diff -urN punbb-1.2.13/upload/admin_bans.php punbb-1.2.14/upload/admin_bans.php
--- punbb-1.2.13/upload/admin_bans.php	Thu Jul  7 19:31:54 2005
+++ punbb-1.2.14/upload/admin_bans.php	Sat Oct 14 18:40:30 2006
@@ -192,6 +192,8 @@
 
 	if ($ban_user == '' && $ban_ip == '' && $ban_email == '')
 		message('You must enter either a username, an IP address or an e-mail address (at least).');
+	else if (strtolower($ban_user) == 'guest')
+		message('The guest user cannot be banned.');
 
 	// Validate IP/IP range (it's overkill, I know)
 	if ($ban_ip != '')
diff -urN punbb-1.2.13/upload/admin_forums.php punbb-1.2.14/upload/admin_forums.php
--- punbb-1.2.13/upload/admin_forums.php	Sun Apr  3 20:48:30 2005
+++ punbb-1.2.14/upload/admin_forums.php	Sun Oct 15 18:27:14 2006
@@ -140,7 +140,7 @@
 		if (!preg_match('#^\d+$#', $disp_position))
 			message('Position must be a positive integer value.');
 
-		$db->query('UPDATE '.$db->prefix.'forums SET disp_position='.$disp_position.' WHERE id='.$forum_id) or error('Unable to update forum', __FILE__, __LINE__, $db->error());
+		$db->query('UPDATE '.$db->prefix.'forums SET disp_position='.$disp_position.' WHERE id='.intval($forum_id)) or error('Unable to update forum', __FILE__, __LINE__, $db->error());
 	}
 
 	// Regenerate the quickjump cache
@@ -186,9 +186,9 @@
 			$result = $db->query('SELECT g_id, g_read_board, g_post_replies, g_post_topics FROM '.$db->prefix.'groups WHERE g_id!='.PUN_ADMIN) or error('Unable to fetch user group list', __FILE__, __LINE__, $db->error());
 			while ($cur_group = $db->fetch_assoc($result))
 			{
-				$read_forum_new = ($cur_group['g_read_board'] == '1') ? isset($_POST['read_forum_new'][$cur_group['g_id']]) ? $_POST['read_forum_new'][$cur_group['g_id']] : '0' : $_POST['read_forum_old'][$cur_group['g_id']];
-				$post_replies_new = isset($_POST['post_replies_new'][$cur_group['g_id']]) ? $_POST['post_replies_new'][$cur_group['g_id']] : '0';
-				$post_topics_new = isset($_POST['post_topics_new'][$cur_group['g_id']]) ? $_POST['post_topics_new'][$cur_group['g_id']] : '0';
+				$read_forum_new = ($cur_group['g_read_board'] == '1') ? isset($_POST['read_forum_new'][$cur_group['g_id']]) ? '1' : '0' : intval($_POST['read_forum_old'][$cur_group['g_id']]);
+				$post_replies_new = isset($_POST['post_replies_new'][$cur_group['g_id']]) ? '1' : '0';
+				$post_topics_new = isset($_POST['post_topics_new'][$cur_group['g_id']]) ? '1' : '0';
 
 				// Check if the new settings differ from the old
 				if ($read_forum_new != $_POST['read_forum_old'][$cur_group['g_id']] || $post_replies_new != $_POST['post_replies_old'][$cur_group['g_id']] || $post_topics_new != $_POST['post_topics_old'][$cur_group['g_id']])
diff -urN punbb-1.2.13/upload/admin_groups.php punbb-1.2.14/upload/admin_groups.php
--- punbb-1.2.13/upload/admin_groups.php	Fri Sep  2 16:04:40 2005
+++ punbb-1.2.14/upload/admin_groups.php	Sat Oct 14 18:41:54 2006
@@ -264,7 +264,7 @@
 	confirm_referrer('admin_groups.php');
 
 	$group_id = intval($_POST['default_group']);
-	if ($group_id < 1)
+	if ($group_id < 4)
 		message($lang_common['Bad request']);
 
 	$db->query('UPDATE '.$db->prefix.'config SET conf_value='.$group_id.' WHERE conf_name=\'o_default_user_group\'') or error('Unable to update board config', __FILE__, __LINE__, $db->error());
diff -urN punbb-1.2.13/upload/admin_options.php punbb-1.2.14/upload/admin_options.php
--- punbb-1.2.13/upload/admin_options.php	Wed Sep 27 00:48:56 2006
+++ punbb-1.2.14/upload/admin_options.php	Sun Oct 15 18:31:20 2006
@@ -46,6 +46,9 @@
 	if ($form['board_title'] == '')
 		message('You must enter a board title.');
 
+	// Clean default_lang
+	$form['default_lang'] = preg_replace('#[\.\\\/]#', '', $form['default_lang']);
+
 	require PUN_ROOT.'include/email.php';
 
 	$form['admin_email'] = strtolower($form['admin_email']);
diff -urN punbb-1.2.13/upload/admin_users.php punbb-1.2.14/upload/admin_users.php
--- punbb-1.2.13/upload/admin_users.php	Fri Sep  2 16:04:40 2005
+++ punbb-1.2.14/upload/admin_users.php	Sun Oct 15 18:27:14 2006
@@ -257,7 +257,7 @@
 	$like_command = ($db_type == 'pgsql') ? 'ILIKE' : 'LIKE';
 	while (list($key, $input) = @each($form))
 	{
-		if ($input != '')
+		if ($input != '' && in_array($key, array('username', 'email', 'title', 'realname', 'url', 'jabber', 'icq', 'msn', 'aim', 'yahoo', 'location', 'signature', 'admin_note')))
 			$conditions[] = 'u.'.$db->escape($key).' '.$like_command.' \''.$db->escape(str_replace('*', '%', $input)).'\'';
 	}
 
@@ -267,7 +267,7 @@
 		$conditions[] = 'u.num_posts<'.$posts_less;
 
 	if ($user_group != 'all')
-		$conditions[] = 'u.group_id='.$db->escape($user_group);
+		$conditions[] = 'u.group_id='.intval($user_group);
 
 	if (empty($conditions))
 		message('You didn\'t enter any search terms.');
diff -urN punbb-1.2.13/upload/include/functions.php punbb-1.2.14/upload/include/functions.php
--- punbb-1.2.13/upload/include/functions.php	Wed Sep 27 00:46:26 2006
+++ punbb-1.2.14/upload/include/functions.php	Sun Oct 15 18:36:14 2006
@@ -1048,7 +1048,10 @@
 	foreach ($input as $k => $v)
 	{
 		if (!in_array($k, $no_unset) && isset($GLOBALS[$k]))
+		{
 			unset($GLOBALS[$k]);
+			unset($GLOBALS[$k]);	// Double unset to circumvent the zend_hash_del_key_or_index hole in PHP <4.4.3 and <5.1.4
+		}
 	}
 }
 
diff -urN punbb-1.2.13/upload/install.php punbb-1.2.14/upload/install.php
--- punbb-1.2.13/upload/install.php	Wed Sep 27 01:23:02 2006
+++ punbb-1.2.14/upload/install.php	Sun Oct 15 18:40:20 2006
@@ -24,7 +24,7 @@
 
 
 // The PunBB version this script installs
-$punbb_version = '1.2.13';
+$punbb_version = '1.2.14';
 
 
 define('PUN_ROOT', './');
@@ -757,7 +757,7 @@
 					poster_id INT(10) UNSIGNED NOT NULL DEFAULT 1,
 					poster_ip VARCHAR(15),
 					poster_email VARCHAR(50),
-					message TEXT NOT NULL DEFAULT '',
+					message TEXT,
 					hide_smilies TINYINT(1) NOT NULL DEFAULT 0,
 					posted INT(10) UNSIGNED NOT NULL DEFAULT 0,
 					edited INT(10) UNSIGNED,
@@ -774,7 +774,7 @@
 					poster_id INT NOT NULL DEFAULT 1,
 					poster_ip VARCHAR(15),
 					poster_email VARCHAR(50),
-					message TEXT NOT NULL DEFAULT '',
+					message TEXT,
 					hide_smilies SMALLINT NOT NULL DEFAULT 0,
 					posted INT NOT NULL DEFAULT 0,
 					edited INT,
@@ -791,7 +791,7 @@
 					poster_id INTEGER NOT NULL DEFAULT 1,
 					poster_ip VARCHAR(15),
 					poster_email VARCHAR(50),
-					message TEXT NOT NULL DEFAULT '',
+					message TEXT,
 					hide_smilies INTEGER NOT NULL DEFAULT 0,
 					posted INTEGER NOT NULL DEFAULT 0,
 					edited INTEGER,
@@ -852,7 +852,7 @@
 					forum_id INT(10) UNSIGNED NOT NULL DEFAULT 0,
 					reported_by INT(10) UNSIGNED NOT NULL DEFAULT 0,
 					created INT(10) UNSIGNED NOT NULL DEFAULT 0,
-					message TEXT NOT NULL DEFAULT '',
+					message TEXT,
 					zapped INT(10) UNSIGNED,
 					zapped_by INT(10) UNSIGNED,
 					PRIMARY KEY (id)
@@ -867,7 +867,7 @@
 					forum_id INT NOT NULL DEFAULT 0,
 					reported_by INT NOT NULL DEFAULT 0,
 					created INT NOT NULL DEFAULT 0,
-					message TEXT NOT NULL DEFAULT '',
+					message TEXT,
 					zapped INT,
 					zapped_by INT,
 					PRIMARY KEY (id)
@@ -882,7 +882,7 @@
 					forum_id INTEGER NOT NULL DEFAULT 0,
 					reported_by INTEGER NOT NULL DEFAULT 0,
 					created INTEGER NOT NULL DEFAULT 0,
-					message TEXT NOT NULL DEFAULT '',
+					message TEXT,
 					zapped INTEGER,
 					zapped_by INTEGER,
 					PRIMARY KEY (id)
@@ -901,7 +901,7 @@
 			$sql = 'CREATE TABLE '.$db_prefix."search_cache (
 					id INT(10) UNSIGNED NOT NULL DEFAULT 0,
 					ident VARCHAR(200) NOT NULL DEFAULT '',
-					search_data TEXT NOT NULL DEFAULT '',
+					search_data TEXT,
 					PRIMARY KEY (id)
 					) TYPE=MyISAM;";
 			break;
@@ -910,7 +910,7 @@
 			$sql = 'CREATE TABLE '.$db_prefix."search_cache (
 					id INT NOT NULL DEFAULT 0,
 					ident VARCHAR(200) NOT NULL DEFAULT '',
-					search_data TEXT NOT NULL DEFAULT '',
+					search_data TEXT,
 					PRIMARY KEY (id)
 					)";
 			break;
@@ -919,7 +919,7 @@
 			$sql = 'CREATE TABLE '.$db_prefix."search_cache (
 					id INTEGER NOT NULL DEFAULT 0,
 					ident VARCHAR(200) NOT NULL DEFAULT '',
-					search_data TEXT NOT NULL DEFAULT '',
+					search_data TEXT,
 					PRIMARY KEY (id)
 					)";
 			break;
diff -urN punbb-1.2.13/upload/register.php punbb-1.2.14/upload/register.php
--- punbb-1.2.13/upload/register.php	Tue Feb 28 20:21:40 2006
+++ punbb-1.2.14/upload/register.php	Sun Oct 15 18:31:20 2006
@@ -173,8 +173,17 @@
 			$dupe_list[] = $cur_dupe['username'];
 	}
 
+	// Make sure we got a valid language string
+	if (isset($_POST['language']))
+	{
+		$language = preg_replace('#[\.\\\/]#', '', $_POST['language']);
+		if (!file_exists(PUN_ROOT.'lang/'.$language.'/common.php'))
+				message($lang_common['Bad request']);
+	}
+	else
+		$language = $pun_config['o_default_lang'];
+
 	$timezone = intval($_POST['timezone']);
-	$language = isset($_POST['language']) ? $_POST['language'] : $pun_config['o_default_lang'];
 	$save_pass = (!isset($_POST['save_pass']) || $_POST['save_pass'] != '1') ? '0' : '1';
 
 	$email_setting = intval($_POST['email_setting']);
diff -urN punbb-1.2.13/upload/search.php punbb-1.2.14/upload/search.php
--- punbb-1.2.13/upload/search.php	Sun Oct 16 11:48:28 2005
+++ punbb-1.2.14/upload/search.php	Sun Oct 15 18:36:14 2006
@@ -170,6 +170,7 @@
 
 				$word_count = 0;
 				$match_type = 'and';
+				$result_list = array();
 				@reset($keywords_array);
 				while (list(, $cur_word) = @each($keywords_array))
 				{
@@ -465,7 +466,7 @@
 			$sql = 'SELECT p.id AS pid, p.poster AS pposter, p.posted AS pposted, p.poster_id, '.$substr_sql.'(p.message, 1, 1000) AS message, t.id AS tid, t.poster, t.subject, t.last_post, t.last_post_id, t.last_poster, t.num_replies, t.forum_id FROM '.$db->prefix.'posts AS p INNER JOIN '.$db->prefix.'topics AS t ON t.id=p.topic_id WHERE p.id IN('.$search_results.') ORDER BY '.$sort_by_sql;
 		}
 		else
-			$sql = 'SELECT t.id AS tid, t.poster, t.subject, t.last_post, t.last_post_id, t.last_poster, t.num_replies, t.closed, t.forum_id FROM '.$db->prefix.'posts AS p INNER JOIN '.$db->prefix.'topics AS t ON t.id=p.topic_id WHERE t.id IN('.$search_results.') GROUP BY t.id, t.poster, t.subject, t.last_post, t.last_post_id, t.last_poster, t.num_replies, t.closed, t.forum_id'.$group_by_sql.' ORDER BY '.$sort_by_sql;
+			$sql = 'SELECT t.id AS tid, t.poster, t.subject, t.last_post, t.last_post_id, t.last_poster, t.num_replies, t.closed, t.forum_id FROM '.$db->prefix.'topics AS t WHERE t.id IN('.$search_results.') GROUP BY t.id, t.poster, t.subject, t.last_post, t.last_post_id, t.last_poster, t.num_replies, t.closed, t.forum_id'.$group_by_sql.' ORDER BY '.$sort_by_sql;
 
 
 		// Determine the topic or post offset (based on $_GET['p'])
diff -urN punbb-1.2.13/upload/style/imports/base.css punbb-1.2.14/upload/style/imports/base.css
--- punbb-1.2.13/upload/style/imports/base.css	Tue Feb  1 17:16:46 2005
+++ punbb-1.2.14/upload/style/imports/base.css	Tue Oct 10 17:48:32 2006
@@ -43,12 +43,19 @@
 
 DIV>DIV>DIV.postfootleft, DIV>DIV>DIV.postfootright {PADDING-TOP: 1px; MARGIN-TOP: -1px}
 
-/* 3.2 This is only visible to IE Windows and cures various bugs. Do not alter comments */
-
-/* Begin IEWin Fix \*/
-* HTML .inbox, * HTML .inform, * HTML .pun, * HTML .intd, * HTML .tclcon {HEIGHT: 1px}
+/* 3.2 This is only visible to IE6 Windows and cures various bugs. Do not alter comments */
+
+/* Begin IE6Win Fix \*/
+* HTML .inbox, * HTML .inform, * HTML .pun, * HTML .intd, * HTML .tclcon {HEIGHT: 1px}
 * HTML .inbox DIV.postmsg {WIDTH: 98%}
-/* End of IEWin Fix */
+/* End of IE6Win Fix */
+
+/* 3.3 This is the equivelant of 3.2 but for IE7. It is visible to other browsers
+but does no harm */
+
+/*Begin IE7Win Fix */
+.pun, .pun .inbox, .pun .inform, .pun .intd, .pun .tclcon {min-height: 1px}
+/* End of IE7Win Fix */
 
 /****************************************************************/
 /* 4. HIDDEN ELEMENTS */
