diff -ruN 2.4.2-5130fix.src/addentry.php 2.4.3.src/addentry.php
--- 2.4.2-5130fix.src/addentry.php	2006-10-08 20:29:20.000000000 -0500
+++ 2.4.3.src/addentry.php	2008-01-15 08:48:00.000000000 -0600
@@ -26,6 +26,7 @@
     $gb_post->token = (isset($_POST["gb_token"])) ? $_POST["gb_token"] : '';
     $gb_post->gb_captcha = (isset($_POST["gb_captcha"])) ? $_POST["gb_captcha"] : '';
     echo $gb_post->process($_POST["gb_action"]);
+    
 } else {
     echo $gb_post->process();
 }
diff -ruN 2.4.2-5130fix.src/admin/footer.inc.php 2.4.3.src/admin/footer.inc.php
--- 2.4.2-5130fix.src/admin/footer.inc.php	2006-10-08 19:50:16.000000000 -0500
+++ 2.4.3.src/admin/footer.inc.php	2008-01-15 08:48:00.000000000 -0600
@@ -1,3 +1,3 @@
-<center><font face="Arial, Helvetica, sans-serif" color="#CCCCCC" size="1"><b>Advanced Guestbook 2.4.2<br><a href="http://www.proxy2.de" target="_blank"><font color="#CCCCCC">http://www.proxy2.de</font></a></b></font></center>
+<center><font face="Arial, Helvetica, sans-serif" color="#CCCCCC" size="1"><b>Advanced Guestbook 2.4.3<br><a href="http://www.proxy2.de" target="_blank"><font color="#CCCCCC">http://www.proxy2.de</font></a></b></font></center>
 </body>
 </html>
diff -ruN 2.4.2-5130fix.src/admin.php 2.4.3.src/admin.php
--- 2.4.2-5130fix.src/admin.php	2006-10-08 19:59:16.000000000 -0500
+++ 2.4.3.src/admin.php	2008-01-15 08:48:00.000000000 -0600
@@ -1,13 +1,4 @@
 <?php
-$include_path = dirname(__FILE__);
-require_once $include_path."/admin/config.inc.php";
-require_once $include_path."/lib/$DB_CLASS";
-require_once $include_path."/lib/image.class.php";
-require_once $include_path."/lib/template.class.php";
-
-require_once $include_path."/lib/session.class.php";
-require_once $include_path."/lib/admin.class.php";
-
 if (!isset($PHP_SELF)) {
     $PHP_SELF = $_SERVER["PHP_SELF"];
     if (isset($_GET)) {
@@ -21,11 +12,21 @@
         }
     }
     if (isset($_COOKIE)) {
-        while (list($name, $value)=each($_COOKIE)){
+        while (list($name, $value)=each($_COOKIE)) {
             $$name = $value;
         }
     }
 }
+
+$include_path = dirname(__FILE__);
+require_once $include_path."/admin/config.inc.php";
+require_once $include_path."/lib/$DB_CLASS";
+require_once $include_path."/lib/image.class.php";
+require_once $include_path."/lib/template.class.php";
+
+require_once $include_path."/lib/session.class.php";
+require_once $include_path."/lib/admin.class.php";
+
 $gb_auth = new gb_session($include_path);
 $AUTH = $gb_auth->checkSessionID();
 $VARS = $gb_auth->fetch_array($gb_auth->query("SELECT * FROM ".$gb_auth->table['cfg']));
diff -ruN 2.4.2-5130fix.src/doc/changelog.txt 2.4.3.src/doc/changelog.txt
--- 2.4.2-5130fix.src/doc/changelog.txt	2006-10-08 21:47:38.000000000 -0500
+++ 2.4.3.src/doc/changelog.txt	2008-01-15 08:48:00.000000000 -0600
@@ -1,4 +1,10 @@
+Changelog for 2.4.3
+
+- fixed some vulnerabilities when register_globals is turned on
+
 Changelog for 2.4.2
 
 - use PHP's internal font if TTF is not available
 - added CAPTCHA for comments
+
+
diff -ruN 2.4.2-5130fix.src/doc/readme.txt 2.4.3.src/doc/readme.txt
--- 2.4.2-5130fix.src/doc/readme.txt	2006-10-08 21:01:28.000000000 -0500
+++ 2.4.3.src/doc/readme.txt	2008-01-15 08:48:00.000000000 -0600
@@ -1,4 +1,4 @@
-Advanced Guestbook 2.4.2 (PHP/MySQL)
+Advanced Guestbook 2.4.3 (PHP/MySQL)
 Copyright (c) Chi Kien Uong
 URL: http://www.proxy2.de
 
diff -ruN 2.4.2-5130fix.src/doc/translation.txt 2.4.3.src/doc/translation.txt
--- 2.4.2-5130fix.src/doc/translation.txt	1969-12-31 18:00:00.000000000 -0600
+++ 2.4.3.src/doc/translation.txt	2008-01-15 08:48:00.000000000 -0600
@@ -0,0 +1,31 @@
+- arabic.php - sebaie al sayed <sebaie@hotmail.com>
+- turkish.php/codes-turkish.php - aeyStudio <webmaster@aeystudio.com>
+- polish.php/codes-polish.php - Edmund Kawalec <moondee@sjo-perfekt.pl> 
+- dutch.php/codes-dutch.php - R.P. Gutlich" <pgutlich@xs4all.nl>
+- codes-chinese_gb.php - Terry <bd7nq@hellocq.net>
+- chinese_gb.php - Cyber Lee <cyberlee@mail.neiep.edu.cn>
+- codes-srpski.php - Goran Todorov <todorovg@yufestcaffe.com>
+- codes-italian.php - Giorgio Tsiotas <tsiotas@libero.it>
+- french.php/codes-french.php - Marc Cagninacci <marc@phpforums.net>
+- codes-russian.php - Maxim Anashin <max@aug.ru>  
+- spanish.php/codes-spanish.php - Juan R. Pozo - <jrpozo@conclase.net>
+- bulgarian.php/codes-bulgarian.php - Donka Kirqzova <stevevai@abv.bg>
+- italian.php - Carlo Queirolo <carloq@carloq.it>
+- indonesian.php/codes-indonesian.php Oeban Poetih <oeban@poetih.com>
+- bosanski.php/codes-bosanski.php Samir Kobiljak <admin@kobiljak.com>
+- chines_big5.php/codes-chines_big5.php tck <tck@tck.cc>
+- danish.php - Jan Ole Laugesen <laugesen@tommerup.net>
+- slovak.php/codes-slovak.php Ondrej Jombk <nepto@pobox.sk>
+- vietnamese.php - Asian Trails Hanoi <asiantrailshan@hn.vnn.vn>
+- swedish.php/codes-swedish.php - Anders Areskog <birdie@netservice.nu>
+- srpski.php - Dragan Kneevic <tomaja@yuinternet.net>
+- serbian.php - Aleksandar Lukic <aleksandar.lukic@nbj.sv.gov.yu>
+- finnish.php/codes-finnish.php - Porokka Sami <sami.porokka@mmm.fi>
+- French_translation.rar/Light_templates.rar - Alexandre <alexandre0984@hotmail.com>
+- lithuanian.php - Mantas <doofy@bamba.lt>
+- portugues.php/codes-portugues.php - ArmazemWeb Hosting <contato@armazemweb.com>
+- persian.php - Reza Zafarani <Rzafarani@eng.ui.ac.ir>
+- romanian.php/codes-romanian.php - nelu gui <guinelu@yahoo.com>
+- hungarian.php - Grnwald Imre <imre@grunwald.hu>
+- czech.php/codes-czech.php - Roman webmaster <rogy@rogy.cz>
+
diff -ruN 2.4.2-5130fix.src/index.php 2.4.3.src/index.php
--- 2.4.2-5130fix.src/index.php	2006-10-08 19:58:56.000000000 -0500
+++ 2.4.3.src/index.php	2008-01-15 08:48:00.000000000 -0600
@@ -7,78 +7,80 @@
 
 if (IS_MODULE) {
 
-    if (!eregi("modules.php", $_SERVER['PHP_SELF'])) {
-        die ("You can't access this file directly...");
-    }
-    $ModName = basename(dirname( __FILE__ ));
-
-    ob_start();
-    include("header.php");
-
-    $GB_PG["base_url"] .= "/modules/$ModName";
-
-    $GB_SELF = basename($_SERVER['PHP_SELF']);
-    $GB_PG["index"]    = "$GB_SELF?op=modload&name=$ModName&file=index";
-    $GB_PG["admin"]    = "$GB_SELF?op=modload&name=$ModName&file=index&agbook=admin";
-    $GB_PG["comment"]  = "$GB_SELF?op=modload&name=$ModName&file=index&agbook=comment";
-    $GB_PG["addentry"] = "$GB_SELF?op=modload&name=$ModName&file=index&agbook=addentry";
-
-    if (!isset($agbook)) {
-        $agbook = '';
-    }
-
-    switch ($agbook) {
-
-        case "admin":
-            require_once $include_path."/lib/session.class.php";
-            $gb_auth = new gb_session($include_path);
-            $AUTH = $gb_auth->checkSessionID();
-            $VARS = $gb_auth->fetch_array($gb_auth->query("SELECT * FROM ".$gb_auth->table['cfg']));
-            $gb_auth->free_result($gb_auth->result);
-            $template = new gb_template($include_path);
-            if (isset($_COOKIE['lang']) && !empty($_COOKIE['lang'])) {
-                $template->set_lang($_COOKIE['lang']);
-            } else {
-                $template->set_lang($VARS['lang']);
-            }
-            $LANG = $template->get_content();
-            $gb_auth->close_db();
-            $enter_html = "";
-            if (!$AUTH) {
-                $message = (isset($username) || isset($password)) ? $LANG["PassMess2"] : $LANG["PassMess1"];
-                eval("\$enter_html = \"".$template->get_template($GB_TPL['header'])."\";");
-                eval("\$enter_html .= \"".$template->get_template($GB_TPL['adm_enter'])."\";");
-                eval("\$enter_html .= \"".$template->get_template($GB_TPL['footer'])."\";");
-                echo $enter_html;
-            } else {
-                $GB_PG["admin"] = $GB_PG["base_url"]."/admin.php?username=$username&password=$password&enter=1";
-                header("Location: $GB_PG[admin]");
-                exit();
-            }
-            break;
-
-        case "comment":
-            require_once $include_path."/lib/vars.class.php";
-            require_once $include_path."/lib/comment.class.php";
-            $gb_com = new gb_comment($include_path);
-            $gb_com->id = (isset($_GET["gb_id"])) ? $_GET["gb_id"] : '';
-            $gb_com->id = (isset($_POST["gb_id"])) ? $_POST["gb_id"] : $gb_com->id;
-            $gb_com->id = intval($gb_com->id);
-            $gb_com->comment = (isset($_POST["comment"])) ? $_POST["comment"] : '';
-            $gb_com->user = (isset($_POST["gb_user"])) ? $_POST["gb_user"] : '';
-            $gb_com->pass_comment = (isset($_POST["pass_comment"])) ? $_POST["pass_comment"] : '';
-            $gb_action = (isset($_POST["gb_comment"])) ? $_POST["gb_comment"] : '';
-            $gb_com->comment_action($gb_action);
-            $gb_com->db->close_db();
-            break;
-
-        case "addentry":
-            require_once $include_path."/lib/vars.class.php";
-            require_once $include_path."/lib/add.class.php";
-            require_once $include_path."/lib/phrase.class.php";
-            $gb_post = new addentry($include_path);
-            if (isset($_POST["gb_action"])) {
-                $gb_post->name = (isset($_POST["gb_name"])) ? $_POST["gb_name"] : '';
+	if (!eregi("modules.php", $_SERVER['PHP_SELF'])) {
+	    die ("You can't access this file directly...");
+	}
+	
+	$ModName = basename(dirname( __FILE__ ));
+	
+	ob_start();
+	include("header.php");
+	
+	$GB_PG["base_url"] .= "/modules/$ModName";
+	
+	$GB_SELF = basename($_SERVER['PHP_SELF']);
+	$GB_PG["index"]    = "$GB_SELF?op=modload&name=$ModName&file=index";
+	$GB_PG["admin"]    = "$GB_SELF?op=modload&name=$ModName&file=index&agbook=admin";
+	$GB_PG["comment"]  = "$GB_SELF?op=modload&name=$ModName&file=index&agbook=comment";
+	$GB_PG["addentry"] = "$GB_SELF?op=modload&name=$ModName&file=index&agbook=addentry";
+	
+	if (!isset($agbook)) {
+	    $agbook = '';
+	}
+	
+	switch ($agbook) {
+	
+	    case "admin":
+	        require_once $include_path."/lib/session.class.php";
+	        $gb_auth = new gb_session($include_path);
+	        $AUTH = $gb_auth->checkSessionID();
+	        $VARS = $gb_auth->fetch_array($gb_auth->query("SELECT * FROM ".$gb_auth->table['cfg']));
+	        $gb_auth->free_result($gb_auth->result);
+	        $template = new gb_template($include_path);
+	        if (isset($_COOKIE['lang']) && !empty($_COOKIE['lang'])) {
+	            $template->set_lang($_COOKIE['lang']);
+	        } else {
+	            $template->set_lang($VARS['lang']);
+	        }
+	        $LANG = $template->get_content();
+	        $gb_auth->close_db();
+	        $enter_html = "";
+	        if (!$AUTH) {
+	            $message = (isset($username) || isset($password)) ? $LANG["PassMess2"] : $LANG["PassMess1"];
+	            eval("\$enter_html = \"".$template->get_template($GB_TPL['header'])."\";");
+	            eval("\$enter_html .= \"".$template->get_template($GB_TPL['adm_enter'])."\";");
+	            eval("\$enter_html .= \"".$template->get_template($GB_TPL['footer'])."\";");
+	            echo $enter_html;
+	        } else {
+	            $GB_PG["admin"] = $GB_PG["base_url"]."/admin.php?username=$username&password=$password&enter=1";
+	            header("Location: $GB_PG[admin]");
+	            exit();
+	        }
+	        break;
+	
+	    case "comment":
+	        require_once $include_path."/lib/vars.class.php";
+	        require_once $include_path."/lib/comment.class.php";
+	        $gb_com = new gb_comment($include_path);
+	        $gb_com->id = (isset($_GET["gb_id"])) ? $_GET["gb_id"] : '';
+	        $gb_com->id = (isset($_POST["gb_id"])) ? $_POST["gb_id"] : $gb_com->id;
+	        $gb_com->id = intval($gb_com->id);
+	        $gb_com->comment = (isset($_POST["comment"])) ? $_POST["comment"] : '';
+	        $gb_com->user = (isset($_POST["gb_user"])) ? $_POST["gb_user"] : '';
+	        $gb_com->pass_comment = (isset($_POST["pass_comment"])) ? $_POST["pass_comment"] : '';
+	        $gb_com->gb_captcha = (isset($_POST["gb_captcha"])) ? $_POST["gb_captcha"] : '';
+	        $gb_action = (isset($_POST["gb_comment"])) ? $_POST["gb_comment"] : '';
+	        $gb_com->comment_action($gb_action);
+	        $gb_com->db->close_db();
+	        break;
+	
+	    case "addentry":
+	        require_once $include_path."/lib/vars.class.php";
+	        require_once $include_path."/lib/add.class.php";
+	        require_once $include_path."/lib/phrase.class.php";
+	        $gb_post = new addentry($include_path);
+	        if (isset($_POST["gb_action"])) {
+	            $gb_post->name = (isset($_POST["gb_name"])) ? $_POST["gb_name"] : '';
 				$gb_post->email = (isset($_POST["gb_email"])) ? $_POST["gb_email"] : '';
 				$gb_post->url = (isset($_POST["gb_url"])) ? $_POST["gb_url"] : '';
 				$gb_post->comment = (isset($_POST["gb_comment"])) ? $_POST["gb_comment"] : '';
@@ -93,33 +95,35 @@
 				$gb_post->token = (isset($_POST["gb_token"])) ? $_POST["gb_token"] : '';
 				$gb_post->gb_captcha = (isset($_POST["gb_captcha"])) ? $_POST["gb_captcha"] : '';
 				echo $gb_post->process($_POST["gb_action"]);
-            } else {
-                echo $gb_post->process();
-            }
-            $gb_post->db->close_db();
-            break;
-
-        default:
-            require_once $include_path."/lib/vars.class.php";
-            require_once $include_path."/lib/gb.class.php";
-            $gb = new guestbook($include_path);
-            $entry = (isset($_GET["entry"])) ? $_GET["entry"] : 0;
-            $entry = (isset($_POST["entry"])) ? $_POST["entry"] : $entry;
-            echo $gb->show_entries(intval($entry));
-            $gb->db->close_db();
-    }
-    ob_end_flush();
-    $base_path = dirname(dirname($include_path));
-    chdir("$base_path");
-    include("$base_path/footer.php");
+	        } else {
+	            echo $gb_post->process();
+	        }
+	        $gb_post->db->close_db();
+	        break;
+	
+	    default:
+	        require_once $include_path."/lib/vars.class.php";
+	        require_once $include_path."/lib/gb.class.php";
+	        $gb = new guestbook($include_path);
+	        $entry = (isset($_GET["entry"])) ? $_GET["entry"] : 0;
+	        $entry = (isset($_POST["entry"])) ? $_POST["entry"] : $entry;
+	        echo $gb->show_entries(intval($entry));
+	        $gb->db->close_db();
+	}
+	
+	ob_end_flush();
+	$base_path = dirname(dirname($include_path));
+	chdir("$base_path");
+	include("$base_path/footer.php");
 
 } else {
-    require_once $include_path."/lib/vars.class.php";
-    require_once $include_path."/lib/gb.class.php";
-    $gb = new guestbook($include_path);
-    $entry = (isset($_GET["entry"])) ? $_GET["entry"] : 0;
-    $entry = (isset($_POST["entry"])) ? $_POST["entry"] : $entry;
-    echo $gb->show_entries(intval($entry));
+
+	require_once $include_path."/lib/vars.class.php";
+	require_once $include_path."/lib/gb.class.php";
+	$gb = new guestbook($include_path);
+	$entry = (isset($_GET["entry"])) ? $_GET["entry"] : 0;
+	$entry = (isset($_POST["entry"])) ? $_POST["entry"] : $entry;
+	echo $gb->show_entries(intval($entry));
 }
 
 ?>
\ No newline at end of file
diff -ruN 2.4.2-5130fix.src/lang/smilies.inc 2.4.3.src/lang/smilies.inc
--- 2.4.2-5130fix.src/lang/smilies.inc	2001-12-16 21:48:06.000000000 -0600
+++ 2.4.3.src/lang/smilies.inc	2008-01-15 08:48:00.000000000 -0600
@@ -1,6 +1,6 @@
 <?php
-include ("../admin/config.inc.php");
-include ("../lib/mysql.class.php");
+require_once ("../admin/config.inc.php");
+require_once ("../lib/mysql.class.php");
 
 $smilies = new gbook_sql();
 $smilies->connect();
diff -ruN 2.4.2-5130fix.src/lang/translation.txt 2.4.3.src/lang/translation.txt
--- 2.4.2-5130fix.src/lang/translation.txt	2005-05-09 10:53:02.000000000 -0500
+++ 2.4.3.src/lang/translation.txt	1969-12-31 18:00:00.000000000 -0600
@@ -1,31 +0,0 @@
-- arabic.php - sebaie al sayed <sebaie@hotmail.com>
-- turkish.php/codes-turkish.php - aeyStudio <webmaster@aeystudio.com>
-- polish.php/codes-polish.php - Edmund Kawalec <moondee@sjo-perfekt.pl> 
-- dutch.php/codes-dutch.php - R.P. Gutlich" <pgutlich@xs4all.nl>
-- codes-chinese_gb.php - Terry <bd7nq@hellocq.net>
-- chinese_gb.php - Cyber Lee <cyberlee@mail.neiep.edu.cn>
-- codes-srpski.php - Goran Todorov <todorovg@yufestcaffe.com>
-- codes-italian.php - Giorgio Tsiotas <tsiotas@libero.it>
-- french.php/codes-french.php - Marc Cagninacci <marc@phpforums.net>
-- codes-russian.php - Maxim Anashin <max@aug.ru>  
-- spanish.php/codes-spanish.php - Juan R. Pozo - <jrpozo@conclase.net>
-- bulgarian.php/codes-bulgarian.php - Donka Kirqzova <stevevai@abv.bg>
-- italian.php - Carlo Queirolo <carloq@carloq.it>
-- indonesian.php/codes-indonesian.php Oeban Poetih <oeban@poetih.com>
-- bosanski.php/codes-bosanski.php Samir Kobiljak <admin@kobiljak.com>
-- chines_big5.php/codes-chines_big5.php tck <tck@tck.cc>
-- danish.php - Jan Ole Laugesen <laugesen@tommerup.net>
-- slovak.php/codes-slovak.php Ondrej Jombk <nepto@pobox.sk>
-- vietnamese.php - Asian Trails Hanoi <asiantrailshan@hn.vnn.vn>
-- swedish.php/codes-swedish.php - Anders Areskog <birdie@netservice.nu>
-- srpski.php - Dragan Kneevic <tomaja@yuinternet.net>
-- serbian.php - Aleksandar Lukic <aleksandar.lukic@nbj.sv.gov.yu>
-- finnish.php/codes-finnish.php - Porokka Sami <sami.porokka@mmm.fi>
-- French_translation.rar/Light_templates.rar - Alexandre <alexandre0984@hotmail.com>
-- lithuanian.php - Mantas <doofy@bamba.lt>
-- portugues.php/codes-portugues.php - ArmazemWeb Hosting <contato@armazemweb.com>
-- persian.php - Reza Zafarani <Rzafarani@eng.ui.ac.ir>
-- romanian.php/codes-romanian.php - nelu gui <guinelu@yahoo.com>
-- hungarian.php - Grnwald Imre <imre@grunwald.hu>
-- czech.php/codes-czech.php - Roman webmaster <rogy@rogy.cz>
-
diff -ruN 2.4.2-5130fix.src/lib/add.class.php 2.4.3.src/lib/add.class.php
--- 2.4.2-5130fix.src/lib/add.class.php	2006-10-08 20:33:10.000000000 -0500
+++ 2.4.3.src/lib/add.class.php	2008-01-15 08:48:00.000000000 -0600
@@ -1,7 +1,7 @@
 <?php
 /**
  * ----------------------------------------------
- * Advanced Guestbook 2.4.2 (PHP/MySQL)
+ * Advanced Guestbook 2.4.3 (PHP/MySQL)
  * Copyright (c) Chi Kien Uong
  * URL: http://www.proxy2.de
  * ----------------------------------------------
@@ -31,6 +31,21 @@
     var $image_tag = '';
     var $GB_TPL = array();
     var $table = array();
+    var $illegalChars = array(
+			"?"  => "",
+			"\\" => "",
+			":"  => "",
+			"*"  => "",
+			"\"" => "",
+			"<"  => "",
+			">"  => "",
+			"|"  => "",
+			"../"=> "",
+			"./" => "",
+			"\n" => "",
+			"\r" => "",
+			"\t" => ""
+	);
 
     function addentry($path='') {
         global $GB_TPL, $GB_TBL, $_SERVER;
@@ -112,6 +127,16 @@
 		return $token;
 	}
 
+	function getLanguageFile($language) {
+		$language = trim(strtr($language, $this->illegalChars));
+    	$language = str_replace("codes-", "", $language);
+    	if (!empty($language) && is_file("$this->include_path/lang/$language.php")) {
+            return $language;
+        } else {
+            return "english";
+        }
+	}
+
     function check_entry($type='') {
         global $GB_UPLOAD, $GB_TMP, $GB_PG;
         $this->db->VARS["max_img_size"] = $this->db->VARS["max_img_size"]*1024;
@@ -346,8 +371,9 @@
             eval("\$OPTIONS['img'] = \"".$this->template->get_template($this->GB_TPL['frm_image'])."\";");
         }
         $OPTIONAL = implode("\n",$OPTIONS);
-        if (isset($_COOKIE['lang']) && !empty($_COOKIE['lang']) && file_exists("$this->include_path/lang/codes-".$_COOKIE['lang'].".php")) {
-            $LANG_CODES = "$GB_PG[base_url]/lang/codes-".$_COOKIE['lang'].".php";
+        if (isset($_COOKIE['lang'])) {
+        	$lang = $this->getLanguageFile($_COOKIE['lang']);
+           	$LANG_CODES = "$GB_PG[base_url]/lang/codes-".$lang.".php";
         } elseif (file_exists("$this->include_path/lang/codes-".$VARS['lang'].".php")) {
             $LANG_CODES = "$GB_PG[base_url]/lang/codes-".$VARS['lang'].".php";
         } else {
diff -ruN 2.4.2-5130fix.src/lib/admin.class.php 2.4.3.src/lib/admin.class.php
--- 2.4.2-5130fix.src/lib/admin.class.php	2006-10-08 19:48:30.000000000 -0500
+++ 2.4.3.src/lib/admin.class.php	2008-01-15 08:48:00.000000000 -0600
@@ -1,7 +1,7 @@
 <?php
 /**
  * ----------------------------------------------
- * Advanced Guestbook 2.4.2 (PHP/MySQL)
+ * Advanced Guestbook 2.4.3 (PHP/MySQL)
  * Copyright (c) Chi Kien Uong
  * URL: http://www.proxy2.de
  * ----------------------------------------------
diff -ruN 2.4.2-5130fix.src/lib/bitmapimagetext.class.php 2.4.3.src/lib/bitmapimagetext.class.php
--- 2.4.2-5130fix.src/lib/bitmapimagetext.class.php	2006-10-08 19:48:26.000000000 -0500
+++ 2.4.3.src/lib/bitmapimagetext.class.php	2008-01-15 08:48:00.000000000 -0600
@@ -1,7 +1,7 @@
 <?php
 /**
  * ----------------------------------------------
- * Advanced Guestbook 2.4.2 (PHP/MySQL)
+ * Advanced Guestbook 2.4.3 (PHP/MySQL)
  * Copyright (c) Chi Kien Uong
  * URL: http://www.proxy2.de
  * ----------------------------------------------
diff -ruN 2.4.2-5130fix.src/lib/captcha.class.php 2.4.3.src/lib/captcha.class.php
--- 2.4.2-5130fix.src/lib/captcha.class.php	2006-10-08 21:35:32.000000000 -0500
+++ 2.4.3.src/lib/captcha.class.php	2008-01-15 08:48:00.000000000 -0600
@@ -1,7 +1,7 @@
 <?php
 /**
  * ----------------------------------------------
- * Advanced Guestbook 2.4.2 (PHP/MySQL)
+ * Advanced Guestbook 2.4.3 (PHP/MySQL)
  * Copyright (c) Chi Kien Uong
  * URL: http://www.proxy2.de
  * ----------------------------------------------
@@ -249,28 +249,28 @@
 		switch ($type) {
 			case "jpeg":
 			case "jpg":
-				if ($this->supportedImagesTypes['jpg'] == true) {
+				if (isset($this->supportedImagesTypes['jpg'])) {
 					imagejpeg($this->imgRes, $filename);
 					$retVal = $filename;
 				}
 				break;
 
 			case "png":
-				if ($this->supportedImagesTypes['png'] == true) {
+				if (isset($this->supportedImagesTypes['png'])) {
 					imagepng($this->imgRes, $filename);
 					$retVal = $filename;
 				}
 				break;
 
 			case "gif":
-				if ($this->supportedImagesTypes['gif'] == true) {
+				if (isset($this->supportedImagesTypes['gif'])) {
 					imagegif($this->imgRes, $filename);
 					$retVal = $filename;
 				}
 				break;
 
 			default:
-				if ($this->supportedImagesTypes['png'] == true) {
+				if (isset($this->supportedImagesTypes['png'])) {
 					imagepng($this->imgRes, $filename);
 					$retVal = $filename;
 				}
@@ -288,28 +288,28 @@
 				switch ($type) {
 					case "jpeg":
 					case "jpg":
-						if ($this->supportedImagesTypes['jpg'] == true) {
+						if (isset($this->supportedImagesTypes['jpg'])) {
 							header("Content-Type: image/jpeg");
 							imagejpeg($this->imgRes);
 						}
 						break;
 
 					case "png":
-						if ($this->supportedImagesTypes['png'] == true) {
+						if (isset($this->supportedImagesTypes['png'])) {
 							header("Content-Type: image/png");
 							imagepng($this->imgRes);
 						}
 						break;
 
 					case "gif":
-						if ($this->supportedImagesTypes['gif'] == true) {
+						if (isset($this->supportedImagesTypes['gif'])) {
 							header("Content-Type: image/gif");
 							imagegif($this->imgRes);
 						}
 						break;
 
 					default:
-						if ($this->supportedImagesTypes['png'] == true) {
+						if (isset($this->supportedImagesTypes['png'])) {
 							header("Content-Type: image/png");
 							imagepng($this->imgRes);
 						}
@@ -354,9 +354,15 @@
 		if (count($this->supportedImagesTypes)>0) {
 			return $this->supportedImagesTypes;
 		}
-		$this->supportedImagesTypes['png'] = (imagetypes() & IMG_PNG) ? true : false;
-		$this->supportedImagesTypes['gif'] = (imagetypes() & IMG_GIF) ? true : false;
-		$this->supportedImagesTypes['jpg'] = (imagetypes() & IMG_JPG) ? true : false;
+		if (imagetypes() & IMG_JPG) {
+			$this->supportedImagesTypes['jpg'] = true;
+		}	
+		if (imagetypes() & IMG_GIF) {
+			$this->supportedImagesTypes['gif'] = true;
+		}
+		if (imagetypes() & IMG_PNG) {
+			$this->supportedImagesTypes['png'] = true;
+		}
 		return $this->supportedImagesTypes;
 	}
 
@@ -409,8 +415,8 @@
 	}
 
 	function getTextLengthStr() {
-		$textLenght = strlen($this->text);
-		return ($textLenght * 13);
+		$textLength = strlen($this->text);
+		return ($textLength * 13);
 	}
 
 	function getTextHeightStr() {
diff -ruN 2.4.2-5130fix.src/lib/comment.class.php 2.4.3.src/lib/comment.class.php
--- 2.4.2-5130fix.src/lib/comment.class.php	2006-10-08 21:40:32.000000000 -0500
+++ 2.4.3.src/lib/comment.class.php	2008-01-15 08:48:00.000000000 -0600
@@ -1,7 +1,7 @@
 <?php
 /**
  * ----------------------------------------------
- * Advanced Guestbook 2.4.2 (PHP/MySQL)
+ * Advanced Guestbook 2.4.3 (PHP/MySQL)
  * Copyright (c) Chi Kien Uong
  * URL: http://www.proxy2.de
  * ----------------------------------------------
diff -ruN 2.4.2-5130fix.src/lib/gb.class.php 2.4.3.src/lib/gb.class.php
--- 2.4.2-5130fix.src/lib/gb.class.php	2006-10-08 19:48:14.000000000 -0500
+++ 2.4.3.src/lib/gb.class.php	2008-01-15 08:48:00.000000000 -0600
@@ -1,7 +1,7 @@
 <?php
 /**
  * ----------------------------------------------
- * Advanced Guestbook 2.4.2 (PHP/MySQL)
+ * Advanced Guestbook 2.4.3 (PHP/MySQL)
  * Copyright (c) Chi Kien Uong
  * URL: http://www.proxy2.de
  * ----------------------------------------------
diff -ruN 2.4.2-5130fix.src/lib/image.class.php 2.4.3.src/lib/image.class.php
--- 2.4.2-5130fix.src/lib/image.class.php	2006-10-08 19:47:50.000000000 -0500
+++ 2.4.3.src/lib/image.class.php	2008-01-15 08:48:00.000000000 -0600
@@ -1,7 +1,7 @@
 <?php
 /**
  * ----------------------------------------------
- * Advanced Guestbook 2.4.2 (PHP/MySQL)
+ * Advanced Guestbook 2.4.3 (PHP/MySQL)
  * Copyright (c) Chi Kien Uong
  * URL: http://www.proxy2.de
  * ----------------------------------------------
diff -ruN 2.4.2-5130fix.src/lib/mysql.class.php 2.4.3.src/lib/mysql.class.php
--- 2.4.2-5130fix.src/lib/mysql.class.php	2006-10-08 19:47:20.000000000 -0500
+++ 2.4.3.src/lib/mysql.class.php	2008-01-15 08:48:00.000000000 -0600
@@ -1,7 +1,7 @@
 <?php
 /**
  * ----------------------------------------------
- * Advanced Guestbook 2.4.2 (PHP/MySQL)
+ * Advanced Guestbook 2.4.3 (PHP/MySQL)
  * Copyright (c) Chi Kien Uong
  * URL: http://www.proxy2.de
  * ----------------------------------------------
diff -ruN 2.4.2-5130fix.src/lib/phrase.class.php 2.4.3.src/lib/phrase.class.php
--- 2.4.2-5130fix.src/lib/phrase.class.php	2006-10-08 19:46:58.000000000 -0500
+++ 2.4.3.src/lib/phrase.class.php	2008-01-15 08:48:00.000000000 -0600
@@ -1,7 +1,7 @@
 <?php
 /**
  * ----------------------------------------------
- * Advanced Guestbook 2.4.2 (PHP/MySQL)
+ * Advanced Guestbook 2.4.3 (PHP/MySQL)
  * Copyright (c) Chi Kien Uong
  * URL: http://www.proxy2.de
  * ----------------------------------------------
diff -ruN 2.4.2-5130fix.src/lib/session.class.php 2.4.3.src/lib/session.class.php
--- 2.4.2-5130fix.src/lib/session.class.php	2006-10-08 19:46:40.000000000 -0500
+++ 2.4.3.src/lib/session.class.php	2008-01-15 08:48:00.000000000 -0600
@@ -1,7 +1,7 @@
 <?php
 /**
  * ----------------------------------------------
- * Advanced Guestbook 2.4.2 (PHP/MySQL)
+ * Advanced Guestbook 2.4.3 (PHP/MySQL)
  * Copyright (c) Chi Kien Uong
  * URL: http://www.proxy2.de
  * ----------------------------------------------
diff -ruN 2.4.2-5130fix.src/lib/template.class.php 2.4.3.src/lib/template.class.php
--- 2.4.2-5130fix.src/lib/template.class.php	2006-10-08 19:45:56.000000000 -0500
+++ 2.4.3.src/lib/template.class.php	2008-01-15 08:48:00.000000000 -0600
@@ -1,7 +1,7 @@
 <?php
 /**
  * ----------------------------------------------
- * Advanced Guestbook 2.4.2 (PHP/MySQL)
+ * Advanced Guestbook 2.4.3 (PHP/MySQL)
  * Copyright (c) Chi Kien Uong
  * URL: http://www.proxy2.de
  * ----------------------------------------------
@@ -13,9 +13,28 @@
     var $root_dir;
     var $LANG;
     var $plain_html = array();
+    var $illegalChars = array(
+			"?"  => "",
+			"\\" => "",
+			":"  => "",
+			"*"  => "",
+			"\"" => "",
+			"<"  => "",
+			">"  => "",
+			"|"  => "",
+			"../"=> "",
+			"./" => "",
+			"\n" => "",
+			"\r" => "",
+			"\t" => ""
+	);
 
     function gb_template($path='') {
-        $this->root_dir = $path;
+        if ($path != "" && is_dir($path)) {
+        	$this->root_dir = $path;
+        } else {
+        	$this->root_dir = dirname(dirname(__FILE__));
+    	}
     }
 
     function set_rootdir($tpl_dir) {
@@ -27,7 +46,9 @@
     }
 
     function set_lang($language='') {
-        if (!empty($language) && file_exists("$this->root_dir/lang/$language.php")) {
+    	$language = trim(strtr($language, $this->illegalChars));
+    	$language = str_replace("codes-", "", $language);
+        if (!empty($language) && is_file("$this->root_dir/lang/$language.php")) {
             $this->language = $language;
         } else {
             $this->language = "english";
@@ -37,7 +58,9 @@
 
     function get_content() {
         if (!isset($this->LANG)) {
-            include "$this->root_dir/lang/".$this->language.".php";
+            if (is_file("$this->root_dir/lang/".$this->language.".php")) {
+            	include "$this->root_dir/lang/".$this->language.".php";
+            }
             $this->LANG = &$LANG;
             $this->WEEKDAY = &$weekday;
             $this->MONTHS = &$months;
@@ -48,7 +71,7 @@
     function get_template($tpl) {
         if (!isset($this->template[$tpl])) {
             $filename = "$this->root_dir/templates/$tpl";
-            if (file_exists("$filename") && filesize("$filename")>0) {
+            if (is_file("$filename") && filesize("$filename")>0) {
                 $fd = fopen ($filename, "r");
                 $this->template[$tpl] = fread ($fd, filesize ($filename));
                 fclose ($fd);
diff -ruN 2.4.2-5130fix.src/lib/vars.class.php 2.4.3.src/lib/vars.class.php
--- 2.4.2-5130fix.src/lib/vars.class.php	2006-10-08 19:48:34.000000000 -0500
+++ 2.4.3.src/lib/vars.class.php	2008-01-15 08:48:00.000000000 -0600
@@ -1,7 +1,7 @@
 <?php
 /**
  * ----------------------------------------------
- * Advanced Guestbook 2.4.2 (PHP/MySQL)
+ * Advanced Guestbook 2.4.3 (PHP/MySQL)
  * Copyright (c) Chi Kien Uong
  * URL: http://www.proxy2.de
  * ----------------------------------------------
diff -ruN 2.4.2-5130fix.src/misc/update_db.php 2.4.3.src/misc/update_db.php
--- 2.4.2-5130fix.src/misc/update_db.php	2006-10-08 19:48:56.000000000 -0500
+++ 2.4.3.src/misc/update_db.php	2008-01-15 08:48:00.000000000 -0600
@@ -31,6 +31,7 @@
 $sqlquery[] = "ALTER TABLE `{$GB_TBL['data']}` CHANGE `location` `location` VARCHAR(100) DEFAULT NULL";
 $sqlquery[] = "ALTER TABLE `{$GB_TBL['priv']}` CHANGE `location` `location` VARCHAR(100) DEFAULT NULL";
 $sqlquery[] = "ALTER TABLE `{$GB_TBL['com']}` CHANGE `host` `host` VARCHAR(255) DEFAULT NULL";
+$sqlquery[] = "ALTER TABLE `{$GB_TBL['com']}` ADD INDEX (`id`)";
 
 $sqlquery[] = "CREATE TABLE {$GB_TBL['cap']} (
 	session_id char(32) DEFAULT '' NOT NULL,
@@ -45,7 +46,7 @@
 $result = $db->fetch_array($res);
 
 if ($result == false) {
-	echo "Updating db from 2.3.x to 2.4.2 \n\n";
+	echo "Updating db from 2.3.x to 2.4.3 \n\n";
 	for ($i=0; $i<count($sqlquery); $i++) {
 		$db->query($sqlquery[$i]);
 		echo " - $sqlquery[$i]\n";
diff -ruN 2.4.2-5130fix.src/picture.php 2.4.3.src/picture.php
--- 2.4.2-5130fix.src/picture.php	2006-10-08 19:59:58.000000000 -0500
+++ 2.4.3.src/picture.php	2008-01-15 08:48:00.000000000 -0600
@@ -2,21 +2,45 @@
 $include_path = dirname(__FILE__);
 require_once $include_path."/admin/config.inc.php";
 
+function stripChars($imgFile) {
+	$illegalChars = array(
+			"?"  => "",
+			"\\" => "",
+			":"  => "",
+			"*"  => "",
+			"\"" => "",
+			"<"  => "",
+			">"  => "",
+			"|"  => "",
+			"../"=> "",
+			"./" => "",
+			"\n" => "",
+			"\r" => "",
+			"\t" => ""
+	);
+	return trim(strtr($imgFile, $illegalChars));
+}
+
 $border = 18;
+$size = array();
+$picture = "";
 
 if (isset($_GET['img'])) {
-    if (is_file("$include_path/$GB_TMP/$_GET[img]")) {
-        $size = GetImageSize("$GB_TMP/$_GET[img]");
+    $imgFile = stripChars($_GET['img']);
+    if (!empty($imgFile) && is_file("$include_path/$GB_TMP/$imgFile")) {
+        $size = GetImageSize("$include_path/$GB_TMP/$imgFile");
         $picture = "$GB_PG[base_url]/$GB_TMP/$_GET[img]";
-    }
-    if (is_file("$include_path/$GB_UPLOAD/$_GET[img]")) {
-        if (eregi("(^t_)(img-[0-9]+.[a-z]{3})",$_GET['img'],$regs)) {
-            $size = GetImageSize("$GB_UPLOAD/$regs[2]");
-            $picture = "$GB_PG[base_url]/$GB_UPLOAD/$regs[2]";
-        } else {
-            $size = GetImageSize("$GB_UPLOAD/$_GET[img]");
-            $picture = "$GB_PG[base_url]/$GB_UPLOAD/$_GET[img]";
-        }
+    } else {
+    	$imgFile = stripChars($_GET['img']);
+    	if (!empty($imgFile) && is_file("$include_path/$GB_UPLOAD/$imgFile")) {
+    	    if (eregi("(^t_)(img-[0-9]+.[a-z]{3})", $imgFile, $regs)) {
+    	        $size = GetImageSize("$include_path/$GB_UPLOAD/$regs[2]");
+    	        $picture = "$GB_PG[base_url]/$GB_UPLOAD/$regs[2]";
+    	    } else {
+    	        $size = GetImageSize("$include_path/$GB_UPLOAD/$_GET[img]");
+    	        $picture = "$GB_PG[base_url]/$GB_UPLOAD/$imgFile";
+    	    }
+    	}
     }
 }
 if (isset($size[1]) && $size[1]>100) {
@@ -26,17 +50,18 @@
 	$tbl_height = 100;
 	$tbl_width = 100+$border;
 }
+
 ?>
 <html>
 <head>
 <title>Guestbook</title>
 </head>
-<body bgcolor="#CCCCCC" text="#000000" leftmargin="0" topmargin="0" marginwidth="0" marginheight="0">
+<body bgcolor="#CCCCCC" topmargin="0">
 <table width="<?php echo $tbl_width; ?>" border="0" cellspacing="0" cellpadding="0" height="<?php echo $tbl_height; ?>">
   <tr>
-    <td align="center" valign="middle">
+    <td>
     <?php
-        if (isset($_GET['img']) && is_array($size)) {
+        if (!empty($picture)) {
             echo "<a href=\"javascript:window.close()\"><img src=\"$picture\" width=\"$size[0]\" height=\"$size[1]\" border=\"0\"></a>\n";
         }
     ?>
diff -ruN 2.4.2-5130fix.src/public/index.html 2.4.3.src/public/index.html
--- 2.4.2-5130fix.src/public/index.html	2006-10-08 21:11:14.000000000 -0500
+++ 2.4.3.src/public/index.html	1969-12-31 18:00:00.000000000 -0600
@@ -1 +0,0 @@
-<html></html>
\ No newline at end of file
diff -ruN 2.4.2-5130fix.src/templates/footer.php 2.4.3.src/templates/footer.php
--- 2.4.2-5130fix.src/templates/footer.php	2006-10-08 19:54:32.000000000 -0500
+++ 2.4.3.src/templates/footer.php	2008-01-15 08:48:00.000000000 -0600
@@ -1,3 +1,3 @@
-<center><b><font face="Arial, Helvetica, sans-serif" color="#CCCCCC" size="1"><a href="http://www.proxy2.de" target="_blank"><font color="#CCCCCC" size="1">Advanced Guestbook 2.4.2</font></a></font></b></center>
+<center><b><font face="Arial, Helvetica, sans-serif" color="#CCCCCC" size="1"><a href="http://www.proxy2.de" target="_blank"><font color="#CCCCCC" size="1">Advanced Guestbook 2.4.3</font></a></font></b></center>
 </body>
 </html>
