Index: common/string.php
===================================================================
--- common/string.php	(revision 0)
+++ common/string.php	(revision 0)
@@ -0,0 +1,14 @@
+<?php
+
+// Various string processing functions.
+function starts_with($s, $substr) {
+    log_assert(is_string($s) && is_string($substr));
+    return substr($s, 0, strlen($substr)) === $substr;
+}
+
+function ends_with($s, $substr) {
+    log_assert(is_string($s) && is_string($substr));
+    return substr($s, -strlen($substr)) === $substr;
+}
+
+?>
Index: www/controllers/job_detail.php
===================================================================
--- www/controllers/job_detail.php	(revision 909)
+++ www/controllers/job_detail.php	(working copy)
@@ -62,7 +62,7 @@
     if (!$view['job']['eval_message']) {
         $view['job']['eval_message'] = "&nbsp";
     }
-    execute_view('views/job_detail.php', $view);
+    execute_view_die('views/job_detail.php', $view);
 }
 
 
@@ -92,7 +92,7 @@
     if ($view['lang'] == 'fpc') {
         $view['lang'] = 'delphi';
     }
-    execute_view('views/job_view_source.php', $view);
+    execute_view_die('views/job_view_source.php', $view);
 }
 
 ?>
Index: www/controllers/monitor.php
===================================================================
--- www/controllers/monitor.php	(revision 909)
+++ www/controllers/monitor.php	(working copy)
@@ -22,7 +22,7 @@
     $view['display_entries'] = request('display_entries', $options['display_entries']);
     $view['display_only_table'] = request('only_table', false);
 
-    execute_view('views/monitor.php', $view);
+    execute_view_die('views/monitor.php', $view);
 }
 
 ?>
Index: www/controllers/projector.php
===================================================================
--- www/controllers/projector.php	(revision 909)
+++ www/controllers/projector.php	(working copy)
@@ -22,7 +22,7 @@
     $view['display_entries'] = $options['display_entries'];
     $view['display_only_table'] = request('only_table', false);
 
-    execute_view('views/projector.php', $view);
+    execute_view_die('views/projector.php', $view);
 }
 
 ?>
Index: www/controllers/resetpass.php
===================================================================
--- www/controllers/resetpass.php	(revision 909)
+++ www/controllers/resetpass.php	(working copy)
@@ -89,7 +89,7 @@
     $view['form_errors'] = $errors;
     $view['form_values'] = $data;
     $view['no_sidebar_login'] = true;
-    execute_view('views/resetpass.php', $view);
+    execute_view_die('views/resetpass.php', $view);
 }
 
 // checks confirmation code and resets password
Index: www/wiki/MyTextile.php
===================================================================
--- www/wiki/MyTextile.php	(revision 909)
+++ www/wiki/MyTextile.php	(working copy)
@@ -2,6 +2,7 @@
 
 @require_once(IA_ROOT_DIR."www/wiki/Textile.php");
 require_once(IA_ROOT_DIR."common/attachment.php");
+require_once(IA_ROOT_DIR."common/string.php");
 require_once(IA_ROOT_DIR."www/wiki/latex.php");
 
 class MyTextile extends Textile {
@@ -127,8 +128,22 @@
         $extra = $args['extra'];
         $alt = (preg_match("/\([^\)]+\)/", $extra, $match) ? $match[0] : '');
         $args['extra'] = $alt;
+
+        // To avoid CSRF exploits we restrict all images to textblock attachments
+        $allowed = false;
+        // $allowed_urls are exceptions to this rule
+        $allowed_urls = array("static/images/", "plot/");
+
+        foreach ($allowed_urls as $url) {
+            if (starts_with(strtolower($srcpath), IA_URL . $url) ||
+                starts_with(strtolower($srcpath), IA_URL_PREFIX . $url)) {
+                $allowed = true;
+                break;
+            }
+        }
+
+        // Catch internal images
         if (!preg_match('/^'.IA_RE_EXTERNAL_URL.'$/xi', $srcpath)) {
-            // Catch internal images.
             if (preg_match('/^ ('.IA_RE_PAGE_NAME.') \? '.
                            '('.IA_RE_ATTACHMENT_NAME.')'.
                            '$/ix', $srcpath, $matches)) {
@@ -139,9 +154,14 @@
                     //log_warn("Invalid resize instructions '$extra'");
                     $extra = '';
                 }
-                $args['src'] = htmlentities(url_absolute(url_image_resize($matches[1], $matches[2], $extra))); 
+                $args['src'] = htmlentities(url_absolute(url_image_resize($matches[1], $matches[2], $extra)));
+                $allowed = true;
             }
         }
+
+        if (!$allowed) {
+            return macro_error("Imaginile trebuie neaparat sa fie atasamente ale unei pagini.");
+        }
         //log_print("passing to parent::format image");
         //log_print_r($args);
         $res = @parent::format_image($args);
