Index: smf/Packages/installed.list
===================================================================
--- smf/Packages/installed.list	(revision 1047)
+++ smf/Packages/installed.list	(working copy)
@@ -1,2 +1,7 @@
 SMF 1.0.13 / 1.1.5 / 2.0 b3.1 Update|^|smf_patch_1.0.13_1.1.5_2.0-b3.1.zip|^|smf:smf-1.0.13-1.1.5-2.0.b3.1|^|1.0
 Visual Verification Options|^|VisualVerificationOptions_0-5-2.tar.gz|^|motokochan:visualverificationoptions|^|0.5.2
+SMF 1.0.14 / 1.1.6 Update|^|smf_patch_1.0.14_1.1.6.zip|^|smf:smf-1.0.14-1.1.6|^|1.0
+SMF 1.0.15 / 1.1.7 Update|^|smf_patch_1.0.15_1.1.7.zip|^|smf:smf-1.0.15-1.1.7|^|1.0
+SMF 1.0.16 / 1.1.8 Update|^|smf_patch_1.0.16_1.1.8.zip|^|smf:smf-1.1.8|^|1.0
+SMF 1.0.17 / 1.1.9 / 2.0 RC1 Update|^|smf_patch_1.0.17_1.1.9_2.0-RC1-1.zip|^|smf:smf-1.1.9|^|1.0
+SMF 1.0.18 / 1.1.10 / 2.0 RC1-2 Update|^|smf_patch_1.0.18_1.1.10-2.0-RC1.2.zip|^|smf:smf-1.1.10|^|1.1
Index: smf/SSI.php
===================================================================
--- smf/SSI.php	(revision 1047)
+++ smf/SSI.php	(working copy)
@@ -5,7 +5,7 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.7                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
 * Copyright 2006 by:          Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
@@ -95,6 +95,10 @@
 // Clean the request variables.
 cleanRequest();
 
+// Seed the random generator?
+if (empty($modSettings['rand_seed']) || mt_rand(1, 250) == 69)
+	smf_seed_generator();
+
 // Check on any hacking attempts.
 if (isset($_REQUEST['GLOBALS']) || isset($_COOKIE['GLOBALS']))
 	die('Hacking attempt...');
@@ -102,11 +106,8 @@
 	die('Hacking attempt...');
 elseif (isset($_COOKIE['ssi_theme']) && (int) $_COOKIE['ssi_theme'] == (int) $ssi_theme)
 	die('Hacking attempt...');
-elseif (isset($_REQUEST['ssi_layers']))
-{
-	if ((@get_magic_quotes_gpc() ? addslashes($_REQUEST['ssi_layers']) : $_REQUEST['ssi_layers']) == htmlspecialchars($ssi_layers))
-		die('Hacking attempt...');
-}
+elseif (isset($_REQUEST['ssi_layers'], $ssi_layers) && (@get_magic_quotes_gpc() ? stripslashes($_REQUEST['ssi_layers']) : $_REQUEST['ssi_layers']) == $ssi_layers)
+	die('Hacking attempt...');
 if (isset($_REQUEST['context']))
 	die('Hacking attempt...');
 
Index: smf/Sources/Admin.php
===================================================================
--- smf/Sources/Admin.php	(revision 1047)
+++ smf/Sources/Admin.php	(working copy)
@@ -5,7 +5,7 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.6                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
 * Copyright 2006 by:          Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
@@ -122,7 +122,7 @@
 function Admin()
 {
 	global $sourcedir, $db_prefix, $forum_version, $txt, $scripturl, $context, $modSettings;
-	global $user_info, $_PHPA, $boardurl;
+	global $user_info, $_PHPA, $boardurl, $memcached;
 
 	if (isset($_GET['area']) && $_GET['area'] == 'copyright')
 		return ManageCopyright();
@@ -231,6 +231,10 @@
 	list ($context['current_versions']['mysql']['version']) = mysql_fetch_row($request);
 	mysql_free_result($request);
 
+	// If we're using memcache we need the server info.
+	if (empty($memcached) && function_exists('memcache_get') && isset($modSettings['cache_memcached']) && trim($modSettings['cache_memcached']) != '')
+		get_memcached_server();
+
 	// Check to see if we have any accelerators installed...
 	if (defined('MMCACHE_VERSION'))
 		$context['current_versions']['mmcache'] = array('title' => 'Turck MMCache', 'version' => MMCACHE_VERSION);
@@ -241,7 +245,7 @@
 	if (extension_loaded('apc'))
 		$context['current_versions']['apc'] = array('title' => 'Alternative PHP Cache', 'version' => phpversion('apc'));
 	if (function_exists('memcache_set'))
-		$context['current_versions']['memcache'] = array('title' => 'Memcached', 'version' => memcache_get_version());
+		$context['current_versions']['memcache'] = array('title' => 'Memcached', 'version' => empty($memcached) ? '???' : memcache_get_version($memcached));
 
 	$context['can_admin'] = allowedTo('admin_forum');
 
Index: smf/Sources/Display.php
===================================================================
--- smf/Sources/Display.php	(revision 1047)
+++ smf/Sources/Display.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.4                                           *
+* Software Version:           SMF 1.1.9                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -702,7 +702,7 @@
 		{
 			$request = db_query("
 				SELECT
-					a.ID_ATTACH, a.ID_MSG, a.filename, IFNULL(a.size, 0) AS filesize, a.downloads,
+					a.ID_ATTACH, a.ID_MSG, a.filename, a.file_hash, IFNULL(a.size, 0) AS filesize, a.downloads,
 					a.width, a.height" . (empty($modSettings['attachmentShowImages']) || empty($modSettings['attachmentThumbnails']) ? '' : ",
 					IFNULL(thumb.ID_ATTACH, 0) AS ID_THUMB, thumb.width AS thumb_width, thumb.height AS thumb_height") . "
 				FROM {$db_prefix}attachments AS a" . (empty($modSettings['attachmentShowImages']) || empty($modSettings['attachmentThumbnails']) ? '' : "
@@ -941,7 +941,7 @@
 	if (isset($_REQUEST['type']) && $_REQUEST['type'] == 'avatar')
 	{
 		$request = db_query("
-			SELECT filename, ID_ATTACH, attachmentType
+			SELECT filename, ID_ATTACH, attachmentType, file_hash
 			FROM {$db_prefix}attachments
 			WHERE ID_ATTACH = $_REQUEST[attach]
 				AND ID_MEMBER > 0
@@ -955,7 +955,7 @@
 
 		// Make sure this attachment is on this board.
 		$request = db_query("
-			SELECT a.filename, a.ID_ATTACH, a.attachmentType
+			SELECT a.filename, a.ID_ATTACH, a.attachmentType, a.file_hash
 			FROM ({$db_prefix}boards AS b, {$db_prefix}messages AS m, {$db_prefix}attachments AS a)
 			WHERE b.ID_BOARD = m.ID_BOARD
 				AND $user_info[query_see_board]
@@ -965,7 +965,7 @@
 	}
 	if (mysql_num_rows($request) == 0)
 		fatal_lang_error(1, false);
-	list ($real_filename, $ID_ATTACH, $attachmentType) = mysql_fetch_row($request);
+	list ($real_filename, $ID_ATTACH, $attachmentType, $file_hash) = mysql_fetch_row($request);
 	mysql_free_result($request);
 
 	// Update the download counter (unless it's a thumbnail).
@@ -976,7 +976,7 @@
 			WHERE ID_ATTACH = $ID_ATTACH
 			LIMIT 1", __FILE__, __LINE__);
 
-	$filename = getAttachmentFilename($real_filename, $_REQUEST['attach']);
+	$filename = getAttachmentFilename($real_filename, $_REQUEST['attach'], false, $file_hash);
 
 	// This is done to clear any output that was made before now. (would use ob_clean(), but that's PHP 4.2.0+...)
 	ob_end_clean();
@@ -1036,7 +1036,11 @@
 	header('Connection: close');
 	header('ETag: ' . $file_md5);
 
-	if (filesize($filename) != 0)
+	// IE 6 just doesn't play nice. As dirty as this seems, it works.
+	if ($context['browser']['is_ie6'] && isset($_REQUEST['image']))
+		unset($_REQUEST['image']);
+
+	elseif (filesize($filename) != 0)
 	{
 		$size = @getimagesize($filename);
 		if (!empty($size))
@@ -1047,7 +1051,7 @@
 				2 => 'jpeg',
 				3 => 'png',
 				5 => 'psd',
-				6 => 'bmp',
+				6 => 'x-ms-bmp',
 				7 => 'tiff',
 				8 => 'tiff',
 				9 => 'jpeg',
@@ -1055,8 +1059,8 @@
 			);
 
 			// Do we have a mime type we can simpy use?
-			if (!empty($size['mime']))
-				header('Content-Type: ' . $size['mime']);
+			if (!empty($size['mime']) && !in_array($size[2], array(4, 13)))
+				header('Content-Type: ' . strtr($size['mime'], array('image/bmp' => 'image/x-ms-bmp')));
 			elseif (isset($validTypes[$size[2]]))
 				header('Content-Type: image/' . $validTypes[$size[2]]);
 			// Otherwise - let's think safety first... it might not be an image...
@@ -1068,11 +1072,9 @@
 			unset($_REQUEST['image']);
 	}
 
+	header('Content-Disposition: ' . (isset($_REQUEST['image']) ? 'inline' : 'attachment') . '; filename="' . $real_filename . '"');
 	if (!isset($_REQUEST['image']))
-	{
-		header('Content-Disposition: attachment; filename="' . $real_filename . '"');
 		header('Content-Type: application/octet-stream');
-	}
 
 	// If this has an "image extension" - but isn't actually an image - then ensure it isn't cached cause of silly IE.
 	if (!isset($_REQUEST['image']) && in_array(substr($real_filename, -4), array('.gif', '.jpg', '.bmp', '.png', 'jpeg', 'tiff')))
@@ -1166,7 +1168,7 @@
 				// A proper thumb doesn't exist yet? Create one!
 				if (empty($attachment['ID_THUMB']) || $attachment['thumb_width'] > $modSettings['attachmentThumbWidth'] || $attachment['thumb_height'] > $modSettings['attachmentThumbHeight'] || ($attachment['thumb_width'] < $modSettings['attachmentThumbWidth'] && $attachment['thumb_height'] < $modSettings['attachmentThumbHeight']))
 				{
-					$filename = getAttachmentFilename($attachment['filename'], $attachment['ID_ATTACH']);
+					$filename = getAttachmentFilename($attachment['filename'], $attachment['ID_ATTACH'], false, $attachment['file_hash']);
 
 					require_once($sourcedir . '/Subs-Graphics.php');
 					if (createThumbnail($filename, $modSettings['attachmentThumbWidth'], $modSettings['attachmentThumbHeight']))
@@ -1178,10 +1180,11 @@
 						$thumb_filename = addslashes($attachment['filename'] . '_thumb');
 
 						// Add this beauty to the database.
+						$thumb_hash = getAttachmentFilename($thumb_filename, false, true);
 						db_query("
 							INSERT INTO {$db_prefix}attachments
-								(ID_MSG, attachmentType, filename, size, width, height)
-							VALUES ($ID_MSG, 3, '$thumb_filename', " . (int) $thumb_size . ", " . (int) $attachment['thumb_width'] . ", " . (int) $attachment['thumb_height'] . ")", __FILE__, __LINE__);
+								(ID_MSG, attachmentType, filename, file_hash, size, width, height)
+							VALUES ($ID_MSG, 3, '$thumb_filename', '$thumb_hash', " . (int) $thumb_size . ", " . (int) $attachment['thumb_width'] . ", " . (int) $attachment['thumb_height'] . ")", __FILE__, __LINE__);
 						$attachment['ID_THUMB'] = db_insert_id();
 						if (!empty($attachment['ID_THUMB']))
 						{
@@ -1191,8 +1194,8 @@
 								WHERE ID_ATTACH = $attachment[ID_ATTACH]
 								LIMIT 1", __FILE__, __LINE__);
 
-							$thumb_realname = getAttachmentFilename($thumb_filename, $attachment['ID_THUMB'], true);
-							rename($filename . '_thumb', $modSettings['attachmentUploadDir'] . '/' . $thumb_realname);
+							$thumb_realname = getAttachmentFilename($thumb_filename, $attachment['ID_THUMB'], false, $thumb_hash);
+							rename($filename . '_thumb', $thumb_realname);
 						}
 					}
 				}
Index: smf/Sources/Help.php
===================================================================
--- smf/Sources/Help.php	(revision 1047)
+++ smf/Sources/Help.php	(working copy)
@@ -62,7 +62,7 @@
 		'searching' => 'search',
 	);
 
-	if (!isset($_GET['page']) || !isset($context['all_pages'][$_GET['page']]))
+	if (!isset($_GET['page']) || !is_string($_GET['page']) || !isset($context['all_pages'][$_GET['page']]))
 		$_GET['page'] = 'index';
 
 	$context['current_page'] = $_GET['page'];
Index: smf/Sources/Load.php
===================================================================
--- smf/Sources/Load.php	(revision 1047)
+++ smf/Sources/Load.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.9                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -1178,6 +1178,10 @@
 		// Pick between $settings and $options depending on whose data it is.
 		while ($row = mysql_fetch_assoc($result))
 		{
+			// There are just things we shouldn't be able to change as members.
+			if ($row['ID_MEMBER'] != 0 && in_array($row['variable'], array('actual_theme_url', 'actual_images_url', 'base_theme_dir', 'base_theme_url', 'default_images_url', 'default_theme_dir', 'default_theme_url', 'default_template', 'images_url', 'number_recent_posts', 'smiley_sets_default', 'theme_dir', 'theme_id', 'theme_layers', 'theme_templates', 'theme_url')))
+				continue;
+
 			// If this is the theme_dir of the default theme, store it.
 			if (in_array($row['variable'], array('theme_dir', 'theme_url', 'images_url')) && $row['ID_THEME'] == '1' && empty($row['ID_MEMBER']))
 				$themeData[0]['default_' . $row['variable']] = $row['value'];
@@ -1941,9 +1945,9 @@
 		// This is here to stop people from using bad junky PHPSESSIDs.
 		if (isset($_REQUEST[session_name()]) && preg_match('~^[A-Za-z0-9]{16,32}$~', $_REQUEST[session_name()]) == 0 && !isset($_COOKIE[session_name()]))
 		{
-			$_REQUEST[session_name()] = md5(md5('smf_sess_' . time()) . rand());
-			$_GET[session_name()] = md5(md5('smf_sess_' . time()) . rand());
-			$_POST[session_name()] = md5(md5('smf_sess_' . time()) . rand());
+			$_REQUEST[session_name()] = md5(md5('smf_sess_' . time()) . mt_rand());
+			$_GET[session_name()] = md5(md5('smf_sess_' . time()) . mt_rand());
+			$_POST[session_name()] = md5(md5('smf_sess_' . time()) . mt_rand());
 		}
 
 		// Use database sessions? (they don't work in 4.1.x!)
@@ -1970,16 +1974,21 @@
 		if (!empty($modSettings['databaseSession_loose']))
 			header('Cache-Control: private');
 	}
-
-	// While PHP 4.1.x should use $_SESSION, it seems to need this to do it right.
-	if (@version_compare(PHP_VERSION, '4.2.0') == -1)
-		$HTTP_SESSION_VARS['php_412_bugfix'] = true;
 	*/
 
 	// Set the randomly generated code.
 	if (!isset($_SESSION['rand_code']))
-		$_SESSION['rand_code'] = md5(session_id() . rand());
+		$_SESSION['rand_code'] = md5(session_id() . mt_rand() . (string) microtime() . $modSettings['rand_seed']);
 	$sc = $_SESSION['rand_code'];
+
+	// While PHP 4.1.x should use $_SESSION, it seems to need this to do it right. Also reseed the random generator.
+	if (@version_compare(PHP_VERSION, '4.2.0') == -1)
+	{
+		$HTTP_SESSION_VARS['php_412_bugfix'] = true;
+		mt_srand((float) microtime() * 10000010 + $modSettings['rand_seed']);
+	}
+	else
+		mt_srand();
 }
 
 function sessionOpen($save_path, $session_name)
@@ -2110,7 +2119,7 @@
 	// eAccelerator...
 	elseif (function_exists('eaccelerator_put'))
 	{
-		if (rand(0, 10) == 1)
+		if (mt_rand(0, 10) == 1)
 			eaccelerator_gc();
 
 		if ($value === null)
@@ -2121,7 +2130,7 @@
 	// Turck MMCache?
 	elseif (function_exists('mmcache_put'))
 	{
-		if (rand(0, 10) == 1)
+		if (mt_rand(0, 10) == 1)
 			mmcache_gc();
 
 		if ($value === null)
Index: smf/Sources/LogInOut.php
===================================================================
--- smf/Sources/LogInOut.php	(revision 1047)
+++ smf/Sources/LogInOut.php	(working copy)
@@ -5,7 +5,7 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.3                                           *
+* Software Version:           SMF 1.1.6                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
 * Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
@@ -106,7 +106,7 @@
 		else
 			trigger_error('Login2(): Cannot be logged in without a session or cookie', E_USER_ERROR);
 
-		$user_settings['passwordSalt'] = substr(md5(rand()), 0, 4);
+		$user_settings['passwordSalt'] = substr(md5(mt_rand()), 0, 4);
 		updateMemberData($ID_MEMBER, array('passwordSalt' => '\'' . $user_settings['passwordSalt'] . '\''));
 
 		setLoginCookie($timeout - time(), $ID_MEMBER, sha1($user_settings['passwd'] . $user_settings['passwordSalt']));
@@ -347,7 +347,7 @@
 		if (in_array($user_settings['passwd'], $other_passwords))
 		{
 			$user_settings['passwd'] = $sha_passwd;
-			$user_settings['passwordSalt'] = substr(md5(rand()), 0, 4);
+			$user_settings['passwordSalt'] = substr(md5(mt_rand()), 0, 4);
 
 			// Update the password and set up the hash.
 			updateMemberData($user_settings['ID_MEMBER'], array('passwd' => '\'' . $user_settings['passwd'] . '\'', 'passwordSalt' => '\'' . $user_settings['passwordSalt'] . '\''));
@@ -375,7 +375,7 @@
 	// Correct password, but they've got no salt; fix it!
 	elseif ($user_settings['passwordSalt'] == '')
 	{
-		$user_settings['passwordSalt'] = substr(md5(rand()), 0, 4);
+		$user_settings['passwordSalt'] = substr(md5(mt_rand()), 0, 4);
 		updateMemberData($user_settings['ID_MEMBER'], array('passwordSalt' => '\'' . $user_settings['passwordSalt'] . '\''));
 	}
 
Index: smf/Sources/ManageAttachments.php
===================================================================
--- smf/Sources/ManageAttachments.php	(revision 1047)
+++ smf/Sources/ManageAttachments.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.4                                           *
+* Software Version:           SMF 1.1.10                                          *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006 by:          Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -161,7 +161,6 @@
 			'attachmentCheckExtensions' => empty($_POST['attachmentCheckExtensions']) ? '0' : '1',
 			'attachmentExtensions' => $_POST['attachmentExtensions'],
 			'attachmentShowImages' => empty($_POST['attachmentShowImages']) ? '0' : '1',
-			'attachmentEncryptFilenames' => empty($_POST['attachmentEncryptFilenames']) ? '0' : '1',
 			'attachmentUploadDir' => $_POST['attachmentUploadDir'],
 			'attachmentDirSizeLimit' => (int) $_POST['attachmentDirSizeLimit'],
 			'attachmentPostLimit' => (int) $_POST['attachmentPostLimit'],
@@ -339,7 +338,7 @@
 				'name' => htmlspecialchars($row['filename']),
 				'downloads' => $row['downloads'],
 				'href' => $row['attachmentType'] == 1 ? $modSettings['custom_avatar_url'] . '/' . $row['filename'] : ($scripturl . '?action=dlattach;' . ($context['browse_type'] == 'avatars' ? 'type=avatar;' : 'topic=' . $row['ID_TOPIC'] . '.0;') . 'id=' . $row['ID_ATTACH']),
-				'link' => '<a href="' . ($row['attachmentType'] == 1 ? $modSettings['custom_avatar_url'] . '/' . $row['filename'] : ($scripturl . '?action=dlattach;' . ($context['browse_type'] == 'avatars' ? 'type=avatar;' : 'topic=' . $row['ID_TOPIC'] . '.0;') . 'id=' . $row['ID_ATTACH'])) . '"' . (empty($row['width']) || empty($row['height']) ? '' : ' onclick="return reqWin(this.href + \';image\', ' . ($row['width'] + 20) . ', ' . ($row['height'] + 20) . ', true);"') . '>' . htmlspecialchars($row['filename']) . '</a>'
+				'link' => '<a href="' . ($row['attachmentType'] == 1 ? $modSettings['custom_avatar_url'] . '/' . $row['filename'] : ($scripturl . '?action=dlattach;' . ($context['browse_type'] == 'avatars' ? 'type=avatar;' : 'topic=' . $row['ID_TOPIC'] . '.0;') . 'id=' . $row['ID_ATTACH'])) . '"' . (empty($row['width']) || empty($row['height']) ? '' : ' onclick="return reqWin(this.href + \'' . ($modSettings['custom_avatar_url'] ? '' : ';image') . '\', ' . ($row['width'] + 20) . ', ' . ($row['height'] + 20) . ', true);"') . '>' . htmlspecialchars($row['filename']) . '</a>'
 			),
 			'topic' => $row['ID_TOPIC'],
 			'subject' => $row['subject'],
@@ -419,14 +418,14 @@
 	}
 
 	$request = db_query("
-		SELECT ID_ATTACH, ID_MEMBER, filename
+		SELECT ID_ATTACH, ID_MEMBER, filename, file_hash
 		FROM {$db_prefix}attachments
 		WHERE attachmentType = 0
 			AND ID_MEMBER > 0", __FILE__, __LINE__);
 	$updatedAvatars = array();
 	while ($row = mysql_fetch_assoc($request))
 	{
-		$filename = getAttachmentFilename($row['filename'], $row['ID_ATTACH']);
+		$filename = getAttachmentFilename($row['filename'], $row['ID_ATTACH'], false, $row['file_hash']);
 
 		if (rename($filename, $modSettings['custom_avatar_dir'] . '/' . $row['filename']))
 			$updatedAvatars[] = $row['ID_ATTACH'];
@@ -561,7 +560,7 @@
 	// Get all the attachment names and ID_MSGs.
 	$request = db_query("
 		SELECT
-			a.filename, a.attachmentType, a.ID_ATTACH, a.ID_MEMBER" . ($query_type == 'messages' ? ', m.ID_MSG' : ', a.ID_MSG') . ",
+			a.filename, a.file_hash, a.attachmentType, a.ID_ATTACH, a.ID_MEMBER" . ($query_type == 'messages' ? ', m.ID_MSG' : ', a.ID_MSG') . ",
 			IFNULL(thumb.ID_ATTACH, 0) AS ID_THUMB, thumb.filename AS thumb_filename, thumb_parent.ID_ATTACH AS ID_PARENT
 		FROM ({$db_prefix}attachments AS a" .($query_type == 'members' ? ", {$db_prefix}members AS mem" : ($query_type == 'messages' ? ", {$db_prefix}messages AS m" : '')) . ")
 			LEFT JOIN {$db_prefix}attachments AS thumb ON (thumb.ID_ATTACH = a.ID_THUMB)
@@ -576,7 +575,7 @@
 			@unlink($modSettings['custom_avatar_dir'] . '/' . $row['filename']);
 		else
 		{
-			$filename = getAttachmentFilename($row['filename'], $row['ID_ATTACH']);
+			$filename = getAttachmentFilename($row['filename'], $row['ID_ATTACH'], false, $row['file_hash']);
 			@unlink($filename);
 
 			// If this was a thumb, the parent attachment should know about it.
@@ -586,7 +585,7 @@
 			// If this attachments has a thumb, remove it as well.
 			if (!empty($row['ID_THUMB']) && $autoThumbRemoval)
 			{
-				$thumb_filename = getAttachmentFilename($row['thumb_filename'], $row['ID_THUMB']);
+				$thumb_filename = getAttachmentFilename($row['thumb_filename'], $row['ID_THUMB'], false, $row['file_hash']);
 				@unlink($thumb_filename);
 				$attach[] = $row['ID_THUMB'];
 			}
@@ -690,7 +689,7 @@
 			$to_remove = array();
 
 			$result = db_query("
-				SELECT thumb.ID_ATTACH, thumb.filename
+				SELECT thumb.ID_ATTACH, thumb.filename, thumb.file_hash
 				FROM {$db_prefix}attachments AS thumb
 					LEFT JOIN {$db_prefix}attachments AS tparent ON (tparent.ID_THUMB = thumb.ID_ATTACH)
 				WHERE thumb.ID_ATTACH BETWEEN $_GET[substep] AND $_GET[substep] + 499
@@ -705,7 +704,7 @@
 				// If we are repairing remove the file from disk now.
 				if ($fix_errors && in_array('missing_thumbnail_parent', $to_fix))
 				{
-					$filename = getAttachmentFilename($row['filename'], $row['ID_ATTACH']);
+					$filename = getAttachmentFilename($row['filename'], $row['ID_ATTACH'], false, $row['file_hash']);
 					@unlink($filename);
 				}
 			}
@@ -788,7 +787,7 @@
 			$errors_found = array();
 
 			$result = db_query("
-				SELECT ID_ATTACH, filename, size, attachmentType
+				SELECT ID_ATTACH, filename, file_hash, size, attachmentType
 				FROM {$db_prefix}attachments
 				WHERE ID_ATTACH BETWEEN $_GET[substep] AND $_GET[substep] + 249", __FILE__, __LINE__);
 			while ($row = mysql_fetch_assoc($result))
@@ -797,7 +796,7 @@
 				if ($row['attachmentType'] == 1)
 					$filename = $modSettings['custom_avatar_dir'] . '/' . $row['filename'];
 				else
-					$filename = getAttachmentFilename($row['filename'], $row['ID_ATTACH']);
+					$filename = getAttachmentFilename($row['filename'], $row['ID_ATTACH'], false, $row['file_hash']);
 
 				// File doesn't exist?
 				if (!file_exists($filename))
@@ -882,7 +881,7 @@
 			$to_remove = array();
 
 			$result = db_query("
-				SELECT a.ID_ATTACH, a.filename, a.attachmentType
+				SELECT a.ID_ATTACH, a.filename, a.file_hash, a.attachmentType
 				FROM {$db_prefix}attachments AS a
 					LEFT JOIN {$db_prefix}members AS mem ON (mem.ID_MEMBER = a.ID_MEMBER)
 				WHERE a.ID_ATTACH BETWEEN $_GET[substep] AND $_GET[substep] + 499
@@ -900,7 +899,7 @@
 					if ($row['attachmentType'] == 1)
 						$filename = $modSettings['custom_avatar_dir'] . '/' . $row['filename'];
 					else
-						$filename = getAttachmentFilename($row['filename'], $row['ID_ATTACH']);
+						$filename = getAttachmentFilename($row['filename'], $row['ID_ATTACH'], false, $row['file_hash']);
 					@unlink($filename);
 				}
 			}
@@ -938,7 +937,7 @@
 			$to_remove = array();
 
 			$result = db_query("
-				SELECT a.ID_ATTACH, a.filename
+				SELECT a.ID_ATTACH, a.filename, a.file_hash
 				FROM {$db_prefix}attachments AS a
 					LEFT JOIN {$db_prefix}messages AS m ON (m.ID_MSG = a.ID_MSG)
 				WHERE a.ID_ATTACH BETWEEN $_GET[substep] AND $_GET[substep] + 499
@@ -953,7 +952,7 @@
 				// If we are repairing remove the file from disk now.
 				if ($fix_errors && in_array('attachment_no_msg', $to_fix))
 				{
-					$filename = getAttachmentFilename($row['filename'], $row['ID_ATTACH']);
+					$filename = getAttachmentFilename($row['filename'], $row['ID_ATTACH'], false, $row['file_hash']);
 					@unlink($filename);
 				}
 			}
Index: smf/Sources/ManageBans.php
===================================================================
--- smf/Sources/ManageBans.php	(revision 1047)
+++ smf/Sources/ManageBans.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1                                             *
+* Software Version:           SMF 1.1.10                                          *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006 by:          Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -1176,6 +1176,9 @@
 	if (!empty($updates))
 		foreach ($updates as $newStatus => $members)
 			updateMemberData($members, array('is_activated' => $newStatus));
+
+	// Update the amount of members awaiting approval
+	updateStats('member');
 }
 
 ?>
\ No newline at end of file
Index: smf/Sources/ManageMembers.php
===================================================================
--- smf/Sources/ManageMembers.php	(revision 1047)
+++ smf/Sources/ManageMembers.php	(working copy)
@@ -5,7 +5,7 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1                                             *
+* Software Version:           SMF 1.1.6                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
 * Copyright 2006 by:          Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
@@ -766,7 +766,7 @@
 
 				sendmail($member['email'], $txt['register_subject'],
 					"$txt[hello_guest] $member[name]!\n\n" .
-					"$txt[admin_approve_accept_desc] $txt[719] $member[name]\n\n" .
+					"$txt[admin_approve_accept_desc] $txt[719] $member[username]\n\n" .
 					"$txt[701]\n" .
 					"$scripturl?action=profile\n\n" .
 					$txt[130]);
@@ -776,11 +776,13 @@
 	// Maybe we're sending it off for activation?
 	elseif ($_POST['todo'] == 'require_activation')
 	{
+		require_once($sourcedir . '/Subs-Members.php');
+
 		// We have to do this for each member I'm afraid.
 		foreach ($member_info as $member)
 		{
 			// Generate a random activation code.
-			$validation_code = substr(preg_replace('/\W/', '', md5(rand())), 0, 10);
+			$validation_code = generateValidationCode();
 
 			// Set these members for activation - I know this includes two ID_MEMBER checks but it's safer than bodging $condition ;).
 			db_query("
Index: smf/Sources/ManageRegistration.php
===================================================================
--- smf/Sources/ManageRegistration.php	(revision 1047)
+++ smf/Sources/ManageRegistration.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.2                                           *
+* Software Version:           SMF 1.1.10                                          *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -159,7 +159,7 @@
 			'check_reserved_name' => true,
 			'check_password_strength' => false,
 			'check_email_ban' => false,
-			'send_welcome_email' => isset($_POST['emailPassword']),
+			'send_welcome_email' => isset($_POST['emailPassword']) || empty($_POST['password']),
 			'require' => isset($_POST['emailActivate']) ? 'activation' : 'nothing',
 			'memberGroup' => empty($_POST['group']) ? 0 : (int) $_POST['group'],
 		);
@@ -301,7 +301,7 @@
 
 	// Generate a sample registration image.
 	$context['use_graphic_library'] = in_array('gd', get_loaded_extensions());
-	$context['verificiation_image_href'] = $scripturl . '?action=verificationcode;rand=' . md5(rand());
+	$context['verificiation_image_href'] = $scripturl . '?action=verificationcode;rand=' . md5(mt_rand());
 
 	$character_range = array_merge(range('A', 'H'), array('K', 'M', 'N', 'P'), range('R', 'Z'));
 	$_SESSION['visual_verification_code'] = '';
Index: smf/Sources/PackageGet.php
===================================================================
--- smf/Sources/PackageGet.php	(revision 1047)
+++ smf/Sources/PackageGet.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1                                             *
+* Software Version:           SMF 1.1.9                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006 by:          Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -250,6 +250,18 @@
 
 		// Clear any "relative" URL.  Since "server" is not present, "relative" is garbage.
 		unset($_GET['relative']);
+		
+		$token = checkConfirm('get_absolute_url');
+		if ($token !== true)
+		{
+			$context['sub_template'] = 'package_confirm';
+		
+			$context['page_title'] = $txt['smf183'];
+			$context['confirm_message'] = sprintf($txt['package_confirm_view_package_content'], htmlspecialchars($_GET['absolute']));
+			$context['proceed_href'] = $scripturl . '?action=packageget;sa=browse;absolute=' . urlencode($_GET['absolute']) . ';confirm=' . $token;
+			
+			return;
+		}
 	}
 	// Minimum required parameter did not exist so dump out.
 	else
@@ -298,7 +310,7 @@
 	// Get default author and email if they exist.
 	if ($listing->exists('default-author'))
 	{
-		$default_author = $listing->fetch('default-author');
+		$default_author = htmlspecialchars($listing->fetch('default-author'));
 		if ($listing->exists('default-author/@email'))
 			$default_email = $listing->fetch('default-author/@email');
 	}
@@ -308,7 +320,7 @@
 	{
 		$default_website = $listing->fetch('default-website');
 		if ($listing->exists('default-website/@title'))
-			$default_title = $listing->fetch('default-website/@title');
+			$default_title = htmlspecialchars($listing->fetch('default-website/@title'));
 	}
 
 	$the_version = strtr($forum_version, array('SMF ' => ''));
@@ -328,7 +340,7 @@
 
 			// It's a Title, Heading, Rule or Text.
 			if (in_array($package['type'], array('title', 'heading', 'text', 'rule')))
-				$package['name'] = $thisPackage->fetch('.');
+				$package['name'] = htmlspecialchars($thisPackage->fetch('.'));
 			// It's a Remote link.
 			elseif ($package['type'] == 'remote')
 			{
@@ -355,7 +367,7 @@
 					$package['href'] = $scripturl . '?action=packageget;sa=browse;absolute=' . $current_url;
 				}
 
-				$package['name'] = $thisPackage->fetch('.');
+				$package['name'] = htmlspecialchars($thisPackage->fetch('.'));
 				$package['link'] = '<a href="' . $package['href'] . '">' . $package['name'] . '</a>';
 			}
 			// It's a package...
@@ -378,6 +390,8 @@
 
 				if ($package['description'] == '')
 					$package['description'] = $txt['pacman8'];
+				else
+					$package['description'] = parse_bbc(preg_replace('~\[[/]?html\]~i', '', htmlspecialchars($package['description'])));				
 
 				$package['is_installed'] = isset($installed_mods[$package['id']]);
 				$package['is_current'] = $package['is_installed'] && ($installed_mods[$package['id']] == $package['version']);
@@ -397,6 +411,7 @@
 				$package['download_conflict'] = !empty($already_exists) && $already_exists['id'] == $package['id'] && $already_exists['version'] != $package['version'];
 
 				$package['href'] = $url . '/' . $package['filename'];
+				$package['name'] = htmlspecialchars($package['name']);
 				$package['link'] = '<a href="' . $package['href'] . '">' . $package['name'] . '</a>';
 				$package['download']['href'] = $scripturl . '?action=packageget;sa=download' . $server_att . ';package=' . $current_url . $package['filename'] . ($package['download_conflict'] ? ';conflict' : '') . ';sesc=' . $context['session_id'];
 				$package['download']['link'] = '<a href="' . $package['download']['href'] . '">' . $package['name'] . '</a>';
@@ -404,12 +419,12 @@
 				if ($thisPackage->exists('author') || isset($default_author))
 				{
 					if ($thisPackage->exists('author/@email'))
-						$package['author']['email'] = $thisPackage->fetch('author/@email');
+						$package['author']['email'] = htmlspecialchars($thisPackage->fetch('author/@email'));
 					elseif (isset($default_email))
 						$package['author']['email'] = $default_email;
 
 					if ($thisPackage->exists('author') && $thisPackage->fetch('author') != '')
-						$package['author']['name'] = $thisPackage->fetch('author');
+						$package['author']['name'] = htmlspecialchars($thisPackage->fetch('author'));
 					else
 						$package['author']['name'] = $default_author;
 
@@ -424,11 +439,11 @@
 				if ($thisPackage->exists('website') || isset($default_website))
 				{
 					if ($thisPackage->exists('website') && $thisPackage->exists('website/@title'))
-						$package['author']['website']['name'] = $thisPackage->fetch('website/@title');
+						$package['author']['website']['name'] = htmlspecialchars($thisPackage->fetch('website/@title'));
 					elseif (isset($default_title))
 						$package['author']['website']['name'] = $default_title;
 					elseif ($thisPackage->exists('website'))
-						$package['author']['website']['name'] = $thisPackage->fetch('website');
+						$package['author']['website']['name'] = htmlspecialchars($thisPackage->fetch('website'));
 					else
 						$package['author']['website']['name'] = $default_website;
 
@@ -561,7 +576,7 @@
 
 	// Done!  Did we get this package automatically?
 	if (preg_match('~^http://[\w_\-]+\.simplemachines\.org/~', $_REQUEST['package']) == 1 && strpos($_REQUEST['package'], 'dlattach') === false && isset($_REQUEST['auto']))
-		redirectexit('action=packages;sa=install;package=' . $package_name);
+		redirectexit('action=packages;sa=install;package=' . $package_name . ';sesc=' . $context['session_id']);
 
 	// You just downloaded a mod from SERVER_NAME_GOES_HERE.
 	$context['package_server'] = $server;
@@ -572,11 +587,11 @@
 		fatal_lang_error('package_cant_download', false);
 
 	if ($context['package']['type'] == 'modification')
-		$context['package']['install']['link'] = '<a href="' . $scripturl . '?action=packages;sa=install;package=' . $context['package']['filename'] . '">[ ' . $txt['package11'] . ' ]</a>';
+		$context['package']['install']['link'] = '<a href="' . $scripturl . '?action=packages;sa=install;package=' . $context['package']['filename'] . ';sesc=' . $context['session_id'] . '">[ ' . $txt['package11'] . ' ]</a>';
 	elseif ($context['package']['type'] == 'avatar')
-		$context['package']['install']['link'] = '<a href="' . $scripturl . '?action=packages;sa=install;package=' . $context['package']['filename'] . '">[ ' . $txt['package12'] . ' ]</a>';
+		$context['package']['install']['link'] = '<a href="' . $scripturl . '?action=packages;sa=install;package=' . $context['package']['filename'] . ';sesc=' . $context['session_id'] . '">[ ' . $txt['package12'] . ' ]</a>';
 	elseif ($context['package']['type'] == 'language')
-		$context['package']['install']['link'] = '<a href="' . $scripturl . '?action=packages;sa=install;package=' . $context['package']['filename'] . '">[ ' . $txt['package13'] . ' ]</a>';
+		$context['package']['install']['link'] = '<a href="' . $scripturl . '?action=packages;sa=install;package=' . $context['package']['filename'] . ';sesc=' . $context['session_id'] . '">[ ' . $txt['package13'] . ' ]</a>';
 	else
 		$context['package']['install']['link'] = '';
 
@@ -633,11 +648,11 @@
 	}
 
 	if ($context['package']['type'] == 'modification')
-		$context['package']['install']['link'] = '<a href="' . $scripturl . '?action=packages;sa=install;package=' . $context['package']['filename'] . '">[ ' . $txt['package11'] . ' ]</a>';
+		$context['package']['install']['link'] = '<a href="' . $scripturl . '?action=packages;sa=install;package=' . $context['package']['filename'] . ';sesc=' . $context['session_id'] . '">[ ' . $txt['package11'] . ' ]</a>';
 	elseif ($context['package']['type'] == 'avatar')
-		$context['package']['install']['link'] = '<a href="' . $scripturl . '?action=packages;sa=install;package=' . $context['package']['filename'] . '">[ ' . $txt['package12'] . ' ]</a>';
+		$context['package']['install']['link'] = '<a href="' . $scripturl . '?action=packages;sa=install;package=' . $context['package']['filename'] . ';sesc=' . $context['session_id'] . '">[ ' . $txt['package12'] . ' ]</a>';
 	elseif ($context['package']['type'] == 'language')
-		$context['package']['install']['link'] = '<a href="' . $scripturl . '?action=packages;sa=install;package=' . $context['package']['filename'] . '">[ ' . $txt['package13'] . ' ]</a>';
+		$context['package']['install']['link'] = '<a href="' . $scripturl . '?action=packages;sa=install;package=' . $context['package']['filename'] . ';sesc=' . $context['session_id'] . '">[ ' . $txt['package13'] . ' ]</a>';
 	else
 		$context['package']['install']['link'] = '';
 
Index: smf/Sources/Packages.php
===================================================================
--- smf/Sources/Packages.php	(revision 1047)
+++ smf/Sources/Packages.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.2                                           *
+* Software Version:           SMF 1.1.10                                          *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -145,8 +145,10 @@
 {
 	global $boarddir, $txt, $context, $scripturl, $sourcedir, $modSettings;
 
+	checkSession('request');
+
 	// You have to specify a file!!
-	if (!isset($_REQUEST['package']) || $_REQUEST['package'] == '')
+	if (empty($_REQUEST['package']) || preg_match('~[^\\w0-9.\\-_]~', $_REQUEST['package']) === 1 || strpos($_REQUEST['package'], '..') !== false)
 		redirectexit('action=packages');
 	$context['filename'] = preg_replace('~[\.]+~', '.', $_REQUEST['package']);
 
@@ -308,7 +310,7 @@
 
 				$context['actions'][] = array(
 					'type' => $txt['package56'],
-					'action' => strtr($action['filename'], array($boarddir => '.')),
+					'action' => htmlspecialchars(strtr($action['filename'], array($boarddir => '.'))),
 					'description' => $txt['package_action_error']
 				);
 			}
@@ -335,14 +337,14 @@
 				elseif ($mod_action['type'] == 'saved')
 					$context['actions'][] = array(
 						'type' => $txt['package56'],
-						'action' => strtr($mod_action['filename'], array($boarddir => '.')),
+						'action' => htmlspecialchars(strtr($mod_action['filename'], array($boarddir => '.'))),
 						'description' => $failed ? $txt['package_action_failure'] : $txt['package_action_success']
 					);
 				elseif ($mod_action['type'] == 'skipping')
 				{
 					$context['actions'][] = array(
 						'type' => $txt['package56'],
-						'action' => strtr($mod_action['filename'], array($boarddir => '.')),
+						'action' => htmlspecialchars(strtr($mod_action['filename'], array($boarddir => '.'))),
 						'description' => $txt['package_action_skipping']
 					);
 				}
@@ -351,14 +353,14 @@
 					$context['has_failure'] = true;
 					$context['actions'][] = array(
 						'type' => $txt['package56'],
-						'action' => strtr($mod_action['filename'], array($boarddir => '.')),
+						'action' => htmlspecialchars(strtr($mod_action['filename'], array($boarddir => '.'))),
 						'description' => $txt['package_action_missing']
 					);
 				}
 				elseif ($mod_action['type'] == 'error')
 					$context['actions'][] = array(
 						'type' => $txt['package56'],
-						'action' => strtr($mod_action['filename'], array($boarddir => '.')),
+						'action' => htmlspecialchars(strtr($mod_action['filename'], array($boarddir => '.'))),
 						'description' => $txt['package_action_error']
 					);
 			}
@@ -369,27 +371,27 @@
 		elseif ($action['type'] == 'code')
 			$thisAction = array(
 				'type' => $txt['package57'],
-				'action' => $action['filename']
+				'action' => htmlspecialchars($action['filename'])
 			);
 		elseif (in_array($action['type'], array('create-dir', 'create-file')))
 			$thisAction = array(
 				'type' => $txt['package50'] . ' ' . ($action['type'] == 'create-dir' ? $txt['package55'] : $txt['package54']),
-				'action' => strtr($action['destination'], array($boarddir => '.'))
+				'action' => htmlspecialchars(strtr($action['destination'], array($boarddir => '.')))
 			);
 		elseif (in_array($action['type'], array('require-dir', 'require-file')))
 			$thisAction = array(
 				'type' => $txt['package53'] . ' ' . ($action['type'] == 'require-dir' ? $txt['package55'] : $txt['package54']),
-				'action' => strtr($action['destination'], array($boarddir => '.'))
+				'action' => htmlspecialchars(strtr($action['destination'], array($boarddir => '.')))
 			);
 		elseif (in_array($action['type'], array('move-dir', 'move-file')))
 			$thisAction = array(
 				'type' => $txt['package51'] . ' ' . ($action['type'] == 'move-dir' ? $txt['package55'] : $txt['package54']),
-				'action' => strtr($action['source'], array($boarddir => '.')) . ' => ' . strtr($action['destination'], array($boarddir => '.'))
+				'action' => htmlspecialchars(strtr($action['source'], array($boarddir => '.'))) . ' => ' . htmlspecialchars(strtr($action['destination'], array($boarddir => '.')))
 			);
 		elseif (in_array($action['type'], array('remove-dir', 'remove-file')))
 			$thisAction = array(
 				'type' => $txt['package52'] . ' ' . ($action['type'] == 'remove-dir' ? $txt['package55'] : $txt['package54']),
-				'action' => strtr($action['filename'], array($boarddir => '.'))
+				'action' => htmlspecialchars(strtr($action['filename'], array($boarddir => '.')))
 			);
 
 		if (empty($thisAction))
@@ -416,8 +418,10 @@
 {
 	global $boarddir, $txt, $context, $boardurl, $scripturl, $sourcedir, $modSettings;
 
+	checkSession('post');
+
 	// If there's no file, what are we installing?
-	if (!isset($_REQUEST['package']) || $_REQUEST['package'] == '')
+	if (empty($_REQUEST['package']) || preg_match('~[^\\w0-9.\\-_]~', $_REQUEST['package']) === 1 || strpos($_REQUEST['package'], '..') !== false)
 		redirectexit('action=packages');
 	$context['filename'] = $_REQUEST['package'];
 
@@ -609,7 +613,7 @@
 	require_once($sourcedir . '/Subs-Package.php');
 
 	// No package?  Show him or her the door.
-	if (!isset($_REQUEST['package']) || $_REQUEST['package'] == '')
+	if (empty($_REQUEST['package']) || preg_match('~[^\\w0-9.\\-_]~', $_REQUEST['package']) === 1 || strpos($_REQUEST['package'], '..') !== false)
 		redirectexit('action=packages');
 
 	$context['linktree'][] = array(
@@ -634,10 +638,12 @@
 {
 	global $txt, $scripturl, $boarddir, $context, $sourcedir;
 
+	checkSession('get');
+
 	require_once($sourcedir . '/Subs-Package.php');
 
 	// No package?  Show him or her the door.
-	if (!isset($_REQUEST['package']) || $_REQUEST['package'] == '')
+	if (empty($_REQUEST['package']) || preg_match('~[^\\w0-9.\\-_]~', $_REQUEST['package']) === 1 || strpos($_REQUEST['package'], '..') !== false)
 		redirectexit('action=packages');
 
 	// No file?  Show him or her the door.
@@ -670,7 +676,7 @@
 
 	// Let the unpacker do the work.... but make sure we handle images properly.
 	if (in_array(strtolower(strrchr($_REQUEST['file'], '.')), array('.bmp', '.gif', '.jpeg', '.jpg', '.png')))
-		$context['filedata'] = '<img src="' . $scripturl . '?action=packages;sa=examine;package=' . $_REQUEST['package'] . ';file=' . $_REQUEST['file'] . ';raw" alt="' . $_REQUEST['file'] . '" />';
+		$context['filedata'] = '<img src="' . $scripturl . '?action=packages;sa=examine;package=' . $_REQUEST['package'] . ';file=' . $_REQUEST['file'] . ';raw;sesc=' . $context['session_id'] . '" alt="' . $_REQUEST['file'] . '" />';
 	else
 	{
 		if (is_file($boarddir . '/Packages/' . $_REQUEST['package']))
@@ -705,6 +711,8 @@
 {
 	global $boarddir, $sourcedir;
 
+	checkSession('get');
+
 	include_once($sourcedir . '/Subs-Package.php');
 
 	// Open the file and write nothing to it.
@@ -718,6 +726,8 @@
 {
 	global $scripturl, $boarddir;
 
+	checkSession('get');
+
 	// Ack, don't allow deletion of arbitrary files here, could become a security hole somehow!
 	if (!isset($_GET['package']) || $_GET['package'] == 'index.php' || $_GET['package'] == 'installed.list')
 		redirectexit('action=packages;sa=browse');
Index: smf/Sources/PersonalMessage.php
===================================================================
--- smf/Sources/PersonalMessage.php	(revision 1047)
+++ smf/Sources/PersonalMessage.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.10                                          *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -1254,7 +1254,7 @@
 	if ($context['visual_verification'])
 	{
 		$context['use_graphic_library'] = in_array('gd', get_loaded_extensions());
-		$context['verificiation_image_href'] = $scripturl . '?action=verificationcode;rand=' . md5(rand());
+		$context['verificiation_image_href'] = $scripturl . '?action=verificationcode;rand=' . md5(mt_rand());
 
 		// Skip I, J, L, O, Q, S and Z.
 		$character_range = array_merge(range('A', 'H'), array('K', 'M', 'N', 'P'), range('R', 'Z'));
@@ -1345,6 +1345,10 @@
 	);
 	foreach ($error_types as $error_type)
 	{
+		// There is no compatible language string. So lets work around that.
+		if ($error_type == 'wrong_verification_code')
+			$txt['error_wrong_verification_code'] = $txt['visual_verification_failed'];
+
 		$context['post_error'][$error_type] = true;
 		if (isset($txt['error_' . $error_type]))
 			$context['post_error']['messages'][] = $txt['error_' . $error_type];
@@ -1355,7 +1359,7 @@
 	if ($context['visual_verification'])
 	{
 		$context['use_graphic_library'] = in_array('gd', get_loaded_extensions());
-		$context['verificiation_image_href'] = $scripturl . '?action=verificationcode;rand=' . md5(rand());
+		$context['verificiation_image_href'] = $scripturl . '?action=verificationcode;rand=' . md5(mt_rand());
 	}
 
 	// No check for the previous submission is needed.
Index: smf/Sources/Post.php
===================================================================
--- smf/Sources/Post.php	(revision 1047)
+++ smf/Sources/Post.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.10                                          *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -144,6 +144,20 @@
 		$context['preview_subject'] = '';
 	}
 
+	// No message is complete without a topic.
+	if (empty($topic) && !empty($_REQUEST['msg']))
+	{
+		$request = db_query("
+			SELECT id_topic
+			FROM {$db_prefix}messages
+			WHERE id_msg = " . (int) $_REQUEST['msg'], __FILE__, __LINE__);
+		if (mysql_num_rows($request) != 1)
+			unset($_REQUEST['msg'], $_POST['msg'], $_GET['msg']);
+		else
+			list($topic) = mysql_fetch_row($request);
+		mysql_free_result($request);
+	}
+
 	// Check if it's locked.  It isn't locked if no topic is specified.
 	if (!empty($topic))
 	{
@@ -570,8 +584,46 @@
 		$context['submit_label'] = isset($_REQUEST['msg']) ? $txt[10] : $txt[105];
 
 		// Previewing an edit?
-		if (isset($_REQUEST['msg']))
+		if (isset($_REQUEST['msg']) && !empty($topic))
 		{
+			// Get the existing message.
+			$request = db_query("
+				SELECT
+					m.ID_MEMBER, m.modifiedTime, m.smileysEnabled, m.body,
+					m.posterName, m.posterEmail, m.subject, m.icon,
+					IFNULL(a.size, -1) AS filesize, a.filename, a.ID_ATTACH,
+					t.ID_MEMBER_STARTED AS ID_MEMBER_POSTER, m.posterTime
+				FROM ({$db_prefix}messages AS m, {$db_prefix}topics AS t)
+					LEFT JOIN {$db_prefix}attachments AS a ON (a.ID_MSG = m.ID_MSG AND a.attachmentType = 0)
+				WHERE m.ID_MSG = " . (int) $_REQUEST['msg'] . "
+					AND m.ID_TOPIC = $topic
+					AND t.ID_TOPIC = $topic", __FILE__, __LINE__);
+			// The message they were trying to edit was most likely deleted.
+			// !!! Change this error message?
+			if (mysql_num_rows($request) == 0)
+				fatal_lang_error('smf232', false);
+			$row = mysql_fetch_assoc($request);
+	
+			$attachment_stuff = array($row);
+			while ($row2 = mysql_fetch_assoc($request))
+				$attachment_stuff[] = $row2;
+			mysql_free_result($request);
+
+			if ($row['ID_MEMBER'] == $ID_MEMBER && !allowedTo('modify_any'))
+			{
+				// Give an extra five minutes over the disable time threshold, so they can type.
+				if (!empty($modSettings['edit_disable_time']) && $row['posterTime'] + ($modSettings['edit_disable_time'] + 5) * 60 < time())
+					fatal_lang_error('modify_post_time_passed', false);
+				elseif ($row['ID_MEMBER_POSTER'] == $ID_MEMBER && !allowedTo('modify_own'))
+					isAllowedTo('modify_replies');
+				else
+					isAllowedTo('modify_own');
+			}
+			elseif ($row['ID_MEMBER_POSTER'] == $ID_MEMBER && !allowedTo('modify_any'))
+				isAllowedTo('modify_replies');
+			else
+				isAllowedTo('modify_any');
+
 			if (!empty($modSettings['attachmentEnable']))
 			{
 				$request = db_query("
@@ -615,7 +667,7 @@
 		checkSubmitOnce('free');
 	}
 	// Editing a message...
-	elseif (isset($_REQUEST['msg']))
+	elseif (isset($_REQUEST['msg']) && !empty($topic))
 	{
 		checkSession('get');
 
@@ -814,7 +866,7 @@
 				$total_size += filesize($modSettings['attachmentUploadDir'] . '/' . $attachID);
 
 				$context['current_attachments'][] = array(
-					'name' => getAttachmentFilename($name, false, true),
+					'name' => $name,
 					'id' => $attachID
 				);
 			}
@@ -1157,6 +1209,9 @@
 	// Posting a new topic.
 	elseif (empty($topic))
 	{
+		// Now don't be silly, new topics will get their own id_msg soon enough.
+		unset($_REQUEST['msg'], $_POST['msg'], $_GET['msg']);
+
 		if (!isset($_REQUEST['poll']) || $modSettings['pollMode'] != '1')
 			isAllowedTo('post_new');
 
Index: smf/Sources/Profile.php
===================================================================
--- smf/Sources/Profile.php	(revision 1047)
+++ smf/Sources/Profile.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.10                                          *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -699,7 +699,8 @@
 			// Prepare the new password, or check if they want to change their own.
 			if (!empty($modSettings['send_validation_onChange']) && !allowedTo('moderate_forum'))
 			{
-				$validationCode = substr(preg_replace('/\W/', '', md5(rand())), 0, 10);
+				require_once($sourcedir . '/Subs-Members.php');
+				$validationCode = generateValidationCode();
 				$profile_vars['validation_code'] = '\'' . $validationCode . '\'';
 				$profile_vars['is_activated'] = '2';
 				$newpassemail = true;
@@ -901,6 +902,29 @@
 {
 	global $db_prefix, $modSettings;
 
+	$reservedVars = array(
+		'actual_theme_url',
+		'actual_images_url',
+		'base_theme_dir',
+		'base_theme_url',
+		'default_images_url',
+		'default_theme_dir',
+		'default_theme_url',
+		'default_template',
+		'images_url',
+		'number_recent_posts',
+		'smiley_sets_default',
+		'theme_dir',
+		'theme_id',
+		'theme_layers',
+		'theme_templates',
+		'theme_url',
+	);
+
+	// Can't change reserved vars.
+	if ((isset($_POST['options']) && array_intersect(array_keys($_POST['options']), $reservedVars) != array()) || (isset($_POST['default_options']) && array_intersect(array_keys($_POST['default_options']), $reservedVars) != array()))
+		fatal_lang_error(1);
+
 	// These are the theme changes...
 	$themeSetArray = array();
 	if (isset($_POST['options']) && is_array($_POST['options']))
@@ -1090,6 +1114,24 @@
 			}
 			elseif (is_array($sizes))
 			{
+				// Though not an exhaustive list, better safe than sorry.
+				$fp = fopen($_FILES['attachment']['tmp_name'], 'rb');
+				if (!$fp)
+					fatal_lang_error('smf124');
+
+				// Now try to find an infection.
+				while (!feof($fp))
+				{
+					if (preg_match('~(iframe|\\<\\?php|\\<\\?[\s=]|\\<%[\s=]|html|eval|body|script\W)~', fgets($fp, 4096)) === 1)
+					{
+						if (file_exists($uploadDir . '/avatar_tmp_' . $memID))
+							@unlink($uploadDir . '/avatar_tmp_' . $memID);
+
+						fatal_lang_error('smf124');
+					}
+				}
+				fclose($fp);
+
 				$extensions = array(
 					'1' => '.gif',
 					'2' => '.jpg',
@@ -1104,16 +1146,28 @@
 				// Remove previous attachments this member might have had.
 				removeAttachments('a.ID_MEMBER = ' . $memID);
 
-				if (!rename($_FILES['attachment']['tmp_name'], $uploadDir . '/' . $destName))
-					fatal_lang_error('smf124');
+				$file_hash = empty($modSettings['custom_avatar_enabled']) ? getAttachmentFilename($destName, false, true) : '';
 
 				db_query("
 					INSERT INTO {$db_prefix}attachments
-						(ID_MEMBER, attachmentType, filename, size, width, height)
-					VALUES ($memID, " . (empty($modSettings['custom_avatar_enabled']) ? '0' : '1') . ", '$destName', " . filesize($uploadDir . '/' . $destName) . ", " . (int) $width . ", " . (int) $height . ")", __FILE__, __LINE__);
+						(ID_MEMBER, attachmentType, filename, file_hash, size, width, height)
+					VALUES ($memID, " . (empty($modSettings['custom_avatar_enabled']) ? '0' : '1') . ", '$destName', '" . (empty($file_hash) ? "" : "$file_hash") . "', " . filesize($_FILES['attachment']['tmp_name']) . ", " . (int) $width . ", " . (int) $height . ")", __FILE__, __LINE__);
+				$attachID = db_insert_id();
 
+				// Try to move this avatar.
+				$destinationPath = $uploadDir . '/' . (empty($file_hash) ? $destName : $attachID . '_' . $file_hash);
+				if (!rename($_FILES['attachment']['tmp_name'], $destinationPath))
+				{
+					// The move failed, get rid of it and die.
+					db_query("
+						DELETE FROM {$db_prefix}attachments
+						WHERE ID_ATTACH = $attachID", __FILE__, __LINE__);
+
+					fatal_lang_error('smf124');
+				}
+
 				// Attempt to chmod it.
-				@chmod($uploadDir . '/' . $destName, 0644);
+				@chmod($destinationPath, 0644);
 			}
 			$_POST['avatar'] = '';
 
@@ -1202,7 +1256,7 @@
 		$context['activate_link_text'] = in_array($context['member']['is_activated'], array(3, 4, 5, 13, 14, 15)) ? $txt['account_approve'] : $txt['account_activate'];
 
 		// Should we show a custom message?
-		$context['activate_message'] = isset($txt['account_activate_method_' . $context['member']['is_activated'] % 10]) ? $txt['account_activate_method_' . $context['member']['is_activated']] : $txt['account_not_activated'];
+		$context['activate_message'] = isset($txt['account_activate_method_' . $context['member']['is_activated'] % 10]) ? $txt['account_activate_method_' . $context['member']['is_activated'] % 10] : $txt['account_not_activated'];
 	}
 
 	// How about, are they banned?
@@ -1854,8 +1908,10 @@
 	// Get some totals for pagination.
 	$request = db_query("
 		SELECT COUNT(*)
-		FROM {$db_prefix}messages
-		WHERE posterIP $dbip", __FILE__, __LINE__);
+		FROM {$db_prefix}messages AS m
+			INNER JOIN {$db_prefix}boards AS b ON (b.ID_BOARD = m.ID_BOARD)
+		WHERE $user_info[query_see_board]
+			AND m.posterIP $dbip", __FILE__, __LINE__);
 	list ($totalMessages) = mysql_fetch_row($request);
 	mysql_free_result($request);
 	$request = db_query("
@@ -1887,8 +1943,10 @@
 			m.ID_MSG, m.posterIP, IFNULL(mem.realName, m.posterName) AS display_name, mem.ID_MEMBER,
 			m.subject, m.posterTime, m.ID_TOPIC, m.ID_BOARD
 		FROM {$db_prefix}messages AS m
+			INNER JOIN {$db_prefix}boards AS b ON (b.ID_BOARD = m.ID_BOARD)
 			LEFT JOIN {$db_prefix}members AS mem ON (mem.ID_MEMBER = m.ID_MEMBER)
-		WHERE m.posterIP $dbip
+		WHERE $user_info[query_see_board]
+			AND m.posterIP $dbip
 		ORDER BY m.ID_MSG DESC
 		LIMIT $context[message_start], 20", __FILE__, __LINE__);
 	$context['messages'] = array();
@@ -1950,12 +2008,12 @@
 			),
 			'apnic' => array(
 				'name' => &$txt['whois_apnic'],
-				'url' => 'http://www.apnic.net/apnic-bin/whois2.pl?searchtext=' . $context['ip'],
+				'url' => 'http://wq.apnic.net/apnic-bin/whois.pl?searchtext=' . $context['ip'],
 				'range' => array(58, 59, 60, 61, 124, 125, 126, 202, 203, 210, 211, 218, 219, 220, 221, 222),
 			),
 			'arin' => array(
 				'name' => &$txt['whois_arin'],
-				'url' => 'http://ws.arin.net/cgi-bin/whois.pl?queryinput=' . $context['ip'],
+				'url' => 'http://ws.arin.net/whois/?queryinput=' . $context['ip'],
 				'range' => array(63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 199, 204, 205, 206, 207, 208, 209, 216),
 			),
 			'lacnic' => array(
@@ -1965,7 +2023,7 @@
 			),
 			'ripe' => array(
 				'name' => &$txt['whois_ripe'],
-				'url' => 'http://www.ripe.net/perl/whois?searchtext=' . $context['ip'],
+				'url' => 'http://www.db.ripe.net/whois?searchtext=' . $context['ip'],
 				'range' => array(62, 80, 81, 82, 83, 84, 85, 86, 87, 88, 193, 194, 195, 212, 213, 217),
 			),
 		);
Index: smf/Sources/QueryString.php
===================================================================
--- smf/Sources/QueryString.php	(revision 1047)
+++ smf/Sources/QueryString.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.9                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006 by:          Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -120,7 +120,7 @@
 
 		// Replace ';' with '&' and '&something&' with '&something=&'.  (this is done for compatibility...)
 		// !!! smflib
-		parse_str(preg_replace('/&(\w+)(?=&|$)/', '&$1=', strtr($_SERVER['QUERY_STRING'], array(';?' => '&', ';' => '&'))), $_GET);
+		parse_str(preg_replace('/&(\w+)(?=&|$)/', '&$1=', strtr($_SERVER['QUERY_STRING'], array(';?' => '&', ';' => '&', '%00' => '', "\0" => ''))), $_GET);
 	}
 	elseif (strpos(@ini_get('arg_separator.input'), ';') !== false)
 	{
@@ -252,15 +252,15 @@
 	$_SERVER['BAN_CHECK_IP'] = isset($_SERVER['REMOTE_ADDR']) && preg_match('~^((([1]?\d)?\d|2[0-4]\d|25[0-5])\.){3}(([1]?\d)?\d|2[0-4]\d|25[0-5])$~', $_SERVER['REMOTE_ADDR']) === 1 ? $_SERVER['REMOTE_ADDR'] : 'unknown';
 
 	// Find the user's IP address. (but don't let it give you 'unknown'!)
-	if (!empty($_SERVER['HTTP_X_FORWARDED_FOR']) && !empty($_SERVER['HTTP_CLIENT_IP']) && (preg_match('~^((0|10|172\.16|192\.168|255|127\.0)\.|unknown)~', $_SERVER['HTTP_CLIENT_IP']) == 0 || preg_match('~^((0|10|172\.16|192\.168|255|127\.0)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0))
+	if (!empty($_SERVER['HTTP_X_FORWARDED_FOR']) && !empty($_SERVER['HTTP_CLIENT_IP']) && (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['HTTP_CLIENT_IP']) == 0 || preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0))
 	{
 		// We have both forwarded for AND client IP... check the first forwarded for as the block - only switch if it's better that way.
-		if (strtok($_SERVER['HTTP_X_FORWARDED_FOR'], '.') != strtok($_SERVER['HTTP_CLIENT_IP'], '.') && '.' . strtok($_SERVER['HTTP_X_FORWARDED_FOR'], '.') == strrchr($_SERVER['HTTP_CLIENT_IP'], '.') && (preg_match('~^((0|10|172\.16|192\.168|255|127\.0)\.|unknown)~', $_SERVER['HTTP_X_FORWARDED_FOR']) == 0 || preg_match('~^((0|10|172\.16|192\.168|255|127\.0)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0))
+		if (strtok($_SERVER['HTTP_X_FORWARDED_FOR'], '.') != strtok($_SERVER['HTTP_CLIENT_IP'], '.') && '.' . strtok($_SERVER['HTTP_X_FORWARDED_FOR'], '.') == strrchr($_SERVER['HTTP_CLIENT_IP'], '.') && (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['HTTP_X_FORWARDED_FOR']) == 0 || preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0))
 			$_SERVER['REMOTE_ADDR'] = implode('.', array_reverse(explode('.', $_SERVER['HTTP_CLIENT_IP'])));
 		else
 			$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CLIENT_IP'];
 	}
-	if (!empty($_SERVER['HTTP_CLIENT_IP']) && (preg_match('~^((0|10|172\.16|192\.168|255|127\.0)\.|unknown)~', $_SERVER['HTTP_CLIENT_IP']) == 0 || preg_match('~^((0|10|172\.16|192\.168|255|127\.0)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0))
+	if (!empty($_SERVER['HTTP_CLIENT_IP']) && (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['HTTP_CLIENT_IP']) == 0 || preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0))
 	{
 		// Since they are in different blocks, it's probably reversed.
 		if (strtok($_SERVER['REMOTE_ADDR'], '.') != strtok($_SERVER['HTTP_CLIENT_IP'], '.'))
@@ -279,7 +279,7 @@
 			foreach ($ips as $i => $ip)
 			{
 				// Make sure it's in a valid range...
-				if (preg_match('~^((0|10|172\.16|192\.168|255|127\.0)\.|unknown)~', $ip) != 0 && preg_match('~^((0|10|172\.16|192\.168|255|127\.0)\.|unknown)~', $_SERVER['REMOTE_ADDR']) == 0)
+				if (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $ip) != 0 && preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['REMOTE_ADDR']) == 0)
 					continue;
 
 				// Otherwise, we've got an IP!
@@ -288,7 +288,7 @@
 			}
 		}
 		// Otherwise just use the only one.
-		elseif (preg_match('~^((0|10|172\.16|192\.168|255|127\.0)\.|unknown)~', $_SERVER['HTTP_X_FORWARDED_FOR']) == 0 || preg_match('~^((0|10|172\.16|192\.168|255|127\.0)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0)
+		elseif (preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['HTTP_X_FORWARDED_FOR']) == 0 || preg_match('~^((0|10|172\.(1[6-9]|2[0-9]|3[01])|192\.168|255|127)\.|unknown)~', $_SERVER['REMOTE_ADDR']) != 0)
 			$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_FORWARDED_FOR'];
 	}
 	elseif (!isset($_SERVER['REMOTE_ADDR']))
Index: smf/Sources/Register.php
===================================================================
--- smf/Sources/Register.php	(revision 1047)
+++ smf/Sources/Register.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.10                                          *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -119,7 +119,7 @@
 	if ($context['visual_verification'])
 	{
 		$context['use_graphic_library'] = in_array('gd', get_loaded_extensions());
-		$context['verificiation_image_href'] = $scripturl . '?action=verificationcode;rand=' . md5(rand());
+		$context['verificiation_image_href'] = $scripturl . '?action=verificationcode;rand=' . md5(mt_rand());
 
 		// Only generate a new code if one hasn't been set yet
 		if (!isset($_SESSION['visual_verification_code']))
@@ -217,7 +217,7 @@
 	if (isset($_POST['realName']) && (!empty($modSettings['allow_editDisplayName']) || allowedTo('moderate_forum')))
 	{
 		$_POST['realName'] = trim(preg_replace('~[\s]~' . ($context['utf8'] ? 'u' : ''), ' ', $_POST['realName']));
-		if (trim($_POST['realName']) != '' && !isReservedName($_POST['realName'], $memID) && $func['strlen']($_POST['realName']) <= 60)
+		if (trim($_POST['realName']) != '' && !isReservedName($_POST['realName']) && $func['strlen']($_POST['realName']) <= 60)
 			$possible_strings[] = 'realName';
 	}
 
@@ -298,7 +298,7 @@
 	// Registration options are always default options...
 	if (isset($_POST['default_options']))
 		$_POST['options'] = isset($_POST['options']) ? $_POST['options'] + $_POST['default_options'] : $_POST['default_options'];
-	$regOptions['theme_vars'] = isset($_POST['options']) && is_array($_POST['options']) ? $_POST['options'] : array();
+	$regOptions['theme_vars'] = isset($_POST['options']) && is_array($_POST['options']) ? htmlspecialchars__recursive($_POST['options']) : array();
 
 	$memberID = registerMember($regOptions);
 
@@ -543,7 +543,7 @@
 		loadLanguage('Login');
 		loadTemplate('Register');
 
-		$context['verificiation_sound_href'] = $scripturl . '?action=verificationcode;rand=' . md5(rand()) . ';format=.wav';
+		$context['verificiation_sound_href'] = $scripturl . '?action=verificationcode;rand=' . md5(mt_rand()) . ';format=.wav';
 		$context['sub_template'] = 'verification_sound';
 		$context['template_layers'] = array();
 
Index: smf/Sources/Reminder.php
===================================================================
--- smf/Sources/Reminder.php	(revision 1047)
+++ smf/Sources/Reminder.php	(working copy)
@@ -5,7 +5,7 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.2                                           *
+* Software Version:           SMF 1.1.6                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
 * Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
@@ -120,7 +120,8 @@
 		fatal_error('<b>' . $txt[394] . '<br />' . $txt[395] . ' <a href="mailto:' . $webmaster_email . '">webmaster</a> ' . $txt[396] . '.');
 
 	// Randomly generate a new password, with only alpha numeric characters that is a max length of 10 chars.
-	$password = substr(preg_replace('/\W/', '', md5(rand())), 0, 10);
+	require_once($sourcedir . '/Subs-Members.php');
+	$password = generateValidationCode();
 
 	// Set the password in the database.
 	updateMemberData($row['ID_MEMBER'], array('validation_code' => "'" . substr(md5($password), 0, 10) . "'"));
Index: smf/Sources/Security.php
===================================================================
--- smf/Sources/Security.php	(revision 1047)
+++ smf/Sources/Security.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.9                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006 by:          Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -193,7 +193,6 @@
 
 	// Use the kick_guest sub template...
 	$context['kick_message'] = $message;
-	$context['sub_template'] = 'kick_guest';
 	$context['page_title'] = $txt[34];
 
 	obExit();
@@ -607,6 +606,22 @@
 	trigger_error('Hacking attempt...', E_USER_ERROR);
 }
 
+function checkConfirm($action)
+{
+	global $modSettings;
+	
+	if (isset($_GET['confirm']) && isset($_SESSION['confirm_' . $action]) && md5($_GET['confirm'] . $_SERVER['HTTP_USER_AGENT']) == $_SESSION['confirm_' . $action])
+		return true;
+		
+	else
+	{
+		$token = md5(mt_rand() . session_id() . (string) microtime() . $modSettings['rand_seed']);
+		$_SESSION['confirm_' . $action] = md5($token . $_SERVER['HTTP_USER_AGENT']);
+		
+		return $token;
+	}
+}
+
 // Check whether a form has been submitted twice.
 function checkSubmitOnce($action, $is_fatal = true)
 {
@@ -620,7 +635,7 @@
 	{
 		$context['form_sequence_number'] = 0;
 		while (empty($context['form_sequence_number']) || in_array($context['form_sequence_number'], $_SESSION['forms']))
-			$context['form_sequence_number'] = rand(1, 16000000);
+			$context['form_sequence_number'] = mt_rand(1, 16000000);
 	}
 	// Check whether the submitted number can be found in the session.
 	elseif ($action == 'check')
@@ -638,7 +653,7 @@
 			return false;
 	}
 	// Don't check, just free the stack number.
-	elseif ($action == 'free' && isset($_REQUEST['seqnum']) && in_array($_REQUEST['seqnum'], $_SESSION['forms']))	
+	elseif ($action == 'free' && isset($_REQUEST['seqnum']) && in_array($_REQUEST['seqnum'], $_SESSION['forms']))
 		$_SESSION['forms'] = array_diff($_SESSION['forms'], array($_REQUEST['seqnum']));
 	elseif ($action != 'free')
 		trigger_error('checkSubmitOnce(): Invalid action \'' . $action . '\'', E_USER_WARNING);
Index: smf/Sources/SplitTopics.php
===================================================================
--- smf/Sources/SplitTopics.php	(revision 1047)
+++ smf/Sources/SplitTopics.php	(working copy)
@@ -5,7 +5,7 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.2                                           *
+* Software Version:           SMF 1.1.6                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
 * Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
@@ -626,6 +626,10 @@
 	$_REQUEST['targetboard'] = isset($_REQUEST['targetboard']) ? (int) $_REQUEST['targetboard'] : $board;
 	$context['target_board'] = $_REQUEST['targetboard'];
 
+	if (!isset($_GET['from']))
+		fatal_lang_error(1);
+	$_GET['from'] = (int) $_GET['from'];
+
 	// How many topics are on this board?  (used for paging.)
 	$request = db_query("
 		SELECT COUNT(*)
@@ -728,7 +732,7 @@
 
 	// Handle URLs from MergeIndex.
 	if (!empty($_GET['from']) && !empty($_GET['to']))
-		$topics = array($_GET['from'], $_GET['to']);
+		$topics = array((int) $_GET['from'], (int) $_GET['to']);
 
 	// If we came from a form, the topic IDs came by post.
 	if (!empty($_POST['topics']) && is_array($_POST['topics']))
@@ -1091,8 +1095,8 @@
 	global $txt, $context;
 
 	// Make sure the template knows everything...
-	$context['target_board'] = $_GET['targetboard'];
-	$context['target_topic'] = $_GET['to'];
+	$context['target_board'] = (int) $_GET['targetboard'];
+	$context['target_topic'] = (int) $_GET['to'];
 
 	$context['page_title'] = $txt['smf252'];
 	$context['sub_template'] = 'merge_done';
Index: smf/Sources/Stats.php
===================================================================
--- smf/Sources/Stats.php	(revision 1047)
+++ smf/Sources/Stats.php	(working copy)
@@ -5,7 +5,7 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1                                             *
+* Software Version:           SMF 1.1.6                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
 * Copyright 2006 by:          Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
@@ -387,7 +387,6 @@
 		SELECT ID_MEMBER, realName
 		FROM {$db_prefix}members
 		WHERE ID_MEMBER IN (" . implode(', ', array_keys($members)) . ")
-		GROUP BY ID_MEMBER
 		ORDER BY FIND_IN_SET(ID_MEMBER, '" . implode(',', array_keys($members)) . "')
 		LIMIT 10", __FILE__, __LINE__);
 	$context['top_starters'] = array();
@@ -595,7 +594,7 @@
 			$out .= "Host: www.simplemachines.org\r\n";
 			$out .= "Content-Type: application/x-www-form-urlencoded\r\n";
 			$out .= "Content-Length: $length\r\n\r\n";
-			$out .= "$stats_to_send\r\n"; 
+			$out .= "$stats_to_send\r\n";
 			$out .= "Connection: Close\r\n\r\n";
 			fwrite($fp, $out);
 			fclose($fp);
Index: smf/Sources/Subs-Auth.php
===================================================================
--- smf/Sources/Subs-Auth.php	(revision 1047)
+++ smf/Sources/Subs-Auth.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.3                                           *
+* Software Version:           SMF 1.1.10                                          *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006 by:          Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -179,7 +179,7 @@
 		$_SESSION = $oldSessionData;
 
 		// Version 4.3.2 didn't store the cookie of the new session.
-		if (version_compare(PHP_VERSION, '4.3.2') === 0)
+		if (version_compare(PHP_VERSION, '4.3.2') === 0 || (isset($_COOKIE[session_name()]) && $_COOKIE[session_name()] != session_id()))
 			setcookie(session_name(), session_id(), time() + $cookie_length, $cookie_url[1], '', 0);
 
 		$_SESSION['login_' . $cookiename] = $data;
@@ -195,7 +195,7 @@
 		if (headers_sent())
 			return false;
 
-		session_id(strtolower(md5(uniqid(rand(), true))));
+		session_id(strtolower(md5(uniqid(mt_rand(), true))));
 		return true;
 	}
 }
@@ -616,7 +616,8 @@
 	}
 
 	// Generate a random password.
-	$newPassword = substr(preg_replace('/\W/', '', md5(rand())), 0, 10);
+	require_once($sourcedir . '/Subs-Members.php');
+	$newPassword = generateValidationCode();
 	$newPassword_sha1 = sha1(strtolower($user) . $newPassword);
 
 	// Do some checks on the username if needed.
Index: smf/Sources/Subs-Compat.php
===================================================================
--- smf/Sources/Subs-Compat.php	(revision 1047)
+++ smf/Sources/Subs-Compat.php	(working copy)
@@ -5,7 +5,7 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.6                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
 * Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
@@ -171,24 +171,5 @@
 	}
 }
 
-// Make sure random means random.
-if (@version_compare(PHP_VERSION, '4.2.0') == -1)
-{
-	function smf_seed_generator()
-	{
-		global $modSettings;
 
-		if (empty($modSettings['rand_seed']))
-		{
-			$modSettings['rand_seed'] = microtime() * 1000000;
-			updateSettings(array('rand_seed' => $modSettings['rand_seed']));
-		}
-		$seed = ($modSettings['rand_seed'] + ((double) microtime() * 1000003)) & 0x7fffffff;
-		srand($seed);
-		// Change the seed?
-		if (rand(1, 250) == 69)
-			updateSettings(array('rand_seed' => rand()));
-	}
-}
-
 ?>
\ No newline at end of file
Index: smf/Sources/Subs-Graphics.php
===================================================================
--- smf/Sources/Subs-Graphics.php	(revision 1047)
+++ smf/Sources/Subs-Graphics.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.9                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -127,10 +127,13 @@
 
 	require_once($sourcedir . '/ManageAttachments.php');
 	removeAttachments('a.ID_MEMBER = ' . $memID);
+
+	$avatar_hash = empty($modSettings['custom_avatar_enabled']) ? getAttachmentFilename($destName, false, true) : '';
+
 	db_query("
 		INSERT INTO {$db_prefix}attachments
-			(ID_MEMBER, attachmentType, filename, size)
-		VALUES ($memID, " . (empty($modSettings['custom_avatar_enabled']) ? '0' : '1') . ", '$destName', 1)", __FILE__, __LINE__);
+			(ID_MEMBER, attachmentType, filename, file_hash, size)
+		VALUES ($memID, " . (empty($modSettings['custom_avatar_enabled']) ? '0' : '1') . ", '$destName', '" . (empty($avatar_hash) ? "" : "$avatar_hash") . "', 1)", __FILE__, __LINE__);
 	$attachID = db_insert_id();
 
 	$destName = (empty($modSettings['custom_avatar_enabled']) ? $modSettings['attachmentUploadDir'] : $modSettings['custom_avatar_dir']) . '/' . $destName . '.tmp';
@@ -143,14 +146,38 @@
 	$fp = fopen($destName, 'wb');
 	if ($fp && substr($url, 0, 7) == 'http://')
 	{
-		fwrite($fp, fetch_web_data($url));
+		$fileContents = fetch_web_data($url);
+
+		// Though not an exhaustive list, better safe than sorry.
+		if (preg_match('~(iframe|\\<\\?php|\\<\\?[\s=]|\\<%[\s=]|html|eval|body|script\W)~', $fileContents) === 1)
+		{
+			fclose($fp);
+			return false;
+		}
+
+		fwrite($fp, $fileContents);
 		fclose($fp);
 	}
 	elseif ($fp)
 	{
 		$fp2 = fopen($url, 'rb');
+		$prev_chunk = '';
 		while (!feof($fp2))
-			fwrite($fp, fread($fp2, 8192));
+		{
+			$cur_chunk = fread($fp2, 8192);
+
+			// Make sure nothing odd came through.
+			if (preg_match('~(iframe|\\<\\?php|\\<\\?[\s=]|\\<%[\s=]|html|eval|body|script\W)~', $prev_chunk . $cur_chunk) === 1)
+			{
+				fclose($fp2);
+				fclose($fp);
+				unlink($destName);
+				return false;
+			}
+
+			fwrite($fp, $cur_chunk);
+			$prev_chunk = $cur_chunk;
+		}
 		fclose($fp2);
 		fclose($fp);
 	}
@@ -183,8 +210,9 @@
 	if ($success)
 	{
 		// Remove the .tmp extension from the attachment.
-		if (rename($destName . '.tmp', $destName))
+		if (rename($destName . '.tmp', empty($avatar_hash) ? $destName : $modSettings['attachmentUploadDir'] . '/' . $attachID . '_' . $avatar_hash))
 		{
+			$destName = empty($avatar_hash) ? $destName : $modSettings['attachmentUploadDir'] . '/' . $attachID . '_' . $avatar_hash;
 			list ($width, $height) = getimagesize($destName);
 
 			// Write filesize in the database.
@@ -1406,7 +1434,7 @@
 	}
 
 	// Create an image.
-	$code_image = imagecreate($total_width, $max_height);
+	$code_image = $gd2 ? imagecreatetruecolor($total_width, $max_height) : imagecreate($total_width, $max_height);
 
 	// Draw the background.
 	$bg_color = imagecolorallocate($code_image, $background_color[0], $background_color[1], $background_color[2]);
@@ -1414,12 +1442,12 @@
 
 	// Randomize the foreground color a little.
 	for ($i = 0; $i < 3; $i++)
-		$foreground_color[$i] = rand(max($foreground_color[$i] - 3, 0), min($foreground_color[$i] + 3, 255));
+		$foreground_color[$i] = mt_rand(max($foreground_color[$i] - 3, 0), min($foreground_color[$i] + 3, 255));
 	$fg_color = imagecolorallocate($code_image, $foreground_color[0], $foreground_color[1], $foreground_color[2]);
 
 	// Color for the dots.
 	for ($i = 0; $i < 3; $i++)
-		$dotbgcolor[$i] = $background_color[$i] < $foreground_color[$i] ? rand(0, max($foreground_color[$i] - 20, 0)) : rand(min($foreground_color[$i] + 20, 255), 255);
+		$dotbgcolor[$i] = $background_color[$i] < $foreground_color[$i] ? mt_rand(0, max($foreground_color[$i] - 20, 0)) : mt_rand(min($foreground_color[$i] + 20, 255), 255);
 	$randomness_color = imagecolorallocate($code_image, $dotbgcolor[0], $dotbgcolor[1], $dotbgcolor[2]);
 
 	// Fill in the characters.
@@ -1435,7 +1463,7 @@
 			if ($rotationType == 'none')
 				$angle = 0;
 			else
-				$angle = rand(-100, 100) / ($rotationType == 'high' ? 6 : 10);
+				$angle = mt_rand(-100, 100) / ($rotationType == 'high' ? 6 : 10);
 
 			// What colour shall we do it?
 			if ($fontColorType == 'cyclic')
@@ -1453,12 +1481,12 @@
 					$last_index = -1;
 				$new_index = $last_index;
 				while ($last_index == $new_index)
-					$new_index = rand(0, count($colours) - 1);
+					$new_index = mt_rand(0, count($colours) - 1);
 				$char_fg_color = $colours[$new_index];
 				$last_index = $new_index;
 			}
 			elseif ($fontColorType == 'random')
-				$char_fg_color = array(rand(max($foreground_color[0] - 2, 0), $foreground_color[0]), rand(max($foreground_color[1] - 2, 0), $foreground_color[1]), rand(max($foreground_color[2] - 2, 0), $foreground_color[2]));
+				$char_fg_color = array(mt_rand(max($foreground_color[0] - 2, 0), $foreground_color[0]), mt_rand(max($foreground_color[1] - 2, 0), $foreground_color[1]), mt_rand(max($foreground_color[2] - 2, 0), $foreground_color[2]));
 			else
 				$char_fg_color = array($foreground_color[0], $foreground_color[1], $foreground_color[2]);
 
@@ -1466,20 +1494,20 @@
 			{
 				// GD2 handles font size differently.
 				if ($fontSizeRandom)
-					$font_size = $gd2 ? rand(17, 19) : rand(18, 25);
+					$font_size = $gd2 ? mt_rand(17, 19) : mt_rand(18, 25);
 				else
 					$font_size = $gd2 ? 18 : 24;
 	
 				// Work out the sizes - also fix the character width cause TTF not quite so wide!
 				$font_x = $fontHorSpace == 'minus' && $cur_x > 0 ? $cur_x - 3 : $cur_x + 5;
-				$font_y = $max_height - ($fontVerPos == 'vrandom' ? rand(2, 8) : ($fontVerPos == 'random' ? rand(3, 5) : 5));
+				$font_y = $max_height - ($fontVerPos == 'vrandom' ? mt_rand(2, 8) : ($fontVerPos == 'random' ? mt_rand(3, 5) : 5));
 	
 				// What font face?
 				if (!empty($ttfont_list))
-					$fontface = $settings['default_theme_dir'] . '/fonts/' . $ttfont_list[rand(0, count($ttfont_list) - 1)];
+					$fontface = $settings['default_theme_dir'] . '/fonts/' . $ttfont_list[mt_rand(0, count($ttfont_list) - 1)];
 	
 				// What color are we to do it in?
-				$is_reverse = $showReverseChars ? rand(0, 1) : false;
+				$is_reverse = $showReverseChars ? mt_rand(0, 1) : false;
 				$char_color = function_exists('imagecolorallocatealpha') && $fontTrans ? imagecolorallocatealpha($code_image, $char_fg_color[0], $char_fg_color[1], $char_fg_color[2], 50) : imagecolorallocate($code_image, $char_fg_color[0], $char_fg_color[1], $char_fg_color[2]);
 	
 				$fontcord = @imagettftext($code_image, $font_size, $angle, $font_x, $font_y, $char_color, $fontface, $character['id']);
@@ -1505,7 +1533,7 @@
 					$char_bgcolor = imagecolorallocate($char_image, $background_color[0], $background_color[1], $background_color[2]);
 					imagefilledrectangle($char_image, 0, 0, $character['width'] - 1, $character['height'] - 1, $char_bgcolor);
 					imagechar($char_image, $loaded_fonts[$character['font']], 0, 0, $character['id'], imagecolorallocate($char_image, $char_fg_color[0], $char_fg_color[1], $char_fg_color[2]));
-					$rotated_char = imagerotate($char_image, rand(-100, 100) / 10, $char_bgcolor);
+					$rotated_char = imagerotate($char_image, mt_rand(-100, 100) / 10, $char_bgcolor);
 					imagecopy($code_image, $rotated_char, $cur_x, 0, 0, 0, $character['width'], $character['height']);
 					imagedestroy($rotated_char);
 					imagedestroy($char_image);
@@ -1534,9 +1562,9 @@
 	// Add some noise to the background?
 	if ($noiseType != 'none')
 	{
-		for ($i = rand(0, 2); $i < $max_height; $i += rand(1, 2))
-			for ($j = rand(0, 10); $j < $total_width; $j += rand(1, 15))
-				imagesetpixel($code_image, $j, $i, rand(0, 1) ? $fg_color : $randomness_color);
+		for ($i = mt_rand(0, 2); $i < $max_height; $i += mt_rand(1, 2))
+			for ($j = mt_rand(0, 10); $j < $total_width; $j += mt_rand(1, 15))
+				imagesetpixel($code_image, $j, $i, mt_rand(0, 1) ? $fg_color : $randomness_color);
 
 		// Put in some lines too?
 		if ($noiseType == 'high')
@@ -1544,20 +1572,20 @@
 			$num_lines = 2;
 			for ($i = 0; $i < $num_lines; $i++)
 			{
-				if (rand(0, 1))
+				if (mt_rand(0, 1))
 				{
-					$x1 = rand(0, $total_width);
-					$x2 = rand(0, $total_width);
+					$x1 = mt_rand(0, $total_width);
+					$x2 = mt_rand(0, $total_width);
 					$y1 = 0; $y2 = $max_height;
 				}
 				else
 				{
-					$y1 = rand(0, $max_height);
-					$y2 = rand(0, $max_height);
+					$y1 = mt_rand(0, $max_height);
+					$y2 = mt_rand(0, $max_height);
 					$x1 = 0; $x2 = $total_width;
 				}
 		
-				imageline($code_image, $x1, $y1, $x2, $y2, rand (0, 1) ? $fg_color : $randomness_color);
+				imageline($code_image, $x1, $y1, $x2, $y2, mt_rand(0, 1) ? $fg_color : $randomness_color);
 			}
 		}
 	}
Index: smf/Sources/Subs-Members.php
===================================================================
--- smf/Sources/Subs-Members.php	(revision 1047)
+++ smf/Sources/Subs-Members.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.9                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -644,13 +644,13 @@
 	// Generate a validation code if it's supposed to be emailed.
 	$validation_code = '';
 	if ($regOptions['require'] == 'activation')
-		$validation_code = substr(preg_replace('/\W/', '', md5(rand())), 0, 10);
+		$validation_code = generateValidationCode();
 
 	// If you haven't put in a password generated one.
 	if ($regOptions['interface'] == 'admin' && $regOptions['password'] == '')
 	{
-		srand(time() + 1277);
-		$regOptions['password'] = substr(preg_replace('/\W/', '', md5(rand())), 0, 10);
+		mt_srand(time() + 1277);
+		$regOptions['password'] = generateValidationCode();
 		$regOptions['password_check'] = $regOptions['password'];
 	}
 	// Does the first password match the second?
@@ -687,12 +687,35 @@
 		fatal_error(sprintf($txt[730], htmlspecialchars($regOptions['email'])), false);
 	mysql_free_result($request);
 
+	$reservedVars = array(
+		'actual_theme_url',
+		'actual_images_url',
+		'base_theme_dir',
+		'base_theme_url',
+		'default_images_url',
+		'default_theme_dir',
+		'default_theme_url',
+		'default_template',
+		'images_url',
+		'number_recent_posts',
+		'smiley_sets_default',
+		'theme_dir',
+		'theme_id',
+		'theme_layers',
+		'theme_templates',
+		'theme_url',
+	);
+
+	// Can't change reserved vars.
+	if (isset($regOptions['theme_vars']) && array_intersect(array_keys($regOptions['theme_vars']), $reservedVars) != array())
+		fatal_lang_error('theme3');
+
 	// Some of these might be overwritten. (the lower ones that are in the arrays below.)
 	$regOptions['register_vars'] = array(
 		'memberName' => "'$regOptions[username]'",
 		'emailAddress' => "'$regOptions[email]'",
 		'passwd' => '\'' . sha1(strtolower($regOptions['username']) . $regOptions['password']) . '\'',
-		'passwordSalt' => '\'' . substr(md5(rand()), 0, 4) . '\'',
+		'passwordSalt' => '\'' . substr(md5(mt_rand()), 0, 4) . '\'',
 		'posts' => 0,
 		'dateRegistered' => time(),
 		'memberIP' => "'$user_info[ip]'",
@@ -1094,5 +1117,18 @@
 	// Redirect back to the profile
 	redirectexit('action=profile;u=' . $_REQUEST['u']);
 }
+// Generate a random validation code.
+function generateValidationCode()
+{
+	global $modSettings;
+	
+	$request = db_query('
+		SELECT RAND()', __FILE__, __LINE__);
+	
+	list ($dbRand) = mysql_fetch_row($request);
+	mysql_free_result($request);
+	
+	return substr(preg_replace('/\W/', '', sha1(microtime() . mt_rand() . $dbRand . $modSettings['rand_seed'])), 0, 10);	
+}
 
 ?>
\ No newline at end of file
Index: smf/Sources/Subs-Post.php
===================================================================
--- smf/Sources/Subs-Post.php	(revision 1047)
+++ smf/Sources/Subs-Post.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.9                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -230,7 +230,7 @@
 				$parts[$i] = $parts[$i] . str_repeat('[/list]', $list_open - $list_close);
 
 			// Make sure all tags are lowercase.
-			$parts[$i] = preg_replace('~\[([/]?)(list|li|table|tr|td)([^\]]*)\]~ie', '\'[$1\' . strtolower(\'$2\') . \'$3]\'', $parts[$i]);
+			$parts[$i] = preg_replace('~\[([/]?)(list|li|table|tr|td)((\s[^\]]+)*)\]~ie', '\'[$1\' . strtolower(\'$2\') . \'$3]\'', $parts[$i]);
 
 			$mistake_fixes = array(
 				// Find [table]s not followed by [tr].
@@ -306,8 +306,8 @@
 		}
 	}
 
-	// Change breaks back to \n's.
-	return preg_replace('~<br( /)?' . '>~', "\n", implode('', $parts));
+	// Change breaks back to \n's and &nsbp; back to spaces.
+	return preg_replace('~<br( /)?' . '>~', "\n", str_replace('&nbsp;', ' ', implode('', $parts)));
 }
 
 // Fix any URLs posted - ie. remove 'javascript:'.
@@ -461,7 +461,7 @@
 	$replaces = array();
 
 	if ($hasEqualSign)
-		preg_match_all('~\[(' . $myTag . ')=([^\]]*?)\](.+?)\[/(' . $myTag . ')\]~is', $message, $matches);
+		preg_match_all('~\[(' . $myTag . ')=([^\]]*?)\](?:(.+?)\[/(' . $myTag . ')\])?~is', $message, $matches);
 	else
 		preg_match_all('~\[(' . $myTag . ($hasExtra ? '(?:[^\]]*?)' : '') . ')\](.+?)\[/(' . $myTag . ')\]~is', $message, $matches);
 
@@ -470,10 +470,7 @@
 		// Remove all leading and trailing whitespace.
 		$replace = trim($matches[2][$k]);
 		$this_tag = $matches[1][$k];
-		if (!$hasEqualSign)
-			$this_close = $matches[3][$k];
-		else
-			$this_close = $matches[4][$k];
+		$this_close = $hasEqualSign ? (empty($matches[4][$k]) ? '' : $matches[4][$k]) : $matches[3][$k];
 
 		$found = false;
 		foreach ($protocols as $protocol)
@@ -502,7 +499,7 @@
 			$replace = $protocols[0] . '://' . $replace;
 
 		if ($hasEqualSign && $embeddedUrl)
-			$replaces['[' . $matches[1][$k] . '=' . $matches[2][$k] . ']' . $matches[3][$k] . '[/' . $matches[4][$k] . ']'] = '[' . $this_tag . '=' . $replace . ']' . $matches[3][$k] . '[/' . $this_close . ']';
+			$replaces[$matches[0][$k]] = '[' . $this_tag . '=' . $replace . ']' . (empty($matches[4][$k]) ? '' : $matches[3][$k] . '[/' . $this_close . ']');
 		elseif ($hasEqualSign)
 			$replaces['[' . $matches[1][$k] . '=' . $matches[2][$k] . ']'] = '[' . $this_tag . '=' . $replace . ']';
 		elseif ($embeddedUrl)
@@ -1708,9 +1705,9 @@
 	if (!$file_restricted || $already_uploaded)
 		list ($attachmentOptions['width'], $attachmentOptions['height']) = @getimagesize($attachmentOptions['tmp_name']);
 
-	// Remove special foreign characters from the filename.
-	if (empty($modSettings['attachmentEncryptFilenames']))
-		$attachmentOptions['name'] = getAttachmentFilename($attachmentOptions['name'], false, true);
+	// Get the hash if no hash has been given yet.
+	if (empty($attachmentOptions['file_hash']))
+		$attachmentOptions['file_hash'] = getAttachmentFilename($attachmentOptions['name'], false, true);
 
 	// Is the file too big?
 	if (!empty($modSettings['attachmentSizeLimit']) && $attachmentOptions['size'] > $modSettings['attachmentSizeLimit'] * 1024)
@@ -1780,14 +1777,14 @@
 
 	db_query("
 		INSERT INTO {$db_prefix}attachments
-			(ID_MSG, filename, size, width, height)
-		VALUES (" . (int) $attachmentOptions['post'] . ", SUBSTRING('" . $attachmentOptions['name'] . "', 1, 255), " . (int) $attachmentOptions['size'] . ', ' . (empty($attachmentOptions['width']) ? '0' : (int) $attachmentOptions['width']) . ', ' . (empty($attachmentOptions['height']) ? '0' : (int) $attachmentOptions['height']) . ')', __FILE__, __LINE__);
+			(ID_MSG, filename, file_hash, size, width, height)
+		VALUES (" . (int) $attachmentOptions['post'] . ", SUBSTRING('" . $attachmentOptions['name'] . "', 1, 255), '$attachmentOptions[file_hash]', " . (int) $attachmentOptions['size'] . ', ' . (empty($attachmentOptions['width']) ? '0' : (int) $attachmentOptions['width']) . ', ' . (empty($attachmentOptions['height']) ? '0' : (int) $attachmentOptions['height']) . ')', __FILE__, __LINE__);
 	$attachmentOptions['id'] = db_insert_id();
 
 	if (empty($attachmentOptions['id']))
 		return false;
 
-	$attachmentOptions['destination'] = $modSettings['attachmentUploadDir'] . '/' . getAttachmentFilename(basename($attachmentOptions['name']), $attachmentOptions['id'], true);
+	$attachmentOptions['destination'] = getAttachmentFilename(basename($attachmentOptions['name']), $attachmentOptions['id'], false, $attachmentOptions['file_hash']);
 
 	if ($already_uploaded)
 		rename($attachmentOptions['tmp_name'], $attachmentOptions['destination']);
@@ -1826,10 +1823,11 @@
 			$thumb_size = filesize($attachmentOptions['destination'] . '_thumb');
 
 			// To the database we go!
+			$thumb_file_hash = getAttachmentFilename($thumb_filename, false, true);
 			db_query("
 				INSERT INTO {$db_prefix}attachments
-					(ID_MSG, attachmentType, filename, size, width, height)
-				VALUES (" . (int) $attachmentOptions['post'] . ", 3, SUBSTRING('$thumb_filename', 1, 255), " . (int) $thumb_size . ", " . (int) $thumb_width . ", " . (int) $thumb_height . ")", __FILE__, __LINE__);
+					(ID_MSG, attachmentType, filename, file_hash, size, width, height)
+				VALUES (" . (int) $attachmentOptions['post'] . ", 3, SUBSTRING('$thumb_filename', 1, 255), '$thumb_file_hash', " . (int) $thumb_size . ", " . (int) $thumb_width . ", " . (int) $thumb_height . ")", __FILE__, __LINE__);
 			$attachmentOptions['thumb'] = db_insert_id();
 
 			if (!empty($attachmentOptions['thumb']))
@@ -1840,7 +1838,7 @@
 					WHERE ID_ATTACH = $attachmentOptions[id]
 					LIMIT 1", __FILE__, __LINE__);
 
-				rename($attachmentOptions['destination'] . '_thumb', $modSettings['attachmentUploadDir'] . '/' . getAttachmentFilename($thumb_filename, $attachmentOptions['thumb'], true));
+				rename($attachmentOptions['destination'] . '_thumb', getAttachmentFilename($thumb_filename, $attachmentOptions['thumb'], false, $thumb_file_hash));
 			}
 		}
 	}
Index: smf/Sources/Subs-Sound.php
===================================================================
--- smf/Sources/Subs-Sound.php	(revision 1047)
+++ smf/Sources/Subs-Sound.php	(working copy)
@@ -5,7 +5,7 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.6                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
 * Copyright 2006 by:          Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
@@ -48,7 +48,7 @@
 		cache_put_data('wave_file/' . $user_info['ip2'], $ip2 ? $ip2 + 1 : 1, 20);
 
 	// Fixate randomization for this word.
-	srand(end(unpack('n', md5($word . session_id()))));
+	mt_srand(end(unpack('n', md5($word . session_id()))));
 
 	// Try to see if there's a sound font in the user's language.
 	if (file_exists($settings['default_theme_dir'] . '/fonts/sound/a.' . $user_info['language'] . '.wav'))
@@ -74,17 +74,17 @@
 			return false;
 
 		$sound_letter = substr($sound_letter, strpos($sound_letter, 'data') + 8);
-		switch ($word{$i} === 's' ? 0 : rand(0, 2))
+		switch ($word{$i} === 's' ? 0 : mt_rand(0, 2))
 		{
 			case 0:
 				for ($j = 0, $n = strlen($sound_letter); $j < $n; $j++)
-					for ($k = 0, $m = round(rand(15, 25) / 10); $k < $m; $k++)
-						$sound_word .= $word{$i} === 's' ? $sound_letter{$j} : chr(rand(max(ord($sound_letter{$j}) - 1, 0x00), min(ord($sound_letter{$j}) + 1, 0xFF)));
+					for ($k = 0, $m = round(mt_rand(15, 25) / 10); $k < $m; $k++)
+						$sound_word .= $word{$i} === 's' ? $sound_letter{$j} : chr(mt_rand(max(ord($sound_letter{$j}) - 1, 0x00), min(ord($sound_letter{$j}) + 1, 0xFF)));
 			break;
 
 			case 1:
 				for ($j = 0, $n = strlen($sound_letter) - 1; $j < $n; $j += 2)
-					$sound_word .= (rand(0, 3) == 0 ? '' : $sound_letter{$j}) . (rand(0, 3) === 0 ? $sound_letter{$j + 1} : $sound_letter{$j}) . (rand(0, 3) === 0 ? $sound_letter{$j} : $sound_letter{$j + 1})  . $sound_letter{$j + 1} . (rand(0, 3) == 0 ? $sound_letter{$j + 1} : '');
+					$sound_word .= (mt_rand(0, 3) == 0 ? '' : $sound_letter{$j}) . (mt_rand(0, 3) === 0 ? $sound_letter{$j + 1} : $sound_letter{$j}) . (mt_rand(0, 3) === 0 ? $sound_letter{$j} : $sound_letter{$j + 1})  . $sound_letter{$j + 1} . (mt_rand(0, 3) == 0 ? $sound_letter{$j + 1} : '');
 				$sound_word .= str_repeat($sound_letter{$n}, 2);
 			break;
 
@@ -92,16 +92,16 @@
 				$shift = 0;
 				for ($j = 0, $n = strlen($sound_letter); $j < $n; $j++)
 				{
-					if (rand(0, 10) === 0)
-						$shift += rand(-3, 3);
-					for ($k = 0, $m = round(rand(15, 25) / 10); $k < $m; $k++)
+					if (mt_rand(0, 10) === 0)
+						$shift += mt_rand(-3, 3);
+					for ($k = 0, $m = round(mt_rand(15, 25) / 10); $k < $m; $k++)
 						$sound_word .= chr(min(max(ord($sound_letter{$j}) + $shift, 0x00), 0xFF));
 				}
 			break;
 
 		}
 
-		$sound_word .= str_repeat(chr(0x80), rand(10000, 10500));
+		$sound_word .= str_repeat(chr(0x80), mt_rand(10000, 10500));
 	}
 
 	$data_size = strlen($sound_word);
Index: smf/Sources/Subs.php
===================================================================
--- smf/Sources/Subs.php	(revision 1047)
+++ smf/Sources/Subs.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.9                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -3040,7 +3040,7 @@
 		// Gotta be special for the javascript.
 		$context['fader_news_lines'][$i] = strtr(addslashes($context['news_lines'][$i]), array('/' => '\/', '<a href=' => '<a hre" + "f='));
 	}
-	$context['random_news_line'] = $context['news_lines'][rand(0, count($context['news_lines']) - 1)];
+	$context['random_news_line'] = $context['news_lines'][mt_rand(0, count($context['news_lines']) - 1)];
 
 	if (!$user_info['is_guest'])
 	{
@@ -3280,7 +3280,7 @@
 		return $found;
 
 	// Naughty, naughty.
-	if (rand(0, 2) == 1)
+	if (mt_rand(0, 2) == 1)
 	{
 		$temporary = preg_replace('~<!--.+?-->~s', '', ob_get_contents());
 		if (strpos($temporary, '<!--') !== false)
@@ -3306,7 +3306,7 @@
 	{
 		$found = true;
 		echo '
-			<div style="white-space: normal;">The administrator doesn\'t want a copyright notice saying this is copyright 2006 - 2007 by <a href="http://www.simplemachines.org/about/copyright.php" target="_blank">Simple Machines LLC</a>, and named <a href="http://www.simplemachines.org/">SMF</a>, so the forum will honor this request and be quiet.</div>';
+			<div style="white-space: normal;">The administrator doesn\'t want a copyright notice saying this is copyright 2006 - 2009 by <a href="http://www.simplemachines.org/about/copyright.php" target="_blank">Simple Machines LLC</a>, and named <a href="http://www.simplemachines.org/">SMF</a>, so the forum will honor this request and be quiet.</div>';
 	}
 	// If it's in the copyright, and we are outputting it... it's been found.
 	elseif (isset($modSettings['copyright_key']) && sha1($modSettings['copyright_key'] . 'banjo') == '1d01885ece7a9355bdeb22ed107f0ffa8c323026'){$found = true; return;}elseif ((strpos($forum_copyright, '<a href="http://www.simplemachines.org/" title="Simple Machines Forum" target="_blank">Powered by SMF') !== false || strpos($forum_copyright, '<a href="http://www.simplemachines.org/" onclick="this.href += \'referer.php?forum=' . urlencode($context['forum_name'] . '|' . $boardurl . '|' . $forum_version) . '\';" target="_blank">SMF') !== false || strpos($forum_copyright, '<a href="http://www.simplemachines.org/" target="_blank">SMF') !== false || strpos($forum_copyright, '<a href="http://www.simplemachines.org/" title="Simple Machines Forum" target="_blank">SMF') !== false)&&((strpos($forum_copyright, '<a href="http://www.simplemachines.org/about/copyright.php" title="Free Forum Software" target="_blank">SMF &copy;') !== false && (strpos($forum_copyright, 'Lewis Media</a>') !== false || strpos($forum_copyright, 'Simple Machines LLC</a>') !== false)) || strpos($forum_copyright, '<a href="http://www.lewismedia.com/">Lewis Media</a>') !== false || strpos($forum_copyright, '<a href="http://www.lewismedia.com/" target="_blank">Lewis Media</a>') !== false || (strpos($forum_copyright, '<a href="http://www.simplemachines.org/about/copyright.php"') !== false &&	strpos($forum_copyright, 'Simple Machines LLC') !== false))){$found = true; echo $forum_copyright;}
@@ -3440,8 +3440,39 @@
 }
 
 // Get an attachment's encrypted filename.  If $new is true, won't check for file existence.
-function getAttachmentFilename($filename, $attachment_id, $new = false)
+function getAttachmentFilename($filename, $attachment_id, $new = false, $file_hash = '')
 {
+	global $modSettings, $db_prefix;
+
+	// Just make up a nice hash...
+	if ($new)
+		return sha1(md5($filename . time()) . mt_rand());
+
+	// Grab the file hash if it wasn't added.
+	if ($file_hash === '')
+	{
+		$request = db_query("
+			SELECT file_hash
+			FROM {$db_prefix}attachments
+			WHERE ID_ATTACH = " . (int) $attachment_id, __FILE__, __LINE__);
+
+		if (mysql_num_rows($request) === 0)
+			return false;
+
+		list ($file_hash) = mysql_fetch_row($request);
+
+		mysql_free_result($request);
+	}
+
+	// In case of files from the old system, do a legacy call.
+	if (empty($file_hash))
+		return getLegacyAttachmentFilename($filename, $attachment_id, $new);
+
+	return $modSettings['attachmentUploadDir'] . '/' . $attachment_id . '_' . $file_hash;
+}
+
+function getLegacyAttachmentFilename($filename, $attachment_id, $new = false)
+{
 	global $modSettings;
 
 	// Remove special accented characters - ie. sí.
@@ -3481,7 +3512,7 @@
 		$host = false;
 
 	// Try the Linux host command, perhaps?
-	if (!isset($host) && (strpos(strtolower(PHP_OS), 'win') === false || strpos(strtolower(PHP_OS), 'darwin') !== false) && rand(0, 1) == 1)
+	if (!isset($host) && (strpos(strtolower(PHP_OS), 'win') === false || strpos(strtolower(PHP_OS), 'darwin') !== false) && mt_rand(0, 1) == 1)
 	{
 		if (!isset($modSettings['host_to_dis']))
 			$test = @shell_exec('host -W 1 ' . @escapeshellarg($ip));
@@ -3500,7 +3531,7 @@
 	}
 
 	// This is nslookup; usually only Windows, but possibly some Unix?
-	if (!isset($host) && strpos(strtolower(PHP_OS), 'win') !== false && strpos(strtolower(PHP_OS), 'darwin') === false && rand(0, 1) == 1)
+	if (!isset($host) && strpos(strtolower(PHP_OS), 'win') !== false && strpos(strtolower(PHP_OS), 'darwin') === false && mt_rand(0, 1) == 1)
 	{
 		$test = @shell_exec('nslookup -timeout=1 ' . @escapeshellarg($ip));
 		if (strpos($test, 'Non-existent domain') !== false)
@@ -3576,5 +3607,26 @@
 	else
 		return '<img src="' . $settings['images_url'] . '/' . $context['user']['language'] . '/' . $name . '" alt="' . $txt[$alt] . '" ' . $custom . ' />';
 }
+// Generate a random seed and ensure it's stored in settings.
+function smf_seed_generator()
+{
+	global $modSettings;
 
+	// Never existed?
+	if (empty($modSettings['rand_seed']))
+	{
+		$modSettings['rand_seed'] = microtime() * 1000000;
+		updateSettings(array('rand_seed' => $modSettings['rand_seed']));
+	}
+
+	if (@version_compare(PHP_VERSION, '4.2.0') == -1)
+	{
+		$seed = ($modSettings['rand_seed'] + ((double) microtime() * 1000003)) & 0x7fffffff;
+		mt_srand($seed);
+	}
+
+	// Change the seed.
+	updateSettings(array('rand_seed' => mt_rand()));
+}
+
 ?>
Index: smf/Sources/Themes.php
===================================================================
--- smf/Sources/Themes.php	(revision 1047)
+++ smf/Sources/Themes.php	(working copy)
@@ -5,7 +5,7 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.2                                           *
+* Software Version:           SMF 1.1.7                                           *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
 * Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
@@ -1197,6 +1197,29 @@
 	if (empty($_GET['var']) || !isset($_GET['val']))
 		redirectexit($settings['images_url'] . '/blank.gif');
 
+	$reservedVars = array(
+		'actual_theme_url',
+		'actual_images_url',
+		'base_theme_dir',
+		'base_theme_url',
+		'default_images_url',
+		'default_theme_dir',
+		'default_theme_url',
+		'default_template',
+		'images_url',
+		'number_recent_posts',
+		'smiley_sets_default',
+		'theme_dir',
+		'theme_id',
+		'theme_layers',
+		'theme_templates',
+		'theme_url',
+	);
+
+	// Can't change reserved vars.
+	if (in_array(strtolower($_GET['var']), $reservedVars))
+		redirectexit($settings['images_url'] . '/blank.gif');
+
 	// Use a specific theme?
 	if (isset($_GET['th']) || isset($_GET['id']))
 		$settings['theme_id'] = isset($_GET['th']) ? (int) $_GET['th'] : (int) $_GET['id'];
Index: smf/Themes/default/ManageAttachments.template.php
===================================================================
--- smf/Themes/default/ManageAttachments.template.php	(revision 1047)
+++ smf/Themes/default/ManageAttachments.template.php	(working copy)
@@ -1,5 +1,5 @@
 <?php
-// Version: 1.1; ManageAttachments
+// Version: 1.1.9; ManageAttachments
 
 function template_manage_files_above()
 {
@@ -127,9 +127,6 @@
 			<td width="50%" align="right"><label for="attachmentExtensions">', $txt['attachmentExtensions'], '</label>:</td>
 			<td><input type="text" name="attachmentExtensions" id="attachmentExtensions" value="', $modSettings['attachmentExtensions'], '" size="40" /></td>
 		</tr><tr class="windowbg2">
-			<td width="50%" align="right"><label for="attachmentEncryptFilenames">', $txt['attachmentEncryptFilenames'], ' <a href="', $scripturl, '?action=helpadmin;help=attachmentEncryptFilenames" onclick="return reqWin(this.href);" class="help">(?)</a>:</label></td>
-			<td><input type="checkbox" name="attachmentEncryptFilenames" id="attachmentEncryptFilenames" value="1" class="check"', empty($modSettings['attachmentEncryptFilenames']) ? '' : ' checked="checked"', ' /></td>
-		</tr><tr class="windowbg2">
 			<td colspan="2"><hr /></td>
 		</tr><tr class="windowbg2">
 			<td width="50%" align="right"><label for="attachmentUploadDir"', $context['valid_upload_dir'] ? '' : ' style="color: red; font-weight: bold;"', '>', $txt['attachmentUploadDir'], '</label>:</td>
Index: smf/Themes/default/Packages.template.php
===================================================================
--- smf/Themes/default/Packages.template.php	(revision 1047)
+++ smf/Themes/default/Packages.template.php	(working copy)
@@ -1,5 +1,5 @@
 <?php
-// Version: 1.1; Packages
+// Version: 1.1.8; Packages
 
 function template_main()
 {
@@ -160,6 +160,7 @@
 	}
 		echo '
 			</table>
+			<input type="hidden" name="sc" value="', $context['session_id'], '" />
 		</form>';
 }
 
@@ -255,7 +256,7 @@
 
 	foreach ($context['files'] as $fileinfo)
 		echo '
-						<li><a href="', $scripturl, '?action=packages;sa=examine;package=', $context['filename'], ';file=', $fileinfo['filename'], '" title="', $txt[305], '">', $fileinfo['filename'], '</a> (', $fileinfo['size'], ' ', $txt['package_bytes'], ')</li>';
+						<li><a href="', $scripturl, '?action=packages;sa=examine;package=', $context['filename'], ';file=', $fileinfo['filename'], ';sesc=', $context['session_id'], '" title="', $txt[305], '">', $fileinfo['filename'], '</a> (', $fileinfo['size'], ' ', $txt['package_bytes'], ')</li>';
 
 	echo '
 					</ol>
@@ -323,13 +324,13 @@
 							<td>', ++$i, '.</td>
 							<td>', $file['name'], '</td>
 							<td>', $file['version'], '</td>
-							<td align="right"><a href="', $scripturl, '?action=packages;sa=uninstall;package=', $file['filename'], '">[ ', $txt['smf198b'], ' ]</a></td>
+							<td align="right"><a href="', $scripturl, '?action=packages;sa=uninstall;package=', $file['filename'], ';sesc=', $context['session_id'], '">[ ', $txt['smf198b'], ' ]</a></td>
 						</tr>';
 
 		echo '
 					</table>
 					<br />
-					<a href="', $scripturl, '?action=packages;sa=flush">[ ', $txt['smf198d'], ' ]</a>';
+					<a href="', $scripturl, '?action=packages;sa=flush;sesc=', $context['session_id'], '">[ ', $txt['smf198d'], ' ]</a>';
 	}
 
 	echo '
@@ -434,17 +435,17 @@
 
 		if ($package['can_uninstall'])
 			echo '
-								<a href="', $scripturl, '?action=packages;sa=uninstall;package=', $package['filename'], '">[ ', $txt['smf198b'], ' ]</a>';
+								<a href="', $scripturl, '?action=packages;sa=uninstall;package=', $package['filename'], ';sesc=', $context['session_id'], '">[ ', $txt['smf198b'], ' ]</a>';
 		elseif ($package['can_upgrade'])
 			echo '
-								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], '">[ ', $txt['package_upgrade'], ' ]</a>';
+								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], ';sesc=', $context['session_id'], '">[ ', $txt['package_upgrade'], ' ]</a>';
 		elseif ($package['can_install'])
 			echo '
-								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], '">[ ', $txt['package11'], ' ]</a>';
+								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], ';sesc=', $context['session_id'], '">[ ', $txt['package11'], ' ]</a>';
 
 		echo '
 								<a href="', $scripturl, '?action=packages;sa=list;package=', $package['filename'], '">[ ', $txt['package14'], ' ]</a>
-								<a href="', $scripturl, '?action=packages;sa=remove;package=', $package['filename'], '"', $package['is_installed'] && $package['is_current'] ? ' onclick="return confirm(\'' . $txt['package_delete_bad'] . '\');"' : '', '>[ ', $txt['package52'], ' ]</a>
+								<a href="', $scripturl, '?action=packages;sa=remove;package=', $package['filename'], ';sesc=', $context['session_id'], '"', $package['is_installed'] && $package['is_current'] ? ' onclick="return confirm(\'' . $txt['package_delete_bad'] . '\');"' : '', '>[ ', $txt['package52'], ' ]</a>
 							</td>
 						</tr>';
 		}
@@ -488,17 +489,17 @@
 
 		if ($package['can_uninstall'])
 			echo '
-								<a href="', $scripturl, '?action=packages;sa=uninstall;package=', $package['filename'], '">[ ', $txt['smf198b'], ' ]</a>';
+								<a href="', $scripturl, '?action=packages;sa=uninstall;package=', $package['filename'], ';sesc=', $context['session_id'], '">[ ', $txt['smf198b'], ' ]</a>';
 		elseif ($package['can_upgrade'])
 			echo '
-								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], '">[ ', $txt['package_upgrade'], ' ]</a>';
+								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], ';sesc=', $context['session_id'], '">[ ', $txt['package_upgrade'], ' ]</a>';
 		elseif ($package['can_install'])
 			echo '
-								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], '">[ ', $txt['package11'], ' ]</a>';
+								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], ';sesc=', $context['session_id'], '">[ ', $txt['package11'], ' ]</a>';
 
 		echo '
 								<a href="', $scripturl, '?action=packages;sa=list;package=', $package['filename'], '">[ ', $txt['package14'], ' ]</a>
-								<a href="', $scripturl, '?action=packages;sa=remove;package=', $package['filename'], '">[ ', $txt['package52'], ' ]</a>
+								<a href="', $scripturl, '?action=packages;sa=remove;package=', $package['filename'], ';sesc=', $context['session_id'], '">[ ', $txt['package52'], ' ]</a>
 							</td>
 						</tr>';
 		}
@@ -542,17 +543,17 @@
 
 		if ($package['can_uninstall'])
 			echo '
-								<a href="', $scripturl, '?action=packages;sa=uninstall;package=', $package['filename'], '">[ ', $txt['smf198b'], ' ]</a>';
+								<a href="', $scripturl, '?action=packages;sa=uninstall;package=', $package['filename'], ';sesc=', $context['session_id'], '">[ ', $txt['smf198b'], ' ]</a>';
 		elseif ($package['can_upgrade'])
 			echo '
-								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], '">[ ', $txt['package_upgrade'], ' ]</a>';
+								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], ';sesc=', $context['session_id'], '">[ ', $txt['package_upgrade'], ' ]</a>';
 		elseif ($package['can_install'])
 			echo '
-								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], '">[ ', $txt['package11'], ' ]</a>';
+								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], ';sesc=', $context['session_id'], '">[ ', $txt['package11'], ' ]</a>';
 
 		echo '
 								<a href="', $scripturl, '?action=packages;sa=list;package=', $package['filename'], '">[ ', $txt['package14'], ' ]</a>
-								<a href="', $scripturl, '?action=packages;sa=remove;package=', $package['filename'], '">[ ', $txt['package52'], ' ]</a>
+								<a href="', $scripturl, '?action=packages;sa=remove;package=', $package['filename'], ';sesc=', $context['session_id'], '">[ ', $txt['package52'], ' ]</a>
 							</td>
 						</tr>';
 		}
@@ -596,17 +597,17 @@
 
 		if ($package['can_uninstall'])
 			echo '
-								<a href="', $scripturl, '?action=packages;sa=uninstall;package=', $package['filename'], '">[ ', $txt['smf198b'], ' ]</a>';
+								<a href="', $scripturl, '?action=packages;sa=uninstall;package=', $package['filename'], ';sesc=', $context['session_id'], '">[ ', $txt['smf198b'], ' ]</a>';
 		elseif ($package['can_upgrade'])
 			echo '
-								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], '">[ ', $txt['package_upgrade'], ' ]</a>';
+								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], ';sesc=', $context['session_id'], '">[ ', $txt['package_upgrade'], ' ]</a>';
 		elseif ($package['can_install'])
 			echo '
-								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], '">[ ', $txt['package11'], ' ]</a>';
+								<a href="', $scripturl, '?action=packages;sa=install;package=', $package['filename'], ';sesc=', $context['session_id'], '">[ ', $txt['package11'], ' ]</a>';
 
 		echo '
 								<a href="', $scripturl, '?action=packages;sa=list;package=', $package['filename'], '">[ ', $txt['package14'], ' ]</a>
-								<a href="', $scripturl, '?action=packages;sa=remove;package=', $package['filename'], '"', $package['is_installed'] ? ' onclick="return confirm(\'' . $txt['package_delete_bad'] . '\');"' : '', '>[ ', $txt['package52'], ' ]</a>
+								<a href="', $scripturl, '?action=packages;sa=remove;package=', $package['filename'], ';sesc=', $context['session_id'], '"', $package['is_installed'] ? ' onclick="return confirm(\'' . $txt['package_delete_bad'] . '\');"' : '', '>[ ', $txt['package52'], ' ]</a>
 							</td>
 						</tr>';
 		}
@@ -753,6 +754,25 @@
 		</table>';
 }
 
+function template_package_confirm()
+{
+	global $context, $settings, $options, $txt, $scripturl;
+
+	echo '
+		<table border="0" width="100%" cellspacing="1" cellpadding="4" class="bordercolor">
+			<tr class="titlebg">
+				<td>' . $context['page_title'] . '</td>
+			</tr>
+			<tr>
+				<td width="100%" align="left" valign="middle" class="windowbg2">
+					', $context['confirm_message'], '<br />
+					<br />
+					<a href="', $context['proceed_href'], '">[ ', $txt['package_confirm_proceed'], ' ]</a> <a href="JavaScript:history.go(-1);">[ ', $txt['package_confirm_go_back'], ' ]</a>
+				</td>
+			</tr>
+		</table>';	
+}
+	
 function template_package_list()
 {
 	global $context, $settings, $options, $txt, $scripturl, $func;
Index: smf/Themes/default/Recent.template.php
===================================================================
--- smf/Themes/default/Recent.template.php	(revision 1047)
+++ smf/Themes/default/Recent.template.php	(working copy)
@@ -1,5 +1,5 @@
 <?php
-// Version: 1.1.5; Recent
+// Version: 1.1.9; Recent
 
 function template_main()
 {
@@ -15,7 +15,7 @@
 		$button_set = array();
 
 		if ($post['can_delete'])
-			$button_set['delete'] = array('text' => 31, 'image' => 'delete.gif', 'lang' => true, 'custom' => 'onclick="return confirm(\'' . $txt[154] . '?\');"', 'url' => $scripturl . '?action=deletemsg2;msg=' . $post['id'] . ';topic=' . $post['topic'] . ';recent;sesc=' . $context['session_id']);
+			$button_set['delete'] = array('text' => 31, 'image' => 'delete.gif', 'lang' => true, 'custom' => 'onclick="return confirm(\'' . $txt[154] . '?\');"', 'url' => $scripturl . '?action=deletemsg;msg=' . $post['id'] . ';topic=' . $post['topic'] . ';recent;sesc=' . $context['session_id']);
 		if ($post['can_reply'])
 		{
 			$button_set['reply'] = array('text' => 146, 'image' => 'reply_sm.gif', 'lang' => true, 'url' => $scripturl . '?action=post;topic=' . $post['topic'] . '.' . $post['start']);
Index: smf/Themes/default/Register.template.php
===================================================================
--- smf/Themes/default/Register.template.php	(revision 1047)
+++ smf/Themes/default/Register.template.php	(working copy)
@@ -1,5 +1,5 @@
 <?php
-// Version: 1.1.5; Register
+// Version: 1.1.10; Register
 
 // Before registering - get their information.
 function template_before()
@@ -360,7 +360,7 @@
 		<script language="JavaScript" type="text/javascript"><!-- // --><![CDATA[
 			function onCheckChange()
 			{
-				if (document.forms.postForm.emailActivate.checked)
+				if (document.forms.postForm.emailActivate.checked || document.forms.postForm.password.value == \'\')
 				{
 					document.forms.postForm.emailPassword.disabled = true;
 					document.forms.postForm.emailPassword.checked = true;
@@ -405,7 +405,7 @@
 					<div class="smalltext" style="font-weight: normal;">', $txt['admin_register_password_desc'], '</div>
 				</th>
 				<td width="50%" align="left">
-					<input type="password" name="password" id="password_input" size="30" /><br />
+					<input type="password" name="password" id="password_input" size="30" onchange="onCheckChange();" /><br />
 				</td>
 			</tr><tr class="windowbg2">
 				<th width="50%" align="right">
@@ -427,7 +427,7 @@
 					<div class="smalltext" style="font-weight: normal;">', $txt['admin_register_email_detail_desc'], '</div>
 				</th>
 				<td width="50%" align="left">
-					<input type="checkbox" name="emailPassword" id="emailPassword_check" checked="checked"', !empty($modSettings['registration_method']) && $modSettings['registration_method'] == 1 ? ' disabled="disabled"' : '', ' class="check" /><br />
+					<input type="checkbox" name="emailPassword" id="emailPassword_check" checked="checked" disabled="disabled" class="check" /><br />
 				</td>
 			</tr><tr class="windowbg2">
 				<th width="50%" align="right">
Index: smf/attachments/.htaccess
===================================================================
--- smf/attachments/.htaccess	(revision 1047)
+++ smf/attachments/.htaccess	(working copy)
@@ -2,4 +2,5 @@
 	Order Deny,Allow
 	Deny from all
 	Allow from localhost
-</Files>
\ No newline at end of file
+</Files>
+RemoveHandler .php .php3 .phtml .cgi .fcgi .pl .fpl .shtml
Index: smf/index.php
===================================================================
--- smf/index.php	(revision 1047)
+++ smf/index.php	(working copy)
@@ -5,9 +5,9 @@
 * SMF: Simple Machines Forum                                                      *
 * Open-Source Project Inspired by Zef Hemel (zef@zefhemel.com)                    *
 * =============================================================================== *
-* Software Version:           SMF 1.1.5                                           *
+* Software Version:           SMF 1.1.10                                          *
 * Software by:                Simple Machines (http://www.simplemachines.org)     *
-* Copyright 2006-2007 by:     Simple Machines LLC (http://www.simplemachines.org) *
+* Copyright 2006-2009 by:     Simple Machines LLC (http://www.simplemachines.org) *
 *           2001-2006 by:     Lewis Media (http://www.lewismedia.com)             *
 * Support, News, Updates at:  http://www.simplemachines.org                       *
 ***********************************************************************************
@@ -34,7 +34,7 @@
 	with the URL index.php?action=action-in-url.  Relatively simple, no?
 */
 
-$forum_version = 'SMF 1.1.5';
+$forum_version = 'SMF 1.1.10';
 
 // Get everything started up...
 define('SMF', 1);
@@ -88,8 +88,8 @@
 cleanRequest();
 $context = array();
 
-// Seed the random generator for PHP < 4.2.0.
-if (@version_compare(PHP_VERSION, '4.2.0') == -1)
+// Seed the random generator?
+if (empty($modSettings['rand_seed']) || mt_rand(1, 250) == 69)
 	smf_seed_generator();
 
 // Determine if this is using WAP, WAP2, or imode.  Technically, we should check that wap comes before application/xhtml or text/html, but this doesn't work in practice as much as it should.
@@ -199,7 +199,7 @@
 		}
 	}
 	// If guest access is off, a guest can only do one of the very few following actions.
-	elseif (empty($modSettings['allow_guestAccess']) && $user_info['is_guest'] && (!isset($_REQUEST['action']) || !in_array($_REQUEST['action'], array('login', 'login2', 'register', 'register2', 'reminder', 'activate', 'smstats', 'help', '.xml', 'verificationcode'))))
+	elseif (empty($modSettings['allow_guestAccess']) && $user_info['is_guest'] && (!isset($_REQUEST['action']) || !in_array($_REQUEST['action'], array('coppa', 'login', 'login2', 'register', 'register2', 'reminder', 'activate', 'smstats', 'help', 'verificationcode'))))
 	{
 		require_once($sourcedir . '/Subs-Auth.php');
 		return 'KickGuest';
