diff -urN punbb-1.2.10/upload/header.php punbb-1.2.12/upload/header.php
--- punbb-1.2.10/upload/header.php	Thu Jul  7 17:48:00 2005
+++ punbb-1.2.12/upload/header.php	Tue Feb 28 20:20:26 2006
@@ -131,7 +131,7 @@
 
 
 // START SUBST - <pun_page>
-$tpl_main = str_replace('<pun_page>', basename($_SERVER['PHP_SELF'], '.php'), $tpl_main);
+$tpl_main = str_replace('<pun_page>', htmlspecialchars(basename($_SERVER['PHP_SELF'], '.php')), $tpl_main);
 // END SUBST - <pun_title>
 
 
diff -urN punbb-1.2.10/upload/include/parser.php punbb-1.2.12/upload/include/parser.php
--- punbb-1.2.10/upload/include/parser.php	Fri Sep  2 15:01:04 2005
+++ punbb-1.2.12/upload/include/parser.php	Sat May 20 17:42:32 2006
@@ -264,7 +264,7 @@
 {
 	global $pun_user;
 
-	$full_url = str_replace(array(' ', '\'', '`'), array('%20', '', ''), $url);
+	$full_url = str_replace(array(' ', '\'', '`', '"'), array('%20', '', '', ''), $url);
 	if (strpos($url, 'www.') === 0)			// If it starts with www, we add http://
 		$full_url = 'http://'.$full_url;
 	else if (strpos($url, 'ftp.') === 0)	// Else if it starts with ftp, we add ftp://
diff -urN punbb-1.2.10/upload/install.php punbb-1.2.12/upload/install.php
--- punbb-1.2.10/upload/install.php	Tue Nov  1 00:31:04 2005
+++ punbb-1.2.12/upload/install.php	Sat May 20 17:57:04 2006
@@ -24,7 +24,7 @@
 
 
 // The PunBB version this script installs
-$punbb_version = '1.2.10';
+$punbb_version = '1.2.12';
 
 
 define('PUN_ROOT', './');
diff -urN punbb-1.2.10/upload/login.php punbb-1.2.12/upload/login.php
--- punbb-1.2.10/upload/login.php	Wed Sep 21 23:36:08 2005
+++ punbb-1.2.12/upload/login.php	Sat May 20 17:52:02 2006
@@ -78,7 +78,7 @@
 	$expire = ($save_pass == '1') ? time() + 31536000 : 0;
 	pun_setcookie($user_id, $form_password_hash, $expire);
 
-	redirect($_POST['redirect_url'], $lang_login['Login redirect']);
+	redirect(htmlspecialchars($_POST['redirect_url']), $lang_login['Login redirect']);
 }
 
 
diff -urN punbb-1.2.10/upload/misc.php punbb-1.2.12/upload/misc.php
--- punbb-1.2.10/upload/misc.php	Sun Jul  3 12:54:30 2005
+++ punbb-1.2.12/upload/misc.php	Sat May 20 17:52:02 2006
@@ -120,7 +120,7 @@
 
 		pun_mail($recipient_email, $mail_subject, $mail_message, '"'.str_replace('"', '', $pun_user['username']).'" <'.$pun_user['email'].'>');
 
-		redirect($_POST['redirect_url'], $lang_misc['E-mail sent redirect']);
+		redirect(htmlspecialchars($_POST['redirect_url']), $lang_misc['E-mail sent redirect']);
 	}
 
 
diff -urN punbb-1.2.10/upload/register.php punbb-1.2.12/upload/register.php
--- punbb-1.2.10/upload/register.php	Tue Aug 30 01:45:44 2005
+++ punbb-1.2.12/upload/register.php	Tue Feb 28 20:21:40 2006
@@ -79,6 +79,13 @@
 
 else if (isset($_POST['form_sent']))
 {
+	// Check that someone from this IP didn't register a user within the last hour (DoS prevention)
+	$result = $db->query('SELECT 1 FROM '.$db->prefix.'users WHERE registration_ip=\''.get_remote_address().'\' AND registered>'.(time() - 3600)) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error());
+
+	if ($db->num_rows($result))
+		message('A new user was registered with the same IP address as you within the last hour. To prevent registration flooding, at least an hour has to pass between registrations from the same IP. Sorry for the inconvenience.');
+
+
 	$username = pun_trim($_POST['req_username']);
 	$email1 = strtolower(trim($_POST['req_email1']));
 
diff -urN punbb-1.2.10/upload/userlist.php punbb-1.2.12/upload/userlist.php
--- punbb-1.2.10/upload/userlist.php	Thu Mar  3 01:08:18 2005
+++ punbb-1.2.12/upload/userlist.php	Sat May 20 17:53:28 2006
@@ -116,7 +116,7 @@
 	$where_sql[] = 'u.group_id='.$show_group;
 
 // Fetch user count
-$result = $db->query('SELECT COUNT(id) FROM '.$db->prefix.'users AS u'.(!empty($where_sql) ? ' WHERE u.id>1 AND '.implode(' AND ', $where_sql) : '')) or error('Unable to fetch user list count', __FILE__, __LINE__, $db->error());
+$result = $db->query('SELECT COUNT(id) FROM '.$db->prefix.'users AS u WHERE u.id>1'.(!empty($where_sql) ? ' AND '.implode(' AND ', $where_sql) : '')) or error('Unable to fetch user list count', __FILE__, __LINE__, $db->error());
 $num_users = $db->result($result);
 
 
