diff -urN punbb-1.2.9/upload/admin_options.php punbb-1.2.13/upload/admin_options.php
--- punbb-1.2.9/upload/admin_options.php	Wed Jul 27 23:24:24 2005
+++ punbb-1.2.13/upload/admin_options.php	Wed Sep 27 00:48:56 2006
@@ -63,6 +63,9 @@
 	if (substr($form['base_url'], -1) == '/')
 		$form['base_url'] = substr($form['base_url'], 0, -1);
 
+	// Clean avatars_dir
+	$form['avatars_dir'] = str_replace("\0", '', $form['avatars_dir']);
+
 	// Make sure avatars_dir doesn't end with a slash
 	if (substr($form['avatars_dir'], -1) == '/')
 		$form['avatars_dir'] = substr($form['avatars_dir'], 0, -1);
diff -urN punbb-1.2.9/upload/header.php punbb-1.2.13/upload/header.php
--- punbb-1.2.9/upload/header.php	Thu Jul  7 18:48:00 2005
+++ punbb-1.2.13/upload/header.php	Tue Feb 28 20:20:26 2006
@@ -131,7 +131,7 @@
 
 
 // START SUBST - <pun_page>
-$tpl_main = str_replace('<pun_page>', basename($_SERVER['PHP_SELF'], '.php'), $tpl_main);
+$tpl_main = str_replace('<pun_page>', htmlspecialchars(basename($_SERVER['PHP_SELF'], '.php')), $tpl_main);
 // END SUBST - <pun_title>
 
 
diff -urN punbb-1.2.9/upload/include/common.php punbb-1.2.13/upload/include/common.php
--- punbb-1.2.9/upload/include/common.php	Sun Oct 16 12:02:42 2005
+++ punbb-1.2.13/upload/include/common.php	Tue Nov  1 01:06:54 2005
@@ -32,6 +32,15 @@
 if (!defined('PUN_ROOT'))
 	exit('The constant PUN_ROOT must be defined and point to a valid PunBB installation root directory.');
 
+
+// Load the functions script
+require PUN_ROOT.'include/functions.php';
+
+// Reverse the effect of register_globals
+if (@ini_get('register_globals'))
+	unregister_globals();
+
+
 @include PUN_ROOT.'config.php';
 
 // If PUN isn't defined, config.php is missing or corrupt
@@ -75,14 +84,6 @@
 define('PUN_MOD', 2);
 define('PUN_GUEST', 3);
 define('PUN_MEMBER', 4);
-
-
-// Load the functions script
-require PUN_ROOT.'include/functions.php';
-
-// Reverse the effect of register_globals
-if (@ini_get('register_globals'))
-	unregister_globals();
 
 
 // Load DB abstraction layer and connect
diff -urN punbb-1.2.9/upload/include/functions.php punbb-1.2.13/upload/include/functions.php
--- punbb-1.2.9/upload/include/functions.php	Sun Oct 16 12:02:42 2005
+++ punbb-1.2.13/upload/include/functions.php	Wed Sep 27 00:46:26 2006
@@ -138,7 +138,10 @@
 	// Enable sending of a P3P header by removing // from the following line (try this if login is failing in IE6)
 //	@header('P3P: CP="CUR ADM"');
 
-	setcookie($cookie_name, serialize(array($user_id, md5($cookie_seed.$password_hash))), $expire, $cookie_path, $cookie_domain, $cookie_secure);
+	if (version_compare(PHP_VERSION, '5.2.0', '>='))
+		setcookie($cookie_name, serialize(array($user_id, md5($cookie_seed.$password_hash))), $expire, $cookie_path, $cookie_domain, $cookie_secure, true);
+	else
+		setcookie($cookie_name, serialize(array($user_id, md5($cookie_seed.$password_hash))), $expire, $cookie_path.'; HttpOnly', $cookie_domain, $cookie_secure);
 }
 
 
@@ -681,28 +684,7 @@
 //
 function get_remote_address()
 {
-	$remote_address = $_SERVER['REMOTE_ADDR'];
-
-	// If HTTP_X_FORWARDED_FOR is set, we try to grab the first non-LAN IP
-	if (!empty($_SERVER['HTTP_X_FORWARDED_FOR']))
-	{
-		if (preg_match_all('/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/', $_SERVER['HTTP_X_FORWARDED_FOR'], $address_list))
-		{
-			$lan_ips = array('/^0\./', '/^127\.0\.0\.1/', '/^192\.168\..*/', '/^172\.((1[6-9])|(2[0-9])|(3[0-1]))\..*/', '/^10\..*/', '/^224\..*/', '/^240\..*/');
-			$address_list = preg_replace($lan_ips, null, $address_list[0]);
-
-			while (list(, $cur_address) = each($address_list))
-			{
-				if ($cur_address)
-				{
-					$remote_address = $cur_address;
-					break;
-				}
-			}
-		}
-	}
-
-	return $remote_address;
+	return $_SERVER['REMOTE_ADDR'];
 }
 
 
@@ -1052,22 +1034,22 @@
 //
 // Unset any variables instantiated as a result of register_globals being enabled
 //
-function unregister_globals()
+function unregister_globals()
 {
-	// Prevent script.php?GLOBALS[foo]=bar
-	if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS']))
-		exit('I\'ll have a steak sandwich and... a steak sandwich.');
-	
-	// Variables that shouldn't be unset
-	$no_unset = array('GLOBALS', '_GET', '_POST', '_COOKIE', '_REQUEST', '_SERVER', '_ENV', '_FILES');
+	// Prevent script.php?GLOBALS[foo]=bar
+	if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS']))
+		exit('I\'ll have a steak sandwich and... a steak sandwich.');
+	
+	// Variables that shouldn't be unset
+	$no_unset = array('GLOBALS', '_GET', '_POST', '_COOKIE', '_REQUEST', '_SERVER', '_ENV', '_FILES');
 
 	// Remove elements in $GLOBALS that are present in any of the superglobals
-	$input = array_merge($_GET, $_POST, $_COOKIE, $_SERVER, $_ENV, $_FILES, isset($_SESSION) && is_array($_SESSION) ? $_SESSION : array());
+	$input = array_merge($_GET, $_POST, $_COOKIE, $_SERVER, $_ENV, $_FILES, isset($_SESSION) && is_array($_SESSION) ? $_SESSION : array());
 	foreach ($input as $k => $v)
-	{
-		if (!in_array($k, $no_unset) && isset($GLOBALS[$k]))
-			unset($GLOBALS[$k]);
-	}
+	{
+		if (!in_array($k, $no_unset) && isset($GLOBALS[$k]))
+			unset($GLOBALS[$k]);
+	}
 }
 
 
diff -urN punbb-1.2.9/upload/include/parser.php punbb-1.2.13/upload/include/parser.php
--- punbb-1.2.9/upload/include/parser.php	Fri Sep  2 16:01:04 2005
+++ punbb-1.2.13/upload/include/parser.php	Sat May 20 17:42:32 2006
@@ -264,7 +264,7 @@
 {
 	global $pun_user;
 
-	$full_url = str_replace(array(' ', '\'', '`'), array('%20', '', ''), $url);
+	$full_url = str_replace(array(' ', '\'', '`', '"'), array('%20', '', '', ''), $url);
 	if (strpos($url, 'www.') === 0)			// If it starts with www, we add http://
 		$full_url = 'http://'.$full_url;
 	else if (strpos($url, 'ftp.') === 0)	// Else if it starts with ftp, we add ftp://
diff -urN punbb-1.2.9/upload/include/search_idx.php punbb-1.2.13/upload/include/search_idx.php
--- punbb-1.2.9/upload/include/search_idx.php	Thu Jul  7 22:11:26 2005
+++ punbb-1.2.13/upload/include/search_idx.php	Mon Oct 31 23:37:18 2005
@@ -69,10 +69,8 @@
 	{
 		while (list($i, $word) = @each($words))
 		{
+			$words[$i] = trim($word, '.');
 			$num_chars = pun_strlen($word);
-
-			if (strrpos($word, '.') == ($num_chars-1))
-				$words[$i] = substr($word, 0, -1);
 
 			if ($num_chars < 3 || $num_chars > 20 || in_array($word, $stopwords))
 				unset($words[$i]);
diff -urN punbb-1.2.9/upload/install.php punbb-1.2.13/upload/install.php
--- punbb-1.2.9/upload/install.php	Sun Oct 16 11:46:40 2005
+++ punbb-1.2.13/upload/install.php	Wed Sep 27 01:23:02 2006
@@ -24,7 +24,7 @@
 
 
 // The PunBB version this script installs
-$punbb_version = '1.2.9';
+$punbb_version = '1.2.13';
 
 
 define('PUN_ROOT', './');
diff -urN punbb-1.2.9/upload/login.php punbb-1.2.13/upload/login.php
--- punbb-1.2.9/upload/login.php	Thu Sep 22 00:36:08 2005
+++ punbb-1.2.13/upload/login.php	Sat May 20 17:52:02 2006
@@ -78,7 +78,7 @@
 	$expire = ($save_pass == '1') ? time() + 31536000 : 0;
 	pun_setcookie($user_id, $form_password_hash, $expire);
 
-	redirect($_POST['redirect_url'], $lang_login['Login redirect']);
+	redirect(htmlspecialchars($_POST['redirect_url']), $lang_login['Login redirect']);
 }
 
 
diff -urN punbb-1.2.9/upload/misc.php punbb-1.2.13/upload/misc.php
--- punbb-1.2.9/upload/misc.php	Sun Jul  3 13:54:30 2005
+++ punbb-1.2.13/upload/misc.php	Sat May 20 17:52:02 2006
@@ -120,7 +120,7 @@
 
 		pun_mail($recipient_email, $mail_subject, $mail_message, '"'.str_replace('"', '', $pun_user['username']).'" <'.$pun_user['email'].'>');
 
-		redirect($_POST['redirect_url'], $lang_misc['E-mail sent redirect']);
+		redirect(htmlspecialchars($_POST['redirect_url']), $lang_misc['E-mail sent redirect']);
 	}
 
 
diff -urN punbb-1.2.9/upload/post.php punbb-1.2.13/upload/post.php
--- punbb-1.2.9/upload/post.php	Fri Sep  2 16:05:30 2005
+++ punbb-1.2.13/upload/post.php	Mon Oct 31 23:26:12 2005
@@ -338,7 +338,7 @@
 		if ($qid < 1)
 			message($lang_common['Bad request']);
 
-		$result = $db->query('SELECT poster, message FROM '.$db->prefix.'posts WHERE id='.$qid) or error('Unable to fetch quote info', __FILE__, __LINE__, $db->error());
+		$result = $db->query('SELECT poster, message FROM '.$db->prefix.'posts WHERE id='.$qid.' AND topic_id='.$tid) or error('Unable to fetch quote info', __FILE__, __LINE__, $db->error());
 		if (!$db->num_rows($result))
 			message($lang_common['Bad request']);
 
diff -urN punbb-1.2.9/upload/profile.php punbb-1.2.13/upload/profile.php
--- punbb-1.2.9/upload/profile.php	Thu Sep 22 09:50:40 2005
+++ punbb-1.2.13/upload/profile.php	Tue Nov  1 01:27:28 2005
@@ -201,6 +201,9 @@
 	}
 	else if (isset($_POST['form_sent']))
 	{
+		if (pun_hash($_POST['req_password']) !== $pun_user['password'])
+			message($lang_profile['Wrong pass']);
+
 		require PUN_ROOT.'include/email.php';
 
 		// Validate the email-address
@@ -264,7 +267,7 @@
 	}
 
 	$page_title = pun_htmlspecialchars($pun_config['o_board_title']).' / '.$lang_common['Profile'];
-	$required_fields = array('req_new_email' => $lang_profile['New e-mail']);
+	$required_fields = array('req_new_email' => $lang_profile['New e-mail'], 'req_password' => $lang_common['Password']);
 	$focus_element = array('change_email', 'req_new_email');
 	require PUN_ROOT.'header.php';
 
@@ -279,6 +282,7 @@
 					<div class="infldset">
 						<input type="hidden" name="form_sent" value="1" />
 						<label><strong><?php echo $lang_profile['New e-mail'] ?></strong><br /><input type="text" name="req_new_email" size="50" maxlength="50" /><br /></label>
+						<label><strong><?php echo $lang_common['Password'] ?></strong><br /><input type="password" name="req_password" size="16" maxlength="16" /><br /></label>
 						<p><?php echo $lang_profile['E-mail instructions'] ?></p>
 					</div>
 				</fieldset>
@@ -362,12 +366,17 @@
 				message($lang_profile['Move failed'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.');
 
 			// Now check the width/height
-			list($width, $height, ,) = getimagesize($pun_config['o_avatars_dir'].'/'.$id.'.tmp');
+			list($width, $height, $type,) = getimagesize($pun_config['o_avatars_dir'].'/'.$id.'.tmp');
 			if (empty($width) || empty($height) || $width > $pun_config['o_avatars_width'] || $height > $pun_config['o_avatars_height'])
 			{
 				@unlink($pun_config['o_avatars_dir'].'/'.$id.'.tmp');
 				message($lang_profile['Too wide or high'].' '.$pun_config['o_avatars_width'].'x'.$pun_config['o_avatars_height'].' '.$lang_profile['pixels'].'.');
 			}
+			else if ($type == 1 && $uploaded_file['type'] != 'image/gif')	// Prevent dodgy uploads
+			{
+				@unlink($pun_config['o_avatars_dir'].'/'.$id.'.tmp');
+				message($lang_profile['Bad type']);
+			}			
 
 			// Delete any old avatars and put the new one in place
 			@unlink($pun_config['o_avatars_dir'].'/'.$id.$extensions[0]);
diff -urN punbb-1.2.9/upload/register.php punbb-1.2.13/upload/register.php
--- punbb-1.2.9/upload/register.php	Tue Aug 30 02:45:44 2005
+++ punbb-1.2.13/upload/register.php	Tue Feb 28 20:21:40 2006
@@ -79,6 +79,13 @@
 
 else if (isset($_POST['form_sent']))
 {
+	// Check that someone from this IP didn't register a user within the last hour (DoS prevention)
+	$result = $db->query('SELECT 1 FROM '.$db->prefix.'users WHERE registration_ip=\''.get_remote_address().'\' AND registered>'.(time() - 3600)) or error('Unable to fetch user info', __FILE__, __LINE__, $db->error());
+
+	if ($db->num_rows($result))
+		message('A new user was registered with the same IP address as you within the last hour. To prevent registration flooding, at least an hour has to pass between registrations from the same IP. Sorry for the inconvenience.');
+
+
 	$username = pun_trim($_POST['req_username']);
 	$email1 = strtolower(trim($_POST['req_email1']));
 
diff -urN punbb-1.2.9/upload/userlist.php punbb-1.2.13/upload/userlist.php
--- punbb-1.2.9/upload/userlist.php	Thu Mar  3 02:08:18 2005
+++ punbb-1.2.13/upload/userlist.php	Sat May 20 17:53:28 2006
@@ -116,7 +116,7 @@
 	$where_sql[] = 'u.group_id='.$show_group;
 
 // Fetch user count
-$result = $db->query('SELECT COUNT(id) FROM '.$db->prefix.'users AS u'.(!empty($where_sql) ? ' WHERE u.id>1 AND '.implode(' AND ', $where_sql) : '')) or error('Unable to fetch user list count', __FILE__, __LINE__, $db->error());
+$result = $db->query('SELECT COUNT(id) FROM '.$db->prefix.'users AS u WHERE u.id>1'.(!empty($where_sql) ? ' AND '.implode(' AND ', $where_sql) : '')) or error('Unable to fetch user list count', __FILE__, __LINE__, $db->error());
 $num_users = $db->result($result);
 
 
