diff -urN punbb-1.2.7/upload/include/common.php punbb-1.2.9/upload/include/common.php
--- punbb-1.2.7/upload/include/common.php	Thu Jul  7 19:38:16 2005
+++ punbb-1.2.9/upload/include/common.php	Sun Oct 16 12:02:42 2005
@@ -80,6 +80,11 @@
 // Load the functions script
 require PUN_ROOT.'include/functions.php';
 
+// Reverse the effect of register_globals
+if (@ini_get('register_globals'))
+	unregister_globals();
+
+
 // Load DB abstraction layer and connect
 require PUN_ROOT.'include/dblayer/common_db.php';
 
diff -urN punbb-1.2.7/upload/include/email.php punbb-1.2.9/upload/include/email.php
--- punbb-1.2.7/upload/include/email.php	Thu Apr  7 21:41:16 2005
+++ punbb-1.2.9/upload/include/email.php	Thu Sep 22 00:35:04 2005
@@ -75,15 +75,7 @@
 	$subject = trim(preg_replace('#[\n\r]+#s', '', $subject));
 	$from = trim(preg_replace('#[\n\r:]+#s', '', $from));
 
-	// Detect what linebreak we should use for the headers
-	if (strtoupper(substr(PHP_OS, 0, 3) == 'WIN'))
-		$eol = "\r\n";
-	else if (strtoupper(substr(PHP_OS, 0, 3) == 'MAC'))
-		$eol = "\r";
-	else
-		$eol = "\n";
-
-	$headers = 'From: '.$from.$eol.'Date: '.date('r').$eol.'MIME-Version: 1.0'.$eol.'Content-transfer-encoding: 8bit'.$eol.'Content-type: text/plain; charset='.$lang_common['lang_encoding'].$eol.'X-Mailer: PunBB Mailer';
+	$headers = 'From: '.$from."\r\n".'Date: '.date('r')."\r\n".'MIME-Version: 1.0'."\r\n".'Content-transfer-encoding: 8bit'."\r\n".'Content-type: text/plain; charset='.$lang_common['lang_encoding']."\r\n".'X-Mailer: PunBB Mailer';
 
 	// Make sure all linebreaks are CRLF in message
 	$message = str_replace("\n", "\r\n", pun_linebreaks($message));
@@ -91,7 +83,15 @@
 	if ($pun_config['o_smtp_host'] != '')
 		smtp_mail($to, $subject, $message, $headers);
 	else
+	{
+		// Change the linebreaks used in the headers according to OS
+		if (strtoupper(substr(PHP_OS, 0, 3)) == 'MAC')
+			$headers = str_replace("\r\n", "\r", $headers);
+		else if (strtoupper(substr(PHP_OS, 0, 3)) != 'WIN')
+			$headers = str_replace("\r\n", "\n", $headers);
+
 		mail($to, $subject, $message, $headers);
+	}
 }
 
 
diff -urN punbb-1.2.7/upload/include/functions.php punbb-1.2.9/upload/include/functions.php
--- punbb-1.2.7/upload/include/functions.php	Fri Sep  2 01:17:54 2005
+++ punbb-1.2.9/upload/include/functions.php	Sun Oct 16 12:02:42 2005
@@ -209,7 +209,7 @@
 	$now = time();
 
 	// Fetch all online list entries that are older than "o_timeout_online"
-	$result = $db->query('SELECT * FROM '.$db->prefix.'online WHERE logged<'.($now-$pun_config['o_timeout_online'])) or error('Unable to delete from online list', __FILE__, __LINE__, $db->error());
+	$result = $db->query('SELECT * FROM '.$db->prefix.'online WHERE logged<'.($now-$pun_config['o_timeout_online'])) or error('Unable to fetch old entries from online list', __FILE__, __LINE__, $db->error());
 	while ($cur_user = $db->fetch_assoc($result))
 	{
 		// If the entry is a guest, delete it
@@ -1046,6 +1046,28 @@
 </div>
 <?php
 
+}
+
+
+//
+// Unset any variables instantiated as a result of register_globals being enabled
+//
+function unregister_globals()
+{
+	// Prevent script.php?GLOBALS[foo]=bar
+	if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS']))
+		exit('I\'ll have a steak sandwich and... a steak sandwich.');
+	
+	// Variables that shouldn't be unset
+	$no_unset = array('GLOBALS', '_GET', '_POST', '_COOKIE', '_REQUEST', '_SERVER', '_ENV', '_FILES');
+
+	// Remove elements in $GLOBALS that are present in any of the superglobals
+	$input = array_merge($_GET, $_POST, $_COOKIE, $_SERVER, $_ENV, $_FILES, isset($_SESSION) && is_array($_SESSION) ? $_SESSION : array());
+	foreach ($input as $k => $v)
+	{
+		if (!in_array($k, $no_unset) && isset($GLOBALS[$k]))
+			unset($GLOBALS[$k]);
+	}
 }
 
 
diff -urN punbb-1.2.7/upload/install.php punbb-1.2.9/upload/install.php
--- punbb-1.2.7/upload/install.php	Fri Sep  2 16:12:18 2005
+++ punbb-1.2.9/upload/install.php	Sun Oct 16 11:46:40 2005
@@ -24,7 +24,7 @@
 
 
 // The PunBB version this script installs
-$punbb_version = '1.2.7';
+$punbb_version = '1.2.9';
 
 
 define('PUN_ROOT', './');
diff -urN punbb-1.2.7/upload/login.php punbb-1.2.9/upload/login.php
--- punbb-1.2.7/upload/login.php	Thu Jul  7 19:35:30 2005
+++ punbb-1.2.9/upload/login.php	Thu Sep 22 00:36:08 2005
@@ -153,7 +153,7 @@
 			message($lang_login['Forget mail'].' <a href="mailto:'.$pun_config['o_admin_email'].'">'.$pun_config['o_admin_email'].'</a>.');
 		}
 		else
-			message($lang_login['No e-mail match'].' '.$email.'.');
+			message($lang_login['No e-mail match'].' '.htmlspecialchars($email).'.');
 	}
 
 
diff -urN punbb-1.2.7/upload/profile.php punbb-1.2.9/upload/profile.php
--- punbb-1.2.7/upload/profile.php	Thu Jul  7 22:37:30 2005
+++ punbb-1.2.9/upload/profile.php	Thu Sep 22 09:50:40 2005
@@ -710,6 +710,14 @@
 					message($lang_common['Invalid e-mail']);
 			}
 
+			// Make sure we got a valid language string
+			if (isset($form['language']))
+			{
+				$form['language'] = preg_replace('#[\.\\\/]#', '', $form['language']);
+				if (!file_exists(PUN_ROOT.'lang/'.$form['language'].'/common.php'))
+						message($lang_common['Bad request']);
+			}
+
 			break;
 		}
 
diff -urN punbb-1.2.7/upload/search.php punbb-1.2.9/upload/search.php
--- punbb-1.2.7/upload/search.php	Fri Sep  2 15:51:24 2005
+++ punbb-1.2.9/upload/search.php	Sun Oct 16 11:48:28 2005
@@ -51,9 +51,10 @@
 	$action = (isset($_GET['action'])) ? $_GET['action'] : null;
 	$forum = (isset($_GET['forum'])) ? intval($_GET['forum']) : -1;
 	$sort_dir = (isset($_GET['sort_dir'])) ? (($_GET['sort_dir'] == 'DESC') ? 'DESC' : 'ASC') : 'DESC';
+	if (isset($search_id)) unset($search_id);
 
 	// If a search_id was supplied
-	if (isset($_REQUEST['search_id']))
+	if (isset($_GET['search_id']))
 	{
 		$search_id = intval($_GET['search_id']);
 		if ($search_id < 1)
@@ -386,6 +387,7 @@
 
 
 		// Prune "old" search results
+		$old_searches = array();
 		$result = $db->query('SELECT ident FROM '.$db->prefix.'online') or error('Unable to fetch online list', __FILE__, __LINE__, $db->error());
 
 		if ($db->num_rows($result))
diff -urN punbb-1.2.7/upload/viewforum.php punbb-1.2.9/upload/viewforum.php
--- punbb-1.2.7/upload/viewforum.php	Tue Feb  1 17:16:46 2005
+++ punbb-1.2.9/upload/viewforum.php	Thu Sep 22 00:39:30 2005
@@ -242,7 +242,7 @@
 
 <div class="linksb">
 	<div class="inbox">
-		<p class="pagelink conl"><?php echo $lang_common['Pages'].': '.paginate($num_pages, $p, 'viewforum.php?id='.$id) ?></p>
+		<p class="pagelink conl"><?php echo $paging_links ?></p>
 <?php echo $post_link ?>
 		<ul><li><a href="index.php"><?php echo $lang_common['Index'] ?></a>&nbsp;</li><li>&raquo;&nbsp;<?php echo pun_htmlspecialchars($cur_forum['forum_name']) ?></li></ul>
 		<div class="clearer"></div>
