Merge commit 'release-3.0-RC6'

phpBB/adm/index.php

@@ -1,10 +1,10 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
@@ -42,7 +42,7 @@ if (!$auth->acl_get('a_'))
 
 // We define the admin variables now, because the user is now able to use the admin related features...
 define('IN_ADMIN', true);
-$phpbb_admin_path = './';
+$phpbb_admin_path = (defined('PHPBB_ADMIN_PATH')) ? PHPBB_ADMIN_PATH : './';
 
 // Some oft used variables
 $safe_mode		= (@ini_get('safe_mode') || @strtolower(ini_get('safe_mode')) == 'on') ? true : false;
@@ -204,11 +204,7 @@ function adm_page_footer($copyright_html = true)
 	$template->display('body');
 
 	garbage_collection();
-
+	exit_handler();
-	if (!defined('PHPBB_EMBEDDED'))
-	{
-		exit;
-	}
 }
 
 /**
@@ -280,7 +276,7 @@ function build_cfg_template($tpl_type, $key, &$new, $config_key, $vars)
 			$size = (int) $tpl_type[1];
 			$maxlength = (int) $tpl_type[2];
 
-			$tpl = '<input id="' . $key . '" type="text"' . (($size) ? ' size="' . $size . '"' : '') . ' maxlength="' . (($maxlength) ? $maxlength : 255) . '" name="config[' . $config_key . '_height]" value="' . $new[$config_key . '_height'] . '" /> x <input type="text"' . (($size) ? ' size="' . $size . '"' : '') . ' maxlength="' . (($maxlength) ? $maxlength : 255) . '" name="config[' . $config_key . '_width]" value="' . $new[$config_key . '_width'] . '" />';
+			$tpl = '<input id="' . $key . '" type="text"' . (($size) ? ' size="' . $size . '"' : '') . ' maxlength="' . (($maxlength) ? $maxlength : 255) . '" name="config[' . $config_key . '_width]" value="' . $new[$config_key . '_width'] . '" /> x <input type="text"' . (($size) ? ' size="' . $size . '"' : '') . ' maxlength="' . (($maxlength) ? $maxlength : 255) . '" name="config[' . $config_key . '_height]" value="' . $new[$config_key . '_height'] . '" />';
 		break;
 
 		case 'textarea':

phpBB/adm/style/acp_attachments.html

@@ -16,7 +16,7 @@
 		<p>{WARNING_MSG}</p>
 	</div>
 <!-- ENDIF -->
-	
+
 <!-- IF S_NOTIFY -->
 	<div class="successbox">
 		<h3>{L_NOTIFY}</h3>
@@ -110,15 +110,14 @@
 		<p>{L_NO_IPS_DEFINED}</p>
 	<!-- ENDIF -->
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSEIF S_EXTENSION_GROUPS -->
 
 	<!-- IF S_EDIT_GROUP -->
 		<script type="text/javascript" defer="defer">
-		<!--
+		// <![CDATA[
-
 			function update_image(newimage)
 			{
 				if (newimage == 'no_image')
@@ -163,7 +162,7 @@
 				}
 			}
 
-		//-->
+		// ]]>
 		</script>
 
 		<form id="extgroups" method="post" action="{U_ACTION}">
@@ -217,7 +216,7 @@
 		</p>
 
 		</fieldset>
-
+		{S_FORM_TOKEN}
 		</form>
 	<!-- ELSE -->
 
@@ -255,10 +254,11 @@
 		</tbody>
 		</table>
 		<p class="quick">
-				{L_CREATE_GROUP}: <input type="text" name="group_name" maxlength="30" /> 
+				{L_CREATE_GROUP}: <input type="text" name="group_name" maxlength="30" />
 				<input class="button2" name="add" type="submit" value="{L_SUBMIT}" />
 		</p>
 		</fieldset>
+		{S_FORM_TOKEN}
 		</form>
 
 	<!-- ENDIF -->
@@ -281,9 +281,9 @@
 		<input type="submit" id="add_extension_check" name="add_extension_check" class="button2" value="{L_SUBMIT}" />
 	</p>
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
-	
+
 	<br />
 
 	<form id="change_ext" method="post" action="{U_ACTION}">
@@ -307,7 +307,7 @@
 			<td class="spacer" colspan="3">&nbsp;</td>
 		</tr>
 		<!-- ENDIF -->
-		<tr> 
+		<tr>
 			<td><strong>{extensions.EXTENSION}</strong></td>
 			<td>{extensions.GROUP_OPTIONS}</td>
 			<td><input type="checkbox" class="radio" name="extension_id_list[]" value="{extensions.EXTENSION_ID}" /><input type="hidden" name="extension_change_list[]" value="{extensions.EXTENSION_ID}" /></td>
@@ -321,7 +321,7 @@
 		<input class="button2" type="reset" id="reset" name="reset" value="{L_RESET}" />
 	</p>
 	</fieldset>
-	
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSEIF S_ORPHAN -->
@@ -369,7 +369,7 @@
 	</p>
 
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ENDIF -->

phpBB/adm/style/acp_ban.html

@@ -9,24 +9,24 @@
 <p>{L_EXPLAIN}</p>
 
 <script type="text/javascript">
-<!--
+// <![CDATA[
 
 	var ban_length = new Array();
 		ban_length[-1] = '';
 	<!-- BEGIN ban_length -->
-		ban_length['{ban_length.BAN_ID}'] = "{ban_length.A_LENGTH}";
+		ban_length['{ban_length.BAN_ID}'] = '{ban_length.A_LENGTH}';
 	<!-- END ban_length -->
 
 	var ban_reason = new Array();
 		ban_reason[-1] = '';
 	<!-- BEGIN ban_reason -->
-		ban_reason['{ban_reason.BAN_ID}'] = "{ban_reason.A_REASON}";
+		ban_reason['{ban_reason.BAN_ID}'] = '{ban_reason.A_REASON}';
 	<!-- END ban_reason -->
 
 	var ban_give_reason = new Array();
 		ban_give_reason[-1] = '';
 	<!-- BEGIN ban_give_reason -->
-		ban_give_reason['{ban_give_reason.BAN_ID}'] = "{ban_give_reason.A_REASON}";
+		ban_give_reason['{ban_give_reason.BAN_ID}'] = '{ban_give_reason.A_REASON}';
 	<!-- END ban_give_reason -->
 
 	function display_details(option)
@@ -36,7 +36,7 @@
 		document.getElementById('acp_unban').unbanlength.value = ban_length[option];
 	}
 
-//-->
+// ]]>
 </script>
 
 <form id="acp_ban" method="post" action="{U_ACTION}">
@@ -46,7 +46,7 @@
 <dl>
 	<dt><label for="ban">{L_BAN_CELL}:</label></dt>
 	<dd><textarea name="ban" cols="40" rows="3" id="ban"></textarea></dd>
-	<!-- IF S_USERNAME_BAN --><dd>[ <a href="#" onclick="window.open('{U_FIND_USER}', '_phpbbsearch', 'height=500, resizable=yes, scrollbars=yes, width=740'); return false;">{L_FIND_USERNAME}</a> ]</dd><!-- ENDIF -->
+	<!-- IF S_USERNAME_BAN --><dd>[ <a href="{U_FIND_USERNAME}" onclick="find_username(this.href); return false;">{L_FIND_USERNAME}</a> ]</dd><!-- ENDIF -->
 </dl>
 <dl>
 	<dt><label for="banlength">{L_BAN_LENGTH}:</label></dt>

phpBB/adm/style/acp_bbcodes.html

@@ -77,7 +77,7 @@
 	<!-- END token -->
 	</tbody>
 	</table>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSE -->
@@ -111,7 +111,7 @@
 		<input class="button2" name="submit" type="submit" value="{L_ADD_BBCODE}" />
 	</p>
 	</fieldset>
-
+{S_FORM_TOKEN}
 	</form>
 
 <!-- ENDIF -->

phpBB/adm/style/acp_board.html

@@ -45,6 +45,7 @@
 
 </fieldset>
 
+{S_FORM_TOKEN}
 </form>
 
 <!-- INCLUDE overall_footer.html -->

phpBB/adm/style/acp_bots.html

@@ -51,7 +51,7 @@
 		<input class="button2" type="reset" id="reset" name="reset" value="{L_RESET}" />
 	</p>
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSE -->
@@ -94,7 +94,7 @@
 		<input class="button2" name="submit" type="submit" value="{L_SUBMIT}" />
 		<p class="small"><a href="#" onclick="marklist('acp_bots', 'mark', true);">{L_MARK_ALL}</a> &bull; <a href="#" onclick="marklist('acp_bots', 'mark', false);">{L_UNMARK_ALL}</a></p>
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ENDIF -->

phpBB/adm/style/acp_captcha.html

@@ -64,7 +64,7 @@
 	<input class="button2" type="reset" id="reset" name="reset" value="{L_RESET}" />&nbsp;
 	<input class="button2" type="submit" id="preview" name="preview" value="{L_PREVIEW}" />
 </fieldset>
-
+{S_FORM_TOKEN}
 </form>
 
 <!-- INCLUDE overall_footer.html -->

phpBB/adm/style/acp_database.html

@@ -25,6 +25,7 @@
 	<!-- ENDIF -->
 
 	</fieldset>
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSE -->
@@ -33,7 +34,7 @@
 	<p>{L_ACP_BACKUP_EXPLAIN}</p>
 
 	<script type="text/javascript">
-	<!--
+	// <![CDATA[
 
 		function selector(bool)
 		{
@@ -45,7 +46,7 @@
 			}
 		}
 
-	//-->
+	// ]]>
 	</script>
 
 	<form id="acp_backup" method="post" action="{U_ACTION}">
@@ -85,7 +86,7 @@
 		<input class="button2" type="reset" id="reset" name="reset" value="{L_RESET}" />
 	</p>
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ENDIF -->

phpBB/adm/style/acp_disallow.html

@@ -4,7 +4,7 @@
 
 <h1>{L_ACP_DISALLOW_USERNAMES}</h1>
 
-<p>{L_ADD_DISALLOW_EXPLAIN}</p>
+<p>{L_ACP_DISALLOW_EXPLAIN}</p>
 
 <form id="acp_disallow" method="post" action="{U_ACTION}">
 
@@ -39,7 +39,7 @@
 	<p>{L_NO_DISALLOWED}</p>
 <!-- ENDIF -->
 </fieldset>
-
+{S_FORM_TOKEN}
 </form>
 
 <!-- INCLUDE overall_footer.html -->

phpBB/adm/style/acp_email.html

@@ -24,7 +24,7 @@
 <dl>
 	<dt><label for="usernames">{L_SEND_TO_USERS}:</label><br /><span>{L_SEND_TO_USERS_EXPLAIN}</span></dt>
 	<dd><textarea name="usernames" id="usernames" rows="5" cols="40">{USERNAMES}</textarea></dd>
-	<dd>[ <a href="{U_FIND_USERNAME}" onclick="find_username(); return false;">{L_FIND_USERNAME}</a> ]</dd>
+	<dd>[ <a href="{U_FIND_USERNAME}" onclick="find_username(this.href); return false;">{L_FIND_USERNAME}</a> ]</dd>
 </dl>
 <dl>
 	<dt><label for="subject">{L_SUBJECT}:</label></dt>
@@ -48,7 +48,7 @@
 	<input class="button2" type="reset" id="reset" name="reset" value="{L_RESET}" />
 </p>
 </fieldset>
-
+{S_FORM_TOKEN}
 </form>
 
 <!-- INCLUDE overall_footer.html -->

phpBB/adm/style/acp_forums.html

@@ -5,8 +5,7 @@
 <!-- IF S_EDIT_FORUM -->
 
 	<script type="text/javascript">
-	<!--
+	// <![CDATA[
-
 		/**
 		* Handle displaying/hiding several options based on the forum type
 		*/
@@ -92,7 +91,7 @@
 			<!-- ENDIF -->
 		}
 
-	//-->
+	// ]]>
 	</script>
 
 	<a href="{U_BACK}" style="float: {S_CONTENT_FLOW_END};">&laquo; {L_BACK}</a>
@@ -161,20 +160,28 @@
 	</dl>
 	<dl>
 		<dt><label for="forum_password">{L_FORUM_PASSWORD}:</label><br /><span>{L_FORUM_PASSWORD_EXPLAIN}</span></dt>
-		<dd><input type="password" id="forum_password" name="forum_password" value="{FORUM_PASSWORD}" /></dd>
+		<dd><input type="password" id="forum_password" name="forum_password" value="<!-- IF S_FORUM_PASSWORD_SET -->&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;<!-- ENDIF -->" /></dd>
 	</dl>
 	<dl>
 		<dt><label for="forum_password_confirm">{L_FORUM_PASSWORD_CONFIRM}:</label><br /><span>{L_FORUM_PASSWORD_CONFIRM_EXPLAIN}</span></dt>
-		<dd><input type="password" id="forum_password_confirm" name="forum_password_confirm" value="{FORUM_PASSWORD_CONFIRM}" /></dd>
+		<dd><input type="password" id="forum_password_confirm" name="forum_password_confirm" value="<!-- IF S_FORUM_PASSWORD_SET -->&#x20;&#x20;&#x20;&#x20;&#x20;&#x20;<!-- ENDIF -->" /></dd>
 	</dl>
+	<!-- IF S_FORUM_PASSWORD_SET -->
+	<dl>
+		<dt><label for="forum_password_unset">{L_FORUM_PASSWORD_UNSET}:</label><br /><span>{L_FORUM_PASSWORD_UNSET_EXPLAIN}</span></dt>
+		<dd><input id="forum_password_unset" name="forum_password_unset" type="checkbox" /></dd>
+	</dl>
+	<!-- ENDIF -->
 	<dl>
 		<dt><label for="forum_style">{L_FORUM_STYLE}:</label></dt>
 		<dd><select id="forum_style" name="forum_style"><option value="0">{L_DEFAULT_STYLE}</option>{S_STYLES_OPTIONS}</select></dd>
 	</dl>
-	<dl>
+	<!-- IF S_CAN_COPY_PERMISSIONS -->
-		<dt><label for="forum_perm_from">{L_COPY_PERMISSIONS}:</label><br /><span>{L_COPY_PERMISSIONS_EXPLAIN}</span></dt>
+		<dl>
-		<dd><select id="forum_perm_from" name="forum_perm_from"><option value="0">{L_NO_PERMISSIONS}</option>{S_FORUM_OPTIONS}</select></dd>
+			<dt><label for="forum_perm_from">{L_COPY_PERMISSIONS}:</label><br /><span>{L_COPY_PERMISSIONS_EXPLAIN}</span></dt>
-	</dl>
+			<dd><select id="forum_perm_from" name="forum_perm_from"><option value="0">{L_NO_PERMISSIONS}</option>{S_FORUM_OPTIONS}</select></dd>
+		</dl>
+	<!-- ENDIF -->
 	</fieldset>
 
 	<div id="forum_cat_options">
@@ -311,7 +318,7 @@
 		<input class="button1" type="submit" id="submit" name="update" value="{L_SUBMIT}" />&nbsp;
 		<input class="button2" type="reset" id="reset" name="reset" value="{L_RESET}" />
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSEIF S_DELETE_FORUM -->
@@ -360,18 +367,17 @@
 		<input class="button1" type="submit" name="update" value="{L_SUBMIT}" />
 	</p>
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSEIF S_CONTINUE_SYNC -->
 
 	<script type="text/javascript">
-	<!--
+	// <![CDATA[
-
 		var close_waitscreen = 0;
-		window.open('{UA_PROGRESS_BAR}', '_sync', 'height=240, resizable=yes, scrollbars=no, width=400');
+		// no scrollbars...
-
+		popup('{UA_PROGRESS_BAR}', 400, 240, '_sync');
-	//-->
+	// ]]>
 	</script>
 
 	<h1>{L_FORUM_ADMIN}</h1>
@@ -383,18 +389,17 @@
 <!-- ELSE -->
 
 	<script type="text/javascript">
-	<!--
+	// <![CDATA[
-
 		/**
 		* Popup search progress bar
 		*/
 		function popup_progress_bar()
 		{
 			var close_waitscreen = 0;
-			window.open('{UA_PROGRESS_BAR}', '_sync', 'height=240, resizable=yes, scrollbars=no, width=400');
+			// no scrollbars...
+			popup('{UA_PROGRESS_BAR}', 400, 240, '_sync');
 		}
-
+	// ]]>
-	//-->
 	</script>
 
 	<h1>{L_FORUM_ADMIN}</h1>
@@ -410,9 +415,9 @@
 
 	<!-- IF S_RESYNCED -->
 		<script type="text/javascript">
-		<!--
+		// <![CDATA[
 			var close_waitscreen = 1;
-		//-->
+		// ]]>
 		</script>
 
 		<div class="successbox">
@@ -471,7 +476,7 @@
 
 		<input class="button2" type="submit" value="{L_GO}" />
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 	<form id="forums" method="post" action="{U_ACTION}">
@@ -482,7 +487,7 @@
 		<input type="text" name="forum_name" value="" maxlength="255" />
 		<input class="button2" name="addforum" type="submit" value="{L_CREATE_FORUM}" />
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ENDIF -->

phpBB/adm/style/acp_groups.html

@@ -76,7 +76,7 @@
 	</dl>
 	<dl>
 		<dt><label for="group_colour">{L_GROUP_COLOR}:</label><br /><span>{L_GROUP_COLOR_EXPLAIN}</span></dt>
-		<dd><input name="group_colour" type="text" id="group_colour" value="{GROUP_COLOUR}" size="6" maxlength="6" />&nbsp;&nbsp;<span>[ <a href="#" onclick="swatch(); return false">{L_COLOUR_SWATCH}</a> ]</span></dd>
+		<dd><input name="group_colour" type="text" id="group_colour" value="{GROUP_COLOUR}" size="6" maxlength="6" />&nbsp;&nbsp;<span>[ <a href="{U_SWATCH}" onclick="popup(this.href, 636, 150, '_swatch'); return false">{L_COLOUR_SWATCH}</a> ]</span></dd>
 	</dl>
 	<dl>
 		<dt><label for="group_rank">{L_GROUP_RANK}:</label></dt>
@@ -155,7 +155,7 @@
 		<input class="button1" type="submit" id="submit" name="update" value="{L_SUBMIT}" />&nbsp;
 		<input class="button2" type="reset" id="reset" name="reset" value="{L_RESET}" />
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSEIF S_LIST -->
@@ -254,14 +254,14 @@
 	<dl>
 		<dt><label for="usernames">{L_USERNAME}:</label><br /><span>{L_USERNAMES_EXPLAIN}</span></dt>
 		<dd><textarea id="usernames" name="usernames" cols="40" rows="5"></textarea></dd>
-		<dd>[ <a href="{U_FIND_USERNAME}" onclick="find_username(); return false;">{L_FIND_USERNAME}</a> ]</dd>
+		<dd>[ <a href="{U_FIND_USERNAME}" onclick="find_username(this.href); return false;">{L_FIND_USERNAME}</a> ]</dd>
 	</dl>
 
 	<p class="quick">
 		<input class="button2" type="submit" name="addusers" value="{L_SUBMIT}" />
 	</p>
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSE -->
@@ -310,7 +310,7 @@
 			<input type="hidden" name="add" value="1" />
 		<!-- ENDIF -->
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 	<h1>{L_SPECIAL_GROUPS}</h1>

phpBB/adm/style/acp_icons.html

@@ -5,7 +5,7 @@
 <!-- IF S_EDIT -->
 
 	<script type="text/javascript" defer="defer">
-	<!--
+	// <![CDATA[
 	<!-- IF S_ADD_CODE -->
 	
 			var smiley = Array();
@@ -22,7 +22,7 @@
 			{
 				var use_element = smiley[newimage];
 
-				document.getElementById('add_image_src').src = '{PHPBB_ROOT_PATH}{IMG_PATH}/' + newimage;
+				document.getElementById('add_image_src').src = '{PHPBB_ROOT_PATH}{IMG_PATH}/' + encodeURI(newimage);
 				document.getElementById('add_code').value = use_element['code'];
 				document.getElementById('add_emotion').value = use_element['emotion'];
 				document.getElementById('add_width').value = use_element['width'];
@@ -60,10 +60,9 @@
 			nodisp.className = '';
 		}
 	}
-	//-->
+	// ]]>
 	</script>
 
-
 	<a href="{U_BACK}" style="float: {S_CONTENT_FLOW_END};">&laquo; {L_BACK}</a>
 
 	<h1>{L_TITLE}</h1>
@@ -112,7 +111,7 @@
 		<td><input class="text post" type="text" size="3" name="width[{items.IMG}]" value="{items.WIDTH}" /></td>
 		<td><input class="text post" type="text" size="3" name="height[{items.IMG}]" value="{items.HEIGHT}" /></td>
 		<td>
-			<input type="checkbox" class="radio" name="display_on_posting[{items.IMG}]"{items.POSTING_CHECKED} onclick="toggle_select('{items.IMG}', this.checked, 'order[{items.IMG}]');"/>
+			<input type="checkbox" class="radio" name="display_on_posting[{items.IMG}]"{items.POSTING_CHECKED} onclick="toggle_select('{items.A_IMG}', this.checked, 'order[{items.A_IMG}]');"/>
 			<!-- IF items.S_ID -->
 				<input type="hidden" name="id[{items.IMG}]" value="{items.ID}" />
 			<!-- ENDIF -->
@@ -161,7 +160,7 @@
 	</p>
 
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSEIF S_CHOOSE_PAK -->
@@ -196,7 +195,7 @@
 	</p>
 	<!-- ENDIF -->
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSE -->
@@ -258,7 +257,7 @@
 		<input class="button2" name="add" type="submit" value="{L_ICON_ADD}" />&nbsp; &nbsp;<input class="button2" type="submit" name="edit" value="{L_ICON_EDIT}" />
 	</p>
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ENDIF -->

phpBB/adm/style/acp_inactive.html

@@ -65,7 +65,7 @@
 
 
 
-
+{S_FORM_TOKEN}
 </form>
 
 <!-- INCLUDE overall_footer.html -->

phpBB/adm/style/acp_jabber.html

@@ -17,6 +17,9 @@
 
 <fieldset>
 	<legend>{L_ACP_JABBER_SETTINGS}</legend>
+<!-- IF S_GTALK_NOTE -->
+	<p>{L_JAB_GTALK_NOTE}</p>
+<!-- ENDIF -->
 <dl>
 	<dt><label for="jab_enable">{L_JAB_ENABLE}:</label><br /><span>{L_JAB_ENABLE_EXPLAIN}</span></dt>
 	<dd><label><input type="radio" class="radio" id="jab_enable" name="jab_enable" value="1"<!-- IF JAB_ENABLE --> checked="checked"<!-- ENDIF --> /> {L_ENABLED}</label>
@@ -56,7 +59,7 @@
 	<input class="button1" type="submit" id="submit" name="submit" value="{L_SUBMIT}" />&nbsp;
 	<input class="button2" type="reset" id="reset" name="reset" value="{L_RESET}" />
 </fieldset>
-
+{S_FORM_TOKEN}
 </form>
 
 <!-- INCLUDE overall_footer.html -->

phpBB/adm/style/acp_language.html

@@ -55,7 +55,7 @@
 		<input type="submit" name="update_details" class="button2" value="{L_SUBMIT}" />
 	</p>
 	</fieldset>
-	
+	{S_FORM_TOKEN}
 	</form>
 
 	<br /><br />
@@ -92,7 +92,7 @@
 		<!-- END missing -->
 		</tbody>
 		</table>
-
+		{S_FORM_TOKEN}
 		</form>
 
 		<br /><br />
@@ -161,7 +161,7 @@
 	</tr>
 	</tbody>
 	</table>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSEIF S_UPLOAD -->
@@ -201,7 +201,7 @@
 		<input class="button1" type="submit" name="update" value="{L_SUBMIT}" />
 		<input class="button1" type="submit" name="test_connection" value="{L_TEST_CONNECTION}" />
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSE -->

phpBB/adm/style/acp_logs.html

@@ -79,7 +79,7 @@
 <!-- ENDIF -->
 
 
-
+{S_FORM_TOKEN}
 </form>
 
 <!-- INCLUDE overall_footer.html -->

phpBB/adm/style/acp_modules.html

@@ -5,8 +5,7 @@
 <!-- IF S_EDIT_MODULE -->
 
 	<script type="text/javascript">
-	<!--
+	// <![CDATA[
-
 		function display_options(value)
 		{
 			if (value == 'category')
@@ -38,7 +37,7 @@
 			var j = 0;
 <!-- BEGIN m_names -->
 		
-			if (value == '{m_names.NAME}')
+			if (value == '{m_names.A_NAME}')
 			{
 	<!-- BEGIN modes -->
 				item.options[j] = new Option('{m_names.modes.A_VALUE}');
@@ -52,7 +51,7 @@
 			item.options[0].selected = true;
 		}
 
-	//-->
+	// ]]>
 	</script>
 
 	<a href="{U_BACK}" style="float: {S_CONTENT_FLOW_END};">&laquo; {L_BACK}</a>
@@ -117,7 +116,7 @@
 		<input class="button2" type="reset" id="reset" name="reset" value="{L_RESET}" />
 	</p>
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSE -->

phpBB/adm/style/acp_permission_roles.html

@@ -5,7 +5,7 @@
 <!-- IF S_EDIT -->
 
 	<script type="text/javascript">
-	<!--
+	// <![CDATA[
 		var active_pmask = '0';
 		var active_fmask = '0';
 		var active_cat = '0';
@@ -17,7 +17,7 @@
 		<!-- IF S_ROLE_JS_ARRAY -->
 			{S_ROLE_JS_ARRAY}
 		<!-- ENDIF -->
-	//-->
+	// ]]>
 	</script>
 
 	<script type="text/javascript" src="style/permissions.js"></script>
@@ -125,7 +125,7 @@
 	<fieldset class="quick">
 		<input type="submit" class="button1" name="submit" value="{L_SUBMIT}" />
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 	<a href="#maincontent">&raquo; {L_BACK_TO_TOP}</a><br />
@@ -179,7 +179,7 @@
 	<fieldset class="quick">
 		{L_CREATE_ROLE}: <input type="text" name="role_name" value="" maxlength="255" /><!-- IF S_ROLE_OPTIONS --> <select name="options_from"><option value="0" selected="selected">{L_CREATE_ROLE_FROM}</option>{S_ROLE_OPTIONS}</select><!-- ENDIF --> <input class="button2" type="submit" name="add" value="{L_SUBMIT}" /><br />
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 	<!-- IF S_DISPLAY_ROLE_MASK -->

phpBB/adm/style/acp_permissions.html

@@ -39,7 +39,7 @@
 		</p>
 
 		</fieldset>
-
+		{S_FORM_TOKEN}
 		</form>
 
 		<!-- IF S_FORUM_MULTIPLE -->
@@ -60,7 +60,7 @@
 			</p>
 
 			</fieldset>
-
+			{S_FORM_TOKEN}
 			</form>
 			
 		<!-- ENDIF -->
@@ -74,7 +74,7 @@
 		<dl>
 			<dt><label for="username">{L_FIND_USERNAME}:</label></dt>
 			<dd><input class="text medium" type="text" id="username" name="username[]" /></dd>
-			<dd>[ <a href="{U_FIND_USERNAME}" onclick="find_username(); return false;">{L_FIND_USERNAME}</a> ]</dd>
+			<dd>[ <a href="{U_FIND_USERNAME}" onclick="find_username(this.href); return false;">{L_FIND_USERNAME}</a> ]</dd>
 			<dd class="full" style="text-align: left;"><label><input type="checkbox" class="radio" id="anonymous" name="user_id[]" value="{ANONYMOUS_USER_ID}" /> {L_SELECT_ANONYMOUS}</label></dd>
 		</dl>
 
@@ -83,7 +83,7 @@
 			<input type="submit" name="submit" value="{L_SUBMIT}" class="button1" />
 		</p>
 		</fieldset>
-
+		{S_FORM_TOKEN}
 		</form>
 
 	<!-- ELSEIF S_SELECT_GROUP and S_CAN_SELECT_GROUP -->
@@ -103,7 +103,7 @@
 		</p>
 
 		</fieldset>
-
+		{S_FORM_TOKEN}
 		</form>
 
 		<!-- ELSEIF S_SELECT_USERGROUP -->
@@ -128,7 +128,7 @@
 				{S_HIDDEN_FIELDS}
 				<input type="submit" class="button2" name="action[delete]" value="{L_REMOVE_PERMISSIONS}" style="width: 46% !important;" /> &nbsp; <input class="button1" type="submit" name="submit_edit_options" value="{L_EDIT_PERMISSIONS}" style="width: 46% !important;" />
 			</fieldset>
-			
+			{S_FORM_TOKEN}
 			</form>
 
 			<form id="add_user" method="post" action="{U_ACTION}">
@@ -138,7 +138,7 @@
 				<p>{L_USERNAMES_EXPLAIN}</p>
 			<dl>
 				<dd class="full"><textarea id="username" name="usernames" rows="5" cols="5" style="width: 100%; height: 60px;"></textarea></dd>
-				<dd class="full" style="text-align: left;"><div style="float: {S_CONTENT_FLOW_END};">[ <a href="{U_FIND_USERNAME}" onclick="find_username(); return false;">{L_FIND_USERNAME}</a> ]</div><label><input type="checkbox" class="radio" id="anonymous" name="user_id[]" value="{ANONYMOUS_USER_ID}" /> {L_SELECT_ANONYMOUS}</label></dd>
+				<dd class="full" style="text-align: left;"><div style="float: {S_CONTENT_FLOW_END};">[ <a href="{U_FIND_USERNAME}" onclick="find_username(this.href); return false;">{L_FIND_USERNAME}</a> ]</div><label><input type="checkbox" class="radio" id="anonymous" name="user_id[]" value="{ANONYMOUS_USER_ID}" /> {L_SELECT_ANONYMOUS}</label></dd>
 			</dl>
 			</fieldset>
 
@@ -146,7 +146,7 @@
 				{S_HIDDEN_FIELDS}
 				<input class="button1" type="submit" name="submit_add_options" value="{L_ADD_PERMISSIONS}" />
 			</fieldset>
-			
+			{S_FORM_TOKEN}
 			</form>
 
 		<!-- ENDIF -->
@@ -173,7 +173,7 @@
 				{S_HIDDEN_FIELDS}
 				<input class="button2" type="submit" name="action[delete]" value="{L_REMOVE_PERMISSIONS}" style="width: 46% !important;" /> &nbsp; <input class="button1" type="submit" name="submit_edit_options" value="{L_EDIT_PERMISSIONS}" style="width: 46% !important;" />
 			</fieldset>
-			
+			{S_FORM_TOKEN}
 			</form>
 
 			<form id="add_groups" method="post" action="{U_ACTION}">
@@ -190,6 +190,7 @@
 				<input type="submit" class="button1" name="submit_add_options" value="{L_ADD_PERMISSIONS}" />
 			</fieldset>
 			
+			{S_FORM_TOKEN}
 			</form>
 
 		<!-- ENDIF -->
@@ -216,6 +217,7 @@
 				<input class="button1" type="submit" name="submit" value="{L_VIEW_PERMISSIONS}" />
 			</fieldset>
 			
+			{S_FORM_TOKEN}
 			</form>
 
 			<form id="add_user" method="post" action="{U_ACTION}">
@@ -225,7 +227,7 @@
 			<dl>
 				<dt><label for="username">{L_FIND_USERNAME}:</label></dt>
 				<dd><input type="text" id="username" name="username[]" /></dd>
-				<dd>[ <a href="{U_FIND_USERNAME}" onclick="find_username(); return false;">{L_FIND_USERNAME}</a> ]</dd>
+				<dd>[ <a href="{U_FIND_USERNAME}" onclick="find_username(this.href); return false;">{L_FIND_USERNAME}</a> ]</dd>
 				<dd class="full" style="text-align: left;"><label><input type="checkbox" class="radio" id="anonymous" name="user_id[]" value="{ANONYMOUS_USER_ID}" /> {L_SELECT_ANONYMOUS}</label></dd>
 			</dl>
 			</fieldset>
@@ -234,7 +236,7 @@
 				{S_HIDDEN_FIELDS}
 				<input type="submit" name="submit" value="{L_VIEW_PERMISSIONS}" class="button1" />
 			</fieldset>
-
+			{S_FORM_TOKEN}
 			</form>
 
 		</div>
@@ -257,6 +259,7 @@
 				<input class="button1" type="submit" name="submit" value="{L_VIEW_PERMISSIONS}" />
 			</fieldset>
 			
+			{S_FORM_TOKEN}
 			</form>
 
 			<form id="group" method="post" action="{U_ACTION}">
@@ -275,6 +278,7 @@
 				<input type="submit" name="submit" value="{L_VIEW_PERMISSIONS}" class="button1" />
 			</fieldset>
 
+			{S_FORM_TOKEN}
 			</form>
 
 		</div>
@@ -318,7 +322,7 @@
 
 			<input class="button2" type="submit" name="submit" value="{L_GO}" />
 		</fieldset>
-	
+		{S_FORM_TOKEN}	
 		</form>
 	<!-- ENDIF -->
 
@@ -327,9 +331,9 @@
 	<!-- include tooltip file -->
 	<script type="text/javascript" src="style/tooltip.js"></script>
 	<script type="text/javascript">
-	<!--
+	// <![CDATA[
 		window.onload = function(){enable_tooltips_select('set-permissions', '{LA_ROLE_DESCRIPTION}', 'role')};
-	//-->
+	// ]]>
 	</script>
 
 	<form id="set-permissions" method="post" action="{U_ACTION}">
@@ -346,7 +350,8 @@
 	</fieldset>
 
 	<br /><br />
-
+	
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ENDIF -->

phpBB/adm/style/acp_profile.html

@@ -156,7 +156,7 @@
 		</fieldset>
 	
 	<!-- ENDIF -->
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSE -->
@@ -217,7 +217,7 @@
 		<input class="button1" type="submit" name="submit" value="{L_CREATE_NEW_FIELD}" />
 		<input type="hidden" name="create" value="1" />
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ENDIF -->

phpBB/adm/style/acp_prune_forums.html

@@ -101,7 +101,7 @@
 		<input class="button1" type="submit" id="submit" name="submit" value="{L_SUBMIT}" />
 	</p>
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ENDIF -->

phpBB/adm/style/acp_prune_users.html

@@ -33,7 +33,7 @@
 <dl>
 	<dt><label for="users">{L_ACP_PRUNE_USERS}:</label><br /><span>{L_SELECT_USERS_EXPLAIN}</span></dt>
 	<dd><textarea id="users" name="users" cols="40" rows="5"></textarea></dd>
-	<dd>[ <a href="#" onclick="window.open('{U_FIND_USER}', '_phpbbsearch', 'height=500, resizable=yes, scrollbars=yes, width=740'); return false;">{L_FIND_USERNAME}</a> ]</dd>
+	<dd>[ <a href="{U_FIND_USERNAME}" onclick="find_username(this.href); return false;">{L_FIND_USERNAME}</a> ]</dd>
 </dl>
 <dl>
 	<dt><label for="deleteposts">{L_DELETE_USER_POSTS}:</label><br /><span>{L_DELETE_USER_POSTS_EXPLAIN}</span></dt>
@@ -53,7 +53,7 @@
 	<input class="button2" type="reset" id="reset" name="reset" value="{L_RESET}" />
 </p>
 </fieldset>
-
+{S_FORM_TOKEN}
 </form>
 
 <!-- INCLUDE overall_footer.html -->

phpBB/adm/style/acp_ranks.html

@@ -7,13 +7,13 @@
 	<a href="{U_BACK}" style="float: {S_CONTENT_FLOW_END};">&laquo; {L_BACK}</a>
 
 	<script type="text/javascript">
-	<!--
+	// <![CDATA[
 		function update_image(newimage)
 		{
-			document.getElementById('image').src = (newimage) ? "{RANKS_PATH}/" + newimage : "./images/spacer.gif";
+			document.getElementById('image').src = (newimage) ? "{RANKS_PATH}/" + encodeURI(newimage) : "./images/spacer.gif";
 		}
 
-	//-->
+	// ]]>
 	</script>
 
 	<h1>{L_ACP_MANAGE_RANKS}</h1>
@@ -52,7 +52,7 @@
 		<input class="button2" type="reset" id="reset" name="reset" value="{L_RESET}" />
 	</p>
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSE -->
@@ -90,7 +90,7 @@
 		<input class="button2" name="add" type="submit" value="{L_ADD_RANK}" />
 	</p>
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ENDIF -->

phpBB/adm/style/acp_reasons.html

@@ -54,7 +54,7 @@
 		<input class="button2" type="reset" id="reset" name="reset" value="{L_RESET}" />
 	</p>
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSE -->
@@ -118,7 +118,8 @@
 		<input class="button2" name="addreason" type="submit" value="{L_ADD_NEW_REASON}" />
 	</p>
 	</fieldset>
-
+	
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ENDIF -->

phpBB/adm/style/acp_search.html

@@ -61,22 +61,23 @@
 		<input class="button2" type="reset" id="reset" name="reset" value="{L_RESET}" />
 	</fieldset>
 
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSEIF S_INDEX -->
 
 	<script type="text/javascript">
-	<!--
+	// <![CDATA[
-
 		/**
 		* Popup search progress bar
 		*/
 		function popup_progress_bar(progress_type)
 		{
 			close_waitscreen = 0;
-			window.open('{UA_PROGRESS_BAR}&type=' + progress_type, '_index', 'HEIGHT=240,resizable=yes,scrollbars=no,WIDTH=400');
+			// no scrollbars
+			popup('{UA_PROGRESS_BAR}&amp;type=' + progress_type, 400, 240, '_index');
 		}
-	//-->
+	// ]]>
 	</script>
 
 	<h1>{L_ACP_SEARCH_INDEX}</h1>
@@ -90,6 +91,7 @@
 				<input class="button1" type="submit" id="continue" name="continue" value="{L_CONTINUE}" onclick="popup_progress_bar('{S_CONTINUE_INDEXING}');" />&nbsp;
 				<input class="button2" type="submit" id="cancel" name="cancel" value="{L_CANCEL}" />
 			</fieldset>
+		{S_FORM_TOKEN}
 		</form>
 	<!-- ELSE -->
 
@@ -140,7 +142,7 @@
 			<!-- ENDIF -->
 			</p>
 			</fieldset>
-
+			{S_FORM_TOKEN}
 			</form>
 		<!-- END backend -->
 

phpBB/adm/style/acp_styles.html

@@ -27,7 +27,7 @@
 		<input class="button1" type="submit" name="update" value="{L_DELETE}" />
 	</p>
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSEIF S_EDIT_IMAGESET -->
@@ -51,15 +51,15 @@
 	<!-- ENDIF -->
 
 	<script type="text/javascript" defer="defer">
-	<!--
+	// <![CDATA[
 		function update_image(newimage)
 		{
-			document.getElementById('newimg').src = (newimage) ? "../styles/{NAME}/imageset/" + newimage : "images/no_image.png";
+			document.getElementById('newimg').src = (newimage) ? '../styles/{A_NAME}/imageset/' + encodeURI(newimage) : 'images/no_image.png';
 		}
-	//-->
+	// ]]>
 	</script>
 	<script type="text/javascript">
-	<!--
+	// <![CDATA[
 		/**
 		* Handle displaying/hiding the dimension fields
 		*/
@@ -85,7 +85,7 @@
 				dE('img_dimensions', -1);
 			<!-- ENDIF -->
 		}
-	//-->
+	// ]]>
 	</script>
 
 	<form method="post" action="{U_ACTION}">
@@ -148,38 +148,11 @@
 		<legend>{L_SUBMIT}</legend>
 		<input class="button1" type="submit" name="update" value="{L_SUBMIT}" />&nbsp;&nbsp;<input class="button2" type="reset" value="{L_RESET}" />
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSEIF S_EDIT_TEMPLATE or S_EDIT_THEME -->
 
-	<script type="text/javascript" defer="defer">
-	<!--
-		function append_text_rows(form_name, value)
-		{
-			url = document.getElementById(form_name).action;
-			var_start = url.indexOf('&text_rows=');
-			if (var_start == -1)
-			{
-				document.getElementById(form_name).action = url + "&text_rows=" + value;
-			}
-			else
-			{
-				url_start = url.substring(0, var_start + 1);
-				var_end = url.substring(var_start + 1).indexOf('&');
-				if (var_end == -1)
-				{
-					document.getElementById(form_name).action = url_start + "text_rows=" + value;
-				}
-				else
-				{
-					document.getElementById(form_name).action = url_start + url.substring(var_end + var_start + 2) + "&text_rows=" + value;
-				}
-			}
-		}
-	//-->
-	</script>
-
 	<a href="{U_BACK}" style="float: {S_CONTENT_FLOW_END};">&laquo; {L_BACK}</a>
 
 	<h1>{L_EDIT}</h1>
@@ -199,15 +172,23 @@
 	</dl>
 	</fieldset>
 	<!-- ENDIF -->
-
+	
+	{S_FORM_TOKEN}
 	</form>
 
 	<!-- IF TEMPLATE_FILE or (S_EDIT_THEME and S_THEME_IN_DB) -->
 		<script type="text/javascript" defer="defer">
-		<!--
+		// <![CDATA[
 
 			function change_editor_height(height)
 			{
+				height = Number(height);
+
+				if (isNaN(height))
+				{
+					return;
+				}
+
 				editor = document.getElementById('template_data');
 				editor.rows = Math.max(5, Math.min(height, 999));
 
@@ -217,7 +198,18 @@
 
 			function append_text_rows(form_name, value)
 			{
+				value = Number(value);
+
+				if (isNaN(value))
+				{
+					return;
+				}
+
 				url = document.getElementById(form_name).action;
+
+				// Make sure &amp; is actually... &
+				url = url.replace(/&amp;/g, '&');
+
 				var_start = url.indexOf('&text_rows=');
 				if (var_start == -1)
 				{
@@ -237,7 +229,8 @@
 					}
 				}
 			}
-		//-->
+
+		// ]]>
 		</script>
 
 		<form id="acp_template" method="post" action="{U_ACTION}">
@@ -262,24 +255,13 @@
 			{S_HIDDEN_FIELDS}
 			<input class="button1" id="save" type="submit" name="save" value="{L_SUBMIT}" />
 		</fieldset>
-
+		
+		{S_FORM_TOKEN}
 		</form>
 	<!-- ENDIF -->
 
 <!-- ELSEIF S_CACHE -->
 
-	<script type="text/javascript">
-	<!--
-
-		function viewsource(url)
-		{
-			window.open(url, '_source', 'HEIGHT=550,resizable=yes,scrollbars=yes,WIDTH=750');
-			return false;
-		}
-	
-	//-->
-	</script>
-
 	<a href="{U_BACK}" style="float: {S_CONTENT_FLOW_END};">&laquo; {L_BACK}</a>
 	
 	<h1>{L_TEMPLATE_CACHE}</h1>
@@ -303,7 +285,7 @@
 	<tbody>
 	<!-- BEGIN file -->
 		<!-- IF file.S_ROW_COUNT is even --><tr class="row1"><!-- ELSE --><tr class="row2"><!-- ENDIF -->
-			<td><a href="{file.U_VIEWSOURCE}" onclick="viewsource('{file.UA_VIEWSOURCE}');return false">{file.FILENAME}</a></td>
+			<td><a href="{file.U_VIEWSOURCE}" onclick="popup(this.href, 750, 550, '_source'); return false;">{file.FILENAME}</a></td>
 			<td>{file.FILESIZE}</td>
 			<td>{file.CACHED}</td>
 			<td>{file.MODIFIED}</td>
@@ -324,6 +306,7 @@
 	</p>
 	</fieldset>
 
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSEIF S_EXPORT -->
@@ -381,6 +364,7 @@
 	</p>
 	</fieldset>
 
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSEIF S_FRONTEND -->
@@ -525,7 +509,8 @@
 		<legend>{L_SUBMIT}</legend>
 		<input class="button1" type="submit" name="update" value="{L_SUBMIT}" />
 	</fieldset>
-
+	
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ENDIF -->

phpBB/adm/style/acp_users.html

@@ -15,7 +15,7 @@
 	<dl>
 		<dt><label for="username">{L_FIND_USERNAME}:</label></dt>
 		<dd><input class="text medium" type="text" id="username" name="username" /></dd>
-		<dd>[ <a href="{U_FIND_USERNAME}" onclick="find_username(); return false;">{L_FIND_USERNAME}</a> ]</dd>
+		<dd>[ <a href="{U_FIND_USERNAME}" onclick="find_username(this.href); return false;">{L_FIND_USERNAME}</a> ]</dd>
 		<dd class="full" style="text-align: left;"><label><input type="checkbox" class="radio" id="anonymous" name="u" value="{ANONYMOUS_USER_ID}" /> {L_SELECT_ANONYMOUS}</label></dd>
 	</dl>
 
@@ -47,7 +47,7 @@
 	<fieldset class="quick">
 		<input type="submit" name="update" value="{L_SUBMIT}" class="button1" />
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSE -->
@@ -70,7 +70,7 @@
 	<fieldset class="quick">
 		{L_SELECT_FORM}: <select name="mode" onchange="if (this.options[this.selectedIndex].value != '') this.form.submit();">{S_FORM_OPTIONS}</select> <input class="button2" type="submit" value="{L_GO}" />
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ENDIF -->
@@ -110,7 +110,7 @@
 	<fieldset class="quick">
 		<input class="button1" type="submit" name="update" value="{L_SUBMIT}" />
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSEIF S_SIGNATURE -->
@@ -145,7 +145,7 @@
 			{L_USER_GROUP_ADD}: <select name="g">{S_GROUP_OPTIONS}</select> <input class="button1" type="submit" name="update" value="{L_SUBMIT}" />
 		</fieldset>
 	<!-- ENDIF -->
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSEIF S_ATTACHMENTS -->
@@ -202,7 +202,7 @@
 		<input class="button2" type="submit" name="delmarked" value="{L_DELETE_MARKED}" />
 		<p class="small"><a href="#" onclick="marklist('user_attachments', 'mark', true);">{L_MARK_ALL}</a> &bull; <a href="#" onclick="marklist('user_attachments', 'mark', false);">{L_UNMARK_ALL}</a></p>
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSEIF S_PERMISSIONS -->
@@ -218,7 +218,7 @@
 			{L_SELECT_FORUM}: <select name="f">{S_FORUM_OPTIONS}</select> 
 			<input class="button2" type="submit" value="{L_GO}" name="select" />
 		</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 	<div class="clearfix">&nbsp;</div>

phpBB/adm/style/acp_users_avatar.html

@@ -71,5 +71,6 @@
 	<fieldset class="quick">
 		<input class="button1" type="submit" name="update" value="{L_SUBMIT}" />
 	</fieldset>
-
+	
+	{S_FORM_TOKEN}
 	</form>

phpBB/adm/style/acp_users_feedback.html

@@ -72,5 +72,5 @@
 	<fieldset class="quick">
 		<input class="button1" type="submit" name="update" value="{L_SUBMIT}" />
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>

phpBB/adm/style/acp_users_overview.html

@@ -21,7 +21,7 @@
 <dl>
 	<dt><label>{L_REGISTERED_IP}:</label></dt>
 	<dd><a href="{U_SHOW_IP}">{REGISTERED_IP}</a></dd>
-	<dd>[ <a href="#" onclick="window.open('{U_WHOIS}', '_whois', 'height=500, resizable=yes, scrollbars=yes, width=700'); return false;">{L_WHOIS}</a> ]</dd>
+	<dd>[ <a href="{U_WHOIS}" onclick="popup(this.href, 700, 500, '_whois'); return false;">{L_WHOIS}</a> ]</dd>
 </dl>
 <!-- ENDIF -->
 <dl>
@@ -64,13 +64,13 @@
 </p>
 
 </fieldset>
-
+{S_FORM_TOKEN}
 </form>
 
 <!-- IF not S_USER_FOUNDER or S_FOUNDER -->
 
 	<script type="text/javascript">
-	<!--
+	// <![CDATA[
 
 		function display_reason(option)
 		{
@@ -103,7 +103,7 @@
 			}
 		}
 
-	//-->
+	// ]]>
 	</script>
 
 	<form id="user_quick_tools" method="post" action="{U_ACTION}">
@@ -137,7 +137,8 @@
 	</p>
 
 	</fieldset>
-
+	
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ENDIF -->

phpBB/adm/style/acp_users_prefs.html

@@ -1,3 +1,9 @@
+<script type="text/javascript">
+// <![CDATA[
+	var default_dateformat = '{A_DEFAULT_DATEFORMAT}';
+// ]]>
+</script>
+
 	<form id="user_prefs" method="post" action="{U_ACTION}">
 
 	<fieldset>
@@ -57,7 +63,7 @@
 	</dl>
 	<dl> 
 		<dt><label for="dateoptions">{L_BOARD_DATE_FORMAT}:</label><br /><span>{L_BOARD_DATE_FORMAT_EXPLAIN}</span></dt>
-		<dd><select name="dateoptions" id="dateoptions" onchange="if(this.value=='custom'){dE('custom_date',1);}else{dE('custom_date',-1);} if (this.value == 'custom') { document.getElementById('dateformat').value = '{A_DEFAULT_DATEFORMAT}'; } else { document.getElementById('dateformat').value = this.value; }">{S_DATEFORMAT_OPTIONS}</select></dd>
+		<dd><select name="dateoptions" id="dateoptions" onchange="if(this.value=='custom'){dE('custom_date',1);}else{dE('custom_date',-1);} if (this.value == 'custom') { document.getElementById('dateformat').value = default_dateformat; } else { document.getElementById('dateformat').value = this.value; }">{S_DATEFORMAT_OPTIONS}</select></dd>
 		<dd><div id="custom_date"<!-- IF not S_CUSTOM_DATEFORMAT --> style="display:none;"<!-- ENDIF -->><input type="text" name="dateformat" id="dateformat" value="{DATE_FORMAT}" maxlength="30" /></div></dd>
 	</dl>
 	</fieldset>
@@ -148,4 +154,5 @@
 		<input class="button1" type="submit" name="update" value="{L_SUBMIT}" />
 	</fieldset>
 
+	{S_FORM_TOKEN}
 	</form>

phpBB/adm/style/acp_users_profile.html

@@ -63,4 +63,5 @@
 		<input class="button1" type="submit" name="update" value="{L_SUBMIT}" />
 	</fieldset>
 
+	{S_FORM_TOKEN}
 	</form>

phpBB/adm/style/acp_users_signature.html

@@ -1,5 +1,5 @@
-	<script type="text/javascript">
+<script type="text/javascript">
-	<!--
+// <![CDATA[
 
 	var form_name = 'user_signature';
 	var text_name = 'signature';
@@ -31,11 +31,11 @@
 		<!-- END custom_tags -->
 	}
 
-	//-->
+// ]]>
-	</script>
+</script>
-	<script type="text/javascript" src="{T_TEMPLATE_PATH}/editor.js"></script>
+<script type="text/javascript" src="{T_TEMPLATE_PATH}/editor.js"></script>
 
-	<form id="user_signature" method="post" action="{U_ACTION}">
+<form id="user_signature" method="post" action="{U_ACTION}">
 
 	<!-- IF SIGNATURE_PREVIEW -->
 		<fieldset>
@@ -67,12 +67,12 @@
 				<input type="button" class="button2" accesskey="d" name="addbbcode18" value="Flash" onclick="bbstyle(18)" onmouseover="helpline('d')" onmouseout="helpline('tip')" />
 			<!-- ENDIF -->
 
-			{L_FONT_SIZE}: <select name="addbbcode20" onchange="bbfontstyle('[size=' + this.form.addbbcode20.options[this.form.addbbcode20.selectedIndex].value + ']', '[/size]');this.form.addbbcode20.selectedIndex = 2;" onmouseover="helpline('f')" onmouseout="helpline('tip')">
+			{L_FONT_SIZE}: <select name="addbbcode20" onchange="bbfontstyle('[size=' + this.form.addbbcode20.options[this.form.addbbcode20.selectedIndex].value + ']', '[/size]');this.form.addbbcode20.selectedIndex = 2;" title="{L_FONT_SIZE}" onmouseover="helpline('f')" onmouseout="helpline('tip')">
-				<option value="7">{L_FONT_TINY}</option>
+				<option value="50">{L_FONT_TINY}</option>
-				<option value="9">{L_FONT_SMALL}</option>
+				<option value="85">{L_FONT_SMALL}</option>
-				<option value="12" selected="selected">{L_FONT_NORMAL}</option>
+				<option value="100" selected="selected">{L_FONT_NORMAL}</option>
-				<option value="18">{L_FONT_LARGE}</option>
+				<option value="150">{L_FONT_LARGE}</option>
-				<option value="24">{L_FONT_HUGE}</option>
+				<option value="200">{L_FONT_HUGE}</option>
 			</select>
 		<!-- IF .custom_tags -->
 			<br /><br />
@@ -86,9 +86,12 @@
 		<p><input type="text" class="text full" style="border: 0; background: none;" name="helpbox" value="{L_STYLES_TIP}" /></p>
 
 		<dl>
-			<dt style="width: 90px;"><script type="text/javascript"><!--
+			<dt style="width: 90px;">
-				colorPalette('v', 12, 10);
+				<script type="text/javascript">
-				//--></script>
+				// <![CDATA[
+					colorPalette('v', 12, 10);
+				// ]]>
+				</script>
 			</dt>
 			<dd style="margin-left: 90px;"><textarea name="signature" rows="10" cols="60" style="width: 95%;" onselect="storeCaret(this);" onclick="storeCaret(this);" onkeyup="storeCaret(this);">{SIGNATURE}</textarea></dd>
 			<dd style="margin-left: 90px; margin-top: 5px;">
@@ -110,5 +113,5 @@
 		<input class="button1" type="submit" name="update" value="{L_SUBMIT}" />&nbsp;
 		<input class="button2" type="submit" name="preview" value="{L_PREVIEW}" />
 	</fieldset>
-
+{S_FORM_TOKEN}
-	</form>
+</form>

phpBB/adm/style/acp_words.html

@@ -29,7 +29,7 @@
 		<input class="button2" type="reset" id="reset" name="reset" value="{L_RESET}" />
 	</p>
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 
 <!-- ELSE -->
@@ -67,7 +67,7 @@
 	</table>
 
 	</fieldset>
-
+	{S_FORM_TOKEN}
 	</form>
 <!-- ENDIF -->
 

phpBB/adm/style/admin.css

@@ -421,7 +421,6 @@ span.corners-bottom span {
 #menu li a:hover, #menu li a:hover span {
 	text-decoration: none;
 	background-color: #FFFFFF;
-	
 	color: #BC2A4D;
 }
 
@@ -703,7 +702,7 @@ input:hover, textarea:hover {
 	border-top: 1px solid #AFAEAA;
 	border-right: 1px solid #AFAEAA;
 	border-bottom: 1px solid #AFAEAA;
-	background-color: #E9E9E2; 
+	background-color: #E9E9E2;
 }
 
 input.langvalue, textarea.langvalue {

phpBB/adm/style/colour_swatch.html

@@ -36,7 +36,7 @@
 <body>
 
 <script type="text/javascript">
-<!--
+// <![CDATA[
 	var r = 0, g = 0, b = 0;
 
 	var numberList = new Array(6);
@@ -71,7 +71,7 @@
 	{
 		opener.document.forms["{OPENER}"].{NAME}.value = color;
 	}
-//-->
+// ]]>
 </script>
 
 </body>

phpBB/adm/style/install_header.html

@@ -11,6 +11,31 @@
 
 <link href="../adm/style/admin.css" rel="stylesheet" type="text/css" media="screen" />
 
+<script type="text/javascript">
+// <![CDATA[
+
+/**
+* Set display of page element
+* s[-1,0,1] = hide,toggle display,show
+*/
+function dE(n, s, type)
+{
+	if (!type)
+	{
+		type = 'block';
+	}
+
+	var e = document.getElementById(n);
+	if (!s)
+	{
+		s = (e.style.display == '' || e.style.display == 'block') ? -1 : 1;
+	}
+	e.style.display = (s == 1) ? type : 'none';
+}
+
+// ]]>
+</script>
+
 </head>
 
 <body class="{S_CONTENT_DIRECTION}">

phpBB/adm/style/install_update.html

@@ -1,13 +1,13 @@
 <!-- INCLUDE install_header.html -->
 
 <script type="text/javascript">
-<!--
+// <![CDATA[
 	function diff_popup(url)
 	{
-		window.open(url.replace(/&amp;/g, '&'), 'diff', 'height=600,resizable=yes,scrollbars=yes,width=950');
+		popup(url, 950, 600, '_diff');
 		return false;
 	}
-//-->
+// ]]>
 </script>
 
 <!-- IF S_ERROR -->
@@ -17,7 +17,14 @@
 	</div>
 <!-- ENDIF -->
 
-<!-- IF S_INTRO -->
+<!-- IF S_IN_PROGRESS -->
+
+	<div class="successbox" style="margin-top: 0;">
+		<h3>{L_IN_PROGRESS}</h3>
+		<p>{L_IN_PROGRESS_EXPLAIN}</p>
+	</div>
+
+<!-- ELSEIF S_INTRO -->
 
 	<!-- IF S_WARNING -->
 	<div class="successbox" style="margin-top: 0;">
@@ -178,13 +185,16 @@
 			<!-- BEGIN files -->
 				<!-- IF files.S_STATUS -->
 					<!-- IF not files.S_FIRST_ROW -->
-						</fieldset>
+						</fieldset></div>
 					<!-- ENDIF -->
 
 					<h2>{files.TITLE}</h2>
 
+					<!-- IF files.STATUS eq 'not_modified' --><div style="float: {S_CONTENT_FLOW_END};">&raquo; <a href="#" onclick="dE('not_modified', 0);">{L_TOGGLE_DISPLAY}</a></div><!-- ENDIF -->
 					<p>{files.EXPLAIN}</p>
 
+					<div style="display: <!-- IF files.STATUS neq 'not_modified' -->block<!-- ELSE -->none<!-- ENDIF -->;" id="{files.STATUS}">
+
 					<fieldset>
 						<legend><img src="{T_IMAGE_PATH}file_{files.STATUS}.gif" alt="{files.L_STATUS}" /></legend>
 				<!-- ELSE -->
@@ -201,7 +211,7 @@
 								<br /><span>{L_NUM_CONFLICTS}: {files.NUM_CONFLICTS}</span>
 								<!-- ENDIF -->
 							</dt>
-							<dd style="margin-left: 60%;"><!-- IF files.STATUS eq 'modified' -->&nbsp;<!-- ELSE --><!-- IF not files.S_BINARY -->[ <a href="{files.U_SHOW_DIFF}" onclick="diff_popup('{files.U_SHOW_DIFF}'); return false;">{files.L_SHOW_DIFF}</a> ]<!-- ELSE -->{L_BINARY_FILE}<!-- ENDIF --><!-- ENDIF --></dd>
+							<dd style="margin-left: 60%;"><!-- IF files.STATUS eq 'modified' -->&nbsp;<!-- ELSE --><!-- IF not files.S_BINARY -->[ <a href="{files.U_SHOW_DIFF}" onclick="diff_popup(this.href); return false;">{files.L_SHOW_DIFF}</a> ]<!-- ELSE -->{L_BINARY_FILE}<!-- ENDIF --><!-- ENDIF --></dd>
 							<!-- IF files.S_CUSTOM -->
 								<dd style="margin-left: 60%;"><label><input type="checkbox" name="no_update[]" value="{files.FILENAME}" class="radio" /> {L_DO_NOT_UPDATE}</label></dd>
 							<!-- ENDIF -->
@@ -210,15 +220,15 @@
 							</dl>
 							<dl>
 								<dt style="width: 60%"><label><input type="radio" class="radio" name="modified[{files.FILENAME}]" value="0" checked="checked" /> {L_MERGE_MODIFICATIONS_OPTION}</label></dt>
-								<dd style="margin-left: 60%;"><!-- IF not files.S_BINARY -->[ <a href="{files.U_SHOW_DIFF}" onclick="diff_popup('{files.U_SHOW_DIFF}'); return false;">{files.L_SHOW_DIFF}</a> ]<!-- ELSE -->{L_BINARY_FILE}<!-- ENDIF --></dd>
+								<dd style="margin-left: 60%;"><!-- IF not files.S_BINARY -->[ <a href="{files.U_SHOW_DIFF}" onclick="diff_popup(this.href); return false;">{files.L_SHOW_DIFF}</a> ]<!-- ELSE -->{L_BINARY_FILE}<!-- ENDIF --></dd>
 							</dl>
 							<dl>
 								<dt style="width: 60%"><label><input type="radio" class="radio" name="modified[{files.FILENAME}]" value="1" /> {L_MERGE_NO_MERGE_NEW_OPTION}</label></dt>
-								<dd style="margin-left: 60%;"><!-- IF not files.S_BINARY -->[<a href="{files.U_VIEW_NO_MERGE_NEW}" onclick="diff_popup('{files.U_VIEW_NO_MERGE_NEW}'); return false;">{L_SHOW_DIFF_FINAL}</a>]<!-- ELSE -->&nbsp;<!-- ENDIF --></dd>
+								<dd style="margin-left: 60%;"><!-- IF not files.S_BINARY -->[<a href="{files.U_VIEW_NO_MERGE_NEW}" onclick="diff_popup(this.href); return false;">{L_SHOW_DIFF_FINAL}</a>]<!-- ELSE -->&nbsp;<!-- ENDIF --></dd>
 							</dl>
 							<dl>
 								<dt style="width: 60%"><label><input type="radio" class="radio" name="modified[{files.FILENAME}]" value="2" /> {L_MERGE_NO_MERGE_MOD_OPTION}</label></dt>
-								<dd style="margin-left: 60%;"><!-- IF not files.S_BINARY -->[<a href="{files.U_VIEW_NO_MERGE_MOD}" onclick="diff_popup('{files.U_VIEW_NO_MERGE_MOD}'); return false;">{L_SHOW_DIFF_FINAL}</a>]<!-- ELSE -->&nbsp;<!-- ENDIF --></dd>
+								<dd style="margin-left: 60%;"><!-- IF not files.S_BINARY -->[<a href="{files.U_VIEW_NO_MERGE_MOD}" onclick="diff_popup(this.href); return false;">{L_SHOW_DIFF_FINAL}</a>]<!-- ELSE -->&nbsp;<!-- ENDIF --></dd>
 							</dl>
 							<!-- IF not files.S_LAST_ROW -->
 							</fieldset>
@@ -233,20 +243,20 @@
 							</dl>
 							<dl>
 								<dt style="width: 60%"><label><input type="radio" class="radio" name="conflict[{files.FILENAME}]" value="1" checked="checked" /> {L_MERGE_NO_MERGE_NEW_OPTION}</label></dt>
-								<dd style="margin-left: 60%;"><!-- IF not files.S_BINARY -->[<a href="{files.U_VIEW_NO_MERGE_NEW}" onclick="diff_popup('{files.U_VIEW_NO_MERGE_NEW}'); return false;">{L_SHOW_DIFF_FINAL}</a>]<!-- ELSE -->&nbsp;<!-- ENDIF --></dd>
+								<dd style="margin-left: 60%;"><!-- IF not files.S_BINARY -->[<a href="{files.U_VIEW_NO_MERGE_NEW}" onclick="diff_popup(this.href); return false;">{L_SHOW_DIFF_FINAL}</a>]<!-- ELSE -->&nbsp;<!-- ENDIF --></dd>
 							</dl>
 							<dl>
 								<dt style="width: 60%"><label><input type="radio" class="radio" name="conflict[{files.FILENAME}]" value="2" /> {L_MERGE_NO_MERGE_MOD_OPTION}</label></dt>
-								<dd style="margin-left: 60%;"><!-- IF not files.S_BINARY -->[<a href="{files.U_VIEW_NO_MERGE_MOD}" onclick="diff_popup('{files.U_VIEW_NO_MERGE_MOD}'); return false;">{L_SHOW_DIFF_FINAL}</a>]<!-- ELSE -->&nbsp;<!-- ENDIF --></dd>
+								<dd style="margin-left: 60%;"><!-- IF not files.S_BINARY -->[<a href="{files.U_VIEW_NO_MERGE_MOD}" onclick="diff_popup(this.href); return false;">{L_SHOW_DIFF_FINAL}</a>]<!-- ELSE -->&nbsp;<!-- ENDIF --></dd>
 							</dl>
 								<!-- IF not files.S_BINARY -->
 									<dl>
 										<dt style="width: 60%"><label><input type="radio" class="radio" name="conflict[{files.FILENAME}]" value="3" /> {L_MERGE_NEW_FILE_OPTION}</label></dt>
-										<dd style="margin-left: 60%;">[<a href="{files.U_VIEW_NEW_FILE}" onclick="diff_popup('{files.U_VIEW_NEW_FILE}'); return false;">{L_SHOW_DIFF_FINAL}</a>]</dd>
+										<dd style="margin-left: 60%;">[<a href="{files.U_VIEW_NEW_FILE}" onclick="diff_popup(this.href); return false;">{L_SHOW_DIFF_FINAL}</a>]</dd>
 									</dl>
 									<dl>
 										<dt style="width: 60%"><label><input type="radio" class="radio" name="conflict[{files.FILENAME}]" value="4" /> {L_MERGE_MOD_FILE_OPTION}</label></dt>
-										<dd style="margin-left: 60%;">[<a href="{files.U_VIEW_MOD_FILE}" onclick="diff_popup('{files.U_VIEW_MOD_FILE}'); return false;">{L_SHOW_DIFF_FINAL}</a>]</dd>
+										<dd style="margin-left: 60%;">[<a href="{files.U_VIEW_MOD_FILE}" onclick="diff_popup(this.href); return false;">{L_SHOW_DIFF_FINAL}</a>]</dd>
 									</dl>
 								<!-- ENDIF -->
 							<!-- IF not files.S_LAST_ROW -->
@@ -262,7 +272,7 @@
 				<!-- ENDIF -->
 			<!-- END files -->
 
-			</fieldset>
+			</fieldset></div>
 		<!-- ENDIF -->
 
 		<br />
@@ -287,14 +297,14 @@
 
 <!-- ELSEIF S_DOWNLOAD_FILES -->
 
-	<h1>{L_SELECT_DOWNLOAD_FORMAT}</h1>
+	<h1>{L_DOWNLOAD_UPDATE_METHOD}</h1>
 
 	<p>{L_DOWNLOAD_UPDATE_METHOD_EXPLAIN}</p>
 
 	<form id="install_update" method="post" action="{U_ACTION}">
 
 	<fieldset>
-		<legend>{L_DOWNLOAD_AS}</legend>
+		<legend>{L_SELECT_DOWNLOAD_FORMAT}</legend>
 	<dl>
 		<dt><label for="use_method">{L_DOWNLOAD_AS}:</label></dt>
 		<dd>{RADIO_BUTTONS}</dd>

phpBB/adm/style/install_update_diff.html

@@ -12,7 +12,7 @@
 <link href="../adm/style/admin.css" rel="stylesheet" type="text/css" media="screen" />
 
 <script type="text/javascript">
-<!--
+// <![CDATA[
 function resize_panel()
 {
 	var block = document.getElementById('codepanel');	
@@ -28,7 +28,7 @@ function resize_panel()
 		//whatever IE needs to do this
 	}	
 }
--->
+// ]]>
 </script>
 
 <style type="text/css">

phpBB/adm/style/overall_header.html

@@ -12,11 +12,11 @@
 <link href="style/admin.css" rel="stylesheet" type="text/css" media="screen" />
 
 <script type="text/javascript">
-<!--
+// <![CDATA[
 var jump_page = '{LA_JUMP_PAGE}:';
 var on_page = '{ON_PAGE}';
 var per_page = '{PER_PAGE}';
-var base_url = '{BASE_URL}';
+var base_url = '{A_BASE_URL}';
 
 var menu_state = 'shown';
 
@@ -81,34 +81,26 @@ function marklist(id, name, state)
 	}
 }
 
-/**
-* Open trace popup
-*/
-function trace(link)
-{
-	window.open(link.replace(/&amp;/g, '&'), '_trace', 'height=515, resizable=yes, scrollbars=yes, width=750');
-	return false;
-}
-
 /**
 * Find a member
 */
-function find_username()
+function find_username(url)
 {
-	<!-- IF UA_FIND_USERNAME -->
+	popup(url, 760, 570, '_usersearch');
-	window.open('{UA_FIND_USERNAME}', '_usersearch', 'height=570, resizable=yes, scrollbars=yes, width=760');
-	<!-- ENDIF -->
 	return false;
 }
 
 /**
-* Color swatch
+* Window popup
 */
-function swatch(field)
+function popup(url, width, height, name)
 {
-	<!-- IF UA_SWATCH -->
+	if (!name)
-	window.open('{UA_SWATCH}' + field, '_swatch', 'height=150, resizable=yes, scrollbars=no, width=636');
+	{
-	<!-- ENDIF -->
+		name = '_popup';
+	}
+
+	window.open(url.replace(/&amp;/g, '&'), name, 'height=' + height + ',resizable=yes,scrollbars=yes, width=' + width);
 	return false;
 }
 
@@ -162,7 +154,7 @@ function switch_menu()
 	}
 }
 
-//-->
+// ]]>
 </script>
 </head>
 

phpBB/adm/style/permission_mask.html

@@ -1,6 +1,6 @@
 
 <script type="text/javascript">
-<!--
+// <![CDATA[
 	var active_pmask = '0';
 	var active_fmask = '0';
 	var active_cat = '0';
@@ -12,7 +12,7 @@
 	<!-- IF S_ROLE_JS_ARRAY -->
 		{S_ROLE_JS_ARRAY}
 	<!-- ENDIF -->
-//-->
+// ]]>
 </script>
 <script type="text/javascript" src="style/permissions.js"></script>
 
@@ -102,7 +102,7 @@
 				<tbody>
 				<!-- BEGIN mask -->
 					<!-- IF p_mask.f_mask.category.mask.S_ROW_COUNT is even --><tr class="row4"><!-- ELSE --><tr class="row3"><!-- ENDIF -->
-					<th class="permissions-name<!-- IF p_mask.f_mask.category.mask.S_ROW_COUNT is even --> row4<!-- ELSE --> row3<!-- ENDIF -->"><!-- IF p_mask.f_mask.category.mask.U_TRACE --><a href="#" class="trace" onclick="trace('{p_mask.f_mask.category.mask.U_TRACE}'); return false;" title="{L_TRACE_SETTING}"><img src="images/icon_trace.gif" alt="{L_TRACE_SETTING}" /></a> <!-- ENDIF -->{p_mask.f_mask.category.mask.PERMISSION}</th>
+					<th class="permissions-name<!-- IF p_mask.f_mask.category.mask.S_ROW_COUNT is even --> row4<!-- ELSE --> row3<!-- ENDIF -->"><!-- IF p_mask.f_mask.category.mask.U_TRACE --><a href="{p_mask.f_mask.category.mask.U_TRACE}" class="trace" onclick="popup(this.href, 750, 515, '_trace'); return false;" title="{L_TRACE_SETTING}"><img src="images/icon_trace.gif" alt="{L_TRACE_SETTING}" /></a> <!-- ENDIF -->{p_mask.f_mask.category.mask.PERMISSION}</th>
 					<!-- IF p_mask.S_VIEW -->
 						<td<!-- IF p_mask.f_mask.category.mask.S_YES --> class="yes"<!-- ENDIF -->>&nbsp;</td>
 						<td<!-- IF p_mask.f_mask.category.mask.S_NEVER --> class="never"<!-- ENDIF -->></td>

phpBB/adm/style/progress_bar.html

@@ -1,7 +1,7 @@
 <!-- INCLUDE simple_header.html -->
 
 <script type="text/javascript">
-<!--
+// <![CDATA[
 	/**
 	* Close previously opened popup
 	*/
@@ -22,7 +22,7 @@
 		setTimeout("close_popup()", 1000);
 		return 0;
 	}
-//-->
+// ]]>
 </script>
 
 <div class="successbox">
@@ -32,9 +32,9 @@
 </div>
 
 <script type="text/javascript">
-<!--
+// <![CDATA[
 	close_popup();
-//-->
+// ]]>
 </script>
 
 <!-- INCLUDE simple_footer.html -->

phpBB/adm/style/simple_footer.html

@@ -1,4 +1,4 @@
-		<div style="text-align: right;"><a href="#" onclick="self.close(); return false;">{L_CLOSE_WINDOW}</a></div>
+		<div style="text-align: {S_CONTENT_FLOW_END};"><a href="#" onclick="self.close(); return false;">{L_CLOSE_WINDOW}</a></div>
 	<br /><br />
 </div>
 

phpBB/adm/style/simple_header.html

@@ -12,11 +12,25 @@
 <link href="style/admin.css" rel="stylesheet" type="text/css" media="screen" />
 
 <script type="text/javascript">
-<!--
+// <![CDATA[
 var jump_page = '{LA_JUMP_PAGE}:';
 var on_page = '{ON_PAGE}';
 var per_page = '{PER_PAGE}';
-var base_url = '{BASE_URL}';
+var base_url = '{A_BASE_URL}';
+
+/**
+* Window popup
+*/
+function popup(url, width, height, name)
+{
+	if (!name)
+	{
+		name = '_popup';
+	}
+
+	window.open(url.replace(/&amp;/g, '&'), name, 'height=' + height + ',resizable=yes,scrollbars=yes, width=' + width);
+	return false;
+}
 
 /**
 * Jump to page
@@ -76,26 +90,13 @@ function marklist(id, name, state)
 /**
 * Find a member
 */
-function find_username()
+function find_username(url)
 {
-	<!-- IF UA_FIND_USERNAME -->
+	popup(url, 760, 570, '_usersearch');
-	window.open('{UA_FIND_USERNAME}', '_usersearch', 'height=570, resizable=yes, scrollbars=yes, width=760');
-	<!-- ENDIF -->
 	return false;
 }
 
-/**
+// ]]>
-* Color swatch
-*/
-function swatch(field)
-{
-	<!-- IF UA_SWATCH -->
-	window.open('{UA_SWATCH}' + field, '_swatch', 'height=150, resizable=yes, scrollbars=no, width=636');
-	<!-- ENDIF -->
-	return false;
-}
-
-//-->
 </script>
 </head>
 

phpBB/adm/swatch.php

@@ -1,10 +1,10 @@
 <?php
-/** 
+/**
 *
 * @package phpBB3
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
@@ -12,6 +12,7 @@
 * @ignore
 */
 define('IN_PHPBB', true);
+define('ADMIN_START', true);
 $phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './../';
 $phpEx = substr(strrchr(__FILE__, '.'), 1);
 include($phpbb_root_path . 'common.' . $phpEx);
@@ -28,9 +29,16 @@ $template->set_filenames(array(
 	'body' => 'colour_swatch.html')
 );
 
+$form = request_var('form', '');
+$name = request_var('name', '');
+
+// We validate form and name here, only id/class allowed
+$form = (!preg_match('/^[a-z0-9_-]+$/i', $form)) ? '' : $form;
+$name = (!preg_match('/^[a-z0-9_-]+$/i', $name)) ? '' : $name;
+
 $template->assign_vars(array(
-	'OPENER'		=> addslashes(request_var('form', '')),
+	'OPENER'		=> $form,
-	'NAME'			=> request_var('name', ''),
+	'NAME'			=> $name,
 	'T_IMAGES_PATH'	=> "{$phpbb_root_path}images/",
 
 	'S_USER_LANG'			=> $user->lang['USER_LANG'],

phpBB/common.php

@@ -1,10 +1,10 @@
 <?php
-/** 
+/**
 *
 * @package phpBB3
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 * Minimum Requirement: PHP 4.3.3
 */
@@ -65,8 +65,26 @@ function deregister_globals()
 	{
 		if (isset($not_unset[$varname]))
 		{
-			// Hacking attempt. No point in continuing.
+			// Hacking attempt. No point in continuing unless it's a COOKIE
-			exit;
+			if ($varname !== 'GLOBALS' || isset($_GET['GLOBALS']) || isset($_POST['GLOBALS']) || isset($_SERVER['GLOBALS']) || isset($_SESSION['GLOBALS']) || isset($_ENV['GLOBALS']) || isset($_FILES['GLOBALS']))
+			{
+				exit;
+			}
+			else
+			{
+				$cookie = &$_COOKIE;
+				while (isset($cookie['GLOBALS']))
+				{
+					foreach ($cookie['GLOBALS'] as $registered_var => $value)
+					{
+						if (!isset($not_unset[$registered_var]))
+						{
+							unset($GLOBALS[$registered_var]);
+						}
+					}
+					$cookie = &$cookie['GLOBALS'];
+				}
+			}
 		}
 
 		unset($GLOBALS[$varname]);
@@ -88,7 +106,7 @@ else
 	set_magic_quotes_runtime(0);
 
 	// Be paranoid with passed vars
-	if (@ini_get('register_globals') == '1' || strtolower(@ini_get('register_globals')) == 'on')
+	if (@ini_get('register_globals') == '1' || strtolower(@ini_get('register_globals')) == 'on' || !function_exists('ini_get'))
 	{
 		deregister_globals();
 	}
@@ -166,13 +184,16 @@ require($phpbb_root_path . 'includes/cache.' . $phpEx);
 require($phpbb_root_path . 'includes/template.' . $phpEx);
 require($phpbb_root_path . 'includes/session.' . $phpEx);
 require($phpbb_root_path . 'includes/auth.' . $phpEx);
+
 require($phpbb_root_path . 'includes/functions.' . $phpEx);
+require($phpbb_root_path . 'includes/functions_content.' . $phpEx);
+
 require($phpbb_root_path . 'includes/constants.' . $phpEx);
 require($phpbb_root_path . 'includes/db/' . $dbms . '.' . $phpEx);
 require($phpbb_root_path . 'includes/utf/utf_tools.' . $phpEx);
 
 // Set PHP error handler to ours
-set_error_handler('msg_handler');
+set_error_handler(defined('PHPBB_MSG_HANDLER') ? PHPBB_MSG_HANDLER : 'msg_handler');
 
 // Instantiate some basic classes
 $user		= new user();
@@ -190,4 +211,13 @@ unset($dbpasswd);
 // Grab global variables, re-cache if necessary
 $config = $cache->obtain_config();
 
+// Add own hook handler
+require($phpbb_root_path . 'includes/hooks/index.' . $phpEx);
+$phpbb_hook = new phpbb_hook(array('exit_handler', 'phpbb_user_session_handler', 'append_sid', array('template', 'display')));
+
+foreach ($cache->obtain_hooks() as $hook)
+{
+	@include($phpbb_root_path . 'includes/hooks/' . $hook . '.' . $phpEx);
+}
+
 ?>

phpBB/cron.php

@@ -1,10 +1,10 @@
 <?php
-/** 
+/**
 *
 * @package phpBB3
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
@@ -33,7 +33,7 @@ echo base64_decode('R0lGODlhAQABAIAAAP///wAAACH5BAEAAAAALAAAAAABAAEAAAICRAEAOw==
 // test without flush ;)
 // flush();
 
-// 
+//
 if (!isset($config['cron_lock']))
 {
 	set_config('cron_lock', '0', true);
@@ -79,6 +79,12 @@ switch ($cron_type)
 			break;
 		}
 
+		// A user reported using the mail() function while using shutdown does not work. We do not want to risk that.
+		if ($use_shutdown_function && !$config['smtp_delivery'])
+		{
+			$use_shutdown_function = false;
+		}
+
 		include_once($phpbb_root_path . 'includes/functions_messenger.' . $phpEx);
 		$queue = new queue();
 
@@ -253,18 +259,29 @@ switch ($cron_type)
 // Unloading cache and closing db after having done the dirty work.
 if ($use_shutdown_function)
 {
+	register_shutdown_function('unlock_cron');
 	register_shutdown_function('garbage_collection');
 }
 else
 {
+	unlock_cron();
 	garbage_collection();
 }
 
-$sql = 'UPDATE ' . CONFIG_TABLE . "
-	SET config_value = '0'
-	WHERE config_name = 'cron_lock' AND config_value = '" . $db->sql_escape(CRON_ID) . "'";
-$db->sql_query($sql);
-
 exit;
 
+
+/**
+* Unlock cron script
+*/
+function unlock_cron()
+{
+	global $db;
+
+	$sql = 'UPDATE ' . CONFIG_TABLE . "
+		SET config_value = '0'
+		WHERE config_name = 'cron_lock' AND config_value = '" . $db->sql_escape(CRON_ID) . "'";
+	$db->sql_query($sql);
+}
+
 ?>

phpBB/develop/create_schema_files.php

@@ -1,10 +1,10 @@
 <?php
-/** 
+/**
 *
 * @package phpBB3
 * @version $Id$
-* @copyright (c) 2006 phpBB Group 
+* @copyright (c) 2006 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 * This file creates new schema files for every database.
 * The filenames will be prefixed with an underscore to not overwrite the current schema files.
@@ -323,7 +323,7 @@ foreach ($supported_dbms as $dbms)
 		}
 
 		// Table specific so we don't get overlap
-		$modded_array = array(); 
+		$modded_array = array();
 
 		// Write columns one by one...
 		foreach ($table_data['COLUMNS'] as $column_name => $column_data)
@@ -1285,7 +1285,7 @@ function get_schema_struct()
 			'post_checksum'			=> array('VCHAR:32', ''),
 			'post_attachment'		=> array('BOOL', 0),
 			'bbcode_bitfield'		=> array('VCHAR:255', ''),
-			'bbcode_uid'			=> array('VCHAR:5', ''),
+			'bbcode_uid'			=> array('VCHAR:8', ''),
 			'post_postcount'		=> array('BOOL', 1),
 			'post_edit_time'		=> array('TIMESTAMP', 0),
 			'post_edit_reason'		=> array('STEXT_UNI', ''),
@@ -1322,7 +1322,7 @@ function get_schema_struct()
 			'message_edit_user'		=> array('UINT', 0),
 			'message_attachment'	=> array('BOOL', 0),
 			'bbcode_bitfield'		=> array('VCHAR:255', ''),
-			'bbcode_uid'			=> array('VCHAR:5', ''),
+			'bbcode_uid'			=> array('VCHAR:8', ''),
 			'message_edit_time'		=> array('TIMESTAMP', 0),
 			'message_edit_count'	=> array('USINT', 0),
 			'to_address'			=> array('TEXT_UNI', ''),
@@ -1829,7 +1829,7 @@ function get_schema_struct()
 			'user_avatar_width'			=> array('USINT', 0),
 			'user_avatar_height'		=> array('USINT', 0),
 			'user_sig'					=> array('MTEXT_UNI', ''),
-			'user_sig_bbcode_uid'		=> array('VCHAR:5', ''),
+			'user_sig_bbcode_uid'		=> array('VCHAR:8', ''),
 			'user_sig_bbcode_bitfield'	=> array('VCHAR:255', ''),
 			'user_from'					=> array('VCHAR_UNI:100', ''),
 			'user_icq'					=> array('VCHAR:15', ''),
@@ -1842,6 +1842,8 @@ function get_schema_struct()
 			'user_interests'			=> array('TEXT_UNI', ''),
 			'user_actkey'				=> array('VCHAR:32', ''),
 			'user_newpasswd'			=> array('VCHAR_UNI:32', ''),
+			'user_form_salt'			=> array('VCHAR_UNI:32', ''),
+
 		),
 		'PRIMARY_KEY'	=> 'user_id',
 		'KEYS'			=> array(
@@ -1906,17 +1908,17 @@ function custom_data($dbms)
 
 /*
 CREATE TABLESPACE "PHPBB"
-	LOGGING 
+	LOGGING
-	DATAFILE 'E:\ORACLE\ORADATA\LOCAL\PHPBB.ora' 
+	DATAFILE 'E:\ORACLE\ORADATA\LOCAL\PHPBB.ora'
 	SIZE 10M
 	AUTOEXTEND ON NEXT 10M
 	MAXSIZE 100M;
 
-CREATE USER "PHPBB" 
+CREATE USER "PHPBB"
-	PROFILE "DEFAULT" 
+	PROFILE "DEFAULT"
-	IDENTIFIED BY "phpbb_password" 
+	IDENTIFIED BY "phpbb_password"
-	DEFAULT TABLESPACE "PHPBB" 
+	DEFAULT TABLESPACE "PHPBB"
-	QUOTA UNLIMITED ON "PHPBB" 
+	QUOTA UNLIMITED ON "PHPBB"
 	ACCOUNT UNLOCK;
 
 GRANT ANALYZE ANY TO "PHPBB";
@@ -2020,4 +2022,6 @@ EOF;
 	return '';
 }
 
+echo 'done';
+
 ?>

phpBB/develop/generate_utf_casefold.php

@@ -1,10 +1,10 @@
 <?php
-/** 
+/**
 *
 * @package phpBB3
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 

phpBB/develop/generate_utf_confusables.php

@@ -1,10 +1,10 @@
 <?php
-/** 
+/**
 *
 * @package phpBB3
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 

phpBB/develop/generate_utf_tables.php

@@ -1,10 +1,10 @@
 <?php
-/** 
+/**
 *
 * @package phpBB3
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 

phpBB/develop/search_fill.php

@@ -1,4 +1,4 @@
-<?php 
+<?php
 
 //
 // Security message:
@@ -54,9 +54,9 @@ print "<html>\n<body>\n";
 //
 // Fetch a batch of posts_text entries
 //
-$sql = "SELECT COUNT(*) as total, MAX(post_id) as max_post_id 
+$sql = "SELECT COUNT(*) as total, MAX(post_id) as max_post_id
 	FROM ". POSTS_TABLE;
-if ( !($result = $db->sql_query($sql)) ) 
+if ( !($result = $db->sql_query($sql)) )
 {
 	$error = $db->sql_error();
 	die("Couldn't get maximum post ID :: " . $sql . " :: " . $error['message']);
@@ -77,10 +77,10 @@ for(;$postcounter <= $max_post_id; $postcounter += $batchsize)
 	$batchend = $postcounter + $batchsize;
 	$batchcount++;
 	
-	$sql = "SELECT * 
+	$sql = "SELECT *
-		FROM " . POSTS_TABLE . " 
+		FROM " . POSTS_TABLE . "
-		WHERE post_id 
+		WHERE post_id
-			BETWEEN $batchstart 
+			BETWEEN $batchstart
 				AND $batchend";
 	if( !($result = $db->sql_query($sql)) )
 	{
@@ -97,16 +97,16 @@ for(;$postcounter <= $max_post_id; $postcounter += $batchsize)
 	{
 
 	// $sql = "LOCK TABLES ".POST_TEXT_TABLE." WRITE";
-	// $result = $db->sql_query($sql); 
+	// $result = $db->sql_query($sql);
 		print "\n<p>\n<a href='{$_SERVER['PHP_SELF']}?batchstart=$batchstart'>Restart from posting $batchstart</a><br>\n";
 
 		// For every post in the batch:
 		for($post_nr = 0; $post_nr < $post_rows; $post_nr++ )
-		{ 
+		{
 			print ".";
 			flush();
 
-			$post_id = $rowset[$post_nr]['post_id']; 
+			$post_id = $rowset[$post_nr]['post_id'];
 
 			$search->index('post', $rowset[$post_nr]['post_id'], $rowset[$post_nr]['post_text'], $rowset[$post_nr]['post_subject'], $rowset[$post_nr]['poster_id']);
 		}

phpBB/develop/utf_normalizer_test.php

@@ -1,10 +1,10 @@
 <?php
-/** 
+/**
 *
 * @package phpBB3
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 

phpBB/docs/AUTHORS

@@ -1,4 +1,4 @@
-/** 
+/**
 *
 * phpBB3 © Copyright 2000, 2002, 2005, 2007 phpBB Group
 * http://www.phpbb.com

phpBB/docs/CHANGELOG.html

@@ -1,164 +1,43 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en" xml:lang="en">
-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
 <head>
-<title>phpBB 3.0.x Changelog</title>
+
-<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
-<meta http-equiv="Content-Style-Type" content="text/css" />
+<meta http-equiv="content-style-type" content="text/css" />
+<meta http-equiv="content-language" content="en" />
+<meta http-equiv="imagetoolbar" content="no" />
 <meta name="resource-type" content="document" />
-<meta name="description" lang="en" content="phpBB 3.0.x Changelog" />
+<meta name="distribution" content="global" />
-<meta name="keywords" lang="en" content="" />
+<meta name="copyright" content="2007 phpBB Group" />
-<meta name="author" content="phpBB Group" />
+<meta name="keywords" content="" />
-<meta name="copyright" content="phpBB Group" />
+<meta name="description" content="phpBB 3.0.x Changelog" />
-<meta name="MSSmartTagsPreventParsing" content="true" />
+<title>phpBB3 &bull; Changelog</title>
 
-<style type="text/css">
+<link href="stylesheet.css" rel="stylesheet" type="text/css" media="screen, projection" />
-<!--
-
-/* The original "subSilver" theme for phpBB2 Created by subBlue design :: http://www.subBlue.com */
-body {
-	background-color: white;
-	font-family: Verdana, Arial, Helvetica, sans-serif;
-	margin: 0;
-	border: 0;
-	padding: 0;
-}
-
-img {
-	border: 0;
-}
-
-p {
-	font-size: 8pt;
-}
-
-hr {
-	height: 0;
-	border: solid #D1D7DC 0;
-	border-top-width: 1px;
-}
-
-#title, h1 {
-	font: bold 18pt 'Trebuchet MS', Verdana, sans-serif;
-	text-decoration: none;
-	line-height: 120%;
-}
-
-h2 {
-	font: bold 12pt Arial, Helvetica, sans-serif;
-	text-decoration: none;
-	line-height: 120%;
-}
-
-h3 {
-	font: bold 10pt Arial, Helvetica, sans-serif;
-	text-decoration: none;
-	line-height: 120%;
-}
-
-.paragraph {
-	margin-left: 20px;
-}
-
-/* Structure */
-#logo {
-	background: #fff url(header_bg.jpg) repeat-x top right;
-	height: 60px;
-}
-
-#title {
-	color: #12749b;
-	float: right;
-	margin: 10px 10px 0;
-}
-
-#main {
-	margin-left: 25px;
-	margin-right: 25px;
-}
-
-.good {
-	color: green;
-}
-
-.bad {
-	color: red;
-}
-
-#footer {
-	margin-left: 75px;
-	font-size: 70%;
-	color: #006600;
-}
-
-code {
-	color: #006600;
-	font-weight: normal;
-	font-family: 'Courier New', monospace;
-	border-color: #D1D7DC;
-	border-width: 1px;
-	border-style: solid;
-	background-color: #FAFAFA;
-}
-
-.indent p {
-	padding-left: 20px;
-	font-size: 90%;
-}
-
-/* Anchors */
-a {
-	font-size: 70%;
-}
-
-a:link, a:active, a:visited {
-	color:	#006699;
-	text-decoration: none;
-}
-
-a:hover {
-	color: #DD6900;
-	text-decoration: underline;
-}
-
-a.nav {
-	color: #006699;
-	text-decoration: none;
-}
-
-a.nav:hover {
-	text-decoration: underline;
-}
-
-p a {
-	font-size: 100%;
-}
-
-.menu {
-	font-size: 80%;
-}
-
-.menu li a {
-	font-size: 100%;
-}
-
-.comment {
-	color: green;
-}
-
-//-->
-</style>
 
 </head>
 
-<body>
+<body id="phpbb" class="section-docs">
 
-<div id="logo">
+<div id="wrap">
-	<div id="title">phpBB 3.0.x Changelog</div>
+	<a id="top" name="top" accesskey="t"></a>
-	<img src="header_left.jpg" alt="phpBB Logo" />
+	<div id="page-header">
-</div>
+		<div class="headerbar">
+			<div class="inner"><span class="corners-top"><span></span></span>
 
-<a name="top"></a><div id="main">
+			<div id="doc-description">
+				<a href="../index.php" id="logo"><img src="site_logo.gif" alt="" /></a>
+				<h1>phpBB 3.0.x Changelog</h1>
+				<p style="display: none;"><a href="#start_here">Skip</a></p>
+			</div>
+
+			<span class="corners-bottom"><span></span></span></div>
+		</div>
+	</div>
+
+	<a name="start_here"></a>
+
+	<div id="page-body">
 
 <!-- BEGIN DOCUMENT -->
 
@@ -166,9 +45,15 @@ p a {
 
 <h1>Changelog</h1>
 
-<ol class="menu">
+	<div class="paragraph menu">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
+
+<ol>
 	<li><a href="#changelog">Changelog</a>
-	<ol type="i">
+	<ol style="list-style-type: lower-roman;">
+		<li><a href="#v30rc5">Changes since RC-5</a></li>
 		<li><a href="#v30rc4">Changes since RC-4</a></li>
 		<li><a href="#v30rc3">Changes since RC-3</a></li>
 		<li><a href="#v30rc2">Changes since RC-2</a></li>
@@ -178,17 +63,86 @@ p a {
 	<li><a href="#disclaimer">Copyright and disclaimer</a></li>
 </ol>
 
-<hr />
+		</div>
 
-<a name="changelog"></a><h1>1. Changelog</h1>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<hr />
+
+	<a name="changelog"></a><h2>1. Changelog</h2>
 
-	<a name="v30rc4"></a><b>1.i. Changes since 3.0.RC4</b>
-	<br /><br />
 	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
 
-	<p>These fixes/changes are currently only present within CVS and will appear within the next phpBB3 version.</p>
+		<div class="content">
 
-	<ul class="menu">
+	<a name="v30rc5"></a><h3>1.i. Changes since 3.0.RC5</h3>
+
+	<ul>
+		<li>[Feature] Removing constant PHPBB_EMBEDDED in favor of using an exit_handler(); the constant was meant to achive this more or less.</li>
+		<li>[Feature] Constant PHPBB_ADMIN_PATH introduced, having the same purpose as PHPBB_ROOT_PATH, but for the ACP.</li>
+		<li>[Fix] Further fixing user profile view (please do not forget to update/refresh your template and style) (Bug #14230)</li>
+		<li>[Fix] Adjust google adsense bot information (Bug #14296)</li>
+		<li>[Fix] Fix horizontal scrollbar problem in IE6 (Bug #14228) - fix provided by Danny-dev</li>
+		<li>[Fix] Use correct size values in ACP user signature screen (Bug #13367)</li>
+		<li>[Fix] Attachment Place inline won't work with single quotes (Bug #14291)</li>
+		<li>[Fix] Unable to save email templates through ACP language page (Bug #14266)</li>
+		<li>[Fix] Correctly set user style for guest user (able to be changed within user management)</li>
+		<li>[Change] Moved note about dns_get_record function for using GTalk (Jabber) from Jabber log to Jabber ACP panel</li>
+		<li>[Fix] Do not use register_shutdown_function within cron.php if handling the queue and the mail function being used (Bug #14321)</li>
+		<li>[Fix] Fixing private message on-hold code if moving messages into folder based on rules (Bug #14309)</li>
+		<li>[Fix] Allow the merge selection screen to work (Bug #14363)</li>
+		<li>[Change] Require additional permissions for copying permission when editing forums </li>
+		<li>[Fix] Local magic URLs no longer get an additional trailing slash (Bug #14362)</li>
+		<li>[Fix] Do not let the cron script stale for one hour if register_shutdown_function is not able to be called (Bug #14436)</li>
+		<li>[Feature] Added /includes/db/db_tools.php file, which includes tools for handling cross-db actions such as altering columns, etc.</li>
+		<li>[Change] Reset the start parameter when the timeframe is changed in the mcp topic page (Ticket #14438)</li>
+		<li>[Change] Added Code for cleaning the confirm table to the session garbage collection</li>
+		<li>[Fix] Fixed token handling in jabber class for extremely spec-compilant XMPP server (Bug #14445)</li>
+		<li>[Fix] Disallowed galleries from using special characters (Bug #14466)</li>
+		<li>[Change] Listing the board url within the email text instead of appending it to the subject (Bug #14378)</li>
+		<li>[Fix] Always display the quote button as the most accessible one - edit is always before quote (Bug #14403)</li>
+		<li>[Fix] Use correct dimension (width x height) in ACP (Bug #14452)</li>
+		<li>[Fix] Only display PM history links if there are PM's to be displayed (Bug #14484)</li>
+		<li>[Feature] Added completely new hook system to allow better application/mod integration - see docs/hook_system.html</li>
+		<li>[Fix] Correctly delete excess poll options (Bug #14566)</li>
+		<li>[Fix] Allow names evaluating to false for poll options</li>
+		<li>[Change] use in-build functions for user online list (Bug #14596) - provided by rxu</li>
+		<li>[Fix] Fixing google cache display problems with Firefox (Bug #14472) - patch provided by Raimon</li>
+		<li>[Fix] Prevent topic unlocking if locked by someone else while posting (Bug #10307)</li>
+		<li>[Change] Allow years in future be selected for date custom profile field (Bug #14519)</li>
+		<li>[Fix] Don't display &quot;Avatars Disabled&quot; message on edit groups in UCP (Bug #14636)</li>
+		<li>[Change] Require confirm for deleting inactive users. (Bug #14641)</li>
+		<li>[Fix] Match custom BBCodes in the same way during first and second pass - patch provided by IBBoard (Bug #14268)</li>
+		<li>[Fix] Correct quote parsing if opening bracket before opening quote (Bug #14667)</li>
+		<li>[Fix] Clean post message for checking length to prevent posting empty messages</li>
+		<li>[Fix] Display jumpbox if needed for functionality (Bug #14702)</li>
+		<li>[Feature] Added an option to enforce that users spend a configurable amount of time on the terms page during registration</li>
+		<li>[Fix] Fixed copy permissions box in the ACP</li>
+		<li>[Fix] Enforce types for the user table during conversions</li>
+		<li>[Sec] Fixing possible XSS through compromised WHOIS server (#i63, #i64)</li>
+		<li>[Sec] Missing access control on whois in viewonline.php (#i51)</li>
+		<li>[Sec] Encoding some variables within user::page array correctly (to cope with browser not doing it correctly) to prevent XSS through functions re-using them (#i61)</li>
+		<li>[Sec] Fixed XSS through memberlist search feature (#i62)</li>
+		<li>[Sec] Fixed XSS through colour swatch (#i65)</li>
+		<li>[Sec] Fixed insecure attachment deletion (#i53)</li>
+		<li>[Sec] Only allow whitelisted protocols in meta_redirect/redirect (#i66)</li>
+		<li>[Sec] Check file names to be written in language management panel (#i52)</li>
+		<li>[Sec] Deregister globals if ini_get has been disabled (#i112)</li>
+		<li>[Sec] Added form tokens to most forms to enforce a lighter variant of CSRF protection (#i91 - #i96)</li>
+		<li>[Sec] Use new password hash method for forum passwords (#i43)</li>
+		<li>[Sec] Changed download file location to prevent flash crossdomain policies taking effect (#i8)</li>
+		<li>[Sec] Do not allow autocompletion for password on admin re-authentication (#i41)</li>
+		<li>[Sec] Made sure users are not completely locked out if they have a GLOBALS cookie (#i101)</li>
+		<li>[Sec] Use the secure hash to generate BBCODE_UIDs (#i71)</li>
+		<li>[Sec] Increase the length of BBCODE_UIDs (#i72)</li>
+		<li>[Sec] New password hashing mechanism for storing passwords (#i42)</li>
+	</ul>
+
+	<a name="v30rc4"></a><h3>1.ii. Changes since 3.0.RC4</h3>
+
+	<ul>
 		<li>[Fix] MySQL, PostgreSQL and SQLite related database fixes (Bug #13862)</li>
 		<li>[Fix] Allow MS SQL to properly connect when using the mssql driver and PHP is less than either 4.4.1 or 5.1 (Bug #13874)</li>
 		<li>[Fix] Ignore files containing HTML special chars in the filenames as gallery avatars (Bug #13906)</li>
@@ -237,17 +191,9 @@ p a {
 		<li>[Fix] odbc_autocommit causing existing result sets to be dropped (Bug #14182)</li>
 	</ul>
 
-	</div>
+	<a name="v30rc3"></a><h3>1.iii. Changes since 3.0.RC3</h3>
-	<a href="#top">Top</a>
-	<br /><br />
 
-	<hr />
+	<ul>
-
-	<a name="v30rc3"></a><b>1.ii. Changes since 3.0.RC3</b>
-	<br /><br />
-	<div class="paragraph">
-
-	<ul class="menu">
 		<li>[Fix] Fixing some subsilver2 and prosilver style issues</li>
 		<li>[Fix] Parse error in MCP ban (Bug #13109)</li>
 		<li>[Fix] Correctly hide online status in the profile (Bug #13059)</li>
@@ -354,17 +300,9 @@ p a {
 
 	</ul>
 
-	</div>
+	<a name="v30rc2"></a><h3>1.iv. Changes since 3.0.RC2</h3>
-	<a href="#top">Top</a>
-	<br /><br />
 
-	<hr />
+	<ul>
-
-	<a name="v30rc2"></a><b>1.iii. Changes since 3.0.RC2</b>
-	<br /><br />
-	<div class="paragraph">
-
-	<ul class="menu">
 		<li>[Fix] Re-allow searching within the memberlist</li>
 		<li>[Fix] Force prune related values to integers during conversions</li>
 		<li>[Fix] Updater now detects successfully merged files having conflicts and user chose to merge with modifications (Bug #12685)</li>
@@ -408,17 +346,9 @@ p a {
 
 	</ul>
 
-	</div>
+	<a name="v30rc1"></a><h3>1.v. Changes since 3.0.RC1</h3>
-	<a href="#top">Top</a>
-	<br /><br />
 
-	<hr />
+	<ul>
-
-	<a name="v30rc1"></a><b>1.iiii. Changes since 3.0.RC1</b>
-	<br /><br />
-	<div class="paragraph">
-
-	<ul class="menu">
 		<li>[Fix] (X)HTML issues within the templates (Bug #11255, #11255)</li>
 		<li>[Fix] Tiny language and grammar changes</li>
 		<li>[Fix] Several style related fixes, mainly fixing cross-browser issues</li>
@@ -535,28 +465,41 @@ p a {
 
 	</ul>
 
+		</div>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
 	</div>
-	<a href="#top">Top</a>
-	<br /><br />
 
 	<hr />
 
-<a name="disclaimer"></a><h1>2. Copyright and disclaimer</h1>
+<a name="disclaimer"></a><h2>2. Copyright and disclaimer</h2>
 
 	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 	<p>This application is opensource software released under the <a href="http://opensource.org/licenses/gpl-license.php">GPL</a>. Please see source code and the docs directory for more details. This package and its contents are Copyright (c) 2000, 2002, 2005, 2007 <a href="http://www.phpbb.com/">phpBB Group</a>, All Rights Reserved.</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
 <!-- END DOCUMENT -->
 
+	<div id="page-footer">
+		<div class="version">Note that a full list of fixed bugs can be found at the bug tracker (<a href="README.html#bugs">see section on bug reporting</a>)</div>
+	</div>
+</div></div>
+
+<div>
+	<a id="bottom" name="bottom" accesskey="z"></a>
 </div>
 
-<br /><br />
-
-<div id="footer">Note that a full list of fixed bugs can be found at the bug tracker (<a href="README.html#bugs">see section on bug reporting</a>)<br /><br /></div>
-
 </body>
-</html>
+</html>

phpBB/docs/FAQ.html

@@ -1,173 +1,58 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en" xml:lang="en">
-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
 <head>
-<title>phpBB 3.0.x FAQ</title>
+
-<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
-<meta http-equiv="Content-Style-Type" content="text/css" />
+<meta http-equiv="content-style-type" content="text/css" />
+<meta http-equiv="content-language" content="en" />
+<meta http-equiv="imagetoolbar" content="no" />
 <meta name="resource-type" content="document" />
-<meta name="description" lang="en" content="phpBB 3.0.x frequently asked questions" />
+<meta name="distribution" content="global" />
-<meta name="keywords" lang="en" content="" />
+<meta name="copyright" content="2007 phpBB Group" />
-<meta name="author" content="phpBB Group" />
+<meta name="keywords" content="" />
-<meta name="copyright" content="phpBB Group" />
+<meta name="description" content="phpBB 3.0.x frequently asked questions" />
-<meta name="MSSmartTagsPreventParsing" content="true" />
+<title>phpBB3 &bull; FAQ</title>
 
-<style type="text/css">
+<link href="stylesheet.css" rel="stylesheet" type="text/css" media="screen, projection" />
-<!--
-
-/* The original "subSilver" theme for phpBB2 Created by subBlue design :: http://www.subBlue.com */
-body {
-	background-color: white;
-	font-family: Verdana, Arial, Helvetica, sans-serif;
-	margin: 0;
-	border: 0;
-	padding: 0;
-}
-
-img {
-	border: 0;
-}
-
-p {
-	font-size: 8pt;
-}
-
-hr { 
-	height: 0; 
-	border: solid #D1D7DC 0;
-	border-top-width: 1px;
-}
-
-#title, h1 {
-	font: bold 18pt 'Trebuchet MS', Verdana, sans-serif;
-	text-decoration: none;
-	line-height: 120%;
-}
-
-h2 {
-	font: bold 12pt Arial, Helvetica, sans-serif;
-	text-decoration: none;
-	line-height: 120%;
-}
-
-h3 {
-	font: bold 10pt Arial, Helvetica, sans-serif;
-	text-decoration: none;
-	line-height: 120%;
-}
-
-.paragraph {
-	margin-left: 20px;
-}
-
-/* Structure */
-#logo {
-	background: #fff url(header_bg.jpg) repeat-x top right;
-	height: 60px;
-}
-
-#title {
-	color: #12749b;
-	float: right;
-	margin: 10px 10px 0;
-}
-
-#main {
-	margin-left: 25px;
-	margin-right: 25px;
-}
-
-.good {
-	color: green;
-}
-
-.bad {
-	color: red;
-}
-
-#footer {
-	margin-left: 75px;
-	font-size: 70%;
-	color: #006600;
-}
-
-code {
-	color: #006600; 
-	font-weight: normal;
-	font-family: 'Courier New', monospace;
-	border-color: #D1D7DC;
-	border-width: 1px;
-	border-style: solid;
-	background-color: #FAFAFA;
-}
-
-.indent p {
-	padding-left: 20px;
-	font-size: 90%;
-}
-
-/* Anchors */
-a {
-	font-size: 70%;
-}
-
-a:link, a:active, a:visited {
-	color:	#006699;
-	text-decoration: none;
-}
-
-a:hover {
-	color: #DD6900;
-	text-decoration: underline;
-}
-
-a.nav {
-	color: #006699;
-	text-decoration: none;
-}
-
-a.nav:hover {
-	text-decoration: underline;
-}
-
-p a {
-	font-size: 100%;
-}
-
-.menu {
-	font-size: 80%;
-}
-
-.menu li a {
-	font-size: 100%;
-}
-
-.comment {
-	color: green;
-}
-
-//-->
-</style>
 
 </head>
 
-<body>
+<body id="phpbb" class="section-docs">
 
-<div id="logo">
+<div id="wrap">
-	<div id="title">phpBB 3.0.x FAQ</div>
+	<a id="top" name="top" accesskey="t"></a>
-	<img src="header_left.jpg" alt="phpBB Logo" />
+	<div id="page-header">
-</div>
+		<div class="headerbar">
+			<div class="inner"><span class="corners-top"><span></span></span>
 
-<a name="top"></a><div id="main">
+			<div id="doc-description">
+				<a href="../index.php" id="logo"><img src="site_logo.gif" alt="" /></a>
+				<h1>phpBB 3.0.x FAQ</h1>
+				<p>phpBB 3.0.x frequently asked questions</p>
+				<p style="display: none;"><a href="#start_here">Skip</a></p>
+			</div>
+
+			<span class="corners-bottom"><span></span></span></div>
+		</div>
+	</div>
+
+	<a name="start_here"></a>
+
+	<div id="page-body">
 
 <!-- BEGIN DOCUMENT -->
 
-<p>This is a very basic Frequently Asked Questions (FAQ) page which attempts to answer some of the more commonly asked questions. It is by no means exhaustive and should be used in combination with the 'built-in' User FAQ within phpBB3, the community forums and our IRC channel (see <a href="README.html">README</a> for details).</p>
+	<p>This is a very basic Frequently Asked Questions (FAQ) page which attempts to answer some of the more commonly asked questions. It is by no means exhaustive and should be used in combination with the 'built-in' User FAQ within phpBB3, the community forums and our IRC channel (see <a href="README.html">README</a> for details).</p>
 
-<h1>FAQ</h1>
+	<h1>FAQ</h1>
+
+	<div class="paragraph menu">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 <!-- add entry about common UTF8 problems (for example wrong uploading, editing) -->
-<ul class="menu">
+<ul>
 	<li><a href="#install">I cannot install this it is too difficult! Will you do it?</a></li>
 	<li><a href="#legal">I am having problems with the admin at a certain board, help!</a></li>
 	<li><a href="#legal">A board has ripped off my graphics/software/etc., stop them!</a></li>
@@ -186,11 +71,19 @@ p a {
 	<li><a href="#disclaimer">Copyright and disclaimer</a></li>
 </ul>
 
-<hr />
+		</div>
 
-<a name="install"></a><h3>I cannot install this it is too difficult! Will you do it?</h3>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
-<div class="paragraph">
+	<hr />
+
+	<a name="install"></a><h2>I cannot install this it is too difficult! Will you do it?</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 <p>Simple answer, no we will not. We are not being difficult when we say this we are actually trying to help you. phpBB has a reputation for being easy to install, that reputation is we believe well deserved. It is a simple process of unarchiving a single file, uploading the resulting directory/files to their intended location and entering some data in a web based form. The sequence of events, what to type where, etc. is covered in detail in the accompanying <a href="INSTALL.html">INSTALL.html</a> documentation. If you cannot install phpBB3 the chances are you will be unable to administer or update it.</p>
 
@@ -198,75 +91,104 @@ p a {
 
 <p>We think a better solution is for you to carefully read the enclosed documentation, read through our knowledge base at <a href="http://www.phpbb.com/">www.phpbb.com</a> and if necessary ask for help on any thing you get stuck on. However, the decision is yours but please note we may not offer support if we believe you have had the board installed by a third party. In such cases you should direct your questions to that company or person/s.</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="legal"></a>
+		<span class="corners-bottom"><span></span></span></div>
-<h3>I am having problems with the admin at a certain board, help!</h3>
+	</div>
-<h3>A board has ripped off my graphics/software/etc., stop them!</h3>
-<h3>A board is dealing in warez/porn/etc., you need to prevent them doing this!</h3>
-<h3>I want to sue you because i think you host an illegal board!</h3>
 
-<div class="paragraph">
+	<hr />
+
+<a name="legal"></a><h2>I am having problems with the admin at a certain board, help!<br />
+A board has ripped off my graphics/software/etc., stop them!<br />
+A board is dealing in warez/porn/etc., you need to prevent them doing this!<br />
+I want to sue you because i think you host an illegal board!</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 <p>We provide the software, we have absolutely nothing to do with any board that runs it (beyond phpbb.com of course!) and we also do not host any site. The GPL grants the user an unlimited right of use subject to their adherence of that licence. Therefore we cannot prevent, dictate, control or otherwise limit the use of phpBB software. So please do not contact us for such matters.</p>
 
 <p>If you have a problem with a given board please take it up with them, not us. We are not and cannot be held legally responsible for any third party use of this software (much like Microsoft et al cannot be held responsible for the use of Windows in illegal activities, etc.). Additionally we do <strong>not</strong> track the use of phpBB software in any way. So please do not ask us for details on a &quot;given&quot; board we will not be able to help you. If any law firms or lawyers out there send us writs, cease and desist orders, etc. for third party website use of this software we reserve the right to charge for time wasted dealing with such issues...</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="viewonline"></a><h3>According to viewonline a user is doing/reading something they should not be able to!</h3>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
-<div class="paragraph">
+	<hr />
+
+<a name="viewonline"></a><h2>According to viewonline a user is doing/reading something they should not be able to!</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 <p>No, they probably are not. phpBB uses sessions to keep track of users as they move between pages. The session information tells us who this user is. Therefore in order to determine what a user can do on a page we first need the session details. Once this data is available we can check whether the user is permitted to do whatever it is they are trying to do. This can result in it appearing as if a user is reading a topic in a forum they should not be able to access. Or perhaps viewing private messages when they are only guests, etc. In practice the user is not doing these things, they are viewing a &quot;You are not permitted to do this&quot; type message. The session data has simply been updated before we were able to determine what the user could or could not do.</p>
 
 <p>Of course this only applies where permissions have been set correctly!</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="mail"></a><h3>I keep getting Mail sending errors when I (or my users) post/send PM's/etc.!</h3>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
-<div class="paragraph">
+	<hr />
+
+<a name="mail"></a><h2>I keep getting Mail sending errors when I (or my users) post/send PM's/etc.!</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 <p>This error will occur if phpBB cannot send mail. phpBB can send email two ways; using the PHP <code>mail()</code> function or directly via SMTP. Some hosting providers limit the <code>mail()</code> function to prevent its use in spamming, others may rename it or limit its functionality. If the <code>mail()</code> function got renamed, you are able to enter the correct name within the administration control panel. In either case you may need to make use of SMTP. This requires that you have access to such a facility, e.g. your hosting provider may provide one (perhaps requiring specific written authorisation), etc. Please see <a href="http://www.phpbb.com/">www.phpbb.com</a> for additional help on this matter.</p>
 
 <p>If you do require SMTP services please do not ask (on our forums or elsewhere) for someone to provide you with one. Open relays are now things of the past thanks to the unthinking spammers out there. Therefore you are unlikely to find someone willing to offer you (free) services.</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="mail_language"></a><h3>My users are complaining that emails are not in their selected language!</h3>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
-<div class="paragraph">
+	<hr />
+
+<a name="mail_language"></a><h2>My users are complaining that emails are not in their selected language!</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 <p>You must have deleted a language pack or the language pack is incomplete. phpBB will try to send emails in the users selected language. If it cannot find a suitable email template it will switch to the boards default language.</p>
 
 <!-- additional entry about encoded emails -->
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="aol_browser"></a><h3>My AOL based users keep getting logged out!</h3>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
-<div class="paragraph">
+	<hr />
+
+<a name="aol_browser"></a><h2>My AOL based users keep getting logged out!</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 <p>phpBB uses sessions to keep track of users as they browse the board. These sessions use a combination of a unique session id, the users IP and if specified the users browser and/or the users x-forwarded-for header to identify each user. We make use of all of this as an extra safe-guard to help prevent sessions being hijacked (by discovering the unique session id).</p>
 
@@ -274,79 +196,115 @@ p a {
 
 <p>If you are experiencing problems related to this you can set the Session IP validation parameter found in <code>Admin-&gt;General-&gt;Server Configuration-&gt;Security Settings</code> to <samp>A.B</samp>. Please note that reducing the IP validation length does potentially increase the risk of sessions being hijacked (this is something for you to consider, phpBB Group takes no responsibility should anything happen!). We suggest to at least additionally enable the browser validation.</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="avatars"></a><h3>No matter what I set the uploadable avatars to I cannot upload one from my computer!</h3>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
-<div class="paragraph">
+	<hr />
+
+<a name="avatars"></a><h2>No matter what I set the uploadable avatars to I cannot upload one from my computer!</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 <p>There are two possibilities here, the first is you have not created the directory you specified as the storage location for avatars, ie. as specified in the <code>Admin -&gt; General -&gt; Board Configuration -&gt; Avatar settings</code> section. If the directory does not exist uploadeable avatars are automatically disabled. You should create the required directory (ensuring it has global write access or other appropriate permissions to allow the webserver to write files to it).</p>
 
 <p>The second possibility is that your provider has disabled file_upload support. You should contact your provider and ask them if this is the case. There is not a lot you can do, there are still three other avatar settings left to choose from including uploading via an URL which will work fine.</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="gallery_avatars"></a><h3>I just cannot get gallery avatars to appear!</h3>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
-<div class="paragraph">
+	<hr />
+
+<a name="gallery_avatars"></a><h2>I just cannot get gallery avatars to appear!</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 <p>phpBB categorises gallery avatars and it does this by reading through folders contained in the location you specified as being the gallery path. For example, if you set the gallery path to <samp>images/avatars/gallery</samp> phpBB will expect to find a series of folders within that path, e.g. <samp>images/avatars/gallery/moviestars</samp>, <samp>images/avatars/gallery/cartoons</samp>, <samp>images/avatars/gallery/misc</samp>, etc. Placing images directly in <samp>images/avatars/gallery/</samp> will result in nothing being listed in your gallery.</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="permissions"></a><h3>How do I use/set permissions?</h3>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
-<div class="paragraph">
+	<hr />
+
+<a name="permissions"></a><h2>How do I use/set permissions?</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 <p>Please read the paragraph about permissions in our extensive <a href="http://www.phpbb.com/support/documentation/3.0/">online documentation</a>.</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="login_issues"></a><h3>I (or my users) cannot stay logged in to the forum!</h3>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
-<div class="paragraph">
+	<hr />
+
+<a name="login_issues"></a><h2>I (or my users) cannot stay logged in to the forum!</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 <p>If you (or your users) are, after attempting a login, being returned to the index (or other page) without appearing to be logged in the most likely problem is incorrect cookie settings. phpBB uses cookies to store a session id and a small amount of user data. For this data to be stored correctly the cookie domain, name, path and secure settings must be correct. You can check this in <code>Admin-&gt;General-&gt;Server Configuration-&gt;Cookie Settings</code>. Typically the cookie domain can be left blank and the cookie path set to <samp>/</samp> (a single forward slash). Do <strong>not</strong> set the cookie as being secure unless your board is running over a secure sockets layer connection, ie. https://</p>
 
 <p>If you still have problems try setting the cookie domain to your full domain name, e.g. <samp>www.mysystem.tld</samp>, <samp>www.something.mydomain.tld</samp>. You <strong>must</strong> ensure the domain name contains at least two dots or browsers will be unlikely to recognise the cookie, e.g. <samp>.mydomain.com</samp>, <samp>mydomain.com</samp>. Do <strong>not</strong> add http:// or anything else to the domain name!</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="logout_issues"></a><h3>My users are complaining about being logged out too quickly!</h3>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
-<div class="paragraph">
+	<hr />
+
+<a name="logout_issues"></a><h2>My users are complaining about being logged out too quickly!</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 <p>You can increase the default length of sessions (ie. how long before a users session is considered 'dead') in <code>Admin-&gt;General-&gt;Server Configuration-&gt;Load Settings</code>. Set it to whatever value your users feel comfortable with, remember that security issues may affect your decision (ie. having too long a session may allow non-users to abuse your board should a user forget to logout or otherwise leave a current session on a public workstation).</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="not_answered"></a><h3>My question isn't answered here!</h3>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
-<div class="paragraph">
+	<hr />
+
+<a name="not_answered"></a><h2>My question isn't answered here!</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 <p>Please read our <a href="http://www.phpbb.com/support/documentation/3.0/">extensive user documentation</a> first, it may just explain what you want to know.</p>
 
@@ -354,26 +312,41 @@ p a {
 
 <p><a href="http://www.phpbb.com">www.phpbb.com</a></p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="disclaimer"></a><h3>Copyright and disclaimer</h3>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
-<div class="paragraph">
+	<hr />
+
+<a name="disclaimer"></a><h2>Copyright and disclaimer</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 	<p>This application is opensource software released under the <a href="http://opensource.org/licenses/gpl-license.php">GPL</a>. Please see source code and the docs directory for more details. This package and its contents are Copyright (c) 2000, 2002, 2005, 2007 <a href="http://www.phpbb.com/">phpBB Group</a>, All Rights Reserved.</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
 <!-- END DOCUMENT -->
 
-</div>
+	<div id="page-footer">
+		<div class="version">&nbsp;</div>
+	</div>
+</div></div>
 
-<div id="footer">&nbsp; <br /><br /></div>
+<div>
+	<a id="bottom" name="bottom" accesskey="z"></a>
+</div>
 
 </body>
 </html>

phpBB/docs/INSTALL.html

@@ -1,164 +1,44 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en" xml:lang="en">
-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
 <head>
-<title>phpBB 3.0.x Install</title>
+
-<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
-<meta http-equiv="Content-Style-Type" content="text/css" />
+<meta http-equiv="content-style-type" content="text/css" />
+<meta http-equiv="content-language" content="en" />
+<meta http-equiv="imagetoolbar" content="no" />
 <meta name="resource-type" content="document" />
-<meta name="description" lang="en" content="phpBB 3.0.x Installation, updating and conversion informations" />
+<meta name="distribution" content="global" />
-<meta name="keywords" lang="en" content="" />
+<meta name="copyright" content="2007 phpBB Group" />
-<meta name="author" content="phpBB Group" />
+<meta name="keywords" content="" />
-<meta name="copyright" content="phpBB Group" />
+<meta name="description" content="phpBB 3.0.x Installation, updating and conversion informations" />
-<meta name="MSSmartTagsPreventParsing" content="true" />
+<title>phpBB3 &bull; Install</title>
 
-<style type="text/css">
+<link href="stylesheet.css" rel="stylesheet" type="text/css" media="screen, projection" />
-<!--
-
-/* The original "subSilver" theme for phpBB2 Created by subBlue design :: http://www.subBlue.com */
-body {
-	background-color: white;
-	font-family: Verdana, Arial, Helvetica, sans-serif;
-	margin: 0;
-	border: 0;
-	padding: 0;
-}
-
-img {
-	border: 0;
-}
-
-p {
-	font-size: 8pt;
-}
-
-hr {
-	height: 0;
-	border: solid #D1D7DC 0;
-	border-top-width: 1px;
-}
-
-#title, h1 {
-	font: bold 18pt 'Trebuchet MS', Verdana, sans-serif;
-	text-decoration: none;
-	line-height: 120%;
-}
-
-h2 {
-	font: bold 12pt Arial, Helvetica, sans-serif;
-	text-decoration: none;
-	line-height: 120%;
-}
-
-h3 {
-	font: bold 10pt Arial, Helvetica, sans-serif;
-	text-decoration: none;
-	line-height: 120%;
-}
-
-.paragraph {
-	margin-left: 20px;
-}
-
-/* Structure */
-#logo {
-	background: #fff url(header_bg.jpg) repeat-x top right;
-	height: 60px;
-}
-
-#title {
-	color: #12749b;
-	float: right;
-	margin: 10px 10px 0;
-}
-
-#main {
-	margin-left: 25px;
-	margin-right: 25px;
-}
-
-.good {
-	color: green;
-}
-
-.bad {
-	color: red;
-}
-
-#footer {
-	margin-left: 75px;
-	font-size: 70%;
-	color: #006600;
-}
-
-code {
-	color: #006600;
-	font-weight: normal;
-	font-family: 'Courier New', monospace;
-	border-color: #D1D7DC;
-	border-width: 1px;
-	border-style: solid;
-	background-color: #FAFAFA;
-}
-
-.indent p {
-	padding-left: 20px;
-	font-size: 90%;
-}
-
-/* Anchors */
-a {
-	font-size: 70%;
-}
-
-a:link, a:active, a:visited {
-	color:	#006699;
-	text-decoration: none;
-}
-
-a:hover {
-	color: #DD6900;
-	text-decoration: underline;
-}
-
-a.nav {
-	color: #006699;
-	text-decoration: none;
-}
-
-a.nav:hover {
-	text-decoration: underline;
-}
-
-p a {
-	font-size: 100%;
-}
-
-.menu {
-	font-size: 80%;
-}
-
-.menu li a {
-	font-size: 100%;
-}
-
-.comment {
-	color: green;
-}
-
-//-->
-</style>
 
 </head>
 
-<body>
+<body id="phpbb" class="section-docs">
 
-<div id="logo">
+<div id="wrap">
-	<div id="title">phpBB 3.0.x Install</div>
+	<a id="top" name="top" accesskey="t"></a>
-	<img src="header_left.jpg" alt="phpBB Logo" />
+	<div id="page-header">
-</div>
+		<div class="headerbar">
+			<div class="inner"><span class="corners-top"><span></span></span>
 
-<a name="top"></a><div id="main">
+			<div id="doc-description">
+				<a href="../index.php" id="logo"><img src="site_logo.gif" alt="" /></a>
+				<h1>phpBB 3.0.x Install</h1>
+				<p>phpBB 3.0.x Installation, updating and conversion informations</p>
+				<p style="display: none;"><a href="#start_here">Skip</a></p>
+			</div>
+
+			<span class="corners-bottom"><span></span></span></div>
+		</div>
+	</div>
+
+	<a name="start_here"></a>
+
+	<div id="page-body">
 
 <!-- BEGIN DOCUMENT -->
 
@@ -170,12 +50,17 @@ p a {
 
 <h1>Install</h1>
 
-<ol class="menu">
+	<div class="paragraph menu">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
+
+<ol>
 	<li><a href="#quickinstall">Quick install</a></li>
 	<li><a href="#require">Requirements</a></li>
 	<li><a href="#install">New installation</a></li>
 	<li><a href="#update">Updating from stable releases of phpBB 3.0.x</a>
-	<ol type="i">
+	<ol style="list-style-type: lower-roman;">
 		<li><a href="#update_full">Full package</a></li>
 		<li><a href="#update_files">Changed files only</a></li>
 		<li><a href="#update_patch">Patch file</a></li>
@@ -184,7 +69,7 @@ p a {
 	</ol>
 	</li>
 	<li><a href="#convert">Conversion from phpBB 2.0.x to phpBB 3.0.x</a>
-	<ol type="i">
+	<ol style="list-style-type: lower-roman;">
 		<li><a href="#prereq">Requirements before converting</a></li>
 		<li><a href="#conversion">Converting</a></li>
 		<li><a href="#postreq">Things to do after conversion</a></li>
@@ -192,21 +77,30 @@ p a {
 	</ol>
 	</li>
 	<li><a href="#postinstall">Important (security related) post-Install tasks for all installation methods</a>
-	<ol type="i">
+	<ol style="list-style-type: lower-roman;">
 		<li><a href="#avatars">Uploadable avatars</a></li>
 	</ol>
 	</li>
 	<li><a href="#disclaimer">Disclaimer</a></li>
 </ol>
 
-<hr />
+		</div>
 
-<a name="quickinstall"></a><h1>1. Quick install</h1>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<hr />
+
+	<a name="quickinstall"></a><h2>1. Quick install</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
-<div class="paragraph">
 	<p>If you have basic knowledge of using FTP and are sure your hosting service or server will run phpBB3 you can use these steps to quickly get started. For a more detailed explanation you should skip this and go to <a href="#require">section 2</a> below.</p>
 
-	<ol class="menu">
+	<ol>
 		<li>Decompress the phpBB3 archive to a local directory on your system.</li>
 		<li>Upload all the files contained in this archive (retaining the directory structure) to a web accessible directory on your server or hosting account.</li>
 		<li>Change the permissions on config.php to be writable by all (666 or -rw-rw-rw- within your FTP Client)</li>
@@ -219,18 +113,26 @@ p a {
 	</ol>
 
 	<p>If you experienced problems or do not know how to proceed with any of the steps above please read the rest of this document.</p>
-</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		</div>
 
-<a name="require"></a><h1>2. Requirements</h1>
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<hr />
+
+	<a name="require"></a><h2>2. Requirements</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
-<div class="paragraph">
 	<p>phpBB3 has a few requirements which must be met before you are able to install and use it.</p>
 
-	<ul class="menu">
+	<ul>
 		<li>A webserver or web hosting account running on any major Operating System with support for PHP</li>
 		<li>A SQL database system, <strong>one of</strong>:
 		<ul>
@@ -242,7 +144,8 @@ p a {
 			<li>Oracle</li>
 		</ul>
 		</li>
-		<li><strong>PHP 4.3.3</strong> or above with support for the database you intend to use.</li>
+		<li><strong>PHP 4.3.3+ (>=4.3.3, >4.4.x, >5.x.x, >6.0-dev (compatible))</strong> with support for the database you intend to use.</li>
+		<li>getimagesize() function need to be enabled.</li>
 		<li>These optional presence of the following modules within PHP will provide access to additional features, but they are not required.
 		<ul>
 			<li>zlib Compression support</li>
@@ -255,15 +158,22 @@ p a {
 	</ul>
 
 	<p>If your server or hosting account does not meet the requirements above we are afraid phpBB3 is not for you.</p>
-</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		</div>
 
-<a name="install"></a><h1>3. New installation</h1>
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<div class="paragraph">
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<hr />
+
+	<a name="install"></a><h2>3. New installation</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 	<p>Installation of phpBB3 will vary according to your server and database. If you have <em>shell access</em> to your account (via telnet or ssh for example) you may want to upload the entire phpBB3 archive (in binary mode!) to a directory on your host and unarchive it there.</p>
 
@@ -275,19 +185,19 @@ p a {
 
 	<p>Once all the files have been uploaded to your site you should point your browser at this location with the addition of <code>install/</code>. For example if your domain name is <em>www.mydomain.tld</em> and you placed phpBB3 in a directory /phpBB3 off your web root you would enter <em>http://www.mydomain.tld/phpBB3/install/</em> or (alternatively) <em>http://www.mydomain.tld/phpBB3/install/index.php</em> into your browser. When you have done this you should see the phpBB3 Installation screen appear.</p>
 
-	<h3>Introduction:</h3>
+	<h4>Introduction:</h4>
 
 	<p>The installation screen gives you a short introduction into phpBB. It allows you to read the license phpBB3 is released under (General Public License) and provides information about how you can receive support. To start the installation, use the <em>Install</em> button.</p>
 
-	<h3>Requirements</h3>
+	<h4>Requirements</h4>
 
 	<p>The first page you will see after starting the installation is the Requirements list. phpBB3 checks automatically whether everything that it needs to run properly is installed on your server. You need to have at least the minimum PHP version installed, and at least one database available to continue the installation. Also important, is that all shown folders are available and do have the correct permissions. Please see the description of each section to find out whether they are optional or required for phpBB3 to run. If everything is in order, you can continue the installation with <em>Start Install</em>.</p>
 
-	<h3>Database settings</h3>
+	<h4>Database settings</h4>
 
 	<p>You now have to decide which database to use. See the <a href="#require">Requirements section</a> for information on which databases are supported. If you do not know your database settings, please contact your host and ask for them. You will not be able to continue without them. You need:</p>
 
-	<ul class="menu">
+	<ul>
 		<li>The Database Type - the database you will be using.</li>
 		<li>The Database server hostname or DSN - the address of the database server.</li>
 		<li>The Database server port - the port of the database server (most of the time this is not needed).</li>
@@ -309,17 +219,17 @@ p a {
 
 	<p>If you see the Successful Connection message, you can continue to the next step.</p>
 
-	<h3>Administrator details</h3>
+	<h4>Administrator details</h4>
 
 	<p>Now you have to create your administration user. This user will have full administration access and he/she will be the first user on your forum. All fields on this page are required. You can also set the default language of your forum on this page. In a vanilla phpBB3 installation we only include English. You can download further languages from <a href="http://www.phpbb.com/">www.phpbb.com</a>, and add them before installing or later.</p>
 
-	<h3>Configuration file</h3>
+	<h4>Configuration file</h4>
 
 	<p>In this step, phpBB will try to write the configuration file automatically. The forum needs the configuration to run properly. It contains all database settings, so without it, phpBB will not be able to access the database.</p>
 
 	<p>Usually writing the configuration file automatically works fine. But in some cases it can fail due to wrong file permissions, for instance. In this case, you need to upload the file manually. phpBB asks you to download the config.php file and tells you what to do with it. Please read the instructions carefully. After you have uploaded the file, use <em>Done</em> to get to the last step. If <em>Done</em> returns you to the same page as before, and does not return a success message, you did not upload the file correctly.</p>
 
-	<h3>Advanced settings</h3>
+	<h4>Advanced settings</h4>
 
 	<p>The Advanced settings allow you to set some parameters of the board configuration. They are optional, and you can always change them later. So if you are not sure what these settings mean, proceed to the final step and finish the installation.</p>
 
@@ -329,21 +239,27 @@ p a {
 
 	<p>At this point if you are converting from phpBB 2.0.x, you should refer to the <a href="#convert">conversion steps</a> for further information. If not, you should remove the install directory from your server as you will only be able to access the Administration Control Panel whilst it is present.</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="update"></a><h1>4. Updating from stable releases of phpBB 3.0.x</h1>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<hr />
+
+	<a name="update"></a><h2>4. Updating from stable releases of phpBB 3.0.x</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 <p>If you are currently using a stable release of phpBB3 updating to this version is straightforward. You would have downloaded one of four packages and your choice determines what you need to do. <strong>Please Note</strong>: That before updating we heavily recommend you do a <em>full backup of your database and existing phpBB3 files</em>! If you are unsure how to achieve this please ask your hosting provider for advice.</p>
 
 <p><strong>Please make sure you update your phpBB3 source files too, even if you run the <code>database_update.php</code> file.</strong></p>
 
-<a name="update_full"></a><b>4.i. Full package</b>
+<a name="update_full"></a><h3>4.i. Full package</h3>
-<br /><br />
-<div class="paragraph">
 
 	<p>The full package is normally meant for new installations, but if you want to replace all source files this package comes in handy.</p>
 
@@ -352,27 +268,16 @@ p a {
 	<p>You should now run <code>install/database_update.php</code> which, depending on your previous version, will make a number of database changes. You may receive <em>FAILURES</em> during this procedure, they should not be a cause for concern unless you see an actual <em>ERROR</em>, in which case the script will stop (in this case you should seek help via our forums or bug tracker).</p>
 
 	<p>Once the install/database_update.php has completed you may proceed to the Administration Control Panel and check remove the install directory as advised.</p>
-</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<a name="update_files"></a><b>4.ii. Changed files only</b>
+<a name="update_files"></a><h3>4.ii. Changed files only</h3>
-<br /><br />
-<div class="paragraph">
 
 	<p>This package contains a number of archives, each contains the files changed from a given release to the latest version. You should select the appropriate archive for your current version, e.g. if you currently have <samp>3.0.0</samp> you should select the phpBB-3.0.0_to_3.0.1.zip/tar.gz file.</p>
 
 	<p>The directory structure has been preserved enabling you (if you wish) to simply upload the contents of the archive to the appropriate location on your server, i.e. simply overwrite the existing files with the new versions. Do not forget that if you have installed any MODs these files will overwrite the originals possibly destroying them in the process. You will need to re-add MODs to any affected file before uploading.</p>
 
 	<p>As for the other update procedures you should run <b>install/database_update.php</b> after you have finished updating the files. This will update your database schema and increment the version number.</p>
-</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<a name="update_patch"></a><b>4.iii. Patch file</b>
+<a name="update_patch"></a><h3>4.iii. Patch file</h3>
-<br /><br />
-
-<div class="paragraph">
 
 	<p>The patch file is probably the best solution for those with many Modifications (MODs) or other changes who do not want to re-add them back to all the changed files. To use this you will need command line access to a standard UNIX type <strong>patch</strong> application. If you do not have access to such an application but still want to use this update approach we recommend the <a href="update_auto">Automatic update package</a> explained below.</p>
 
@@ -381,20 +286,14 @@ p a {
 	<p>If you do get failures you should look at using the <a href="#update_files">Changed files only</a> package to replace the files which failed to patch, please note that you will need to manually re-add any Modifications (MODs) to these particular files. Alternatively if you know how you can examine the .rej files to determine what failed where and make manual adjustments to the relevant source.</p>
 
 	<p>You should of course delete the patch file (or files) after use. As for the other update procedures you should run <code>install/database_update.php</code> after you have finished updating the files. This will update your database schema and data (if appropriate) and increment the version number.</p>
-</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<a name="update_auto"></a><b>4.iv. Automatic update package</b>
+<a name="update_auto"></a><h3>4.iv. Automatic update package</h3>
-<br /><br />
-
-<div class="paragraph">
 
 	<p>The automatic update package is holding - contrary to the others - only the update informations for updating the last released version to the latest available version. These package is meant for use with the automatic update tool.</p>
 
 	<p>To perform the update, either follow the instructions from the <code>Administration Control Panel -&gt; System</code> Tab - this should point out that you are running an outdated version and will guide you through the update - or following the instructions listed below.</p>
 
-	<ul class="menu">
+	<ul>
 		<li>Go to the <a href="http://www.phpbb.com/downloads/">downloads page</a> and download the latest update package listed there.</li>
 		<li>Upload the archives contents to your phpBB installation - only the install folder is required. Upload the whole install folder, retaining the file structure.</li>
 		<li>After the install folder is present, phpBB3 will go offline automatically.</li>
@@ -402,44 +301,39 @@ p a {
 		<li>Choose the "Update" Tab and follow the instructions</li>
 	</ul>
 
-</div>
+	<p>&nbsp;</p>
-<a href="#top">Top</a>
-<br /><br />
 
-<a name="update_all"></a><b>4.v. All package types</b>
+<a name="update_all"></a><h3>4.v. All package types</h3>
-<br /><br />
-
-<div class="paragraph">
 
 	<p>If you have non-English language packs installed you may want to see if a new version has been made available. A number of missing strings may have been added which, though not essential, may be beneficial to users. Please note that at this time not all language packs have been updated so you should be prepared to periodically check for updates.</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="convert"></a><h1>5. Conversion from phpBB 2.0.x to phpBB 3.0.x</h1>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<hr />
+
+	<a name="convert"></a><h2>5. Conversion from phpBB 2.0.x to phpBB 3.0.x</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 <p>This paragraph explains the steps necessary to convert your existing phpBB2 installation to phpBB3.</p>
 
-<a name="prereq"></a><b>5.i. Requirements before converting</b>
+<a name="prereq"></a><h3>5.i. Requirements before converting</h3>
-<br /><br />
 
-<div class="paragraph">
 	<p>Before converting we heavily recommend you do a <em>full backup of your database and files</em>! If you are unsure how to achieve this please ask your hosting provider for advice. You basically need to follow the basic instructions given for <a href="#install">New installations</a>. Please <strong>do not</strong> overwrite any old files - install phpBB3 at a different location.</p>
 
 	<p>Once you made a backup of everything and also have a brand new phpBB3 installation, you can now begin the conversion.</p>
 
 	<p>Note that the conversion requires CREATE and DROP privileges for the phpBB3's database user account.</p>
-</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<a name="conversion"></a><b>5.ii. Converting</b>
+<a name="conversion"></a><h3>5.ii. Converting</h3>
-<br /><br />
-
-<div class="paragraph">
 
 	<p>To begin the conversion visit the install folder of your phpBB3 installation (the same as you have done for installing). Now you will see a new tab <em>Convert</em>. Click this tab.</p>
 
@@ -448,14 +342,8 @@ p a {
 	<p>Please note that this conversion process may take quite some time and depending on your hosting provider this may result in it failing (due to web server or other timeout issues). If this is the case you should ask your provider if they are willing to allow the convert script to temporarily exceed their limits (be nice and they will probably be quite helpful).</p>
 
 	<p>Once completed your board should be immediately available. If you encountered errors you should report the problems to our bug tracker or seek help via our forums (see <a href="README.html">README</a> for details).</p>
-</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<a name="postreq"></a><b>5.iii. Things to do after conversion</b>
+<a name="postreq"></a><h3>5.iii. Things to do after conversion</h3>
-<br /><br />
-
-<div class="paragraph">
 
 	<p>After successful conversion there may be a few items you need to do - apart from checking if the installation is accessible and everything displayed correctly.</p>
 
@@ -467,14 +355,7 @@ p a {
 
 	<p>Once you are pleased with your new installation you may want to give it the name of your old installation, changing the directory name. With phpBB3 this is possible without any problems - but you may still want to check your cookie settings within the administration panel, if the cookie path need to be adjusted prior to renaming.</p>
 
-</div>
+<a name="convprob"></a><h3>5.iv. Common conversion problems</h3>
-<a href="#top">Top</a>
-<br /><br />
-
-<a name="convprob"></a><b>5.iv. Common conversion problems</b>
-<br /><br />
-
-<div class="paragraph">
 
 	<p><strong>Broken non-latin characters</strong> The conversion script assumes that the database encoding in the source phpBB2 matches the encoding defined in the <code>lang_main.php</code> file of the default language pack of the source installation. Edit that file to match the database's encoding and re-start the conversion procedure.</p>
 
@@ -488,28 +369,28 @@ p a {
 
 	<p><strong>Smilies</strong> During the conversion you might see warnings about image files where the copying failed. That can happen if the old board's smilies have the same file names as those on the new board. Copy those files manually after the conversion, if you want to continue using the old smilies.</p> 
 
-</div>
-<a href="#top">Top</a>
-<br /><br />
 
+		</div>
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="postinstall"></a><h1>6. Important (security related) post-Install tasks for all installation methods</h1>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
-<div class="paragraph">
+	<hr />
 
-	<p>Once you have succssfully installed phpBB3 you <strong>MUST</strong> ensure you remove the entire install/ directory. Leaving the install directory in place is a <em>very serious potential security issue</em> which may lead to deletion or alteration of files, etc. Please note that until this directory is not removed phpBB3 will not operate and a warning message will be displayed. Beyond this <strong>essential</strong> deletion you may also wish to delete the docs/ directories if you wish.</p>
+	<a name="postinstall"></a><h2>6. Important (security related) post-Install tasks for all installation methods</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
+
+	<p>Once you have successfully installed phpBB3 you <strong>MUST</strong> ensure you remove the entire install/ directory. Leaving the install directory in place is a <em>very serious potential security issue</em> which may lead to deletion or alteration of files, etc. Please note that until this directory is removed, phpBB3 will not operate and a warning message will be displayed. Beyond this <strong>essential</strong> deletion, you may also wish to delete the docs/ directories if you wish.</p>
 
 	<p>With these directories deleted you should proceed to the administration panel. Depending on how the installation completed you may have been directed there automatically. If not, login as the administrator you specified during install/conversion and click the <strong>Administration Panel</strong> link at the bottom of any page. Ensure that details specified in <code>Admin -&gt; General</code> are correct!</p>
 
-</div>
+<a name="avatars"></a><h3>6.i. Uploadable avatars</h3>
-<a href="#top">Top</a>
-<br /><br />
-
-<a name="avatars"></a><b>6.i. Uploadable avatars</b>
-<br /><br />
-<div class="paragraph">
 
 	<p>phpBB3 supports several methods for allowing users to select their own <em>avatar</em> (an avatar is a small image generally unique to a user and displayed just below their username in posts).</p>
 
@@ -520,27 +401,42 @@ p a {
 	<p>On Windows system you need to ensure the directory is not write-protected and that it has global write permissions (see your servers documentation or contact your hosting provider if you are unsure on how to achieve this).</p>
 
 	<p>Please be aware that setting a directories permissions to global write access is a potential security issue. While it is unlikely that anything nasty will occur (such as all the avatars being deleted) there are always people out there to cause trouble. Therefore you should monitor this directory and if possible make regular backups.</p>
-</div>
 
-<a href="#top">Top</a>
+		</div>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="disclaimer"></a><h1>7. Copyright and disclaimer</h1>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<hr />
+
+<a name="disclaimer"></a><h2>7. Copyright and disclaimer</h2>
 
 	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 	<p>This application is opensource software released under the <a href="http://opensource.org/licenses/gpl-license.php">GPL</a>. Please see source code and the docs directory for more details. This package and its contents are Copyright (c) 2000, 2002, 2005, 2007 <a href="http://www.phpbb.com/">phpBB Group</a>, All Rights Reserved.</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
 <!-- END DOCUMENT -->
 
-</div>
+	<div id="page-footer">
+		<div class="version">&nbsp;</div>
+	</div>
+</div></div>
 
-<div id="footer">&nbsp;<br /><br /></div>
+<div>
+	<a id="bottom" name="bottom" accesskey="z"></a>
+</div>
 
 </body>
 </html>

phpBB/docs/README.html

@@ -1,210 +1,102 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en" xml:lang="en">
-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
 <head>
-<title>phpBB 3.0.x Readme</title>
+
-<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
-<meta http-equiv="Content-Style-Type" content="text/css" />
+<meta http-equiv="content-style-type" content="text/css" />
+<meta http-equiv="content-language" content="en" />
+<meta http-equiv="imagetoolbar" content="no" />
 <meta name="resource-type" content="document" />
-<meta name="description" lang="en" content="phpBB 3.0.x Readme" />
+<meta name="distribution" content="global" />
-<meta name="keywords" lang="en" content="" />
+<meta name="copyright" content="2007 phpBB Group" />
-<meta name="author" content="phpBB Group" />
+<meta name="keywords" content="" />
-<meta name="copyright" content="phpBB Group" />
+<meta name="description" content="phpBB 3.0.x Readme" />
-<meta name="MSSmartTagsPreventParsing" content="true" />
+<title>phpBB3 &bull; Readme</title>
 
-<style type="text/css">
+<link href="stylesheet.css" rel="stylesheet" type="text/css" media="screen, projection" />
-<!--
-
-/* The original "subSilver" theme for phpBB2 Created by subBlue design :: http://www.subBlue.com */
-body {
-	background-color: white;
-	font-family: Verdana, Arial, Helvetica, sans-serif;
-	margin: 0;
-	border: 0;
-	padding: 0;
-}
-
-img {
-	border: 0;
-}
-
-p {
-	font-size: 8pt;
-}
-
-hr { 
-	height: 0; 
-	border: solid #D1D7DC 0;
-	border-top-width: 1px;
-}
-
-#title, h1 {
-	font: bold 18pt 'Trebuchet MS', Verdana, sans-serif;
-	text-decoration: none;
-	line-height: 120%;
-}
-
-h2 {
-	font: bold 12pt Arial, Helvetica, sans-serif;
-	text-decoration: none;
-	line-height: 120%;
-}
-
-h3 {
-	font: bold 10pt Arial, Helvetica, sans-serif;
-	text-decoration: none;
-	line-height: 120%;
-}
-
-.paragraph {
-	margin-left: 20px;
-}
-
-/* Structure */
-#logo {
-	background: #fff url(header_bg.jpg) repeat-x top right;
-	height: 60px;
-}
-
-#title {
-	color: #12749b;
-	float: right;
-	margin: 10px 10px 0;
-}
-
-#main {
-	margin-left: 25px;
-	margin-right: 25px;
-}
-
-.good {
-	color: green;
-}
-
-.bad {
-	color: red;
-}
-
-#footer {
-	margin-left: 75px;
-	font-size: 70%;
-	color: #006600;
-}
-
-code {
-	color: #006600; 
-	font-weight: normal;
-	font-family: 'Courier New', monospace;
-	border-color: #D1D7DC;
-	border-width: 1px;
-	border-style: solid;
-	background-color: #FAFAFA;
-}
-
-.indent p {
-	padding-left: 20px;
-	font-size: 90%;
-}
-
-/* Anchors */
-a {
-	font-size: 70%;
-}
-
-a:link, a:active, a:visited {
-	color:	#006699;
-	text-decoration: none;
-}
-
-a:hover {
-	color: #DD6900;
-	text-decoration: underline;
-}
-
-a.nav {
-	color: #006699;
-	text-decoration: none;
-}
-
-a.nav:hover {
-	text-decoration: underline;
-}
-
-p a {
-	font-size: 100%;
-}
-
-.menu {
-	font-size: 80%;
-}
-
-.menu li a {
-	font-size: 100%;
-}
-
-.comment {
-	color: green;
-}
-
-//-->
-</style>
 
 </head>
 
-<body>
+<body id="phpbb" class="section-docs">
 
-<div id="logo">
+<div id="wrap">
-	<div id="title">phpBB 3.0.x Readme</div>
+	<a id="top" name="top" accesskey="t"></a>
-	<img src="header_left.jpg" alt="phpBB Logo" />
+	<div id="page-header">
-</div>
+		<div class="headerbar">
+			<div class="inner"><span class="corners-top"><span></span></span>
 
-<a name="top"></a><div id="main">
+			<div id="doc-description">
+				<a href="../index.php" id="logo"><img src="site_logo.gif" alt="" /></a>
+				<h1>phpBB 3.0.x Readme</h1>
+				<p style="display: none;"><a href="#start_here">Skip</a></p>
+			</div>
+
+			<span class="corners-bottom"><span></span></span></div>
+		</div>
+	</div>
+
+	<a name="start_here"></a>
+
+	<div id="page-body">
 
 <!-- BEGIN DOCUMENT -->
 
-<p>Thank you for downloading phpBB3. This README will guide through the basics of installation and operation of phpBB3. Please ensure you read this and the accompanying documentation fully <strong>before</strong> proceeding with the installation.</p>
+	<p>Thank you for downloading phpBB3. This README will guide through the basics of installation and operation of phpBB3. Please ensure you read this and the accompanying documentation fully <strong>before</strong> proceeding with the installation.</p>
 
-<h1>Readme</h1>
+	<h1>Readme</h1>
 
-<ol class="menu">
+	<div class="paragraph menu">
-	<li><a href="#install">Installing phpBB3</a></li>
+		<div class="inner"><span class="corners-top"><span></span></span>
-	<li><a href="#run">Running phpBB3</a>
-	<ol type="i">
-		<li><a href="#i18n">Internationalisation (i18n)</a></li>
-		<li><a href="#styles">Styles</a></li>
-		<li><a href="#mods">Modifications</a></li>
-	</ol>
-	</li>
-	<li><a href="#help">Getting help with phpBB3</a>
-	<ol type="i">
-		<li><a href="#docs">Documentation</a></li>
-		<li><a href="#website">Community Forums</a></li>
-		<li><a href="#irc">Internet Relay Chat</a></li>
-	</ol>
-	</li>
-	<li><a href="#status">Status of this version</a></li>
-	<li><a href="#bugs">Reporting Bugs</a>
-	<ol type="i">
-		<li><a href="#securitybugs">Security related bugs</a></li>
-	</ol>
-	</li>
-	<li><a href="#curbugs">Overview of current bug list</a></li>
-	<li><a href="#php">PHP compatibility issues</a></li>
-	<li><a href="#disclaimer">Disclaimer</a></li>
-</ol>
 
-<hr />
+		<div class="content">
 
-<a name="install"></a><h1>1. Installing phpBB3</h1>
+			<ol>
+				<li><a href="#install">Installing phpBB3</a></li>
+				<li><a href="#run">Running phpBB3</a>
+				<ol style="list-style-type: lower-roman;">
+					<li><a href="#i18n">Internationalisation (i18n)</a></li>
+					<li><a href="#styles">Styles</a></li>
+					<li><a href="#mods">Modifications</a></li>
+				</ol>
+				</li>
+				<li><a href="#help">Getting help with phpBB3</a>
+				<ol style="list-style-type: lower-roman;">
+					<li><a href="#docs">Documentation</a></li>
+					<li><a href="#website">Community Forums</a></li>
+					<li><a href="#irc">Internet Relay Chat</a></li>
+				</ol>
+				</li>
+				<li><a href="#status">Status of this version</a></li>
+				<li><a href="#bugs">Reporting Bugs</a>
+				<ol style="list-style-type: lower-roman;">
+					<li><a href="#securitybugs">Security related bugs</a></li>
+				</ol>
+				</li>
+				<li><a href="#curbugs">Overview of current bug list</a></li>
+				<li><a href="#php">PHP compatibility issues</a></li>
+				<li><a href="#disclaimer">Disclaimer</a></li>
+			</ol>
 
-<div class="paragraph">
+		</div>
+
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<hr />
+
+	<a name="install"></a><h2>1. Installing phpBB3</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 	<p>Installation, update and conversion instructions can be found in the <a href="INSTALL.html">INSTALL</a> document contained in this distribution. If you are intending to convert from a previous phpBB 2.0.x installation we highly recommend you backup any existing data before proceeding!</p>
 
 	<p>Users of phpBB3 Beta versions cannot directly update.</p>
 
 	<p>Please note that we won't support the following installation types:</p>
-	<ul class="menu">
+	<ul>
 		<li>Updates from phpBB3 Beta versions to phpBB3 RC1 and higher</li>
 		<li>Conversions from phpBB 2.0.x to phpBB3 Beta versions</li>
 		<li>phpBB3 Beta installations</li>
@@ -212,25 +104,31 @@ p a {
 
 	<p>We give support for the following installation types:</p>
 
-	<ul class="menu">
+	<ul>
 		<li>Updates from phpBB3 RC1 to any higher version</li>
 		<li>Conversions from phpBB 2.0.x to phpBB3 RC1 and higher</li>
 		<li>New installations of phpBB3 RC1 and higher</li>
 	</ul>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="run"></a><h1>2. Running phpBB3</h1>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<hr />
+
+	<a name="run"></a><h2>2. Running phpBB3</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 	<p>Once installed phpBB is easily managed by both admin and moderator control panels. If you need help or advice with phpBB please see <a href="#help">Section 3</a> below.</p>
 
-	<a name="i18n"></a><b>2.i. Internationalisation (i18n)</b>
+	<a name="i18n"></a><h3>2.i. Internationalisation (i18n)</h3>
-	<br /><br />
-	<div class="paragraph">
 
 	<p>A number of language packs and style localisations are available. You can find them on our official download page:</p>
 
@@ -242,13 +140,7 @@ p a {
 
 	<p>If your language is not available please visit our forums where you will find a topic listing translations currently available or in preparation. This topic also gives you information should you wish to volunteer to translate a language not currently listed</p>
 
-	</div>
+	<a name="styles"></a><h3>2.ii. Styles</h3>
-	<a href="#top">Top</a>
-	<br /><br />
-
-	<a name="styles"></a><b>2.ii. Styles</b>
-	<br /><br />
-	<div class="paragraph">
 
 	<p>Although phpBB Group are rather proud of the included styles we realise that it may not be to everyones tastes. Therefore phpBB3 allows styles to be switched with relative ease. Firstly you need to locate and download a style you like. We maintain such a site at</p>
 
@@ -258,13 +150,7 @@ p a {
 
 	<p>Once you have downloaded a style the usual next step is to unarchive (or upload the unarchived contents of) the package into your <samp>styles/</samp> directory. You then need to visit <code>Administration -&gt; Styles</code>, you should see the new style available, click install and it will become available for all your users.</p>
 
-	</div>
+	<a name="mods"></a><h3>2.iii. Modifications</h3>
-	<a href="#top">Top</a>
-	<br /><br />
-
-	<a name="mods"></a><b>2.iii. Modifications</b>
-	<br /><br />
-	<div class="paragraph">
 
 	<p>Although not officially supported by phpBB Group, phpBB has a thriving modification scene. These third party modifications to the standard phpBB extend its capabilities still further and can be found at:</p>
 
@@ -274,19 +160,25 @@ p a {
 
 	<p>Also remember that any modifications which modify the database in any way may render upgrading your forum to future versions more difficult unless we state otherwise. With all this said many users have and continue to utilise many of the mods already available with great success.</p>
 
+		</div>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
 	</div>
-	<a href="#top">Top</a>
-	<br /><br />
 
-<hr />
+	<hr />
 
-<a name="help"></a><h1>3. Getting help with phpBB3</h1>
+<a name="help"></a><h2>3. Getting help with phpBB3</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 	<p>phpBB3 can seem a little daunting to new users in places, particularly with regard the permission system. The first thing you should do is check the <a href="FAQ.html">FAQ</a> which covers a few basic getting started questions. If you need additional help there are several places you should look.</p>
 
-	<a name="docs"></a><b>3.i. phpBB3 Documentation</b>
+	<a name="docs"></a><h3>3.i. phpBB3 Documentation</h3>
-	<br /><br />
-	<div class="paragraph">
 
 	<p>A comprehensive documentation is now available online and can be accessed from the following location:</p>
 
@@ -294,14 +186,7 @@ p a {
 
 	<p>This covers everything from installation through setting permissions and managing users.</p>
 
-	</div>
+	<a name="website"></a><h3>3.ii. Community Forums</h3>
-	<a href="#top">Top</a>
-	<br /><br />
-
-	<a name="website"></a><b>3.ii. Community Forums</b>
-	<br /><br />
-
-	<div class="paragraph">
 
 	<p>phpBB Group maintains a thriving community where a number of people have generously decided to donate their time to help support users. This site can be found at:</p>
 
@@ -309,48 +194,57 @@ p a {
 
 	<p>If you do seek help via our forums please be sure to do a Search before posting. This may well save both you and us time and allow the developer, moderator and support groups to spend more time responding to people with unknown issues and problems. Please also remember that phpBB is an entirely volunteer effort, no one receives any compensation for the time they give, this includes moderators as well as developers. So please be respectful and mindful when awaiting responses.</p>
 
-	</div>
+	<a name="irc"></a><h3>3.iii Internet Relay Chat</h3>
-	<a href="#top">Top</a>
-	<br /><br />
-
-	<a name="irc"></a><b>3.iii Internet Relay Chat</b>
-	<br /><br />
-	<div class="paragraph">
 
 	<p>Another place you may find help is our IRC channel. This operates on the Freenode IRC network, <em>irc.freenode.net</em> and the channel is <em>#phpbb</em> and can be accessed by any good IRC client such as mIRC, XChat, etc. Again, please do not abuse this service and be respectful of other users.</p>
 
+		</div>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
 	</div>
-	<a href="#top">Top</a>
-	<br /><br />
 
-<hr />
+	<hr />
 
-<a name="status"></a><h1>4. Status of this version</h1>
+<a name="status"></a><h2>4. Status of this version</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
-<div class="paragraph">
 	<p>This is the third stable release of phpBB. The 3.0.x line is essentially feature frozen, with only point releases seeing fixes for bugs and security issues, though feature alterations and minor feature additions may be done if deemed absolutely required. Our next major release will be phpBB 3.2 and the planning phase has begun (the unstable development version is 3.1). Please do not post questions asking when 3.2 will be available, no release date has been set.</p>
 
 	<p>For those interested in the development of phpBB should keep an eye on the community forums to see how things are progressing:</p>
 
-	<p><a href="http://area51.phpbb.com/">http://area51.phpbb.com/phpBB/</a></p>
+	<p><a href="http://area51.phpbb.com/phpBB/">http://area51.phpbb.com/phpBB/</a></p>
 
 	<p>Please note that this forum should <strong>NOT</strong> be used to obtain support for or ask questions about phpBB 2.0.x or phpBB 3.0.x, the main community forums are the place for this. Any such posts will be locked and go unanswered.</p>
-</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		</div>
 
-<a name="bugs"></a><h1>5. Reporting Bugs</h1>
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<hr />
+
+<a name="bugs"></a><h2>5. Reporting Bugs</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
-<div class="paragraph">
 	<p>The phpBB Group uses a bug tracking system to store, list and manage all reported bugs, it can be found at the location listed below. Please <strong>DO NOT</strong> post bug reports to our forums, they will be locked. In addition please <strong>DO NOT</strong> use the bug tracker for support requests. Posting such a request will only see you directed to the support forums (while taking time away from working on real bugs).</p>
 
 	<p><a href="http://www.phpbb.com/bugs/">http://www.phpbb.com/bugs/</a></p>
 
 	<p>While we very much appreciate receiving bug reports (the more reports the more stable phpBB will be) we ask you carry out a few steps before adding new entries:</p>
 
-	<ul class="menu">
+	<ul>
 		<li>Firstly determine if your bug is reproduceable, how to determine this depends on the bug in question. Only if the bug is reproduceable it is likely to be a problem with phpBB3 (or in some way connected). If something cannot be reproduced it may turn out to have been your hosting provider working on something, a user doing something silly, etc. Bug reports for non-reproduceable events can slow down our attempts to fix real, reproduceable issues<br /><br /></li>
 		<li>Next please read or search through the existing bug reports to see if <em>your</em> bug (or one very similar to it) is already listed. If it is please add to that existing bug rather than creating a new duplicate entry (all this does is slow us down).<br /><br /></li>
 		<li>Check the forums (use search!) to see if people have discussed anything that sounds similar to what you are seeing. However, as noted above please <strong>DO NOT</strong> post your particular bug to the forum unless it's non-reproduceable or you are sure it's related to something you have done rather phpBB3<br /><br /></li>
@@ -359,7 +253,7 @@ p a {
 
 	<p>If you do post a new bug (i.e. one that isn't already listed in the bug tracker) firstly make sure you have logged in (your username and password are the same as for the community forums) then please include the following details:</p>
 
-	<ul class="menu">
+	<ul>
 		<li>Your server type/version, e.g. Apache 1.3.28, IIS 4, Sambar, etc.</li>
 		<li>PHP version and mode of operation, e.g. PHP 5.1.1 as a module, PHP 4.4.4 running as CGI, etc.</li>
 		<li>DB type/version, e.g. MySQL 4.0.1, PostgreSQL 7.3.2, MSSQL Server 2000 SP1, etc.</li>
@@ -371,76 +265,97 @@ p a {
 
 	<p>Once a bug has been submitted you will be emailed any follow up comments added to it. <strong>Please</strong> if you are requested to supply additional information, do so! It is frustrating for us to receive bug reports, ask for additional information but get nothing. In these cases we have a policy of closing the bug, which may leave a very real problem in place. Obviously we would rather not have this situation arise.</p>
 
-</div>
+<a name="securitybugs"></a><h3>5.i. Security related bugs</h3>
-<a href="#top">Top</a>
-<br /><br />
 
-<a name="securitybugs"></a><b>5.i. Security related bugs</b>
-<br /><br />
-<div class="paragraph">
 	<p>If you find a potential security related vulnerability in phpBB please <strong>DO NOT</strong> post it to the bug tracker, public forums, etc.! Doing so may allow unscrupulous users to take advantage of it before we have time to put a fix in place. All security related bugs should be sent to our security tracker:</p>
 
 	<p><a href="http://www.phpbb.com/security/">http://www.phpbb.com/security/</a></p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="curbugs"></a><h1>6. Overview of current bug list</h1>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<hr />
+
+<a name="curbugs"></a><h2>6. Overview of current bug list</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
-<div class="paragraph">
 	<p>This list is not complete but does represent those bugs which may effect users on a wider scale. Other bugs listed in the tracker have typically been shown to be limited to certain setups or methods of installation, updating and/or conversions.</p>
 
-	<ul class="menu">
+	<ul>
-		<li>By default cannot post very large messages with MSSQL (this can be configured within MSSQL)</li>
 		<li>Conversions may fail to complete on large boards under some hosts</li>
+		<li>Updates may fail to complete on large update sets under some hosts</li>
+		<li>URL redirects are not working correctly under PHP 5.2.4 and certain conditions due to a bug within this PHP version</li>
 	</ul>
 
-</div>
+		</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<a name="php"></a><h1>7. PHP compatibility issues</h1>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<hr />
+
+<a name="php"></a><h2>7. PHP compatibility issues</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
-<div class="paragraph">
 	<p>phpBB is no longer supported on PHP3 due to several compatibility issues and we recommend that you upgrade to the latest stable release of PHP5 to run phpBB. The minimum version required is PHP 4.3.3.</p>
 
 	<p>Please remember that running any application on a developmental version of PHP can lead to strange/unexpected results which may appear to be bugs in the application (which may not be true). Therefore we recommend you upgrade to the newest stable version of PHP before running phpBB3. If you are running a developmental version of PHP please check any bugs you find on a system running a stable release before submitting.</p>
 
 	<p>This board has been developed and tested under Linux and Windows (amongst others) running Apache using MySQL 3.23, 4.x, 5.x, MSSQL Server 2000, PostgreSQL 7.x, Oracle 8, SQLite and Firebird. Versions of PHP used range from 4.3.3 to 6.0.0-dev without problem. </p>
-</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<a name="phpsec"></a><b>7.i. Notice on PHP security issues</b>
+<a name="phpsec"></a><h3>7.i. Notice on PHP security issues</h3>
 
-<br /><br />
-<div class="paragraph">
 <p>Currently there are no known issues regarding PHP security.</p>
-</div>
-<a href="#top">Top</a>
-<br /><br />
 
-<hr />
+		</div>
 
-<a name="disclaimer"></a><h1>8. Copyright and disclaimer</h1>
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<hr />
+
+<a name="disclaimer"></a><h2>8. Copyright and disclaimer</h2>
 
 	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 	<p>This application is opensource software released under the <a href="http://opensource.org/licenses/gpl-license.php">GPL</a>. Please see source code and the docs directory for more details. This package and its contents are Copyright (c) 2000, 2002, 2005, 2007 <a href="http://www.phpbb.com/">phpBB Group</a>, All Rights Reserved.</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
 
 <!-- END DOCUMENT -->
 
-</div>
+	<div id="page-footer">
+		<div class="version">&nbsp;</div>
+	</div>
+</div></div>
 
-<div id="footer">&nbsp;<br /><br /></div>
+<div>
+	<a id="bottom" name="bottom" accesskey="z"></a>
+</div>
 
 </body>
 </html>

phpBB/docs/auth_api.html

@@ -1,191 +1,60 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
-    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en" xml:lang="en">
-<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
 <head>
-<title>Auth API</title>
+
-<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
-<meta http-equiv="Content-Style-Type" content="text/css" />
+<meta http-equiv="content-style-type" content="text/css" />
+<meta http-equiv="content-language" content="en" />
+<meta http-equiv="imagetoolbar" content="no" />
 <meta name="resource-type" content="document" />
-<meta name="description" lang="en" content="Olympus coding guidelines document" />
+<meta name="distribution" content="global" />
-<meta name="keywords" lang="en" content="" />
+<meta name="copyright" content="2007 phpBB Group" />
-<meta name="author" content="phpBB Group" />
+<meta name="keywords" content="" />
-<meta name="copyright" content="phpBB Group" />
+<meta name="description" content="This is an explanation of how to use the phpBB auth/acl API" />
-<meta name="MSSmartTagsPreventParsing" content="true" />
+<title>phpBB3 &bull; Auth API</title>
-<link rel="shortcut icon" href="" />
 
-<style type="text/css">
+<link href="stylesheet.css" rel="stylesheet" type="text/css" media="screen, projection" />
-<!--
-
-/*
-	    The original "subSilver" theme for phpBB2
-	Created by subBlue design :: http://www.subBlue.com
-*/
-
-body {
-	background-color:	white;
-	font-family:		Verdana, Arial, Helvetica, sans-serif;
-	margin:				0px;
-	border:				0px;
-	padding:			0px;
-}
-
-img {
-	border: 0;
-}
-
-p {
-	font-size:	8pt;
-}
-
-hr { 
-	height: 0px; 
-	border: solid #D1D7DC 0px; 
-	border-top-width: 1px;
-}
-
-#title, h1 {
-	font: bold 18pt 'Trebuchet MS', Verdana, sans-serif;
-	text-decoration: none; 
-	line-height: 120%; 
-}
-
-h2 {
-	font: bold 12pt Arial, Helvetica, sans-serif;
-	text-decoration: none; 
-	line-height: 120%; 
-}
-
-h3 {
-	font: bold 10pt Arial, Helvetica, sans-serif;
-	text-decoration: none; 
-	line-height: 120%; 
-}
-
-.paragraph {
-	margin-left: 20px;
-}
-
-/* 
-	Structure 
-*/
-#logo {
-	background: #fff url(header_bg.jpg) repeat-x top right;
-	height: 60px;
-}
-
-#title {
-	color: #12749b;
-	float: right;
-	margin: 10px 10px 0;
-}
-
-#main {
-	margin-left: 25px;
-	margin-right: 25px;
-}
-
-.good {
-	color: green;
-}
-
-.bad {
-	color: red;
-}
-
-#footer {
-	margin-left: 75px;
-	font-size: 70%;
-	color: #006600;
-}
-
-code { 
-	color: #006600; 
-	font-weight: normal; 
-	font-family: 'Courier New', monospace; 
-	border-color: #D1D7DC; 
-	border-width: 1px; 
-	border-style: solid; 
-	background-color: #FAFAFA; 
-}
-
-.indent p {
-	padding-left: 20px;
-	font-size: 90%;
-}
-
-/*
-	Anchors
-*/
-a {
-	font-size: 70%;
-}
-
-a:link, a:active, a:visited {
-	color:	#006699;
-	text-decoration:	none;
-}
-
-a:hover {
-	color:				#DD6900;
-	text-decoration:	underline;
-}
-
-a.nav {
-	color:				#006699;
-	text-decoration:	none;
-}
-
-a.nav:hover {
-	text-decoration:	underline;
-}
-
-p a {
-	font-size: 100%;
-}
-
-.menu {
-	font-size: 80%;
-}
-
-.menu li a {
-	font-size: 100%;
-}
-//-->
-</style>
-
-<!--[if IE]>
-<style type="text/css">
-body {
-	scrollbar-face-color:		#DEE3E7;
-	scrollbar-highlight-color:	white;
-	scrollbar-shadow-color:		#DEE3E7;
-	scrollbar-3dlight-color:	#D1D7DC;
-	scrollbar-arrow-color:		#006699;
-	scrollbar-track-color:		#EFEFEF;
-	scrollbar-darkshadow-color: #98AAB1;
-}
-</style>
-<![endif]-->
 
 </head>
 
-<body>
+<body id="phpbb" class="section-docs">
 
-<div id="logo">
+<div id="wrap">
-	<div id="title">Auth API</div>
+	<a id="top" name="top" accesskey="t"></a>
-	<a href="index.php"><img src="header_left.jpg" alt="phpBB Logo" /></a>
+	<div id="page-header">
-</div>
+		<div class="headerbar">
+			<div class="inner"><span class="corners-top"><span></span></span>
 
-<a name="top"></a><div id="main">
+			<div id="doc-description">
+				<a href="../index.php" id="logo"><img src="site_logo.gif" alt="" /></a>
+				<h1>Auth API</h1>
+				<p>This is an explanation of how to use the phpBB auth/acl API</p>
+				<p style="display: none;"><a href="#start_here">Skip</a></p>
+			</div>
 
-<p>This is an explanation of how to use the phpBB auth/acl API.</p>
+			<span class="corners-bottom"><span></span></span></div>
+		</div>
+	</div>
 
-<h1>Auth API</h1>
+	<a name="start_here"></a>
 
-<ol class="menu">
+	<div id="page-body">
+
+<!-- BEGIN DOCUMENT -->
+
+	<p>This is an explanation of how to use the phpBB auth/acl API.</p>
+
+	<h1>Auth API</h1>
+
+	<div class="paragraph menu">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
+
+<ol>
 	<li><a href="#intro">Introduction</a></li>
 	<li><a href="#methods">Methods</a>
-	<ol type="i">
+	<ol style="list-style-type: lower-roman;">
 		<li><a href="#acl">acl</a></li>
 		<li><a href="#acl_get">acl_get</a></li>
 		<li><a href="#acl_gets">acl_gets</a></li>
@@ -198,62 +67,69 @@ body {
 	<li><a href="#disclaimer">Copyright and disclaimer</a></li>
 </ol>
 
-<hr />
+		</div>
 
-<a name="intro"></a><h1>1. Introduction</h1>
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<hr />
+
+<a name="intro"></a><h2>1. Introduction</h2>
 
 	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
 
-	<h3>What is it?</h3>
+		<div class="content">
+
+	<h4>What is it?</h4>
 
 	<p>The <code>auth</code> class contains methods related to authorisation users to access various board functions, e.g. posting, viewing, replying, logging in (and out), etc. If you need to check whether a user can carry out a task or handle user login/logouts this class is required.</p>
 
-	<h3>Initialisation</h3>
+	<h4>Initialisation</h4>
 
 	<p>To use any methods contained with the <code>auth</code> class it first needs to be instantiated. This is best achieved early in the execution of the script in the following manner:</p>
 
-	<blockquote><pre>
+	<div class="codebox"><pre>
 $auth = new auth();
-	</pre></blockquote>
+	</pre></div>
 
 	<p>Once an instance of the class has been created you are free to call the various methods it contains. Please note that should you wish to use the <code>auth_admin</code> methods you will need to instantiate this separately but in the same way.</p>
 
+		</div>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
 	</div>
-	<a href="#top">Top</a>
-	<br /><br />
 
-<hr />
+	<hr />
 
-<a name="methods"></a><h1>2. Methods</h1>
+<a name="methods"></a><h2>2. Methods</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 	<p>Following are the methods you are able to use.</p>
 
-	<a name="acl"></a><b>2.i. acl</b>
+	<a name="acl"></a><h3>2.i. acl</h3>
-	<br /><br />
-	<div class="paragraph">
 	
 	<p>The <code>acl</code> method is the initialisation routine for all the acl functions. If you intend calling any acl method you must first call this. The method takes as its one and only required parameter an associative array containing user information as stored in the database. This array must contain at least the following information; user_id, user_permissions and user_type. It is called in the following way:</p>
 
-	<blockquote><pre>
+	<div class="codebox"><pre>
 $auth-&gt;acl(<code>userdata</code>);
-	</pre></blockquote>
+	</pre></div>
 
 	<p>Where userdata is the array containing the aforementioned data.</p>
 
-	</div>
+	<a name="acl_get"></a><h3>2.ii. acl_get</h3>
-	<a href="#top">Top</a>
-	<br /><br />
-
-
-	<a name="acl_get"></a><b>2.ii. acl_get</b>
-	<br /><br />
-	<div class="paragraph">
 
 	<p>This method is the primary way of determining what a user can and cannot do for a given option globally or in a given forum. The method should be called in the following way:</p>
 
-	<blockquote><pre>
+	<div class="codebox"><pre>
 $result = $auth-&gt;acl_get(<code>option</code>[, <code>forum</code>]);
-	</pre></blockquote>
+	</pre></div>
 
 	<p>Where option is a string representing the required option, e.g. 'f_list', 'm_edit', 'a_adduser', etc. By adding a ! in front of the option, e.g. '!f_list' the result of this method will be negated. The optional forum term is the integer forum_id.</p>
 
@@ -263,121 +139,114 @@ $result = $auth-&gt;acl_get(<code>option</code>[, <code>forum</code>]);
 
 	<p>There are some special options or <em>flags</em> which are used as prefixes for other options, e.g. 'f_' or 'm_'. These flags will automatically be set to a positive integer if the user has one or more permissions with the given prefix. A local setting will result in the flag being set only locally (so it will require a forum id to retrieve). If a user has one or more global permissions with the prefix acl_get will return a positive integer regardless of the forum id.</p>
 
-	</div>
+	<a name="acl_gets"></a><h3>2.iii. acl_gets</h3>
-	<a href="#top">Top</a>
-	<br /><br />
-
-
-	<a name="acl_gets"></a><b>2.iii. acl_gets</b>
-	<br /><br />
-	<div class="paragraph">
 
 	<p>This method is funtionally similar to <code>acl_get</code> in that it returns information on whether a user can or cannot carry out a given task. The difference here is the ability to test several different options in one go. This may be useful for testing whether a user is a moderator or an admin in one call. Rather than having to call and check <code>acl_get</code> twice.</p>
 
 	<p>The method should be called thus:</p>
 
-	<blockquote><pre>
+	<div class="codebox"><pre>
 $result = $auth-&gt;acl_gets(<code>option1</code>[, <code>option2</code>, ..., <code>optionN</code>, <code>forum</code>]);
-	</pre></blockquote>
+	</pre></div>
 
 	<p>As with the <code>acl_get</code> method the options are strings representing the required permissions to check. The forum again is an integer representing a given forum_id.</p>
 
 	<p>The method will return a positive integer if <code>acl_get</code> for one of the options evaluates to a positive integer (combines permissions with OR).</p>
 
-	</div>
+	<a name="acl_getf"></a><h3>2.iv. acl_getf</h3>
-	<a href="#top">Top</a>
-	<br /><br />
-
-
-	<a name="acl_getf"></a><b>2.iv. acl_getf</b>
-	<br /><br />
-	<div class="paragraph">
 
 	<p>This method is used to find out in which forums a user is allowed to carry out an operation or to find out in which forums he is not allowed to carry out an operation. The method should be called in the following way:</p>
 
-	<blockquote><pre>
+	<div class="codebox"><pre>
 $result = $auth-&gt;acl_getf(<code>option</code>[, <code>clean</code>]);
-	</pre></blockquote>
+	</pre></div>
 
 	<p>Just like in the <code>acl_get</code> method the option is a string specifying the permission which has to be checked (negation using ! is allowed). The second parameter is a boolean. If it is set to false this method returns all forums with either zero or a positive integer. If it is set to true only those forums with a positive integer as the result will be returned.</p>
 
 	<p>The method returns an associative array of the form:</p>
 
-	<blockquote><pre>
+	<div class="codebox"><pre>
 array(<em>forum_id1</em> =&gt; array(<em>option</em> =&gt; <em>integer</em>), <em>forum_id2</em> =&gt; ...)
-	</pre></blockquote>
+	</pre></div>
 
 	<p>Where option is the option passed to the method and integer is either zero or a positive integer and the same <code>acl_get(option, forum_id)</code> would return.</p>
 
-	</div>
+	<a name="acl_getf_global"></a><h3>2.v. acl_getf_global</h3>
-	<a href="#top">Top</a>
-	<br /><br />
-
-
-	<a name="acl_getf_global"></a><b>2.v. acl_getf_global</b>
-	<br /><br />
-	<div class="paragraph">
 
 	<p>This method is used to find out whether a user has a permission in at least one forum or globally. This method is similar to checking whether <code>acl_getf(option, true)</code> returned one or more forums but it's faster. It should be called in the following way:</p>
 
-	<blockquote><pre>
+	<div class="codebox"><pre>
 $result = acl_getf_global(<code>option</code>)
-	</pre></blockquote>
+	</pre></div>
 
 	<p>As with the previous methods option is a string specifying the permission which has to be checked.</p>
 
 	<p>This method returns either zero or a positive integer.</p>
 
-	</div>
+	<a name="acl_cache"></a><h3>2.vi. acl_cache</h3>
-	<a href="#top">Top</a>
-	<br /><br />
-
-
-	<a name="acl_cache"></a><b>2.vi. acl_cache</b>
-	<br /><br />
-	<div class="paragraph">
 
 	<p>This should be considered a private method and not be called externally. It handles the generation of the user_permissions data from the basic user and group authorisation data. When necessary this method is called automatically by <code>acl</code>.</p>
 
+		</div>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
 	</div>
-	<a href="#top">Top</a>
-	<br /><br />
 
-<hr />
+	<hr />
 
-<a name="admin_related"></a><h1>3. Admin related functions</h1>
+<a name="admin_related"></a><h2>3. Admin related functions</h2>
 
 	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 	<p>A number of additional methods are available related to <code>auth</code>. These handle more basic functions such as adding user and group permissions, new options and clearing the user cache. These methods are contained within a separate class, <code>auth_admin</code>. This can be found in <code>includes/acp/auth.php</code>.</p>
 
 	<p>To use any methods this class contains it first needs to be instantiated separately from <code>auth</code>. This is achieved in the same way as <code>auth</code>:</p>
 
-	<blockquote><pre>
+	<div class="codebox"><pre>
 $auth_admin = new auth_admin();
-	</pre></blockquote>
+	</pre></div>
 
 	<p>This instance gives you access to both the methods of this specific class and that of <code>auth</code>.</p>
 
+		</div>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
 	</div>
-	<a href="#top">Top</a>
-	<br /><br />
 
 	<hr />
 
-<a name="disclaimer"></a><h1>4. Copyright and disclaimer</h1>
+<a name="disclaimer"></a><h2>4. Copyright and disclaimer</h2>
 
 	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
 
 	<p>This application is opensource software released under the <a href="http://opensource.org/licenses/gpl-license.php">GPL</a>. Please see source code and the docs directory for more details. This package and its contents are Copyright (c) 2000, 2002, 2005, 2007 <a href="http://www.phpbb.com/">phpBB Group</a>, All Rights Reserved.</p>
 
-</div>
+		</div>
-<a href="#top">Top</a>
 
-</div>
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
 
-<div id="footer"> $Id$ 
+		<span class="corners-bottom"><span></span></span></div>
-<br /><br />
+	</div>
+
+<!-- END DOCUMENT -->
+
+	<div id="page-footer">
+		<div class="version"> $Id$ </div>
+	</div>
+</div></div>
+
+<div>
+	<a id="bottom" name="bottom" accesskey="z"></a>
 </div>
 
 </body>

phpBB/docs/hook_system.html

@@ -0,0 +1,858 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en" xml:lang="en">
+<head>
+
+<meta http-equiv="content-type" content="text/html; charset=utf-8" />
+<meta http-equiv="content-style-type" content="text/css" />
+<meta http-equiv="content-language" content="en" />
+<meta http-equiv="imagetoolbar" content="no" />
+<meta name="resource-type" content="document" />
+<meta name="distribution" content="global" />
+<meta name="copyright" content="2007 phpBB Group" />
+<meta name="keywords" content="" />
+<meta name="description" content="Hook System explanation" />
+<title>phpBB3 &bull; Hook System</title>
+
+<style type="text/css">
+<!--
+
+/*
+	The original "prosilver" theme for phpBB3
+	Created by subBlue design :: http://www.subBlue.com
+*/
+
+* { margin: 0; padding: 0; }
+
+html { font-size: 100%; height: 100%; margin-bottom: 1px; }
+
+body {
+	font-family: Verdana, Helvetica, Arial, sans-serif;
+	color: #828282;
+	background-color: #FFFFFF;
+	font-size: 12px;
+	margin: 0;
+	padding: 12px 0;
+}
+
+img { border-width: 0; }
+
+p {
+	line-height: 1.3em;
+	font-size: 1.1em;
+	margin-bottom: 1.5em;
+}
+
+hr {
+	border: 0 none #FFFFFF;
+	border-top: 1px solid #CCCCCC;
+	height: 1px;
+	margin: 5px 0;
+	display: block;
+	clear: both;
+}
+
+html, body {
+	color: #536482;
+	background-color: #FFFFFF;
+}
+
+#doc-description h1 {
+	font-family: "Trebuchet MS", Arial, Helvetica, sans-serif;
+	margin-right: 200px;
+	color: #FFFFFF;
+	margin-top: 15px;
+	font-weight: bold;
+	font-size: 2em;
+	color: #fff;
+}
+
+h1 {
+	font-family: "Trebuchet MS", Arial, Helvetica, sans-serif;
+	font-weight: normal;
+	color: #000;
+	font-size: 2em;
+	margin: 0.8em 0 0.2em 0;
+}
+
+h2 {
+	font-family: "Trebuchet MS", Arial, Helvetica, sans-serif;
+	font-weight: normal;
+	color: #28313F;
+	font-size: 1.5em;
+	margin: 0.8em 0 0.2em 0;
+}
+
+h3 {
+	font-family: Arial, Helvetica, sans-serif;
+	font-weight: bold;
+	border-bottom: 1px solid #CCCCCC;
+	margin-bottom: 3px;
+	padding-bottom: 2px;
+	font-size: 1.05em;
+	color: #115098;
+	margin-top: 20px;
+}
+
+.good { color: green; }
+.bad { color: red; }
+
+.version {
+	margin-top: 20px;
+	text-align: left;
+	font-size: 70%;
+	color: #006600;
+	border-top: 1px solid #ccc;
+}
+
+code { 
+	color: #006600; 
+	font-weight: normal; 
+	font-family: 'Courier New', monospace; 
+	border-color: #D1D7DC; 
+	border-width: 1px; 
+	border-style: solid; 
+	background-color: #FAFAFA; 
+}
+
+#wrap {
+	padding: 0 20px;
+	min-width: 650px;
+}
+
+#simple-wrap {
+	padding: 6px 10px;
+}
+
+#page-body {
+	margin: 4px 0;
+	clear: both;
+}
+
+#page-footer {
+	clear: both;
+}
+
+#logo {
+	float: left;
+	width: auto;
+	padding: 10px 13px 0 10px;
+}
+
+a#logo:hover {
+	text-decoration: none;
+}
+
+#doc-description {
+	float: left;
+	width: 70%;
+}
+
+#doc-description h1 {
+	margin-right: 0;
+}
+
+.headerbar {
+	background: #ebebeb none repeat-x 0 0;
+	color: #FFFFFF;
+	margin-bottom: 4px;
+	padding: 0 5px;
+}
+
+span.corners-top, span.corners-bottom, span.corners-top span, span.corners-bottom span {
+	font-size: 1px;
+	line-height: 1px;
+	display: block;
+	height: 5px;
+	background-repeat: no-repeat;
+}
+
+span.corners-top {
+	background-image: none;
+	background-position: 0 0;
+	margin: 0 -5px;
+}
+
+span.corners-top span {
+	background-image: none;
+	background-position: 100% 0;
+}
+
+span.corners-bottom {
+	background-image: none;
+	background-position: 0 100%;
+	margin: 0 -5px;
+	clear: both;
+}
+
+span.corners-bottom span {
+	background-image: none;
+	background-position: 100% 100%;
+}
+
+.paragraph {
+	padding: 0 10px;
+	margin-bottom: 4px;
+	background-repeat: no-repeat;
+	background-position: 100% 0;
+	background-color: #ECF3F7;
+}
+
+.paragraph:target .content {
+	color: #000000;
+}
+
+.paragraph:target h3 a {
+	color: #000000;
+}
+
+.content {
+	color: #333333;
+}
+
+.content h2, .panel h2 {
+	color: #115098;
+	border-bottom-color:  #CCCCCC;
+}
+
+a:link	{ color: #898989; text-decoration: none; }
+a:visited	{ color: #898989; text-decoration: none; }
+a:hover	{ color: #d3d3d3; text-decoration: underline; }
+a:active	{ color: #d2d2d2; text-decoration: none; }
+
+hr {
+	border-color: #FFFFFF;
+	border-top-color: #CCCCCC;
+}
+
+.menu {
+	background-color: #cadceb;
+}
+
+.headerbar {
+	background-color: #12A3EB;
+	background-image: url("bg_header.gif");
+	color: #FFFFFF;
+}
+
+.panel {
+	background-color: #ECF1F3;
+	color: #28313F;
+}
+
+
+span.corners-top {
+	background-image: url("corners_left.png");
+}
+
+span.corners-top span {
+	background-image: url("corners_right.png");
+}
+
+span.corners-bottom {
+	background-image: url("corners_left.png");
+}
+
+span.corners-bottom span {
+	background-image: url("corners_right.png");
+}
+
+.error {
+	color: #BC2A4D;
+}
+
+a:link	{ color: #105289; }
+a:visited	{ color: #105289; }
+a:hover	{ color: #D31141; }
+a:active	{ color: #368AD2; }
+
+.paragraph span.corners-top, .paragraph span.corners-bottom {
+	margin: 0 -10px;
+}
+
+.content {
+	padding: 0;
+	line-height: 1.48em;
+	color: #333333;
+}
+
+.content h2, .panel h2 {
+	color: #115098;
+	border-bottom-color:  #CCCCCC;
+}
+
+.notice {
+	border-top-color:  #CCCCCC;
+}
+
+.codebox {
+	padding: 3px;
+	background-color: #FFFFFF;
+	border: 1px solid #C9D2D8;
+	font-size: 1em;
+	margin-bottom: 10px;
+	display: block;
+	font: 0.9em Monaco, "Andale Mono","Courier New", Courier, mono;
+	line-height: 1.3em;
+}
+
+* html hr { margin: 0; }
+* html span.corners-top, * html span.corners-bottom { background-image: url("corners_left.gif"); }
+* html span.corners-top span, * html span.corners-bottom span { background-image: url("corners_right.gif"); }
+
+.back2top {
+	clear: both;
+	height: 11px;
+	text-align: right;
+}
+
+.content ol {
+	margin-left: 25px;
+}
+
+//-->
+</style>
+
+</head>
+
+<body id="phpbb" class="section-docs">
+
+<div id="wrap">
+	<a id="top" name="top" accesskey="t"></a>
+	<div id="page-header">
+		<div class="headerbar">
+			<div class="inner"><span class="corners-top"><span></span></span>
+
+			<div id="doc-description">
+				<a href="../index.php" id="logo"><img src="site_logo.gif" alt="" /></a>
+				<h1>Hook System</h1>
+				<p>This is an explanation of how to use the phpBB3 hook system.</p>
+				<p style="display: none;"><a href="#start_here">Skip</a></p>
+			</div>
+
+			<span class="corners-bottom"><span></span></span></div>
+		</div>
+	</div>
+
+	<a name="start_here"></a>
+
+	<div id="page-body">
+
+	<h1>Hook System</h1>
+
+	<div class="paragraph menu">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
+
+			<ol>
+				<li><a href="#intro">Introduction</a></li>
+				<li><a href="#use">Allow hooks in functions/methods</a></li>
+				<li><a href="#register">Registering hooks</a></li>
+				<li><a href="#return">Result returning</a></li>
+				<li><a href="#embed">Embedding your hook files/classes/methods</a></li>
+				<li><a href="#disclaimer">Copyright and disclaimer</a></li>
+			</ol>
+
+		</div>
+
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<hr />
+
+	<a name="intro"></a><h2>1. Introduction</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
+
+<h3>What is it?</h3>
+
+<p>The hook system allows applicaton and mod developers to hook into phpBB's or their own functions.</p>
+
+<h3>Pre-defined hookable phpBB3 functions</h3>
+
+<p>In phpBB3 there are four functions you are able to hook into with your custom functions:</p>
+
+<p><code>phpbb_user_session_handler();</code> which is called within user::setup after the session and the user object is correctly initialized.<br />
+<code>append_sid($url, $params = false, $is_amp = true, $session_id = false);</code> which is called for building urls (appending the session id)<br />
+<code>$template-&gt;display($handle, $include_once = true);</code> which is called directly before outputting the (not-yet-compiled) template.<br />
+<code>exit_handler();</code> which is called at the very end of phpBB3's execution.</p>
+
+<p>There are also valid external constants you may want to use if you embed phpBB3 into your application:</p>
+
+<div class="codebox"><pre>
+PHPBB_MSG_HANDLER (overwrite message handler)
+PHPBB_ROOT_PATH   (overwrite $phpbb_root_path)
+PHPBB_ADMIN_PATH  (overwrite $phpbb_admin_path)
+</pre></div>
+
+		</div>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<a name="use"></a><h2>2. Allow hooks in functions/methods</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
+
+<p>The following examples explain how phpBB3 utilize the in-build hook system. You will be more interested in registering your hooks, but showing you this may help you understand the system better along the way.</p>
+
+<p>First of all, this is how a function need to be layed out if you want to allow it to be hookable...</p>
+
+<div class="codebox"><pre>
+function my_own_function($my_first_parameter, $my_second_parameter)
+{
+	global $phpbb_hook;
+
+	if ($phpbb_hook-&gt;call_hook(__FUNCTION__, $my_first_parameter, $my_second_parameter))
+	{
+		if ($phpbb_hook-&gt;hook_return(__FUNCTION__))
+		{
+			return $phpbb_hook-&gt;hook_return_result(__FUNCTION__);
+		}
+	}
+
+	[YOUR CODE HERE]
+}
+</pre></div>
+
+<p>Above, the call_hook function should always be mapping your function call... in regard to the number of parameters passed.</p>
+
+<p>This is how you could make a method being hookable...</p>
+
+<div class="codebox"><pre>
+class my_hookable_object
+{
+	function hook_me($my_first_parameter, $my_second_parameter)
+	{
+		global $phpbb_hook;
+
+		if ($phpbb_hook-&gt;call_hook(array(__CLASS__, __FUNCTION__), $my_first_parameter, $my_second_parameter))
+		{
+			if ($phpbb_hook-&gt;hook_return(array(__CLASS__, __FUNCTION__)))
+			{
+				return $phpbb_hook-&gt;hook_return_result(array(__CLASS__, __FUNCTION__));
+			}
+		}
+
+		[YOUR CODE HERE]
+	}
+}
+</pre></div>
+
+<p>The only difference about calling it is the way you define the first parameter. For a function it is only <code>__FUNCTION__</code>, for a method it is <code>array(__CLASS__, __FUNCTION__)</code>. In PHP4 __CLASS__ is always returning the class in lowercase.</p>
+
+<p>Now, in phpBB there are some pre-defined hooks available, but how do you make your own hookable function available (and therefore allowing others to hook into it)? For this, there is the add_hook() method:</p>
+
+<div class="codebox"><pre>
+// Adding your own hookable function:
+$phpbb_hook-&gt;add_hook('my_own_function');
+
+// Adding your own hookable method:
+$phpbb_hook-&gt;add_hook(array('my_hookable_object', 'hook_me'));
+</pre></div>
+
+<p>You are also able to remove the possibility of hooking a function/method by calling <code>$phpbb_hook-&gt;remove_hook()</code> with the same parameters as add_hook().<br />
+This comes in handy if you want to force some hooks not to be called - at all.</p>
+
+		</div>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<a name="register"></a><h2>3. Registering hooks</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
+
+		<h3>Registering hooks</h3>
+
+<p>Now to actually defining your functions which should be called. For this we take the append_sid() function as an example (this function is able to be hooked by default). We create two classes, one being static and a function:</p>
+
+<div class="codebox"><pre>
+class my_append_sid_class
+{
+	// Our functions
+	function my_append_sid(&amp;$hook, $url, $params = false, $is_amp = true, $session_id = false)
+	{
+		// Get possible previous results
+		$result = $hook-&gt;previous_hook_result('append_sid');
+
+		return $result['result'] . '&lt;br /&gt;And i was the second one.';
+	}
+}
+
+// Yet another class :o
+class my_second_append_sid_class
+{
+	function my_append_sid(&amp;$hook, $url, $params = false, $is_amp = true, $session_id = false)
+	{
+		// Get possible previous results
+		$result = $hook-&gt;previous_hook_result('append_sid');
+
+		echo $result['result'] . '&lt;br /&gt;I was called as the third one.';
+	}
+}
+
+// And a normal function
+function my_append_sid(&amp;$hook, $url, $params = false, $is_amp = true, $session_id = false)
+{
+	// Get possible previous results
+	$result = $hook-&gt;previous_hook_result('append_sid');
+
+	return 'I was called as the first one';
+}
+
+// Initializing the second class
+$my_second_append_sid_class = new my_second_append_sid_class();
+</pre></div>
+
+<p>Make sure you add the same parameters to your function as is defined for the hookable function with one exception: The first variable is always <code>&amp;$hook</code>... this is the hook object itself you are able to operate on.</p>
+
+<p>Now we register the hooks one by one with the <code>$phpbb_hook-&gt;register()</code> method:</p>
+
+<div class="codebox"><pre>
+// Now, we register our append_sid &quot;replacements&quot; in a stacked way...
+// Registering the function (this is called first)
+$phpbb_hook-&gt;register('append_sid', 'my_append_sid');
+
+// Registering the first class
+$phpbb_hook-&gt;register('append_sid', array('my_append_sid_class', 'my_append_sid'));
+$phpbb_hook-&gt;register('append_sid', array(&amp;$my_second_append_sid_class, 'my_append_sid'));
+</pre></div>
+
+<p>With this you are even able to make your own functions that are already hooked itself being hooked again...</p>
+
+<div class="codebox"><pre>
+// Registering hook, which will be called
+$phpbb_hook-&gt;register('append_sid', 'my_own_append_sid');
+
+// Add hook to our called hook function
+$phpbb_hook-&gt;add_hook('my_own_append_sid');
+
+// Register added hook
+$phpbb_hook-&gt;register('my_own_append_sid', 'also_my_own_append_sid');
+</pre></div>
+
+		<h3>Special treatment/chains</h3>
+
+		<p>The <code>register</code> method is able to take a third argument to specify a special 'chain' mode. The valid modes are <code>first</code>, <code>last</code> and <code>standalone</code></p>
+
+		<p><code>$phpbb_hook-&gt;register('append_sid', 'my_own_append_sid', 'first')</code> would make sure that the function is called in the beginning of the chain. It is possible that more than one function is called within the first block - here the FIFO principle is used.</p>
+
+		<p><code>$phpbb_hook-&gt;register('append_sid', 'my_own_append_sid', 'last')</code> would make sure that the function is called at the very end of the chain. It is possible that more than one function is called within the last block - here the FIFO principle is used.</p>
+
+		<p><code>$phpbb_hook-&gt;register('append_sid', 'my_own_append_sid', 'standalone')</code> makes sure only the defined function is called. All other functions are removed from the chain and no other functions are added to it later on. If two applications try to trigger the standalone mode a PHP notice will be printed and the second function being discarded.</p>
+
+		<h3>Only allowing hooks for some objects</h3>
+
+		<p>Because the hook system is not able to differate between initialized objects and only operate on the class, you need to solve this on the code level.</p>
+
+		<p>One possibility would be to use a property:</p>
+
+		<div class="codebox"><pre>
+class my_hookable_object
+{
+	function blabla()
+	{
+	}
+}
+
+class my_hookable_object2 extends my_hookable_object
+{
+	var $call_hook = true;
+
+	function hook_me($my_first_parameter, $my_second_parameter)
+	{
+		if ($this-&gt;call_hook)
+		{
+			global $phpbb_hook;
+
+			if ($phpbb_hook-&gt;call_hook(array(__CLASS__, __FUNCTION__), $my_first_parameter, $my_second_parameter))
+			{
+				if ($phpbb_hook-&gt;hook_return(array(__CLASS__, __FUNCTION__)))
+				{
+					return $phpbb_hook-&gt;hook_return_result(array(__CLASS__, __FUNCTION__));
+				}
+			}
+		}
+
+		return 'not hooked';
+	}
+}
+
+function hooking(&amp;$hook, $first, $second)
+{
+	return 'hooked';
+}
+
+$first_object = new my_hookable_object2();
+$second_object = new my_hookable_object2();
+
+$phpbb_hook-&gt;add_hook(array('my_hookable_object2', 'hook_me'));
+
+$phpbb_hook-&gt;register(array('my_hookable_object2', 'hook_me'), 'hooking');
+
+// Do not call the hook for $first_object
+$first_object-&gt;call_hook = false;
+
+echo $first_object-&gt;hook_me('first', 'second') . '&lt;br /&gt;';
+echo $second_object-&gt;hook_me('first', 'second') . '&lt;br /&gt;';
+</pre></div>
+
+<p>OUTPUT:</p>
+
+<div class="codebox"><pre>
+not hooked
+hooked 
+</pre></div>
+
+		<p>A different possibility would be using a function variable (which could be left out on passing the function variables to the hook):</p>
+
+		<div class="codebox"><pre>
+class my_hookable_object
+{
+	function blabla()
+	{
+	}
+}
+
+class my_hookable_object2 extends my_hookable_object
+{
+	function hook_me($my_first_parameter, $my_second_parameter, $hook_me = true)
+	{
+		if ($hook_me)
+		{
+			global $phpbb_hook;
+
+			if ($phpbb_hook-&gt;call_hook(array(__CLASS__, __FUNCTION__), $my_first_parameter, $my_second_parameter))
+			{
+				if ($phpbb_hook-&gt;hook_return(array(__CLASS__, __FUNCTION__)))
+				{
+					return $phpbb_hook-&gt;hook_return_result(array(__CLASS__, __FUNCTION__));
+				}
+			}
+		}
+
+		return 'not hooked';
+	}
+}
+
+function hooking(&amp;$hook, $first, $second)
+{
+	return 'hooked';
+}
+
+$first_object = new my_hookable_object2();
+$second_object = new my_hookable_object2();
+
+$phpbb_hook-&gt;add_hook(array('my_hookable_object2', 'hook_me'));
+
+$phpbb_hook-&gt;register(array('my_hookable_object2', 'hook_me'), 'hooking');
+
+echo $first_object-&gt;hook_me('first', 'second', false) . '&lt;br /&gt;';
+echo $second_object-&gt;hook_me('first', 'second') . '&lt;br /&gt;';
+		</pre></div>
+
+		<p>OUTPUT:</p>
+
+		<div class="codebox"><pre>
+not hooked
+hooked 
+		</pre></div>
+
+		</div>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<a name="return"></a><h2>4. Result returning</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
+
+<p>Generally, the distinction has to be made if a function returns the result obtained from the called function or continue the execution. Based on the needs of the application this may differ. Therefore, the function returns the results only if the called hook function is returning a result.</p>
+
+<h3>Case 1 - Returning the result</h3>
+
+<p>Imagine the following function supporting hooks:</p>
+
+<div class="codebox"><pre>
+function append_sid($url, $params = false, $is_amp = true, $session_id = false)
+{
+	global $_SID, $_EXTRA_URL, $phpbb_hook;
+
+	// Developers using the hook function need to globalise the $_SID and $_EXTRA_URL on their own and also handle it appropiatly.
+	// They could mimick most of what is within this function
+	if ($phpbb_hook-&gt;call_hook(__FUNCTION__, $url, $params, $is_amp, $session_id))
+	{
+		if ($phpbb_hook-&gt;hook_return(__FUNCTION__))
+		{
+			return $phpbb_hook-&gt;hook_return_result(__FUNCTION__);
+		}
+	}
+
+	[...]
+}
+</pre></div>
+
+<p>Now, the following function is yours. Since you return a value, the append_sid() function itself is returning it as is:</p>
+
+<div class="codebox"><pre>
+// The function called
+function my_append_sid(&amp;$hook, $url, $params = false, $is_amp = true, $session_id = false)
+{
+	// Get possible previous results
+	$result = $hook-&gt;previous_hook_result('append_sid');
+
+	return 'Since i return something the append_sid() function will return my result.';
+}
+</pre></div>
+
+<p>To be able to get the results returned from functions higher in the change the <code>previous_hook_result()</code> method should always be used, it returns an <code>array('result' => [your result])</code> construct.</p>
+
+<h3>Case 2 - Not Returning any result</h3>
+
+<p>Sometimes applications want to return nothing and therefore force the underlying function to continue it's execution:</p>
+
+<div class="codebox"><pre>
+function append_sid($url, $params = false, $is_amp = true, $session_id = false)
+{
+	global $_SID, $_EXTRA_URL, $phpbb_hook;
+
+	// Developers using the hook function need to globalise the $_SID and $_EXTRA_URL on their own and also handle it appropiatly.
+	// They could mimick most of what is within this function
+	if ($phpbb_hook-&gt;call_hook(__FUNCTION__, $url, $params, $is_amp, $session_id))
+	{
+		if ($phpbb_hook-&gt;hook_return(__FUNCTION__))
+		{
+			return $phpbb_hook-&gt;hook_return_result(__FUNCTION__);
+		}
+	}
+
+	[...]
+}
+
+// The function called
+function my_append_sid(&amp;$hook, $url, $params = false, $is_amp = true, $session_id = false)
+{
+	// Get possible previous results
+	$result = $hook-&gt;previous_hook_result('append_sid');
+
+	[...]
+
+	// I only rewrite some variables, but return nothing. Therefore, the append_sid() function will not return my (non)result.
+}
+</pre></div>
+
+<p>Please Note: The decision to return or not return is solely made of the very last function call within the hook chain. An example:</p>
+
+<div class="codebox"><pre>
+// The function called
+function my_append_sid(&amp;$hook, $url, $params = false, $is_amp = true, $session_id = false)
+{
+	// Get possible previous results
+	$result = $hook-&gt;previous_hook_result('append_sid');
+
+	// $result is not filled
+
+	return 'FILLED';
+}
+
+// This function is registered too and gets executed after my_append_sid()
+function my_own_append_sid(&amp;$hook, $url, $params = false, $is_amp = true, $session_id = false)
+{
+	$result = $hook->previous_hook_result('append_sid');
+
+	// $result is actually filled with $result['result'] = 'FILLED'
+	// But i return nothing, therefore append_sid() continues it's execution.
+}
+
+// The way both functions are registered.
+$phpbb_hook->register('append_sid', 'my_append_sid');
+$phpbb_hook->register('append_sid', 'my_own_append_sid');
+</pre></div>
+
+		</div>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<a name="embed"></a><h2>5. Embedding your hook files/classes/methods</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
+
+<p>There are basically two methods you are able to choose from:</p>
+
+<p>1) Add a file to includes/hooks/. The file need to be prefixed by <code>hook_</code>. This file is included within common.php, you are able to register your hooks, include other files or functions, etc. It is advised to only include other files if needed (within a function call for example).</p>
+
+<p>Please be aware that you need to purge your cache within the ACP to make your newly placed file available to phpBB3.</p>
+
+<p>2) The second method is meant for those wanting to wrap phpBB3 without placing a custom file to the hooks directory. This is mostly done by including phpBB's files within the application file. To be able to register your hooks you need to create a function within your application:</p>
+
+<div class="codebox"><pre>
+// My function which gets executed within the hooks constuctor
+function phpbb_hook_register(&amp;$hook)
+{
+	$hook-&gt;register('append_sid', 'my_append_sid');
+}
+
+[...]
+</pre></div>
+
+<p>You should get the idea. ;)</p>
+
+		</div>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<a name="disclaimer"></a><h2>6. Copyright and disclaimer</h2>
+
+	<div class="paragraph">
+		<div class="inner"><span class="corners-top"><span></span></span>
+
+		<div class="content">
+
+	<p>This application is opensource software released under the <a href="http://opensource.org/licenses/gpl-license.php">GPL</a>. Please see source code and the docs directory for more details. This package and its contents are Copyright (c) 2000, 2002, 2005, 2007 <a href="http://www.phpbb.com/">phpBB Group</a>, All Rights Reserved.</p>
+
+		</div>
+
+		<div class="back2top"><a href="#wrap" class="top">Back to Top</a></div>
+
+		<span class="corners-bottom"><span></span></span></div>
+	</div>
+
+	<div id="page-footer">
+		<div class="version">$Id$</div>
+	</div>
+</div></div>
+
+<div>
+	<a id="bottom" name="bottom" accesskey="z"></a>
+</div>
+
+</body>
+</html>

phpBB/docs/stylesheet.css

@@ -0,0 +1,352 @@
+/*
+	The original "prosilver" theme for phpBB3
+	Created by subBlue design :: http://www.subBlue.com
+*/
+
+* { margin: 0; padding: 0; }
+
+html { font-size: 100%; height: 100%; margin-bottom: 1px; }
+
+body {
+	font-family: Verdana, Helvetica, Arial, sans-serif;
+	color: #828282;
+	background-color: #FFFFFF;
+	font-size: 12px;
+	margin: 0;
+	padding: 12px 0;
+}
+
+img { border-width: 0; }
+
+p {
+	line-height: 1.3em;
+	font-size: 1.1em;
+	margin-bottom: 1.5em;
+}
+
+hr {
+	border: 0 none #FFFFFF;
+	border-top: 1px solid #CCCCCC;
+	height: 1px;
+	margin: 5px 0;
+	display: block;
+	clear: both;
+}
+
+html, body {
+	color: #536482;
+	background-color: #FFFFFF;
+}
+
+#doc-description h1 {
+	font-family: "Trebuchet MS", Arial, Helvetica, sans-serif;
+	margin-right: 200px;
+	color: #FFFFFF;
+	margin-top: 15px;
+	font-weight: bold;
+	font-size: 2em;
+	color: #fff;
+}
+
+h1 {
+	font-family: "Trebuchet MS", Arial, Helvetica, sans-serif;
+	font-weight: normal;
+	color: #000;
+	font-size: 2em;
+	margin: 0.8em 0 0.2em 0;
+}
+
+h2 {
+	font-family: "Trebuchet MS", Arial, Helvetica, sans-serif;
+	font-weight: normal;
+	color: #28313F;
+	font-size: 1.5em;
+	margin: 0.8em 0 0.2em 0;
+}
+
+h3 {
+	font-family: Arial, Helvetica, sans-serif;
+	font-weight: bold;
+	border-bottom: 1px solid #CCCCCC;
+	margin-bottom: 3px;
+	padding-bottom: 2px;
+	font-size: 1.05em;
+	color: #115098;
+	margin-top: 20px;
+}
+
+h4 {
+	font-family: Arial, Helvetica, sans-serif;
+	font-weight: bold;
+	margin-bottom: 3px;
+	padding-bottom: 2px;
+	font-size: 1.05em;
+	color: #115098;
+	margin-top: 20px;
+}
+
+.good { color: green; }
+.bad { color: red; }
+
+.version {
+	margin-top: 20px;
+	text-align: left;
+	font-size: 70%;
+	color: #006600;
+	border-top: 1px solid #ccc;
+}
+
+code { 
+	color: #006600; 
+	font-weight: normal; 
+	font-family: 'Courier New', monospace; 
+	border-color: #D1D7DC; 
+	border-width: 1px; 
+	border-style: solid; 
+	background-color: #FAFAFA; 
+}
+
+#wrap {
+	padding: 0 20px;
+	min-width: 650px;
+}
+
+#simple-wrap {
+	padding: 6px 10px;
+}
+
+#page-body {
+	margin: 4px 0;
+	clear: both;
+}
+
+#page-footer {
+	clear: both;
+}
+
+#logo {
+	float: left;
+	width: auto;
+	padding: 10px 13px 0 10px;
+}
+
+a#logo:hover {
+	text-decoration: none;
+}
+
+#doc-description {
+	float: left;
+	width: 70%;
+}
+
+#doc-description h1 {
+	margin-right: 0;
+}
+
+.headerbar {
+	background: #ebebeb none repeat-x 0 0;
+	color: #FFFFFF;
+	margin-bottom: 4px;
+	padding: 0 5px;
+}
+
+span.corners-top, span.corners-bottom, span.corners-top span, span.corners-bottom span {
+	font-size: 1px;
+	line-height: 1px;
+	display: block;
+	height: 5px;
+	background-repeat: no-repeat;
+}
+
+span.corners-top {
+	background-image: none;
+	background-position: 0 0;
+	margin: 0 -5px;
+}
+
+span.corners-top span {
+	background-image: none;
+	background-position: 100% 0;
+}
+
+span.corners-bottom {
+	background-image: none;
+	background-position: 0 100%;
+	margin: 0 -5px;
+	clear: both;
+}
+
+span.corners-bottom span {
+	background-image: none;
+	background-position: 100% 100%;
+}
+
+.paragraph {
+	padding: 0 10px;
+	margin-bottom: 4px;
+	background-repeat: no-repeat;
+	background-position: 100% 0;
+	background-color: #ECF3F7;
+}
+
+.paragraph:target .content {
+	color: #000000;
+}
+
+.paragraph:target h3 a {
+	color: #000000;
+}
+
+.content {
+	color: #333333;
+}
+
+.content h2, .panel h2 {
+	color: #115098;
+	border-bottom-color:  #CCCCCC;
+}
+
+a:link	{ color: #898989; text-decoration: none; }
+a:visited	{ color: #898989; text-decoration: none; }
+a:hover	{ color: #d3d3d3; text-decoration: underline; }
+a:active	{ color: #d2d2d2; text-decoration: none; }
+
+hr {
+	border-color: #FFFFFF;
+	border-top-color: #CCCCCC;
+}
+
+.menu {
+	background-color: #cadceb;
+}
+
+.headerbar {
+	background-color: #12A3EB;
+	background-image: url("bg_header.gif");
+	color: #FFFFFF;
+}
+
+.panel {
+	background-color: #ECF1F3;
+	color: #28313F;
+}
+
+
+span.corners-top {
+	background-image: url("corners_left.png");
+}
+
+span.corners-top span {
+	background-image: url("corners_right.png");
+}
+
+span.corners-bottom {
+	background-image: url("corners_left.png");
+}
+
+span.corners-bottom span {
+	background-image: url("corners_right.png");
+}
+
+.error {
+	color: #BC2A4D;
+}
+
+a:link	{ color: #105289; }
+a:visited	{ color: #105289; }
+a:hover	{ color: #D31141; }
+a:active	{ color: #368AD2; }
+
+.paragraph span.corners-top, .paragraph span.corners-bottom {
+	margin: 0 -10px;
+}
+
+.content {
+	padding: 0;
+	line-height: 1.48em;
+	color: #333333;
+}
+
+.content h2, .panel h2 {
+	color: #115098;
+	border-bottom-color:  #CCCCCC;
+}
+
+.notice {
+	border-top-color:  #CCCCCC;
+}
+
+.codebox {
+	padding: 3px;
+	background-color: #FFFFFF;
+	border: 1px solid #C9D2D8;
+	font-size: 1em;
+	margin-bottom: 10px;
+	display: block;
+	font: 0.9em Monaco, "Andale Mono","Courier New", Courier, mono;
+	line-height: 1.3em;
+}
+
+* html hr { margin: 0; }
+* html span.corners-top, * html span.corners-bottom { background-image: url("corners_left.gif"); }
+* html span.corners-top span, * html span.corners-bottom span { background-image: url("corners_right.gif"); }
+
+.back2top {
+	clear: both;
+	height: 11px;
+	text-align: right;
+}
+
+.content ol, .content ul {
+	margin-left: 25px;
+	margin-top: 0;
+}
+
+.content ul + p, .content ul + div {
+	margin-top: 20px;
+}
+
+.comment {
+	color: green;
+}
+
+.indent {
+	margin-left: 20px;
+}
+
+.paragraph table  {
+	font-size:	8pt;
+	border-collapse: collapse;
+	border: 1px solid #cfcfcf;
+	margin-bottom: 20px;
+}
+
+.paragraph table caption  {
+	display: none;
+}
+
+.paragraph table thead  {
+	background-color: #cadceb;
+	color: #000;
+}
+
+.paragraph table td, .paragraph table th {
+	border: 1px solid #006699;
+	padding: 0.5em;
+	background-color: #e1ebf2;
+}
+
+.paragraph table th {
+	background-color: #cadceb;
+}
+
+.paragraph table td dl {
+	margin: 0;
+	padding: 0;
+}
+
+.paragraph table td dl dt {
+	float: left;
+	clear: both;
+	margin-right: 1em;
+}

phpBB/download/file.php

@@ -1,10 +1,10 @@
 <?php
-/** 
+/**
 *
 * @package phpBB3
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
@@ -12,7 +12,7 @@
 * @ignore
 */
 define('IN_PHPBB', true);
-$phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './';
+$phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './../';
 $phpEx = substr(strrchr(__FILE__, '.'), 1);
 
 if (isset($_GET['avatar']))
@@ -80,9 +80,9 @@ if (isset($_GET['avatar']))
 		$db->sql_close();
 		exit;
 	}
- 
+
 	send_avatar_to_browser(($avatar_group ? 'g' : '') . $filename . '.' . $ext);
- 
+
 	if (!empty($cache))
 	{
 		$cache->unload();
@@ -149,7 +149,7 @@ else
 {
 	if (!$attachment['in_message'])
 	{
-		// 
+		//
 		$sql = 'SELECT p.forum_id, f.forum_password, f.parent_id
 			FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . ' f
 			WHERE p.post_id = ' . $attachment['post_msg_id'] . '
@@ -231,8 +231,8 @@ if ($thumbnail)
 else if (($display_cat == ATTACHMENT_CATEGORY_NONE || $display_cat == ATTACHMENT_CATEGORY_IMAGE) && !$attachment['is_orphan'])
 {
 	// Update download count
-	$sql = 'UPDATE ' . ATTACHMENTS_TABLE . ' 
+	$sql = 'UPDATE ' . ATTACHMENTS_TABLE . '
-		SET download_count = download_count + 1 
+		SET download_count = download_count + 1
 		WHERE attach_id = ' . $attachment['attach_id'];
 	$db->sql_query($sql);
 }
@@ -271,7 +271,7 @@ function send_avatar_to_browser($file)
 {
 	global $config, $phpbb_root_path;
 
-	$prefix = $config['avatar_salt'] . '_'; 
+	$prefix = $config['avatar_salt'] . '_';
 	$image_dir = $config['avatar_path'];
 
 	// worst-case default
@@ -428,7 +428,7 @@ function send_file_to_browser($attachment, $upload_dir, $category)
 
 	// Send out the Headers. Do not set Content-Disposition to inline please, it is a security measure for users using the Internet Explorer.
 	header('Content-Type: ' . $attachment['mimetype']);
- 
+
 	if (empty($user->browser) || (strpos(strtolower($user->browser), 'msie') !== false))
 	{
 		header('Content-Disposition: attachment; ' . header_filename(htmlspecialchars_decode($attachment['real_filename'])));

phpBB/faq.php

@@ -1,10 +1,10 @@
 <?php
-/** 
+/**
 *
 * @package phpBB3
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 

phpBB/includes/acm/acm_file.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acm
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * ACM File Based Caching
 * @package acm
@@ -64,7 +72,7 @@ class acm
 	/**
 	* Save modified objects
 	*/
-	function save() 
+	function save()
 	{
 		if (!$this->is_modified)
 		{

phpBB/includes/acp/acp_attachments.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -27,6 +35,14 @@ class acp_attachments
 		$submit = (isset($_POST['submit'])) ? true : false;
 		$action = request_var('action', '');
 
+		$form_key = 'acp_attach';
+		add_form_key($form_key);
+
+		if ($submit && !check_form_key($form_key))
+		{
+			trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
+		}
+
 		switch ($mode)
 		{
 			case 'attach':
@@ -288,7 +304,7 @@ class acp_attachments
 						{
 							if ($row['group_id'] != $extensions[$row['extension_id']]['group_id'])
 							{
-								$sql = 'UPDATE ' . EXTENSIONS_TABLE . ' 
+								$sql = 'UPDATE ' . EXTENSIONS_TABLE . '
 									SET group_id = ' . (int) $extensions[$row['extension_id']]['group_id'] . '
 									WHERE extension_id = ' . $row['extension_id'];
 								$db->sql_query($sql);
@@ -303,7 +319,7 @@ class acp_attachments
 
 						if (sizeof($extension_id_list))
 						{
-							$sql = 'SELECT extension 
+							$sql = 'SELECT extension
 								FROM ' . EXTENSIONS_TABLE . '
 								WHERE ' . $db->sql_in_set('extension_id', $extension_id_list);
 							$result = $db->sql_query($sql);
@@ -315,7 +331,7 @@ class acp_attachments
 							}
 							$db->sql_freeresult($result);
 
-							$sql = 'DELETE 
+							$sql = 'DELETE
 								FROM ' . EXTENSIONS_TABLE . '
 								WHERE ' . $db->sql_in_set('extension_id', $extension_id_list);
 							$db->sql_query($sql);
@@ -371,8 +387,8 @@ class acp_attachments
 					'GROUP_SELECT_OPTIONS'	=> (isset($_POST['add_extension_check'])) ? $this->group_select('add_group_select', $add_extension_group, 'extension_group') : $this->group_select('add_group_select', false, 'extension_group'))
 				);
 
-				$sql = 'SELECT * 
+				$sql = 'SELECT *
-					FROM ' . EXTENSIONS_TABLE . ' 
+					FROM ' . EXTENSIONS_TABLE . '
 					ORDER BY group_id, extension';
 				$result = $db->sql_query($sql);
 
@@ -452,7 +468,7 @@ class acp_attachments
 					// Check New Group Name
 					if ($new_group_name)
 					{
-						$sql = 'SELECT group_id 
+						$sql = 'SELECT group_id
 							FROM ' . EXTENSION_GROUPS_TABLE . "
 							WHERE LOWER(group_name) = '" . $db->sql_escape(utf8_strtolower($new_group_name)) . "'";
 						$result = $db->sql_query($sql);
@@ -527,7 +543,7 @@ class acp_attachments
 
 					if (sizeof($extension_list))
 					{
-						$sql = 'UPDATE ' . EXTENSIONS_TABLE . " 
+						$sql = 'UPDATE ' . EXTENSIONS_TABLE . "
 							SET group_id = $group_id
 							WHERE " . $db->sql_in_set('extension_id', $extension_list);
 						$db->sql_query($sql);
@@ -559,15 +575,15 @@ class acp_attachments
 
 						if (confirm_box(true))
 						{
-							$sql = 'SELECT group_name 
+							$sql = 'SELECT group_name
 								FROM ' . EXTENSION_GROUPS_TABLE . "
 								WHERE group_id = $group_id";
 							$result = $db->sql_query($sql);
 							$group_name = (string) $db->sql_fetchfield('group_name');
 							$db->sql_freeresult($result);
 
-							$sql = 'DELETE 
+							$sql = 'DELETE
-								FROM ' . EXTENSION_GROUPS_TABLE . " 
+								FROM ' . EXTENSION_GROUPS_TABLE . "
 								WHERE group_id = $group_id";
 							$db->sql_query($sql);
 
@@ -983,7 +999,7 @@ class acp_attachments
 						'PHYSICAL_FILENAME'	=> basename($row['physical_filename']),
 						'ATTACH_ID'			=> $row['attach_id'],
 						'POST_IDS'			=> (!empty($post_ids[$row['attach_id']])) ? $post_ids[$row['attach_id']] : '',
-						'U_FILE'			=> append_sid($phpbb_root_path . 'download.' . $phpEx, 'mode=view&amp;id=' . $row['attach_id']))
+						'U_FILE'			=> append_sid($phpbb_root_path . 'download/file.' . $phpEx, 'mode=view&amp;id=' . $row['attach_id']))
 					);
 				}
 				$db->sql_freeresult($result);

phpBB/includes/acp/acp_ban.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -23,11 +31,18 @@ class acp_ban
 		include($phpbb_root_path . 'includes/functions_user.' . $phpEx);
 
 		$bansubmit	= (isset($_POST['bansubmit'])) ? true : false;
-		$unbansubmit= (isset($_POST['unbansubmit'])) ? true : false;
+		$unbansubmit = (isset($_POST['unbansubmit'])) ? true : false;
 		$current_time = time();
 
 		$user->add_lang(array('acp/ban', 'acp/users'));
 		$this->tpl_name = 'acp_ban';
+		$form_key = 'acp_ban';
+		add_form_key($form_key);
+
+		if (($bansubmit || $unbansubmit) && !check_form_key($form_key))
+		{
+			trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
+		}
 
 		// Ban submitted?
 		if ($bansubmit)
@@ -97,9 +112,8 @@ class acp_ban
 			'S_USERNAME_BAN'	=> ($mode == 'user') ? true : false,
 			
 			'U_ACTION'			=> $this->u_action,
-			'U_FIND_USER'		=> append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=searchuser&amp;form=acp_ban&amp;field=ban'),
+			'U_FIND_USERNAME'	=> append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=searchuser&amp;form=acp_ban&amp;field=ban'),
-			)
+		));
-		);
 	}
 
 	/**
@@ -179,10 +193,10 @@ class acp_ban
 			foreach ($ban_length as $ban_id => $length)
 			{
 				$template->assign_block_vars('ban_length', array(
-					'BAN_ID'	=> $ban_id,
+					'BAN_ID'	=> (int) $ban_id,
 					'LENGTH'	=> $length,
-					'A_LENGTH'	=> addslashes($length))
+					'A_LENGTH'	=> addslashes($length),
-				);
+				));
 			}
 		}
 
@@ -193,8 +207,8 @@ class acp_ban
 				$template->assign_block_vars('ban_reason', array(
 					'BAN_ID'	=> $ban_id,
 					'REASON'	=> $reason,
-					'A_REASON'	=> addslashes(htmlspecialchars_decode($reason)))
+					'A_REASON'	=> addslashes(htmlspecialchars_decode($reason)),
-				);
+				));
 			}
 		}
 
@@ -205,8 +219,8 @@ class acp_ban
 				$template->assign_block_vars('ban_give_reason', array(
 					'BAN_ID'	=> $ban_id,
 					'REASON'	=> $reason,
-					'A_REASON'	=> addslashes(htmlspecialchars_decode($reason)))
+					'A_REASON'	=> addslashes(htmlspecialchars_decode($reason)),
-				);
+				));
 			}
 		}
 

phpBB/includes/acp/acp_bbcodes.php

@@ -8,6 +8,14 @@
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -28,6 +36,9 @@ class acp_bbcodes
 
 		$this->tpl_name = 'acp_bbcodes';
 		$this->page_title = 'ACP_BBCODES';
+		$form_key = 'acp_bbcodes';
+
+		add_form_key($form_key);
 
 		// Set up mode-specific vars
 		switch ($action)
@@ -320,6 +331,17 @@ class acp_bbcodes
 			)
 		);
 
+		$sp_tokens = array(
+			'URL'	 => '(?i)((?:' . str_replace(array('!', '\#'), array('\!', '#'), get_preg_expression('url')) . ')|(?:' . str_replace(array('!', '\#'), array('\!', '#'), get_preg_expression('www_url')) . '))(?-i)',
+			'LOCAL_URL'	 => '(?i)(' . str_replace(array('!', '\#'), array('\!', '#'), get_preg_expression('relative_url')) . ')(?-i)',
+			'EMAIL' => '([a-zA-Z0-9]+[a-zA-Z0-9\-\._]*@(?:(?:[0-9]{1,3}\.){3,5}[0-9]{1,3}|[a-zA-Z0-9]+[a-zA-Z0-9\-\._]*\.[a-zA-Z]+))',
+			'TEXT' => '(.*?)',
+			'SIMPLETEXT' => '([a-zA-Z0-9-+.,_ ]+)',
+			'IDENTIFIER' => '([a-zA-Z0-9-_]+)',
+			'COLOR' => '([a-zA-Z]+|#[0-9abcdefABCDEF]+)',
+			'NUMBER' => '([0-9]+)',
+		);
+
 		$pad = 0;
 		$modifiers = 'i';
 
@@ -365,7 +387,7 @@ class acp_bbcodes
 				$fp_match = str_replace(preg_quote($token, '!'), $regex, $fp_match);
 				$fp_replace = str_replace($token, $replace, $fp_replace);
 
-				$sp_match = str_replace(preg_quote($token, '!'), '(.*?)', $sp_match);
+				$sp_match = str_replace(preg_quote($token, '!'), $sp_tokens[$token_type], $sp_match);
 				$sp_replace = str_replace($token, '${' . ($n + 1) . '}', $sp_replace);
 			}
 

phpBB/includes/acp/acp_board.php

@@ -9,6 +9,14 @@
 * @todo add cron intervals to server settings? (database_gc, queue_interval, session_gc, search_gc, cache_gc, warnings_gc)
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -27,6 +35,9 @@ class acp_board
 		$action	= request_var('action', '');
 		$submit = (isset($_POST['submit'])) ? true : false;
 
+		$form_key = 'acp_board';
+		add_form_key($form_key);
+
 		/**
 		*	Validation types are:
 		*		string, int, bool,
@@ -212,6 +223,8 @@ class acp_board
 						'enable_confirm'		=> array('lang' => 'VISUAL_CONFIRM_REG',	'validate' => 'bool',	'type' => 'radio:yes_no', 'explain' => true),
 						'max_login_attempts'	=> array('lang' => 'MAX_LOGIN_ATTEMPTS',	'validate' => 'int',	'type' => 'text:3:3', 'explain' => true),
 						'max_reg_attempts'		=> array('lang' => 'REG_LIMIT',				'validate' => 'int',	'type' => 'text:4:4', 'explain' => true),
+						'min_time_reg'			=> array('lang' => 'MIN_TIME_REG',			'validate' => 'int',	'type' => 'text:3:3', 'explain' => true, 'append' => ' ' . $user->lang['SECONDS']),
+						'min_time_terms'		=> array('lang' => 'MIN_TIME_TERMS',		'validate' => 'int',	'type' => 'text:3:3', 'explain' => true, 'append' => ' ' . $user->lang['SECONDS']),
 
 						'legend3'			=> 'COPPA',
 						'coppa_enable'		=> array('lang' => 'ENABLE_COPPA',		'validate' => 'bool',	'type' => 'radio:yes_no', 'explain' => true),
@@ -314,6 +327,10 @@ class acp_board
 						'chg_passforce'			=> array('lang' => 'FORCE_PASS_CHANGE',		'validate' => 'int',	'type' => 'text:3:3', 'explain' => true, 'append' => ' ' . $user->lang['DAYS']),
 						'max_login_attempts'	=> array('lang' => 'MAX_LOGIN_ATTEMPTS',	'validate' => 'int',	'type' => 'text:3:3', 'explain' => true),
 						'tpl_allow_php'			=> array('lang' => 'TPL_ALLOW_PHP',			'validate' => 'bool',	'type' => 'radio:yes_no', 'explain' => true),
+						'form_token_lifetime'	=> array('lang' => 'FORM_TIME_MAX',			'validate' => 'int',	'type' => 'text:5:5', 'explain' => true, 'append' => ' ' . $user->lang['SECONDS']),
+						'form_token_mintime'	=> array('lang' => 'FORM_TIME_MIN',			'validate' => 'int',	'type' => 'text:5:5', 'explain' => true, 'append' => ' ' . $user->lang['SECONDS']),
+						'form_token_sid_guests'	=> array('lang' => 'FORM_SID_GUESTS',		'validate' => 'bool',	'type' => 'radio:yes_no', 'explain' => true),
+
 					)
 				);
 			break;
@@ -360,6 +377,10 @@ class acp_board
 		// We validate the complete config if whished
 		validate_config_vars($display_vars['vars'], $cfg_array, $error);
 
+		if ($submit && !check_form_key($form_key))
+		{
+			$error[] = $user->lang['FORM_INVALID'];
+		}
 		// Do not write values if there is an error
 		if (sizeof($error))
 		{
@@ -407,7 +428,7 @@ class acp_board
 				{
 					if (preg_match('#^auth_(.*?)\.' . $phpEx . '$#', $file))
 					{
-						$auth_plugins[] = preg_replace('#^auth_(.*?)\.' . $phpEx . '$#', '\1', $file);
+						$auth_plugins[] = basename(preg_replace('#^auth_(.*?)\.' . $phpEx . '$#', '\1', $file));
 					}
 				}
 				closedir($dp);
@@ -459,7 +480,7 @@ class acp_board
 
 			if ($submit && (($cfg_array['auth_method'] != $this->new_config['auth_method']) || $updated_auth_settings))
 			{
-				$method = $cfg_array['auth_method'];
+				$method = basename($cfg_array['auth_method']);
 				if ($method && in_array($method, $auth_plugins))
 				{
 					include_once($phpbb_root_path . 'includes/auth/auth_' . $method . '.' . $phpEx);
@@ -476,7 +497,7 @@ class acp_board
 							trigger_error($error . adm_back_link($this->u_action), E_USER_WARNING);
 						}
 					}
-					set_config('auth_method', $cfg_array['auth_method']);
+					set_config('auth_method', basename($cfg_array['auth_method']));
 				}
 				else
 				{
@@ -784,7 +805,7 @@ class acp_board
 		$user->timezone = $old_tz;
 		$user->dst = $old_dst;
 
-		return "<select name=\"dateoptions\" id=\"dateoptions\" onchange=\"if (this.value == 'custom') { document.getElementById('$key').value = '$value'; } else { document.getElementById('$key').value = this.value; }\">$dateformat_options</select>
+		return "<select name=\"dateoptions\" id=\"dateoptions\" onchange=\"if (this.value == 'custom') { document.getElementById('" . addslashes($key) . "').value = '" . addslashes($value) . "'; } else { document.getElementById('" . addslashes($key) . "').value = this.value; }\">$dateformat_options</select>
 		<input type=\"text\" name=\"config[$key]\" id=\"$key\" value=\"$value\" maxlength=\"30\" />";
 	}
 }

phpBB/includes/acp/acp_bots.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -35,6 +43,13 @@ class acp_bots
 		$user->add_lang('acp/bots');
 		$this->tpl_name = 'acp_bots';
 		$this->page_title = 'ACP_BOTS';
+		$form_key = 'acp_bots';
+		add_form_key($form_key);
+
+		if ($submit && !check_form_key($form_key))
+		{
+			$error[] = $user->lang['FORM_INVALID'];
+		}
 
 		// User wants to do something, how inconsiderate of them!
 		switch ($action)
@@ -44,7 +59,7 @@ class acp_bots
 				{
 					$sql_id = ($bot_id) ? " = $bot_id" : ' IN (' . implode(', ', $mark) . ')';
 
-					$sql = 'UPDATE ' . BOTS_TABLE . " 
+					$sql = 'UPDATE ' . BOTS_TABLE . "
 						SET bot_active = 1
 						WHERE bot_id $sql_id";
 					$db->sql_query($sql);
@@ -58,7 +73,7 @@ class acp_bots
 				{
 					$sql_id = ($bot_id) ? " = $bot_id" : ' IN (' . implode(', ', $mark) . ')';
 
-					$sql = 'UPDATE ' . BOTS_TABLE . " 
+					$sql = 'UPDATE ' . BOTS_TABLE . "
 						SET bot_active = 0
 						WHERE bot_id $sql_id";
 					$db->sql_query($sql);
@@ -75,8 +90,8 @@ class acp_bots
 						// We need to delete the relevant user, usergroup and bot entries ...
 						$sql_id = ($bot_id) ? " = $bot_id" : ' IN (' . implode(', ', $mark) . ')';
 
-						$sql = 'SELECT bot_name, user_id 
+						$sql = 'SELECT bot_name, user_id
-							FROM ' . BOTS_TABLE . " 
+							FROM ' . BOTS_TABLE . "
 							WHERE bot_id $sql_id";
 						$result = $db->sql_query($sql);
 
@@ -90,7 +105,7 @@ class acp_bots
 
 						$db->sql_transaction('begin');
 
-						$sql = 'DELETE FROM ' . BOTS_TABLE . " 
+						$sql = 'DELETE FROM ' . BOTS_TABLE . "
 							WHERE bot_id $sql_id";
 						$db->sql_query($sql);
 
@@ -193,9 +208,9 @@ class acp_bots
 						// New bot? Create a new user and group entry
 						if ($action == 'add')
 						{
-							$sql = 'SELECT group_id, group_colour 
+							$sql = 'SELECT group_id, group_colour
-								FROM ' . GROUPS_TABLE . " 
+								FROM ' . GROUPS_TABLE . "
-								WHERE group_name = 'BOTS' 
+								WHERE group_name = 'BOTS'
 									AND group_type = " . GROUP_SPECIAL;
 							$result = $db->sql_query($sql);
 							$group_row = $db->sql_fetchrow($result);
@@ -208,22 +223,22 @@ class acp_bots
 						
 
 							$user_id = user_add(array(
-								'user_type'				=> (int) USER_IGNORE, 
+								'user_type'				=> (int) USER_IGNORE,
-								'group_id'				=> (int) $group_row['group_id'], 
+								'group_id'				=> (int) $group_row['group_id'],
-								'username'				=> (string) $bot_row['bot_name'], 
+								'username'				=> (string) $bot_row['bot_name'],
 								'user_regdate'			=> time(),
 								'user_password'			=> '',
 								'user_colour'			=> (string) $group_row['group_colour'],
 								'user_email'			=> '',
-								'user_lang'				=> (string) $bot_row['bot_lang'], 
+								'user_lang'				=> (string) $bot_row['bot_lang'],
 								'user_style'			=> (int) $bot_row['bot_style'],
 								'user_allow_massemail'	=> 0,
 							));
 	
 							$sql = 'INSERT INTO ' . BOTS_TABLE . ' ' . $db->sql_build_array('INSERT', array(
 								'user_id'		=> (int) $user_id,
-								'bot_name'		=> (string) $bot_row['bot_name'], 
+								'bot_name'		=> (string) $bot_row['bot_name'],
-								'bot_active'	=> (int) $bot_row['bot_active'], 
+								'bot_active'	=> (int) $bot_row['bot_active'],
 								'bot_agent'		=> (string) $bot_row['bot_agent'],
 								'bot_ip'		=> (string) $bot_row['bot_ip'])
 							);
@@ -233,8 +248,8 @@ class acp_bots
 						}
 						else if ($bot_id)
 						{
-							$sql = 'SELECT user_id, bot_name 
+							$sql = 'SELECT user_id, bot_name
-								FROM ' . BOTS_TABLE . " 
+								FROM ' . BOTS_TABLE . "
 								WHERE bot_id = $bot_id";
 							$result = $db->sql_query($sql);
 							$row = $db->sql_fetchrow($result);
@@ -260,8 +275,8 @@ class acp_bots
 							$db->sql_query($sql);
 
 							$sql = 'UPDATE ' . BOTS_TABLE . ' SET ' . $db->sql_build_array('UPDATE', array(
-								'bot_name'		=> (string) $bot_row['bot_name'], 
+								'bot_name'		=> (string) $bot_row['bot_name'],
-								'bot_active'	=> (int) $bot_row['bot_active'], 
+								'bot_active'	=> (int) $bot_row['bot_active'],
 								'bot_agent'		=> (string) $bot_row['bot_agent'],
 								'bot_ip'		=> (string) $bot_row['bot_ip'])
 							) . " WHERE bot_id = $bot_id";
@@ -285,7 +300,7 @@ class acp_bots
 				}
 				else if ($bot_id)
 				{
-					$sql = 'SELECT b.*, u.user_lang, u.user_style 
+					$sql = 'SELECT b.*, u.user_lang, u.user_style
 						FROM ' . BOTS_TABLE . ' b, ' . USERS_TABLE . " u
 						WHERE b.bot_id = $bot_id
 							AND u.user_id = b.user_id";
@@ -351,7 +366,7 @@ class acp_bots
 			'S_BOT_OPTIONS'	=> $s_options)
 		);
 
-		$sql = 'SELECT b.bot_id, b.bot_name, b.bot_active, u.user_lastvisit 
+		$sql = 'SELECT b.bot_id, b.bot_name, b.bot_active, u.user_lastvisit
 			FROM ' . BOTS_TABLE . ' b, ' . USERS_TABLE . ' u
 			WHERE u.user_id = b.user_id
 			ORDER BY u.user_lastvisit DESC, b.bot_name ASC';

phpBB/includes/acp/acp_captcha.php

@@ -1,12 +1,20 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -46,7 +54,7 @@ class acp_captcha
 			}
 			$captcha = new captcha();
 			$captcha->execute(gen_rand_string(mt_rand(5, 8)), time());
-			exit;
+			exit_handler();
 		}
 
 		$config_vars = array(
@@ -57,9 +65,12 @@ class acp_captcha
 
 		$this->tpl_name = 'acp_captcha';
 		$this->page_title = 'ACP_VC_SETTINGS';
+		$form_key = 'acp_captcha';
+		add_form_key($form_key);
+
 		$submit = request_var('submit', '');
-		
+
-		if ($submit)
+		if ($submit && check_form_key($form_key))
 		{
 			$config_vars = array_keys($config_vars);
 			foreach ($config_vars as $config_var)
@@ -73,6 +84,10 @@ class acp_captcha
 			}
 			trigger_error($user->lang['CONFIG_UPDATED'] . adm_back_link($this->u_action));
 		}
+		else if ($submit)
+		{
+				trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action));
+		}
 		else
 		{
 			

phpBB/includes/acp/acp_database.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -713,7 +721,7 @@ class mysql_extractor extends base_extractor
 
 			// Get field information
 			$field = array();
-			for ($i = 0; $i < $fields_cnt; $i++) 
+			for ($i = 0; $i < $fields_cnt; $i++)
 			{
 				$field[] = mysql_fetch_field($result, $i);
 			}
@@ -915,8 +923,8 @@ class sqlite_extractor extends base_extractor
 		$sql_data .= "DROP TABLE $table_name;\n";
 
 		$sql = "SELECT sql
-			FROM sqlite_master 
+			FROM sqlite_master
-			WHERE type = 'table' 
+			WHERE type = 'table'
 				AND name = '" . $db->sql_escape($table_name) . "'
 			ORDER BY type DESC, name;";
 		$result = $db->sql_query($sql);
@@ -974,8 +982,8 @@ class sqlite_extractor extends base_extractor
 		else
 		{
 			$sql = "SELECT sql
-				FROM sqlite_master 
+				FROM sqlite_master
-				WHERE type = 'table' 
+				WHERE type = 'table'
 					AND name = '" . $table_name . "'";
 			$table_data = sqlite_single_query($db->db_connect_id, $sql);
 			$table_data = preg_replace('#CREATE\s+TABLE\s+"?' . $table_name . '"?#i', '', $table_data);

phpBB/includes/acp/acp_disallow.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -28,9 +36,17 @@ class acp_disallow
 		$this->tpl_name = 'acp_disallow';
 		$this->page_title = 'ACP_DISALLOW_USERNAMES';
 
+		$form_key = 'acp_disallow';
+		add_form_key($form_key);
+
 		$disallow = (isset($_POST['disallow'])) ? true : false;
 		$allow = (isset($_POST['allow'])) ? true : false;
 
+		if (($allow || $disallow) && !check_form_key($form_key))
+		{
+			trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
+		}
+
 		if ($disallow)
 		{
 			$disallowed_user = str_replace('*', '%', utf8_normalize_nfc(request_var('disallowed_user', '', true)));

phpBB/includes/acp/acp_email.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -24,6 +32,9 @@ class acp_email
 		$this->tpl_name = 'acp_email';
 		$this->page_title = 'ACP_MASS_EMAIL';
 
+		$form_key = 'acp_email';
+		add_form_key($form_key);
+
 		// Set some vars
 		$submit = (isset($_POST['submit'])) ? true : false;
 		$error = array();
@@ -36,11 +47,16 @@ class acp_email
 		// Do the job ...
 		if ($submit)
 		{
-			// Error checking needs to go here ... if no subject and/or no message then skip 
+			// Error checking needs to go here ... if no subject and/or no message then skip
 			// over the send and return to the form
 			$use_queue		= (isset($_POST['send_immediately'])) ? false : true;
 			$priority		= request_var('mail_priority_flag', MAIL_NORMAL_PRIORITY);
 
+			if (!check_form_key($form_key))
+			{
+				$error[] = $user->lang['FORM_INVALID'];
+			}
+
 			if (!$subject)
 			{
 				$error[] = $user->lang['NO_EMAIL_SUBJECT'];
@@ -56,7 +72,7 @@ class acp_email
 				if ($usernames)
 				{
 					// If giving usernames the admin is able to email inactive users too...
-					$sql = 'SELECT username, user_email, user_jabber, user_notify_type, user_lang 
+					$sql = 'SELECT username, user_email, user_jabber, user_notify_type, user_lang
 						FROM ' . USERS_TABLE . '
 						WHERE ' . $db->sql_in_set('username_clean', array_map('utf8_clean_string', explode("\n", $usernames))) . '
 							AND user_allow_massemail = 1
@@ -66,18 +82,18 @@ class acp_email
 				{
 					if ($group_id)
 					{
-						$sql = 'SELECT u.user_email, u.username, u.username_clean, u.user_lang, u.user_jabber, u.user_notify_type 
+						$sql = 'SELECT u.user_email, u.username, u.username_clean, u.user_lang, u.user_jabber, u.user_notify_type
-							FROM ' . USERS_TABLE . ' u, ' . USER_GROUP_TABLE . ' ug 
+							FROM ' . USERS_TABLE . ' u, ' . USER_GROUP_TABLE . ' ug
 							WHERE ug.group_id = ' . $group_id . '
 								AND ug.user_pending = 0
-								AND u.user_id = ug.user_id 
+								AND u.user_id = ug.user_id
 								AND u.user_allow_massemail = 1
 								AND u.user_type IN (' . USER_NORMAL . ', ' . USER_FOUNDER . ')
 							ORDER BY u.user_lang, u.user_notify_type';
 					}
 					else
 					{
-						$sql = 'SELECT username, username_clean, user_email, user_jabber, user_notify_type, user_lang 
+						$sql = 'SELECT username, username_clean, user_email, user_jabber, user_notify_type, user_lang
 							FROM ' . USERS_TABLE . '
 							WHERE user_allow_massemail = 1
 								AND user_type IN (' . USER_NORMAL . ', ' . USER_FOUNDER . ')
@@ -235,7 +251,6 @@ class acp_email
 			'S_GROUP_OPTIONS'		=> $select_list,
 			'USERNAMES'				=> $usernames,
 			'U_FIND_USERNAME'		=> append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=searchuser&amp;form=acp_email&amp;field=usernames'),
-			'UA_FIND_USERNAME'		=> append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=searchuser&form=acp_email&field=usernames', false),
 			'SUBJECT'				=> $subject,
 			'MESSAGE'				=> $message,
 			'S_PRIORITY_OPTIONS'	=> $s_priority_options)

phpBB/includes/acp/acp_forums.php

@@ -8,6 +8,14 @@
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -25,13 +33,20 @@ class acp_forums
 		$this->tpl_name = 'acp_forums';
 		$this->page_title = 'ACP_MANAGE_FORUMS';
 
+		$form_key = 'acp_forums';
+		add_form_key($form_key);
+
 		$action		= request_var('action', '');
 		$update		= (isset($_POST['update'])) ? true : false;
 		$forum_id	= request_var('f', 0);
 
 		$this->parent_id	= request_var('parent_id', 0);
-
 		$forum_data = $errors = array();
+		if ($update && !check_form_key($form_key))
+		{
+			$update = false;
+			$error[] = $user->lang['FORM_INVALID'];
+		}
 
 		// Check additional permissions
 		switch ($action)
@@ -41,7 +56,7 @@ class acp_forums
 				$total = request_var('total', 0);
 
 				$this->display_progress_bar($start, $total);
-				exit;
+				exit_handler();
 			break;
 
 			case 'delete':
@@ -118,8 +133,8 @@ class acp_forums
 						'forum_image'			=> request_var('forum_image', ''),
 						'forum_style'			=> request_var('forum_style', 0),
 						'display_on_index'		=> request_var('display_on_index', false),
-						'forum_topics_per_page'	=> request_var('topics_per_page', 0), 
+						'forum_topics_per_page'	=> request_var('topics_per_page', 0),
-						'enable_indexing'		=> request_var('enable_indexing', true), 
+						'enable_indexing'		=> request_var('enable_indexing', true),
 						'enable_icons'			=> request_var('enable_icons', false),
 						'enable_prune'			=> request_var('enable_prune', false),
 						'enable_post_review'	=> request_var('enable_post_review', true),
@@ -131,6 +146,7 @@ class acp_forums
 						'prune_sticky'			=> request_var('prune_sticky', false),
 						'forum_password'		=> request_var('forum_password', '', true),
 						'forum_password_confirm'=> request_var('forum_password_confirm', '', true),
+						'forum_password_unset'	=> request_var('forum_password_unset', false),
 					);
 
 					// Use link_display_on_index setting if forum type is link
@@ -163,7 +179,8 @@ class acp_forums
 						$forum_perm_from = request_var('forum_perm_from', 0);
 
 						// Copy permissions?
-						if ($forum_perm_from && !empty($forum_perm_from) && $forum_perm_from != $forum_data['forum_id'])
+						if ($forum_perm_from && !empty($forum_perm_from) && $forum_perm_from != $forum_data['forum_id'] &&
+							(($action != 'edit') || empty($forum_id) || ($auth->acl_get('a_fauth') && $auth->acl_get('a_authusers') && $auth->acl_get('a_authgroups') && $auth->acl_get('a_mauth'))))
 						{
 							// if we edit a forum delete current permissions first
 							if ($action == 'edit')
@@ -343,7 +360,7 @@ class acp_forums
 
 						$template->assign_vars(array(
 							'U_PROGRESS_BAR'		=> $this->u_action . "&action=progress_bar&start=$topics_done&total={$row['forum_topics_real']}",
-							'UA_PROGRESS_BAR'		=> str_replace('&', '&', $this->u_action) . "&action=progress_bar&start=$topics_done&total={$row['forum_topics_real']}",
+							'UA_PROGRESS_BAR'		=> addslashes($this->u_action . "&action=progress_bar&start=$topics_done&total={$row['forum_topics_real']}"),
 							'S_CONTINUE_SYNC'		=> true,
 							'L_PROGRESS_EXPLAIN'	=> sprintf($user->lang['SYNC_IN_PROGRESS_EXPLAIN'], $topics_done, $row['forum_topics_real']))
 						);
@@ -357,7 +374,7 @@ class acp_forums
 
 				$template->assign_vars(array(
 					'U_PROGRESS_BAR'		=> $this->u_action . '&action=progress_bar',
-					'UA_PROGRESS_BAR'		=> str_replace('&', '&', $this->u_action) . '&action=progress_bar',
+					'UA_PROGRESS_BAR'		=> addslashes($this->u_action . '&action=progress_bar'),
 					'S_CONTINUE_SYNC'		=> true,
 					'L_PROGRESS_EXPLAIN'	=> sprintf($user->lang['SYNC_IN_PROGRESS_EXPLAIN'], 0, $row['forum_topics_real']))
 				);
@@ -454,8 +471,8 @@ class acp_forums
 							'forum_image'			=> '',
 							'forum_style'			=> 0,
 							'display_on_index'		=> false,
-							'forum_topics_per_page'	=> 0, 
+							'forum_topics_per_page'	=> 0,
-							'enable_indexing'		=> true, 
+							'enable_indexing'		=> true,
 							'enable_icons'			=> false,
 							'enable_prune'			=> false,
 							'prune_days'			=> 7,
@@ -593,6 +610,11 @@ class acp_forums
 						}
 					}
 				}
+				
+				if (strlen($forum_data['forum_password']) == 32)
+				{
+					$errors[] = 'FORUM_PASSWORD_OLD';
+				}
 
 				$template->assign_vars(array(
 					'S_EDIT_FORUM'		=> true,
@@ -619,8 +641,6 @@ class acp_forums
 					'PRUNE_DAYS'				=> $forum_data['prune_days'],
 					'PRUNE_VIEWED'				=> $forum_data['prune_viewed'],
 					'TOPICS_PER_PAGE'			=> $forum_data['forum_topics_per_page'],
-					'FORUM_PASSWORD'			=> $forum_data['forum_password'],
-					'FORUM_PASSWORD_CONFIRM'	=> $forum_data['forum_password_confirm'],
 					'FORUM_RULES_LINK'			=> $forum_data['forum_rules_link'],
 					'FORUM_RULES'				=> $forum_data['forum_rules'],
 					'FORUM_RULES_PREVIEW'		=> $forum_rules_preview,
@@ -628,6 +648,7 @@ class acp_forums
 					'S_BBCODE_CHECKED'			=> ($forum_rules_data['allow_bbcode']) ? true : false,
 					'S_SMILIES_CHECKED'			=> ($forum_rules_data['allow_smilies']) ? true : false,
 					'S_URLS_CHECKED'			=> ($forum_rules_data['allow_urls']) ? true : false,
+					'S_FORUM_PASSWORD_SET'		=> (empty($forum_data['forum_password'])) ? false : true,
 
 					'FORUM_DESC'				=> $forum_desc_data['text'],
 					'S_DESC_BBCODE_CHECKED'		=> ($forum_desc_data['allow_bbcode']) ? true : false,
@@ -656,8 +677,8 @@ class acp_forums
 					'S_PRUNE_STICKY'			=> ($forum_data['forum_flags'] & FORUM_FLAG_PRUNE_STICKY) ? true : false,
 					'S_DISPLAY_ACTIVE_TOPICS'	=> ($forum_data['forum_flags'] & FORUM_FLAG_ACTIVE_TOPICS) ? true : false,
 					'S_ENABLE_POST_REVIEW'		=> ($forum_data['forum_flags'] & FORUM_FLAG_POST_REVIEW) ? true : false,
-					)
+					'S_CAN_COPY_PERMISSIONS'	=> ($action != 'edit' || empty($forum_id) || ($auth->acl_get('a_fauth') && $auth->acl_get('a_authusers') && $auth->acl_get('a_authgroups') && $auth->acl_get('a_mauth'))) ? true : false,
-				);
+				));
 
 				return;
 
@@ -829,8 +850,8 @@ class acp_forums
 			'U_ACTION'		=> $this->u_action . '&parent_id=' . $this->parent_id,
 
 			'U_PROGRESS_BAR'	=> $this->u_action . '&action=progress_bar',
-			'UA_PROGRESS_BAR'	=> str_replace('&', '&', $this->u_action) . '&action=progress_bar')
+			'UA_PROGRESS_BAR'	=> addslashes($this->u_action . '&action=progress_bar'),
-		);
+		));
 	}
 
 	/**
@@ -927,7 +948,22 @@ class acp_forums
 		{
 			return $errors;
 		}
-
+ 
+ 		// As we don't know the old password, it's kinda tricky to detect changes
+		if ($forum_data_sql['forum_password_unset'])
+		{
+			$forum_data_sql['forum_password'] = '';
+		}
+		else if (empty($forum_data_sql['forum_password']))
+		{
+			unset($forum_data_sql['forum_password']);
+		}
+		else
+		{
+			$forum_data_sql['forum_password'] = phpbb_hash($forum_data_sql['forum_password']);
+		}
+		unset($forum_data_sql['forum_password_unset']);
+		
 		if (!isset($forum_data_sql['forum_id']))
 		{
 			// no forum_id means we're creating a new forum
@@ -1069,7 +1105,7 @@ class acp_forums
 							$db->sql_query($sql);
 
 							// Delete forum ids from extension groups table
-							$sql = 'SELECT group_id, allowed_forums 
+							$sql = 'SELECT group_id, allowed_forums
 								FROM ' . EXTENSION_GROUPS_TABLE;
 							$result = $db->sql_query($sql);
 
@@ -1083,7 +1119,7 @@ class acp_forums
 								$allowed_forums = unserialize(trim($_row['allowed_forums']));
 								$allowed_forums = array_diff($allowed_forums, $forum_ids);
 
-								$sql = 'UPDATE ' . EXTENSION_GROUPS_TABLE . " 
+								$sql = 'UPDATE ' . EXTENSION_GROUPS_TABLE . "
 									SET allowed_forums = '" . ((sizeof($allowed_forums)) ? serialize($allowed_forums) : '') . "'
 									WHERE group_id = {$_row['group_id']}";
 								$db->sql_query($sql);
@@ -1100,7 +1136,7 @@ class acp_forums
 							return array($user->lang['NO_DESTINATION_FORUM']);
 						}
 
-						$sql = 'SELECT forum_name 
+						$sql = 'SELECT forum_name
 							FROM ' . FORUMS_TABLE . '
 							WHERE forum_id = ' . $subforums_to_id;
 						$result = $db->sql_query($sql);
@@ -1355,7 +1391,7 @@ class acp_forums
 			{
 				$log_action_posts = 'MOVE_POSTS';
 
-				$sql = 'SELECT forum_name 
+				$sql = 'SELECT forum_name
 					FROM ' . FORUMS_TABLE . '
 					WHERE forum_id = ' . $posts_to_id;
 				$result = $db->sql_query($sql);
@@ -1419,7 +1455,7 @@ class acp_forums
 			{
 				$log_action_forums = 'MOVE_FORUMS';
 
-				$sql = 'SELECT forum_name 
+				$sql = 'SELECT forum_name
 					FROM ' . FORUMS_TABLE . '
 					WHERE forum_id = ' . $subforums_to_id;
 				$result = $db->sql_query($sql);
@@ -1501,7 +1537,7 @@ class acp_forums
 		$db->sql_query($sql);
 
 		// Delete forum ids from extension groups table
-		$sql = 'SELECT group_id, allowed_forums 
+		$sql = 'SELECT group_id, allowed_forums
 			FROM ' . EXTENSION_GROUPS_TABLE;
 		$result = $db->sql_query($sql);
 
@@ -1515,7 +1551,7 @@ class acp_forums
 			$allowed_forums = unserialize(trim($row['allowed_forums']));
 			$allowed_forums = array_diff($allowed_forums, $forum_ids);
 
-			$sql = 'UPDATE ' . EXTENSION_GROUPS_TABLE . " 
+			$sql = 'UPDATE ' . EXTENSION_GROUPS_TABLE . "
 				SET allowed_forums = '" . ((sizeof($allowed_forums)) ? serialize($allowed_forums) : '') . "'
 				WHERE group_id = {$row['group_id']}";
 			$db->sql_query($sql);
@@ -1718,12 +1754,12 @@ class acp_forums
 			{
 				$sql = 'UPDATE ' . USERS_TABLE . '
 					SET user_posts = 0
-					WHERE user_id = ' . $poster_id . ' 
+					WHERE user_id = ' . $poster_id . '
 					AND user_posts < ' . $substract;
 				$db->sql_query($sql);
 				$sql = 'UPDATE ' . USERS_TABLE . '
 					SET user_posts = user_posts - ' . $substract . '
-					WHERE user_id = ' . $poster_id . ' 
+					WHERE user_id = ' . $poster_id . '
 					AND user_posts >= ' . $substract;
 				$db->sql_query($sql);
 			}
@@ -1732,7 +1768,7 @@ class acp_forums
 		$db->sql_transaction('commit');
 
 		// Make sure the overall post/topic count is correct...
-		$sql = 'SELECT COUNT(post_id) AS stat 
+		$sql = 'SELECT COUNT(post_id) AS stat
 			FROM ' . POSTS_TABLE . '
 			WHERE post_approved = 1';
 		$result = $db->sql_query($sql);
@@ -1842,7 +1878,7 @@ class acp_forums
 				ELSE {$diff_down}
 			END,
 			forum_parents = ''
-			WHERE 
+			WHERE
 				left_id BETWEEN {$left_id} AND {$right_id}
 				AND right_id BETWEEN {$left_id} AND {$right_id}";
 		$db->sql_query($sql);

phpBB/includes/acp/acp_groups.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -24,6 +32,9 @@ class acp_groups
 		$this->tpl_name = 'acp_groups';
 		$this->page_title = 'ACP_GROUPS_MANAGE';
 
+		$form_key = 'acp_groups';
+		add_form_key($form_key);
+
 		include($phpbb_root_path . 'includes/functions_user.' . $phpEx);
 
 		// Check and set some common vars
@@ -36,6 +47,7 @@ class acp_groups
 		$start		= request_var('start', 0);
 		$update		= (isset($_POST['update'])) ? true : false;
 
+
 		// Clear some vars
 		$can_upload = (file_exists($phpbb_root_path . $config['avatar_path']) && @is_writable($phpbb_root_path . $config['avatar_path']) && $file_uploads) ? true : false;
 		$group_row = array();
@@ -43,8 +55,8 @@ class acp_groups
 		// Grab basic data for group, if group_id is set and exists
 		if ($group_id)
 		{
-			$sql = 'SELECT * 
+			$sql = 'SELECT *
-				FROM ' . GROUPS_TABLE . " 
+				FROM ' . GROUPS_TABLE . "
 				WHERE group_id = $group_id";
 			$result = $db->sql_query($sql);
 			$group_row = $db->sql_fetchrow($result);
@@ -111,9 +123,9 @@ class acp_groups
 
 						do
 						{
-							$sql = 'SELECT user_id 
+							$sql = 'SELECT user_id
 								FROM ' . USER_GROUP_TABLE . "
-								WHERE group_id = $group_id 
+								WHERE group_id = $group_id
 								ORDER BY user_id";
 							$result = $db->sql_query_limit($sql, 200, $start);
 
@@ -251,13 +263,18 @@ class acp_groups
 
 				$error = array();
 				$user->add_lang('ucp');
-			
+
 				$avatar_select = basename(request_var('avatar_select', ''));
 				$category = basename(request_var('category', ''));
 
 				// Did we submit?
 				if ($update)
 				{
+					if (!check_form_key($form_key))
+					{
+						trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
+					}
+
 					$group_name	= utf8_normalize_nfc(request_var('group_name', '', true));
 					$group_desc = utf8_normalize_nfc(request_var('group_desc', '', true));
 					$group_type	= request_var('group_type', GROUP_FREE);
@@ -290,10 +307,10 @@ class acp_groups
 					{
 						// Avatar stuff
 						$var_ary = array(
-							'uploadurl'		=> array('string', true, 5, 255), 
+							'uploadurl'		=> array('string', true, 5, 255),
-							'remotelink'	=> array('string', true, 5, 255), 
+							'remotelink'	=> array('string', true, 5, 255),
-							'width'			=> array('string', true, 1, 3), 
+							'width'			=> array('string', true, 1, 3),
-							'height'		=> array('string', true, 1, 3), 
+							'height'		=> array('string', true, 1, 3),
 						);
 
 						if (!($error = validate_data($data, $var_ary)))
@@ -366,7 +383,7 @@ class acp_groups
 					if (!sizeof($error))
 					{
 						// Only set the rank, colour, etc. if it's changed or if we're adding a new
-						// group. This prevents existing group members being updated if no changes 
+						// group. This prevents existing group members being updated if no changes
 						// were made.
 
 						$group_attributes = array();
@@ -468,7 +485,7 @@ class acp_groups
 					$group_rank = $group_row['group_rank'];
 				}
 
-				$sql = 'SELECT * 
+				$sql = 'SELECT *
 					FROM ' . RANKS_TABLE . '
 					WHERE rank_special = 1
 					ORDER BY rank_title';
@@ -558,7 +575,6 @@ class acp_groups
 
 					'U_BACK'			=> $u_back,
 					'U_SWATCH'			=> append_sid("{$phpbb_admin_path}swatch.$phpEx", 'form=settings&amp;name=group_colour'),
-					'UA_SWATCH'			=> append_sid("{$phpbb_admin_path}swatch.$phpEx", 'form=settings&name=group_colour', false),
 					'U_ACTION'			=> "{$this->u_action}&amp;action=$action&amp;g=$group_id",
 					'L_AVATAR_EXPLAIN'	=> sprintf($user->lang['AVATAR_EXPLAIN'], $config['avatar_max_width'], $config['avatar_max_height'], round($config['avatar_filesize'] / 1024)),
 					)
@@ -577,9 +593,9 @@ class acp_groups
 				$this->page_title = 'GROUP_MEMBERS';
 
 				// Grab the leaders - always, on every page...
-				$sql = 'SELECT u.user_id, u.username, u.username_clean, u.user_regdate, u.user_posts, u.group_id, ug.group_leader, ug.user_pending 
+				$sql = 'SELECT u.user_id, u.username, u.username_clean, u.user_regdate, u.user_posts, u.group_id, ug.group_leader, ug.user_pending
-					FROM ' . USERS_TABLE . ' u, ' . USER_GROUP_TABLE . " ug 
+					FROM ' . USERS_TABLE . ' u, ' . USER_GROUP_TABLE . " ug
-					WHERE ug.group_id = $group_id 
+					WHERE ug.group_id = $group_id
 						AND u.user_id = ug.user_id
 						AND ug.group_leader = 1
 					ORDER BY ug.group_leader DESC, ug.user_pending ASC, u.username_clean";
@@ -600,9 +616,9 @@ class acp_groups
 				$db->sql_freeresult($result);
 
 				// Total number of group members (non-leaders)
-				$sql = 'SELECT COUNT(user_id) AS total_members 
+				$sql = 'SELECT COUNT(user_id) AS total_members
-					FROM ' . USER_GROUP_TABLE . " 
+					FROM ' . USER_GROUP_TABLE . "
-					WHERE group_id = $group_id 
+					WHERE group_id = $group_id
 						AND group_leader = 0";
 				$result = $db->sql_query($sql);
 				$total_members = (int) $db->sql_fetchfield('total_members');
@@ -628,14 +644,13 @@ class acp_groups
 					'U_ACTION'			=> $this->u_action . "&amp;g=$group_id",
 					'U_BACK'			=> $this->u_action,
 					'U_FIND_USERNAME'	=> append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=searchuser&amp;form=list&amp;field=usernames'),
-					'UA_FIND_USERNAME'	=> append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=searchuser&form=list&field=usernames', false),
+					'U_DEFAULT_ALL'		=> "{$this->u_action}&amp;action=default&amp;g=$group_id",
-					'U_DEFAULT_ALL'		=> "{$this->u_action}&amp;action=default&amp;g=$group_id")
+				));
-				);
 
 				// Grab the members
-				$sql = 'SELECT u.user_id, u.username, u.username_clean, u.user_regdate, u.user_posts, u.group_id, ug.group_leader, ug.user_pending 
+				$sql = 'SELECT u.user_id, u.username, u.username_clean, u.user_regdate, u.user_posts, u.group_id, ug.group_leader, ug.user_pending
-					FROM ' . USERS_TABLE . ' u, ' . USER_GROUP_TABLE . " ug 
+					FROM ' . USERS_TABLE . ' u, ' . USER_GROUP_TABLE . " ug
-					WHERE ug.group_id = $group_id 
+					WHERE ug.group_id = $group_id
 						AND u.user_id = ug.user_id
 						AND ug.group_leader = 0
 					ORDER BY ug.group_leader DESC, ug.user_pending ASC, u.username_clean";

phpBB/includes/acp/acp_icons.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @todo [smilies] check regular expressions for special char replacements (stored specialchared in db)
 * @package acp
@@ -30,6 +38,8 @@ class acp_icons
 		$action = (isset($_POST['import'])) ? 'import' : $action;
 		$icon_id = request_var('id', 0);
 
+		$mode = ($mode == 'smilies') ? 'smilies' : 'icons';
+
 		$this->tpl_name = 'acp_icons';
 
 		// What are we working on?
@@ -106,7 +116,7 @@ class acp_icons
 
 				if ($action == 'add' && $mode == 'smilies')
 				{
-					$sql = 'SELECT * 
+					$sql = 'SELECT *
 						FROM ' . SMILIES_TABLE . '
 						ORDER BY smiley_order';
 					$result = $db->sql_query($sql);
@@ -145,8 +155,8 @@ class acp_icons
 					}
 				}
 				
-				$sql = "SELECT * 
+				$sql = "SELECT *
-					FROM $table 
+					FROM $table
 					ORDER BY {$fields}_order " . (($icon_id || $action == 'add') ? 'DESC' : 'ASC');
 				$result = $db->sql_query($sql);
 				
@@ -200,13 +210,13 @@ class acp_icons
 				$db->sql_freeresult($result);
 
 				$order_list = '<option value="1"' . ((!isset($after)) ? ' selected="selected"' : '') . '>' . $user->lang['FIRST'] . '</option>';
- 				$add_order_list = '<option value="1">' . $user->lang['FIRST'] . '</option>';
+				$add_order_list = '<option value="1">' . $user->lang['FIRST'] . '</option>';
- 
+
 				if ($action == 'add')
 				{
 					$data = $_images;
 				}
-				 
+
 				$colspan = (($mode == 'smilies') ? '7' : '5');
 				$colspan += ($icon_id) ? 1 : 0;
 				$colspan += ($action == 'add') ? 2 : 0;
@@ -241,6 +251,7 @@ class acp_icons
 				{
 					$template->assign_block_vars('items', array(
 						'IMG'		=> $img,
+						'A_IMG'		=> addslashes($img),
 						'IMG_SRC'	=> $phpbb_root_path . $img_path . '/' . $img,
 
 						'CODE'		=> ($mode == 'smilies' && isset($img_row['code'])) ? $img_row['code'] : '',
@@ -385,7 +396,7 @@ class acp_icons
 						if ($action == 'modify'  && !empty($image_id[$image]))
 						{
 							$sql = "UPDATE $table
-								SET " . $db->sql_build_array('UPDATE', $img_sql) . " 
+								SET " . $db->sql_build_array('UPDATE', $img_sql) . "
 								WHERE {$fields}_id = " . $image_id[$image];
 							$db->sql_query($sql);
 							$icons_updated++;
@@ -448,7 +459,7 @@ class acp_icons
 					{
 						if (preg_match_all("#'(.*?)', ?#", $pak_entry, $data))
 						{
-							if ((sizeof($data[1]) != 4 && $mode == 'icons') || 
+							if ((sizeof($data[1]) != 4 && $mode == 'icons') ||
 								(sizeof($data[1]) != 6 && $mode == 'smilies'))
 							{
 								trigger_error($user->lang['WRONG_PAK_TYPE'] . adm_back_link($this->u_action), E_USER_WARNING);
@@ -488,7 +499,7 @@ class acp_icons
 							break;
 						}
 					}
-					else 
+					else
 					{
 						$cur_img = array();
 
@@ -511,7 +522,7 @@ class acp_icons
 						$data = array();
 						if (preg_match_all("#'(.*?)', ?#", $pak_entry, $data))
 						{
-							if ((sizeof($data[1]) != 4 && $mode == 'icons') || 
+							if ((sizeof($data[1]) != 4 && $mode == 'icons') ||
 								(sizeof($data[1]) != 6 && $mode == 'smilies'))
 							{
 								trigger_error($user->lang['WRONG_PAK_TYPE'] . adm_back_link($this->u_action), E_USER_WARNING);
@@ -529,8 +540,8 @@ class acp_icons
 								$code = stripslashes($data[1][5]);
 							}
 
-							if ($current == 'replace' && 
+							if ($current == 'replace' &&
-								(($mode == 'smilies' && !empty($cur_img[$code])) || 
+								(($mode == 'smilies' && !empty($cur_img[$code])) ||
 								($mode == 'icons' && !empty($cur_img[$img]))))
 							{
 								$replace_sql = ($mode == 'smilies') ? $code : $img;
@@ -548,7 +559,7 @@ class acp_icons
 									));
 								}
 
-								$sql = "UPDATE $table SET " . $db->sql_build_array('UPDATE', $sql) . " 
+								$sql = "UPDATE $table SET " . $db->sql_build_array('UPDATE', $sql) . "
 									WHERE $field_sql = '" . $db->sql_escape($replace_sql) . "'";
 								$db->sql_query($sql);
 							}
@@ -627,7 +638,7 @@ class acp_icons
 
 			case 'send':
 
-				$sql = "SELECT * 
+				$sql = "SELECT *
 					FROM $table
 					ORDER BY {$fields}_order";
 				$result = $db->sql_query($sql);
@@ -657,8 +668,8 @@ class acp_icons
 					header('Pragma: public');
 
 					// Send out the Headers
-					header('Content-Type: text/x-delimtext; name="' . $fields . '.pak"');
+					header('Content-Type: text/x-delimtext; name="' . $mode . '.pak"');
-					header('Content-Disposition: inline; filename="' . $fields . '.pak"');
+					header('Content-Disposition: inline; filename="' . $mode . '.pak"');
 					echo $pak;
 
 					flush();
@@ -686,12 +697,12 @@ class acp_icons
 
 						case 'icons':
 							// Reset appropriate icon_ids
-							$db->sql_query('UPDATE ' . TOPICS_TABLE . " 
+							$db->sql_query('UPDATE ' . TOPICS_TABLE . "
-								SET icon_id = 0 
+								SET icon_id = 0
 								WHERE icon_id = $icon_id");
 
-							$db->sql_query('UPDATE ' . POSTS_TABLE . " 
+							$db->sql_query('UPDATE ' . POSTS_TABLE . "
-								SET icon_id = 0 
+								SET icon_id = 0
 								WHERE icon_id = $icon_id");
 						break;
 					}
@@ -733,7 +744,7 @@ class acp_icons
 				// on move_up, switch position with previous order_id...
 				$switch_order_id = ($action == 'move_down') ? $current_order + 1 : $current_order - 1;
 
-				// 
+				//
 				$sql = "UPDATE $table
 					SET {$fields}_order = $current_order
 					WHERE {$fields}_order = $switch_order_id
@@ -801,7 +812,7 @@ class acp_icons
 
 		$spacer = false;
 
-		$sql = "SELECT * 
+		$sql = "SELECT *
 			FROM $table
 			ORDER BY {$fields}_order ASC";
 		$result = $db->sql_query($sql);

phpBB/includes/acp/acp_inactive.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2006 phpBB Group 
+* @copyright (c) 2006 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -33,20 +41,29 @@ class acp_inactive
 		$action = request_var('action', '');
 		$mark	= (isset($_REQUEST['mark'])) ? request_var('mark', array(0)) : array();
 		$start	= request_var('start', 0);
+		$submit = isset($_POST['submit']);
 
 		// Sort keys
 		$sort_days	= request_var('st', 0);
 		$sort_key	= request_var('sk', 'i');
 		$sort_dir	= request_var('sd', 'd');
 
-		if (sizeof($mark))
+		$form_key = 'acp_inactive';
+		add_form_key($form_key);
+
+		if ($submit && sizeof($mark))
 		{
+			if ($action !== 'delete' && !check_form_key($form_key))
+			{
+				trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
+			}
+
 			switch ($action)
 			{
 				case 'activate':
 				case 'delete':
 
-					$sql = 'SELECT user_id, username 
+					$sql = 'SELECT user_id, username
 						FROM ' . USERS_TABLE . '
 						WHERE ' . $db->sql_in_set('user_id', $mark);
 					$result = $db->sql_query($sql);
@@ -107,14 +124,27 @@ class acp_inactive
 					}
 					else if ($action == 'delete')
 					{
-						if (!$auth->acl_get('a_userdel'))
+						if (confirm_box(true))
 						{
-							trigger_error($user->lang['NO_AUTH_OPERATION'] . adm_back_link($this->u_action), E_USER_WARNING);
+							if (!$auth->acl_get('a_userdel'))
-						}
+							{
+								trigger_error($user->lang['NO_AUTH_OPERATION'] . adm_back_link($this->u_action), E_USER_WARNING);
+							}
 
-						foreach ($mark as $user_id)
+							foreach ($mark as $user_id)
+							{
+								user_delete('retain', $user_id, $user_affected[$user_id]);
+							}
+						}
+						else
 						{
-							user_delete('retain', $user_id, $user_affected[$user_id]);
+							$s_hidden_fields = array(
+								'mode'			=> $mode,
+								'action'		=> $action,
+								'mark'			=> $mark,
+								'submit'		=> 1,
+							);
+							confirm_box(false, $user->lang['CONFIRM_OPERATION'], build_hidden_fields($s_hidden_fields));
 						}
 					}
 
@@ -128,8 +158,8 @@ class acp_inactive
 						trigger_error($user->lang['EMAIL_DISABLED'] . adm_back_link($this->u_action), E_USER_WARNING);
 					}
 
-					$sql = 'SELECT user_id, username, user_email, user_lang, user_jabber, user_notify_type, user_regdate, user_actkey 
+					$sql = 'SELECT user_id, username, user_email, user_lang, user_jabber, user_notify_type, user_regdate, user_actkey
-						FROM ' . USERS_TABLE . ' 
+						FROM ' . USERS_TABLE . '
 						WHERE ' . $db->sql_in_set('user_id', $mark);
 					$result = $db->sql_query($sql);
 
@@ -150,7 +180,7 @@ class acp_inactive
 
 							$messenger->assign_vars(array(
 								'USERNAME'		=> htmlspecialchars_decode($row['username']),
-								'REGISTER_DATE'	=> $user->format_date($row['user_regdate']), 
+								'REGISTER_DATE'	=> $user->format_date($row['user_regdate']),
 								'U_ACTIVATE'	=> generate_board_url() . "/ucp.$phpEx?mode=activate&u=" . $row['user_id'] . '&k=' . $row['user_actkey'])
 							);
 

phpBB/includes/acp/acp_jabber.php

@@ -9,6 +9,14 @@
 * @todo Check/enter/update transport info
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -44,8 +52,16 @@ class acp_jabber
 		$jab_package_size	= request_var('jab_package_size', $config['jab_package_size']);
 		$jab_use_ssl		= request_var('jab_use_ssl', $config['jab_use_ssl']);
 
+		$form_name = 'acp_jabber';
+		add_form_key($form_name);
+
 		if ($submit)
 		{
+			if (!check_form_key($form_name))
+			{
+				trigger_error($user->lang['FORM_INVALID']. adm_back_link($this->u_action), E_USER_WARNING);
+			}
+
 			$error = array();
 
 			$message = $user->lang['JAB_SETTINGS_CHANGED'];
@@ -93,6 +109,7 @@ class acp_jabber
 			'JAB_PACKAGE_SIZE'		=> $jab_package_size,
 			'JAB_USE_SSL'			=> $jab_use_ssl,
 			'S_CAN_USE_SSL'			=> jabber::can_use_ssl(),
+			'S_GTALK_NOTE'			=> (!@function_exists('dns_get_record')) ? true : false,
 		));
 	}
 }

phpBB/includes/acp/acp_language.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -32,14 +40,19 @@ class acp_language
 		$this->default_variables();
 
 		// Check and set some common vars
-		$action		= request_var('action', '');
 
-		$action		= (isset($_POST['update_details'])) ? 'update_details' : $action;
+		$action		= (isset($_POST['update_details'])) ? 'update_details' : '';
-		$action		= (isset($_POST['download_file'])) ? 'download_file' : $action;
+		$action		= (isset($_POST['download_file'])) ? 'download_file' : '';
-		$action		= (isset($_POST['upload_file'])) ? 'upload_file' : $action;
+		$action		= (isset($_POST['upload_file'])) ? 'upload_file' : '';
-		$action		= (isset($_POST['upload_data'])) ? 'upload_data' : $action;
+		$action		= (isset($_POST['upload_data'])) ? 'upload_data' : '';
-		$action		= (isset($_POST['submit_file'])) ? 'submit_file' : $action;
+		$action		= (isset($_POST['submit_file'])) ? 'submit_file' : '';
-		$action		= (isset($_POST['remove_store'])) ? 'details' : $action;
+		$action		= (isset($_POST['remove_store'])) ? 'details' : '';
+
+		$submit = (empty($action)) ? false : true;
+		$action = (empty($action)) ? request_var('action', '') : $action;
+
+		$form_name = 'acp_lang';
+		add_form_key('acp_lang');
 
 		$lang_id = request_var('id', 0);
 		if (isset($_POST['missing_file']))
@@ -59,7 +72,7 @@ class acp_language
 		$this->tpl_name = 'acp_language';
 		$this->page_title = 'ACP_LANGUAGE_PACKS';
 
-		if ($action == 'upload_data' && request_var('test_connection', ''))
+		if ($submit && $action == 'upload_data' && request_var('test_connection', ''))
 		{
 			$test_connection = false;
 			$action = 'upload_file';
@@ -89,6 +102,7 @@ class acp_language
 		switch ($action)
 		{
 			case 'upload_file':
+
 				include_once($phpbb_root_path . 'includes/functions_transfer.' . $phpEx);
 
 				$method = request_var('method', '');
@@ -132,6 +146,11 @@ class acp_language
 
 			case 'update_details':
 
+				if (!$submit || !check_form_key($form_name))
+				{
+					trigger_error($user->lang['FORM_INVALID']. adm_back_link($this->u_action), E_USER_WARNING);
+				}
+
 				if (!$lang_id)
 				{
 					trigger_error($user->lang['NO_LANG_ID'] . adm_back_link($this->u_action), E_USER_WARNING);
@@ -150,7 +169,7 @@ class acp_language
 					'lang_author'			=> utf8_normalize_nfc(request_var('lang_author', $row['lang_author'], true)),
 				);
 
-				$db->sql_query('UPDATE ' . LANG_TABLE . ' 
+				$db->sql_query('UPDATE ' . LANG_TABLE . '
 					SET ' . $db->sql_build_array('UPDATE', $sql_ary) . '
 					WHERE lang_id = ' . $lang_id);
 
@@ -162,8 +181,18 @@ class acp_language
 			case 'submit_file':
 			case 'download_file':
 			case 'upload_data':
+				
+				if (!$submit || !check_form_key($form_name))
+				{
+					trigger_error($user->lang['FORM_INVALID']. adm_back_link($this->u_action), E_USER_WARNING);
+				}
 
-				if (!$lang_id || empty($_POST['entry']) || !is_array($_POST['entry']))
+				if (!$lang_id || empty($_POST['entry']))
+				{
+					trigger_error($user->lang['NO_LANG_ID'] . adm_back_link($this->u_action), E_USER_WARNING);
+				}
+
+				if ($this->language_directory != 'email' && !is_array($_POST['entry']))
 				{
 					trigger_error($user->lang['NO_LANG_ID'] . adm_back_link($this->u_action), E_USER_WARNING);
 				}
@@ -180,6 +209,55 @@ class acp_language
 				$row = $db->sql_fetchrow($result);
 				$db->sql_freeresult($result);
 
+				if (!$row)
+				{
+					trigger_error($user->lang['NO_LANG_ID'] . adm_back_link($this->u_action), E_USER_WARNING);
+				}
+
+				// Before we attempt to write anything let's check if the admin really chose a correct filename
+				switch ($this->language_directory)
+				{
+					case 'email':
+						// Get email templates
+						$email_files = filelist($phpbb_root_path . 'language/' . $row['lang_iso'], 'email', 'txt');
+						$email_files = $email_files['email/'];
+
+						if (!in_array($this->language_file, $email_files))
+						{
+							trigger_error($user->lang['WRONG_LANGUAGE_FILE'] . adm_back_link($this->u_action . '&amp;action=details&amp;id=' . $lang_id), E_USER_WARNING);
+						}
+					break;
+
+					case 'acp':
+						// Get acp files
+						$acp_files = filelist($phpbb_root_path . 'language/' . $row['lang_iso'], 'acp', $phpEx);
+						$acp_files = $acp_files['acp/'];
+
+						if (!in_array($this->language_file, $acp_files))
+						{
+							trigger_error($user->lang['WRONG_LANGUAGE_FILE'] . adm_back_link($this->u_action . '&amp;action=details&amp;id=' . $lang_id), E_USER_WARNING);
+						}
+					break;
+
+					case 'mods':
+						// Get mod files
+						$mods_files = filelist($phpbb_root_path . 'language/' . $row['lang_iso'], 'mods', $phpEx);
+						$mods_files = (isset($mods_files['mods/'])) ? $mods_files['mods/'] : array();
+
+						if (!in_array($this->language_file, $mods_files))
+						{
+							trigger_error($user->lang['WRONG_LANGUAGE_FILE'] . adm_back_link($this->u_action . '&amp;action=details&amp;id=' . $lang_id), E_USER_WARNING);
+						}
+					break;
+
+					default:
+						if (!in_array($this->language_file, $this->main_files))
+						{
+							trigger_error($user->lang['WRONG_LANGUAGE_FILE'] . adm_back_link($this->u_action . '&amp;action=details&amp;id=' . $lang_id), E_USER_WARNING);
+						}
+					break;
+				}
+
 				if (!$safe_mode)
 				{
 					$mkdir_ary = array('language', 'language/' . $row['lang_iso']);
@@ -690,7 +768,7 @@ class acp_language
 
 				$db->sql_query('DELETE FROM ' . LANG_TABLE . ' WHERE lang_id = ' . $lang_id);
 
-				$sql = 'UPDATE ' . USERS_TABLE . " 
+				$sql = 'UPDATE ' . USERS_TABLE . "
 					SET user_lang = '" . $db->sql_escape($config['default_lang']) . "'
 					WHERE user_lang = '" . $db->sql_escape($row['lang_iso']) . "'";
 				$db->sql_query($sql);
@@ -869,7 +947,7 @@ class acp_language
 					trigger_error($user->lang['NO_LANG_ID'] . adm_back_link($this->u_action), E_USER_WARNING);
 				}
 
-				$sql = 'SELECT * 
+				$sql = 'SELECT *
 					FROM ' . LANG_TABLE . '
 					WHERE lang_id = ' . $lang_id;
 				$result = $db->sql_query($sql);
@@ -985,7 +1063,7 @@ class acp_language
 		}
 
 		$sql = 'SELECT user_lang, COUNT(user_lang) AS lang_count
-			FROM ' . USERS_TABLE . ' 
+			FROM ' . USERS_TABLE . '
 			GROUP BY user_lang';
 		$result = $db->sql_query($sql);
 
@@ -996,7 +1074,7 @@ class acp_language
 		}
 		$db->sql_freeresult($result);
 
-		$sql = 'SELECT * 
+		$sql = 'SELECT *
 			FROM ' . LANG_TABLE . '
 			ORDER BY lang_english_name';
 		$result = $db->sql_query($sql);
@@ -1078,15 +1156,15 @@ class acp_language
 		global $phpEx;
 
 		$this->language_file_header = '<?php
-/** 
+/**
 *
 * {FILENAME} [{LANG_NAME}]
 *
 * @package language
 * @version $' . 'Id: ' . '$
-* @copyright (c) ' . date('Y') . ' phpBB Group 
+* @copyright (c) ' . date('Y') . ' phpBB Group
 * @author {CHANGED} - {AUTHOR}
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 

phpBB/includes/acp/acp_logs.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */

phpBB/includes/acp/acp_main.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -117,7 +125,7 @@ class acp_main
 							trigger_error($user->lang['NO_AUTH_OPERATION'] . adm_back_link($this->u_action), E_USER_WARNING);
 						}
 
-						$sql = 'SELECT COUNT(post_id) AS stat 
+						$sql = 'SELECT COUNT(post_id) AS stat
 							FROM ' . POSTS_TABLE . '
 							WHERE post_approved = 1';
 						$result = $db->sql_query($sql);

phpBB/includes/acp/acp_modules.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * - Able to check for new module versions (modes changed/adjusted/added/removed)
 * Icons for:
@@ -124,7 +132,7 @@ class acp_modules
 					trigger_error($user->lang['NO_MODULE'] . adm_back_link($this->u_action . '&amp;parent_id=' . $this->parent_id), E_USER_WARNING);
 				}
 
-				$sql = 'UPDATE ' . MODULES_TABLE . ' 
+				$sql = 'UPDATE ' . MODULES_TABLE . '
 					SET module_enabled = ' . (($action == 'enable') ? 1 : 0) . "
 					WHERE module_class = '" . $db->sql_escape($this->module_class) . "'
 						AND module_id = $module_id";
@@ -310,7 +318,7 @@ class acp_modules
 					// Name options
 					$s_name_options .= '<option value="' . $option . '"' . (($option == $module_data['module_basename']) ? ' selected="selected"' : '') . '>' . $this->lang_name($values['title']) . ' [' . $this->module_class . '_' . $option . ']</option>';
 
-					$template->assign_block_vars('m_names', array('NAME' => $option));
+					$template->assign_block_vars('m_names', array('NAME' => $option, 'A_NAME' => addslashes($option)));
 
 					// Build module modes
 					foreach ($values['modes'] as $m_mode => $m_values)
@@ -346,7 +354,7 @@ class acp_modules
 					'ACTION'			=> $action,
 					'MODULE_ID'			=> $module_id,
 
-				), 
+				),
 					array_change_key_case($module_data, CASE_UPPER))
 				);
 
@@ -730,7 +738,7 @@ class acp_modules
 
 	/**
 	* Update/Add module
-	* 
+	*
 	* @param bool $run_inline if set to true errors will be returned and no logs being written
 	*/
 	function update_module_data(&$module_data, $run_inline = false)

phpBB/includes/acp/acp_permission_roles.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -35,6 +43,9 @@ class acp_permission_roles
 		$action = request_var('action', '');
 		$action = (isset($_POST['add'])) ? 'add' : $action;
 
+		$form_name = 'acp_permissions';
+		add_form_key($form_name);
+
 		switch ($mode)
 		{
 			case 'admin_roles':
@@ -134,6 +145,11 @@ class acp_permission_roles
 
 				case 'add':
 
+					if (!check_form_key($form_name))
+					{
+						trigger_error($user->lang['FORM_INVALID']. adm_back_link($this->u_action), E_USER_WARNING);
+					}
+
 					$role_name = utf8_normalize_nfc(request_var('role_name', '', true));
 					$role_description = utf8_normalize_nfc(request_var('role_description', '', true));
 					$auth_settings = request_var('setting', array('' => 0));
@@ -171,8 +187,8 @@ class acp_permission_roles
 
 					if ($action == 'edit')
 					{
-						$sql = 'UPDATE ' . ACL_ROLES_TABLE . ' 
+						$sql = 'UPDATE ' . ACL_ROLES_TABLE . '
-							SET ' . $db->sql_build_array('UPDATE', $sql_ary) . ' 
+							SET ' . $db->sql_build_array('UPDATE', $sql_ary) . '
 							WHERE role_id = ' . $role_id;
 						$db->sql_query($sql);
 					}

phpBB/includes/acp/acp_permissions.php

@@ -8,6 +8,14 @@
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -46,7 +54,6 @@ class acp_permissions
 				$this->permission_trace($user_id, $forum_id, $permission);
 				return;
 			}
-			
 			trigger_error('NO_MODE', E_USER_ERROR);
 		}
 
@@ -66,6 +73,9 @@ class acp_permissions
 		$group_id = request_var('group_id', array(0));
 		$select_all_groups = request_var('select_all_groups', 0);
 
+		$form_name = 'acp_permissions';
+		add_form_key($form_name);
+
 		// If select all groups is set, we pre-build the group id array (this option is used for other screens to link to the permission settings screen)
 		if ($select_all_groups)
 		{
@@ -214,6 +224,11 @@ class acp_permissions
 			switch ($action)
 			{
 				case 'delete':
+
+					if (!check_form_key($form_name))
+					{
+						trigger_error($user->lang['FORM_INVALID']. adm_back_link($this->u_action), E_USER_WARNING);
+					}
 					// All users/groups selected?
 					$all_users = (isset($_POST['all_users'])) ? true : false;
 					$all_groups = (isset($_POST['all_groups'])) ? true : false;
@@ -247,6 +262,10 @@ class acp_permissions
 					{
 						trigger_error($user->lang['NO_AUTH_SETTING_FOUND'] . adm_back_link($this->u_action), E_USER_WARNING);
 					}
+					if (!check_form_key($form_name))
+					{
+						trigger_error($user->lang['FORM_INVALID']. adm_back_link($this->u_action), E_USER_WARNING);
+					}
 
 					$this->set_permissions($mode, $permission_type, $auth_admin, $user_id, $group_id);
 				break;
@@ -256,6 +275,10 @@ class acp_permissions
 					{
 						trigger_error($user->lang['NO_AUTH_SETTING_FOUND'] . adm_back_link($this->u_action), E_USER_WARNING);
 					}
+					if (!check_form_key($form_name))
+					{
+						trigger_error($user->lang['FORM_INVALID']. adm_back_link($this->u_action), E_USER_WARNING);
+					}
 
 					$this->set_all_permissions($mode, $permission_type, $auth_admin, $user_id, $group_id);
 				break;
@@ -332,8 +355,7 @@ class acp_permissions
 					$template->assign_vars(array(
 						'S_SELECT_USER'			=> true,
 						'U_FIND_USERNAME'		=> append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=searchuser&form=select_victim&field=username&select_single=true'),
-						'UA_FIND_USERNAME'		=> append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=searchuser&form=select_victim&field=username&select_single=true', false))
+					));
-					);
 
 				break;
 
@@ -395,8 +417,7 @@ class acp_permissions
 						'S_DEFINED_GROUP_OPTIONS'	=> $items['group_ids_options'],
 						'S_ADD_GROUP_OPTIONS'		=> group_select_options(false, $items['group_ids'], (($user->data['user_type'] == USER_FOUNDER) ? false : 0)),
 						'U_FIND_USERNAME'			=> append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=searchuser&form=add_user&field=username&select_single=true'),
-						'UA_FIND_USERNAME'			=> append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=searchuser&form=add_user&field=username&select_single=true', false))
+					));
-					);
 
 				break;
 			}
@@ -588,7 +609,7 @@ class acp_permissions
 		}
 	}
 
-	/** 
+	/**
 	* Apply permissions
 	*/
 	function set_permissions($mode, $permission_type, &$auth_admin, &$user_id, &$group_id)
@@ -612,6 +633,14 @@ class acp_permissions
 		list($ug_id, ) = each($psubmit);
 		list($forum_id, ) = each($psubmit[$ug_id]);
 
+		if (empty($_POST['setting']) || empty($_POST['setting'][$ug_id]) || empty($_POST['setting'][$ug_id][$forum_id]) || !is_array($_POST['setting'][$ug_id][$forum_id]))
+		{
+			trigger_error('WRONG_PERMISSION_SETTING_FORMAT', E_USER_WARNING);
+		}
+
+		// We obtain and check $_POST['setting'][$ug_id][$forum_id] directly and not using request_var() because request_var()
+		// currently does not support the amount of dimensions required. ;)
+		//		$auth_settings = request_var('setting', array(0 => array(0 => array('' => 0))));
 		$auth_settings = array_map('intval', $_POST['setting'][$ug_id][$forum_id]);
 
 		// Do we have a role we want to set?
@@ -669,7 +698,7 @@ class acp_permissions
 		trigger_error($user->lang['AUTH_UPDATED'] . adm_back_link($this->u_action));
 	}
 
-	/** 
+	/**
 	* Apply all permissions
 	*/
 	function set_all_permissions($mode, $permission_type, &$auth_admin, &$user_id, &$group_id)
@@ -841,7 +870,7 @@ class acp_permissions
 		else
 		{
 			// Grab the forum details if non-zero forum_id
-			$sql = 'SELECT forum_name 
+			$sql = 'SELECT forum_name
 				FROM ' . FORUMS_TABLE . '
 				WHERE ' . $db->sql_in_set('forum_id', $forum_id);
 			$result = $db->sql_query($sql);

phpBB/includes/acp/acp_php_info.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -28,16 +36,16 @@ class acp_php_info
 		$this->tpl_name = 'acp_php_info';
 		$this->page_title = 'ACP_PHP_INFO';
 		
-		ob_start(); 
+		ob_start();
-		@phpinfo(INFO_GENERAL | INFO_CONFIGURATION | INFO_MODULES | INFO_VARIABLES); 
+		@phpinfo(INFO_GENERAL | INFO_CONFIGURATION | INFO_MODULES | INFO_VARIABLES);
-		$phpinfo = ob_get_clean(); 
+		$phpinfo = ob_get_clean();
 
 		$phpinfo = trim($phpinfo);
 
 		// Here we play around a little with the PHP Info HTML to try and stylise
 		// it along phpBB's lines ... hopefully without breaking anything. The idea
 		// for this was nabbed from the PHP annotated manual
-		preg_match_all('#<body[^>]*>(.*)</body>#si', $phpinfo, $output); 
+		preg_match_all('#<body[^>]*>(.*)</body>#si', $phpinfo, $output);
 
 		if (empty($phpinfo) || empty($output))
 		{
@@ -66,7 +74,7 @@ class acp_php_info
 
 		$orig_output = $output;
 
-		preg_match_all('#<div class="center">(.*)</div>#siU', $output, $output); 
+		preg_match_all('#<div class="center">(.*)</div>#siU', $output, $output);
 		$output = (!empty($output[1][0])) ? $output[1][0] : $orig_output;
 
 		$template->assign_var('PHPINFO', $output);

phpBB/includes/acp/acp_profile.php

@@ -8,6 +8,14 @@
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -99,8 +107,8 @@ class acp_profile
 
 				if (confirm_box(true))
 				{
-					$sql = 'SELECT field_ident 
+					$sql = 'SELECT field_ident
-						FROM ' . PROFILE_FIELDS_TABLE . " 
+						FROM ' . PROFILE_FIELDS_TABLE . "
 						WHERE field_id = $field_id";
 					$result = $db->sql_query($sql);
 					$field_ident = (string) $db->sql_fetchfield('field_ident');
@@ -116,8 +124,8 @@ class acp_profile
 					{
 						case 'sqlite':
 							$sql = "SELECT sql
-								FROM sqlite_master 
+								FROM sqlite_master
-								WHERE type = 'table' 
+								WHERE type = 'table'
 									AND name = '" . PROFILE_FIELDS_DATA_TABLE . "'
 								ORDER BY type DESC, name;";
 							$result = $db->sql_query($sql);
@@ -138,6 +146,12 @@ class acp_profile
 							foreach ($old_table_cols as $declaration)
 							{
 								$entities = preg_split('#\s+#', trim($declaration));
+
+								if ($entities[0] == 'PRIMARY')
+								{
+									continue;
+								}
+
 								if ($entities[0] !== 'pf_' . $field_ident)
 								{
 									$column_list[] = $entities[0];
@@ -170,8 +184,8 @@ class acp_profile
 						$order++;
 						if ($row['field_order'] != $order)
 						{
-							$sql = 'UPDATE ' . PROFILE_FIELDS_TABLE . " 
+							$sql = 'UPDATE ' . PROFILE_FIELDS_TABLE . "
-								SET field_order = $order 
+								SET field_order = $order
 								WHERE field_id = {$row['field_id']}";
 							$db->sql_query($sql);
 						}
@@ -203,8 +217,8 @@ class acp_profile
 					trigger_error($user->lang['NO_FIELD_ID'] . adm_back_link($this->u_action), E_USER_WARNING);
 				}
 	
-				$sql = 'SELECT lang_id 
+				$sql = 'SELECT lang_id
-					FROM ' . LANG_TABLE . " 
+					FROM ' . LANG_TABLE . "
 					WHERE lang_iso = '" . $db->sql_escape($config['default_lang']) . "'";
 				$result = $db->sql_query($sql);
 				$default_lang_id = (int) $db->sql_fetchfield('lang_id');
@@ -215,13 +229,13 @@ class acp_profile
 					trigger_error($user->lang['DEFAULT_LANGUAGE_NOT_FILLED'] . adm_back_link($this->u_action), E_USER_WARNING);
 				}
 
-				$sql = 'UPDATE ' . PROFILE_FIELDS_TABLE . " 
+				$sql = 'UPDATE ' . PROFILE_FIELDS_TABLE . "
-					SET field_active = 1 
+					SET field_active = 1
 					WHERE field_id = $field_id";
 				$db->sql_query($sql);
 
-				$sql = 'SELECT field_ident 
+				$sql = 'SELECT field_ident
-					FROM ' . PROFILE_FIELDS_TABLE . " 
+					FROM ' . PROFILE_FIELDS_TABLE . "
 					WHERE field_id = $field_id";
 				$result = $db->sql_query($sql);
 				$field_ident = (string) $db->sql_fetchfield('field_ident');
@@ -241,12 +255,12 @@ class acp_profile
 				}
 	
 				$sql = 'UPDATE ' . PROFILE_FIELDS_TABLE . "
-					SET field_active = 0 
+					SET field_active = 0
 					WHERE field_id = $field_id";
 				$db->sql_query($sql);
 
-				$sql = 'SELECT field_ident 
+				$sql = 'SELECT field_ident
-					FROM ' . PROFILE_FIELDS_TABLE . " 
+					FROM ' . PROFILE_FIELDS_TABLE . "
 					WHERE field_id = $field_id";
 				$result = $db->sql_query($sql);
 				$field_ident = (string) $db->sql_fetchfield('field_ident');
@@ -290,7 +304,7 @@ class acp_profile
 					}
 
 					$sql = 'SELECT l.*, f.*
-						FROM ' . PROFILE_LANG_TABLE . ' l, ' . PROFILE_FIELDS_TABLE . ' f 
+						FROM ' . PROFILE_LANG_TABLE . ' l, ' . PROFILE_FIELDS_TABLE . ' f
 						WHERE l.lang_id = ' . $this->edit_lang_id . "
 							AND f.field_id = $field_id
 							AND l.field_id = f.field_id";
@@ -302,7 +316,7 @@ class acp_profile
 					{
 						// Some admin changed the default language?
 						$sql = 'SELECT l.*, f.*
-							FROM ' . PROFILE_LANG_TABLE . ' l, ' . PROFILE_FIELDS_TABLE . ' f 
+							FROM ' . PROFILE_LANG_TABLE . ' l, ' . PROFILE_FIELDS_TABLE . ' f
 							WHERE l.lang_id <> ' . $this->edit_lang_id . "
 							AND f.field_id = $field_id
 							AND l.field_id = f.field_id";
@@ -321,7 +335,7 @@ class acp_profile
 
 					// Get language entries
 					$sql = 'SELECT *
-						FROM ' . PROFILE_FIELDS_LANG_TABLE . ' 
+						FROM ' . PROFILE_FIELDS_LANG_TABLE . '
 						WHERE lang_id = ' . $this->edit_lang_id . "
 							AND field_id = $field_id
 						ORDER BY option_id ASC";
@@ -491,7 +505,7 @@ class acp_profile
 								list($cp->vars['field_default_value_day'], $cp->vars['field_default_value_month'], $cp->vars['field_default_value_year']) = explode('-', $var);
 							}
 						}	
-					} 
+					}
 					/* else if ($field_type == FIELD_BOOL && $key == 'field_default_value')
 					{
 						// Get the number of options if this key is 'field_maxlen'
@@ -506,7 +520,7 @@ class acp_profile
 				{
 					// Get language entries
 					$sql = 'SELECT *
-						FROM ' . PROFILE_FIELDS_LANG_TABLE . ' 
+						FROM ' . PROFILE_FIELDS_LANG_TABLE . '
 						WHERE lang_id <> ' . $this->edit_lang_id . "
 							AND field_id = $field_id
 						ORDER BY option_id ASC";
@@ -521,7 +535,7 @@ class acp_profile
 
 		
 					$sql = 'SELECT lang_id, lang_name, lang_explain, lang_default_value
-						FROM ' . PROFILE_LANG_TABLE . ' 
+						FROM ' . PROFILE_LANG_TABLE . '
 						WHERE lang_id <> ' . $this->edit_lang_id . "
 							AND field_id = $field_id
 						ORDER BY lang_id ASC";
@@ -596,8 +610,8 @@ class acp_profile
 					// Check for already existing field ident
 					if ($action != 'edit')
 					{
-						$sql = 'SELECT field_ident 
+						$sql = 'SELECT field_ident
-							FROM ' . PROFILE_FIELDS_TABLE . " 
+							FROM ' . PROFILE_FIELDS_TABLE . "
 							WHERE field_ident = '" . $db->sql_escape($cp->vars['field_ident']) . "'";
 						$result = $db->sql_query($sql);
 						$row = $db->sql_fetchrow($result);
@@ -704,7 +718,7 @@ class acp_profile
 				switch ($step)
 				{
 					// Create basic options - only small differences between field types
-					case 1: 
+					case 1:
 	
 						// Build common create options
 						$template->assign_vars(array(
@@ -783,7 +797,7 @@ class acp_profile
 					break;
 
 					// Define remaining language variables
-					case 3: 
+					case 3:
 
 						$template->assign_var('S_STEP_THREE', true);
 						$options = $this->build_language_options($cp, $field_type, $action);
@@ -879,7 +893,7 @@ class acp_profile
 
 		$default_lang_id = (!empty($this->edit_lang_id)) ? $this->edit_lang_id : $this->lang_defs['iso'][$config['default_lang']];
 
-		$sql = 'SELECT lang_id, lang_iso 
+		$sql = 'SELECT lang_id, lang_iso
 			FROM ' . LANG_TABLE . '
 			WHERE lang_id <> ' . (int) $default_lang_id . '
 			ORDER BY lang_english_name';
@@ -1102,7 +1116,7 @@ class acp_profile
 
 			foreach ($empty_lang as $lang_id => $NULL)
 			{
-				$sql = 'DELETE FROM ' . PROFILE_LANG_TABLE . " 
+				$sql = 'DELETE FROM ' . PROFILE_LANG_TABLE . "
 					WHERE field_id = $field_id
 					AND lang_id = " . (int) $lang_id;
 				$db->sql_query($sql);
@@ -1136,7 +1150,7 @@ class acp_profile
 
 			if ($action != 'create')
 			{
-				$sql = 'DELETE FROM ' . PROFILE_FIELDS_LANG_TABLE . " 
+				$sql = 'DELETE FROM ' . PROFILE_FIELDS_LANG_TABLE . "
 					WHERE field_id = $field_id
 						AND lang_id = " . (int) $default_lang_id;
 				$db->sql_query($sql);
@@ -1188,7 +1202,7 @@ class acp_profile
 				{
 					if ($action != 'create')
 					{
-						$sql = 'DELETE FROM ' . PROFILE_FIELDS_LANG_TABLE . " 
+						$sql = 'DELETE FROM ' . PROFILE_FIELDS_LANG_TABLE . "
 							WHERE field_id = $field_id
 							AND lang_id = " . (int) $lang_id;
 						$db->sql_query($sql);
@@ -1209,7 +1223,7 @@ class acp_profile
 
 			foreach ($empty_lang as $lang_id => $NULL)
 			{
-				$sql = 'DELETE FROM ' . PROFILE_FIELDS_LANG_TABLE . " 
+				$sql = 'DELETE FROM ' . PROFILE_FIELDS_LANG_TABLE . "
 					WHERE field_id = $field_id
 					AND lang_id = " . (int) $lang_id;
 				$db->sql_query($sql);
@@ -1246,7 +1260,7 @@ class acp_profile
 					unset($sql['lang_id'], $sql['field_id'], $sql['option_id']);
 					
 					$this->update_insert(PROFILE_FIELDS_LANG_TABLE, $sql, array(
-						'lang_id'	=> $lang_id, 
+						'lang_id'	=> $lang_id,
 						'field_id'	=> $field_id,
 						'option_id'	=> $option_id)
 					);
@@ -1300,7 +1314,7 @@ class acp_profile
 			return;
 		}
 
-		$sql = "SELECT $check_key 
+		$sql = "SELECT $check_key
 			FROM $table
 			WHERE " . implode(' AND ', $where_sql);
 		$result = $db->sql_query($sql);
@@ -1320,7 +1334,7 @@ class acp_profile
 		{
 			if (sizeof($sql_ary))
 			{
-				$sql = "UPDATE $table SET " . $db->sql_build_array('UPDATE', $sql_ary) . ' 
+				$sql = "UPDATE $table SET " . $db->sql_build_array('UPDATE', $sql_ary) . '
 					WHERE ' . implode(' AND ', $where_sql);
 				$db->sql_query($sql);
 			}
@@ -1409,8 +1423,8 @@ class acp_profile
 				if (version_compare(sqlite_libversion(), '3.0') == -1)
 				{
 					$sql = "SELECT sql
-						FROM sqlite_master 
+						FROM sqlite_master
-						WHERE type = 'table' 
+						WHERE type = 'table'
 							AND name = '" . PROFILE_FIELDS_DATA_TABLE . "'
 						ORDER BY type DESC, name;";
 					$result = $db->sql_query($sql);
@@ -1431,7 +1445,7 @@ class acp_profile
 					foreach ($old_table_cols as $declaration)
 					{
 						$entities = preg_split('#\s+#', trim($declaration));
-						if ($entities == 'PRIMARY')
+						if ($entities[0] == 'PRIMARY')
 						{
 							continue;
 						}

phpBB/includes/acp/acp_prune.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -89,10 +97,10 @@ class acp_prune
 				$sql_forum = (sizeof($forum_id)) ? ' AND ' . $db->sql_in_set('forum_id', $forum_id) : '';
 
 				// Get a list of forum's or the data for the forum that we are pruning.
-				$sql = 'SELECT forum_id, forum_name 
+				$sql = 'SELECT forum_id, forum_name
 					FROM ' . FORUMS_TABLE . '
 					WHERE forum_type = ' . FORUM_POST . "
-						$sql_forum 
+						$sql_forum
 					ORDER BY left_id ASC";
 				$result = $db->sql_query($sql);
 
@@ -181,8 +189,8 @@ class acp_prune
 		}
 		else
 		{
-			$sql = 'SELECT forum_id, forum_name 
+			$sql = 'SELECT forum_id, forum_name
-				FROM ' . FORUMS_TABLE . ' 
+				FROM ' . FORUMS_TABLE . '
 				WHERE ' . $db->sql_in_set('forum_id', $forum_id);
 			$result = $db->sql_query($sql);
 			$row = $db->sql_fetchrow($result);
@@ -350,8 +358,8 @@ class acp_prune
 			'S_JOINED_OPTIONS'	=> $s_find_join_time,
 			'S_ACTIVE_OPTIONS'	=> $s_find_active_time,
 			'S_COUNT_OPTIONS'	=> $s_find_count,
-			'U_FIND_USER'		=> append_sid($phpbb_root_path . "memberlist.$phpEx", 'mode=searchuser&amp;form=acp_prune&amp;field=users'))
+			'U_FIND_USERNAME'	=> append_sid("{$phpbb_root_path}memberlist.$phpEx", 'mode=searchuser&amp;form=acp_prune&amp;field=users'),
-		);
+		));
 	}
 
 	/**
@@ -407,7 +415,7 @@ class acp_prune
 		}
 
 		// Get bot ids
-		$sql = 'SELECT user_id 
+		$sql = 'SELECT user_id
 			FROM ' . BOTS_TABLE;
 		$result = $db->sql_query($sql);
 

phpBB/includes/acp/acp_ranks.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -31,10 +39,17 @@ class acp_ranks
 		$this->tpl_name = 'acp_ranks';
 		$this->page_title = 'ACP_MANAGE_RANKS';
 
+		$form_name = 'acp_prune';
+		add_form_key($form_name);
+
 		switch ($action)
 		{
 			case 'save':
-				
+
+				if (!check_form_key($form_name))
+				{
+					trigger_error($user->lang['FORM_INVALID']. adm_back_link($this->u_action), E_USER_WARNING);
+				}
 				$rank_title = utf8_normalize_nfc(request_var('title', '', true));
 				$special_rank = request_var('special_rank', 0);
 				$min_posts = ($special_rank) ? 0 : request_var('min_posts', 0);
@@ -124,10 +139,15 @@ class acp_ranks
 			case 'edit':
 			case 'add':
 
+				if (!check_form_key($form_name))
+				{
+					trigger_error($user->lang['FORM_INVALID']. adm_back_link($this->u_action), E_USER_WARNING);
+				}
+
 				$data = $ranks = $existing_imgs = array();
 				
-				$sql = 'SELECT * 
+				$sql = 'SELECT *
-					FROM ' . RANKS_TABLE . ' 
+					FROM ' . RANKS_TABLE . '
 					ORDER BY rank_min ASC, rank_special ASC';
 				$result = $db->sql_query($sql);
 
@@ -151,7 +171,7 @@ class acp_ranks
 
 					foreach ($img_ary as $img)
 					{
-						$img = $path . $img; 
+						$img = $path . $img;
 
 						if (!in_array($img, $existing_imgs) || $action == 'edit')
 						{

phpBB/includes/acp/acp_reasons.php

@@ -1,13 +1,21 @@
 <?php
-/** 
+/**
 *
 * @package acp
 * @version $Id$
-* @copyright (c) 2005 phpBB Group 
+* @copyright (c) 2005 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -30,6 +38,9 @@ class acp_reasons
 		$this->tpl_name = 'acp_reasons';
 		$this->page_title = 'ACP_REASONS';
 
+		$form_name = 'acp_reason';
+		add_form_key('acp_reason');
+
 		$error = array();
 
 		switch ($action)
@@ -44,6 +55,10 @@ class acp_reasons
 
 				if ($submit)
 				{
+					if (!check_form_key($form_name))
+					{
+						$error[] = $user->lang['FORM_INVALID'];
+					}
 					// Reason specified?
 					if (!$reason_row['reason_title'] || !$reason_row['reason_description'])
 					{
@@ -308,7 +323,7 @@ class acp_reasons
 
 		// Reason count
 		$sql = 'SELECT reason_id, COUNT(reason_id) AS reason_count
-			FROM ' . REPORTS_TABLE . ' 
+			FROM ' . REPORTS_TABLE . '
 			GROUP BY reason_id';
 		$result = $db->sql_query($sql);
 

phpBB/includes/acp/acp_search.php

@@ -8,6 +8,14 @@
 *
 */
 
+/**
+* @ignore
+*/
+if (!defined('IN_PHPBB'))
+{
+	exit;
+}
+
 /**
 * @package acp
 */
@@ -473,8 +481,8 @@ class acp_search
 			'S_INDEX'				=> true,
 			'U_ACTION'				=> $this->u_action,
 			'U_PROGRESS_BAR'		=> append_sid("{$phpbb_admin_path}index.$phpEx", "i=$id&mode=$mode&action=progress_bar"),
-			'UA_PROGRESS_BAR'		=> append_sid("{$phpbb_admin_path}index.$phpEx", "i=$id&mode=$mode&action=progress_bar", false))
+			'UA_PROGRESS_BAR'		=> addslashes(append_sid("{$phpbb_admin_path}index.$phpEx", "i=$id&mode=$mode&action=progress_bar")),
-		);
+		));
 
 		if (isset($this->state[1]))
 		{