);
+					if ($value2 == "" && $plugin->getOption($name2) != 'no') {
+						$condition = true;
+					} else if ($plugin->getOption($name2) == $value2) {
+						$condition = true;
+					}
+				}
+			}
+		}
+		return $condition;
+	}
+
+	/**
+	 * Checks if a plugin exists and call its doIf function
+	 */
+	function _ifPlugin($name, $key = '', $value = '') {
+		global $manager;
+
+		$plugin =& $manager->getPlugin('NP_' . $name);
+		if (!$plugin) return;
+
+		$params = func_get_args();
+		array_shift($params);
+
+		return call_user_func_array(array(&$plugin, 'doIf'), $params);
+	}
 
 }
 ?>
diff -x .svn -aruN 3.51.src/nucleus/libs/COMMENT.php 3.61.src/nucleus/libs/COMMENT.php
--- 3.51.src/nucleus/libs/COMMENT.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/COMMENT.php	2010-12-19 00:24:42.000000000 -0600
@@ -15,32 +15,33 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2007 The Nucleus Group
- * @version $Id: COMMENT.php 1370 2009-06-22 22:00:32Z ftruscot $
+ * @version $Id: COMMENT.php 1483 2010-12-19 05:24:46Z ftruscot $
  */
 class COMMENT {
 
 	/**
 	  * Returns the requested comment
-	  * 
+	  *
 	  * @static
 	  */
 	function getComment($commentid) {
-		$query =  'SELECT cnumber as commentid, cbody as body, cuser as user, cmail as userid, cemail as email, cmember as memberid, ctime, chost as host, mname as member, cip as ip, cblog as blogid'
-			   . ' FROM '.sql_table('comment').' left outer join '.sql_table('member').' on cmember=mnumber'
-			   . ' WHERE cnumber=' . intval($commentid);
+		$query = 'SELECT `cnumber` AS commentid, `cbody` AS body, `cuser` AS user, `cmail` AS userid, `cemail` AS email, `cmember` AS memberid, `ctime`, `chost` AS host, `mname` AS member, `cip` AS ip, `cblog` AS blogid'
+					. ' FROM ' . sql_table('comment') . ' LEFT OUTER JOIN ' . sql_table('member') . ' ON `cmember` = `mnumber`'
+					. ' WHERE `cnumber` = ' . intval($commentid);
 		$comments = sql_query($query);
 
 		$aCommentInfo = sql_fetch_assoc($comments);
-		if ($aCommentInfo)
-		{
+
+		if ($aCommentInfo) {
 			$aCommentInfo['timestamp'] = strtotime($aCommentInfo['ctime']);
 		}
+
 		return $aCommentInfo;
 	}
 
 	/**
 	  * Prepares a comment to be saved
-	  * 	  
+	  *
 	  * @static
 	  */
 	function prepare($comment) {
@@ -48,10 +49,15 @@
 		$comment['userid'] = strip_tags($comment['userid']);
 		$comment['email'] = strip_tags($comment['email']);
 
-		// remove quotes and newlines from user and userid
-		$comment['user'] = strtr($comment['user'], "\'\"\n",'-- ');
-		$comment['userid'] = strtr($comment['userid'], "\'\"\n",'-- ');
-		$comment['email'] = strtr($comment['email'], "\'\"\n",'-- ');
+		// remove newlines from user; remove quotes and newlines from userid and email; trim whitespace from beginning and end
+		$comment['user'] = trim(strtr($comment['user'], "\n", ' ') );
+		$comment['userid'] = trim(strtr($comment['userid'], "\'\"\n", '-- ') );
+		$comment['email'] = trim(strtr($comment['email'], "\'\"\n", '-- ') );
+
+		// begin if: a comment userid is supplied, but does not have an "http://" or "https://" at the beginning - prepend an "http://"
+		if ( !empty($comment['userid']) && (strpos($comment['userid'], 'http://') !== 0) && (strpos($comment['userid'], 'https://') !== 0) ) {
+			$comment['userid'] = 'http://' . $comment['userid'];
+		} // end if
 
 		$comment['body'] = COMMENT::prepareBody($comment['body']);
 
@@ -62,11 +68,15 @@
 	 * Prepares the body of a comment
 	 *
 	 * @ static
-	 */	 	
+	 */
 	function prepareBody($body) {
 
-		// remove newlines when too many in a row
-		$body = ereg_replace("\n.\n.\n","\n",$body);
+		# replaced ereg_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
+		# original ereg_replace: ereg_replace("\n.\n.\n", "\n", $body);
+
+		// remove newlines when too many in a row		
+		$body = preg_replace("/\r\n/", "\n", $body);
+		$body = preg_replace("/\n+/", "\n", $body);
 
 		// encode special characters as entities
 		$body = htmlspecialchars($body);
@@ -86,10 +96,10 @@
 			'/([^:\/\/\w]|^)(mailto:(([a-zA-Z\@\%\.\-\+_])+))/ie'
 		);
 		$replaceTo = array(
-			'COMMENT::createLinkCode("\\1", "\\2","https")',
-			'COMMENT::createLinkCode("\\1", "\\2","http")',
-			'COMMENT::createLinkCode("\\1", "\\2","ftp")',
-			'COMMENT::createLinkCode("\\1", "\\3","mailto")'
+			'COMMENT::createLinkCode("\\1", "\\2", "https")',
+			'COMMENT::createLinkCode("\\1", "\\2", "http")',
+			'COMMENT::createLinkCode("\\1", "\\2", "ftp")',
+			'COMMENT::createLinkCode("\\1", "\\3", "mailto")'
 		);
 		$body = preg_replace($replaceFrom, $replaceTo, $body);
 
@@ -100,7 +110,7 @@
 	 * Creates a link code for unlinked URLs with different protocols
 	 *
 	 * @ static
-	 */	
+	 */
 	function createLinkCode($pre, $url, $protocol = 'http') {
 		$post = '';
 
@@ -108,41 +118,48 @@
 		// since htmlspecialchars is applied _before_ URL linking
 		// move the part of URL, starting from the disallowed entity to the 'post' link part
 		$aBadEntities = array('&quot;', '&gt;', '&lt;');
-		foreach ($aBadEntities as $entity)
-		{
+		foreach ($aBadEntities as $entity) {
+
 			$pos = strpos($url, $entity);
-			if ($pos)
-			{
+
+			if ($pos) {
 				$post = substr($url, $pos) . $post;
 				$url = substr($url, 0, $pos);
-
 			}
+
 		}
 
 		// remove entities at end (&&&&)
-		if (preg_match('/(&\w+;)+$/i', $url, $matches)) {
+		if (preg_match('/(&\w+;)+$/i', $url, $matches) ) {
 			$post = $matches[0] . $post;	// found entities (1 or more)
-			$url = substr($url, 0, strlen($url) - strlen($post));
+			$url = substr($url, 0, strlen($url) - strlen($post) );
 		}
 
 		// move ending comma from url to 'post' part
-		if (substr($url, strlen($url) - 1) == ',')
-		{
+		if (substr($url, strlen($url) - 1) == ',') {
 			$url = substr($url, 0, strlen($url) - 1);
 			$post = ',' . $post;
 		}
 
-		if (!ereg('^'.$protocol.'://',$url))
-			$linkedUrl = $protocol . (($protocol == 'mailto') ? ':' : '://') . $url;
+		# replaced ereg() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
+		# original ereg: ereg('^' . $protocol . '://', $url)
+
+		if (!preg_match('#^' . $protocol . '://#', $url) )
+		{
+			$linkedUrl = $protocol . ( ($protocol == 'mailto') ? ':' : '://') . $url;
+		}
 		else
+		{
 			$linkedUrl = $url;
+		}
 
-
-		if ($protocol != 'mailto')
+		if ($protocol != 'mailto') {
 			$displayedUrl = $linkedUrl;
-		else
+		} else {
 			$displayedUrl = $url;
-		return $pre . '<a href="'.$linkedUrl.'" rel="nofollow">'.shorten($displayedUrl,30,'...').'</a>' . $post;
+		}
+
+		return $pre . '<a href="' . $linkedUrl . '" rel="nofollow">' . shorten($displayedUrl,30,'...') . '</a>' . $post;
 	}
 
 }
diff -x .svn -aruN 3.51.src/nucleus/libs/COMMENTS.php 3.61.src/nucleus/libs/COMMENTS.php
--- 3.51.src/nucleus/libs/COMMENTS.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/COMMENTS.php	2010-12-19 00:16:48.000000000 -0600
@@ -15,7 +15,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: COMMENTS.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: COMMENTS.php 1474 2010-12-04 20:10:32Z gregorlove $
  */
 
 if ( !function_exists('requestVar') ) exit;
@@ -258,12 +258,12 @@
 
 		$manager->notify('PreAddComment',array('comment' => &$comment, 'spamcheck' => &$spamcheck));
 
-		$name		= addslashes($comment['user']);
-		$url		= addslashes($comment['userid']);
-		$email      = addslashes($comment['email']);
-		$body		= addslashes($comment['body']);
-		$host		= addslashes($comment['host']);
-		$ip			= addslashes($comment['ip']);
+		$name		= sql_real_escape_string($comment['user']);
+		$url		= sql_real_escape_string($comment['userid']);
+		$email      = sql_real_escape_string($comment['email']);
+		$body		= sql_real_escape_string($comment['body']);
+		$host		= sql_real_escape_string($comment['host']);
+		$ip			= sql_real_escape_string($comment['ip']);
 		$memberid	= intval($comment['memberid']);
 		$timestamp	= date('Y-m-d H:i:s', $comment['timestamp']);
 		$itemid		= $this->itemid;
@@ -299,41 +299,62 @@
 	 * that can check if the comment is a spam comment	  
 	 */
 	function isValidComment(&$comment, &$spamcheck) {
+
 		global $member, $manager;
 
 		// check if there exists a item for this date
-		$item =& $manager->getItem($this->itemid,0,0);
+		$item =& $manager->getItem($this->itemid, 0, 0);
 
 		if (!$item)
+		{
 			return _ERROR_NOSUCHITEM;
+		}
 
 		if ($item['closed'])
+		{
 			return _ERROR_ITEMCLOSED;
+		}
+
+		# replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
+		# original eregi comparison: eregi('[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}', $comment['body']) != FALSE
 
 		// don't allow words that are too long
-		if (eregi('[a-zA-Z0-9|\.,;:!\?=\/\\]{90,90}',$comment['body']) != false)
+		if (preg_match('/[a-zA-Z0-9|\.,;:!\?=\/\\\\]{90,90}/', $comment['body']) != 0)
+		{
 			return _ERROR_COMMENT_LONGWORD;
+		}
 
 		// check lengths of comment
-		if (strlen($comment['body'])<3)
+		if (strlen($comment['body']) < 3)
+		{
 			return _ERROR_COMMENT_NOCOMMENT;
+		}
 
-		if (strlen($comment['body'])>5000)
+		if (strlen($comment['body']) > 5000)
+		{
 			return _ERROR_COMMENT_TOOLONG;
+		}
 
 		// only check username if no member logged in
-		if (!$member->isLoggedIn())
-			if (strlen($comment['user'])<2)
+		if (!$member->isLoggedIn() )
+		{
+
+			if (strlen($comment['user']) < 2)
+			{
 				return _ERROR_COMMENT_NOUSERNAME;
+			}
+
+		}
 
-		if ((strlen($comment['email']) != 0) && !(isValidMailAddress($comment['email']))) {
+		if ((strlen($comment['email']) != 0) && !(isValidMailAddress(trim($comment['email']) ) ) )
+		{
 			return _ERROR_BADMAILADDRESS;
 		}
 
 		// let plugins do verification (any plugin which thinks the comment is invalid
 		// can change 'error' to something other than '1')
 		$result = 1;
-		$manager->notify('ValidateForm', array('type' => 'comment', 'comment' => &$comment, 'error' => &$result, 'spamcheck' => &$spamcheck));
+		$manager->notify('ValidateForm', array('type' => 'comment', 'comment' => &$comment, 'error' => &$result, 'spamcheck' => &$spamcheck) );
 
 		return $result;
 	}
diff -x .svn -aruN 3.51.src/nucleus/libs/globalfunctions.php 3.61.src/nucleus/libs/globalfunctions.php
--- 3.51.src/nucleus/libs/globalfunctions.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/globalfunctions.php	2010-12-19 00:24:42.000000000 -0600
@@ -13,16 +13,17 @@
 /**
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: globalfunctions.php 1421 2009-11-01 13:45:44Z kaigreve $
+ * @version $Id: globalfunctions.php 1483 2010-12-19 05:24:46Z ftruscot $
 
  */
 
 // needed if we include globalfunctions from install.php
 global $nucleus, $CONF, $DIR_LIBS, $DIR_LANG, $manager, $member;
 
-$nucleus['version'] = 'v3.51';
+$nucleus['version'] = 'v3.61';
 $nucleus['codename'] = '';
 
+// check and die if someone is trying to override internal globals (when register_globals turn on)
 checkVars(array('nucleus', 'CONF', 'DIR_LIBS', 'MYSQL_HOST', 'MYSQL_USER', 'MYSQL_PASSWORD', 'MYSQL_DATABASE', 'DIR_LANG', 'DIR_PLUGINS', 'HTTP_GET_VARS', 'HTTP_POST_VARS', 'HTTP_COOKIE_VARS', 'HTTP_ENV_VARS', 'HTTP_SESSION_VARS', 'HTTP_POST_FILES', 'HTTP_SERVER_VARS', 'GLOBALS', 'argv', 'argc', '_GET', '_POST', '_COOKIE', '_ENV', '_SESSION', '_SERVER', '_FILES'));
 
 $CONF['debug'] = 0;
@@ -64,6 +65,15 @@
     $CONF['URLMode'] = 'normal';
 }*/
 
+/*
+	Set these to 1 to allow viewing of future items or draft items
+	Should really never do this, but can be useful for some plugins that might need to
+	Could cause some other issues if you use future posts otr drafts
+	So use with care
+*/
+$CONF['allowDrafts'] = 0;
+$CONF['allowFuture'] = 0;
+
 if (getNucleusPatchLevel() > 0) {
     $nucleus['version'] .= '/' . getNucleusPatchLevel();
 }
@@ -115,6 +125,7 @@
 }
 
 // include core classes that are needed for login & plugin handling
+include_once($DIR_LIBS . 'mysql.php');
 // added for 3.5 sql_* wrapper
 global $MYSQL_HANDLER;
 if (!isset($MYSQL_HANDLER))
@@ -123,7 +134,6 @@
     $MYSQL_HANDLER[0] = 'mysql';
 include_once($DIR_LIBS . 'sql/'.$MYSQL_HANDLER[0].'.php');
 // end new for 3.5 sql_* wrapper
-include_once($DIR_LIBS . 'mysql.php');
 include($DIR_LIBS . 'MEMBER.php');
 include($DIR_LIBS . 'ACTIONLOG.php');
 include($DIR_LIBS . 'MANAGER.php');
@@ -345,8 +355,12 @@
 
 // read language file, only after user has been initialized
 $language = getLanguageName();
-//include($DIR_LANG . ereg_replace( '[\\|/]', '', $language) . '.php');
-include($DIR_LANG . preg_replace( '@\\|/@', '', $language) . '.php');
+
+# replaced ereg_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
+# original ereg_replace: ereg_replace( '[\\|/]', '', $language) . '.php')
+# important note that '\' must be matched with '\\\\' in preg* expressions
+
+include($DIR_LANG . preg_replace('#[\\\\|/]#', '', $language) . '.php');
 
 /*
     Backed out for now: See http://forum.nucleuscms.org/viewtopic.php?t=3684 for details
@@ -364,10 +378,11 @@
 */
 
 // make sure the archivetype skinvar keeps working when _ARCHIVETYPE_XXX not defined
-if (!defined('_ARCHIVETYPE_MONTH') ) {
-    define('_ARCHIVETYPE_DAY', 'day');
-    define('_ARCHIVETYPE_MONTH', 'month');
-    define('_ARCHIVETYPE_YEAR', 'year');
+if (!defined('_ARCHIVETYPE_MONTH') )
+{
+	define('_ARCHIVETYPE_DAY', 'day');
+	define('_ARCHIVETYPE_MONTH', 'month');
+	define('_ARCHIVETYPE_YEAR', 'year');
 }
 
 // decode path_info
@@ -484,6 +499,37 @@
         }
     }
 }
+/* 	PostParseURL is a place to cleanup any of the path-related global variables before the selector function is run.
+	It has 2 values in the data in case the original virtualpath is needed, but most the use will be in tweaking
+	global variables to clean up (scrub out catid or add catid) or to set someother global variable based on
+	the values of something like catid or itemid
+	New in 3.60
+*/
+$manager->notify(
+	'PostParseURL',
+	array(
+		'type' => basename(serverVar('SCRIPT_NAME') ), // e.g. item, blog, ...
+		'info' => $virtualpath
+	)
+);
+
+function include_libs($file,$once=true,$require=true){
+       global $DIR_LIBS;
+       if (!is_dir($DIR_LIBS)) exit;
+       if ($once && $require) require_once($DIR_LIBS.$file);
+       elseif ($once && !$require) include_once($DIR_LIBS.$file);
+       elseif ($require) require($DIR_LIBS.$file);
+       else include($DIR_LIBS.$file);
+}
+
+function include_plugins($file,$once=true,$require=true){
+       global $DIR_PLUGINS;
+       if (!is_dir($DIR_PLUGINS)) exit;
+       if ($once && $require) require_once($DIR_PLUGINS.$file);
+       elseif ($once && !$require) include_once($DIR_PLUGINS.$file);
+       elseif ($require) require($DIR_PLUGINS.$file);
+       else include($DIR_PLUGINS.$file);
+}
 
 function intPostVar($name) {
     return intval(postVar($name) );
@@ -505,7 +551,7 @@
   * returns the currently used version (100 = 1.00, 101 = 1.01, etc...)
   */
 function getNucleusVersion() {
-    return 351;
+    return 361;
 }
 
 /**
@@ -518,7 +564,7 @@
 }
 
 /**
- * returns the latest version available for download from nucleuscms.org 
+ * returns the latest version available for download from nucleuscms.org
  * or false if unable to attain data
  * format will be major.minor/patachlevel
  * e.g. 3.41 or 3.41/02
@@ -601,7 +647,7 @@
 }
 
 /**
- * Errors before the database connection has been made - moved to 
+ * Errors before the database connection has been made - moved to
  */
 /* moved to $DIR_LIBS/sql/*.php handler files
 function startUpError($msg, $title) {
@@ -641,54 +687,69 @@
 
 /**
  * Highlights a specific query in a given HTML text (not within HTML tags) and returns it
- *
- * @param $text
- *		text to be highlighted
- * @param $expression
- *		regular expression to be matched (can be an array of expressions as well)
- * @param $highlight
- *		highlight to be used (use \\0 to indicate the matched expression)
- *
- */
+ * @param string $text text to be highlighted
+ * @param string $expression regular expression to be matched (can be an array of expressions as well)
+ * @param string $highlight highlight to be used (use \\0 to indicate the matched expression)
+ * @return string
+ **/
 function highlight($text, $expression, $highlight) {
-    if (!$highlight || !$expression) {
-        return $text;
-    }
 
-    if (is_array($expression) && (count($expression) == 0) ) {
-        return $text;
-    }
+	if (!$highlight || !$expression)
+	{
+		return $text;
+	}
 
-    // add a tag in front (is needed for preg_match_all to work correct)
-    $text = '<!--h-->' . $text;
+	if (is_array($expression) && (count($expression) == 0) )
+	{
+		return $text;
+	}
 
-    // split the HTML up so we have HTML tags
-    // $matches[0][i] = HTML + text
-    // $matches[1][i] = HTML
-    // $matches[2][i] = text
-    preg_match_all('/(<[^>]+>)([^<>]*)/', $text, $matches);
+	// add a tag in front (is needed for preg_match_all to work correct)
+	$text = '<!--h-->' . $text;
 
-    // throw it all together again while applying the highlight to the text pieces
-    $result = '';
-    for ($i = 0; $i < sizeof($matches[2]); $i++) {
-        if ($i != 0) {
-            $result .= $matches[1][$i];
-        }
+	// split the HTML up so we have HTML tags
+	// $matches[0][i] = HTML + text
+	// $matches[1][i] = HTML
+	// $matches[2][i] = text
+	preg_match_all('/(<[^>]+>)([^<>]*)/', $text, $matches);
 
-        if (is_array($expression) ) {
-            foreach ($expression as $regex) {
-                if ($regex) {
-                    $matches[2][$i] = @eregi_replace($regex, $highlight, $matches[2][$i]);
-                }
-            }
+	// throw it all together again while applying the highlight to the text pieces
+	$result = '';
 
-            $result .= $matches[2][$i];
-        } else {
-            $result .= @eregi_replace($expression, $highlight, $matches[2][$i]);
-        }
-    }
+	$count_matches = count($matches[2]);
+
+	for ($i = 0; $i < $count_matches; $i++) {
+
+		if ($i != 0)
+		{
+			$result .= $matches[1][$i];
+		}
+
+		if (is_array($expression) )
+		{
+
+			foreach ($expression as $regex)
+			{
+
+				if ($regex)
+				{
+					$matches[2][$i] = @eregi_replace($regex, $highlight, $matches[2][$i]);
+				}
+
+			}
+
+			$result .= $matches[2][$i];
+
+		}
+		else
+		{
+			$result .= @eregi_replace($expression, $highlight, $matches[2][$i]);
+		}
+
+	}
+
+	return $result;
 
-    return $result;
 }
 
 /**
@@ -725,7 +786,8 @@
   * Checks if email address is valid
   */
 function isValidMailAddress($address) {
-    if (preg_match('/^[a-zA-Z+0-9\._-]+@[a-zA-Z0-9\._-]+\.[A-Za-z]{2,5}$/', $address)) {
+	// enhancement made in 3.6x based on code by Quandary.
+	if (preg_match('/^(?!\\.)(?:\\.?[-a-zA-Z0-9!#$%&\'*+\\/=?^_`{|}~]+)+@(?!\\.)(?:\\.?(?!-)[-a-zA-Z0-9]+(?<!-)){2,}$/', $address)) {
         return 1;
     } else {
         return 0;
@@ -735,7 +797,7 @@
 
 // some helper functions
 function getBlogIDFromName($name) {
-    return quickQuery('SELECT bnumber as result FROM ' . sql_table('blog') . ' WHERE bshortname="' . addslashes($name) . '"');
+    return quickQuery('SELECT bnumber as result FROM ' . sql_table('blog') . ' WHERE bshortname="' . sql_real_escape_string($name) . '"');
 }
 
 function getBlogNameFromID($id) {
@@ -755,7 +817,7 @@
 }
 
 function getCatIDFromName($name) {
-    return quickQuery('SELECT catid as result FROM ' . sql_table('category') . ' WHERE cname="' . addslashes($name) . '"');
+    return quickQuery('SELECT catid as result FROM ' . sql_table('category') . ' WHERE cname="' . sql_real_escape_string($name) . '"');
 }
 
 function quickQuery($q) {
@@ -820,7 +882,7 @@
         // itemid given -> only show that item
         $type = 'item';
 
-        if (!$manager->existsItem($itemid,0,0) ) {
+        if (!$manager->existsItem($itemid,intval($CONF['allowFuture']),intval($CONF['allowDrafts'])) ) {
             doError(_ERROR_NOSUCHITEM);
         }
 
@@ -837,17 +899,7 @@
 
 
         if ($blogid && (intval($blogid) != $obj->iblog) ) {
-
-
-
-
-
-
-
-
-
             doError(_ERROR_NOSUCHITEM);
-
         }
 
         // if a category has been selected which doesn't match the item, ignore the
@@ -989,28 +1041,6 @@
         $type = 'search';
         $query = stripslashes($query);
 
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
         if (is_numeric($blogid)) {
             $blogid = intVal($blogid);
         } else {
@@ -1089,6 +1119,10 @@
         doError(_ERROR_NOSUCHSKIN);
     }
 
+	// set global skinpart variable so can determine quickly what is being parsed from any plugin or phpinclude
+	global $skinpart;
+	$skinpart = $type;
+
     // parse the skin
     $skin->parse($type);
 
@@ -1138,11 +1172,21 @@
 
 // some checks for names of blogs, categories, templates, members, ...
 function isValidShortName($name) {
-    return eregi('^[a-z0-9]+$', $name);
+
+	# replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
+	# original eregi: eregi('^[a-z0-9]+$', $name)
+
+	return preg_match('#^[a-z0-9]+$#i', $name);
+
 }
 
 function isValidDisplayName($name) {
-    return eregi('^[a-z0-9]+[a-z0-9 ]*[a-z0-9]+$', $name);
+
+	# replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
+	# original eregi: eregi('^[a-z0-9]+[a-z0-9 ]*[a-z0-9]+$', $name)
+
+	return preg_match('#^[a-z0-9]+[a-z0-9 ]*[a-z0-9]+$#i', $name);
+
 }
 
 function isValidCategoryName($name) {
@@ -1150,11 +1194,21 @@
 }
 
 function isValidTemplateName($name) {
-    return eregi('^[a-z0-9/]+$', $name);
+
+	# replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
+	# original eregi: eregi('^[a-z0-9/]+$', $name)
+
+	return preg_match('#^[a-z0-9/]+$#i', $name);
+
 }
 
 function isValidSkinName($name) {
-    return eregi('^[a-z0-9/]+$', $name);
+
+	# replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
+	# original eregi: eregi('^[a-z0-9/]+$', $name);
+
+	return preg_match('#^[a-z0-9/]+$#i', $name);
+
 }
 
 // add and remove linebreaks
@@ -1230,9 +1284,15 @@
 
 // force the use of a language file (warning: can cause warnings)
 function selectLanguage($language) {
-    global $DIR_LANG;
-//    include($DIR_LANG . ereg_replace( '[\\|/]', '', $language) . '.php');
-    include($DIR_LANG . preg_replace( '@\\|/@', '', $language) . '.php');
+
+	global $DIR_LANG;
+
+	# replaced ereg_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
+	# original ereg_replace: preg_replace( '@\\|/@', '', $language) . '.php')
+	# important note that '\' must be matched with '\\\\' in preg* expressions
+
+	include($DIR_LANG . preg_replace('#[\\\\|/]#', '', $language) . '.php');
+
 }
 
 function parseFile($filename, $includeMode = 'normal', $includePrefix = '') {
@@ -1352,18 +1412,37 @@
 }
 
 /**
-  * Checks if a certain language/plugin exists
-  */
+ * Checks if a certain language exists
+ * @param string $lang
+ * @return bool
+ **/
 function checkLanguage($lang) {
-    global $DIR_LANG ;
-//    return file_exists($DIR_LANG . ereg_replace( '[\\|/]', '', $lang) . '.php');
-    return file_exists($DIR_LANG . preg_replace( '@\\|/@', '', $lang) . '.php');
+
+	global $DIR_LANG;
+
+	# replaced ereg_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
+	# original ereg_replace: ereg_replace( '[\\|/]', '', $lang) . '.php')
+	# important note that '\' must be matched with '\\\\' in preg* expressions
+
+	return file_exists($DIR_LANG . preg_replace('#[\\\\|/]#', '', $lang) . '.php');
+
 }
 
+/**
+ * Checks if a certain plugin exists
+ * @param string $plug
+ * @return bool
+ **/
 function checkPlugin($plug) {
-    global $DIR_PLUGINS;
-    return file_exists($DIR_PLUGINS . ereg_replace( '[\\|/]', '', $plug) . '.php');
-//    return file_exists($DIR_PLUGINS . preg_replace( '@\\|/@', '', $plug) . '.php');
+
+	global $DIR_PLUGINS;
+
+	# replaced ereg_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
+	# original ereg_replace: ereg_replace( '[\\|/]', '', $plug) . '.php')
+	# important note that '\' must be matched with '\\\\' in preg* expressions
+
+	return file_exists($DIR_PLUGINS . preg_replace('#[\\\\|/]#', '', $plug) . '.php');
+
 }
 
 /**
@@ -1694,124 +1773,203 @@
  * to avoid CSRF.
  * Also avoid the access to plugin/index.php by guest user.
  */
-function ticketForPlugin(){
-    global $CONF,$DIR_PLUGINS,$member,$ticketforplugin;
+function ticketForPlugin() {
 
-    /* initialize */
-    $ticketforplugin=array();
-    $ticketforplugin['ticket']=false;
-
-    /* Check if using plugin's php file. */
-    if ($p_translated=serverVar('PATH_TRANSLATED')) {
-        if (!file_exists($p_translated)) $p_translated='';
-    }
-    if (!$p_translated) {
-        $p_translated=serverVar('SCRIPT_FILENAME');
-        if (!file_exists($p_translated)) {
-            header("HTTP/1.0 404 Not Found");
-            exit('');
-        }
-    }
-    $p_translated=str_replace('\\','/',$p_translated);
-    $d_plugins=str_replace('\\','/',$DIR_PLUGINS);
-    if (strpos($p_translated,$d_plugins)!==0) return;// This isn't plugin php file.
-
-    /* Solve the plugin php file or admin directory */
-    $phppath=substr($p_translated,strlen($d_plugins));
-    $phppath=preg_replace('!^/!','',$phppath);// Remove the first "/" if exists.
-    $path=preg_replace('/^NP_(.*)\.php$/','$1',$phppath); // Remove the first "NP_" and the last ".php" if exists.
-    $path=preg_replace('!^([^/]*)/(.*)$!','$1',$path); // Remove the "/" and beyond.
-
-    /* Solve the plugin name. */
-    $plugins=array();
-    $query='SELECT pfile FROM '.sql_table('plugin');
-    $res=sql_query($query);
-    while($row=sql_fetch_row($res)) {
-        $name=substr($row[0],3);
-        $plugins[strtolower($name)]=$name;
-    }
-    sql_free_result($res);
-    if ($plugins[$path]) $plugin_name=$plugins[$path];
-    else if (in_array($path,$plugins)) $plugin_name=$path;
-    else {
-        header("HTTP/1.0 404 Not Found");
-        exit('');
-    }
+	global $CONF, $DIR_PLUGINS, $member, $ticketforplugin;
 
-    /* Return if not index.php */
-    if ( $phppath!=strtolower($plugin_name).'/'
-        && $phppath!=strtolower($plugin_name).'/index.php' ) return;
+	/* initialize */
+	$ticketforplugin = array();
+	$ticketforplugin['ticket'] = FALSE;
+
+	/* Check if using plugin's php file. */
+	if ($p_translated = serverVar('PATH_TRANSLATED') )
+	{
+
+		if (!file_exists($p_translated) )
+		{
+			$p_translated = '';
+		}
+
+    }
+
+	if (!$p_translated)
+	{
+		$p_translated = serverVar('SCRIPT_FILENAME');
+
+		if (!file_exists($p_translated) )
+		{
+			header("HTTP/1.0 404 Not Found");
+			exit('');
+		}
+
+	}
+
+	$p_translated = str_replace('\\', '/', $p_translated);
+	$d_plugins = str_replace('\\', '/', $DIR_PLUGINS);
+
+    if (strpos($p_translated, $d_plugins) !== 0)
+	{
+		return;// This isn't plugin php file.
+	}
+
+	/* Solve the plugin php file or admin directory */
+	$phppath = substr($p_translated, strlen($d_plugins) );
+	$phppath = preg_replace('#^/#', '', $phppath); // Remove the first "/" if exists.
+	$path = preg_replace('#^NP_(.*)\.php$#', '$1', $phppath); // Remove the first "NP_" and the last ".php" if exists.
+	$path = preg_replace('#^([^/]*)/(.*)$#', '$1', $path); // Remove the "/" and beyond.
+
+	/* Solve the plugin name. */
+	$plugins = array();
+	$query = 'SELECT `pfile` FROM '.sql_table('plugin');
+	$res = sql_query($query);
+
+	while($row = sql_fetch_row($res) )
+	{
+		$name = substr($row[0], 3);
+		$plugins[strtolower($name)] = $name;
+    }
+
+	sql_free_result($res);
+
+	if ($plugins[$path])
+	{
+		$plugin_name = $plugins[$path];
+	}
+	else if (in_array($path, $plugins))
+	{
+		$plugin_name = $path;
+	}
+	else
+	{
+		header("HTTP/1.0 404 Not Found");
+		exit('');
+	}
+
+	/* Return if not index.php */
+	if ( ($phppath != strtolower($plugin_name) . '/') && ($phppath != strtolower($plugin_name) . '/index.php') )
+	{
+		return;
+	}
 
     /* Exit if not logged in. */
-    if ( !$member->isLoggedIn() ) exit("You aren't logged in.");
+	if ( !$member->isLoggedIn() )
+	{
+		exit('You aren\'t logged in.');
+	}
 
-    global $manager,$DIR_LIBS,$DIR_LANG,$HTTP_GET_VARS,$HTTP_POST_VARS;
+	global $manager, $DIR_LIBS, $DIR_LANG, $HTTP_GET_VARS, $HTTP_POST_VARS;
 
-    /* Check if this feature is needed (ie, if "$manager->checkTicket()" is not included in the script). */
-    if (!($p_translated=serverVar('PATH_TRANSLATED'))) $p_translated=serverVar('SCRIPT_FILENAME');
-    if ($file=@file($p_translated)) {
-        $prevline='';
-        foreach($file as $line) {
-            if (preg_match('/[\$]manager([\s]*)[\-]>([\s]*)checkTicket([\s]*)[\(]/i',$prevline.$line)) return;
-            $prevline=$line;
-        }
-    }
+	/* Check if this feature is needed (ie, if "$manager->checkTicket()" is not included in the script). */
+	if (!($p_translated = serverVar('PATH_TRANSLATED') ) )
+	{
+		$p_translated = serverVar('SCRIPT_FILENAME');
+	}
+
+	if ($file = @file($p_translated) )
+	{
+		$prevline = '';
+
+		foreach($file as $line)
+		{
+
+			if (preg_match('/[\$]manager([\s]*)[\-]>([\s]*)checkTicket([\s]*)[\(]/i', $prevline . $line) )
+			{
+				return;
+			}
+
+			$prevline = $line;
+
+		}
+
+	}
 
     /* Show a form if not valid ticket */
-    if ( ( strstr(serverVar('REQUEST_URI'),'?') || serverVar('QUERY_STRING')
-            || strtoupper(serverVar('REQUEST_METHOD'))=='POST' )
-                && (!$manager->checkTicket()) ){
-
-        if (!class_exists('PluginAdmin')) {
-            $language = getLanguageName();
-//            include($DIR_LANG . ereg_replace( '[\\|/]', '', $language) . '.php');
-            include($DIR_LANG . preg_replace( '@\\|/@', '', $language) . '.php');
-            include($DIR_LIBS . 'PLUGINADMIN.php');
-        }
-        if (!(function_exists('mb_strimwidth') || extension_loaded('mbstring'))) {
-            if (file_exists($DIR_LIBS.'mb_emulator/mb-emulator.php')) {
-                global $mbemu_internals;
-                include_once($DIR_LIBS.'mb_emulator/mb-emulator.php');
-            }
-        }
-        $oPluginAdmin = new PluginAdmin($plugin_name);
-        $oPluginAdmin->start();
-        echo '<p>' . _ERROR_BADTICKET . "</p>\n";
-
-        /* Show the form to confirm action */
-        // PHP 4.0.x support
-        $get=  (isset($_GET))  ? $_GET  : $HTTP_GET_VARS;
-        $post= (isset($_POST)) ? $_POST : $HTTP_POST_VARS;
-        // Resolve URI and QUERY_STRING
-        if ($uri=serverVar('REQUEST_URI')) {
-            list($uri,$qstring)=explode('?',$uri);
-        } else {
-            if ( !($uri=serverVar('PHP_SELF')) ) $uri=serverVar('SCRIPT_NAME');
-            $qstring=serverVar('QUERY_STRING');
-        }
-        if ($qstring) $qstring='?'.$qstring;
-        echo '<p>'._SETTINGS_UPDATE.' : '._QMENU_PLUGINS.' <span style="color:red;">'.
-            htmlspecialchars($plugin_name)."</span> ?</p>\n";
-        switch(strtoupper(serverVar('REQUEST_METHOD'))){
-        case 'POST':
-            echo '<form method="POST" action="'.htmlspecialchars($uri.$qstring).'">';
-            $manager->addTicketHidden();
-            _addInputTags($post);
-            break;
-        case 'GET':
-            echo '<form method="GET" action="'.htmlspecialchars($uri).'">';
-            $manager->addTicketHidden();
-            _addInputTags($get);
-        default:
-            break;
-        }
-        echo '<input type="submit" value="'._YES.'" />&nbsp;&nbsp;&nbsp;&nbsp;';
-        echo '<input type="button" value="'._NO.'" onclick="history.back(); return false;" />';
-        echo "</form>\n";
+    if ( ( strstr(serverVar('REQUEST_URI'), '?') || serverVar('QUERY_STRING')
+			|| strtoupper(serverVar('REQUEST_METHOD') ) == 'POST')
+				&& (!$manager->checkTicket() ) )
+	{
+
+		if (!class_exists('PluginAdmin') )
+		{
+			$language = getLanguageName();
+
+			# replaced ereg_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
+			# original ereg_replace: ereg_replace( '[\\|/]', '', $language) . '.php')
+			# important note that '\' must be matched with '\\\\' in preg* expressions
+
+			include($DIR_LANG . preg_replace('#[\\\\|/]#', '', $language) . '.php');
+			include($DIR_LIBS . 'PLUGINADMIN.php');
+		}
+
+		if (!(function_exists('mb_strimwidth') || extension_loaded('mbstring')))
+		{
+
+			if (file_exists($DIR_LIBS.'mb_emulator/mb-emulator.php'))
+			{
+				global $mbemu_internals;
+				include_once($DIR_LIBS.'mb_emulator/mb-emulator.php');
+			}
+
+		}
+
+		$oPluginAdmin = new PluginAdmin($plugin_name);
+		$oPluginAdmin->start();
+		echo '<p>' . _ERROR_BADTICKET . "</p>\n";
+
+		/* Show the form to confirm action */
+		// PHP 4.0.x support
+		$get = (isset($_GET) ) ? $_GET : $HTTP_GET_VARS;
+		$post = (isset($_POST) ) ? $_POST : $HTTP_POST_VARS;
+
+		// Resolve URI and QUERY_STRING
+		if ($uri = serverVar('REQUEST_URI') )
+		{
+			list($uri, $qstring) = explode('?', $uri);
+		}
+		else
+		{
+
+			if ( !($uri = serverVar('PHP_SELF') ) )
+			{
+				$uri = serverVar('SCRIPT_NAME');
+			}
+
+            $qstring = serverVar('QUERY_STRING');
+
+        }
+
+        if ($qstring)
+		{
+			$qstring = '?' . $qstring;
+		}
+
+        echo '<p>' . _SETTINGS_UPDATE . ' : ' . _QMENU_PLUGINS . ' <span style="color:red;">' . htmlspecialchars($plugin_name) . "</span> ?</p>\n";
+
+		switch(strtoupper(serverVar('REQUEST_METHOD') ) )
+		{
+			case 'POST':
+				echo '<form method="POST" action="'.htmlspecialchars($uri.$qstring).'">';
+				$manager->addTicketHidden();
+				_addInputTags($post);
+				break;
+
+			case 'GET':
+				echo '<form method="GET" action="'.htmlspecialchars($uri).'">';
+				$manager->addTicketHidden();
+				_addInputTags($get);
+
+			default:
+				break;
+		}
+
+		echo '<input type="submit" value="' . _YES . '" />&nbsp;&nbsp;&nbsp;&nbsp;';
+		echo '<input type="button" value="' . _NO . '" onclick="history.back(); return false;" />';
+		echo "</form>\n";
 
-        $oPluginAdmin->end();
-        exit;
-    }
+		$oPluginAdmin->end();
+		exit;
+
+	}
 
     /* Create new ticket */
     $ticket=$manager->addTicketToUrl('');
@@ -1898,6 +2056,8 @@
         if (get_magic_quotes_gpc()) {
             $val = stripslashes($val);
         }
+		// note that we must use addslashes here because this function is called before the db connection is made
+		// and sql_real_escape_string needs a db connection
         $val = addslashes($val);
 
         // if $key is included in exclude list, skip this param
@@ -1907,7 +2067,7 @@
             if (strpos($val, '\\')) {
                 list($val, $tmp) = explode('\\', $val);
             }
-            
+
             // remove control code etc.
             $val = strtr($val, "\0\r\n<>'\"", "       ");
 
@@ -2108,9 +2268,42 @@
     return $obj->count;
 }
 
+/**
+ * sets $special global variable for use in index.php before selector()
+ *
+ * @param String id
+ * @return nothing
+ */
 function selectSpecialSkinType($id) {
     global $special;
     $special = strtolower($id);
 }
 
+/**
+ * cleans filename of uploaded file for writing to file system
+ *
+ * @param String str
+ * @return String cleaned filename ready for use
+ */
+function cleanFileName($str) {
+	$cleaner = array();
+	$cleaner[] = array('expression'=>"/[]/",'replace'=>"a");
+	$cleaner[] = array('expression'=>"/[]/",'replace'=>"e");
+	$cleaner[] = array('expression'=>"/[]/",'replace'=>"i");
+	$cleaner[] = array('expression'=>"/[]/",'replace'=>"o");
+	$cleaner[] = array('expression'=>"/[]/",'replace'=>"u");
+	$cleaner[] = array('expression'=>"/[]/",'replace'=>"n");
+	$cleaner[] = array('expression'=>"/[]/",'replace'=>"c");
+	
+	$str = strtolower($str);
+	$ext_point = strripos($str,".");
+	if ($ext_point===false) return false;
+	$ext = substr($str,$ext_point,strlen($str));
+	$str = substr($str,0,$ext_point);
+
+	foreach( $cleaner as $cv ) $str = preg_replace($cv["expression"],$cv["replace"],$str);
+
+	return preg_replace("/[^a-z0-9-]/","_",$str).$ext;
+}
+
 ?>
\ No newline at end of file
diff -x .svn -aruN 3.51.src/nucleus/libs/ITEMACTIONS.php 3.61.src/nucleus/libs/ITEMACTIONS.php
--- 3.51.src/nucleus/libs/ITEMACTIONS.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/ITEMACTIONS.php	2010-12-19 00:16:48.000000000 -0600
@@ -14,7 +14,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: ITEMACTIONS.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: ITEMACTIONS.php 1453 2010-10-21 19:40:24Z ftruscot $
  */
 class ITEMACTIONS extends BaseActions {
 
@@ -101,13 +101,13 @@
 			'editlink',
 			'editpopupcode',
 			'comments',
-			'relevance'/*,
+			'relevance',
 			'if',
 			'else',
 			'endif',
 			'elseif',
 			'ifnot',
-			'elseifnot'*/
+			'elseifnot'
 		);
 	}
 
@@ -121,6 +121,8 @@
 
 	function setCurrentItem(&$item) {
 		$this->currentItem =& $item;
+		global $currentitemid;
+		$currentitemid = $this->currentItem->itemid;
 	}
 
 	function setBlog(&$blog) {
@@ -539,7 +541,248 @@
 		$this->parser->actions = $this->getDefinedActions();
 	}
 	*/
+	
+	// function to enable if-else-elseif-elseifnot-ifnot-endif to item template fields
+	
+		/**
+	 * Checks conditions for if statements
+	 *
+	 * @param string $field type of <%if%>
+	 * @param string $name property of field
+	 * @param string $value value of property
+	 */
+	function checkCondition($field, $name='', $value = '') {
+		global $catid, $blog, $member, $itemidnext, $itemidprev, $manager, $archiveprevexists, $archivenextexists;
+
+		$condition = 0;
+		switch($field) {
+			case 'category':
+				$condition = ($blog && $this->_ifCategory($name,$value));
+				break;
+			case 'itemcategory':
+				$condition = ($this->_ifItemCategory($name,$value));
+				break;
+			case 'blogsetting':
+				$condition = ($blog && ($blog->getSetting($name) == $value));
+				break;
+			case 'itemblogsetting':
+				$b =& $manager->getBlog(getBlogIDFromItemID($this->currentItem->itemid));
+				$condition = ($b && ($b->getSetting($name) == $value));
+				break;
+			case 'loggedin':
+				$condition = $member->isLoggedIn();
+				break;
+			case 'onteam':
+				$condition = $member->isLoggedIn() && $this->_ifOnTeam($name);
+				break;
+			case 'admin':
+				$condition = $member->isLoggedIn() && $this->_ifAdmin($name);
+				break;
+			case 'author':
+				$condition = ($this->_ifAuthor($name,$value));
+				break;
+/*			case 'nextitem':
+				$condition = ($itemidnext != '');
+				break;
+			case 'previtem':
+				$condition = ($itemidprev != '');
+				break;
+			case 'archiveprevexists':
+				$condition = ($archiveprevexists == true);
+				break;
+			case 'archivenextexists':
+				$condition = ($archivenextexists == true);
+				break; 
+			case 'skintype':
+				$condition = ($name == $this->skintype);
+				break; */
+			case 'hasplugin':
+				$condition = $this->_ifHasPlugin($name, $value);
+				break;
+			default:
+				$condition = $manager->pluginInstalled('NP_' . $field) && $this->_ifPlugin($field, $name, $value);
+				break;
+		}
+		return $condition;
+	}	
+	
+	/**
+	 *  Different checks for a category
+	 */
+	function _ifCategory($name = '', $value='') {
+		global $blog, $catid;
+
+		// when no parameter is defined, just check if a category is selected
+		if (($name != 'catname' && $name != 'catid') || ($value == ''))
+			return $blog->isValidCategory($catid);
+
+		// check category name
+		if ($name == 'catname') {
+			$value = $blog->getCategoryIdFromName($value);
+			if ($value == $catid)
+				return $blog->isValidCategory($catid);
+		}
+
+		// check category id
+		if (($name == 'catid') && ($value == $catid))
+			return $blog->isValidCategory($catid);
+
+		return false;
+	}
+	
+		
+	/**
+	 *  Different checks for an author
+	 */
+	function _ifAuthor($name = '', $value='') {
+		global $member, $manager;
+		
+		$b =& $manager->getBlog(getBlogIDFromItemID($this->currentItem->itemid));
+
+		// when no parameter is defined, just check if author is current visitor
+		if (($name != 'isadmin' && $name != 'name') || ($name == 'name' && $value == '')) {
+			return (intval($member->getID()) > 0 && intval($member->getID()) == intval($this->currentItem->authorid));
+		}
+
+		// check author name
+		if ($name == 'name') {
+			$value = strtolower($value);
+			if ($value == strtolower($this->currentItem->author))
+				return true;
+		}
+
+		// check if author is admin
+		if (($name == 'isadmin')) {			
+			$aid = intval($this->currentItem->authorid);
+			$blogid = intval($b->getID());			
+			$amember =& $manager->getMember($aid);
+			if ($amember->isAdmin())
+				return true;
+				
+			return $amember->isBlogAdmin($blogid);
+		}
+
+		return false;
+	}
+	
+	/**
+	 *  Different checks for a category
+	 */
+	function _ifItemCategory($name = '', $value='') {
+		global $catid, $manager;
+		
+		$b =& $manager->getBlog(getBlogIDFromItemID($this->currentItem->itemid));
+
+		// when no parameter is defined, just check if a category is selected
+		if (($name != 'catname' && $name != 'catid') || ($value == ''))
+			return $b->isValidCategory($catid);
+			
+		$icatid = $this->currentItem->catid;
+		//$icategory = $this->currentItem->category;
+
+		// check category name
+		if ($name == 'catname') {
+			$value = $b->getCategoryIdFromName($value);
+			if ($value == $icatid)
+				return $b->isValidCategory($icatid);
+		}
+
+		// check category id
+		if (($name == 'catid') && ($value == $icatid))
+			return $b->isValidCategory($icatid);
+
+		return false;
+	}
+
+	
+	/**
+	 *  Checks if a member is on the team of a blog and return his rights
+	 */
+	function _ifOnTeam($blogName = '') {
+		global $blog, $member, $manager;
+
+		// when no blog found
+		if (($blogName == '') && (!is_object($blog)))
+			return 0;
+
+		// explicit blog selection
+		if ($blogName != '')
+			$blogid = getBlogIDFromName($blogName);
+
+		if (($blogName == '') || !$manager->existsBlogID($blogid))
+			// use current blog
+			$blogid = $blog->getID();
+
+		return $member->teamRights($blogid);
+	}
+
+	/**
+	 *  Checks if a member is admin of a blog
+	 */
+	function _ifAdmin($blogName = '') {
+		global $blog, $member, $manager;
+
+		// when no blog found
+		if (($blogName == '') && (!is_object($blog)))
+			return 0;
+
+		// explicit blog selection
+		if ($blogName != '')
+			$blogid = getBlogIDFromName($blogName);
+
+		if (($blogName == '') || !$manager->existsBlogID($blogid))
+			// use current blog
+			$blogid = $blog->getID();
+
+		return $member->isBlogAdmin($blogid);
+	}
+
+	
+	/**
+	 *	hasplugin,PlugName
+	 *	   -> checks if plugin exists
+	 *	hasplugin,PlugName,OptionName
+	 *	   -> checks if the option OptionName from plugin PlugName is not set to 'no'
+	 *	hasplugin,PlugName,OptionName=value
+	 *	   -> checks if the option OptionName from plugin PlugName is set to value
+	 */
+	function _ifHasPlugin($name, $value) {
+		global $manager;
+		$condition = false;
+		// (pluginInstalled method won't write a message in the actionlog on failure)
+		if ($manager->pluginInstalled('NP_'.$name)) {
+			$plugin =& $manager->getPlugin('NP_' . $name);
+			if ($plugin != NULL) {
+				if ($value == "") {
+					$condition = true;
+				} else {
+					list($name2, $value2) = explode('=', $value, 2);
+					if ($value2 == "" && $plugin->getOption($name2) != 'no') {
+						$condition = true;
+					} else if ($plugin->getOption($name2) == $value2) {
+						$condition = true;
+					}
+				}
+			}
+		}
+		return $condition;
+	}
+
+	/**
+	 * Checks if a plugin exists and call its doIf function
+	 */
+	function _ifPlugin($name, $key = '', $value = '') {
+		global $manager;
+
+		$plugin =& $manager->getPlugin('NP_' . $name);
+		if (!$plugin) return;
+
+		$params = func_get_args();
+		array_shift($params);
+
+		return call_user_func_array(array(&$plugin, 'doIf'), $params);
+	}
 
 }
 
-?>
+?>
\ No newline at end of file
diff -x .svn -aruN 3.51.src/nucleus/libs/ITEM.php 3.61.src/nucleus/libs/ITEM.php
--- 3.51.src/nucleus/libs/ITEM.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/ITEM.php	2010-12-19 00:16:48.000000000 -0600
@@ -15,7 +15,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: ITEM.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: ITEM.php 1470 2010-11-29 22:10:16Z ftruscot $
  */
 class ITEM {
 
@@ -212,9 +212,9 @@
 		// update item itsself
 		$query =  'UPDATE '.sql_table('item')
 			   . ' SET'
-			   . " ibody='". addslashes($body) ."',"
-			   . " ititle='" . addslashes($title) . "',"
-			   . " imore='" . addslashes($more) . "',"
+			   . " ibody='". sql_real_escape_string($body) ."',"
+			   . " ititle='" . sql_real_escape_string($title) . "',"
+			   . " imore='" . sql_real_escape_string($more) . "',"
 			   . " iclosed=" . intval($closed) . ","
 			   . " icat=" . intval($catid);
 
diff -x .svn -aruN 3.51.src/nucleus/libs/KARMA.php 3.61.src/nucleus/libs/KARMA.php
--- 3.51.src/nucleus/libs/KARMA.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/KARMA.php	2010-12-19 00:16:48.000000000 -0600
@@ -14,7 +14,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: KARMA.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: KARMA.php 1470 2010-11-29 22:10:16Z ftruscot $
  */
 class KARMA {
 
@@ -102,14 +102,14 @@
 
 	// checks if a vote is still allowed for an IP
 	function isVoteAllowed($ip) {
-		$query = 'SELECT * FROM '.sql_table('karma')." WHERE itemid=$this->itemid and ip='".addslashes($ip)."'";
+		$query = 'SELECT * FROM '.sql_table('karma')." WHERE itemid=$this->itemid and ip='".sql_real_escape_string($ip)."'";
 		$res = sql_query($query);
 		return (sql_num_rows($res) == 0);
 	}
 
 	// save IP in database so no multiple votes are possible
 	function saveIP() {
-		$query = 'INSERT INTO '.sql_table('karma').' (itemid, ip) VALUES ('.$this->itemid.",'".addslashes(serverVar('REMOTE_ADDR'))."')";
+		$query = 'INSERT INTO '.sql_table('karma').' (itemid, ip) VALUES ('.$this->itemid.",'".sql_real_escape_string(serverVar('REMOTE_ADDR'))."')";
 		sql_query($query);
 	}
 }
diff -x .svn -aruN 3.51.src/nucleus/libs/MANAGER.php 3.61.src/nucleus/libs/MANAGER.php
--- 3.51.src/nucleus/libs/MANAGER.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/MANAGER.php	2010-12-19 00:16:48.000000000 -0600
@@ -20,7 +20,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: MANAGER.php 1411 2009-09-14 19:49:05Z ftruscot $
+ * @version $Id: MANAGER.php 1470 2010-11-29 22:10:16Z ftruscot $
  */
 class MANAGER {
 
@@ -507,7 +507,7 @@
 			$memberId = $member->getID();
 
 		// check if ticket is a valid one
-		$query = 'SELECT COUNT(*) as result FROM ' . sql_table('tickets') . ' WHERE member=' . intval($memberId). ' and ticket=\''.addslashes($ticket).'\'';
+		$query = 'SELECT COUNT(*) as result FROM ' . sql_table('tickets') . ' WHERE member=' . intval($memberId). ' and ticket=\''.sql_real_escape_string($ticket).'\'';
 		if (quickQuery($query) == 1)
 		{
 			// [in the original implementation, the checked ticket was deleted. This would lead to invalid
@@ -560,7 +560,7 @@
 
 				// add in database as non-active
 				$query = 'INSERT INTO ' . sql_table('tickets') . ' (ticket, member, ctime) ';
-				$query .= 'VALUES (\'' . addslashes($ticket). '\', \'' . intval($memberId). '\', \'' . date('Y-m-d H:i:s',time()) . '\')';
+				$query .= 'VALUES (\'' . sql_real_escape_string($ticket). '\', \'' . intval($memberId). '\', \'' . date('Y-m-d H:i:s',time()) . '\')';
 				if (sql_query($query))
 					$ok = true;
 			}
diff -x .svn -aruN 3.51.src/nucleus/libs/MEDIA.php 3.61.src/nucleus/libs/MEDIA.php
--- 3.51.src/nucleus/libs/MEDIA.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/MEDIA.php	2010-12-19 00:16:48.000000000 -0600
@@ -14,7 +14,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: MEDIA.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: MEDIA.php 1455 2010-10-22 15:37:13Z ftruscot $
  */
 
 define('PRIVATE_COLLECTION', 'Private Collection');
@@ -142,6 +142,13 @@
 	function addMediaObject($collection, $uploadfile, $filename) {
 		global $DIR_MEDIA, $manager;
 
+		// clean filename of characters that may cause trouble in a filename using cleanFileName() function from globalfunctions.php
+		$filename = cleanFileName($filename);
+		// should already have tested for allowable types before calling this method. This will only catch files with no extension at all
+		if ($filename === false) 
+			return _ERROR_BADFILETYPE;
+		
+		// trigger PreMediaUpload event
 		$manager->notify('PreMediaUpload',array('collection' => &$collection, 'uploadfile' => $uploadfile, 'filename' => &$filename));
 
 		// don't allow uploads to unknown or forbidden collections
diff -x .svn -aruN 3.51.src/nucleus/libs/MEMBER.php 3.61.src/nucleus/libs/MEMBER.php
--- 3.51.src/nucleus/libs/MEMBER.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/MEMBER.php	2010-12-19 00:16:48.000000000 -0600
@@ -15,7 +15,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: MEMBER.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: MEMBER.php 1476 2010-12-05 23:23:32Z gregorlove $
  */
 class MEMBER {
 
@@ -67,7 +67,7 @@
 	}
 
 	function readFromName($displayname) {
-		return $this->read("mname='".addslashes($displayname)."'");
+		return $this->read("mname='".sql_real_escape_string($displayname)."'");
 	}
 
 	function readFromID($id) {
@@ -334,6 +334,8 @@
 	function sendActivationLink($type, $extra='')
 	{
 		global $CONF;
+		
+		if (!isset($CONF['ActivationDays'])) $CONF['ActivationDays'] = 2;
 
 		// generate key and URL
 		$key = $this->generateActivationEntry($type, $extra);
@@ -363,7 +365,8 @@
 			'siteName' => $CONF['SiteName'],
 			'siteUrl' => $CONF['IndexURL'],
 			'memberName' => $this->getDisplayName(),
-			'activationUrl' => $url
+			'activationUrl' => $url,
+			'activationDays' => $CONF['ActivationDays']
 		);
 
 		$message = TEMPLATE::fill($message, $aVars);
@@ -442,16 +445,16 @@
 	function write() {
 
 		$query =  'UPDATE '.sql_table('member')
-			   . " SET mname='" . addslashes($this->getDisplayName()) . "',"
-			   . "     mrealname='". addslashes($this->getRealName()) . "',"
-			   . "     mpassword='". addslashes($this->getPassword()) . "',"
-			   . "     mcookiekey='". addslashes($this->getCookieKey()) . "',"
-			   . "     murl='" . addslashes($this->getURL()) . "',"
-			   . "     memail='" . addslashes($this->getEmail()) . "',"
+			   . " SET mname='" . sql_real_escape_string($this->getDisplayName()) . "',"
+			   . "     mrealname='". sql_real_escape_string($this->getRealName()) . "',"
+			   . "     mpassword='". sql_real_escape_string($this->getPassword()) . "',"
+			   . "     mcookiekey='". sql_real_escape_string($this->getCookieKey()) . "',"
+			   . "     murl='" . sql_real_escape_string($this->getURL()) . "',"
+			   . "     memail='" . sql_real_escape_string($this->getEmail()) . "',"
 			   . "     madmin=" . $this->isAdmin() . ","
-			   . "     mnotes='" . addslashes($this->getNotes()) . "',"
+			   . "     mnotes='" . sql_real_escape_string($this->getNotes()) . "',"
 			   . "     mcanlogin=" . $this->canLogin() . ","
-			   . "	   deflang='" . addslashes($this->getLanguage()) . "',"
+			   . "	   deflang='" . sql_real_escape_string($this->getLanguage()) . "',"
 			   . "	   mautosave=" . intval($this->getAutosave()) . ""			   
 			   . " WHERE mnumber=" . $this->getID();
 		sql_query($query);
@@ -573,7 +576,7 @@
 	 * @static
 	 */	 	
 	function exists($name) {
-		$r = sql_query('select * FROM '.sql_table('member')." WHERE mname='".addslashes($name)."'");
+		$r = sql_query('select * FROM '.sql_table('member')." WHERE mname='".sql_real_escape_string($name)."'");
 		return (sql_num_rows($r) != 0);
 	}
 
@@ -606,33 +609,49 @@
 	 * @static
 	 */
 	function create($name, $realname, $password, $email, $url, $admin, $canlogin, $notes) {
-		if (!isValidMailAddress($email))
+
+		if (!isValidMailAddress($email) )
+		{
 			return _ERROR_BADMAILADDRESS;
+		}
 
-		if (!isValidDisplayName($name))
+		if (!isValidDisplayName($name) )
+		{
 			return _ERROR_BADNAME;
+		}
 
-		if (MEMBER::exists($name))
+		if (MEMBER::exists($name) )
+		{
 			return _ERROR_NICKNAMEINUSE;
+		}
 
 		if (!$realname)
+		{
 			return _ERROR_REALNAMEMISSING;
+		}
 
 		if (!$password)
+		{
 			return _ERROR_PASSWORDMISSING;
+		}
+
+		# replaced eregi() below with preg_match(). ereg* functions are deprecated in PHP 5.3.0
+		# original eregi: !eregi("^https?://", $url)
 
-		// Sometimes user didn't prefix the URL with http://, this cause a malformed URL. Let's fix it.
-		if (!eregi("^https?://", $url))
-			$url = "http://".$url;
-
-		$name = addslashes($name);
-		$realname = addslashes($realname);
-		$password = addslashes(md5($password));
-		$email = addslashes($email);
-		$url = addslashes($url);
+		// begin if: sometimes user didn't prefix the URL with http:// or https://, this cause a malformed URL. Let's fix it.
+		if (!preg_match('#^https?://#', $url) )
+		{
+			$url = 'http://' . $url;
+		} // end if
+
+		$name = sql_real_escape_string($name);
+		$realname = sql_real_escape_string($realname);
+		$password = sql_real_escape_string(md5($password));
+		$email = sql_real_escape_string($email);
+		$url = sql_real_escape_string($url);
 		$admin = intval($admin);
 		$canlogin = intval($canlogin);
-		$notes = addslashes($notes);
+		$notes = sql_real_escape_string($notes);
 
 		$query = 'INSERT INTO '.sql_table('member')." (MNAME,MREALNAME,MPASSWORD,MEMAIL,MURL, MADMIN, MCANLOGIN, MNOTES) "
 			   . "VALUES ('$name','$realname','$password','$email','$url',$admin, $canlogin, '$notes')";
@@ -651,7 +670,7 @@
 	 */
 	function getActivationInfo($key)
 	{
-		$query = 'SELECT * FROM ' . sql_table('activation') . ' WHERE vkey=\'' . addslashes($key). '\'';
+		$query = 'SELECT * FROM ' . sql_table('activation') . ' WHERE vkey=\'' . sql_real_escape_string($key). '\'';
 		$res = sql_query($query);
 
 		if (!$res || (sql_num_rows($res) == 0))
@@ -703,7 +722,7 @@
 			// attempt to add entry in database
 			// add in database as non-active
 			$query = 'INSERT INTO ' . sql_table('activation'). ' (vkey, vtime, vmember, vtype, vextra) ';
-			$query .= 'VALUES (\'' . addslashes($key). '\', \'' . date('Y-m-d H:i:s',time()) . '\', \'' . intval($this->getID()). '\', \'' . addslashes($type). '\', \'' . addslashes($extra). '\')';
+			$query .= 'VALUES (\'' . sql_real_escape_string($key). '\', \'' . date('Y-m-d H:i:s',time()) . '\', \'' . intval($this->getID()). '\', \'' . sql_real_escape_string($type). '\', \'' . sql_real_escape_string($extra). '\')';
 			if (sql_query($query))
 				$ok = true;
 		}
@@ -751,7 +770,7 @@
 		}
 
 		// delete from activation table
-		sql_query('DELETE FROM ' . sql_table('activation') . ' WHERE vkey=\'' . addslashes($key) . '\'');
+		sql_query('DELETE FROM ' . sql_table('activation') . ' WHERE vkey=\'' . sql_real_escape_string($key) . '\'');
 
 		// success!
 		return true;
@@ -769,6 +788,9 @@
 		if (isset($CONF['ActivationDays']) && intval($CONF['ActivationDays']) > 0) {
 		    $actdays = intval($CONF['ActivationDays']);
 		}
+		else {
+			$CONF['ActivationDays'] = 2;
+		}
 		$boundary = time() - (60 * 60 * 24 * $actdays);
 
 		// 1. walk over all entries, and see if special actions need to be performed
@@ -787,7 +809,7 @@
 				case 'addresschange':
 					// revert the e-mail address of the member back to old address
 					list($oldEmail, $oldCanLogin) = explode('/', $o->vextra);
-					sql_query('UPDATE ' . sql_table('member') . ' SET mcanlogin=' . intval($oldCanLogin). ', memail=\'' . addslashes($oldEmail). '\' WHERE mnumber=' . intval($o->vmember));
+					sql_query('UPDATE ' . sql_table('member') . ' SET mcanlogin=' . intval($oldCanLogin). ', memail=\'' . sql_real_escape_string($oldEmail). '\' WHERE mnumber=' . intval($o->vmember));
 					break;
 				case 'forgot':
 					// delete the activation link and ignore. member can request a new password using the
diff -x .svn -aruN 3.51.src/nucleus/libs/mysql.php 3.61.src/nucleus/libs/mysql.php
--- 3.51.src/nucleus/libs/mysql.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/mysql.php	2010-12-19 00:16:48.000000000 -0600
@@ -13,7 +13,7 @@
 /**
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2007 The Nucleus Group
- * @version $Id: mysql.php 1279 2008-10-23 08:18:26Z shizuki $
+ * @version $Id: mysql.php 1466 2010-11-23 16:10:04Z ftruscot $
  */
  
 /*
@@ -114,6 +114,12 @@
 		global $MYSQL_CONN;
 		return mysqli_affected_rows($MYSQL_CONN);
 	}
+	
+	function mysql_real_escape_string($val)
+	{
+		global $MYSQL_CONN;
+		return mysqli_real_escape_string($MYSQL_CONN,$val);
+	}
 }
 
 
diff -x .svn -aruN 3.51.src/nucleus/libs/PLUGINADMIN.php 3.61.src/nucleus/libs/PLUGINADMIN.php
--- 3.51.src/nucleus/libs/PLUGINADMIN.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/PLUGINADMIN.php	2010-12-19 00:16:48.000000000 -0600
@@ -15,44 +15,9 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: PLUGINADMIN.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: PLUGINADMIN.php 1445 2010-06-09 19:43:19Z ehui $
  */
 
-global $HTTP_GET_VARS, $HTTP_POST_VARS, $HTTP_COOKIE_VARS, $HTTP_ENV_VARS, $HTTP_POST_FILES, $HTTP_SESSION_VARS;
-$aVarsToCheck = array('HTTP_GET_VARS', 'HTTP_POST_VARS', 'HTTP_COOKIE_VARS', 'HTTP_ENV_VARS', 'HTTP_SESSION_VARS', 'HTTP_POST_FILES', 'HTTP_SERVER_VARS', 'GLOBALS', 'argv', 'argc', '_GET', '_POST', '_COOKIE', '_ENV', '_SESSION', '_SERVER', '_FILES', 'DIR_LIBS');
-
-foreach ($aVarsToCheck as $varName)
-{
-	if (phpversion() >= '4.1.0')
-	{
-		if (   isset($_GET[$varName])
-			|| isset($_POST[$varName])
-			|| isset($_COOKIE[$varName])
-			|| isset($_ENV[$varName])
-			|| isset($_SESSION[$varName])
-			|| isset($_FILES[$varName])
-		){
-			die('Sorry. An error occurred.');
-		}
-	} else {
-		if (   isset($HTTP_GET_VARS[$varName])
-			|| isset($HTTP_POST_VARS[$varName])
-			|| isset($HTTP_COOKIE_VARS[$varName])
-			|| isset($HTTP_ENV_VARS[$varName])
-			|| isset($HTTP_SESSION_VARS[$varName])
-			|| isset($HTTP_POST_FILES[$varName])
-		){
-			die('Sorry. An error occurred.');
-		}
-	}
-}
-
-if (!isset($DIR_LIBS)) {
-	die('Sorry.');
-}
-
-include($DIR_LIBS . 'ADMIN.php');
-
 class PluginAdmin {
 
 	var $strFullName;		// NP_SomeThing
@@ -63,6 +28,7 @@
 	function PluginAdmin($pluginName)
 	{
 		global $manager;
+                include_once($DIR_LIBS . 'ADMIN.php');
 
 		$this->strFullName = 'NP_' . $pluginName;
 
@@ -166,4 +132,4 @@
 
 
 
-?>
\ No newline at end of file
+?>
diff -x .svn -aruN 3.51.src/nucleus/libs/PLUGIN.php 3.61.src/nucleus/libs/PLUGIN.php
--- 3.51.src/nucleus/libs/PLUGIN.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/PLUGIN.php	2010-12-19 00:16:48.000000000 -0600
@@ -17,7 +17,7 @@
 	 *
 	 * @license http://nucleuscms.org/license.txt GNU General Public License
 	 * @copyright Copyright (C) 2002-2009 The Nucleus Group
-	 * @version $Id: PLUGIN.php 1393 2009-07-24 21:06:40Z ftruscot $
+	 * @version $Id: PLUGIN.php 1470 2010-11-29 22:10:16Z ftruscot $
 	 */
 	class NucleusPlugin {
 
@@ -348,12 +348,12 @@
 			$query = 'INSERT INTO ' . sql_table('plugin_option_desc')
 				   .' (opid, oname, ocontext, odesc, otype, odef, oextra)'
 				   .' VALUES ('.intval($this->plugid)
-							 .', \''.addslashes($name).'\''
-							 .', \''.addslashes($context).'\''
-							 .', \''.addslashes($desc).'\''
-							 .', \''.addslashes($type).'\''
-							 .', \''.addslashes($defValue).'\''
-							 .', \''.addslashes($typeExtras).'\')';
+							 .', \''.sql_real_escape_string($name).'\''
+							 .', \''.sql_real_escape_string($context).'\''
+							 .', \''.sql_real_escape_string($desc).'\''
+							 .', \''.sql_real_escape_string($type).'\''
+							 .', \''.sql_real_escape_string($defValue).'\''
+							 .', \''.sql_real_escape_string($typeExtras).'\')';
 			sql_query($query);
 			$oid = sql_insert_id();
 
@@ -419,7 +419,7 @@
 
 			// update plugin_option
 			sql_query('DELETE FROM ' . sql_table('plugin_option') . ' WHERE oid='.intval($oid) . ' and ocontextid='. intval($contextid));
-			sql_query('INSERT INTO ' . sql_table('plugin_option') . ' (ovalue, oid, ocontextid) VALUES (\''.addslashes($value).'\', '. intval($oid) . ', ' . intval($contextid) . ')');
+			sql_query('INSERT INTO ' . sql_table('plugin_option') . ' (ovalue, oid, ocontextid) VALUES (\''.sql_real_escape_string($value).'\', '. intval($oid) . ', ' . intval($contextid) . ')');
 
 			// update cache
 			$this->_aOptionValues[$oid . '_' . $contextid] = $value;
@@ -453,7 +453,7 @@
 
 				// fill DB with default value
 				$query = 'INSERT INTO ' . sql_table('plugin_option') . ' (oid,ocontextid,ovalue)'
-					   .' VALUES ('.intval($oid).', '.intval($contextid).', \''.addslashes($defVal).'\')';
+					   .' VALUES ('.intval($oid).', '.intval($contextid).', \''.sql_real_escape_string($defVal).'\')';
 				sql_query($query);
 			}
 			else {
@@ -541,7 +541,7 @@
 			// delete all associated plugin options
 			$aOIDs = array();
 				// find ids
-			$query = 'SELECT oid FROM '.sql_table('plugin_option_desc') . ' WHERE ocontext=\''.addslashes($context).'\'';
+			$query = 'SELECT oid FROM '.sql_table('plugin_option_desc') . ' WHERE ocontext=\''.sql_real_escape_string($context).'\'';
 			$res = sql_query($query);
 			while ($o = sql_fetch_object($res))
 				array_push($aOIDs, $o->oid);
@@ -666,7 +666,7 @@
 
 							// delete the old value for the option
 							sql_query('DELETE FROM '.sql_table('plugin_option').' WHERE oid='.intval($oid).' AND ocontextid='.intval($contextid));
-							sql_query('INSERT INTO '.sql_table('plugin_option')." (oid, ocontextid, ovalue) VALUES (".intval($oid).",".intval($contextid).",'" . addslashes($value) . "')");
+							sql_query('INSERT INTO '.sql_table('plugin_option')." (oid, ocontextid, ovalue) VALUES (".intval($oid).",".intval($contextid).",'" . sql_real_escape_string($value) . "')");
 						}
 					}
 				}
diff -x .svn -aruN 3.51.src/nucleus/libs/SEARCH.php 3.61.src/nucleus/libs/SEARCH.php
--- 3.51.src/nucleus/libs/SEARCH.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/SEARCH.php	2010-12-19 00:16:48.000000000 -0600
@@ -20,7 +20,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: SEARCH.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: SEARCH.php 1477 2010-12-05 23:41:51Z gregorlove $
  */
 
 
@@ -60,7 +60,7 @@
 		   }
 
 		   if(strlen($stringsum_long)>0){
-				$stringsum_long = addslashes($stringsum_long);
+				$stringsum_long = sql_real_escape_string($stringsum_long);
 				$stringsum_a[] = " match ($match) against ('$stringsum_long') ";
 		   }
 
@@ -70,29 +70,32 @@
 	}
 
 	function boolean_inclusive_atoms($string){
-		$result=trim($string);
-		$result=preg_replace("/([[:space:]]{2,})/",' ',$result);
+		$result = trim($string);
+		$result = preg_replace("#([[:space:]]{2,})#", ' ', $result);
+
+		# replaced eregi_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
+		# just added delimiters to regex and the 'i' for case-insensitive matching
 
 		/* convert normal boolean operators to shortened syntax */
-		$result=eregi_replace(' not ',' -',$result);
-		$result=eregi_replace(' and ',' ',$result);
-		$result=eregi_replace(' or ',',',$result);
+		$result = preg_replace('# not #i', ' -', $result);
+		$result = preg_replace('# and #i', ' ', $result);
+		$result = preg_replace('# or #i', ',', $result);
 
 		/* drop unnecessary spaces */
-		$result=str_replace(' ,',',',$result);
-		$result=str_replace(', ',',',$result);
-		$result=str_replace('- ','-',$result);
-		$result=str_replace('+','',$result);
+		$result = str_replace(' ,', ',', $result);
+		$result = str_replace(', ', ',', $result);
+		$result = str_replace('- ', '-', $result);
+		$result = str_replace('+', '', $result);
 
 		/* strip exlusive atoms */
-		$result=preg_replace(
-			"(\-\([A-Za-z0-9]{1,}[A-Za-z0-9\-\.\_\,]{0,}\))",
+		$result = preg_replace(
+			"#\-\([A-Za-z0-9]{1,}[A-Za-z0-9\-\.\_\,]{0,}\)#",
 			'',
 			$result);
 
-		$result=str_replace('(',' ',$result);
-		$result=str_replace(')',' ',$result);
-		$result=str_replace(',',' ',$result);
+		$result = str_replace('(', ' ', $result);
+		$result = str_replace(')', ' ', $result);
+		$result = str_replace(',', ' ', $result);
 
 		return $result;
 	}
@@ -131,7 +134,7 @@
 
         if (!is_array($matches)) $match=$matches;
 
-        else return ' match ('.$match.') against (\''.addslashes($matches[1]).'\') > 0 ';
+        else return ' match ('.$match.') against (\''.sql_real_escape_string($matches[1]).'\') > 0 ';
 
     }
 
@@ -141,48 +144,53 @@
 
         if (!is_array($matches)) $match=$matches;
 
-        else return ' ('.$this->boolean_sql_where_short(addslashes($mathes[1]),$match).') ';
+        else return ' ('.$this->boolean_sql_where_short(sql_real_escape_string($mathes[1]),$match).') ';
 
     }	
 
 	function boolean_mark_atoms($string){
-		$result=trim($string);
-		$result=preg_replace("/([[:space:]]{2,})/",' ',$result);
+		$result = trim($string);
+		$result = preg_replace("/([[:space:]]{2,})/",' ',$result);
 
-		/* convert normal boolean operators to shortened syntax */
-		$result=eregi_replace(' not ',' -',$result);
-		$result=eregi_replace(' and ',' ',$result);
-		$result=eregi_replace(' or ',',',$result);
+		# replaced eregi_replace() below with preg_replace(). ereg* functions are deprecated in PHP 5.3.0
+		# just added delimiters to regex and the 'i' for case-insensitive matching
 
+		/* convert normal boolean operators to shortened syntax */
+		$result = preg_replace('# not #i', ' -', $result);
+		$result = preg_replace('# and #i', ' ', $result);
+		$result = preg_replace('# or #i', ',', $result);
 
 		/* strip excessive whitespace */
-		$result=str_replace('( ','(',$result);
-		$result=str_replace(' )',')',$result);
-		$result=str_replace(', ',',',$result);
-		$result=str_replace(' ,',',',$result);
-		$result=str_replace('- ','-',$result);
-		$result=str_replace('+','',$result);
+		$result = str_replace('( ', '(', $result);
+		$result = str_replace(' )', ')', $result);
+		$result = str_replace(', ', ',', $result);
+		$result = str_replace(' ,', ',', $result);
+		$result = str_replace('- ', '-', $result);
+		$result = str_replace('+', '', $result);
 
 		// remove double spaces (we might have introduced some new ones above)
-		$result=trim($result);
-		$result=preg_replace("/([[:space:]]{2,})/",' ',$result);
+		$result = trim($result);
+		$result = preg_replace("#([[:space:]]{2,})#", ' ', $result);
 
 		/* apply arbitrary function to all 'word' atoms */
 
-		$result_a = explode(" ",$result);
-		for($word=0;$word<count($result_a);$word++){
-			$result_a[$word] = "foo[('".$result_a[$word]."')]bar";
+		$result_a = explode(' ', $result);
+
+		for($word = 0;$word<count($result_a);$word++)
+		{
+			$result_a[$word] = "foo[('" . $result_a[$word] . "')]bar";
 		}
-		$result = implode(" ",$result_a);
+
+		$result = implode(' ', $result_a);
 
 		/* dispatch ' ' to ' AND ' */
-		$result=str_replace(' ',' AND ',$result);
+		$result = str_replace(' ', ' AND ', $result);
 
 		/* dispatch ',' to ' OR ' */
-		$result=str_replace(',',' OR ',$result);
+		$result = str_replace(',', ' OR ', $result);
 
 		/* dispatch '-' to ' NOT ' */
-		$result=str_replace(' -',' NOT ',$result);
+		$result = str_replace(' -', ' NOT ', $result);
 		return $result;
 	}
 
@@ -201,9 +209,9 @@
 		for($ith=0;$ith<count($match_a);$ith++){
 			$score_a[$ith] =
 						   " $score_unit_weight*(
-						   LENGTH(" . addslashes($match_a[$ith]) . ") -
-						   LENGTH(REPLACE(LOWER(" . addslashes($match_a[$ith]) . "),LOWER('" . addslashes($string) . "'),'')))
-						   /LENGTH('" . addslashes($string) . "') ";
+						   LENGTH(" . sql_real_escape_string($match_a[$ith]) . ") -
+						   LENGTH(REPLACE(LOWER(" . sql_real_escape_string($match_a[$ith]) . "),LOWER('" . sql_real_escape_string($string) . "'),'')))
+						   /LENGTH('" . sql_real_escape_string($string) . "') ";
 		}
 		$score = implode(" + ",$score_a);
 
diff -x .svn -aruN 3.51.src/nucleus/libs/SKIN.php 3.61.src/nucleus/libs/SKIN.php
--- 3.51.src/nucleus/libs/SKIN.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/SKIN.php	2010-12-19 00:16:48.000000000 -0600
@@ -14,7 +14,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: SKIN.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: SKIN.php 1470 2010-11-29 22:10:16Z ftruscot $
  */
 
 if ( !function_exists('requestVar') ) exit;
@@ -65,7 +65,7 @@
 	 * @static
 	 */
 	function exists($name) {
-		return quickQuery('select count(*) as result FROM '.sql_table('skin_desc').' WHERE sdname="'.addslashes($name).'"') > 0;
+		return quickQuery('select count(*) as result FROM '.sql_table('skin_desc').' WHERE sdname="'.sql_real_escape_string($name).'"') > 0;
 	}
 
 	/**
@@ -97,7 +97,7 @@
 	function getIdFromName($name) {
 		$query =  'SELECT sdnumber'
 			   . ' FROM '.sql_table('skin_desc')
-			   . ' WHERE sdname="'.addslashes($name).'"';
+			   . ' WHERE sdname="'.sql_real_escape_string($name).'"';
 		$res = sql_query($query);
 		$obj = sql_fetch_object($res);
 		return $obj->sdnumber;
@@ -132,7 +132,7 @@
 			)
 		);
 
-		sql_query('INSERT INTO '.sql_table('skin_desc')." (sdname, sddesc, sdtype, sdincmode, sdincpref) VALUES ('" . addslashes($name) . "','" . addslashes($desc) . "','".addslashes($type)."','".addslashes($includeMode)."','".addslashes($includePrefix)."')");
+		sql_query('INSERT INTO '.sql_table('skin_desc')." (sdname, sddesc, sdtype, sdincmode, sdincpref) VALUES ('" . sql_real_escape_string($name) . "','" . sql_real_escape_string($desc) . "','".sql_real_escape_string($type)."','".sql_real_escape_string($includeMode)."','".sql_real_escape_string($includePrefix)."')");
 		$newid = sql_insert_id();
 
 		$manager->notify(
@@ -194,7 +194,7 @@
 	}
 
 	function getContent($type) {
-		$query = 'SELECT scontent FROM '.sql_table('skin')." WHERE sdesc=$this->id and stype='". addslashes($type) ."'";
+		$query = 'SELECT scontent FROM '.sql_table('skin')." WHERE sdesc=$this->id and stype='". sql_real_escape_string($type) ."'";
 		$res = sql_query($query);
 
 		if (sql_num_rows($res) == 0)
@@ -210,11 +210,11 @@
 		$skinid = $this->id;
 
 		// delete old thingie
-		sql_query('DELETE FROM '.sql_table('skin')." WHERE stype='".addslashes($type)."' and sdesc=" . intval($skinid));
+		sql_query('DELETE FROM '.sql_table('skin')." WHERE stype='".sql_real_escape_string($type)."' and sdesc=" . intval($skinid));
 
 		// write new thingie
 		if ($content) {
-			sql_query('INSERT INTO '.sql_table('skin')." SET scontent='" . addslashes($content) . "', stype='" . addslashes($type) . "', sdesc=" . intval($skinid));
+			sql_query('INSERT INTO '.sql_table('skin')." SET scontent='" . sql_real_escape_string($content) . "', stype='" . sql_real_escape_string($type) . "', sdesc=" . intval($skinid));
 		}
 	}
 
@@ -230,11 +230,11 @@
 	 */
 	function updateGeneralInfo($name, $desc, $type = 'text/html', $includeMode = 'normal', $includePrefix = '') {
 		$query =  'UPDATE '.sql_table('skin_desc').' SET'
-			   . " sdname='" . addslashes($name) . "',"
-			   . " sddesc='" . addslashes($desc) . "',"
-			   . " sdtype='" . addslashes($type) . "',"
-			   . " sdincmode='" . addslashes($includeMode) . "',"
-			   . " sdincpref='" . addslashes($includePrefix) . "'"
+			   . " sdname='" . sql_real_escape_string($name) . "',"
+			   . " sddesc='" . sql_real_escape_string($desc) . "',"
+			   . " sdtype='" . sql_real_escape_string($type) . "',"
+			   . " sdincmode='" . sql_real_escape_string($includeMode) . "',"
+			   . " sdincpref='" . sql_real_escape_string($includePrefix) . "'"
 			   . " WHERE sdnumber=" . $this->getID();
 		sql_query($query);
 	}
@@ -370,7 +370,8 @@
 				$extraActions = array(
 								'membermailform',
 								'blogsetting',
-								'nucleusbutton'
+								'nucleusbutton',
+								'categorylist'
 				);
 				break;
 			case 'item':
@@ -397,7 +398,8 @@
 				break;
 			case 'error':
 				$extraActions = array(
-								'errormessage'
+								'errormessage',
+								'categorylist'
 				);
 				break;
 			default:
@@ -414,7 +416,8 @@
 						'nextlink',
 						'prevlink',
 						'membermailform',
-						'nucleusbutton'
+						'nucleusbutton',
+						'categorylist'
 					);
 				}
 				break;
diff -x .svn -aruN 3.51.src/nucleus/libs/sql/mysql.php 3.61.src/nucleus/libs/sql/mysql.php
--- 3.51.src/nucleus/libs/sql/mysql.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/sql/mysql.php	2010-12-19 00:16:48.000000000 -0600
@@ -168,9 +168,11 @@
 	/**
 	  * returns number of rows affected by SQL query
 	  */
-	function sql_affected_rows($res)
+	function sql_affected_rows($conn = false)
 	{
-		return mysql_affected_rows($res);
+		global $MYSQL_CONN;
+		if (!$conn) $conn = $MYSQL_CONN;
+		return mysql_affected_rows($conn);
 	}
 	
 	/**
diff -x .svn -aruN 3.51.src/nucleus/libs/TEMPLATE.php 3.61.src/nucleus/libs/TEMPLATE.php
--- 3.51.src/nucleus/libs/TEMPLATE.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/libs/TEMPLATE.php	2010-12-19 00:16:48.000000000 -0600
@@ -15,7 +15,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: TEMPLATE.php 1388 2009-07-18 06:31:28Z shizuki $
+ * @version $Id: TEMPLATE.php 1470 2010-11-29 22:10:16Z ftruscot $
  */
 class TEMPLATE {
 
@@ -38,7 +38,7 @@
 	function getIdFromName($name) {
 		$query =  'SELECT tdnumber'
 			   . ' FROM '.sql_table('template_desc')
-			   . ' WHERE tdname="'.addslashes($name).'"';
+			   . ' WHERE tdname="'.sql_real_escape_string($name).'"';
 		$res = sql_query($query);
 		$obj = sql_fetch_object($res);
 		return $obj->tdnumber;
@@ -49,8 +49,8 @@
 	 */
 	function updateGeneralInfo($name, $desc) {
 		$query =  'UPDATE '.sql_table('template_desc').' SET'
-			   . " tdname='" . addslashes($name) . "',"
-			   . " tddesc='" . addslashes($desc) . "'"
+			   . " tdname='" . sql_real_escape_string($name) . "',"
+			   . " tddesc='" . sql_real_escape_string($desc) . "'"
 			   . " WHERE tdnumber=" . $this->getID();
 		sql_query($query);
 	}
@@ -62,11 +62,11 @@
 		$id = $this->getID();
 
 		// delete old thingie
-		sql_query('DELETE FROM '.sql_table('template')." WHERE tpartname='". addslashes($type) ."' and tdesc=" . intval($id));
+		sql_query('DELETE FROM '.sql_table('template')." WHERE tpartname='". sql_real_escape_string($type) ."' and tdesc=" . intval($id));
 
 		// write new thingie
 		if ($content) {
-			sql_query('INSERT INTO '.sql_table('template')." SET tcontent='" . addslashes($content) . "', tpartname='" . addslashes($type) . "', tdesc=" . intval($id));
+			sql_query('INSERT INTO '.sql_table('template')." SET tcontent='" . sql_real_escape_string($content) . "', tpartname='" . sql_real_escape_string($type) . "', tdesc=" . intval($id));
 		}
 	}
 
@@ -94,7 +94,7 @@
 			)
 		);
 
-		sql_query('INSERT INTO '.sql_table('template_desc')." (tdname, tddesc) VALUES ('" . addslashes($name) . "','" . addslashes($desc) . "')");
+		sql_query('INSERT INTO '.sql_table('template_desc')." (tdname, tddesc) VALUES ('" . sql_real_escape_string($name) . "','" . sql_real_escape_string($desc) . "')");
 		$newId = sql_insert_id();
 
 		$manager->notify(
@@ -128,7 +128,7 @@
 
 		$query = 'SELECT tpartname, tcontent'
 			   . ' FROM '.sql_table('template_desc').', '.sql_table('template')
-			   . ' WHERE tdesc=tdnumber and tdname="' . addslashes($name) . '"';
+			   . ' WHERE tdesc=tdnumber and tdname="' . sql_real_escape_string($name) . '"';
 		$res = sql_query($query);
 		while ($obj = sql_fetch_object($res))
 			$template[$obj->tpartname] = $obj->tcontent;
@@ -167,7 +167,7 @@
 	// returns true if there is a template with the given shortname
 	// (static)
 	function exists($name) {
-		$r = sql_query('select * FROM '.sql_table('template_desc').' WHERE tdname="'.addslashes($name).'"');
+		$r = sql_query('select * FROM '.sql_table('template_desc').' WHERE tdname="'.sql_real_escape_string($name).'"');
 		return (sql_num_rows($r) != 0);
 	}
 
diff -x .svn -aruN 3.51.src/nucleus/media.php 3.61.src/nucleus/media.php
--- 3.51.src/nucleus/media.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/media.php	2010-12-19 00:16:52.000000000 -0600
@@ -21,7 +21,7 @@
  *
  * @license http://nucleuscms.org/license.txt GNU General Public License
  * @copyright Copyright (C) 2002-2009 The Nucleus Group
- * @version $Id: media.php 1390 2009-07-19 02:41:50Z ftruscot $
+ * @version $Id: media.php 1473 2010-12-03 22:57:39Z ftruscot $
  *
  */
 
@@ -278,6 +278,13 @@
 		<input name="collection" type="hidden" value="<?php echo htmlspecialchars(requestVar('collection'))?>" />
 	<?php		} // if sizeof
 	?>
+	<br /><br />
+	<?php
+	$manager->notify(
+                'MediaUploadFormExtras',
+                array()
+            );
+	?>
 	  <br /><br />
 	  <input type="submit" value="<?php echo _UPLOAD_BUTTON?>" />
 	</div>
@@ -302,6 +309,11 @@
 	$filetempname = $uploadInfo['tmp_name'];
 	$fileerror = intval($uploadInfo['error']);
 	
+	// clean filename of characters that may cause trouble in a filename using cleanFileName() function from globalfunctions.php
+	$filename = cleanFileName($filename);
+	if ($filename === false) 
+		media_doError(_ERROR_BADFILETYPE);
+	
 	switch ($fileerror)
 	{
 		case 0: // = UPLOAD_ERR_OK
diff -x .svn -aruN 3.51.src/nucleus/plugins/NP_Ping.php 3.61.src/nucleus/plugins/NP_Ping.php
--- 3.51.src/nucleus/plugins/NP_Ping.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/plugins/NP_Ping.php	2010-12-19 00:16:46.000000000 -0600
@@ -28,6 +28,7 @@
  *   v1.7 - move send ping option from blog to plugin/blog level
  *        - remove ping override option
  *   v1.8 - remove sendPing event handle, switch to use PostAddItem and PostUpdateItem event for new item ping
+ *   v1.81 - fix bug in _sendPingCheck() where ITEM class not found when creating new weblog
  */
 
 class NP_Ping extends NucleusPlugin
@@ -50,7 +51,7 @@
 
     function getVersion()
     {
-        return '1.8';
+        return '1.81';
     }
 
     function getMinNucleusVersion()
@@ -167,7 +168,8 @@
     function _sendPingCheck($itemid)
     {
         $iid  = intval($itemid);
-        $item = ITEM::getitem($iid, 0, 0); // draft or future post return 0
+        global $manager;
+		$item = $manager->getItem($iid,0,0);
         if ($item) {
             $bid = intval(getBlogIDFromItemID($iid));
             if ($this->getBlogOption($bid, 'ping_sendping') == "yes" ) {
@@ -179,8 +181,7 @@
     function sendPings($data) {
 
         if (!class_exists('xmlrpcmsg')) {
-            global $DIR_LIBS;
-            include($DIR_LIBS . 'xmlrpc.inc.php');
+            include_libs('xmlrpc.inc.php');
         }
         $this->myBlogId = $data['blogid'];
 
@@ -380,4 +381,4 @@
     }
 }
 
-?>
\ No newline at end of file
+?>
diff -x .svn -aruN 3.51.src/nucleus/plugins/NP_SecurityEnforcer.php 3.61.src/nucleus/plugins/NP_SecurityEnforcer.php
--- 3.51.src/nucleus/plugins/NP_SecurityEnforcer.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/plugins/NP_SecurityEnforcer.php	2010-12-19 00:16:46.000000000 -0600
@@ -18,11 +18,11 @@
 
 	function getName() { return 'SecurityEnforcer'; }
 
-	function getAuthor()  {	return 'Frank Truscott';	}
+	function getAuthor()  {	return 'Frank Truscott + Cacher';	}
 
 	function getURL()   { return 'http://revcetera.com/ftruscot';	}
 
-	function getVersion() {	return '1.01'; }
+	function getVersion() {	return '1.02'; }
 
 	function getDescription() {
 		return _SECURITYENFORCER_DESCRIPTION;
@@ -42,7 +42,7 @@
 	}
 
 	function getTableList() { return array(sql_table('plug_securityenforcer')); }
-	function getEventList() { return array('QuickMenu','PrePasswordSet','CustomLogin','LoginSuccess','LoginFailed'); }
+	function getEventList() { return array('QuickMenu','PrePasswordSet','CustomLogin','LoginSuccess','LoginFailed','PostRegister','PrePluginOptionsEdit'); }
 	
 	function install() {
 		global $CONF;
@@ -52,7 +52,8 @@
 		$this->createOption('del_uninstall_data', _SECURITYENFORCER_OPT_DEL_UNINSTALL_DATA, 'yesno','no');
 		$this->createOption('enable_security', _SECURITYENFORCER_OPT_ENABLE, 'yesno','yes');
 		$this->createOption('pwd_min_length', _SECURITYENFORCER_OPT_PWD_MIN_LENGTH, 'text','8');
-		$this->createOption('pwd_complexity', _SECURITYENFORCER_OPT_PWD_COMPLEXITY, 'select','0',_SECURITYENFORCER_OPT_SELECT_OFF_COMP.'|0|'._SECURITYENFORCER_OPT_SELECT_ONE_COMP.'|1|'._SECURITYENFORCER_OPT_SELECT_TWO_COMP.'|2|'._SECURITYENFORCER_OPT_SELECT_THREE_COMP.'|3|'._SECURITYENFORCER_OPT_SELECT_FOUR_COMP.'|4');
+		//$this->createOption('pwd_complexity', _SECURITYENFORCER_OPT_PWD_COMPLEXITY, 'select','0',_SECURITYENFORCER_OPT_SELECT_OFF_COMP.'|0|'._SECURITYENFORCER_OPT_SELECT_ONE_COMP.'|1|'._SECURITYENFORCER_OPT_SELECT_TWO_COMP.'|2|'._SECURITYENFORCER_OPT_SELECT_THREE_COMP.'|3|'._SECURITYENFORCER_OPT_SELECT_FOUR_COMP.'|4');
+		$this->createOption('pwd_complexity', '_SECURITYENFORCER_OPT_PWD_COMPLEXITY', 'select','0','_SECURITYENFORCER_OPT_SELECT');
 		$this->createOption('max_failed_login', _SECURITYENFORCER_OPT_MAX_FAILED_LOGIN, 'text', '5');
 		$this->createOption('login_lockout', _SECURITYENFORCER_OPT_LOGIN_LOCKOUT, 'text', '15');
 		
@@ -75,7 +76,6 @@
 	
 	function init() {
 		// include language file for this plugin
-//        $language = ereg_replace( '[\\|/]', '', getLanguageName());
         $language = preg_replace( '@\\|/@', '', getLanguageName());
         if (file_exists($this->getDirectory().$language.'.php'))
             include_once($this->getDirectory().$language.'.php');
@@ -94,7 +94,7 @@
     	// only show when option enabled
 		global $member;
     	if ($this->getOption('quickmenu') != 'yes' || !$member->isAdmin()) return;
-    	global $member;
+    	//global $member;
     	if (!($member->isLoggedIn())) return;
     	array_push($data['options'],
       		array('title' => 'Security Enforcer',
@@ -105,11 +105,32 @@
 	function event_PrePasswordSet(&$data) {
 		//password, errormessage, valid
 		if ($this->enable_security == 'yes') {
-			if (!$this->_validate_passwd($data['password'],$this->pwd_min_length, $this->pwd_complexity)) {
-				$data['errormessage'] = _SECURITYENFORCER_INSUFFICIENT_COMPLEXITY;
-				$data['errormessage'] .= _SECURITYENFORCER_MIN_PWD_LENGTH . $this->pwd_min_length; 
-				$data['errormessage'] .= _SECURITYENFORCER_PWD_COMPLEXITY . $this->pwd_complexity . "<br /><br />\n"; 
-				$data['valid'] = false;
+			$password = $data['password'];
+			// conditional below not needed in 3.60 or higher. Used to keep from setting off error when password not being changed
+			if (postVar('action') == 'changemembersettings')
+				$emptyAllowed = true;
+			else
+				$emptyAllowed = false;
+			if ((!$emptyAllowed)||$password){
+				$message = $this->_validate_and_messsage($password,$this->pwd_min_length, $this->pwd_complexity);
+				if ($message) {
+					$data['errormessage'] = _SECURITYENFORCER_INSUFFICIENT_COMPLEXITY . $message. "<br /><br />\n";
+					$data['valid'] = false;
+				}
+			}
+		}
+	}
+	
+	function event_PostRegister(&$data) {
+		if ($this->enable_security == 'yes') {
+			$password = postVar('password');
+			if(postVar('action') == 'memberadd'){
+				$message = $this->_validate_and_messsage($password,$this->pwd_min_length, $this->pwd_complexity);
+				if ($message) {
+					$errormessage = _SECURITYENFORCER_ACCOUNT_CREATED. $message. "<br /><br />\n";
+					global $admin;
+					$admin->error($errormessage);
+				}
 			}
 		}
 	}
@@ -122,17 +143,14 @@
 			$ip = $_SERVER['REMOTE_ADDR'];
 			sql_query("DELETE FROM ".sql_table('plug_securityenforcer')." WHERE lastfail < ".(time() - ($this->login_lockout * 60)));
 			$query = "SELECT fails as result FROM ".sql_table('plug_securityenforcer')." ";
-			//$query .= "WHERE login='".addslashes($login)."'";
 			$query .= "WHERE login='".sql_real_escape_string($login)."'";
 			$flogin = quickQuery($query); 
 			$query = "SELECT fails as result FROM ".sql_table('plug_securityenforcer')." ";
-			//$query .= "WHERE login='".addslashes($ip)."'";
 			$query .= "WHERE login='".sql_real_escape_string($ip)."'";
 			$fip = quickQuery($query); 
 			if ($flogin >= $this->max_failed_login || $fip >= $this->max_failed_login) {
 				$data['success'] = 0;
 				$data['allowlocal'] = 0;
-				//ACTIONLOG::add(INFO, 'login disallowed by NP_SecurityEnforcer. login: '.htmlentities($login).', ip: '.htmlentities($ip) );
 				$info = sprintf(_SECURITYENFORCER_LOGIN_DISALLOWED, htmlspecialchars($login), htmlspecialchars($ip));
                 ACTIONLOG::add(INFO, $info);
 			}
@@ -145,9 +163,7 @@
 			global $_SERVER;
 			$login = $data['username'];
 			$ip = $_SERVER['REMOTE_ADDR'];
-			//sql_query("DELETE FROM ".sql_table('plug_securityenforcer')." WHERE login='".addslashes($login)."'");
 			sql_query("DELETE FROM ".sql_table('plug_securityenforcer')." WHERE login='".sql_real_escape_string($login)."'");
-			//sql_query("DELETE FROM ".sql_table('plug_securityenforcer')." WHERE login='".addslashes($ip)."'");			
 			sql_query("DELETE FROM ".sql_table('plug_securityenforcer')." WHERE login='".sql_real_escape_string($ip)."'");
 		}
 	}
@@ -158,30 +174,36 @@
 			global $_SERVER;
 			$login = $data['username'];
 			$ip = $_SERVER['REMOTE_ADDR'];
-			//sql_table('plug_securityenforcer')
-			//$lres = sql_query("SELECT * FROM ".sql_table('plug_securityenforcer')." WHERE login='".addslashes($login)."'");
 			$lres = sql_query("SELECT * FROM ".sql_table('plug_securityenforcer')." WHERE login='".sql_real_escape_string($login)."'");
 			if (sql_num_rows($lres)) {
-				//sql_query("UPDATE ".sql_table('plug_securityenforcer')." SET fails=fails+1, lastfail=".time()." WHERE login='".addslashes($login)."'");
 				sql_query("UPDATE ".sql_table('plug_securityenforcer')." SET fails=fails+1, lastfail=".time()." WHERE login='".sql_real_escape_string($login)."'");
 			}
 			else {
-				//sql_query("INSERT INTO ".sql_table('plug_securityenforcer')." (login,fails,lastfail) VALUES ('".addslashes($login)."',1,".time().")");
 				sql_query("INSERT INTO ".sql_table('plug_securityenforcer')." (login,fails,lastfail) VALUES ('".sql_real_escape_string($login)."',1,".time().")");
 			}
-			//$lres = sql_query("SELECT * FROM ".sql_table('plug_securityenforcer')." WHERE login='".addslashes($ip)."'");
 			$lres = sql_query("SELECT * FROM ".sql_table('plug_securityenforcer')." WHERE login='".sql_real_escape_string($ip)."'");
 			if (sql_num_rows($lres)) {
-				//sql_query("UPDATE ".sql_table('plug_securityenforcer')." SET fails=fails+1, lastfail=".time()." WHERE login='".addslashes($ip)."'");
 				sql_query("UPDATE ".sql_table('plug_securityenforcer')." SET fails=fails+1, lastfail=".time()." WHERE login='".sql_real_escape_string($ip)."'");
 			}
 			else {
-				//sql_query("INSERT INTO ".sql_table('plug_securityenforcer')." (login,fails,lastfail) VALUES ('".addslashes($ip)."',1,".time().")");
 				sql_query("INSERT INTO ".sql_table('plug_securityenforcer')." (login,fails,lastfail) VALUES ('".sql_real_escape_string($ip)."',1,".time().")");
 			}
 		}		
 	}
 	
+	function event_PrePluginOptionsEdit($data) {
+		if ($data['plugid'] === $this->getID()) {
+			foreach($data['options'] as $key => $value){
+				if (defined($value['description'])) {
+					$data['options'][$key]['description'] = constant($value['description']);
+				}
+				if (!strcmp($value['type'], 'select') && defined($value['typeinfo'])) {
+					$data['options'][$key]['typeinfo'] = constant($value['typeinfo']);
+				}
+			}
+		}
+	}
+	
 	/* Helper Functions */
 	
 	function _validate_passwd($passwd,$minlength = 6,$complexity = 0) {
@@ -207,5 +229,33 @@
 		if (array_sum($tot) >= $complexity) return true;
 		else return false;
 	}
+	
+	function _validate_and_messsage($passwd,$minlength = 6,$complexity = 0) {
+		$minlength = intval($minlength);
+		$complexity = intval($complexity);
+
+		if ($minlength < 6 ) $minlength = 6;
+		if (strlen($passwd) < $minlength) {
+			$message = _SECURITYENFORCER_MIN_PWD_LENGTH . $this->pwd_min_length;
+		}
+
+		if ($complexity > 4) $complexity = 4;
+		$ucchars = "[A-Z]";
+		$lcchars = "[a-z]";
+		$numchars = "[0-9]";
+		$ochars = "[-~!@#$%^&*()_+=,.<>?:;|]";
+		$chartypes = array($ucchars, $lcchars, $numchars, $ochars);
+		$tot = array(0,0,0,0);
+		$i = 0;
+		foreach ($chartypes as $value) {
+			$tot[$i] = preg_match("/".$value."/", $passwd);
+			$i = $i + 1;
+		}
+
+		if (array_sum($tot) < $complexity) {
+			$message .= _SECURITYENFORCER_PWD_COMPLEXITY . $this->pwd_complexity;
+		}
+		return $message;
+	}
 }
 ?>
\ No newline at end of file
diff -x .svn -aruN 3.51.src/nucleus/plugins/ping/ping.php 3.61.src/nucleus/plugins/ping/ping.php
--- 3.51.src/nucleus/plugins/ping/ping.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/plugins/ping/ping.php	2010-12-19 00:16:44.000000000 -0600
@@ -1,7 +1,7 @@
 <?php
 require(dirname(__FILE__).'/../../../config.php');
 
-include($DIR_LIBS . 'PLUGINADMIN.php');
+include_libs('PLUGINADMIN.php');
 
 // create a object of the plugin via Plugin Admin
 $oPluginAdmin = new PluginAdmin('Ping');
diff -x .svn -aruN 3.51.src/nucleus/plugins/securityenforcer/english.php 3.61.src/nucleus/plugins/securityenforcer/english.php
--- 3.51.src/nucleus/plugins/securityenforcer/english.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/plugins/securityenforcer/english.php	2010-12-19 00:16:44.000000000 -0600
@@ -1,43 +1,45 @@
-<?php
-/** English language file for NP_SECURITYENFORCER Plugin
-*/
-
-// Plugin Options
-define('_SECURITYENFORCER_OPT_QUICKMENU',		   'Show Admin Area in quick menu?');
-define('_SECURITYENFORCER_OPT_DEL_UNINSTALL_DATA',	   'Delete NP_SecurityEnforcer data table on uninstall?');
-define('_SECURITYENFORCER_OPT_ENABLE',		   'Enable NP_SecurityEnforcer password and login checks?');
-define('_SECURITYENFORCER_OPT_PWD_MIN_LENGTH',		'Minimum Length in characters of a user password. Integer. 8 is the default and 6 the minimum value: ');
-define('_SECURITYENFORCER_OPT_PWD_COMPLEXITY',		'Password Complexity Check. (How many character types should be present out of a-z, A-Z, 0-9, punctuation marks?):');
-define('_SECURITYENFORCER_OPT_SELECT_OFF_COMP',		'Off');
-define('_SECURITYENFORCER_OPT_SELECT_ONE_COMP',		'One character type');
-define('_SECURITYENFORCER_OPT_SELECT_TWO_COMP',		'Two character types');
-define('_SECURITYENFORCER_OPT_SELECT_THREE_COMP',		'Three character types');
-define('_SECURITYENFORCER_OPT_SELECT_FOUR_COMP',		'Four character types');
-define('_SECURITYENFORCER_OPT_MAX_FAILED_LOGIN',		'How many failed login attempts before locking the user account?');
-define('_SECURITYENFORCER_OPT_LOGIN_LOCKOUT',		'After how many minutes should a locked account be released?');
-
-
-//QuickMenu
-define('_SECURITYENFORCER_ADMIN_TOOLTIP',		   'Manage NP_SecurityEnforcer Plugin');
-define('_SECURITYENFORCER_ADMIN_UNLOCKED',		   ' has been unlocked. Remember to unlock the corresponding IP or Login Name.');
-define('_SECURITYENFORCER_ADMIN_NONE_LOCKED',		   'No Records Found.');
-
-// ERRORS
-define('_SECURITYENFORCER_INSUFFICIENT_COMPLEXITY',		   'This password does not meet site requirements for length or complexity. <br />');
-define('_SECURITYENFORCER_MIN_PWD_LENGTH',		   '<br />Minimum password length: ');
-define('_SECURITYENFORCER_PWD_COMPLEXITY',		   '<br />Minimum number of character types ([a-z], [A-Z], [0-9], [-~!@#$%^&*()_+=,.<>?:;|]): ');
-
-//random words
-define('_SECURITYENFORCER_UNLOCK',		   'Unlock');
-define('_SECURITYENFORCER_ENTITY',		   'Entity');
-define('_SECURITYENFORCER_LOCKED_ENTITIES',		   'Currently Locked Entities');
-
-// Plugin desc
-define('_SECURITYENFORCER_DESCRIPTION',				'Enforces some password complexity rules and sets a maximum number of failed logins.');
-// Log info
-define('_SECURITYENFORCER_LOGIN_DISALLOWED',		'login disallowed by NP_SecurityEnforcer. login: %1$s, ip: %2$s');
-// QuickMenu title
-define('_SECURITYENFORCER_ADMIN_TITLE',				'Security Enforcer Administration');
-
-
+<?php
+/** English language file for NP_SECURITYENFORCER Plugin
+*/
+
+// Plugin Options
+define('_SECURITYENFORCER_OPT_QUICKMENU',			'Show Admin Area in quick menu?');
+define('_SECURITYENFORCER_OPT_DEL_UNINSTALL_DATA',	'Delete NP_SecurityEnforcer data table on uninstall?');
+define('_SECURITYENFORCER_OPT_ENABLE',				'Enable NP_SecurityEnforcer password and login checks?');
+define('_SECURITYENFORCER_OPT_PWD_MIN_LENGTH',		'Minimum Length in characters of a user password. Integer. 8 is the default and 6 the minimum value:');
+define('_SECURITYENFORCER_OPT_PWD_COMPLEXITY',		'Password Complexity Check. (How many character types should be present out of a-z, A-Z, 0-9, punctuation marks?):');
+//define('_SECURITYENFORCER_OPT_SELECT_OFF_COMP',		'Off');
+//define('_SECURITYENFORCER_OPT_SELECT_ONE_COMP',		'One character type');
+//define('_SECURITYENFORCER_OPT_SELECT_TWO_COMP',		'Two character types');
+//define('_SECURITYENFORCER_OPT_SELECT_THREE_COMP',		'Three character types');
+//define('_SECURITYENFORCER_OPT_SELECT_FOUR_COMP',		'Four character types');
+define('_SECURITYENFORCER_OPT_SELECT',				'Off|0|One character type|1|Two character types|2|Three character types|3|Four character types|4');
+define('_SECURITYENFORCER_OPT_MAX_FAILED_LOGIN',	'How many failed login attempts before locking the user account?');
+define('_SECURITYENFORCER_OPT_LOGIN_LOCKOUT',		'After how many minutes should a locked account be released?');
+
+//QuickMenu
+define('_SECURITYENFORCER_ADMIN_TOOLTIP',			'Manage NP_SecurityEnforcer Plugin');
+define('_SECURITYENFORCER_ADMIN_UNLOCKED',			' has been unlocked. Remember to unlock the corresponding IP or Login Name.');
+define('_SECURITYENFORCER_ADMIN_NONE_LOCKED',		'No Records Found.');
+
+// ERRORS
+define('_SECURITYENFORCER_ACCOUNT_CREATED',			'Account has been created,but that password does not meet site requirements for length or complexity. <br />');
+define('_SECURITYENFORCER_INSUFFICIENT_COMPLEXITY',	'This password does not meet site requirements for length or complexity. <br />');
+define('_SECURITYENFORCER_MIN_PWD_LENGTH',			'<br />Minimum password length:');
+define('_SECURITYENFORCER_PWD_COMPLEXITY',			'<br />Minimum number of character types ([a-z], [A-Z], [0-9], [-~!@#$%^&*()_+=,.<>?:;|]):');
+
+//random words
+define('_SECURITYENFORCER_UNLOCK',					'Unlock');
+define('_SECURITYENFORCER_ENTITY',					'Entity');
+define('_SECURITYENFORCER_LOCKED_ENTITIES',			'Currently Locked Entities');
+
+// Plugin desc
+define('_SECURITYENFORCER_DESCRIPTION',				'Enforces some password complexity rules and sets a maximum number of failed logins.');
+
+// Log info
+define('_SECURITYENFORCER_LOGIN_DISALLOWED',		'login disallowed by NP_SecurityEnforcer. login: %1$s, ip: %2$s');
+
+// QuickMenu title
+define('_SECURITYENFORCER_ADMIN_TITLE',				'Security Enforcer Administration');
+
 ?>
\ No newline at end of file
diff -x .svn -aruN 3.51.src/nucleus/plugins/securityenforcer/index.php 3.61.src/nucleus/plugins/securityenforcer/index.php
--- 3.51.src/nucleus/plugins/securityenforcer/index.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/plugins/securityenforcer/index.php	2010-12-19 00:16:44.000000000 -0600
@@ -15,12 +15,12 @@
 	if (!$member->isAdmin())
 		doError('Insufficient Permissions.');
 		
+	include_libs('PLUGINADMIN.php');
 
-	include($DIR_LIBS . 'PLUGINADMIN.php');
 	// some functions
 	
 	function SE_unlockLogin($login) {
-		sql_query("DELETE FROM ".sql_table('plug_securityenforcer')." WHERE login='".addslashes($login)."'");
+		sql_query("DELETE FROM ".sql_table('plug_securityenforcer')." WHERE login='".sql_real_escape_string($login)."'");
 	}
 	
 		
@@ -81,4 +81,4 @@
 	
 	$oPluginAdmin->end();
 
-?>
\ No newline at end of file
+?>
diff -x .svn -aruN 3.51.src/nucleus/plugins/securityenforcer/japanese-euc.php 3.61.src/nucleus/plugins/securityenforcer/japanese-euc.php
--- 3.51.src/nucleus/plugins/securityenforcer/japanese-euc.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/plugins/securityenforcer/japanese-euc.php	2010-12-19 00:16:44.000000000 -0600
@@ -1,44 +1,45 @@
-<?php
-/** English language file for NP_SECURITYENFORCER Plugin
-*/
-
-// Plugin Options
-define('_SECURITYENFORCER_OPT_QUICKMENU',			'å˥塼ɽޤ');
-define('_SECURITYENFORCER_OPT_DEL_UNINSTALL_DATA',	'󥤥󥹥ȡ˥ǡ١Υơ֥ޤ');
-define('_SECURITYENFORCER_OPT_ENABLE',				'ѥɤΥåȥåΤȤSecurityEnforcerͭˤޤ');
-define('_SECURITYENFORCER_OPT_PWD_MIN_LENGTH',		'ѥɤκǾʸ(ǥեȤ8ʸ6ʸ̤ˤϻǤޤ');
-define('_SECURITYENFORCER_OPT_PWD_COMPLEXITY',		'ѥɶ٤Υå(a-z, A-Z, 0-9, 鲿ʸפ¸ߤ٤Ǥ?):');
-define('_SECURITYENFORCER_OPT_SELECT_OFF_COMP',		'Off');
-define('_SECURITYENFORCER_OPT_SELECT_ONE_COMP',		'ʸ');
-define('_SECURITYENFORCER_OPT_SELECT_TWO_COMP',		'ʸ');
-define('_SECURITYENFORCER_OPT_SELECT_THREE_COMP',	'ʸ');
-define('_SECURITYENFORCER_OPT_SELECT_FOUR_COMP',	'ͼʸ');
-define('_SECURITYENFORCER_OPT_MAX_FAILED_LOGIN',	'ܤΥԤǥȤåޤ');
-define('_SECURITYENFORCER_OPT_LOGIN_LOCKOUT',		'ȤåƤ鲿ʬǥåޤ');
-
-
-// QuickMenu
-define('_SECURITYENFORCER_ADMIN_TOOLTIP',			'SecurityEnforcerץ饰δ');
-define('_SECURITYENFORCER_ADMIN_UNLOCKED',			'åޤбɣХɥ쥹ޤϥ̾ΥåΤ˺ʤǤ');
-define('_SECURITYENFORCER_ADMIN_NONE_LOCKED',		'ʤ');
-
-// ERRORS
-define('_SECURITYENFORCER_INSUFFICIENT_COMPLEXITY',	'Ϥ줿ѥɤϡΥȤ׵ᤵʸޤ϶٤Ƥޤ<br />');
-define('_SECURITYENFORCER_MIN_PWD_LENGTH',			'<br />ѥɤûޤ');
-define('_SECURITYENFORCER_PWD_COMPLEXITY',			'<br />ʸפʤޤ([a-z], [A-Z], [0-9], [-~!@#$%^&*()_+=,.<>?:;|]): ');
-
-// random words
-define('_SECURITYENFORCER_UNLOCK',					'å');
-define('_SECURITYENFORCER_ENTITY',					'ƥƥ');
-define('_SECURITYENFORCER_LOCKED_ENTITIES',			'ߥåΥƥƥ');
-
-// Plugin desc
-define('_SECURITYENFORCER_DESCRIPTION',				'ѥɤκǾʸ䶯٤¡Բǽʤɤꤷޤ');
-
-// Log info
-define('_SECURITYENFORCER_LOGIN_DISALLOWED',		'⡼ȥۥȡ%2$sפΥ̾%1$sפΥSecurityEnforcerץ饰ˤäƵ䤵ޤ');
-
-// QuickMenu title
-define('_SECURITYENFORCER_ADMIN_TITLE',				'SecurityEnforcerץ饰δ');
-
+<?php
+/** Japanese-EUC language file for NP_SECURITYENFORCER Plugin
+*/
+
+// Plugin Options
+define('_SECURITYENFORCER_OPT_QUICKMENU',			'å˥塼ɽޤ');
+define('_SECURITYENFORCER_OPT_DEL_UNINSTALL_DATA',	'󥤥󥹥ȡ˥ǡ١Υơ֥ޤ');
+define('_SECURITYENFORCER_OPT_ENABLE',				'ѥɤȥåSecurityEnforcerͭˤޤ');
+define('_SECURITYENFORCER_OPT_PWD_MIN_LENGTH',		'ѥɤκǾʸ(ǥեȤ8ʸ6ʸ̤ˤϻǤޤ');
+define('_SECURITYENFORCER_OPT_PWD_COMPLEXITY',		'ѥɶ٤Υå(a-z, A-Z, 0-9, Ⱦѵ椫鲿ʸפ¸ߤ٤Ǥ?):');
+//define('_SECURITYENFORCER_OPT_SELECT_OFF_COMP',		'Off');
+//define('_SECURITYENFORCER_OPT_SELECT_ONE_COMP',		'ʸ');
+//define('_SECURITYENFORCER_OPT_SELECT_TWO_COMP',		'ʸ');
+//define('_SECURITYENFORCER_OPT_SELECT_THREE_COMP',	'ʸ');
+//define('_SECURITYENFORCER_OPT_SELECT_FOUR_COMP',	'ͼʸ');
+define('_SECURITYENFORCER_OPT_SELECT',				'|0|1ʸ|1|2ʸ|2|3ʸ|3|4ʸ|4');
+define('_SECURITYENFORCER_OPT_MAX_FAILED_LOGIN',	'ܤΥԤǥȤåޤ');
+define('_SECURITYENFORCER_OPT_LOGIN_LOCKOUT',		'ȤåƤ鲿ʬǥåޤ');
+
+// QuickMenu
+define('_SECURITYENFORCER_ADMIN_TOOLTIP',			'SecurityEnforcerץ饰δ');
+define('_SECURITYENFORCER_ADMIN_UNLOCKED',			'åޤбIPɥ쥹ޤϥ̾ΥåΤ˺ʤǤ');
+define('_SECURITYENFORCER_ADMIN_NONE_LOCKED',		'ʤ');
+
+// ERRORS
+define('_SECURITYENFORCER_ACCOUNT_CREATED',			'ȤϺޤѥɤΥȤ׵ᤵʸޤ϶٤Ƥޤ<br />');
+define('_SECURITYENFORCER_INSUFFICIENT_COMPLEXITY',	'Ϥ줿ѥɤϡΥȤ׵ᤵʸޤ϶٤Ƥޤ<br />');
+define('_SECURITYENFORCER_MIN_PWD_LENGTH',			'<br />Ǿʸ: ');
+define('_SECURITYENFORCER_PWD_COMPLEXITY',			'<br />Ǿʸ׿([a-z], [A-Z], [0-9], [-~!@#$%^&*()_+=,.<>?:;|]): ');
+
+// random words
+define('_SECURITYENFORCER_UNLOCK',					'å');
+define('_SECURITYENFORCER_ENTITY',					'ƥƥ');
+define('_SECURITYENFORCER_LOCKED_ENTITIES',			'ߥåΥƥƥ');
+
+// Plugin desc
+define('_SECURITYENFORCER_DESCRIPTION',				'ѥɤκǾʸ䶯٤¡Բǽʤɤꤷޤ');
+
+// Log info
+define('_SECURITYENFORCER_LOGIN_DISALLOWED',		'SecurityEnforcerˤäƥ󤬵䤵ޤlogin: %1$s, ip: %2$s');
+
+// QuickMenu title
+define('_SECURITYENFORCER_ADMIN_TITLE',				'SecurityEnforcerץ饰δ');
+
 ?>
\ No newline at end of file
diff -x .svn -aruN 3.51.src/nucleus/plugins/securityenforcer/japanese-utf8.php 3.61.src/nucleus/plugins/securityenforcer/japanese-utf8.php
--- 3.51.src/nucleus/plugins/securityenforcer/japanese-utf8.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/plugins/securityenforcer/japanese-utf8.php	2010-12-19 00:16:44.000000000 -0600
@@ -1,44 +1,45 @@
-<?php
-/** English language file for NP_SECURITYENFORCER Plugin
-*/
-
-// Plugin Options
-define('_SECURITYENFORCER_OPT_QUICKMENU',			'クイックメニューに表示しますか？');
-define('_SECURITYENFORCER_OPT_DEL_UNINSTALL_DATA',	'アンインストール時にデータベースのテーブルを削除しますか？');
-define('_SECURITYENFORCER_OPT_ENABLE',				'パスワードのチェックとログインチェックのときにSecurityEnforcerを有効にしますか？');
-define('_SECURITYENFORCER_OPT_PWD_MIN_LENGTH',		'パスワードの最小文字数(デフォルトは8文字。6文字未満には指定できません：');
-define('_SECURITYENFORCER_OPT_PWD_COMPLEXITY',		'パスワード強度のチェック(a-z, A-Z, 0-9, 句読点から何種類の文字タイプが存在するべきですか?):');
-define('_SECURITYENFORCER_OPT_SELECT_OFF_COMP',		'Off');
-define('_SECURITYENFORCER_OPT_SELECT_ONE_COMP',		'一種類の文字タイプ');
-define('_SECURITYENFORCER_OPT_SELECT_TWO_COMP',		'二種類の文字タイプ');
-define('_SECURITYENFORCER_OPT_SELECT_THREE_COMP',	'三種類の文字タイプ');
-define('_SECURITYENFORCER_OPT_SELECT_FOUR_COMP',	'四種類の文字タイプ');
-define('_SECURITYENFORCER_OPT_MAX_FAILED_LOGIN',	'何度目のログイン失敗でアカウントをロックしますか？');
-define('_SECURITYENFORCER_OPT_LOGIN_LOCKOUT',		'アカウントをロックしてから何分でロック解除しますか？');
-
-
-// QuickMenu
-define('_SECURITYENFORCER_ADMIN_TOOLTIP',			'SecurityEnforcerプラグインの管理');
-define('_SECURITYENFORCER_ADMIN_UNLOCKED',			'ロック解除されました。対応するＩＰアドレス、またはログイン名のロックを解除するのを忘れないでください。');
-define('_SECURITYENFORCER_ADMIN_NONE_LOCKED',		'該当なし');
-
-// ERRORS
-define('_SECURITYENFORCER_INSUFFICIENT_COMPLEXITY',	'入力されたパスワードは、このサイトで要求される文字数、または強度を満たしていません。<br />');
-define('_SECURITYENFORCER_MIN_PWD_LENGTH',			'<br />パスワードが短すぎます：');
-define('_SECURITYENFORCER_PWD_COMPLEXITY',			'<br />文字タイプが少なすぎます([a-z], [A-Z], [0-9], [-~!@#$%^&*()_+=,.<>?:;|]): ');
-
-// random words
-define('_SECURITYENFORCER_UNLOCK',					'アンロック');
-define('_SECURITYENFORCER_ENTITY',					'エンティティ');
-define('_SECURITYENFORCER_LOCKED_ENTITIES',			'現在ロック中のエンティティ');
-
-// Plugin desc
-define('_SECURITYENFORCER_DESCRIPTION',				'パスワードの最小文字数や強度の制限、ログイン失敗可能回数などを設定します');
-
-// Log info
-define('_SECURITYENFORCER_LOGIN_DISALLOWED',		'リモートホスト「%2$s」からのログイン名「%1$s」のログインはSecurityEnforcerプラグインによって拒絶されました');
-
-// QuickMenu title
-define('_SECURITYENFORCER_ADMIN_TITLE',				'SecurityEnforcerプラグインの管理');
-
+<?php
+/** Japanese-UTF8 language file for NP_SECURITYENFORCER Plugin
+*/
+
+// Plugin Options
+define('_SECURITYENFORCER_OPT_QUICKMENU',			'クイックメニューに表示しますか？');
+define('_SECURITYENFORCER_OPT_DEL_UNINSTALL_DATA',	'アンインストール時にデータベースのテーブルを削除しますか？');
+define('_SECURITYENFORCER_OPT_ENABLE',				'パスワードとログインチェック時にSecurityEnforcerを有効にしますか？');
+define('_SECURITYENFORCER_OPT_PWD_MIN_LENGTH',		'パスワードの最小文字数(デフォルトは8文字。6文字未満には指定できません：');
+define('_SECURITYENFORCER_OPT_PWD_COMPLEXITY',		'パスワード強度のチェック(a-z, A-Z, 0-9, 半角記号から何種類の文字タイプが存在するべきですか?):');
+//define('_SECURITYENFORCER_OPT_SELECT_OFF_COMP',		'Off');
+//define('_SECURITYENFORCER_OPT_SELECT_ONE_COMP',		'一種類の文字タイプ');
+//define('_SECURITYENFORCER_OPT_SELECT_TWO_COMP',		'二種類の文字タイプ');
+//define('_SECURITYENFORCER_OPT_SELECT_THREE_COMP',	'三種類の文字タイプ');
+//define('_SECURITYENFORCER_OPT_SELECT_FOUR_COMP',	'四種類の文字タイプ');
+define('_SECURITYENFORCER_OPT_SELECT',				'オフ|0|1種類の文字タイプ|1|2種類の文字タイプ|2|3種類の文字タイプ|3|4種類の文字タイプ|4');
+define('_SECURITYENFORCER_OPT_MAX_FAILED_LOGIN',	'何度目のログイン失敗でアカウントをロックしますか？');
+define('_SECURITYENFORCER_OPT_LOGIN_LOCKOUT',		'アカウントをロックしてから何分でロック解除しますか？');
+
+// QuickMenu
+define('_SECURITYENFORCER_ADMIN_TOOLTIP',			'SecurityEnforcerプラグインの管理');
+define('_SECURITYENFORCER_ADMIN_UNLOCKED',			'ロック解除されました。対応するIPアドレス、またはログイン名のロックを解除するのを忘れないでください。');
+define('_SECURITYENFORCER_ADMIN_NONE_LOCKED',		'該当なし');
+
+// ERRORS
+define('_SECURITYENFORCER_ACCOUNT_CREATED',			'アカウントは作成されましたが、パスワードがこのサイトで要求される文字数、または強度を満たしていません。<br />');
+define('_SECURITYENFORCER_INSUFFICIENT_COMPLEXITY',	'入力されたパスワードは、このサイトで要求される文字数、または強度を満たしていません。<br />');
+define('_SECURITYENFORCER_MIN_PWD_LENGTH',			'<br />最小文字数: ');
+define('_SECURITYENFORCER_PWD_COMPLEXITY',			'<br />最小文字タイプ数([a-z], [A-Z], [0-9], [-~!@#$%^&*()_+=,.<>?:;|]): ');
+
+// random words
+define('_SECURITYENFORCER_UNLOCK',					'アンロック');
+define('_SECURITYENFORCER_ENTITY',					'エンティティ');
+define('_SECURITYENFORCER_LOCKED_ENTITIES',			'現在ロック中のエンティティ');
+
+// Plugin desc
+define('_SECURITYENFORCER_DESCRIPTION',				'パスワードの最小文字数や強度の制限、ログイン失敗可能回数などを設定します');
+
+// Log info
+define('_SECURITYENFORCER_LOGIN_DISALLOWED',		'SecurityEnforcerによってログインが拒絶されました。login: %1$s, ip: %2$s');
+
+// QuickMenu title
+define('_SECURITYENFORCER_ADMIN_TITLE',				'SecurityEnforcerプラグインの管理');
+
 ?>
\ No newline at end of file
diff -x .svn -aruN 3.51.src/nucleus/plugins/skinfiles/index.php 3.61.src/nucleus/plugins/skinfiles/index.php
--- 3.51.src/nucleus/plugins/skinfiles/index.php	2010-12-14 08:49:53.000000000 -0600
+++ 3.61.src/nucleus/plugins/skinfiles/index.php	2010-12-19 00:16:44.000000000 -0600
@@ -5,7 +5,7 @@
 	*
 	* Copyright 2005-2007 by Jeff MacMichael and Niels Leenheer
 	*
-	* @version $Id: index.php 1200 2007-09-07 07:06:37Z kimitake $
+	* @version $Id: index.php 1442 2010-06-08 04:59:29Z ehui $
 	* @version $NucleusJP: index.php,v 1.5.2.1 2005/08/25 07:04:13 kimitake Exp $
 	*
 	* ==========================================================================================
@@ -28,7 +28,7 @@
 
  	$strRel = '../../../'; 
 	require($strRel . 'config.php');
-	include($DIR_LIBS . 'PLUGINADMIN.php');
+	include_libs('PLUGINADMIN.php');
 
 	$language = ereg_replace( '[\\|/]', '', getLanguageName());
 	$langfile = $language.'.php';
