Merge branch 'mod-rewrite'

Conflicts:
	inc/lib/Twig/Extensions/Extension/Tinyboard.php
	install.php
	mod.php
	stylesheets/style.css
	templates/index.html
	templates/page.html
	templates/thread.html

59 files changed, 7312 insertions, 3524 deletions

diff --git a/inc/anti-bot.php b/inc/anti-bot.php
index 81afca1b..716e301c 100644
--- a/inc/anti-bot.php
+++ b/inc/anti-bot.php
@@ -19,7 +19,7 @@ class AntiBot {
 		if ($uppercase)
 			$chars .= 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
 		if ($special_chars)
-			$chars .= ' ~!@#$%^&*()_+,./;\'[]\\{}|:"<>?=-` ';
+			$chars .= ' ~!@#$%^&*()_+,./;\'[]\\{}|:<>?=-` ';
 		
 		$chars = str_split($chars);
 		
@@ -48,8 +48,9 @@ class AntiBot {
 		
 		foreach ($chars as &$c) {
 			if (rand(0, 2) != 0)
-				continue;
-			$c = mb_encode_numericentity($c, array(0, 0xffff, 0, 0xffff), 'UTF-8');
+				$c = utf8tohtml($c);
+			else
+				$c = mb_encode_numericentity($c, array(0, 0xffff, 0, 0xffff), 'UTF-8');
 		}
 		
 		return implode('', $chars);
diff --git a/inc/cache.php b/inc/cache.php
index 19e6b356..0bb73589 100644
--- a/inc/cache.php
+++ b/inc/cache.php
@@ -48,7 +48,7 @@ class Cache {
 		}
 		
 		// debug
-		if ($data && $config['debug']) {
+		if ($data !== false && $config['debug']) {
 			$debug['cached'][] = $key;
 		}
 		
diff --git a/inc/config.php b/inc/config.php
index 866fefae..cd5896fc 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -38,7 +38,6 @@
 	$config['check_updates_time'] = 43200; // 12 hours
 	
 	// Shows some extra information at the bottom of pages. Good for debugging development.
-	// Also experimental.
 	$config['debug'] = false;
 	// For development purposes. Turns 'display_errors' on. Not recommended for production.
 	$config['verbose_errors'] = true;
@@ -362,7 +361,7 @@
 	$config['markup'][] = array("/'''(.+?)'''/", "<strong>\$1</strong>");
 	$config['markup'][] = array("/''(.+?)''/", "<em>\$1</em>");
 	$config['markup'][] = array("/\*\*(.+?)\*\*/", "<span class=\"spoiler\">\$1</span>");
-	$config['markup'][] = array("/^\s*==(.+?)==\s*$/m", "<span class=\"heading\">\$1</span>");
+	$config['markup'][] = array("/^[ |\t]*==(.+?)==[ |\t]*$/m", "<span class=\"heading\">\$1</span>");
 	
 	// Highlight PHP code wrapped in <code> tags (PHP 5.3.0+)
 	// $config['markup'][] = array(
@@ -816,8 +815,6 @@
 	
 	// Do a DNS lookup on IP addresses to get their hostname on the IP summary page
 	$config['mod']['dns_lookup'] = true;
-	// Show ban form on the IP summary page
-	$config['mod']['ip_banform'] = true;
 	// How many recent posts, per board, to show in the IP summary page
 	$config['mod']['ip_recentposts'] = 5;
 	
@@ -826,12 +823,17 @@
 	
 	// How many actions to show per page in the moderation log
 	$config['mod']['modlog_page'] = 350;
+	// How many bans to show per page in the ban list
+	$config['mod']['banlist_page'] = 350;
+	
+	// Number of news entries to display per page
+	$config['mod']['news_page'] = 40;
 	
 	// Maximum number of results to display for a search, per board
 	$config['mod']['search_results'] = 75;
 	
-	// Maximum number of notices to display on the moderator noticeboard
-	$config['mod']['noticeboard_display'] = 50;
+	// How many entries to show per page in the moderator noticeboard
+	$config['mod']['noticeboard_page'] = 50;
 	// Number of entries to summarize and display on the dashboard
 	$config['mod']['noticeboard_dashboard'] = 5;
 	
@@ -867,7 +869,20 @@
  *  Mod permissions
  * ====================
  */
- 	
+ 
+ 	// Capcode permissions
+	$config['mod']['capcode'] = array(
+	//	JANITOR		=> array('Janitor'),
+		MOD		=> array('Mod'),
+		ADMIN		=> true
+	);
+	
+	// Example: Allow mods to post with "## Moderator" as well
+	// $config['mod']['capcode'][MOD][] = 'Moderator';
+	
+	// Example: Allow janitors to post with any capcode
+	// $config['mod']['capcode'][JANITOR] = true;
+ 
  	// Set any of the below to "DISABLED" to make them unavailable for everyone.
  
 	// Don't worry about per-board moderators. Let all mods moderate any board.
@@ -1043,6 +1058,4 @@
 	
 	// Complex regular expression to catch URLs
 	$config['url_regex'] = '/' . '(https?|ftp):\/\/' . '(([\w\-]+\.)+[a-zA-Z]{2,6}|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})' . '(:\d+)?' . '(\/([\w\-~.#\/?=&;:+%!*\[\]@$\'()+,|\^]+)?)?' . '/';
-	// INSANE regular expression for IPv6 addresses
-	$config['ipv6_regex'] = '((([0-9A-Fa-f]{1,4}:){7}([0-9A-Fa-f]{1,4}|:))|(([0-9A-Fa-f]{1,4}:){6}(:[0-9A-Fa-f]{1,4}|((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){5}(((:[0-9A-Fa-f]{1,4}){1,2})|:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})|:))|(([0-9A-Fa-f]{1,4}:){4}(((:[0-9A-Fa-f]{1,4}){1,3})|((:[0-9A-Fa-f]{1,4})?:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){3}(((:[0-9A-Fa-f]{1,4}){1,4})|((:[0-9A-Fa-f]{1,4}){0,2}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){2}(((:[0-9A-Fa-f]{1,4}){1,5})|((:[0-9A-Fa-f]{1,4}){0,3}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(([0-9A-Fa-f]{1,4}:){1}(((:[0-9A-Fa-f]{1,4}){1,6})|((:[0-9A-Fa-f]{1,4}){0,4}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:))|(:(((:[0-9A-Fa-f]{1,4}){1,7})|((:[0-9A-Fa-f]{1,4}){0,5}:((25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(\.(25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}))|:)))(%.+)?';
 
diff --git a/inc/filters.php b/inc/filters.php
index 7204614a..ab48598f 100644
--- a/inc/filters.php
+++ b/inc/filters.php
@@ -28,7 +28,7 @@ class Filter {
 			case 'name':
 				return preg_match($match, $post['name']);
 			case 'trip':
-				return preg_match($match, $post['trip']);
+				return $match === $post['trip'];
 			case 'email':
 				return preg_match($match, $post['email']);
 			case 'subject':
diff --git a/inc/functions.php b/inc/functions.php
index bd255b35..eedbf9b9 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -32,7 +32,30 @@ function loadConfig() {
 	if (!isset($_SERVER['REMOTE_ADDR']))
 		$_SERVER['REMOTE_ADDR'] = '0.0.0.0';
 	
-	$arrays = array('db', 'cache', 'cookies', 'error', 'dir', 'mod', 'spam', 'flood_filters', 'wordfilters', 'custom_capcode', 'custom_tripcode', 'dnsbl', 'dnsbl_exceptions', 'remote', 'allowed_ext', 'allowed_ext_files', 'file_icons', 'footer', 'stylesheets', 'additional_javascript', 'markup');
+	$arrays = array(
+		'db',
+		'cache',
+		'cookies',
+		'error',
+		'dir',
+		'mod',
+		'spam',
+		'flood_filters',
+		'wordfilters',
+		'custom_capcode',
+		'custom_tripcode',
+		'dnsbl',
+		'dnsbl_exceptions',
+		'remote',
+		'allowed_ext',
+		'allowed_ext_files',
+		'file_icons',
+		'footer',
+		'stylesheets',
+		'additional_javascript',
+		'markup',
+		'custom_pages'
+	);
 	
 	$config = array();
 	foreach ($arrays as $key) {
@@ -277,10 +300,13 @@ function setupBoard($array) {
 	
 	$board = array(
 		'uri' => $array['uri'],
-		'name' => $array['title'],
-		'title' => $array['subtitle']
+		'title' => $array['title'],
+		'subtitle' => $array['subtitle']
 	);
 	
+	// older versions
+	$board['name'] = &$board['title'];
+	
 	$board['dir'] = sprintf($config['board_path'], $board['uri']);
 	$board['url'] = sprintf($config['board_abbreviation'], $board['uri']);
 	
@@ -690,13 +716,13 @@ function post(array $post) {
 	$query->bindValue(':password', $post['password']);		
 	$query->bindValue(':ip', isset($post['ip']) ? $post['ip'] : $_SERVER['REMOTE_ADDR']);
 	
-	if ($post['mod'] && $post['sticky']) {
+	if ($post['op'] && $post['mod'] && $post['sticky']) {
 		$query->bindValue(':sticky', 1, PDO::PARAM_INT);
 	} else {
 		$query->bindValue(':sticky', 0, PDO::PARAM_INT);
 	}
 	
-	if ($post['mod'] && $post['locked']) {
+	if ($post['op'] && $post['mod'] && $post['locked']) {
 		$query->bindValue(':locked', 1, PDO::PARAM_INT);
 	} else {
 		$query->bindValue(':locked', 0, PDO::PARAM_INT);
@@ -777,12 +803,8 @@ function deleteFile($id, $remove_entirely_if_already=true) {
 	$query = prepare(sprintf("SELECT `thread`,`thumb`,`file` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri']));
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
-	
-	if ($query->rowCount() < 1) {
+	if (!$post = $query->fetch())
 		error($config['error']['invalidpost']);
-	}
-	
-	$post = $query->fetch();
 	
 	if ($post['file'] == 'deleted' && !$post['thread'])
 		return; // Can't delete OP's image completely.
@@ -801,13 +823,14 @@ function deleteFile($id, $remove_entirely_if_already=true) {
 		// Set file to 'deleted'
 		$query->bindValue(':file', 'deleted', PDO::PARAM_INT);
 	}
-	// Update database
 	
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
 	
 	if ($post['thread'])
 		buildThread($post['thread']);
+	else
+		buildThread($id);
 }
 
 // rebuild post (markup)
@@ -1179,6 +1202,7 @@ function buildIndex() {
 	global $board, $config;
 	
 	$pages = getPages();
+	$antibot = create_antibot($board['uri']);
 
 	$page = 1;
 	while ($page <= $config['max_pages'] && $content = index($page)) {
@@ -1188,7 +1212,7 @@ function buildIndex() {
 		$content['pages'] = $pages;
 		$content['pages'][$page-1]['selected'] = true;
 		$content['btn'] = getPageButtons($content['pages']);
-		$content['antibot'] = create_antibot($board['uri']);
+		$content['antibot'] = $antibot;
 		file_write($filename, Element('index.html', $content));
 		
 		if (isset($md5) && $md5 == md5_file($filename)) {
@@ -1370,8 +1394,10 @@ function markup(&$body, $track_cites = false) {
 	if ($config['auto_unicode']) {
 		$body = unicodify($body);
 	
-		foreach ($markup_urls as &$url) {
-			$body = str_replace(unicodify($url), $url, $body);
+		if ($config['markup_urls']) {
+			foreach ($markup_urls as &$url) {
+				$body = str_replace(unicodify($url), $url, $body);
+			}
 		}
 	}
 	
diff --git a/inc/lib/Twig/Extensions/Extension/Tinyboard.php b/inc/lib/Twig/Extensions/Extension/Tinyboard.php
index b515e8d2..0a128e7b 100644
--- a/inc/lib/Twig/Extensions/Extension/Tinyboard.php
+++ b/inc/lib/Twig/Extensions/Extension/Tinyboard.php
@@ -10,19 +10,22 @@ class Twig_Extensions_Extension_Tinyboard extends Twig_Extension
 	public function getFilters()
 	{
 		return Array(
-			'filesize' => new Twig_Filter_Function('format_bytes', Array('needs_environment' => false)),
-			'truncate' => new Twig_Filter_Function('twig_truncate_filter', array('needs_environment' => false)),
-			'truncate_body' => new Twig_Filter_Function('truncate', array('needs_environment' => false)),
-			'extension' => new Twig_Filter_Function('twig_extension_filter', array('needs_environment' => false)),
-			'sprintf' => new Twig_Filter_Function('sprintf', array('needs_environment' => false)),
-			'capcode' => new Twig_Filter_Function('capcode', array('needs_environment' => false)),
-			'hasPermission' => new Twig_Filter_Function('twig_hasPermission_filter', array('needs_environment' => false)),
-			'date' => new Twig_Filter_Function('twig_date_filter', array('needs_environment' => false)),
-			'poster_id' => new Twig_Filter_Function('poster_id', array('needs_environment' => false)),
-			'remove_whitespace' => new Twig_Filter_Function('twig_remove_whitespace_filter', array('needs_environment' => false)),
-			'count' => new Twig_Filter_Function('count', array('needs_environment' => false)),
-			'until' => new Twig_Filter_Function('until', array('needs_environment' => false)),
-			'addslashes' => new Twig_Filter_Function('addslashes', array('needs_environment' => false)),
+			'filesize' => new Twig_Filter_Function('format_bytes'),
+			'truncate' => new Twig_Filter_Function('twig_truncate_filter'),
+			'truncate_body' => new Twig_Filter_Function('truncate'),
+			'extension' => new Twig_Filter_Function('twig_extension_filter'),
+			'sprintf' => new Twig_Filter_Function('sprintf'),
+			'capcode' => new Twig_Filter_Function('capcode'),
+			'hasPermission' => new Twig_Filter_Function('twig_hasPermission_filter'),
+			'date' => new Twig_Filter_Function('twig_date_filter'),
+			'poster_id' => new Twig_Filter_Function('poster_id'),
+			'remove_whitespace' => new Twig_Filter_Function('twig_remove_whitespace_filter'),
+			'count' => new Twig_Filter_Function('count'),
+			'ago' => new Twig_Filter_Function('ago'),
+			'until' => new Twig_Filter_Function('until'),
+			'split' => new Twig_Filter_Function('twig_split_filter'),
+			'push' => new Twig_Filter_Function('twig_push_filter'),
+			'addslashes' => new Twig_Filter_Function('addslashes')
 		);
 	}
 	
@@ -34,10 +37,11 @@ class Twig_Extensions_Extension_Tinyboard extends Twig_Extension
 	public function getFunctions()
 	{
 		return Array(
-			'time' => new Twig_Filter_Function('time', array('needs_environment' => false)),
-			'timezone' => new Twig_Filter_Function('twig_timezone_function', array('needs_environment' => false)),
-			'hiddenInputs' => new Twig_Filter_Function('hiddenInputs', array('needs_environment' => false)),
-			'hiddenInputsHash' => new Twig_Filter_Function('hiddenInputsHash', array('needs_environment' => false))
+			'time' => new Twig_Filter_Function('time'),
+			'floor' => new Twig_Filter_Function('floor'),
+			'timezone' => new Twig_Filter_Function('twig_timezone_function'),
+			'hiddenInputs' => new Twig_Filter_Function('hiddenInputs'),
+			'hiddenInputsHash' => new Twig_Filter_Function('hiddenInputsHash'),
 		);
 	}
 	
@@ -57,6 +61,15 @@ function twig_timezone_function() {
 	return sprintf("%s%02d", ($hr = (int)floor(($tz = date('Z')) / 3600)) > 0 ? '+' : '-', abs($hr)) . ':' . sprintf("%02d", (($tz / 3600) - $hr) * 60);
 }
 
+function twig_split_filter($str, $delim) {
+	return explode($delim, $str);
+}
+
+function twig_push_filter($array, $value) {
+	array_push($array, $value);
+	return $array;
+}
+
 function twig_remove_whitespace_filter($data) {
 	return preg_replace('/[\t\r\n]/', '', $data);
 }
@@ -65,7 +78,7 @@ function twig_date_filter($date, $format) {
 	return strftime($format, $date);
 }
 
-function twig_hasPermission_filter($mod, $permission, $board) {
+function twig_hasPermission_filter($mod, $permission, $board = null) {
 	return hasPermission($permission, $board, $mod);
 }
 
diff --git a/inc/mod-old.php b/inc/mod-old.php
new file mode 100644
index 00000000..9065bb82
--- /dev/null
+++ b/inc/mod-old.php
@@ -0,0 +1,287 @@
+<?php
+
+/*
+ *  Copyright (c) 2010-2012 Tinyboard Development Group
+ */
+
+if (realpath($_SERVER['SCRIPT_FILENAME']) == str_replace('\\', '/', __FILE__)) {
+	// You cannot request this file directly.
+	exit;
+}
+
+// create a hash/salt pair for validate logins
+function mkhash($username, $password, $salt = false) {
+	global $config;
+	
+	if (!$salt) {
+		// create some sort of salt for the hash
+		$salt = substr(base64_encode(sha1(rand() . time(), true) . $config['cookies']['salt']), 0, 15);
+		
+		$generated_salt = true;
+	}
+	
+	// generate hash (method is not important as long as it's strong)
+	$hash = substr(base64_encode(md5($username . sha1($username . $password . $salt . ($config['mod']['lock_ip'] ? $_SERVER['REMOTE_ADDR'] : ''), true), true)), 0, 20);
+	
+	if (isset($generated_salt))
+		return Array($hash, $salt);
+	else
+		return $hash;
+}
+
+function login($username, $password, $makehash=true) {
+	global $mod;
+	
+	// SHA1 password
+	if ($makehash) {
+		$password = sha1($password);
+	}
+	
+	$query = prepare("SELECT `id`,`type`,`boards` FROM `mods` WHERE `username` = :username AND `password` = :password LIMIT 1");
+	$query->bindValue(':username', $username);
+	$query->bindValue(':password', $password);
+	$query->execute() or error(db_error($query));
+	
+	if ($user = $query->fetch()) {
+		return $mod = Array(
+			'id' => $user['id'],
+			'type' => $user['type'],
+			'username' => $username,
+			'hash' => mkhash($username, $password),
+			'boards' => explode(',', $user['boards'])
+			);
+	} else return false;
+}
+
+function setCookies() {
+	global $mod, $config;
+	if (!$mod)
+		error('setCookies() was called for a non-moderator!');
+	
+	setcookie($config['cookies']['mod'],
+			$mod['username'] . // username
+			':' . 
+			$mod['hash'][0] . // password
+			':' .
+			$mod['hash'][1], // salt
+		time() + $config['cookies']['expire'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, true);
+}
+
+function destroyCookies() {
+	global $config;
+	// Delete the cookies
+	setcookie($config['cookies']['mod'], 'deleted', time() - $config['cookies']['expire'], $config['cookies']['jail']?$config['cookies']['path'] : '/', null, false, true);
+}
+
+function create_pm_header() {
+	global $mod;
+	$query = prepare("SELECT `id` FROM `pms` WHERE `to` = :id AND `unread` = 1");
+	$query->bindValue(':id', $mod['id'], PDO::PARAM_INT);
+	$query->execute() or error(db_error($query));
+	
+	if ($pm = $query->fetch()) {
+		return Array('id' => $pm['id'], 'waiting' => $query->rowCount() - 1);
+	}
+	
+	return false;
+}
+
+function modLog($action, $_board=null) {
+	global $mod, $board, $config;
+	$query = prepare("INSERT INTO `modlogs` VALUES (:id, :ip, :board, :time, :text)");
+	$query->bindValue(':id', $mod['id'], PDO::PARAM_INT);
+	$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
+	$query->bindValue(':time', time(), PDO::PARAM_INT);
+	$query->bindValue(':text', $action);
+	if (isset($_board))
+		$query->bindValue(':board', $_board);
+	elseif (isset($board))
+		$query->bindValue(':board', $board['uri']);
+	else
+		$query->bindValue(':board', null, PDO::PARAM_NULL);
+	$query->execute() or error(db_error($query));
+	
+	if ($config['syslog'])
+		_syslog(LOG_INFO, '[mod/' . $mod['username'] . ']: ' . $action);
+}
+
+// Generates a <ul> element with a list of linked
+// boards and their subtitles. (without the <ul> opening and ending tags)
+function ulBoards() {
+	global $mod, $config;
+	
+	$body = '';
+	
+	// List of boards
+	$boards = listBoards();
+	
+	foreach ($boards as &$b) {
+		$body .= '<li>' . 
+			'<a href="?/' .
+					sprintf($config['board_path'], $b['uri']) . $config['file_index'] .
+					'">' .
+				sprintf($config['board_abbreviation'], $b['uri']) .
+				'</a> - ' .
+				$b['title'] .
+				(isset($b['subtitle']) ? '<span class="unimportant"> — ' . $b['subtitle'] . '</span>' : '') . 
+					($mod['type'] >= $config['mod']['manageboards'] ?
+						' <a href="?/' . $b['uri'] . '/edit" class="unimportant">[manage]</a>' : '') .
+			'</li>';
+	}
+	
+	if ($mod['type'] >= $config['mod']['newboard']) {
+		$body .= '<li style="margin-top:15px;"><a href="?/new"><strong>' . _('Create new board') . '</strong></a></li>';
+	}
+	return $body;
+}
+
+function form_newBan($ip=null, $reason='', $continue=false, $delete=false, $board=false, $allow_public = false) {
+	global $config, $mod;
+	
+	$boards = listBoards();
+	$__boards = '<li><input type="radio" checked="checked" name="board" id="board_*" value=""/> <label style="display:inline" for="board_*"><em>' . _('all boards') . '</em></label></li>';
+	foreach ($boards as &$_board) {
+		$__boards .= '<li>' .
+					'<input type="radio" name="board" id="board_' . $_board['uri'] . '" value="' . $_board['uri'] . '">' .
+					'<label style="display:inline" for="board_' . $_board['uri'] . '"> ' .
+						($_board['uri'] == '*' ?
+							'<em>"*"</em>'
+						:
+							sprintf($config['board_abbreviation'], $_board['uri'])
+						) .
+						' - ' . $_board['title'] .
+					'</label>' .
+					'</li>';
+	}
+	
+	return '<fieldset><legend>New ban</legend>' . 
+				'<form action="?/ban" method="post">' . 
+					($continue ? '<input type="hidden" name="continue" value="' . htmlentities($continue) . '" />' : '') .
+					($delete || $allow_public ? '<input type="hidden" name="' . (!$allow_public ? 'delete' : 'post') . '" value="' . htmlentities($delete) . '" />' : '') .
+					($board ? '<input type="hidden" name="board" value="' . htmlentities($board) . '" />' : '') .
+					'<table>' .
+					'<tr>' . 
+						'<th><label for="ip">IP ' .
+							($config['ban_cidr'] ? '<span class="unimportant">(or subnet)' : '') .
+						'</span></label></th>' .
+						'<td><input type="text" name="ip" id="ip" size="30" maxlength="30" ' . 
+							(isset($ip) ?
+								'value="' . htmlentities($ip) . '" ' : ''
+							) .
+						'/></td>' .
+					'</tr>' . 
+					'<tr>' . 
+						'<th><label for="reason">Reason</label></th>' .
+						'<td><textarea name="reason" id="reason" rows="5" cols="30">' .
+							htmlentities($reason) .
+						'</textarea></td>' .
+					'</tr>' . 
+					($mod['type'] >= $config['mod']['public_ban'] && $allow_public ?
+						'<tr>' . 
+							'<th><label for="message">Message</label></th>' .
+							'<td><input type="checkbox" id="public_message" name="public_message"/>' .
+							' <input type="text" name="message" id="message" size="35" maxlength="200" value="' . htmlentities($config['mod']['default_ban_message']) . '" />' .
+							' <span class="unimportant">(public; attached to post)</span></td>' .
+								'<script type="text/javascript">' . 
+									'document.getElementById(\'message\').disabled = true;' .
+									'document.getElementById(\'public_message\').onchange = function() {' . 
+										'document.getElementById(\'message\').disabled = !this.checked;' .
+									'}' . 
+									
+								'</script>' .
+						'</tr>'
+					: '') .
+					'<tr>' . 
+						'<th><label for="length">Length</label></th>' .
+						'<td><input type="text" name="length" id="length" size="20" maxlength="40" />' .
+						' <span class="unimportant">(eg. "2d1h30m" or "2 days")</span></td>' .
+					'</tr>' . 
+					
+					'<tr>' . 
+						'<th>Board</th>' .
+						'<td><ul style="list-style:none;padding:2px 5px">' . $__boards . '</tl></td>' .
+					'</tr>' . 
+					
+					'<tr>' . 
+						'<td></td>' . 
+						'<td><input name="new_ban" type="submit" value="New Ban" /></td>' . 
+					'</tr>' . 
+					'</table>' .
+				'</form>' .
+			'</fieldset>';
+}
+
+function form_newBoard() {
+	return '<fieldset><legend>New board</legend>' . 
+				'<form action="?/new" method="post">' . 
+					'<table>' .
+					'<tr>' . 
+						'<th><label for="board">URI</label></th>' .
+						'<td><input type="text" name="uri" id="board" size="10" />' .
+						' <span class="unimportant">(eg. "b"; "mu")</span></td>' .
+					'</tr>' . 
+					'<tr>' . 
+						'<th><label for="title">Title</label></th>' .
+						'<td><input type="text" name="title" id="title" size="25" />' .
+						' <span class="unimportant">(eg. "Random")</span></td>' .
+					'</tr>' . 
+					'<tr>' . 
+						'<th><label for="subtitle">Subtitle</label></th>' .
+						'<td><input type="text" name="subtitle" id="subtitle" size="25" />' .
+						' <span class="unimportant">(optional)</span></td>' .
+					'</tr>' . 
+					'<tr>' . 
+						'<td></td>' . 
+						'<td><input name="new_board" type="submit" value="New Board" /></td>' . 
+					'</tr>' . 
+					'</table>' .
+				'</form>' .
+			'</fieldset>';
+}
+
+
+function removeBan($id) {
+	global $config, $memcached;
+	
+	$query = prepare("DELETE FROM `bans` WHERE `id` = :id");
+	$query->bindValue(':id', $id, PDO::PARAM_INT);
+	$query->execute() or error(db_error($query));
+	
+	//if ($config['memcached']['enabled']) {
+		// Remove cached ban
+		// TODO
+	//	$memcached->delete("ban_{$id}");
+	//}
+}
+
+
+// Validate session
+
+if (isset($_COOKIE[$config['cookies']['mod']])) {
+	// Should be username:hash:salt
+	$cookie = explode(':', $_COOKIE[$config['cookies']['mod']]);
+	if (count($cookie) != 3) {
+		destroyCookies();
+		error($config['error']['malformed']);
+	}
+	
+	$query = prepare("SELECT `id`, `type`, `boards`, `password` FROM `mods` WHERE `username` = :username LIMIT 1");
+	$query->bindValue(':username', $cookie[0]);
+	$query->execute() or error(db_error($query));
+	$user = $query->fetch();
+	
+	// validate password hash
+	if ($cookie[1] != mkhash($cookie[0], $user['password'], $cookie[2])) {
+		// Malformed cookies
+		destroyCookies();
+		error($config['error']['malformed']);
+	}
+	
+	$mod = Array(
+		'id' => $user['id'],
+		'type' => $user['type'],
+		'username' => $cookie[0],
+		'boards' => explode(',', $user['boards'])
+	);
+}
+
diff --git a/inc/mod.php b/inc/mod.php
index 9065bb82..7b95d05d 100644
--- a/inc/mod.php
+++ b/inc/mod.php
@@ -4,284 +4,12 @@
  *  Copyright (c) 2010-2012 Tinyboard Development Group
  */
 
+// WARNING: Including this file is DEPRECIATED. It's only here to support older versions and won't exist forever.
+
 if (realpath($_SERVER['SCRIPT_FILENAME']) == str_replace('\\', '/', __FILE__)) {
 	// You cannot request this file directly.
 	exit;
 }
 
-// create a hash/salt pair for validate logins
-function mkhash($username, $password, $salt = false) {
-	global $config;
-	
-	if (!$salt) {
-		// create some sort of salt for the hash
-		$salt = substr(base64_encode(sha1(rand() . time(), true) . $config['cookies']['salt']), 0, 15);
-		
-		$generated_salt = true;
-	}
-	
-	// generate hash (method is not important as long as it's strong)
-	$hash = substr(base64_encode(md5($username . sha1($username . $password . $salt . ($config['mod']['lock_ip'] ? $_SERVER['REMOTE_ADDR'] : ''), true), true)), 0, 20);
-	
-	if (isset($generated_salt))
-		return Array($hash, $salt);
-	else
-		return $hash;
-}
-
-function login($username, $password, $makehash=true) {
-	global $mod;
-	
-	// SHA1 password
-	if ($makehash) {
-		$password = sha1($password);
-	}
-	
-	$query = prepare("SELECT `id`,`type`,`boards` FROM `mods` WHERE `username` = :username AND `password` = :password LIMIT 1");
-	$query->bindValue(':username', $username);
-	$query->bindValue(':password', $password);
-	$query->execute() or error(db_error($query));
-	
-	if ($user = $query->fetch()) {
-		return $mod = Array(
-			'id' => $user['id'],
-			'type' => $user['type'],
-			'username' => $username,
-			'hash' => mkhash($username, $password),
-			'boards' => explode(',', $user['boards'])
-			);
-	} else return false;
-}
-
-function setCookies() {
-	global $mod, $config;
-	if (!$mod)
-		error('setCookies() was called for a non-moderator!');
-	
-	setcookie($config['cookies']['mod'],
-			$mod['username'] . // username
-			':' . 
-			$mod['hash'][0] . // password
-			':' .
-			$mod['hash'][1], // salt
-		time() + $config['cookies']['expire'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, true);
-}
-
-function destroyCookies() {
-	global $config;
-	// Delete the cookies
-	setcookie($config['cookies']['mod'], 'deleted', time() - $config['cookies']['expire'], $config['cookies']['jail']?$config['cookies']['path'] : '/', null, false, true);
-}
-
-function create_pm_header() {
-	global $mod;
-	$query = prepare("SELECT `id` FROM `pms` WHERE `to` = :id AND `unread` = 1");
-	$query->bindValue(':id', $mod['id'], PDO::PARAM_INT);
-	$query->execute() or error(db_error($query));
-	
-	if ($pm = $query->fetch()) {
-		return Array('id' => $pm['id'], 'waiting' => $query->rowCount() - 1);
-	}
-	
-	return false;
-}
-
-function modLog($action, $_board=null) {
-	global $mod, $board, $config;
-	$query = prepare("INSERT INTO `modlogs` VALUES (:id, :ip, :board, :time, :text)");
-	$query->bindValue(':id', $mod['id'], PDO::PARAM_INT);
-	$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
-	$query->bindValue(':time', time(), PDO::PARAM_INT);
-	$query->bindValue(':text', $action);
-	if (isset($_board))
-		$query->bindValue(':board', $_board);
-	elseif (isset($board))
-		$query->bindValue(':board', $board['uri']);
-	else
-		$query->bindValue(':board', null, PDO::PARAM_NULL);
-	$query->execute() or error(db_error($query));
-	
-	if ($config['syslog'])
-		_syslog(LOG_INFO, '[mod/' . $mod['username'] . ']: ' . $action);
-}
-
-// Generates a <ul> element with a list of linked
-// boards and their subtitles. (without the <ul> opening and ending tags)
-function ulBoards() {
-	global $mod, $config;
-	
-	$body = '';
-	
-	// List of boards
-	$boards = listBoards();
-	
-	foreach ($boards as &$b) {
-		$body .= '<li>' . 
-			'<a href="?/' .
-					sprintf($config['board_path'], $b['uri']) . $config['file_index'] .
-					'">' .
-				sprintf($config['board_abbreviation'], $b['uri']) .
-				'</a> - ' .
-				$b['title'] .
-				(isset($b['subtitle']) ? '<span class="unimportant"> — ' . $b['subtitle'] . '</span>' : '') . 
-					($mod['type'] >= $config['mod']['manageboards'] ?
-						' <a href="?/' . $b['uri'] . '/edit" class="unimportant">[manage]</a>' : '') .
-			'</li>';
-	}
-	
-	if ($mod['type'] >= $config['mod']['newboard']) {
-		$body .= '<li style="margin-top:15px;"><a href="?/new"><strong>' . _('Create new board') . '</strong></a></li>';
-	}
-	return $body;
-}
-
-function form_newBan($ip=null, $reason='', $continue=false, $delete=false, $board=false, $allow_public = false) {
-	global $config, $mod;
-	
-	$boards = listBoards();
-	$__boards = '<li><input type="radio" checked="checked" name="board" id="board_*" value=""/> <label style="display:inline" for="board_*"><em>' . _('all boards') . '</em></label></li>';
-	foreach ($boards as &$_board) {
-		$__boards .= '<li>' .
-					'<input type="radio" name="board" id="board_' . $_board['uri'] . '" value="' . $_board['uri'] . '">' .
-					'<label style="display:inline" for="board_' . $_board['uri'] . '"> ' .
-						($_board['uri'] == '*' ?
-							'<em>"*"</em>'
-						:
-							sprintf($config['board_abbreviation'], $_board['uri'])
-						) .
-						' - ' . $_board['title'] .
-					'</label>' .
-					'</li>';
-	}
-	
-	return '<fieldset><legend>New ban</legend>' . 
-				'<form action="?/ban" method="post">' . 
-					($continue ? '<input type="hidden" name="continue" value="' . htmlentities($continue) . '" />' : '') .
-					($delete || $allow_public ? '<input type="hidden" name="' . (!$allow_public ? 'delete' : 'post') . '" value="' . htmlentities($delete) . '" />' : '') .
-					($board ? '<input type="hidden" name="board" value="' . htmlentities($board) . '" />' : '') .
-					'<table>' .
-					'<tr>' . 
-						'<th><label for="ip">IP ' .
-							($config['ban_cidr'] ? '<span class="unimportant">(or subnet)' : '') .
-						'</span></label></th>' .
-						'<td><input type="text" name="ip" id="ip" size="30" maxlength="30" ' . 
-							(isset($ip) ?
-								'value="' . htmlentities($ip) . '" ' : ''
-							) .
-						'/></td>' .
-					'</tr>' . 
-					'<tr>' . 
-						'<th><label for="reason">Reason</label></th>' .
-						'<td><textarea name="reason" id="reason" rows="5" cols="30">' .
-							htmlentities($reason) .
-						'</textarea></td>' .
-					'</tr>' . 
-					($mod['type'] >= $config['mod']['public_ban'] && $allow_public ?
-						'<tr>' . 
-							'<th><label for="message">Message</label></th>' .
-							'<td><input type="checkbox" id="public_message" name="public_message"/>' .
-							' <input type="text" name="message" id="message" size="35" maxlength="200" value="' . htmlentities($config['mod']['default_ban_message']) . '" />' .
-							' <span class="unimportant">(public; attached to post)</span></td>' .
-								'<script type="text/javascript">' . 
-									'document.getElementById(\'message\').disabled = true;' .
-									'document.getElementById(\'public_message\').onchange = function() {' . 
-										'document.getElementById(\'message\').disabled = !this.checked;' .
-									'}' . 
-									
-								'</script>' .
-						'</tr>'
-					: '') .
-					'<tr>' . 
-						'<th><label for="length">Length</label></th>' .
-						'<td><input type="text" name="length" id="length" size="20" maxlength="40" />' .
-						' <span class="unimportant">(eg. "2d1h30m" or "2 days")</span></td>' .
-					'</tr>' . 
-					
-					'<tr>' . 
-						'<th>Board</th>' .
-						'<td><ul style="list-style:none;padding:2px 5px">' . $__boards . '</tl></td>' .
-					'</tr>' . 
-					
-					'<tr>' . 
-						'<td></td>' . 
-						'<td><input name="new_ban" type="submit" value="New Ban" /></td>' . 
-					'</tr>' . 
-					'</table>' .
-				'</form>' .
-			'</fieldset>';
-}
-
-function form_newBoard() {
-	return '<fieldset><legend>New board</legend>' . 
-				'<form action="?/new" method="post">' . 
-					'<table>' .
-					'<tr>' . 
-						'<th><label for="board">URI</label></th>' .
-						'<td><input type="text" name="uri" id="board" size="10" />' .
-						' <span class="unimportant">(eg. "b"; "mu")</span></td>' .
-					'</tr>' . 
-					'<tr>' . 
-						'<th><label for="title">Title</label></th>' .
-						'<td><input type="text" name="title" id="title" size="25" />' .
-						' <span class="unimportant">(eg. "Random")</span></td>' .
-					'</tr>' . 
-					'<tr>' . 
-						'<th><label for="subtitle">Subtitle</label></th>' .
-						'<td><input type="text" name="subtitle" id="subtitle" size="25" />' .
-						' <span class="unimportant">(optional)</span></td>' .
-					'</tr>' . 
-					'<tr>' . 
-						'<td></td>' . 
-						'<td><input name="new_board" type="submit" value="New Board" /></td>' . 
-					'</tr>' . 
-					'</table>' .
-				'</form>' .
-			'</fieldset>';
-}
-
-
-function removeBan($id) {
-	global $config, $memcached;
-	
-	$query = prepare("DELETE FROM `bans` WHERE `id` = :id");
-	$query->bindValue(':id', $id, PDO::PARAM_INT);
-	$query->execute() or error(db_error($query));
-	
-	//if ($config['memcached']['enabled']) {
-		// Remove cached ban
-		// TODO
-	//	$memcached->delete("ban_{$id}");
-	//}
-}
-
-
-// Validate session
-
-if (isset($_COOKIE[$config['cookies']['mod']])) {
-	// Should be username:hash:salt
-	$cookie = explode(':', $_COOKIE[$config['cookies']['mod']]);
-	if (count($cookie) != 3) {
-		destroyCookies();
-		error($config['error']['malformed']);
-	}
-	
-	$query = prepare("SELECT `id`, `type`, `boards`, `password` FROM `mods` WHERE `username` = :username LIMIT 1");
-	$query->bindValue(':username', $cookie[0]);
-	$query->execute() or error(db_error($query));
-	$user = $query->fetch();
-	
-	// validate password hash
-	if ($cookie[1] != mkhash($cookie[0], $user['password'], $cookie[2])) {
-		// Malformed cookies
-		destroyCookies();
-		error($config['error']['malformed']);
-	}
-	
-	$mod = Array(
-		'id' => $user['id'],
-		'type' => $user['type'],
-		'username' => $cookie[0],
-		'boards' => explode(',', $user['boards'])
-	);
-}
+require 'inc/mod/auth.php';
 
diff --git a/inc/mod/auth.php b/inc/mod/auth.php
new file mode 100644
index 00000000..d200c23f
--- /dev/null
+++ b/inc/mod/auth.php
@@ -0,0 +1,152 @@
+<?php
+
+/*
+ *  Copyright (c) 2010-2012 Tinyboard Development Group
+ */
+
+if (realpath($_SERVER['SCRIPT_FILENAME']) == str_replace('\\', '/', __FILE__)) {
+	// You cannot request this file directly.
+	exit;
+}
+
+// create a hash/salt pair for validate logins
+function mkhash($username, $password, $salt = false) {
+	global $config;
+	
+	if (!$salt) {
+		// create some sort of salt for the hash
+		$salt = substr(base64_encode(sha1(rand() . time(), true) . $config['cookies']['salt']), 0, 15);
+		
+		$generated_salt = true;
+	}
+	
+	// generate hash (method is not important as long as it's strong)
+	$hash = substr(base64_encode(md5($username . sha1($username . $password . $salt . ($config['mod']['lock_ip'] ? $_SERVER['REMOTE_ADDR'] : ''), true), true)), 0, 20);
+	
+	if (isset($generated_salt))
+		return Array($hash, $salt);
+	else
+		return $hash;
+}
+
+function login($username, $password, $makehash=true) {
+	global $mod;
+	
+	// SHA1 password
+	if ($makehash) {
+		$password = sha1($password);
+	}
+	
+	$query = prepare("SELECT `id`,`type`,`boards` FROM `mods` WHERE `username` = :username AND `password` = :password LIMIT 1");
+	$query->bindValue(':username', $username);
+	$query->bindValue(':password', $password);
+	$query->execute() or error(db_error($query));
+	
+	if ($user = $query->fetch()) {
+		return $mod = Array(
+			'id' => $user['id'],
+			'type' => $user['type'],
+			'username' => $username,
+			'hash' => mkhash($username, $password),
+			'boards' => explode(',', $user['boards'])
+			);
+	} else return false;
+}
+
+function setCookies() {
+	global $mod, $config;
+	if (!$mod)
+		error('setCookies() was called for a non-moderator!');
+	
+	setcookie($config['cookies']['mod'],
+			$mod['username'] . // username
+			':' . 
+			$mod['hash'][0] . // password
+			':' .
+			$mod['hash'][1], // salt
+		time() + $config['cookies']['expire'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, true);
+}
+
+function destroyCookies() {
+	global $config;
+	// Delete the cookies
+	setcookie($config['cookies']['mod'], 'deleted', time() - $config['cookies']['expire'], $config['cookies']['jail']?$config['cookies']['path'] : '/', null, false, true);
+}
+
+function modLog($action, $_board=null) {
+	global $mod, $board, $config;
+	$query = prepare("INSERT INTO `modlogs` VALUES (:id, :ip, :board, :time, :text)");
+	$query->bindValue(':id', $mod['id'], PDO::PARAM_INT);
+	$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
+	$query->bindValue(':time', time(), PDO::PARAM_INT);
+	$query->bindValue(':text', $action);
+	if (isset($_board))
+		$query->bindValue(':board', $_board);
+	elseif (isset($board))
+		$query->bindValue(':board', $board['uri']);
+	else
+		$query->bindValue(':board', null, PDO::PARAM_NULL);
+	$query->execute() or error(db_error($query));
+	
+	if ($config['syslog'])
+		_syslog(LOG_INFO, '[mod/' . $mod['username'] . ']: ' . $action);
+}
+
+// Validate session
+
+if (isset($_COOKIE[$config['cookies']['mod']])) {
+	// Should be username:hash:salt
+	$cookie = explode(':', $_COOKIE[$config['cookies']['mod']]);
+	if (count($cookie) != 3) {
+		destroyCookies();
+		error($config['error']['malformed']);
+	}
+	
+	$query = prepare("SELECT `id`, `type`, `boards`, `password` FROM `mods` WHERE `username` = :username LIMIT 1");
+	$query->bindValue(':username', $cookie[0]);
+	$query->execute() or error(db_error($query));
+	$user = $query->fetch();
+	
+	// validate password hash
+	if ($cookie[1] != mkhash($cookie[0], $user['password'], $cookie[2])) {
+		// Malformed cookies
+		destroyCookies();
+		error($config['error']['malformed']);
+	}
+	
+	$mod = Array(
+		'id' => $user['id'],
+		'type' => $user['type'],
+		'username' => $cookie[0],
+		'boards' => explode(',', $user['boards'])
+	);
+}
+
+function create_pm_header() {
+	global $mod, $config;
+	
+	if ($config['cache']['enabled'] && ($header = cache::get('pm_unread_' . $mod['id'])) !== false) {
+		if ($header === true)
+			return false;
+	
+		return $header;
+	}
+	
+	$query = prepare("SELECT `id` FROM `pms` WHERE `to` = :id AND `unread` = 1");
+	$query->bindValue(':id', $mod['id'], PDO::PARAM_INT);
+	$query->execute() or error(db_error($query));
+	
+	if ($pm = $query->fetch())
+		$header = Array('id' => $pm['id'], 'waiting' => $query->rowCount() - 1);
+	else
+		$header = true;
+	
+	if ($config['cache']['enabled'])
+		cache::set('pm_unread_' . $mod['id'], $header);
+	
+	if ($header === true)
+		return false;
+	
+	return $header;
+}
+
diff --git a/inc/mod/ban.php b/inc/mod/ban.php
new file mode 100644
index 00000000..51befe27
--- /dev/null
+++ b/inc/mod/ban.php
@@ -0,0 +1,95 @@
+<?php
+
+/*
+ *  Copyright (c) 2010-2012 Tinyboard Development Group
+ */
+
+if (realpath($_SERVER['SCRIPT_FILENAME']) == str_replace('\\', '/', __FILE__)) {
+	// You cannot request this file directly.
+	exit;
+}
+
+function parse_time($str) {
+	if (empty($str))
+		return false;
+	
+	if (($time = @strtotime($str)) !== false)
+		return $time;
+	
+	if (!preg_match('/^((\d+)\s?ye?a?r?s?)?\s?+((\d+)\s?mon?t?h?s?)?\s?+((\d+)\s?we?e?k?s?)?\s?+((\d+)\s?da?y?s?)?((\d+)\s?ho?u?r?s?)?\s?+((\d+)\s?mi?n?u?t?e?s?)?\s?+((\d+)\s?se?c?o?n?d?s?)?$/', $str, $matches))
+		return false;
+	
+	$expire = 0;
+	
+	if (isset($matches[2])) {
+		// Years
+		$expire += $matches[2]*60*60*24*365;
+	}
+	if (isset($matches[4])) {
+		// Months
+		$expire += $matches[4]*60*60*24*30;
+	}
+	if (isset($matches[6])) {
+		// Weeks
+		$expire += $matches[6]*60*60*24*7;
+	}
+	if (isset($matches[8])) {
+		// Days
+		$expire += $matches[8]*60*60*24;
+	}
+	if (isset($matches[10])) {
+		// Hours
+		$expire += $matches[10]*60*60;
+	}
+	if (isset($matches[12])) {
+		// Minutes
+		$expire += $matches[12]*60;
+	}
+	if (isset($matches[14])) {
+		// Seconds
+		$expire += $matches[14];
+	}
+	
+	return time() + $expire;
+}
+
+function ban($mask, $reason, $length, $board) {
+	global $mod, $pdo;
+	
+	$query = prepare("INSERT INTO `bans` VALUES (NULL, :ip, :mod, :time, :expires, :reason, :board)");
+	$query->bindValue(':ip', $mask);
+	$query->bindValue(':mod', $mod['id']);
+	$query->bindValue(':time', time());
+	if ($reason !== '') {
+		markup($reason);
+		$query->bindValue(':reason', $reason);
+	} else
+		$query->bindValue(':reason', null, PDO::PARAM_NULL);
+	
+	if ($length > 0)
+		$query->bindValue(':expires', $length);
+	else
+		$query->bindValue(':expires', null, PDO::PARAM_NULL);
+	
+	if ($board)
+		$query->bindValue(':board', $board);
+	else
+		$query->bindValue(':board', null, PDO::PARAM_NULL);
+	
+	$query->execute() or error(db_error($query));
+	
+	modLog('Created a new ' .
+		($length > 0 ? preg_replace('/^(\d+) (\w+?)s?$/', '$1-$2', until($length)) : 'permanent') .
+		' ban (<small>#' . $pdo->lastInsertId() . '</small>) for ' .
+		(filter_var($mask, FILTER_VALIDATE_IP) !== false ? "<a href=\"?/IP/$mask\">$mask</a>" : utf8tohtml($mask)) .
+		' with ' . ($reason ? 'reason: ' . utf8tohtml($reason) . '' : 'no reason'));
+}
+
+function unban($id) {	
+	$query = prepare("DELETE FROM `bans` WHERE `id` = :id");
+	$query->bindValue(':id', $id);
+	$query->execute() or error(db_error($query));
+	
+	modLog("Removed ban #{$id}");
+}
+
diff --git a/inc/mod/config-editor.php b/inc/mod/config-editor.php
new file mode 100644
index 00000000..484bd908
--- /dev/null
+++ b/inc/mod/config-editor.php
@@ -0,0 +1,75 @@
+<?php
+
+function config_vars() {
+	global $config;
+	
+	$config_file = file('inc/config.php', FILE_IGNORE_NEW_LINES);
+	$conf = array();
+	
+	$var = array(
+		'name' => false,
+		'comment' => array(),
+		'default' => false,
+		'default_temp' => false
+	);
+	$temp_comment = false;
+	foreach ($config_file as $line) {
+		if ($temp_comment) {
+			$var['comment'][] = $temp_comment;
+			$temp_comment = false;
+		}
+		
+		if (preg_match('!^\s*// (.*)$!', $line, $matches)) {
+			if ($var['default'] !== false) {
+				$line = '';
+				$temp_comment = $matches[1];
+			} else {
+				$var['comment'][] = $matches[1];
+			}
+		} else if ($var['default_temp'] !== false) {
+			$var['default_temp'] .= "\n" . $line;
+		} elseif (preg_match('!^\s*\$config\[(.+?)\] = (.+?)(;( //.+)?)?$!', $line, $matches)) {
+			$var['name'] = explode('][', $matches[1]);
+			if (count($var['name']) == 1) {
+				$var['name'] = preg_replace('/^\'(.*)\'$/', '$1', end($var['name']));
+			} else {
+				foreach ($var['name'] as &$i)
+					$i = preg_replace('/^\'(.*)\'$/', '$1', $i);
+			}
+			
+			if (isset($matches[3]))
+				$var['default'] = $matches[2];
+			else
+				$var['default_temp'] = $matches[2];
+		}
+		
+		if (trim($line) === '') {
+			if ($var['name'] !== false) {
+				if ($var['default_temp'])
+					$var['default'] = $var['default_temp'];
+				
+				$temp = eval('return ' . $var['default'] . ';');
+				if (!isset($temp))
+					$var['type'] = 'unknown';
+				else
+					$var['type'] = gettype($temp);
+				
+				unset($var['default_temp']);
+				
+				if (!is_array($var['name']) || (end($var['name']) != '' && !in_array(reset($var['name']), array('stylesheets')))) {
+					$conf[] = $var;
+				}
+			}
+			
+			$var = array(
+				'name' => false,
+				'comment' => array(),
+				'default' => false,
+				'default_temp' => false
+			);
+		}
+	}
+	
+	return $conf;
+}
+
diff --git a/inc/mod/pages.php b/inc/mod/pages.php
new file mode 100644
index 00000000..ad69ae39
--- /dev/null
+++ b/inc/mod/pages.php
@@ -0,0 +1,1796 @@
+<?php
+
+/*
+ *  Copyright (c) 2010-2012 Tinyboard Development Group
+ */
+
+if (realpath($_SERVER['SCRIPT_FILENAME']) == str_replace('\\', '/', __FILE__)) {
+	// You cannot request this file directly.
+	exit;
+}
+
+function mod_page($title, $template, $args, $subtitle = false) {
+	global $config, $mod;
+	
+	echo Element('page.html', array(
+		'config' => $config,
+		'mod' => $mod,
+		'hide_dashboard_link' => $template == 'mod/dashboard.html',
+		'title' => $title,
+		'subtitle' => $subtitle,
+		'body' => Element($template,
+				array_merge(
+					array('config' => $config, 'mod' => $mod), 
+					$args
+				)
+			)
+		)
+	);
+}
+
+function mod_login() {
+	global $config;
+	
+	$args = array();
+	
+	if (isset($_POST['login'])) {
+		// Check if inputs are set and not empty
+		if (!isset($_POST['username'], $_POST['password']) || $_POST['username'] == '' || $_POST['password'] == '') {
+			$args['error'] = $config['error']['invalid'];
+		} elseif (!login($_POST['username'], $_POST['password'])) {
+			if ($config['syslog'])
+				_syslog(LOG_WARNING, 'Unauthorized login attempt!');
+			
+			$args['error'] = $config['error']['invalid'];
+		} else {
+			modLog('Logged in');
+			
+			// Login successful
+			// Set cookies
+			setCookies();
+			
+			header('Location: ?/', true, $config['redirect_http']);
+		}
+	}
+	
+	if (isset($_POST['username']))
+		$args['username'] = $_POST['username'];
+
+	mod_page(_('Login'), 'mod/login.html', $args);
+}
+
+function mod_confirm($request) {
+	mod_page(_('Confirm action'), 'mod/confirm.html', array('request' => $request));
+}
+
+function mod_logout() {
+	destroyCookies();
+	
+	header('Location: ?/', true, $config['redirect_http']);
+}
+
+function mod_dashboard() {
+	global $config, $mod;
+	
+	$args = array();
+	
+	$args['boards'] = listBoards();
+	
+	if (hasPermission($config['mod']['noticeboard'])) {
+		if (!$config['cache']['enabled'] || !$args['noticeboard'] = cache::get('noticeboard_preview')) {
+			$query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit");
+			$query->bindValue(':limit', $config['mod']['noticeboard_dashboard'], PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+			$args['noticeboard'] = $query->fetchAll(PDO::FETCH_ASSOC);
+			
+			if ($config['cache']['enabled'])
+				cache::set('noticeboard_preview', $args['noticeboard']);
+		}
+	}
+	
+	if (!$config['cache']['enabled'] || ($args['unread_pms'] = cache::get('pm_unreadcount_' . $mod['id'])) === false) {
+		$query = prepare('SELECT COUNT(*) FROM `pms` WHERE `to` = :id AND `unread` = 1');
+		$query->bindValue(':id', $mod['id']);
+		$query->execute() or error(db_error($query));
+		$args['unread_pms'] = $query->fetchColumn(0);
+		
+		if ($config['cache']['enabled'])
+			cache::set('pm_unreadcount_' . $mod['id'], $args['unread_pms']);
+	}
+	
+	$query = query('SELECT COUNT(*) FROM `reports`') or error(db_error($query));
+	$args['reports'] = $query->fetchColumn(0);
+	
+	if ($mod['type'] >= ADMIN && $config['check_updates']) {
+		if (!$config['version'])
+			error(_('Could not find current version! (Check .installed)'));
+		
+		if (isset($_COOKIE['update'])) {
+			$latest = unserialize($_COOKIE['update']);
+		} else {
+			$ctx = stream_context_create(array('http' => array('timeout' => 5)));
+			if ($code = @file_get_contents('http://tinyboard.org/version.txt', 0, $ctx)) {
+				eval($code);
+				if (preg_match('/v(\d+)\.(\d)\.(\d+)(-dev.+)?$/', $config['version'], $matches)) {
+					$current = array(
+						'massive' => (int) $matches[1],
+						'major' => (int) $matches[2],
+						'minor' => (int) $matches[3]
+					);
+					if (isset($m[4])) { 
+						// Development versions are always ahead in the versioning numbers
+						$current['minor'] --;
+					}
+					// Check if it's newer
+					if (!(	$latest['massive'] > $current['massive'] ||
+						$latest['major'] > $current['major'] ||
+							($latest['massive'] == $current['massive'] &&
+								$latest['major'] == $current['major'] &&
+								$latest['minor'] > $current['minor']
+							)))
+						$latest = false;
+				} else {
+					$latest = false;
+				}
+			} else {
+				// Couldn't get latest version
+				$latest = false;
+			}
+	
+			setcookie('update', serialize($latest), time() + $config['check_updates_time'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, true);
+		}
+		
+		if ($latest)
+			$args['newer_release'] = $latest;
+	}
+			
+	mod_page(_('Dashboard'), 'mod/dashboard.html', $args);
+}
+
+function mod_edit_board($boardName) {
+	global $board, $config;
+	
+	if (!openBoard($boardName))
+		error($config['error']['noboard']);
+	
+	if (!hasPermission($config['mod']['manageboards'], $board['uri']))
+			error($config['error']['noaccess']);
+	
+	if (isset($_POST['title'], $_POST['subtitle'])) {
+		if (isset($_POST['delete'])) {
+			if (!hasPermission($config['mod']['manageboards'], $board['uri']))
+				error($config['error']['deleteboard']);
+			
+			$query = prepare('DELETE FROM `boards` WHERE `uri` = :uri');
+			$query->bindValue(':uri', $board['uri']);
+			$query->execute() or error(db_error($query));
+			
+			modLog('Deleted board: ' . sprintf($config['board_abbreviation'], $board['uri']), false);
+			
+			// Delete entire board directory
+			rrmdir($board['uri'] . '/');
+			
+			// Delete posting table
+			$query = query(sprintf('DROP TABLE IF EXISTS `posts_%s`', $board['uri'])) or error(db_error());
+			
+			// Clear reports
+			$query = prepare('DELETE FROM `reports` WHERE `board` = :id');
+			$query->bindValue(':id', $board['uri'], PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+			
+			// Delete from table
+			$query = prepare('DELETE FROM `boards` WHERE `uri` = :uri');
+			$query->bindValue(':uri', $board['uri'], PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+			
+			$query = prepare("SELECT `board`, `post` FROM `cites` WHERE `target_board` = :board");
+			$query->bindValue(':board', $board['uri']);
+			$query->execute() or error(db_error($query));
+			while ($cite = $query->fetch(PDO::FETCH_ASSOC)) {
+				if ($board['uri'] != $cite['board']) {
+					if (!isset($tmp_board))
+						$tmp_board = $board;
+					openBoard($cite['board']);
+					rebuildPost($cite['post']);
+				}
+			}
+			
+			$query = prepare('DELETE FROM `cites` WHERE `board` = :board OR `target_board` = :board');
+			$query->bindValue(':board', $board['uri']);
+			$query->execute() or error(db_error($query));
+			
+			$query = prepare('DELETE FROM `antispam` WHERE `board` = :board');
+			$query->bindValue(':board', $board['uri']);
+			$query->execute() or error(db_error($query));
+		} else {
+			$query = prepare('UPDATE `boards` SET `title` = :title, `subtitle` = :subtitle WHERE `uri` = :uri');
+			$query->bindValue(':uri', $board['uri']);
+			$query->bindValue(':title', $_POST['title']);
+			$query->bindValue(':subtitle', $_POST['subtitle']);
+			$query->execute() or error(db_error($query));
+		}
+		
+		if ($config['cache']['enabled']) {
+			cache::delete('board_' . $board['uri']);
+			cache::delete('all_boards');
+		}
+		
+		rebuildThemes('boards');
+		
+		header('Location: ?/', true, $config['redirect_http']);
+	} else {
+		mod_page(sprintf('%s: ' . $config['board_abbreviation'], _('Edit board'), $board['uri']), 'mod/board.html', array('board' => $board));
+	}
+}
+
+function mod_new_board() {
+	global $config, $board;
+	
+	if (!hasPermission($config['mod']['newboard']))
+		error($config['error']['noaccess']);
+	
+	if (isset($_POST['uri'], $_POST['title'], $_POST['subtitle'])) {
+		if ($_POST['uri'] == '')
+			error(sprintf($config['error']['required'], 'URI'));
+		
+		if ($_POST['title'] == '')
+			error(sprintf($config['error']['required'], 'title'));
+		
+		if (!preg_match('/^\w+$/', $_POST['uri']))
+			error(sprintf($config['error']['invalidfield'], 'URI'));
+		
+		if (openBoard($_POST['uri'])) {
+			error(sprintf($config['error']['boardexists'], $board['url']));
+		}
+		
+		$query = prepare('INSERT INTO `boards` VALUES (:uri, :title, :subtitle)');
+		$query->bindValue(':uri', $_POST['uri']);
+		$query->bindValue(':title', $_POST['title']);
+		$query->bindValue(':subtitle', $_POST['subtitle']);
+		$query->execute() or error(db_error($query));
+		
+		modLog('Created a new board: ' . sprintf($config['board_abbreviation'], $_POST['uri']));
+		
+		if (!openBoard($_POST['uri']))
+			error(_("Couldn't open board after creation."));
+		
+		query(Element('posts.sql', array('board' => $board['uri']))) or error(db_error());
+		
+		if ($config['cache']['enabled'])
+			cache::delete('all_boards');
+		
+		// Build the board
+		buildIndex();
+		
+		rebuildThemes('boards');
+		
+		header('Location: ?/' . $board['uri'] . '/' . $config['file_index'], true, $config['redirect_http']);
+	}
+	
+	mod_page(_('New board'), 'mod/board.html', array('new' => true));
+}
+
+function mod_noticeboard($page_no = 1) {
+	global $config, $pdo, $mod;
+	
+	if ($page_no < 1)
+		error($config['error']['404']);
+	
+	if (!hasPermission($config['mod']['noticeboard']))
+		error($config['error']['noaccess']);
+	
+	if (isset($_POST['subject'], $_POST['body'])) {
+		if (!hasPermission($config['mod']['noticeboard_post']))
+			error($config['error']['noaccess']);
+		
+		markup($_POST['body']);
+		
+		$query = prepare('INSERT INTO `noticeboard` VALUES (NULL, :mod, :time, :subject, :body)');
+		$query->bindValue(':mod', $mod['id']);
+		$query->bindvalue(':time', time());
+		$query->bindValue(':subject', $_POST['subject']);
+		$query->bindValue(':body', $_POST['body']);
+		$query->execute() or error(db_error($query));
+		
+		if ($config['cache']['enabled'])
+			cache::delete('noticeboard_preview');
+		
+		modLog('Posted a noticeboard entry');
+		
+		header('Location: ?/noticeboard#' . $pdo->lastInsertId(), true, $config['redirect_http']);
+	}
+	
+	$query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :offset, :limit");
+	$query->bindValue(':limit', $config['mod']['noticeboard_page'], PDO::PARAM_INT);
+	$query->bindValue(':offset', ($page_no - 1) * $config['mod']['noticeboard_page'], PDO::PARAM_INT);
+	$query->execute() or error(db_error($query));
+	$noticeboard = $query->fetchAll(PDO::FETCH_ASSOC);
+	
+	if (empty($noticeboard) && $page_no > 1)
+		error($config['error']['404']);
+	
+	$query = prepare("SELECT COUNT(*) FROM `noticeboard`");
+	$query->execute() or error(db_error($query));
+	$count = $query->fetchColumn(0);
+	
+	mod_page(_('Noticeboard'), 'mod/noticeboard.html', array('noticeboard' => $noticeboard, 'count' => $count));
+}
+
+function mod_noticeboard_delete($id) {
+	global $config;
+	
+	if (!hasPermission($config['mod']['noticeboard_delete']))
+			error($config['error']['noaccess']);
+	
+	$query = prepare('DELETE FROM `noticeboard` WHERE `id` = :id');
+	$query->bindValue(':id', $id);
+	$query->execute() or error(db_error($query));
+	
+	modLog('Deleted a noticeboard entry');
+	
+	header('Location: ?/noticeboard', true, $config['redirect_http']);
+}
+
+function mod_news($page_no = 1) {
+	global $config, $pdo, $mod;
+	
+	if ($page_no < 1)
+		error($config['error']['404']);
+	
+	if (isset($_POST['subject'], $_POST['body'])) {
+		if (!hasPermission($config['mod']['news']))
+			error($config['error']['noaccess']);
+		
+		markup($_POST['body']);
+		
+		$query = prepare('INSERT INTO `news` VALUES (NULL, :name, :time, :subject, :body)');
+		$query->bindValue(':name', isset($_POST['name']) && hasPermission($config['mod']['news_custom']) ? $_POST['name'] : $mod['username']);
+		$query->bindvalue(':time', time());
+		$query->bindValue(':subject', $_POST['subject']);
+		$query->bindValue(':body', $_POST['body']);
+		$query->execute() or error(db_error($query));
+		
+		modLog('Posted a news entry');
+		
+		rebuildThemes('news');
+		
+		header('Location: ?/news#' . $pdo->lastInsertId(), true, $config['redirect_http']);
+	}
+	
+	$query = prepare("SELECT * FROM `news` ORDER BY `id` DESC LIMIT :offset, :limit");
+	$query->bindValue(':limit', $config['mod']['news_page'], PDO::PARAM_INT);
+	$query->bindValue(':offset', ($page_no - 1) * $config['mod']['news_page'], PDO::PARAM_INT);
+	$query->execute() or error(db_error($query));
+	$news = $query->fetchAll(PDO::FETCH_ASSOC);
+	
+	if (empty($news) && $page_no > 1)
+		error($config['error']['404']);
+	
+	$query = prepare("SELECT COUNT(*) FROM `news`");
+	$query->execute() or error(db_error($query));
+	$count = $query->fetchColumn(0);
+	
+	mod_page(_('News'), 'mod/news.html', array('news' => $news, 'count' => $count));
+}
+
+function mod_news_delete($id) {
+	global $config;
+	
+	if (!hasPermission($config['mod']['news_delete']))
+			error($config['error']['noaccess']);
+	
+	$query = prepare('DELETE FROM `news` WHERE `id` = :id');
+	$query->bindValue(':id', $id);
+	$query->execute() or error(db_error($query));
+	
+	modLog('Deleted a news entry');
+	
+	header('Location: ?/news', true, $config['redirect_http']);
+}
+
+function mod_log($page_no = 1) {
+	global $config;
+	
+	if ($page_no < 1)
+		error($config['error']['404']);
+	
+	if (!hasPermission($config['mod']['modlog']))
+		error($config['error']['noaccess']);
+	
+	$query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY `time` DESC LIMIT :offset, :limit");
+	$query->bindValue(':limit', $config['mod']['modlog_page'], PDO::PARAM_INT);
+	$query->bindValue(':offset', ($page_no - 1) * $config['mod']['modlog_page'], PDO::PARAM_INT);
+	$query->execute() or error(db_error($query));
+	$logs = $query->fetchAll(PDO::FETCH_ASSOC);
+	
+	if (empty($logs) && $page_no > 1)
+		error($config['error']['404']);
+	
+	$query = prepare("SELECT COUNT(*) FROM `modlogs`");
+	$query->execute() or error(db_error($query));
+	$count = $query->fetchColumn(0);
+	
+	mod_page(_('Moderation log'), 'mod/log.html', array('logs' => $logs, 'count' => $count));
+}
+
+function mod_view_board($boardName, $page_no = 1) {
+	global $config, $mod;
+	
+	if (!openBoard($boardName))
+		error($config['error']['noboard']);
+	
+	if (!$page = index($page_no, $mod)) {
+		error($config['error']['404']);
+	}
+	
+	$page['pages'] = getPages(true);
+	$page['pages'][$page_no-1]['selected'] = true;
+	$page['btn'] = getPageButtons($page['pages'], true);
+	$page['mod'] = true;
+	$page['config'] = $config;
+	
+	echo Element('index.html', $page);
+}
+
+function mod_view_thread($boardName, $thread) {
+	global $config, $mod;
+	
+	if (!openBoard($boardName))
+		error($config['error']['noboard']);
+	
+	$page = buildThread($thread, true, $mod);
+	echo $page;
+}
+
+function mod_ip_remove_note($ip, $id) {
+	global $config, $mod;
+	
+	if (!hasPermission($config['mod']['remove_notes']))
+			error($config['error']['noaccess']);
+	
+	if (filter_var($ip, FILTER_VALIDATE_IP) === false)
+		error("Invalid IP address.");
+	
+	$query = prepare('DELETE FROM `ip_notes` WHERE `ip` = :ip AND `id` = :id');
+	$query->bindValue(':ip', $ip);
+	$query->bindValue(':id', $id);
+	$query->execute() or error(db_error($query));
+	
+	modLog("Removed a note for <a href=\"?/IP/{$ip}\">{$ip}</a>");
+	
+	header('Location: ?/IP/' . $ip . '#notes', true, $config['redirect_http']);
+}
+
+function mod_page_ip($ip) {
+	global $config, $mod;
+	
+	if (filter_var($ip, FILTER_VALIDATE_IP) === false)
+		error("Invalid IP address.");
+	
+	if (isset($_POST['ban_id'], $_POST['unban'])) {
+		if (!hasPermission($config['mod']['unban']))
+			error($config['error']['noaccess']);
+		
+		require_once 'inc/mod/ban.php';
+		
+		unban($_POST['ban_id']);
+		
+		header('Location: ?/IP/' . $ip . '#bans', true, $config['redirect_http']);
+		return;
+	}
+	
+	if (isset($_POST['note'])) {
+		if (!hasPermission($config['mod']['create_notes']))
+			error($config['error']['noaccess']);
+		
+		markup($_POST['note']);
+		$query = prepare('INSERT INTO `ip_notes` VALUES (NULL, :ip, :mod, :time, :body)');
+		$query->bindValue(':ip', $ip);
+		$query->bindValue(':mod', $mod['id']);
+		$query->bindValue(':time', time());
+		$query->bindValue(':body', $_POST['note']);
+		$query->execute() or error(db_error($query));
+		
+		modLog("Added a note for <a href=\"?/IP/{$ip}\">{$ip}</a>");
+		
+		header('Location: ?/IP/' . $ip . '#notes', true, $config['redirect_http']);
+		return;
+	}
+	
+	$args = array();
+	$args['ip'] = $ip;
+	$args['posts'] = array();
+	
+	if ($config['mod']['dns_lookup'])
+		$args['hostname'] = rDNS($ip);
+	
+	$boards = listBoards();
+	foreach ($boards as $board) {
+		openBoard($board['uri']);
+		
+		$query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `ip` = :ip ORDER BY `sticky` DESC, `id` DESC LIMIT :limit', $board['uri']));
+		$query->bindValue(':ip', $ip);
+		$query->bindValue(':limit', $config['mod']['ip_recentposts'], PDO::PARAM_INT);
+		$query->execute() or error(db_error($query));
+		
+		while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
+			if (!$post['thread']) {
+				// TODO: There is no reason why this should be such a fucking mess.
+				$po = new Thread(
+					$post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'],
+					$post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'],
+					$post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'],
+					$post['sage'], $post['embed'], '?/', $mod, false
+				);
+			} else {
+				$po = new Post(
+					$post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'],
+					$post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'],
+					$post['fileheight'], $post['filesize'], $post['filename'], $post['ip'],  $post['embed'], '?/', $mod
+				);
+			}
+			
+			if (!isset($args['posts'][$board['uri']]))
+				$args['posts'][$board['uri']] = array('board' => $board, 'posts' => array());
+			$args['posts'][$board['uri']]['posts'][] = $po->build(true);
+		}
+	}
+	
+	$args['boards'] = $boards;
+	
+	
+	if (hasPermission($config['mod']['view_ban'])) {
+		$query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `ip` = :ip");
+		$query->bindValue(':ip', $ip);
+		$query->execute() or error(db_error($query));
+		$args['bans'] = $query->fetchAll(PDO::FETCH_ASSOC);
+	}
+	
+	if (hasPermission($config['mod']['view_notes'])) {
+		$query = prepare("SELECT `ip_notes`.*, `username` FROM `ip_notes` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `ip` = :ip");
+		$query->bindValue(':ip', $ip);
+		$query->execute() or error(db_error($query));
+		$args['notes'] = $query->fetchAll(PDO::FETCH_ASSOC);
+	}
+	
+	mod_page(sprintf('%s: %s', _('IP'), $ip), 'mod/view_ip.html', $args, $args['hostname']);
+}
+
+function mod_ban() {
+	global $config;
+	
+	if (!hasPermission($config['mod']['ban']))
+		error($config['error']['noaccess']);
+	
+	if (!isset($_POST['ip'], $_POST['reason'], $_POST['length'], $_POST['board'])) {
+		mod_page(_('New ban'), 'mod/ban_form.html', array());
+		return;
+	}
+	
+	require_once 'inc/mod/ban.php';
+	
+	ban($_POST['ip'], $_POST['reason'], parse_time($_POST['length']), $_POST['board'] == '*' ? false : $_POST['board']);
+	
+	if (isset($_POST['redirect']))
+		header('Location: ' . $_POST['redirect'], true, $config['redirect_http']);
+	else
+		header('Location: ?/', true, $config['redirect_http']);
+}
+
+function mod_bans($page_no = 1) {
+	global $config;
+	
+	if ($page_no < 1)
+		error($config['error']['404']);
+	
+	if (!hasPermission($config['mod']['view_banlist']))
+		error($config['error']['noaccess']);
+	
+	if (isset($_POST['unban'])) {
+		if (!hasPermission($config['mod']['unban']))
+			error($config['error']['noaccess']);
+		
+		$unban = array();
+		foreach ($_POST as $name => $unused) {
+			if (preg_match('/^ban_(\d+)$/', $name, $match))
+				$unban[] = $match[1];
+		}
+		
+		if (!empty($unban)) {
+			query('DELETE FROM `bans` WHERE `id` = ' . implode(' OR `id` = ', $unban)) or error(db_error());
+		
+			foreach ($unban as $id) {
+				modLog("Removed ban #{$id}");
+			}
+		}
+		
+		header('Location: ?/bans', true, $config['redirect_http']);
+	}
+	
+	if ($config['mod']['view_banexpired']) {
+		$query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY (`expires` IS NOT NULL AND `expires` < :time), `set` DESC LIMIT :offset, :limit");
+	} else {
+		// Filter out expired bans
+		$query = prepare("SELECT `bans`.*, `username` FROM `bans` INNER JOIN `mods` ON `mod` = `mods`.`id` WHERE `expires` = 0 OR `expires` > :time ORDER BY `set` DESC LIMIT :offset, :limit");
+	}
+	$query->bindValue(':time', time(), PDO::PARAM_INT);
+	$query->bindValue(':limit', $config['mod']['banlist_page'], PDO::PARAM_INT);
+	$query->bindValue(':offset', ($page_no - 1) * $config['mod']['banlist_page'], PDO::PARAM_INT);
+	$query->execute() or error(db_error($query));
+	$bans = $query->fetchAll(PDO::FETCH_ASSOC);
+	
+	if (empty($bans) && $page_no > 1)
+		error($config['error']['404']);
+	
+	$query = prepare("SELECT COUNT(*) FROM `bans`");
+	$query->execute() or error(db_error($query));
+	$count = $query->fetchColumn(0);
+	
+	foreach ($bans as &$ban) {
+		if (filter_var($ban['ip'], FILTER_VALIDATE_IP) !== false)
+			$ban['real_ip'] = true;
+	}
+	
+	mod_page(_('Ban list'), 'mod/ban_list.html', array('bans' => $bans, 'count' => $count));
+}
+
+
+function mod_lock($board, $unlock, $post) {
+	global $config;
+	
+	if (!openBoard($board))
+		error($config['error']['noboard']);
+	
+	if (!hasPermission($config['mod']['lock'], $board))
+		error($config['error']['noaccess']);
+	
+	$query = prepare(sprintf('UPDATE `posts_%s` SET `locked` = :locked WHERE `id` = :id AND `thread` IS NULL', $board));
+	$query->bindValue(':id', $post);
+	$query->bindValue(':locked', $unlock ? 0 : 1);
+	$query->execute() or error(db_error($query));
+	if ($query->rowCount()) {
+		modLog(($unlock ? 'Unlocked' : 'Locked') . " thread #{$post}");
+		buildThread($post);
+		buildIndex();
+	}
+	
+	header('Location: ?/' . sprintf($config['board_path'], $board) . $config['file_index'], true, $config['redirect_http']);
+}
+
+function mod_sticky($board, $unsticky, $post) {
+	global $config;
+	
+	if (!openBoard($board))
+		error($config['error']['noboard']);
+	
+	if (!hasPermission($config['mod']['sticky'], $board))
+		error($config['error']['noaccess']);
+	
+	$query = prepare(sprintf('UPDATE `posts_%s` SET `sticky` = :sticky WHERE `id` = :id AND `thread` IS NULL', $board));
+	$query->bindValue(':id', $post);
+	$query->bindValue(':sticky', $unsticky ? 0 : 1);
+	$query->execute() or error(db_error($query));
+	if ($query->rowCount()) {
+		modLog(($unlock ? 'Unstickied' : 'Stickied') . " thread #{$post}");
+		buildThread($post);
+		buildIndex();
+	}
+	
+	header('Location: ?/' . sprintf($config['board_path'], $board) . $config['file_index'], true, $config['redirect_http']);
+}
+
+function mod_bumplock($board, $unbumplock, $post) {
+	global $config;
+	
+	if (!openBoard($board))
+		error($config['error']['noboard']);
+	
+	if (!hasPermission($config['mod']['bumplock'], $board))
+		error($config['error']['noaccess']);
+	
+	$query = prepare(sprintf('UPDATE `posts_%s` SET `sage` = :bumplock WHERE `id` = :id AND `thread` IS NULL', $board));
+	$query->bindValue(':id', $post);
+	$query->bindValue(':bumplock', $unbumplock ? 0 : 1);
+	$query->execute() or error(db_error($query));
+	if ($query->rowCount()) {
+		modLog(($unlock ? 'Unbumplocked' : 'Bumplocked') . " thread #{$post}");
+		buildThread($post);
+		buildIndex();
+	}
+	
+	header('Location: ?/' . sprintf($config['board_path'], $board) . $config['file_index'], true, $config['redirect_http']);
+}
+
+function mod_move($originBoard, $postID) {
+	global $board, $config, $mod;
+	
+	if (!openBoard($originBoard))
+		error($config['error']['noboard']);
+	
+	if (!hasPermission($config['mod']['move'], $originBoard))
+		error($config['error']['noaccess']);
+	
+	$query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `id` = :id AND `thread` IS NULL', $originBoard));
+	$query->bindValue(':id', $postID);
+	$query->execute() or error(db_error($query));
+	if (!$post = $query->fetch(PDO::FETCH_ASSOC))
+		error($config['error']['404']);
+	
+	if (isset($_POST['board'])) {
+		$targetBoard = $_POST['board'];
+		$shadow = isset($_POST['shadow']);
+		
+		if ($targetBoard === $originBoard)
+			error(_('Target and source board are the same.'));
+		
+		// copy() if leaving a shadow thread behind; else, rename().
+		$clone = $shadow ? 'copy' : 'rename';
+		
+		// indicate that the post is a thread
+		$post['op'] = true;
+		
+		if ($post['file']) {
+			$post['has_file'] = true;
+			$post['width'] = &$post['filewidth'];
+			$post['height'] = &$post['fileheight'];
+			
+			$file_src = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file'];
+			$file_thumb = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb'];
+		} else {
+			$post['has_file'] = false;
+		}
+		
+		// allow thread to keep its same traits (stickied, locked, etc.)
+		$post['mod'] = true;
+		
+		if (!openBoard($targetBoard))
+			error($config['error']['noboard']);
+		
+		// create the new thread
+		$newID = post($post);
+		
+		if ($post['has_file']) {
+			// copy image
+			$clone($file_src, sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']);
+			$clone($file_thumb, sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']);
+		}
+		
+		// go back to the original board to fetch replies
+		openBoard($originBoard);
+		
+		$query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `thread` = :id ORDER BY `id`', $originBoard));
+		$query->bindValue(':id', $postID, PDO::PARAM_INT);
+		$query->execute() or error(db_error($query));
+		
+		$replies = array();
+		
+		while ($post = $query->fetch()) {
+			$post['mod'] = true;
+			$post['thread'] = $newID;
+			
+			if ($post['file']) {
+				$post['has_file'] = true;
+				$post['width'] = &$post['filewidth'];
+				$post['height'] = &$post['fileheight'];
+				
+				$post['file_src'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file'];
+				$post['file_thumb'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb'];
+			} else {
+				$post['has_file'] = false;
+			}
+			
+			$replies[] = $post;
+		}
+		
+		$newIDs = array($postID => $newID);
+		
+		openBoard($targetBoard);
+		
+		foreach ($replies as &$post) {
+			$query = prepare('SELECT `target` FROM `cites` WHERE `target_board` = :board AND `board` = :board AND `post` = :post');
+			$query->bindValue(':board', $originBoard);
+			$query->bindValue(':post', $post['id'], PDO::PARAM_INT);
+			$query->execute() or error(db_error($qurey));
+			
+			// correct >>X links
+			while ($cite = $query->fetch(PDO::FETCH_ASSOC)) {
+				if (isset($newIDs[$cite['target']])) {
+					$post['body_nomarkup'] = preg_replace(
+							'/(>>(>\/' . preg_quote($originBoard, '/') . '\/)?)' . preg_quote($cite['target'], '/') . '/',
+							'>>' . $newIDs[$cite['target']],
+							$post['body_nomarkup']);
+					
+					$post['body'] = $post['body_nomarkup'];
+				}
+			}
+			
+			$post['body'] = $post['body_nomarkup'];
+			
+			$post['op'] = false;
+			$post['tracked_cites'] = markup($post['body'], true);
+			
+			// insert reply
+			$newIDs[$post['id']] = $newPostID = post($post);
+			
+			if ($post['has_file']) {
+				// copy image
+				$clone($post['file_src'], sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']);
+				$clone($post['file_thumb'], sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']);
+			}
+			
+			foreach ($post['tracked_cites'] as $cite) {
+				$query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)');
+				$query->bindValue(':board', $board['uri']);
+				$query->bindValue(':post', $newPostID, PDO::PARAM_INT);
+				$query->bindValue(':target_board',$cite[0]);
+				$query->bindValue(':target', $cite[1], PDO::PARAM_INT);
+				$query->execute() or error(db_error($query));
+			}
+		}
+		
+		// build new hread
+		buildThread($newID);
+		buildIndex();
+		
+		// trigger themes
+		rebuildThemes('post');
+		
+		// return to original board
+		openBoard($originBoard);
+		
+		if ($shadow) {
+			// lock old thread
+			$query = prepare(sprintf('UPDATE `posts_%s` SET `locked` = 1 WHERE `id` = :id', $originBoard));
+			$query->bindValue(':id', $postID, PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+			
+			// leave a reply, linking to the new thread
+			$post = array(
+				'mod' => true,
+				'subject' => '',
+				'email' => '',
+				'name' => $config['mod']['shadow_name'],
+				'capcode' => $config['mod']['shadow_capcode'],
+				'trip' => '',
+				'password' => '',
+				'has_file' => false,
+				// attach to original thread
+				'thread' => $postID,
+				'op' => false
+			);
+			
+			$post['body'] = $post['body_nomarkup'] =  sprintf($config['mod']['shadow_mesage'], '>>>/' . $targetBoard . '/' . $newID);
+			
+			markup($post['body']);
+			
+			$botID = post($post);
+			buildThread($postID);
+			
+			buildIndex();
+			
+			header('Location: ?/' . sprintf($config['board_path'], $originBoard) . $config['dir']['res'] .sprintf($config['file_page'], $postID) .
+				'#' . $botID, true, $config['redirect_http']);
+		} else {
+			deletePost($postID);
+			buildIndex();
+			
+			openBoard($targetBoard);
+			header('Location: ?/' . sprintf($config['board_path'], $board['uri']) . $config['dir']['res'] . sprintf($config['file_page'], $newID), true, $config['redirect_http']);
+		}
+	}
+	
+	$boards = listBoards();
+	if (count($boards) <= 1)
+		error(_('Impossible to move thread; there is only one board.'));
+	
+	mod_page(_('Move thread'), 'mod/move.html', array('post' => $postID, 'board' => $originBoard, 'boards' => $boards));
+}
+
+function mod_ban_post($board, $delete, $post) {
+	global $config, $mod;
+	
+	if (!openBoard($board))
+		error($config['error']['noboard']);
+	
+	if (!hasPermission($config['mod']['delete'], $board))
+		error($config['error']['noaccess']);
+	
+	$query = prepare(sprintf('SELECT `ip`, `thread` FROM `posts_%s` WHERE `id` = :id', $board));
+	$query->bindValue(':id', $post);
+	$query->execute() or error(db_error($query));
+	if (!$_post = $query->fetch(PDO::FETCH_ASSOC))
+		error($config['error']['404']);
+	
+	$thread = $_post['thread'];
+	$ip = $_post['ip'];
+	
+	if (isset($_POST['new_ban'], $_POST['reason'], $_POST['length'], $_POST['board'])) {
+		require_once 'inc/mod/ban.php';
+		
+		if (isset($_POST['ip']))
+			$ip = $_POST['ip'];
+		
+		ban($ip, $_POST['reason'], parse_time($_POST['length']), $_POST['board'] == '*' ? false : $_POST['board']);
+		
+		if (isset($_POST['public_message'], $_POST['message'])) {
+			// public ban message
+			$query = prepare(sprintf('UPDATE `posts_%s` SET `body` = CONCAT(`body`, :body) WHERE `id` = :id', $board));
+			$query->bindValue(':id', $post);
+			$query->bindValue(':body', sprintf($config['mod']['ban_message'], utf8tohtml($_POST['message'])));
+			$query->execute() or error(db_error($query));
+			
+			modLog("Attached a public ban message to post #{$post}: " . utf8tohtml($_POST['message']));
+			buildThread($thread ? $thread : $post);
+			buildIndex();
+		} elseif (isset($_POST['delete']) && (int) $_POST['delete']) {
+			// Delete post
+			deletePost($post);
+			modLog("Deleted post #{$post}");
+			// Rebuild board
+			buildIndex();
+		}
+		
+		header('Location: ?/' . sprintf($config['board_path'], $board) . $config['file_index'], true, $config['redirect_http']);
+	}
+	
+	$args = array(
+		'ip' => $ip,
+		'hide_ip' => !hasPermission($config['mod']['show_ip'], $board),
+		'post' => $post,
+		'board' => $board,
+		'delete' => (bool)$delete,
+		'boards' => listBoards()
+	);
+	
+	mod_page(_('New ban'), 'mod/ban_form.html', $args);
+}
+
+function mod_delete($board, $post) {
+	global $config, $mod;
+	
+	if (!openBoard($board))
+		error($config['error']['noboard']);
+	
+	if (!hasPermission($config['mod']['delete'], $board))
+		error($config['error']['noaccess']);
+	
+	// Delete post
+	deletePost($post);
+	// Record the action
+	modLog("Deleted post #{$post}");
+	// Rebuild board
+	buildIndex();
+	
+	// Redirect
+	header('Location: ?/' . sprintf($config['board_path'], $board) . $config['file_index'], true, $config['redirect_http']);
+}
+
+function mod_deletefile($board, $post) {
+	global $config, $mod;
+	
+	if (!openBoard($board))
+		error($config['error']['noboard']);
+	
+	if (!hasPermission($config['mod']['deletefile'], $board))
+		error($config['error']['noaccess']);
+	
+	// Delete file
+	deleteFile($post);
+	// Record the action
+	modLog("Deleted file from post #{$post}");
+	// Rebuild thread
+	buildThread($post);
+	// Rebuild board
+	buildIndex();
+	
+	// Redirect
+	header('Location: ?/' . sprintf($config['board_path'], $board) . $config['file_index'], true, $config['redirect_http']);
+}
+
+function mod_deletebyip($boardName, $post, $global = false) {
+	global $config, $mod, $board;
+	
+	$global = (bool)$global;
+	
+	if (!openBoard($boardName))
+		error($config['error']['noboard']);
+	
+	if (!$global && !hasPermission($config['mod']['deletebyip'], $boardName))
+		error($config['error']['noaccess']);
+	
+	if ($global && !hasPermission($config['mod']['deletebyip_global'], $boardName))
+		error($config['error']['noaccess']);
+	
+	// Find IP address
+	$query = prepare(sprintf('SELECT `ip` FROM `posts_%s` WHERE `id` = :id', $boardName));
+	$query->bindValue(':id', $post);
+	$query->execute() or error(db_error($query));
+	if (!$ip = $query->fetchColumn(0))
+		error($config['error']['invalidpost']);
+	
+	$boards = $global ? listBoards() : array(array('uri' => $boardName));
+	
+	$query = '';
+	foreach ($boards as $_board) {
+		$query .= sprintf("SELECT `id`, '%s' AS `board` FROM `posts_%s` WHERE `ip` = :ip UNION ALL ", $_board['uri'], $_board['uri']);
+	}
+	$query = preg_replace('/UNION ALL $/', '', $query);
+	
+	$query = prepare($query);
+	$query->bindValue(':ip', $ip);
+	$query->execute() or error(db_error($query));
+	
+	if ($query->rowCount() < 1)
+		error($config['error']['invalidpost']);
+	
+	$boards = array();
+	while ($post = $query->fetch()) {
+		openBoard($post['board']);
+		$boards[] = $post['board'];
+		
+		deletePost($post['id'], false);
+	}
+	
+	$boards = array_unique($boards);
+	
+	foreach ($boards as $_board) {
+		openBoard($_board);
+		buildIndex();
+	}
+	
+	if ($global) {
+		$board = false;
+	}
+	
+	// Record the action
+	modLog("Deleted all posts by IP address: <a href=\"?/IP/$ip\">$ip</a>");
+	
+	// Redirect
+	header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
+}
+
+function mod_user($uid) {
+	global $config, $mod;
+	
+	if (!hasPermission($config['mod']['editusers']) && !(hasPermission($config['mod']['change_password']) && $uid == $mod['id']))
+		error($config['error']['noaccess']);
+	
+	$query = prepare('SELECT * FROM `mods` WHERE `id` = :id');
+	$query->bindValue(':id', $uid);
+	$query->execute() or error(db_error($query));
+	if (!$user = $query->fetch(PDO::FETCH_ASSOC))
+		error($config['error']['404']);
+	
+	if (hasPermission($config['mod']['editusers']) && isset($_POST['username'], $_POST['password'])) {
+		if (isset($_POST['allboards'])) {
+			$boards = array('*');
+		} else {
+			$_boards = listBoards();
+			foreach ($_boards as &$board) {
+				$board = $board['uri'];
+			}
+		
+			$boards = array();
+			foreach ($_POST as $name => $value) {
+				if (preg_match('/^board_(\w+)$/', $name, $matches) && in_array($matches[1], $_boards))
+					$boards[] = $matches[1];
+			}
+		}
+		
+		if (isset($_POST['delete'])) {
+			if (!hasPermission($config['mod']['deleteusers']))
+				error($config['error']['noaccess']);
+			
+			$query = prepare('DELETE FROM `mods` WHERE `id` = :id');
+			$query->bindValue(':id', $uid);
+			$query->execute() or error(db_error($query));
+			
+			modLog('Deleted user ' . utf8tohtml($user['username']) . ' <small>(#' . $user['id'] . ')</small>');
+			
+			header('Location: ?/users', true, $config['redirect_http']);
+			
+			return;
+		}
+		
+		if ($_POST['username'] == '')
+			error(sprintf($config['error']['required'], 'username'));
+		
+		$query = prepare('UPDATE `mods` SET `username` = :username, `boards` = :boards WHERE `id` = :id');
+		$query->bindValue(':id', $uid);
+		$query->bindValue(':username', $_POST['username']);
+		$query->bindValue(':boards', implode(',', $boards));
+		$query->execute() or error(db_error($query));
+		
+		if ($user['username'] !== $_POST['username']) {
+			// account was renamed
+			modLog('Renamed user "' . utf8tohtml($user['username']) . '" <small>(#' . $user['id'] . ')</small> to "' . utf8tohtml($_POST['username']) . '"');
+		}
+		
+		if ($_POST['password'] != '') {
+			$query = prepare('UPDATE `mods` SET `password` = SHA1(:password) WHERE `id` = :id');
+			$query->bindValue(':id', $uid);
+			$query->bindValue(':password', $_POST['password']);
+			$query->execute() or error(db_error($query));
+			
+			modLog('Changed password for ' . utf8tohtml($_POST['username']) . ' <small>(#' . $user['id'] . ')</small>');
+			
+			if ($uid == $mod['id']) {
+				login($_POST['username'], $_POST['password']);
+				setCookies();
+			}
+		}
+		
+		if (hasPermission($config['mod']['manageusers']))
+			header('Location: ?/users', true, $config['redirect_http']);
+		else
+			header('Location: ?/', true, $config['redirect_http']);
+		
+		return;
+	}
+	
+	if (hasPermission($config['mod']['change_password']) && $uid == $mod['id'] && isset($_POST['password'])) {
+		if ($_POST['password'] != '') {
+			$query = prepare('UPDATE `mods` SET `password` = SHA1(:password) WHERE `id` = :id');
+			$query->bindValue(':id', $uid);
+			$query->bindValue(':password', $_POST['password']);
+			$query->execute() or error(db_error($query));
+			
+			modLog('Changed own password');
+			
+			login($user['username'], $_POST['password']);
+			setCookies();
+		}
+		
+		if (hasPermission($config['mod']['manageusers']))
+			header('Location: ?/users', true, $config['redirect_http']);
+		else
+			header('Location: ?/', true, $config['redirect_http']);
+		
+		return;
+	}
+	
+	if (hasPermission($config['mod']['modlog'])) {
+		$query = prepare('SELECT * FROM `modlogs` WHERE `mod` = :id ORDER BY `time` DESC LIMIT 5');
+		$query->bindValue(':id', $uid);
+		$query->execute() or error(db_error($query));
+		$log = $query->fetchAll(PDO::FETCH_ASSOC);
+	} else {
+		$log = array();
+	}
+	
+	$user['boards'] = explode(',', $user['boards']);
+	
+	mod_page(_('Edit user'), 'mod/user.html', array('user' => $user, 'logs' => $log, 'boards' => listBoards()));
+}
+
+function mod_user_new() {
+	global $pdo, $config;
+	
+	if (!hasPermission($config['mod']['createusers']))
+		error($config['error']['noaccess']);
+	
+	if (isset($_POST['username'], $_POST['password'], $_POST['type'])) {
+		if ($_POST['username'] == '')
+			error(sprintf($config['error']['required'], 'username'));
+		if ($_POST['password'] == '')
+			error(sprintf($config['error']['required'], 'password'));
+		
+		if (isset($_POST['allboards'])) {
+			$boards = array('*');
+		} else {
+			$_boards = listBoards();
+			foreach ($_boards as &$board) {
+				$board = $board['uri'];
+			}
+			
+			$boards = array();
+			foreach ($_POST as $name => $value) {
+				if (preg_match('/^board_(\w+)$/', $name, $matches) && in_array($matches[1], $_boards))
+					$boards[] = $matches[1];
+			}
+		}
+		
+		$_POST['type'] = (int) $_POST['type'];
+		if ($_POST['type'] !== JANITOR && $_POST['type'] !== MOD && $_POST['type'] !== ADMIN)
+			error(sprintf($config['error']['invalidfield'], 'type'));
+		
+		$query = prepare('INSERT INTO `mods` VALUES (NULL, :username, SHA1(:password), :type, :boards)');
+		$query->bindValue(':username', $_POST['username']);
+		$query->bindValue(':password', $_POST['password']);
+		$query->bindValue(':type', $_POST['type']);
+		$query->bindValue(':boards', implode(',', $boards));
+		$query->execute() or error(db_error($query));
+		
+		$userID = $pdo->lastInsertId();
+		
+		modLog('Created a new user: ' . utf8tohtml($_POST['username']) . ' <small>(#' . $userID . ')</small>');
+		
+		header('Location: ?/users', true, $config['redirect_http']);
+		return;
+	}
+		
+	mod_page(_('Edit user'), 'mod/user.html', array('new' => true, 'boards' => listBoards()));
+}
+
+
+function mod_users() {
+	global $config;
+	
+	if (!hasPermission($config['mod']['manageusers']))
+		error($config['error']['noaccess']);
+	
+	$query = query("SELECT *, (SELECT `time` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `last`, (SELECT `text` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `action` FROM `mods` ORDER BY `type` DESC,`id`") or error(db_error());
+	$users = $query->fetchAll(PDO::FETCH_ASSOC);
+	
+	mod_page(sprintf('%s (%d)', _('Manage users'), count($users)), 'mod/users.html', array('users' => $users));
+}
+
+function mod_user_promote($uid, $action) {
+	global $config;
+	
+	if (!hasPermission($config['mod']['promoteusers']))
+		error($config['error']['noaccess']);
+	
+	$query = prepare("UPDATE `mods` SET `type` = `type` " . ($action == 'promote' ? "+1 WHERE `type` < " . (int)ADMIN : "-1 WHERE `type` > " . (int)JANITOR) . " AND `id` = :id");
+	$query->bindValue(':id', $uid);
+	$query->execute() or error(db_error($query));
+	
+	modLog(($action == 'promote' ? 'Promoted' : 'Demoted') . " user #{$uid}");
+	
+	header('Location: ?/users', true, $config['redirect_http']);
+}
+
+function mod_pm($id, $reply = false) {
+	global $mod, $config;
+	
+	if ($reply && !hasPermission($config['mod']['create_pm']))
+		error($config['error']['noaccess']);
+	
+	$query = prepare("SELECT `mods`.`username`, `mods_to`.`username` AS `to_username`, `pms`.* FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` LEFT JOIN `mods` AS `mods_to` ON `mods_to`.`id` = `to` WHERE `pms`.`id` = :id");
+	$query->bindValue(':id', $id);
+	$query->execute() or error(db_error($query));
+	
+	if ((!$pm = $query->fetch(PDO::FETCH_ASSOC)) || ($pm['to'] != $mod['id'] && !hasPermission($config['mod']['master_pm'])))
+		error($config['error']['404']);
+	
+	if (isset($_POST['delete'])) {
+		$query = prepare("DELETE FROM `pms` WHERE `id` = :id");
+		$query->bindValue(':id', $id);
+		$query->execute() or error(db_error($query));
+		
+		if ($config['cache']['enabled']) {
+			cache::delete('pm_unread_' . $mod['id']);
+			cache::delete('pm_unreadcount_' . $mod['id']);
+		}
+		
+		header('Location: ?/', true, $config['redirect_http']);
+		return;
+	}
+	
+	if ($pm['unread'] && $pm['to'] == $mod['id']) {
+		$query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `id` = :id");
+		$query->bindValue(':id', $id);
+		$query->execute() or error(db_error($query));
+		
+		if ($config['cache']['enabled']) {
+			cache::delete('pm_unread_' . $mod['id']);
+			cache::delete('pm_unreadcount_' . $mod['id']);
+		}
+		
+		modLog('Read a PM');
+	}
+	
+	if ($reply) {
+		if (!$pm['to_username'])
+			error($config['error']['404']); // deleted?
+		
+		mod_page(sprintf('%s %s', _('New PM for'), $pm['to_username']), 'mod/new_pm.html', array(
+			'username' => $pm['username'], 'id' => $pm['sender'], 'message' => quote($pm['message'])
+		));
+	} else {
+		mod_page(sprintf('%s &ndash; #%d', _('Private message'), $id), 'mod/pm.html', $pm);
+	}
+}
+
+function mod_inbox() {
+	global $config, $mod;
+	
+	$query = prepare('SELECT `unread`,`pms`.`id`, `time`, `sender`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `to` = :mod ORDER BY `unread` DESC, `time` DESC');
+	$query->bindValue(':mod', $mod['id']);
+	$query->execute() or error(db_error($query));
+	$messages = $query->fetchAll(PDO::FETCH_ASSOC);
+	
+	$query = prepare('SELECT COUNT(*) FROM `pms` WHERE `to` = :mod AND `unread` = 1');
+	$query->bindValue(':mod', $mod['id']);
+	$query->execute() or error(db_error($query));
+	$unread = $query->fetchColumn(0);
+	
+	foreach ($messages as &$message) {
+		$message['snippet'] = pm_snippet($message['message']);
+	}
+	
+	mod_page(sprintf('%s (%s)', _('PM inbox'), count($messages) > 0 ? $unread . ' unread' : 'empty'), 'mod/inbox.html', array(
+		'messages' => $messages,
+		'unread' => $unread
+	));
+}
+
+
+function mod_new_pm($username) {
+	global $config, $mod;
+	
+	if (!hasPermission($config['mod']['create_pm']))
+		error($config['error']['noaccess']);
+	
+	$query = prepare("SELECT `id` FROM `mods` WHERE `username` = :username");
+	$query->bindValue(':username', $username);
+	$query->execute() or error(db_error($query));
+	if (!$id = $query->fetchColumn(0)) {
+		// Old style ?/PM: by user ID
+		$query = prepare("SELECT `username` FROM `mods` WHERE `id` = :username");
+		$query->bindValue(':username', $username);
+		$query->execute() or error(db_error($query));
+		if ($username = $query->fetchColumn(0))
+			header('Location: ?/new_PM/' . $username, true, $config['redirect_http']);
+		else
+			error($config['error']['404']);
+	}
+	
+	if (isset($_POST['message'])) {
+		markup($_POST['message']);
+		
+		$query = prepare("INSERT INTO `pms` VALUES (NULL, :me, :id, :message, :time, 1)");
+		$query->bindValue(':me', $mod['id']);
+		$query->bindValue(':id', $id);
+		$query->bindValue(':message', $_POST['message']);
+		$query->bindValue(':time', time());
+		$query->execute() or error(db_error($query));
+		
+		if ($config['cache']['enabled']) {
+			cache::delete('pm_unread_' . $id);
+			cache::delete('pm_unreadcount_' . $id);
+		}
+		
+		modLog('Sent a PM to ' . utf8tohtml($username));
+		
+		header('Location: ?/', true, $config['redirect_http']);
+	}
+	
+	mod_page(sprintf('%s %s', _('New PM for'), $username), 'mod/new_pm.html', array('username' => $username, 'id' => $id));
+}
+
+function mod_rebuild() {
+	global $config, $twig;
+	
+	if (!hasPermission($config['mod']['rebuild']))
+		error($config['error']['noaccess']);
+	
+	if (isset($_POST['rebuild'])) {
+		$log = array();
+		$boards = listBoards();
+		$rebuilt_scripts = array();
+		
+		if (isset($_POST['rebuild_cache'])) {
+			if ($config['cache']['enabled']) {
+				$log[] = 'Flushing cache';
+				Cache::flush();
+			}
+			
+			$log[] = 'Clearing template cache';
+			load_twig();
+			$twig->clearCacheFiles();
+		}
+		
+		if (isset($_POST['rebuild_themes'])) {
+			$log[] = 'Regenerating theme files';
+			rebuildThemes('all');
+		}
+		
+		if (isset($_POST['rebuild_javascript'])) {
+			$log[] = 'Rebuilding <strong>' . $config['file_script'] . '</strong>';
+			buildJavascript();
+			$rebuilt_scripts[] = $config['file_script'];
+		}
+		
+		foreach ($boards as $board) {
+			if (!(isset($_POST['boards_all']) || isset($_POST['board_' . $board['uri']])))
+				continue;
+			
+			openBoard($board['uri']);
+			
+			if (isset($_POST['rebuild_index'])) {
+				buildIndex();
+				$log[] = '<strong>' . sprintf($config['board_abbreviation'], $board['uri']) . '</strong>: Creating index pages';
+			}
+			
+			if (isset($_POST['rebuild_javascript']) && !in_array($config['file_script'], $rebuilt_scripts)) {
+				$log[] = '<strong>' . sprintf($config['board_abbreviation'], $board['uri']) . '</strong>: Rebuilding <strong>' . $config['file_script'] . '</strong>';
+				buildJavascript();
+				$rebuilt_scripts[] = $config['file_script'];
+			}
+			
+			if (isset($_POST['rebuild_thread'])) {
+				$query = query(sprintf("SELECT `id` FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error());
+				while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
+					$log[] = '<strong>' . sprintf($config['board_abbreviation'], $board['uri']) . '</strong>: Rebuilding thread #' . $post['id'];
+					buildThread($post['id']);
+				}
+			}
+		}
+		
+		mod_page(_('Rebuild'), 'mod/rebuilt.html', array('logs' => $log));
+		return;
+	}
+	
+	mod_page(_('Rebuild'), 'mod/rebuild.html', array('boards' => listBoards()));
+}
+
+function mod_reports() {
+	global $config, $mod;
+	
+	if (!hasPermission($config['mod']['reports']))
+		error($config['error']['noaccess']);
+	
+	$query = prepare("SELECT * FROM `reports` ORDER BY `time` DESC LIMIT :limit");
+	$query->bindValue(':limit', $config['mod']['recent_reports'], PDO::PARAM_INT);
+	$query->execute() or error(db_error($query));
+	$reports = $query->fetchAll(PDO::FETCH_ASSOC);
+	
+	$report_queries = array();
+	foreach ($reports as $report) {
+		if (!isset($report_queries[$report['board']]))
+			$report_queries[$report['board']] = array();
+		$report_queries[$report['board']][] = $report['post'];
+	}
+	
+	$report_posts = array();
+	foreach ($report_queries as $board => $posts) {
+		$report_posts[$board] = array();
+		
+		$query = query(sprintf('SELECT * FROM `posts_%s` WHERE `id` = ' . implode(' OR `id` = ', $posts), $board)) or error(db_error());
+		while ($post = $query->fetch()) {
+			$report_posts[$board][$post['id']] = $post;
+		}
+	}
+	
+	$count = 0;
+	$body = '';
+	foreach ($reports as $report) {
+		if (!isset($report_posts[$report['board']][$report['post']])) {
+			// // Invalid report (post has since been deleted)
+			$query = prepare("DELETE FROM `reports` WHERE `post` = :id AND `board` = :board");
+			$query->bindValue(':id', $report['post'], PDO::PARAM_INT);
+			$query->bindValue(':board', $report['board']);
+			$query->execute() or error(db_error($query));
+			continue;
+		}
+		
+		openBoard($report['board']);
+		
+		$post = &$report_posts[$report['board']][$report['post']];
+		
+		if (!$post['thread']) {
+			// Still need to fix this:
+			$po = new Thread(
+				$post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'],
+				$post['capcode'], $post['body'], $post['time'], $post['thumb'],
+				$post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'],
+				$post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'],
+				$post['locked'], $post['sage'], $post['embed'], '?/', $mod, false
+			);
+		} else {
+			$po = new Post(
+				$post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'],
+				$post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'],
+				$post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod
+			);
+		}
+		
+		// a little messy and inefficient
+		$append_html = Element('mod/report.html', array('report' => $report, 'config' => $config, 'mod' => $mod));
+		
+		// Bug fix for https://github.com/savetheinternet/Tinyboard/issues/21
+		$po->body = truncate($po->body, $po->link(), $config['body_truncate'] - substr_count($append_html, '<br>'));
+		
+		if (mb_strlen($po->body) + mb_strlen($append_html) > $config['body_truncate_char']) {
+			// still too long; temporarily increase limit in the config
+			$__old_body_truncate_char = $config['body_truncate_char'];
+			$config['body_truncate_char'] = mb_strlen($po->body) + mb_strlen($append_html);
+		}
+		
+		$po->body .= $append_html;
+		
+		$body .= $po->build(true) . '<hr>';
+		
+		if (isset($__old_body_truncate_char))
+			$config['body_truncate_char'] = $__old_body_truncate_char;
+		
+		$count++;
+	}
+	
+	mod_page(sprintf('%s (%d)', _('Report queue'), $count), 'mod/reports.html', array('reports' => $body, 'count' => $count));
+}
+
+function mod_report_dismiss($id, $all = false) {
+	global $config;
+	
+	$query = prepare("SELECT `post`, `board`, `ip` FROM `reports` WHERE `id` = :id");
+	$query->bindValue(':id', $id);
+	$query->execute() or error(db_error($query));
+	if ($report = $query->fetch(PDO::FETCH_ASSOC)) {
+		$ip = $report['ip'];
+		$board = $report['board'];
+		$post = $report['post'];
+	} else
+		error($config['error']['404']);
+	
+	if (!$all && !hasPermission($config['mod']['report_dismiss'], $board))
+		error($config['error']['noaccess']);
+	
+	if ($all && !hasPermission($config['mod']['report_dismiss_ip'], $board))
+		error($config['error']['noaccess']);
+	
+	if ($all) {
+		$query = prepare("DELETE FROM `reports` WHERE `ip` = :ip");
+		$query->bindValue(':ip', $ip);
+	} else {
+		$query = prepare("DELETE FROM `reports` WHERE `id` = :id");
+		$query->bindValue(':id', $id);
+	}
+	$query->execute() or error(db_error($query));
+	
+	
+	if ($all)
+		modLog("Dismissed all reports by <a href=\"?/IP/$ip\">$ip</a>");
+	else
+		modLog("Dismissed a report for post #{$id}", $board);
+	
+	header('Location: ?/reports', true, $config['redirect_http']);
+}
+
+
+function mod_config() {
+	global $config, $mod;
+	
+	if (!hasPermission($config['mod']['edit_config']))
+		error($config['error']['noaccess']);
+	
+	require_once 'inc/mod/config-editor.php';
+	
+	$conf = config_vars();
+	
+	foreach ($conf as &$var) {
+		if (is_array($var['name'])) {
+			$c = &$config;
+			foreach ($var['name'] as $n)
+				$c = &$c[$n];
+		} else {
+			$c = $config[$var['name']];
+		}
+		
+		$var['value'] = $c;
+	}
+	unset($var);
+	
+	if (isset($_POST['save'])) {
+		$config_append = '';
+		
+		foreach ($conf as $var) {
+			$field_name = 'cf_' . (is_array($var['name']) ? implode('/', $var['name']) : $var['name']);
+			
+			if ($var['type'] == 'boolean')
+				$value = isset($_POST[$field_name]);
+			elseif (isset($_POST[$field_name]))
+				$value = $_POST[$field_name];
+			else
+				continue; // ???
+			
+			if (!settype($value, $var['type']))
+				continue; // invalid
+			
+			if ($value != $var['value']) {
+				// This value has been changed.
+				
+				$config_append .= '$config';
+				
+				if (is_array($var['name'])) {
+					foreach ($var['name'] as $name)
+						$config_append .= '[' . var_export($name, true) . ']';
+				} else {
+					$config_append .= '[' . var_export($var['name'], true) . ']';
+				}
+				
+				$config_append .= ' = ' . var_export($value, true) . ";\n";
+			}
+		}
+		
+		if (!empty($config_append)) {
+			$config_append = "\n// Changes made via web editor by \"" . $mod['username'] . "\" @ " . date('r') . ":\n" . $config_append . "\n";
+		
+			if (!@file_put_contents('inc/instance-config.php', $config_append, FILE_APPEND)) {
+				$config_append = htmlentities($config_append);
+				
+				if ($config['minify_html'])
+					$config_append = str_replace("\n", '&#010;', $config_append);
+				$page = array();
+				$page['title'] = 'Cannot write to file!';
+				$page['config'] = $config;
+				$page['body'] = '
+					<p style="text-align:center">Tinyboard could not write to <strong>inc/instance-config.php</strong> with the ammended configuration, probably due to a permissions error.</p>
+					<p style="text-align:center">You may proceed with these changes manually by copying and pasting the following code to the end of <strong>inc/instance-config.php</strong>:</p>
+					<textarea style="width:700px;height:370px;margin:auto;display:block;background:white;color:black" readonly>' . $config_append . '</textarea>
+				';
+				echo Element('page.html', $page);
+				exit;
+			}
+		}
+		
+		header('Location: ?/', true, $config['redirect_http']);
+		
+		exit;
+	}
+	
+	mod_page(_('Config editor'), 'mod/config-editor.html', array('conf' => $conf));
+}
+
+function mod_debug_antispam() {
+	global $pdo, $config;
+	
+	$args = array();
+	
+	if (isset($_POST['board'], $_POST['thread'])) {
+		$where = '`board` = ' . $pdo->quote($_POST['board']);
+		if ($_POST['thread'] != '')
+			$where .= ' AND `thread` = ' . $pdo->quote($_POST['thread']);
+		
+		if (isset($_POST['purge'])) {
+			$query = prepare('UPDATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE' . $where);
+			$query->bindValue(':expires', $config['spam']['hidden_inputs_expire']);
+			$query->execute() or error(db_error());
+		}
+		
+		$args['board'] = $_POST['board'];
+		$args['thread'] = $_POST['thread'];
+	} else {
+		$where = '';
+	}
+	
+	$query = query('SELECT COUNT(*) FROM `antispam`' . ($where ? " WHERE $where" : '')) or error(db_error());
+	$args['total'] = number_format($query->fetchColumn(0));
+	
+	$query = query('SELECT COUNT(*) FROM `antispam` WHERE `expires` IS NOT NULL' . ($where ? " AND $where" : '')) or error(db_error());
+	$args['expiring'] = number_format($query->fetchColumn(0));
+	
+	$query = query('SELECT * FROM `antispam` ' . ($where ? "WHERE $where" : '') . ' ORDER BY `passed` DESC LIMIT 40') or error(db_error());
+	$args['top'] = $query->fetchAll(PDO::FETCH_ASSOC);
+	
+	mod_page(_('Debug: Anti-spam'), 'mod/debug/antispam.html', $args);
+}
+
+function mod_themes_list() {
+	global $config;
+
+	if (!hasPermission($config['mod']['themes']))
+		error($config['error']['noaccess']);
+
+	if(!is_dir($config['dir']['themes']))
+		error(_('Themes directory doesn\'t exist!'));
+	if(!$dir = opendir($config['dir']['themes']))
+		error(_('Cannot open themes directory; check permissions.'));
+
+	$query = query('SELECT `theme` FROM `theme_settings` WHERE `name` IS NULL AND `value` IS NULL') or error(db_error());
+	$themes_in_use = $query->fetchAll(PDO::FETCH_COLUMN);
+
+	// Scan directory for themes
+	$themes = array();
+	while ($file = readdir($dir)) {
+		if ($file[0] != '.' && is_dir($config['dir']['themes'] . '/' . $file)) {
+			$themes[$file] = loadThemeConfig($file);
+		}
+	}
+	closedir($dir);
+
+	mod_page(_('Manage themes'), 'mod/themes.html', array(
+		'themes' => $themes,
+		'themes_in_use' => $themes_in_use,
+	));
+}
+
+function mod_theme_configure($theme_name) {
+	global $config;
+
+	if (!hasPermission($config['mod']['themes']))
+		error($config['error']['noaccess']);
+
+	if(!$theme = loadThemeConfig($theme_name)) {
+		error($config['error']['invalidtheme']);
+	}
+
+	if(isset($_POST['install'])) {
+		// Check if everything is submitted
+		foreach($theme['config'] as &$conf) {
+			if(!isset($_POST[$conf['name']]) && $conf['type'] != 'checkbox')
+				error(sprintf($config['error']['required'], $c['title']));
+		}
+		
+		// Clear previous settings
+		$query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme");
+		$query->bindValue(':theme', $theme_name);
+		$query->execute() or error(db_error($query));
+		
+		foreach($theme['config'] as &$conf) {
+			$query = prepare("INSERT INTO `theme_settings` VALUES(:theme, :name, :value)");
+			$query->bindValue(':theme', $theme_name);
+			$query->bindValue(':name', $conf['name']);
+			$query->bindValue(':value', $_POST[$conf['name']]);
+			$query->execute() or error(db_error($query));
+		}
+		
+		$query = prepare("INSERT INTO `theme_settings` VALUES(:theme, NULL, NULL)");
+		$query->bindValue(':theme', $theme_name);
+		$query->execute() or error(db_error($query));
+		
+		$result = true;
+		$message = false;
+		if(isset($theme['install_callback'])) {
+			$ret = $theme['install_callback'](themeSettings($theme_name));
+			if($ret && !empty($ret)) {
+				if(is_array($ret) && count($ret) == 2) {
+					$result = $ret[0];
+					$message = $ret[1];
+				}
+			}
+		}
+		
+		if(!$result) {
+			// Install failed
+			$query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme");
+			$query->bindValue(':theme', $theme_name);
+			$query->execute() or error(db_error($query));
+		}
+		
+		// Build themes
+		rebuildThemes('all');
+		
+		mod_page(sprintf(_($result ? 'Installed theme: %s' : 'Installation failed: %s'), $theme['name']), 'mod/theme_installed.html', array(
+			'theme_name' => $theme_name,
+			'theme' => $theme,
+			'result' => $result,
+			'message' => $message,
+		));
+	}
+
+	$settings = themeSettings($theme_name);
+
+	mod_page(sprintf(_('Configuring theme: %s'), $theme['name']), 'mod/theme_config.html', array(
+		'theme_name' => $theme_name,
+		'theme' => $theme,
+		'settings' => $settings,
+	));
+}
+
+function mod_theme_uninstall($theme_name) {
+	global $config;
+
+	if (!hasPermission($config['mod']['themes']))
+		error($config['error']['noaccess']);
+	
+	$query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme");
+	$query->bindValue(':theme', $theme_name);
+	$query->execute() or error(db_error($query));
+
+	header('Location: ?/themes', true, $config['redirect_http']);
+}
+
+function mod_theme_rebuild($theme_name) {
+	global $config;
+
+	if (!hasPermission($config['mod']['themes']))
+		error($config['error']['noaccess']);
+	
+	rebuildTheme($theme_name, 'all');
+
+	mod_page(sprintf(_('Rebuilt theme: %s'), $theme_name), 'mod/theme_rebuilt.html', array(
+		'theme_name' => $theme_name,
+	));
+}
diff --git a/inc/template.php b/inc/template.php
index 8d679d25..351bde62 100644
--- a/inc/template.php
+++ b/inc/template.php
@@ -27,7 +27,7 @@ function load_twig() {
 	$twig = new Twig_Environment($loader, array(

 		'autoescape' => false,

 		'cache' => "{$config['dir']['template']}/cache",

-		'debug' => ($config['debug'] ? true : false),

+		'debug' => $config['debug']

 	));

 	$twig->addExtension(new Twig_Extensions_Extension_Tinyboard());

 	$twig->addExtension(new Twig_Extensions_Extension_I18n());

@@ -39,7 +39,7 @@ function Element($templateFile, array $options) {
 	if (!$twig)

 		load_twig();

 	

-	if (function_exists('create_pm_header') && ((isset($options['mod']) && $options['mod']) || isset($options['__mod']))) {

+	if (function_exists('create_pm_header') && ((isset($options['mod']) && $options['mod']) || isset($options['__mod'])) && !preg_match('!^mod/!', $templateFile)) {

 		$options['pm'] = create_pm_header();

 	}

 	

diff --git a/install.php b/install.php
index 2e732c4c..1e872911 100644
--- a/install.php
+++ b/install.php
@@ -1,7 +1,7 @@
 <?php
 
 // Installation/upgrade file	
-define('VERSION', 'v0.9.6-dev-4');
+define('VERSION', 'v0.9.6-dev-5');
 
 require 'inc/functions.php';
 
@@ -210,6 +210,8 @@ if (file_exists($config['has_installed'])) {
 			}
 		case 'v0.9.6-dev-3':
 			query("ALTER TABLE  `antispam` CHANGE  `hash`  `hash` CHAR( 40 ) NOT NULL") or error(db_error());
+		case 'v0.9.6-dev-4':
+			query("ALTER TABLE  `news` DROP INDEX  `id`, ADD PRIMARY KEY ( `id` )") or error(db_error());
 		case false:
 			// Update version number
 			file_write($config['has_installed'], VERSION);
diff --git a/mod-old.php b/mod-old.php
new file mode 100644
index 00000000..31273e39
--- /dev/null
+++ b/mod-old.php
@@ -0,0 +1,3128 @@
+<?php
+
+/*
+ *  Copyright (c) 2010-2012 Tinyboard Development Group
+ */
+
+// WARNING: This file is currently a clusterfuck of code. I will be rewriting it very soon.
+
+require 'inc/functions.php';
+require 'inc/mod.php';
+
+if (get_magic_quotes_gpc()) {
+	function strip_array($var) {
+		return is_array($var) ? array_map('strip_array', $var) : stripslashes($var);
+	}
+	
+	$_GET = strip_array($_GET);
+	$_POST = strip_array($_POST);
+}
+
+$query = isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '';
+
+// If not logged in
+if(!$mod) {
+	if(isset($_POST['login'])) {
+		// Check if inputs are set and not empty
+		if(	!isset($_POST['username']) ||
+			!isset($_POST['password']) ||
+			empty($_POST['username']) ||
+			empty($_POST['password'])
+			) loginForm($config['error']['invalid'], $_POST['username'], '?' . $query);
+		
+		
+		if(!login($_POST['username'], $_POST['password'])) {
+			if($config['syslog'])
+				_syslog(LOG_WARNING, 'Unauthorized login attempt!');
+			loginForm($config['error']['invalid'], $_POST['username'], '?' . $query);
+		}
+		
+		modLog("Logged in.");
+		
+		// Login successful
+		// Set cookies
+		setCookies();
+		
+		// Redirect
+		if(isset($_POST['redirect']))
+			header('Location: ' . $_POST['redirect'], true, $config['redirect_http']);
+		else
+			header('Location: ?' . $config['mod']['default'], true, $config['redirect_http']);
+	} else {
+		loginForm(false, false, '?' . $query);
+	}
+} else {
+	// Redirect (for index pages)
+	if(count($_GET) == 2 && isset($_GET['status']) && isset($_GET['r'])) {
+		header('Location: ' . $_GET['r'], true, $_GET['status']);
+		exit;
+	}
+	
+	// A sort of "cache"
+	// Stops calling preg_quote and str_replace when not needed; only does it once
+	$regex = array(
+		'board' => str_replace('%s', '(\w{1,8})', preg_quote($config['board_path'], '/')),
+		'page' => str_replace('%d', '(\d+)', preg_quote($config['file_page'], '/')),
+		'img' => preg_quote($config['dir']['img'], '/'),
+		'thumb' => preg_quote($config['dir']['thumb'], '/'),
+		'res' => preg_quote($config['dir']['res'], '/'),
+		'index' => preg_quote($config['file_index'], '/')
+	);
+	
+	if(preg_match('/^\/?$/', $query)) {
+		// Dashboard
+		$fieldset = array(
+			'Boards' => '',
+			'Noticeboard' => '',
+			'Administration' => '',
+			'Themes' => '',
+			'Search' => '',
+			'Update' => '',
+			'Logout' => ''
+		);
+		
+		// Boards
+		$fieldset['Boards'] .= ulBoards();
+		
+		if(hasPermission($config['mod']['noticeboard'])) {
+			if(!$config['cache']['enabled'] || !($fieldset['Noticeboard'] = cache::get('noticeboard_preview'))) {
+				$query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit");
+				$query->bindValue(':limit', $config['mod']['noticeboard_dashboard'], PDO::PARAM_INT);
+				$query->execute() or error(db_error($query));
+			
+				$fieldset['Noticeboard'] .= '<li>';
+			
+				$_body = '';
+				while($notice = $query->fetch()) {					
+					$_body .= '<li><a href="?/noticeboard#' .
+						$notice['id'] .
+					'">' .
+					($notice['subject'] ?
+						$notice['subject']
+					:
+						'<em>' . _('no subject') . '</em>'
+					) .
+				'</a><span class="unimportant"> &mdash; by ' .
+					(isset($notice['username']) ?
+						utf8tohtml($notice['username'])
+					: '<em>???</em>') .
+				' at ' .
+					strftime($config['post_date'], $notice['time']) .
+				'</span></li>';
+				}
+				if(!empty($_body)) {
+					$fieldset['Noticeboard'] .= '<ul>' . $_body . '</ul></li><li>';
+				}
+				if($config['cache']['enabled'])
+					cache::set('noticeboard_preview', $fieldset['Noticeboard']);
+			}
+			
+			$fieldset['Noticeboard'] .= '<a href="?/noticeboard">' . _('View all entries') . '</a></li>';
+		
+			$query = prepare("SELECT COUNT(*) AS `count` FROM `pms` WHERE `to` = :id AND `unread` = 1");
+			$query->bindValue(':id', $mod['id']);
+			$query->execute() or error(db_error($query));
+			$count = $query->fetch();
+			$count = $count['count'];
+		
+			$fieldset['Noticeboard'] .= '<li><a href="?/inbox">' . _('PM Inbox') . 
+				($count > 0
+				?
+					' <strong>(' . $count . ' unread)</strong>'
+				: '') .
+			'</a></li>';
+		
+			$fieldset['Noticeboard'] .= '<li><a href="?/news">' . _('News') . '</a></li>';
+		}
+		
+		
+		if(hasPermission($config['mod']['reports'])) {
+			$fieldset['Administration'] .= 	'<li><a href="?/reports">' . _('Report queue') . '</a></li>';
+		}
+		if(hasPermission($config['mod']['view_banlist'])) {
+			$fieldset['Administration'] .= 	'<li><a href="?/bans">' . _('Ban list') . '</a></li>';
+		}
+		if(hasPermission($config['mod']['manageusers'])) {
+			$fieldset['Administration'] .= 	'<li><a href="?/users">' . _('Manage users') . '</a></li>';
+		} elseif(hasPermission($config['mod']['change_password'])) {
+			$fieldset['Administration'] .= 	'<li><a href="?/users/' . $user['id'] . '">' . _('Change own password') . '</a></li>';
+		}
+		if(hasPermission($config['mod']['modlog'])) {
+			$fieldset['Administration'] .= 	'<li><a href="?/log">' . _('Moderation log') . '</a></li>';
+		}
+		if(hasPermission($config['mod']['rebuild'])) {
+			$fieldset['Administration'] .= 	'<li><a href="?/rebuild">' . _('Rebuild static files') . '</a></li>';
+		}
+		if(hasPermission($config['mod']['rebuild']) && $config['cache']['enabled']) {
+			$fieldset['Administration'] .= 	'<li><a href="?/flush">' . _('Clear cache') . '</a></li>';
+		}
+		if(hasPermission($config['mod']['show_config'])) {
+			$fieldset['Administration'] .= 	'<li><a href="?/config">' . _('Show configuration') . '</a></li>';
+		}
+		
+		if(hasPermission($config['mod']['themes'])) {
+			$fieldset['Themes'] .= 	'<li><a href="?/themes">' . _('Manage themes') . '</a></li>';
+		}
+		
+		if(hasPermission($config['mod']['search'])) {
+			$fieldset['Search'] .= 	'<li><form style="display:inline" action="?/search" method="post">' .
+			'<label style="display:inline" for="search">' . _('Phrase:') . '</label> ' .
+				'<input id="search" name="search" type="text" size="35" />' .
+				'<input type="submit" value="' . _('Search') . '" />' .
+			'</form>' .
+				'<p class="unimportant">' . _('(Search is case-insensitive, and based on keywords. To match exact phrases, use "quotes". Use an asterisk (*) for wildcard.)') . '</p>' .
+			'</li>';
+		}
+		
+		if($mod['type'] >= ADMIN && $config['check_updates']) {
+			if(!$config['version'])
+				error(_('Could not find current version! (Check .installed)'));
+			if(isset($_COOKIE['update'])) {
+				$latest = unserialize($_COOKIE['update']);
+			} else {
+				$ctx = stream_context_create(array( 
+					'http' => array(
+						'timeout' => 3
+						) 
+					) 
+				);
+				
+				if($code = @file_get_contents('http://tinyboard.org/version.txt', 0, $ctx)) {
+					eval($code);
+					if(preg_match('/v(\d+)\.(\d)\.(\d+)(-dev.+)?$/', $config['version'], $m)) {
+						$current = array(
+							'massive' => (int)$m[1],
+							'major' => (int)$m[2],
+							'minor' => (int)$m[3]
+						);
+						if(isset($m[4])) { 
+							// Development versions are always ahead in the versioning numbers
+							$current['minor'] --;
+						}
+					}
+					// Check if it's newer
+					if(	$latest['massive'] > $current['massive'] ||
+						$latest['major'] > $current['major'] ||
+							($latest['massive'] == $current['massive'] &&
+								$latest['major'] == $current['major'] &&
+								$latest['minor'] > $current['minor']
+							)) {
+						$latest = $latest;
+					} else $latest = false;
+				} else {
+					// Couldn't get latest version
+					// TODO: Display some sort of warning message
+					$latest = false;
+				}
+				
+				
+				setcookie('update', serialize($latest), time() + $config['check_updates_time'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, true);
+			}
+			
+			if($latest) {
+				$fieldset['Update'] .=
+					'<li>A newer version of Tinyboard (<strong>v' .
+						$latest['massive'] . '.' .
+						$latest['major'] . '.' . 
+						$latest['minor'] .
+					'</strong>) is available! See <a href="http://tinyboard.org">http://tinyboard.org/</a> for upgrade instructions.</li>';
+			}
+		}
+		
+		$fieldset['Logout'] .= '<li><a href="?/logout">' . _('Logout') . '</a></li>';
+		
+		// TODO: Statistics, etc, in the dashboard.
+		
+		$body = '';
+		foreach($fieldset as $title => $data) {
+			if($data)
+				$body .= '<fieldset><legend>' . _($title) . '</legend><ul>' . $data . '</ul></fieldset>';
+		}
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>_('Dashboard'),
+			'body'=>$body,
+			'__mod'=>true
+		));
+	} elseif(preg_match('/^\/logout$/', $query)) {
+		destroyCookies();
+		
+		header('Location: ?/', true, $config['redirect_http']);
+	} elseif(preg_match('/^\/confirm\/(.+)$/', $query, $matches)) {
+		$uri = &$matches[1];
+		
+		$body = '<p style="text-align:center">' .
+		'<span class="heading" style="margin-bottom:6px">Are you sure you want to do that?</span>' .
+			'We were unable to serve a confirmation dialog for ' .
+				'<strong>?/' . utf8tohtml($uri) . '</strong>' .
+			', probably due to Javascript being disabled.' .
+		'</p>' .
+		'<p style="text-align:center"><a style="margin:block;font-size:150%;font-weight:bold" href="?/' . utf8tohtml($uri) . '">Confirm</a></p>';
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>'Confirm',
+			'body'=>$body,
+			'mod'=>true
+			)
+		);
+	} elseif(preg_match('/^\/upgrade$/', $query)) {
+		if($mod['type'] != ADMIN)
+			error($config['error']['noaccess']);
+		
+		if(is_dir('.git')) {
+			// use git instead
+			
+			$body = '<div class="ban"><h2>git pull</h2>';
+			$body .= '<p>' . str_replace("\n", '<br/>', shell_exec('git pull')) . '</p>';
+			$body .= '</div>';
+			echo Element('page.html', array(
+				'config' => $config,
+				'title' => 'Upgraded',
+				'body' => $body
+			));
+			exit;
+		}
+		
+		if(!extension_loaded('curl'))
+			error('You need the cURL PHP extension to do that.');
+		
+		if(!class_exists('ZipArchive'))
+			error('You need <a href="http://php.net/manual/en/class.ziparchive.php">the ZipArchive class</a> to do that.');
+		
+		if(!in_array('zip', stream_get_wrappers()))
+			error('You need the zip:// stream wrapper to do that.');
+		
+		$temp = tempnam($config['tmp'], 'tinyboard');
+		
+		$fp = fopen($temp, 'w+');
+		
+		$curl = curl_init();
+		curl_setopt($curl, CURLOPT_URL, 'https://github.com/savetheinternet/Tinyboard/zipball/master');
+		curl_setopt($curl, CURLOPT_FAILONERROR, true);
+		curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
+		curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, true);
+		curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 2);
+		curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, 5);
+		curl_setopt($curl, CURLOPT_TIMEOUT, 45);
+		curl_setopt($curl, CURLOPT_FILE, $fp);
+		curl_setopt($curl, CURLOPT_WRITEHEADER, $header = tmpfile());
+		curl_setopt($curl, CURLOPT_HEADER, true);
+		
+		curl_exec($curl);
+		
+		if(curl_errno($curl))
+			error('Failed downloading newest revision: ' . curl_error($curl));
+		
+		curl_close($curl);
+		
+		fflush($fp);
+		fclose($fp);
+		
+		fseek($header, 0);
+		$version = false;
+		while($line = fgets($header)) {
+			if(preg_match('/^Content-Disposition: attachment; filename=savetheinternet-Tinyboard-(.+)\.zip\s?$/', $line, $m)) {
+				$version = $m[1];
+			}
+		}
+		fclose($header);
+		
+		$zip = new ZipArchive();
+		if(!$zip->open($temp))
+			error('Could not make sense of the ZIP archive.');
+		
+		$version = preg_replace('/^savetheinternet-Tinyboard-(\w+)\//', '$1', $dir = $zip->getNameIndex(0));
+		
+		$errors = array();
+		for($i = 1; $i < $zip->numFiles; $i++) {
+			$filename = str_replace($dir, '', $zip->getNameIndex($i));
+			
+			if($filename == 'inc/instance-config.php')
+				continue; // don't override config
+			
+			// are we able to write here?
+			if(!((file_exists($filename) && is_writable($filename)) || (!file_exists($filename) && is_writable(dirname($filename))))) {
+				// nope
+				$errors[] = 'Cannot write to ' . $filename . '!';
+			}
+		}
+		
+		$zip->close();
+		
+		if($errors) {
+			$body = '<div class="ban"><h2>Error(s) upgrading</h2><p>Tinyboard can not self-upgrade until the following is fixed:</p><ul>';
+			foreach($errors as $error) {
+				$body .= '<li>' . $error . '</li>';
+			}
+			$body .= '</ul><p>Please fix the above errors and refresh to try again.</p></div>';
+			
+			unlink($temp);
+			
+			echo Element('page.html', array(
+				'config' => $config,
+				'title' => 'Error(s) upgrading',
+				'body' => $body
+			));
+			exit;
+		}
+		
+		// For some reason, reading the ZIP entries in PHP doesn't seem to work very well.
+		// Use shell instead.
+		shell_exec('TEMP_DIR=$(mktemp -d); unzip -q ' . escapeshellarg($temp) . ' -d $TEMP_DIR -x "' . escapeshellarg($dir) . 'inc/instance-config.php"; mv -v $TEMP_DIR/' . escapeshellarg($dir) . '* "' . getcwd() . '"; rm -rf $TEMP_DIR');
+		
+		unlink($temp);
+		
+		echo Element('page.html', array(
+			'config' => $config,
+			'title' => 'Upgraded',
+			'body' => '<p style="text-align:center">Upgrading seems to have gone okay. You are now at revision <strong>' . $version . '</strong>.</p>'
+		));		
+	} elseif(preg_match('/^\/log(\/(\d+))?$/', $query, $match)) {
+		if(!hasPermission($config['mod']['modlog'])) error($config['error']['noaccess']);
+		
+		$page = isset($match[2]) ? $match[2] : 1;
+		
+		$boards = array();
+		$_boards = listBoards();
+		foreach($_boards as &$_b) {
+			$boards[$_b['id']] = $_b['uri'];
+		}
+		
+		$query = prepare("SELECT `mod` as `id`, `username`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY `time` DESC LIMIT :offset, :limit");
+		$query->bindValue(':limit', $config['mod']['modlog_page'], PDO::PARAM_INT);
+		$query->bindValue(':offset', ($page - 1) * $config['mod']['modlog_page'], PDO::PARAM_INT);
+		$query->execute() or error(db_error($query));
+		
+		if(!$query->rowCount()) {
+			$body = '<p class="unimportant" style="text-align:center">(Nothing to display.)</p>';
+		} else {
+			$body = '<table class="modlog">' . 
+				'<tr>' . 
+					'<th>' . _('User') . '</th>' . 
+					'<th>' . _('IP address') . '</th>' .
+					'<th>' . _('Ago') . '</th>' . 
+					'<th>' . _('Board') . '</th>' . 
+					'<th>' . _('Action') . '</th>' . 
+				'</tr>';
+			while($log = $query->fetch()) {
+				$log_id = 'log_' . md5($log['text']);
+				
+				if($config['cache']['enabled'] && $_log = cache::get($log_id))
+					$log['text'] = $_log;
+				else {
+				
+					$log['text'] = utf8tohtml($log['text']);
+					$log['text'] = preg_replace('/(\d+\.\d+\.\d+\.\d+)/', '<a href="?/IP/$1">$1</a>', $log['text']);
+				
+					if(isset($boards[$log['board']])) {
+						if(preg_match('/post #(\d+)/', $log['text'], $match)) {
+							$post_query = prepare(sprintf("SELECT `thread` FROM `posts_%s` WHERE `id` = :id", $boards[$log['board']]));
+							$post_query->bindValue(':id', $match[1], PDO::PARAM_INT);
+							$post_query->execute() or error(db_error($query));
+						
+							if($post = $post_query->fetch()) {
+								$log['text'] = preg_replace('/post (#(\d+))/',
+									'post <a href="' .
+										'?/' .
+										sprintf($config['board_path'], $boards[$log['board']]) .
+										$config['dir']['res'] .
+										($post['thread'] ?
+											sprintf($config['file_page'], $post['thread']) . '#' . $match[1]
+										: sprintf($config['file_page'], $match[1])) .
+									'">$1</a>', $log['text']);
+							} else {
+								$log['text'] = preg_replace('/post (#(\d+))/', 'post <s>$1</s>', $log['text']);
+							}
+							
+							if($config['cache']['enabled'])
+								cache::set($log_id, $log['text']);
+						}
+					}
+				}
+				
+				$body .= '<tr>' .
+				'<td class="minimal">' .
+					($log['username'] ? 
+						'<a href="?/new_PM/' . $log['id'] . '">' . $log['username'] . '</a>'
+					: '<em>' . ($log['id'] < 0 ? 'system' : 'deleted?') . '</em>') .
+				'</td>' .
+				'<td class="minimal">' . ($log['id'] < 0 ? '&ndash;' : '<a href="?/IP/' . $log['ip'] . '">' . $log['ip'] . '</a>') . '</td>' .
+				'<td class="minimal">' . ago($log['time']) . '</td>' .
+				'<td class="minimal">' .
+					($log['board'] ?
+						'<a href="?/' . sprintf($config['board_path'], $log['board']) . $config['file_index'] . '">' . sprintf($config['board_abbreviation'], $log['board']) . '</a></td>'
+					: '-') .
+				'<td>' . $log['text'] . '</td>' .
+				'</tr>';
+			}
+		
+			$body .= '</table>';
+			
+			$query = prepare("SELECT COUNT(*) AS `count` FROM `modlogs`");
+			$query->execute() or error(db_error($query));
+			$count = $query->fetch();
+			
+			$body .= '<p class="unimportant" style="text-align:center;word-wrap:break-word">';
+			for($x = 0; $x < $count['count'] / $config['mod']['modlog_page']; $x ++) {
+				$body .= '<a href="?/log/' . ($x+1) . '">[' . ($x + 1) . ']</a> ';
+			}
+			$body .= '</p>';
+		}
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>_('Moderation log'),
+			'body'=>$body,
+			'mod'=>true
+			)
+		);
+	} elseif(preg_match('/^\/themes\/none$/', $query, $match)) {
+		if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']);
+		
+		// Clearsettings
+		query("TRUNCATE TABLE `theme_settings`") or error(db_error());
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>'No theme',
+			'body'=>'<p style="text-align:center">Successfully uninstalled all themes.</p>' .
+				'<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>',
+			'mod'=>true
+			)
+		);
+	} elseif(preg_match('/^\/themes\/([\w\-]+)\/rebuild$/', $query, $match)) {
+		if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']);
+		
+		rebuildTheme($match[1], 'all');
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>'Rebuilt',
+			'body'=>'<p style="text-align:center">Successfully rebuilt the <strong>' . $match[1] . '</strong> theme.</p>' .
+				'<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>',
+			'mod'=>true
+			)
+		);
+	} elseif(preg_match('/^\/themes\/(\w+)\/uninstall$/', $query, $match)) {
+		if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']);
+		
+		$query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme");
+		$query->bindValue(':theme', $match[1]);
+		$query->execute() or error(db_error($query));
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>'Uninstalled',
+			'body'=>'<p style="text-align:center">Successfully uninstalled the <strong>' . $match[1] . '</strong> theme.</p>' .
+				'<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>',
+			'mod'=>true
+			)
+		);
+	} elseif(preg_match('/^\/themes(\/([\w\-]+))?$/', $query, $match)) {
+		if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']);
+		
+		if(!is_dir($config['dir']['themes']))
+			error(_('Themes directory doesn\'t exist!'));
+		if(!$dir = opendir($config['dir']['themes']))
+			error(_('Cannot open themes directory; check permissions.'));
+		
+		if(isset($match[2])) {
+			$_theme = &$match[2];
+			
+			if(!$theme = loadThemeConfig($_theme)) {
+				error($config['error']['invalidtheme']);
+			}
+			
+			if(isset($_POST['install'])) {
+				// Check if everything is submitted
+				foreach($theme['config'] as &$c) {
+					if(!isset($_POST[$c['name']]) && $c['type'] != 'checkbox')
+						error(sprintf($config['error']['required'], $c['title']));
+				}
+				
+				// Clear previous settings
+				$query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme");
+				$query->bindValue(':theme', $_theme);
+				$query->execute() or error(db_error($query));
+				
+				foreach($theme['config'] as &$c) {
+					$query = prepare("INSERT INTO `theme_settings` VALUES(:theme, :name, :value)");
+					$query->bindValue(':theme', $_theme);
+					$query->bindValue(':name', $c['name']);
+					$query->bindValue(':value', $_POST[$c['name']]);
+					$query->execute() or error(db_error($query));
+				}
+				
+				$query = prepare("INSERT INTO `theme_settings` VALUES(:theme, NULL, NULL)");
+				$query->bindValue(':theme', $_theme);
+				$query->execute() or error(db_error($query));
+				
+				$result = true;
+				$body = '';
+				if(isset($theme['install_callback'])) {
+					$ret = $theme['install_callback'](themeSettings($_theme));
+					if($ret && !empty($ret)) {
+						if(is_array($ret) && count($ret) == 2) {
+							$result = $ret[0];
+							$ret = $ret[1];
+						}
+						$body .= '<div style="border:1px dashed maroon;padding:20px;margin:auto;max-width:800px">' . $ret . '</div>';
+					}
+				}
+				
+				if($result) {
+					$body .= '<p style="text-align:center">Successfully installed and built theme.</p>';
+				} else {
+					// install failed
+					$query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme");
+					$query->bindValue(':theme', $_theme);
+					$query->execute() or error(db_error($query));
+				}
+				
+				$body .= '<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>';
+				
+				// Build themes
+				rebuildThemes('all');
+				
+				echo Element('page.html', array(
+					'config'=>$config,
+					'title'=>($result ? 'Installed "' . utf8tohtml($theme['name']) . '"' : 'Installation failed!'),
+					'body'=>$body,
+					'mod'=>true
+					)
+				);
+			} else {
+				$body = '<form action="" method="post">';
+				
+				if(!isset($theme['config']) || empty($theme['config'])) {
+					$body .= '<p style="text-align:center" class="unimportant">(No configuration required.)</p>';
+				} else {
+					$settings = themeSettings($_theme);
+					
+					$body .= '<table>';
+					foreach($theme['config'] as &$c) {
+						$body .= '<tr><th>' . $c['title'] . '</th><td>';
+						switch($c['type']) {
+							case 'text':
+							default:
+								$body .= '<input type="text" name="' . utf8tohtml($c['name']) . '" ' .
+									(isset($settings[$c['name']]) ?
+										' value="' . utf8tohtml($settings[$c['name']]) . '" '
+									:
+										(isset($c['default']) ?
+											'value="' . utf8tohtml($c['default']) . '" '
+										: '')
+									) .
+									(isset($c['size']) ? 'size="' . (int)$c['size'] . '" ' :'') .
+								'/>';
+						}
+						if(isset($c['comment']))
+							$body .= ' <span class="unimportant">' . $c['comment'] . '</span>';
+						$body .= '</td></tr>';
+					}
+					$body .= '</table>';
+				}
+				
+				$body .= '<p style="text-align:center"><input name="install" type="submit" value="Install theme" /></p></form>';
+				
+				echo Element('page.html', array(
+					'config'=>$config,
+					'title'=>'Installing "' . utf8tohtml($theme['name']) . '"',
+					'body'=>$body,
+					'mod'=>true
+					)
+				);
+			}
+		} else {
+			
+			$themes_in_use = array();
+			$query = query("SELECT `theme` FROM `theme_settings` WHERE `name` IS NULL AND `value` IS NULL") or error(db_error());
+			while($theme = $query->fetch()) {
+				$themes_in_use[$theme['theme']] = true;
+			}
+			
+			// Scan directory for themes
+			$themes = array();
+			while($file = readdir($dir)) {
+				if($file[0] != '.' && is_dir($config['dir']['themes'] . '/' . $file)) {
+					$themes[] = $file;
+				}
+			}
+			closedir($dir);
+			
+			$body = '';
+			if(empty($themes)) {
+				$body = '<p style="text-align:center" class="unimportant">(No themes installed.)</p>';
+			} else {
+				$body .= '<table class="modlog">';
+				foreach($themes as &$_theme) {
+					$theme = loadThemeConfig($_theme);
+					
+					markup($theme['description']);
+					
+					$body .= '<tr>' .
+								'<th class="minimal">' . _('Name') . '</th>' .
+								'<td>' . utf8tohtml($theme['name']) . '</td>' .
+							'</tr>' .
+							'<tr>' .
+								'<th class="minimal">' . _('Version') . '</th>' .
+								'<td>' . utf8tohtml($theme['version']) . '</td>' .
+							'</tr>' .
+							'<tr>' .
+								'<th class="minimal">' . _('Description') . '</th>' .
+								'<td>' . $theme['description'] . '</td>' .
+							'</tr>' .
+							'<tr>' .
+								'<th class="minimal">' . _('Thumbnail') . '</th>' .
+								'<td><img style="float:none;margin:4px' . 
+									(isset($themes_in_use[$_theme]) ?
+										';border:2px solid red;padding:4px'
+									: '') .
+									'" src="' . $config['dir']['themes_uri'] . '/' . $_theme . '/thumb.png" /></td>' .
+							'</tr>' .
+							'<tr>' .
+								'<th class="minimal">' . _('Actions') . '</th>' .
+								'<td><ul style="padding:0 20px">' .
+									'<li><a title="' . _('Use theme') . '" href="?/themes/' . $_theme . '">' .
+										(isset($themes_in_use[$_theme]) ? _('Reconfigure') : _('Install')) .
+									'</a></li>' .
+									(isset($themes_in_use[$_theme]) ?
+										'<li><a href="?/themes/' . $_theme . '/rebuild">' . _('Rebuild') . '</a></li>' .
+										'<li><a href="?/themes/' . $_theme . '/uninstall">' . _('Uninstall') . '</a></li>'
+									:
+										'') .
+								'</ul></td>' .
+							'</tr>' .
+							'<tr style="height:40px"><td colspan="2"><hr/></td></tr>';
+				}
+				$body .= '</table>';
+			}
+			
+			if(!empty($themes_in_use))
+				$body .= '<p style="text-align:center"><a href="?/themes/none">' . _('Uninstall all themes.') . '</a></p>';
+			
+			echo Element('page.html', array(
+				'config'=>$config,
+				'title'=>_('Manage themes'),
+				'body'=>$body,
+				'mod'=>true
+				)
+			);
+		}
+	} elseif(preg_match('/^\/noticeboard\/delete\/(\d+)$/', $query, $match)) {
+		if(!hasPermission($config['mod']['noticeboard_delete'])) error($config['error']['noaccess']);
+		
+		$query = prepare("DELETE FROM `noticeboard` WHERE `id` = :id");
+		$query->bindValue(':id', $match[1], PDO::PARAM_INT);
+		$query->execute() or error(db_error($query));
+		
+		if($config['cache']['enabled'])
+			cache::delete('noticeboard_preview');
+		
+		header('Location: ?/noticeboard', true, $config['redirect_http']);
+	} elseif(preg_match('/^\/noticeboard$/', $query)) {
+		if(!hasPermission($config['mod']['noticeboard'])) error($config['error']['noaccess']);
+		
+		$body = '';
+		
+		if(hasPermission($config['mod']['noticeboard_post']) && isset($_POST['subject']) && isset($_POST['body']) && !empty($_POST['body'])) {
+				$query = prepare("INSERT INTO `noticeboard` VALUES (NULL, :mod, :time, :subject, :body)");
+				$query->bindValue(':mod', $mod['id'], PDO::PARAM_INT);
+				$query->bindvalue(':time', time(), PDO::PARAM_INT);
+				$query->bindValue(':subject', utf8tohtml($_POST['subject']));
+				
+				markup($_POST['body']);
+				$query->bindValue(':body', $_POST['body']);
+				$query->execute() or error(db_error($query));
+				
+				if($config['cache']['enabled'])
+					cache::delete('noticeboard_preview');
+				
+				header('Location: ?/noticeboard#' . $pdo->lastInsertId(), true, $config['redirect_http']);
+		} else {
+			
+			if(hasPermission($config['mod']['noticeboard_post'])) {
+				$body .= '<fieldset><legend>New post</legend><form style="display:inline" action="" method="post"><table>' .
+				'<tr>' .
+					'<th><label for="subject">' . _('Name') . '</label></th>' .
+					'<td>' . $mod['username'] . '</td>' .
+				'</tr><tr>' .
+					'<th>' . _('Subject') . '</th>' .
+					'<td><input type="text" size="55" name="subject" id="subject" /></td>' .
+				'</tr><tr>' .
+					'<th>' . _('Body') . '</th>' .
+					'<td><textarea name="body" style="width:100%;height:100px"></textarea></td>' .
+				'</tr><tr>' .
+					'<td></td><td><input type="submit" value="' . _('Post to noticeboard') . '" /></td>' .
+				'</tr></table>' .
+				'</form></fieldset>';
+			}
+			
+			$query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit");
+			$query->bindValue(':limit', $config['mod']['noticeboard_display'], PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+			while($notice = $query->fetch()) {
+				$body .= '<div class="ban">' .
+					(hasPermission($config['mod']['noticeboard_delete']) ?
+						'<span style="float:right;padding:2px"><a class="unimportant" href="?/noticeboard/delete/' . $notice['id'] . '">[delete]</a></span>'
+					: '') .
+				'<h2 id="' . $notice['id'] . '">' .
+					($notice['subject'] ?
+						$notice['subject']
+					:
+						'<em>' . _('no subject') . '</em>'
+					) .
+				'<span class="unimportant"> &mdash; by ' .
+					(isset($notice['username']) ?
+						utf8tohtml($notice['username'])
+					:
+						'<em>???</em>'
+					) .
+				' at ' .
+					strftime($config['post_date'], $notice['time']) .
+				'</span></h2><p>' . $notice['body'] . '</p></div>';
+			}
+		
+		
+			echo Element('page.html', array(
+				'config'=>$config,
+				'title'=>_('Noticeboard'),
+				'body'=>$body,
+				'mod'=>true
+				)
+			);
+		}
+	} elseif(preg_match('/^\/news\/delete\/(\d+)$/', $query, $match)) {
+		if(!hasPermission($config['mod']['noticeboard_delete'])) error($config['error']['noaccess']);
+		
+		$query = prepare("DELETE FROM `news` WHERE `id` = :id");
+		$query->bindValue(':id', $match[1], PDO::PARAM_INT);
+		$query->execute() or error(db_error($query));
+		
+		rebuildThemes('news');
+		
+		header('Location: ?/news', true, $config['redirect_http']);
+	} elseif(preg_match('/^\/news$/', $query)) {			
+		$body = '';
+		
+		if(hasPermission($config['mod']['news'])) {
+			if(isset($_POST['subject']) && isset($_POST['body']) && !empty($_POST['body'])) {
+				$query = prepare("INSERT INTO `news` VALUES (NULL, :name, :time, :subject, :body)");
+				
+				if(isset($_POST['name']) && hasPermission($config['mod']['news_custom']))
+					$name = &$_POST['name'];
+				else
+					$name = &$mod['username'];
+				
+				$query->bindValue(':name', utf8tohtml($name), PDO::PARAM_INT);
+				$query->bindvalue(':time', time(), PDO::PARAM_INT);
+				$query->bindValue(':subject', utf8tohtml($_POST['subject']));
+				
+				markup($_POST['body']);
+				$query->bindValue(':body', $_POST['body']);
+				$query->execute() or error(db_error($query));
+				
+				rebuildThemes('news');
+			}
+			
+			$body .= '<fieldset><legend>New post</legend><form style="display:inline" action="" method="post"><table>' .
+			'<tr>' .
+				'<th>' . _('Name') . '</th>' .
+				(hasPermission($config['mod']['news_custom']) ?
+					'<td><input type="text" size="55" name="name" id="name" value="' . utf8tohtml($mod['username']) . '" /></td>'
+				:
+					'<td>' . $mod['username'] . '</td>') .
+			'</tr><tr>' .
+				'<th>' . _('Subject') . '</th>' .
+				'<td><input type="text" size="55" name="subject" id="subject" /></td>' .
+			'</tr><tr>' .
+				'<th>' . _('Body') . '</th>' .
+				'<td><textarea name="body" style="width:100%;height:100px"></textarea></td>' .
+			'</tr><tr>' .
+				'<td></td><td><input type="submit" value="' . _('Post to news') . '" /></td>' .
+			'</tr></table>' .
+			'</form></fieldset>';
+		}
+		
+		$query = prepare("SELECT * FROM `news` ORDER BY `id` DESC LIMIT :limit");
+		$query->bindValue(':limit', $config['mod']['noticeboard_display'], PDO::PARAM_INT);
+		$query->execute() or error(db_error($query));
+		while($news = $query->fetch()) {			
+			$body .= '<div class="ban">' .
+				(hasPermission($config['mod']['news_delete']) ?
+					'<span style="float:right;padding:2px"><a class="unimportant" href="?/news/delete/' . $news['id'] . '">[delete]</a></span>'
+				: '') .
+			'<h2 id="' . $news['id'] . '">' .
+				($news['subject'] ?
+					$news['subject']
+				:
+					'<em>' . _('no subject') . '</em>'
+				) .
+			'<span class="unimportant"> &mdash; by ' .
+				$news['name'] .
+			' at ' .
+				strftime($config['post_date'], $news['time']) .
+			'</span></h2><p>' . $news['body'] . '</p></div>';
+		}
+		
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>_('News'),
+			'body'=>$body,
+			'mod'=>true
+			)
+		);
+	} elseif(preg_match('/^\/inbox\/readall$/', $query, $match)) {
+		$query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `to` = :id");
+		$query->bindValue(':id', $mod['id'], PDO::PARAM_INT);
+		$query->execute() or error(db_error($query));
+		
+		modLog('Marked all PMs as read');
+		
+		header('Location: ?/inbox', true, $config['redirect_http']);
+	} elseif(preg_match('/^\/inbox$/', $query, $match)) {
+		$query = prepare("SELECT `unread`,`pms`.`id`, `time`, `sender`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `to` = :mod ORDER BY `unread` DESC, `time` DESC");
+		$query->bindValue(':mod', $mod['id'], PDO::PARAM_INT);
+		$query->execute() or error(db_error($query));
+		
+		if($query->rowCount() == 0) {
+			$body = '<p style="text-align:center" class="unimportant">(' . _('No private messages for you.') . ')</p>';
+		} else {
+			$unread_pms = 0;
+			
+			$body = '<table class="modlog"><tr><th>ID</th><th>From</th><th>Date</th><th>Message snippet</th></tr>';
+			while($pm = $query->fetch()) {
+				$body .= '<tr' . ($pm['unread'] ? ' style="font-weight:bold"' : '') . '>' . 
+						'<td class="minimal"><a href="?/PM/' . $pm['id'] . '">' . $pm['id'] . '</a></td>' .
+						'<td class="minimal">' .
+							($pm['username'] ?
+								'<a href="?/new_PM/' . $pm['sender'] . '">' . $pm['username'] . '</a>'
+							: '<em>deleted?</em>') .
+						'</td>' .
+						'<td class="minimal">' . strftime($config['post_date'], $pm['time']) . '</td>' .
+						'<td><a href="?/PM/' . $pm['id'] . '">' . pm_snippet($pm['message']) . '</a></td>' .
+					'</tr>';
+				
+				if($pm['unread'])
+					$unread_pms++;
+			}
+			$body .= '</table>';
+			
+			if($unread_pms) {
+				$body = '<p style="text-align:center" class="unimportant">(<a href="?/inbox/readall">Mark all as read</a>)</p>' . $body;
+			}
+		}
+		
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>_('PM Inbox') . ' (' . ($query->rowCount() == 0 ? _('empty') : $unread_pms . ' ' . _('unread')) . ')',
+			'body'=>$body,
+			'mod'=>true
+			)
+		);
+	} elseif(preg_match('/^\/PM\/(\d+)$/', $query, $match)) {
+		$id = &$match[1];
+		
+		if(hasPermission($config['mod']['master_pm'])) {
+			$query = prepare("SELECT `pms`.`id`, `time`, `sender`, `unread`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `pms`.`id` = :id");
+		} else {
+			$query = prepare("SELECT `pms`.`id`, `time`, `sender`, `unread`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `pms`.`id` = :id AND `to` = :mod");
+			$query->bindValue(':mod', $mod['id'], PDO::PARAM_INT);
+		}
+		
+		$query->bindValue(':id', $id, PDO::PARAM_INT);
+		$query->execute() or error(db_error($query));
+		
+		if(!$pm = $query->fetch()) {
+			// Mod doesn't exist
+			error($config['error']['404']);
+		}
+		
+		if(isset($_POST['delete'])) {
+			$query = prepare("DELETE FROM `pms` WHERE `id` = :id");
+			$query->bindValue(':id', $id, PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+			
+			modLog('Deleted a PM');
+			
+			header('Location: ?/inbox', true, $config['redirect_http']);
+		} else {
+			if($pm['unread']) {
+				$query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `id` = :id");
+				$query->bindValue(':id', $id, PDO::PARAM_INT);
+				$query->execute() or error(db_error($query));
+				
+				modLog('Read a PM');
+			}
+			
+			if($pm['to'] != $mod['id']) {
+				$query = prepare("SELECT `username` FROM `mods` WHERE `id` = :id");
+				$query->bindValue(':id', $pm['to'], PDO::PARAM_INT);
+				$query->execute() or error(db_error($query));
+				
+				if($_mod = $query->fetch()) {
+					$__to = &$_mod['username'];
+				} else {
+					$__to = false;
+				}
+			}
+			
+			$body = '<form action="" method="post" style="margin:0"><table>' . 
+			
+			'<th>From</th><td>' .
+				(!$pm['username'] ?
+					'<em>???</em>'
+				:
+					'<a href="?/new_PM/' . $pm['sender'] . '">' . utf8tohtml($pm['username']) . '</a>'
+				) .
+			'</td></tr>' .
+			
+			(isset($__to) ?
+				'<th>To</th><td>' .
+					($__to === false ?
+						'<em>???</em>'
+					:
+						'<a href="?/new_PM/' . $pm['to'] . '">' . utf8tohtml($__to) . '</a>'
+					) .
+				'</td></tr>'
+			: '') .
+			
+			'<tr><th>Date</th><td> ' . strftime($config['post_date'], $pm['time']) . '</td></tr>' .
+			
+			'<tr><th>Message</th><td> ' . $pm['message'] . '</td></tr>' .
+			
+			'</table>' . 
+			
+			'<p style="text-align:center"><input type="submit" name="delete" value="Delete forever" /></p>' .
+			
+			'</form>' .
+			
+			'<p style="text-align:center"><a href="?/new_PM/' . $pm['sender'] . '/' . $pm['id'] . '">Reply with quote</a></p>';
+			
+			echo Element('page.html', array(
+				'config'=>$config,
+				'title'=>'Private message',
+				'body'=>$body,
+				'mod'=>true
+				)
+			);
+		}
+	} elseif(preg_match('/^\/new_PM\/(\d+)(\/(\d+))?$/', $query, $match)) {
+		if(!hasPermission($config['mod']['create_pm'])) error($config['error']['noaccess']);
+		
+		$to = &$match[1];
+		
+		$query = prepare("SELECT `username`,`id` FROM `mods` WHERE `id` = :id");
+		$query->bindValue(':id', $to, PDO::PARAM_INT);
+		$query->execute() or error(db_error($query));
+		
+		if(!$to = $query->fetch()) {
+			// Mod doesn't exist
+			error($config['error']['404']);
+		}
+		
+		if(isset($_POST['message'])) {
+			// Post message
+			$message = &$_POST['message'];
+			
+			if(empty($message))
+				error($config['error']['tooshort_body']);
+			
+			markup($message);
+			
+			$query = prepare("INSERT INTO `pms` VALUES (NULL, :sender, :to, :message, :time, 1)");
+			$query->bindValue(':sender', $mod['id'], PDO::PARAM_INT);
+			$query->bindValue(':to', $to['id'], PDO::PARAM_INT);
+			$query->bindValue(':message', $message);
+			$query->bindValue(':time', time(), PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+			
+			modLog('Sent a PM to ' . $to['username']);
+			
+			echo Element('page.html', array(
+				'config'=>$config,
+				'title'=>'PM sent',
+				'body'=>'<p style="text-align:center">Message sent successfully to ' . utf8tohtml($to['username']) . '.</p>',
+				'mod'=>true
+				)
+			);
+		} else {
+			$value = '';
+			if(isset($match[3])) {
+				$reply = &$match[3];
+				
+				$query = prepare("SELECT `message` FROM `pms` WHERE `sender` = :sender AND `to` = :mod AND `id` = :id");
+				$query->bindValue(':sender', $to['id'], PDO::PARAM_INT);
+				$query->bindValue(':mod', $mod['id'], PDO::PARAM_INT);
+				$query->bindValue(':id', $reply, PDO::PARAM_INT);
+				$query->execute() or error(db_error($query));
+				if($pm = $query->fetch()) {
+					$value = quote($pm['message']);
+				}
+			}
+			
+			
+			$body = '<form action="" method="post">' .
+			
+			'<table>' . 
+			
+			'<tr><th>To</th><td>' .
+				(hasPermission($config['mod']['editusers']) ?
+					'<a href="?/users/' . $to['id'] . '">' . utf8tohtml($to['username']) . '</a>' :
+					utf8tohtml($to['username'])
+				) .
+			'</td>' .
+			
+			'<tr><th>Message</th><td><textarea name="message" rows="10" cols="40">' . $value . '</textarea></td>' .
+			
+			'</table>' .
+			
+			'<p style="text-align:center"><input type="submit" value="Send message" /></p>' .
+			
+			'</form>';
+			
+			echo Element('page.html', array(
+				'config'=>$config,
+				'title'=>'New PM for ' . utf8tohtml($to['username']),
+				'body'=>$body,
+				'mod'=>true
+				)
+			);
+		}
+	} elseif(preg_match('/^\/search$/', $query)) {
+		if(!hasPermission($config['mod']['search'])) error($config['error']['noaccess']);
+		
+		$body = '<div class="ban"><h2>Search</h2><form style="display:inline" action="?/search" method="post">' .
+			'<p><label style="display:inline" for="search">Phrase:</label> ' .
+				'<input id="search" name="search" type="text" size="35" ' .
+					(isset($_POST['search']) ? 'value="' . str_replace('"', '&quot;', utf8tohtml($_POST['search'])) . '" ' : '') .
+				'/>' .
+				'<input type="submit" value="Search" />' .
+			'</p></form>' .
+				'<p><span class="unimportant">(Search is case-insensitive, and based on keywords. To match exact phrases, use "quotes". Use an asterisk (*) for wildcard.)</span></p>' .
+			'</div>';
+		
+		if(isset($_POST['search']) && !empty($_POST['search'])) {
+			$phrase = &$_POST['search'];
+			$_body = '';
+			
+			$filters = array();
+			
+			function search_filters($m) {
+				global $filters;
+				$name = $m[2];
+				$value = isset($m[4]) ? $m[4] : $m[3];
+				
+				if(!in_array($name, array('id', 'thread', 'subject', 'email', 'name', 'trip', 'capcode', 'filename', 'filehash', 'ip'))) {
+					// unknown filter
+					return $m[0];
+				}
+				
+				$filters[$name] = $value;
+				
+				return $m[1];
+			}
+			
+			$phrase = trim(preg_replace_callback('/(^|\s)(\w+):("(.*)?"|[^\s]*)/', 'search_filters', $phrase));
+			
+			// Escape escape character
+			$phrase = str_replace('!', '!!', $phrase);
+			
+			// Remove SQL wildcard
+			$phrase = str_replace('%', '!%', $phrase);
+			
+			// Use asterisk as wildcard to suit convention
+			$phrase = str_replace('*', '%', $phrase);
+			
+			$like = '';
+			$match = array();
+			
+			// Find exact phrases
+			if(preg_match_all('/"(.+?)"/', $phrase, $m)) {
+				foreach($m[1] as &$quote) {
+					$phrase = str_replace("\"{$quote}\"", '', $phrase);
+					$match[] = $pdo->quote($quote);
+				}
+			}
+			
+			$words = explode(' ', $phrase);
+			foreach($words as &$word) {
+				if(empty($word))
+					continue;
+				$match[] = $pdo->quote($word);
+			}
+			
+			$like = '';
+			foreach($match as &$phrase) {
+				if(!empty($like))
+					$like .= ' AND ';
+				$phrase = preg_replace('/^\'(.+)\'$/', '\'%$1%\'', $phrase);
+				$like .= '`body` LIKE ' . $phrase . ' ESCAPE \'!\'';
+			}
+			
+			foreach($filters as $name => $value) {
+				if(!empty($like))
+					$like .= ' AND ';
+				$like .= '`' . $name . '` = '. $pdo->quote($value);
+			}
+			
+			$like = str_replace('%', '%%', $like);
+			
+			$boards = listBoards();
+			foreach($boards as &$_b) {
+				openBoard($_b['uri']);
+				
+				$query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE " . $like . " ORDER BY `time` DESC LIMIT :limit", $board['uri']));
+				$query->bindValue(':limit', $config['mod']['search_results'], PDO::PARAM_INT);
+				$query->execute() or error(db_error($query));
+				
+				$temp = '';
+				while($post = $query->fetch()) {
+					if(!$post['thread']) {
+						$po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false);
+					} else {
+						$po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod);
+					}
+					$temp .= $po->build(true) . '<hr/>';
+				}
+				
+				if(!empty($temp))
+					$_body .= '<fieldset><legend>' . $query->rowCount() . ' result' . ($query->rowCount() != 1 ? 's' : '') . ' on <a href="?/' .
+							sprintf($config['board_path'], $board['uri']) . $config['file_index'] .
+					'">' .
+					sprintf($config['board_abbreviation'], $board['uri']) . ' - ' . $board['title'] .
+					'</a></legend>' . $temp . '</fieldset>';
+			}
+			
+			$body .= '<hr/>';
+			if(!empty($_body))
+				$body .= $_body;
+			else
+				$body .= '<p style="text-align:center" class="unimportant">(No results.)</p>';
+		}
+			
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>'Search',
+			'body'=>$body,
+			'mod'=>true
+			)
+		);
+	} elseif(preg_match('/^\/users$/', $query)) {
+		if(!hasPermission($config['mod']['manageusers'])) error($config['error']['noaccess']);
+		
+		$body = '<form action="" method="post"><table class="modlog" style="width:auto"><tr><th>' . _('ID') . '</th><th>' . _('Username') . '</th><th>' . _('Type') . '</th><th>' . _('Boards') . '</th><th>' . _('Last action') . '</th><th>&hellip;</th></tr>';
+		
+		$query = query("SELECT *, (SELECT `time` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `last`, (SELECT `text` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `action` FROM `mods` ORDER BY `type` DESC,`id`") or error(db_error());
+		while($_mod = $query->fetch()) {				
+			$type = $_mod['type'] == JANITOR ? 'Janitor' : ($_mod['type'] == MOD ? 'Mod' : 'Admin');
+			
+			$_mod['boards'] = explode(',', $_mod['boards']);
+			foreach($_mod['boards'] as &$_board) {
+				if($_board != '*')
+					$_board = '/' . $_board . '/';
+			}
+			
+			$body .= '<tr>' .
+				'<td>' .
+					$_mod['id'] .
+				'</td>' .
+				
+				'<td>' .
+					utf8tohtml($_mod['username']) .
+				'</td>' .
+				
+				'<td>' .
+					$type .
+				'</td>' .
+				
+				'<td>' .
+					implode(', ', $_mod['boards']) .
+				'</td>' .
+				
+				'<td>' .
+					($_mod['last'] ?
+						(hasPermission($config['mod']['modlog']) ?
+							'<span title="' . str_replace('"', '&quot;', utf8tohtml($_mod['action'])) . '">' . ago($_mod['last']) . '</span>'
+						: ago($_mod['last']))
+					: '<em>never</em>') .
+				'</td>' .
+				
+				'<td style="white-space:nowrap">' .
+					(hasPermission($config['mod']['promoteusers']) ?
+						($_mod['type'] != ADMIN ?
+							'<a style="float:left;text-decoration:none" href="?/users/' . $_mod['id'] . '/promote" title="Promote">▲</a>'
+						:'') .
+						($_mod['type'] != JANITOR ?
+							'<a style="float:left;text-decoration:none" href="?/users/' . $_mod['id'] . '/demote" title="Demote">▼</a>'
+						:'')
+					: ''
+					) .
+					(hasPermission($config['mod']['editusers']) ||
+					(hasPermission($config['mod']['change_password']) && $_mod['id'] == $mod['id'])?
+						'<a class="unimportant" style="margin-left:5px;float:right" href="?/users/' . $_mod['id'] . '">[edit]</a>'
+					: '' ) .
+					(hasPermission($config['mod']['create_pm']) ?
+						'<a class="unimportant" style="margin-left:5px;float:right" href="?/new_PM/' . $_mod['id'] . '">[PM]</a>'
+					: '' ) .
+				'</td></tr>';
+		}
+		
+		$body .= '</table>';
+		
+		if(hasPermission($config['mod']['createusers'])) {
+			$body .= '<p style="text-align:center"><a href="?/users/new">' . _('Create new user') . '</a></p>';
+		}
+		
+		$body .= '</form>';
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>_('Manage users'),
+			'body'=>$body
+			,'mod'=>true
+			)
+		);
+	} elseif(preg_match('/^\/users\/new$/', $query)) {
+		if(!hasPermission($config['mod']['createusers'])) error($config['error']['noaccess']);
+		
+		if(isset($_POST['username']) && isset($_POST['password'])) {
+			if(!isset($_POST['type'])) {
+				error(sprintf($config['error']['required'], 'type'));
+			}
+			
+			if($_POST['type'] != ADMIN && $_POST['type'] != MOD && $_POST['type'] != JANITOR) {
+				error(sprintf($config['error']['invalidfield'], 'type'));
+			}
+			
+			// Check if already exists
+			$query = prepare("SELECT `id` FROM `mods` WHERE `username` = :username");
+			$query->bindValue(':username', $_POST['username']);
+			$query->execute() or error(db_error($query));
+			
+			if($_mod = $query->fetch()) {
+				error(sprintf($config['error']['modexists'], $_mod['id']));
+			}
+			
+			$boards = array();
+			foreach($_POST as $name => $null) {
+				if(preg_match('/^board_(.+)$/', $name, $m))
+					$boards[] = $m[1];
+			}
+			$boards = implode(',', $boards);
+			
+			$query = prepare("INSERT INTO `mods` VALUES (NULL, :username, :password, :type, :boards)");
+			$query->bindValue(':username', $_POST['username']);
+			$query->bindValue(':password', sha1($_POST['password']));
+			$query->bindValue(':type', $_POST['type'], PDO::PARAM_INT);
+			$query->bindValue(':boards', $boards);
+			$query->execute() or error(db_error($query));
+			
+			modLog('Create a new user: "' . $_POST['username'] . '"');
+			header('Location: ?/users', true, $config['redirect_http']);
+		} else {
+		
+			$__boards = '<ul style="list-style:none;padding:2px 5px">';			
+			$boards = array_merge(
+					array(array('uri' => '*', 'title' => 'All')
+				), listBoards());
+			foreach($boards as &$_board) {
+				$__boards .= '<li>' .
+					'<input type="checkbox" name="board_' . $_board['uri'] . '" id="board_' . $_board['uri'] . '">' .
+					'<label style="display:inline" for="board_' . $_board['uri'] . '"> ' .
+						($_board['uri'] == '*' ?
+							'<em>"*"</em>'
+						:
+							sprintf($config['board_abbreviation'], $_board['uri'])
+						) .
+						' - ' . $_board['title'] .
+					'</label>' .
+					'</li>';
+			}
+		
+			$body = '<fieldset><legend>New user</legend>' . 
+			
+				// Begin form
+				'<form style="text-align:center" action="" method="post">' .
+			
+				'<table>' .
+			
+				'<tr><th>Username</th><td><input size="20" maxlength="30" type="text" name="username" value="" autocomplete="off" /></td></tr>' .
+				'<tr><th>Password</th><td><input size="20" maxlength="30" type="password" name="password" value="" autocomplete="off" /></td></tr>' .
+				'<tr><th>Type</th><td>' .
+					'<div><label for="janitor">Janitor</label> <input type="radio" id="janitor" name="type" value="' . JANITOR . '" /></div>' .
+					'<div><label for="mod">Mod</label> <input type="radio" id="mod" name="type" value="' . MOD . '" /></div>' .
+					'<div><label for="admin">Admin</label> <input type="radio" id="admin" name="type" value="' . ADMIN . '" /></div>' .
+				'</td></tr>' .
+				'<tr><th>Boards</th><td>' . $__boards . '</td></tr>' .
+				'</table>' .
+			
+				'<input style="margin-top:10px" type="submit" value="Create user" />' .
+			
+				// End form
+				'</form></fieldset>';
+			
+				echo Element('page.html', array(
+					'config'=>$config,
+					'title'=>'New user',
+					'body'=>$body
+					,'mod'=>true
+					)
+				);
+			}
+	} elseif(preg_match('/^\/users\/(\d+)(\/(promote|demote|delete))?$/', $query, $matches)) {
+		$modID = &$matches[1];
+		
+		if(isset($matches[2])) {
+			if($matches[3] == 'delete') {
+				if(!hasPermission($config['mod']['deleteusers'])) error($config['error']['noaccess']);
+				
+				$query = prepare("DELETE FROM `mods` WHERE `id` = :id");
+				$query->bindValue(':id', $modID, PDO::PARAM_INT);
+				$query->execute() or error(db_error($query));
+				
+				modLog('Deleted user #' . $modID);
+			} else {
+				// Promote/demote
+				if(!hasPermission($config['mod']['promoteusers'])) error($config['error']['noaccess']);
+				
+				if($matches[3] == 'promote') {
+					$query = prepare("UPDATE `mods` SET `type` = `type` + 1 WHERE `type` != :admin AND `id` = :id");
+					$query->bindValue(':admin', ADMIN, PDO::PARAM_INT);
+				} else {
+					$query = prepare("UPDATE `mods` SET `type` = `type` - 1 WHERE `type` != :janitor AND `id` = :id");
+					$query->bindValue(':janitor', JANITOR, PDO::PARAM_INT);
+				}
+				
+				$query->bindValue(':id', $modID, PDO::PARAM_INT);
+				$query->execute() or error(db_error($query));
+			}
+			header('Location: ?/users', true, $config['redirect_http']);
+		} else {
+			// Edit user
+			if(!hasPermission($config['mod']['editusers']) && !hasPermission($config['mod']['change_password']))
+				error($config['error']['noaccess']);
+			
+			$query = prepare("SELECT * FROM `mods` WHERE `id` = :id");
+			$query->bindValue(':id', $modID, PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+			
+			if(!$_mod = $query->fetch()) {
+				error($config['error']['404']);
+			}
+			
+			if(!hasPermission($config['mod']['editusers']) && !(hasPermission($config['mod']['change_password']) && $mod['id'] == $_mod['id'] && $change_password_only = true))
+				error($config['error']['noaccess']);
+			
+			if((isset($_POST['username']) && isset($_POST['password'])) || (isset($change_password_only) && isset($_POST['password']))) {
+				if(!isset($change_password_only)) {
+					$boards = array();
+					foreach($_POST as $name => $null) {
+						if(preg_match('/^board_(.+)$/', $name, $m))
+							$boards[] = $m[1];
+					}
+					$boards = implode(',', $boards);
+					
+					$query = prepare("UPDATE `mods` SET `username` = :username, `boards` = :boards WHERE `id` = :id");
+					$query->bindValue(':username', $_POST['username'], PDO::PARAM_STR);
+					$query->bindValue(':boards', $boards, PDO::PARAM_STR);
+					$query->bindValue(':id', $modID, PDO::PARAM_INT);
+					$query->execute() or error(db_error($query));
+					modLog('Edited login details for user "' . $_mod['username'] . '"');
+				} else {
+					modLog('Changed own password');
+				}
+				if(!empty($_POST['password'])) {
+					$query = prepare("UPDATE `mods` SET `password` = :password WHERE `id` = :id");
+					$query->bindValue(':password', sha1($_POST['password']));
+					$query->bindValue(':id', $modID, PDO::PARAM_INT);
+					$query->execute() or error(db_error($query));
+				}
+				
+				// Refresh
+				$query = prepare("SELECT * FROM `mods` WHERE `id` = :id");
+				$query->bindValue(':id', $modID, PDO::PARAM_INT);
+				$query->execute() or error(db_error($query));
+				
+				if(!$_mod = $query->fetch()) {
+					error($config['error']['404']);
+				}
+				
+				if($_mod['id'] == $mod['id']) {
+					// Changed own password. Update cookies
+					
+					if(!login($_mod['username'], $_mod['password'], false, true))
+						error(_('Could not re-login after changing password. (?)'));
+					
+					setCookies();
+				}
+				
+				if(hasPermission($config['mod']['manageusers']))
+					header('Location: ?/users', true, $config['redirect_http']);
+				else
+					header('Location: ?/', true, $config['redirect_http']);
+				exit;
+			}
+			
+			$__boards = '<ul style="list-style:none;padding:2px 5px">';
+			$boards = array_merge(
+					array(array('uri' => '*', 'title' => 'All')
+				), listBoards());
+			
+			$_mod['boards'] = explode(',', $_mod['boards']);
+			foreach($boards as &$_board) {
+				$__boards .= '<li>' .
+					'<input type="checkbox" name="board_' . $_board['uri'] . '" id="board_' . $_board['uri'] . '"' .
+						(in_array($_board['uri'], $_mod['boards']) ? 
+							' checked="checked"'
+						: '') .
+					'/> ' . 
+					'<label style="display:inline" for="board_' . $_board['uri'] . '">' .
+						($_board['uri'] == '*' ?
+							'<em>"*"</em>'
+						:
+							sprintf($config['board_abbreviation'], $_board['uri'])
+						) .
+						' - ' . $_board['title'] .
+					'</label>' .
+					'</li>';
+			}
+			$__boards .= '</ul>';
+			
+			$body = '<fieldset><legend>Edit user</legend>' . 
+			
+			// Begin form
+			'<form style="text-align:center" action="" method="post">' .
+			
+			'<table>' .
+			
+			'<tr><th>Username</th><td>' . 
+			
+			(isset($change_password_only) ?
+				utf8tohtml($_mod['username'])
+			: '<input size="20" maxlength="30" type="text" name="username" value="' . utf8tohtml($_mod['username']) . '" autocomplete="off" />') .
+			
+			'</td></tr>' .
+			'<tr><th>Password <span class="unimportant">(new; optional)</span></th><td><input size="20" maxlength="30" type="password" name="password" value="" autocomplete="off" /></td></tr>' .
+			
+			(isset($change_password_only) ? '' :
+				'<tr><th>Boards</th><td>' . $__boards . '</td></tr>'
+			) .
+			
+			'</table>' .
+			
+			'<input type="submit" value="Save changes" />' .
+			
+			// End form
+			'</form> ' .
+			
+			// Delete button
+			(hasPermission($config['mod']['deleteusers']) ?
+				'<p style="text-align:center"><a href="?/users/' . $_mod['id'] . '/delete">Delete user</a></p>'
+			:'') .
+			
+			'</fieldset>';
+			
+			echo Element('page.html', array(
+				'config'=>$config,
+				'title'=>'Edit user',
+				'body'=>$body
+				,'mod'=>true
+				)
+			);
+		}
+	} elseif(preg_match('/^\/reports$/', $query)) {
+		if(!hasPermission($config['mod']['reports'])) error($config['error']['noaccess']);
+		
+		$body = '';
+		$reports = 0;
+		
+		$query = prepare("SELECT * FROM `reports` ORDER BY `time` DESC LIMIT :limit");
+		$query->bindValue(':limit', $config['mod']['recent_reports'], PDO::PARAM_INT);
+		$query->execute() or error(db_error($query));
+		
+		while($report = $query->fetch()) {
+			$p_query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `id` = :id", $report['board']));
+			$p_query->bindValue(':id', $report['post'], PDO::PARAM_INT);
+			$p_query->execute() or error(db_error($p_query));
+			
+			if(!$post = $p_query->fetch()) {
+				// Invalid report (post has since been deleted)
+				$p_query = prepare("DELETE FROM `reports` WHERE `post` = :id AND `board` = :board");
+				$p_query->bindValue(':id', $report['post'], PDO::PARAM_INT);
+				$p_query->bindValue(':board', $report['board']);
+				$p_query->execute() or error(db_error($p_query));
+				continue;
+			}
+			
+			$reports++;
+			openBoard($report['uri']);
+			
+			if(!$post['thread']) {
+				$po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false);
+			} else {
+				$po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod);
+			}
+			
+			$append_html =
+				'<div class="report">' .
+					'<hr/>' .
+					'Board: <a href="?/' . $report['uri'] . '/' . $config['file_index'] . '">' . sprintf($config['board_abbreviation'], $report['uri']) . '</a><br/>' .
+					'Reason: ' . $report['reason'] . '<br/>' .
+					'Report date: ' . strftime($config['post_date'], $report['time']) . '<br/>' .
+					(hasPermission($config['mod']['show_ip']) ?
+						'Reported by: <a href="?/IP/' . $report['ip'] . '">' . $report['ip'] . '</a><br/>'
+					: '') .
+					'<hr/>' .
+						(hasPermission($config['mod']['report_dismiss']) ?
+							'<a title="Discard abuse report" href="?/reports/' . $report['id'] . '/dismiss">Dismiss</a> | ' : '') .
+						(hasPermission($config['mod']['report_dismiss_ip']) ?
+							'<a title="Discard all abuse reports by this user" href="?/reports/' . $report['id'] . '/dismiss/all">Dismiss+</a>' : '') .
+				'</div>';
+			
+			// Bug fix for https://github.com/savetheinternet/Tinyboard/issues/21
+			$po->body = truncate($po->body, $po->link(), $config['body_truncate'] - substr_count($append_html, '<br/>'));
+			
+			if(mb_strlen($po->body) + mb_strlen($append_html) > $config['body_truncate_char']) {
+				// still too long. temporarily increase limit in the config
+				$__old_body_truncate_char = $config['body_truncate_char'];
+				$config['body_truncate_char'] = mb_strlen($po->body) + mb_strlen($append_html);
+			}
+			
+			$po->body .= $append_html;
+			
+			$body .= $po->build(true) . '<hr/>';
+			
+			if(isset($__old_body_truncate_char))
+				$config['body_truncate_char'] = $__old_body_truncate_char;
+		}
+		
+		$query = query("SELECT COUNT(`id`) AS `count` FROM `reports`") or error(db_error());
+		$count = $query->fetch();
+		
+		$body .= '<p class="unimportant" style="text-align:center">Showing ' . 
+			($reports == $count['count'] ? 'all ' . $reports . ' reports' : $reports . ' of ' . $count['count'] . ' reports') . '.</p>';
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>_('Report queue') . ' (' . $count['count'] . ')',
+			'body'=>$body,
+			'mod'=>true
+		));
+	} elseif(preg_match('/^\/reports\/(\d+)\/dismiss(\/all)?$/', $query, $matches)) {
+		if(isset($matches[2]) && $matches[2] == '/all') {
+			if(!hasPermission($config['mod']['report_dismiss_ip'])) error($config['error']['noaccess']);
+			
+			$query = prepare("SELECT `ip` FROM `reports` WHERE `id` = :id");
+			$query->bindValue(':id', $matches[1], PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+			
+			if($report = $query->fetch()) {
+				$query = prepare("DELETE FROM `reports` WHERE `ip` = :ip");
+				$query->bindValue(':ip', $report['ip'], PDO::PARAM_INT);
+				$query->execute() or error(db_error($query));
+				
+				modLog('Dismissed all reports by ' . $report['ip']);
+			}
+		} else {
+			if(!hasPermission($config['mod']['report_dismiss'])) error($config['error']['noaccess']);
+			
+			$query = prepare("SELECT `post`, `board` FROM `reports` WHERE `id` = :id");
+			$query->bindValue(':id', $matches[1], PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+			
+			if($report = $query->fetch()) {
+				modLog('Dismissed a report for post #' . $report['post'], $report['board']);
+				
+				$query = prepare("DELETE FROM `reports` WHERE `post` = :post AND `board` = :board");
+				$query->bindValue(':board', $report['board'], PDO::PARAM_INT);
+				$query->bindValue(':post', $report['post'], PDO::PARAM_INT);
+				$query->execute() or error(db_error($query));
+			}
+		}
+		
+		// Redirect
+		header('Location: ?/reports', true, $config['redirect_http']);
+	} elseif(preg_match('/^\/(\w+)\/edit(\/delete)?$/', $query, $matches)) {
+		if(!hasPermission($config['mod']['manageboards'])) error($config['error']['noaccess']);
+		
+		if(!openBoard($matches[1]))
+			error($config['error']['noboard']);
+		
+		if(isset($matches[2]) && $matches[2] == '/delete') {
+			if(!hasPermission($config['mod']['deleteboard'])) error($config['error']['noaccess']);
+			// Delete board
+			
+			modLog('Deleted board ' . sprintf($config['board_abbreviation'], $board['uri']));
+			
+			// Delete entire board directory
+			rrmdir($board['uri'] . '/');
+			
+			// Delete posting table
+			$query = query(sprintf("DROP TABLE IF EXISTS `posts_%s`", $board['uri'])) or error(db_error());
+			
+			// Clear reports
+			$query = prepare("DELETE FROM `reports` WHERE `board` = :id");
+			$query->bindValue(':id', $board['uri'], PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+			
+			// Delete from table
+			$query = prepare("DELETE FROM `boards` WHERE `uri` = :uri");
+			$query->bindValue(':uri', $board['uri'], PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+			
+			if($config['cache']['enabled']) {
+				cache::delete('board_' . $board['uri']);
+				cache::delete('all_boards');
+			}
+			
+			$query = prepare("SELECT `board`, `post` FROM `cites` WHERE `target_board` = :board");
+			$query->bindValue(':board', $board['uri']);
+			$query->execute() or error(db_error($query));
+			while($cite = $query->fetch()) {
+				if($board['uri'] != $cite['board']) {
+					if(!isset($tmp_board))
+						$tmp_board = $board;
+					openBoard($cite['board']);
+					rebuildPost($cite['post']);
+				}
+			}
+			
+			if(isset($tmp_board))
+				$board = $tmp_board;
+			
+			$query = prepare("DELETE FROM `cites` WHERE `board` = :board OR `target_board` = :board");
+			$query->bindValue(':board', $board['uri']);
+			$query->execute() or error(db_error($query));
+			
+			$query = prepare("DELETE FROM `antispam` WHERE `board` = :board");
+			$query->bindValue(':board', $board['uri']);
+			$query->execute() or error(db_error($query));
+			
+			$_board = $board;
+			
+			rebuildThemes('boards');
+			
+			$board = $_board;
+			
+			header('Location: ?/', true, $config['redirect_http']);
+		} else {
+			if(isset($_POST['title']) && isset($_POST['subtitle'])) {
+				$query = prepare("UPDATE `boards` SET `title` = :title, `subtitle` = :subtitle WHERE `uri` = :uri");
+				$query->bindValue(':title', utf8tohtml($_POST['title'], true));
+				
+				if(!empty($_POST['subtitle']))
+					$query->bindValue(':subtitle', utf8tohtml($_POST['subtitle'], true));
+				else
+					$query->bindValue(':subtitle', null, PDO::PARAM_NULL);
+				
+				$query->bindValue(':id', $board['uri'], PDO::PARAM_INT);
+				$query->execute() or error(db_error($query));
+				
+				if($config['cache']['enabled']) {
+					cache::delete('board_' . $board['uri']);
+					cache::delete('all_boards');
+				}
+				
+				$_board = $board;
+				
+				rebuildThemes('boards');
+				
+				$board = $_board;
+				
+				openBoard($board['uri']);
+			}
+			
+			$body =
+			'<fieldset><legend><a href="?/' .
+			$board['uri'] .	'/' . $config['file_index'] . '">' .
+			sprintf($config['board_abbreviation'], $board['uri']) . '</a>' . 
+			' - ' . $board['name'] . '</legend>' . 
+			
+			// Begin form
+			'<form style="text-align:center" action="" method="post">' .
+			
+			'<table>' .
+			
+			'<tr><th>URI</th><td>' . $board['uri'] . '</td>' .
+			'<tr><th>Title</th><td><input size="20" type="text" name="title" value="' . $board['name'] . '" /></td></tr>' .
+			'<tr><th>Subtitle</th><td><input size="20" type="text" name="subtitle" value="' .
+				(isset($board['title']) ? $board['title'] : '') . '" /></td></tr>' .
+			
+			'</table>' .
+			
+			'<input type="submit" value="Update" />' .
+			
+			// End form
+			'</form> ' .
+			
+			// Delete button
+			(hasPermission($config['mod']['deleteboard']) ?
+				'<p style="text-align:center"><a href="?/' . $board['uri'] . '/edit/delete">Delete board</a></p>'
+			:'') .
+			
+			'</fieldset>';
+			
+			echo Element('page.html', array(
+				'config'=>$config,
+				'title'=>'Manage &ndash; ' . sprintf($config['board_abbreviation'], $board['uri']),
+				'body'=>$body,
+				'mod'=>true
+			));
+		}
+	} elseif(preg_match('/^\/bans$/', $query)) {
+		if(!hasPermission($config['mod']['view_banlist'])) error($config['error']['noaccess']);
+		
+		if(isset($_POST['unban'])) {
+			if(!hasPermission($config['mod']['unban'])) error($config['error']['noaccess']);
+			
+			foreach($_POST as $post => $value) {
+				if(preg_match('/^ban_(\d+)$/', $post, $m)) {
+					removeBan($m[1]);
+				}
+			}
+		}
+		if(hasPermission($config['mod']['view_banexpired'])) {
+			$query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY (`expires` IS NOT NULL AND `expires` < :time), `set` DESC");
+			$query->bindValue(':time', time(), PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+		} else {
+			// Filter out expired bans
+			$query = prepare("SELECT `bans`.*, `username` FROM `bans` INNER JOIN `mods` ON `mod` = `mods`.`id` WHERE `expires` = 0 OR `expires` > :time ORDER BY `set` DESC");
+			$query->bindValue(':time', time(), PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+		}
+		
+		if($query->rowCount() < 1) {
+			$body = '<p style="text-align:center" class="unimportant">(There are no active bans.)</p>';
+		} else {
+			$body = '<form action="" method="post">';
+			$body .= '<table><tr><th>' . _('IP address') . '</th><th>' . _('Reason') . '</th><th>' . _('Board') . '</th><th>' . _('Set') . '</th><th>' . _('Expires') . '</th><th>' . _('Staff') . '</th></tr>';
+			
+			while($ban = $query->fetch()) {
+				$body .=
+					'<tr' .
+						($config['mod']['view_banexpired'] && $ban['expires'] != 0 && $ban['expires'] < time() ?
+							' style="text-decoration:line-through"'
+						:'') .
+					'>' .
+				
+				'<td style="white-space: nowrap">' .
+				
+				// Checkbox
+				'<input type="checkbox" name="ban_' . $ban['id'] . '" id="ban_' . $ban['id'] . '" /> ' .
+				
+				// IP address
+				(preg_match('/^(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')$/', $ban['ip']) ?
+					'<a href="?/IP/' .
+						$ban['ip'] .
+					'">'. $ban['ip'] . '</a>'
+				: utf8tohtml($ban['ip'])) .
+				
+				'</td>' .
+				
+				// Reason
+				'<td>' . ($ban['reason'] ? $ban['reason'] : '<em>-</em>') . '</td>' .
+				
+				
+				'<td style="white-space: nowrap">' .
+				(isset($ban['board']) ?
+					sprintf($config['board_abbreviation'], $ban['board'])
+				:
+					'<em>' . _('all boards') . '</em>'
+				) . '</td>' .
+				
+				// Set
+				'<td style="white-space: nowrap">' . strftime($config['post_date'], $ban['set']) . '</td>' .
+				
+				// Expires
+				'<td style="white-space: nowrap">' . 
+					($ban['expires'] == 0 ?
+						'<em>Never</em>'
+					:
+						strftime($config['post_date'], $ban['expires'])
+					) .
+				'</td>' .
+				
+				// Staff
+				'<td>' .
+					(isset($ban['username']) ?
+						(!hasPermission($config['mod']['view_banstaff']) ?
+							($config['mod']['view_banquestionmark'] ?
+								'?'
+							:
+								($ban['type'] == JANITOR ? 'Janitor' :
+								($ban['type'] == MOD ? 'Mod' :
+								($ban['type'] == ADMIN ? 'Admin' :
+								'?')))
+							)
+						:
+							utf8tohtml($ban['username'])
+						)
+					:
+						'<em>deleted?</em>'
+					) .
+				'</td>' .
+				
+				'</tr>';
+			}
+			
+			$body .= '</table>' .
+			
+			(hasPermission($config['mod']['unban']) ?
+				'<p style="text-align:center"><input name="unban" type="submit" value="Unban selected" /></p>'
+			: '') .
+			
+			'</form>';
+		}
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>_('Ban list'),
+			'body'=>$body,
+			'mod'=>true
+		)
+	);
+	} elseif(preg_match('/^\/flush$/', $query)) {
+		if(!hasPermission($config['mod']['rebuild'])) error($config['error']['noaccess']);
+		if(!$config['cache']['enabled']) error(_('Cache is not enabled.'));
+		
+		if(cache::flush()) {
+			$body = 'Successfully invalidated all items in cache.';
+			modLog('Cleared cache');
+		} else {
+			$body = 'An error occured while trying to flush cache.';
+		}
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>'Flushed',
+			'body'=>'<p style="text-align:center">' . $body . '</p>',
+			'mod'=>true
+		));
+	} elseif(preg_match('/^\/rebuild$/', $query)) {
+		if(!hasPermission($config['mod']['rebuild'])) error($config['error']['noaccess']);
+		
+		set_time_limit($config['mod']['rebuild_timelimit']);
+		
+		$body = '<div class="ban"><h2>Rebuilding&hellip;</h2><p>';
+		
+		$body .= 'Clearing template cache&hellip;<br/>';
+		
+		load_twig();
+		$twig->clearCacheFiles();
+	
+		$body .= 'Regenerating theme files&hellip;<br/>';
+		rebuildThemes('all');
+		
+		$body .= 'Generating Javascript file&hellip;<br/>';
+		buildJavascript();
+		
+		$main_js = $config['file_script'];
+		
+		$boards = listBoards();
+		
+		foreach($boards as &$board) {
+			$body .= "<strong style=\"display:inline-block;margin: 15px 0 2px 0;\">Opening board /{$board['uri']}/</strong><br/>";
+			openBoard($board['uri']);
+			
+			$body .= 'Creating index pages<br/>';
+			buildIndex();
+			
+			if($config['file_script'] != $main_js) {
+				// different javascript file
+				$body .= 'Generating Javascript file&hellip;<br/>';
+				buildJavascript();
+			}
+			
+			$query = query(sprintf("SELECT `id` FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error());
+			while($post = $query->fetch()) {
+				$body .= "Rebuilding #{$post['id']}<br/>";
+				buildThread($post['id']);
+			}
+		}
+		$body .= 'Complete!</p></div>';
+		
+		unset($board);
+		modLog('Rebuilt everything');
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>'Rebuilt',
+			'body'=>$body,
+			'mod'=>true
+		));
+	} elseif(preg_match('/^\/config\/edit$/', $query)) {
+		if(!hasPermission($config['mod']['edit_config']))
+			error($config['error']['noaccess']);
+		
+		// TODO: display "unset variables"
+		// $config_file = file_get_contents('inc/config.php');
+		// preg_match_all('/\$config\[\'(\w+)\']/', $config_file, $matches);
+		// $config_variables = array_unique($matches[1]);
+		
+		$body = '<fieldset><legend>' . _('Configuration') . '</legend><form action="" method="post"><table style="width:100%">';
+		
+		$var_force_string = array('blotter');
+		$var_system = array('version');
+		
+		if(isset($_POST['save_changes'])) {
+			$config_append = '';
+			
+			foreach($config as $name => $original_value) {
+				if(in_array($name, $var_system))
+					continue;
+				$type = gettype($original_value);
+				if($type == 'array' || $type == 'NULL')
+					continue;
+				
+				if($type == 'boolean' && in_array($name, $var_force_string))
+					$type = 'string';
+				
+				if(!isset($_POST[$name]) && $type != 'boolean')
+					continue;
+				
+				if($type == 'boolean')
+					$value = isset($_POST[$name]);
+				else
+					$value = $_POST[$name];
+				
+				if($value != $original_value) {
+					// value has been changed
+					$config_append .= "\$config['" . addslashes($name) . "'] = ";
+					if($type == 'boolean')
+						$config_append .= $value ? 'true' : 'false';
+					elseif($type == 'integer')
+						$config_append .= (int)$value;
+					elseif($type == 'string')
+						$config_append .= '\'' . addslashes($value) . '\'';
+					$config_append .= ";\n";
+				}
+			}
+			
+			if(!empty($config_append)) {
+				$config_append = "\n// Changes made via web editor by \"" . $mod['username'] . "\" @ " . date('r') . ":\n" . $config_append . "\n";
+				if(@file_put_contents('inc/instance-config.php', $config_append, FILE_APPEND)) {
+					header('Location: ?/config' . $b['uri'], true, $config['redirect_http']);
+					exit;
+				} else {
+					$config_append = htmlentities($config_append);
+					
+					if($config['minify_html'])
+						$config_append = str_replace("\n", '&#010;', $config_append);
+					$page = array();
+					$page['title'] = 'Cannot write to file!';
+					$page['config'] = $config;
+					$page['body'] = '
+						<p>Tinyboard could not write to <strong>inc/instance-config.php</strong> with the ammended configuration, probably due to a permissions error.</p>
+						<p>You may proceed with these changes manually by copying and pasting the following code to the bottom of <strong>inc/instance-config.php</strong>:</p>
+						<textarea style="width:700px;height:370px;margin:auto;display:block;background:white;color:black" readonly>' . $config_append . '</textarea>
+					';
+					echo Element('page.html', $page);
+					exit;
+				}
+			}
+		}
+		
+		foreach($config as $name => $value) {
+			$body .= '<tr>';
+			
+			$body .= '<th style="text-align:left" class="minimal">' . utf8tohtml($name) . '</th>';
+			$type = gettype($value);
+			if($type == 'array') {
+				$body .= '<td><a href="?/config/edit/' . utf8tohtml($name) . '">[edit]' . '</a></td>';
+			} else {
+				if($type == 'string' || $type == 'integer') {
+					$body .= '<td><input style="width:100%" type="text" name="' .utf8tohtml($name) . '" value="'. str_replace('"', '&quot;', utf8tohtml($value)) . '"' .
+							(in_array($name, $var_system) ? ' readonly="readonly"' : '') . '></td>';
+				} elseif($type == 'boolean') {
+					if(in_array($name, $var_force_string))
+						$body .= '<td><input style="width:100%" type="text" name="' . utf8tohtml($name) . '" value=""></td>';
+					else
+						$body .= '<td><input type="checkbox" name="' . utf8tohtml($name) . '" ' . ($value ? 'checked' : '') . '></td>';
+				} else {
+					$body .= '<td>' . utf8tohtml($value) . '</td>';
+				}
+			}
+			
+			$body .= '</tr>';
+		}
+		
+		$body .= '</table><div style="text-align:center"><input name="save_changes" type="submit" value="Save changes"></div></form></fieldset>';
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>_('Configuration'),
+			'body'=>$body,
+			'mod'=>true
+			)
+		);			
+	} elseif(preg_match('/^\/config$/', $query)) {
+		if(!hasPermission($config['mod']['show_config']))
+			error($config['error']['noaccess']);
+		
+		// Show instance-config.php	
+		
+		$data = '';
+		
+		function do_array_part($array, $prefix = '') {
+			global $data, $config;
+			
+			foreach($array as $name => $value) {
+				if(is_array($value)) {
+					do_array_part($value, $prefix . $name . ' → ');
+				} else {
+					if($config['mod']['never_reveal_password'] && $prefix == 'db → ' && $name == 'password') {
+						$value = '<em>hidden</em>';
+					} elseif(gettype($value) == 'boolean') {
+						$value = $value ? '<span style="color:green;">On</span>' : '<span style="color:red;">Off</span>';
+					} elseif(gettype($value) == 'string') {
+						if(empty($value))
+							$value = '<em>empty</em>';
+						else
+							$value = '<span style="color:maroon;">' . utf8tohtml(substr($value, 0, 110) . (mb_strlen($value) > 110 ? '&hellip;' : '')) . '</span>';
+					} elseif(gettype($value) == 'integer') {
+						$value = '<span style="color:black;">' . $value . '</span>';
+					} elseif(is_object($value) && get_class($value) == 'Closure') {
+						$value = '[callback]';
+					}
+					
+					$data .= 
+							'<tr><th style="text-align:left;">' . 
+								$prefix . (gettype($name) == 'integer' ? '[]' : utf8tohtml($name)) .
+							'</th><td>' .
+								$value .
+							'</td></tr>';
+					}
+				}
+			}
+		
+		do_array_part($config);
+		
+		
+		$body = (hasPermission($config['mod']['edit_config']) ?
+				'<p style="text-align:center" class="unimportant">' .
+					'<a href="?/config/edit">[Edit using web editor]</a>' : '') .
+				'<fieldset><legend>' . _('Configuration') . '</legend><table>' . $data . '</table></fieldset>';
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>_('Configuration'),
+			'body'=>$body,
+			'mod'=>true
+			)
+		);
+	} elseif(preg_match('/^\/new$/', $query)) {
+		if(!hasPermission($config['mod']['newboard'])) error($config['error']['noaccess']);
+		
+		// New board
+		$body = '';
+		
+		if(isset($_POST['new_board'])) {
+			// Create new board
+			if(	!isset($_POST['uri']) ||
+				!isset($_POST['title']) ||
+				!isset($_POST['subtitle'])
+			)	error($config['error']['missedafield']);
+			
+			$b = array(
+				'uri' => $_POST['uri'],
+				'title' => $_POST['title'],
+				'subtitle' => $_POST['subtitle']
+			);
+			
+			// HTML characters
+			$b['title'] = utf8tohtml($b['title'], true);
+			$b['subtitle'] = utf8tohtml($b['subtitle'], true);
+			
+			// Check required fields
+			if(empty($b['uri']))
+				error(sprintf($config['error']['required'], 'URI'));
+			if(empty($b['title']))
+				error(sprintf($config['error']['required'], 'title'));
+			
+			if(!preg_match('/^\w+$/', $b['uri']))
+				error(sprintf($config['error']['invalidfield'], 'URI'));
+			
+			if(openBoard($b['uri'])) {
+				unset($board);
+				error(sprintf($config['error']['boardexists'], sprintf($config['board_abbreviation'], $b['uri'])));
+			}
+			
+			$query = prepare("INSERT INTO `boards` VALUES (:uri, :title, :subtitle)");
+			$query->bindValue(':uri', $b['uri']);
+			$query->bindValue(':title', $b['title']);
+			if(!empty($b['subtitle'])) {
+				$query->bindValue(':subtitle', $b['subtitle']);
+			} else {
+				$query->bindValue(':subtitle', null, PDO::PARAM_NULL);
+			}
+			$query->execute() or error(db_error($query));
+			
+			// Record the action
+			modLog("Created a new board: {$b['title']}");
+			
+			// Open the board
+			openBoard($b['uri']) or error(_("Couldn't open board after creation."));
+			
+			// Create the posts table
+			query(Element('posts.sql', array('board' => $board['uri']))) or error(db_error());
+			
+			if($config['cache']['enabled'])
+				cache::delete('all_boards');
+			
+			// Build the board
+			buildIndex();
+			
+			rebuildThemes('boards');
+			
+			header('Location: ?/' . $b['uri'] . '/' . $config['file_index'], true, $config['redirect_http']);
+		} else {
+			
+			$body .= form_newBoard();
+			
+			// TODO: Statistics, etc, in the dashboard.
+			
+			echo Element('page.html', array(
+				'config'=>$config,
+				'title'=>'New board',
+				'body'=>$body,
+				'mod'=>true
+				)
+			);
+		}
+	} elseif(preg_match('/^\/' . $regex['board'] . '(' . $regex['index'] . '|' . $regex['page'] . ')?$/', $query, $matches)) {
+		// Board index
+		
+		$boardName = &$matches[1];
+		
+		// Open board
+		if(!openBoard($boardName))
+			error($config['error']['noboard']);
+		
+		$page_no = empty($matches[2]) || $matches[2] == $config['file_index'] ? 1 : $matches[2];
+		
+		if(!$page = index($page_no, $mod)) {
+			error($config['error']['404']);
+		}
+		
+		$page['pages'] = getPages(true);
+		$page['pages'][$page_no-1]['selected'] = true;
+		$page['btn'] = getPageButtons($page['pages'], true);
+		$page['mod'] = true;
+		echo Element('index.html', $page);
+	} elseif(preg_match('/^\/' . $regex['board'] . $regex['res'] . $regex['page'] . '$/', $query, $matches)) {
+		// View thread
+		
+		$boardName = &$matches[1];
+		$thread = &$matches[2];
+		// Open board
+		if(!openBoard($boardName))
+			error($config['error']['noboard']);
+		
+		$page = buildThread($thread, true, $mod);
+		
+		echo $page;
+	} elseif(preg_match('/^\/' . $regex['board'] . 'edit\/(\d+)$/', $query, $matches)) {
+		// Edit post body
+		
+		$boardName = &$matches[1];
+		
+		// Open board
+		if(!openBoard($boardName))
+			error($config['error']['noboard']);
+		
+		if(!hasPermission($config['mod']['editpost'], $boardName)) error($config['error']['noaccess']);
+		
+		$postID = &$matches[2];
+		
+		$query = prepare(sprintf("SELECT `body_nomarkup`, `name`, `subject`, `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri']));
+		$query->bindValue(':id', $postID, PDO::PARAM_INT);
+		$query->execute() or error(db_error($query));
+		$post = $query->fetch() or error($config['error']['invalidpost']);
+		
+		if(isset($_POST['submit']) && isset($_POST['body']) && isset($_POST['subject'])) {
+			if(mb_strlen($_POST['subject']) > 100)
+				error(sprintf($config['error']['toolong'], 'subject'));
+			
+			$body = $_POST['body'];
+			$body_nomarkup = $body;
+			
+			wordfilters($body);
+			$tracked_cites = markup($body, true);
+			
+			$query = prepare("DELETE FROM `cites` WHERE `board` = :board AND `post` = :post");
+			$query->bindValue(':board', $board['uri']);
+			$query->bindValue(':post', $postID, PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+		
+			$query = prepare(sprintf("UPDATE `posts_%s` SET `body` = :body, `body_nomarkup` = :body_nomarkup, `subject` = :subject WHERE `id` = :id", $board['uri']));
+			$query->bindValue(':id', $postID, PDO::PARAM_INT);
+			$query->bindValue(':body', $body);
+			$query->bindValue(':body_nomarkup', $body_nomarkup);
+			$query->bindValue(':subject', utf8tohtml($_POST['subject']));
+			$query->execute() or error(db_error($query));
+			
+			if(isset($tracked_cites)) {
+				foreach($tracked_cites as $cite) {
+					$query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)');
+					$query->bindValue(':board', $board['uri']);
+					$query->bindValue(':post', $postID, PDO::PARAM_INT);
+					$query->bindValue(':target_board',$cite[0]);
+					$query->bindValue(':target', $cite[1], PDO::PARAM_INT);
+					$query->execute() or error(db_error($query));
+				}
+			}
+	
+			// Record the action
+			modLog("Edited post #{$postID}");
+			
+			buildThread($post['thread'] ? $post['thread'] : $postID);
+			
+			// Rebuild board
+			buildIndex();
+		
+			// Redirect
+			header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
+			exit;
+		}
+		
+		$post['body_nomarkup'] = utf8tohtml($post['body_nomarkup']);
+		
+		if($config['minify_html'])
+			$post['body_nomarkup'] = str_replace("\n", '&#010;', $post['body_nomarkup']);
+		
+		$body = '<form name="post" action="" method="post">' .
+				'<table>' .
+					'<tr>' .
+						'<th>Name</th>' .
+						'<td>' . utf8tohtml($post['name']) . '</td>' .
+					'</tr>' .
+					'<tr>' .
+						'<th>Subject</th>' .
+						'<td>' .
+							'<input style="float:left;" type="text" name="subject" size="25" maxlength="50" value="' . str_replace('"', '&quot;', $post['subject']) . '"/>' .
+							'<input style="margin-left:2px;" type="submit" name="submit" value="Edit Post"/>' .
+						'</td>' .
+					'</tr>' .
+					'<tr>' .
+						'<th>Body</th>' .
+						'<td>' .
+							'<textarea name="body" rows="8" cols="38">' .
+								 $post['body_nomarkup'] .
+							'</textarea>' .
+						'</td>' .
+					'</tr>' .
+				'</table>' .
+			'</form>';
+		
+		echo Element('page.html', array(
+			'config' => $config,
+			'body' => $body,
+			'title' => 'Edit Post #' . $postID
+		));
+	} elseif(preg_match('/^\/' . $regex['board'] . 'deletefile\/(\d+)$/', $query, $matches)) {
+		// Delete file from post
+		
+		$boardName = &$matches[1];
+		
+		// Open board
+		if(!openBoard($boardName))
+			error($config['error']['noboard']);
+		
+		if(!hasPermission($config['mod']['deletefile'], $boardName)) error($config['error']['noaccess']);
+		
+		$post = &$matches[2];
+		
+		// Delete post
+		deleteFile($post);
+		
+		// Record the action
+		modLog("Removed file from post #{$post}");
+		
+		// Rebuild board
+		buildIndex();
+		
+		// Redirect
+		header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
+	} elseif(preg_match('/^\/' . $regex['board'] . 'delete\/(\d+)$/', $query, $matches)) {
+		// Delete post
+		
+		$boardName = &$matches[1];
+		
+		// Open board
+		if(!openBoard($boardName))
+			error($config['error']['noboard']);
+		
+		if(!hasPermission($config['mod']['delete'], $boardName))
+			error($config['error']['noaccess']);
+		
+		$post = &$matches[2];
+		
+		// Delete post
+		deletePost($post);
+		
+		// Record the action
+		modLog("Deleted post #{$post}");
+		
+		// Rebuild board
+		buildIndex();
+		
+		// Redirect
+		header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
+	} elseif(preg_match('/^\/' . $regex['board'] . '(un)?sticky\/(\d+)$/', $query, $matches)) {
+		// Add/remove sticky
+		
+		$boardName = &$matches[1];
+		
+		// Open board
+		if(!openBoard($boardName))
+			error($config['error']['noboard']);
+		
+		if(!hasPermission($config['mod']['sticky'], $boardName)) error($config['error']['noaccess']);
+		
+		$post = &$matches[3];
+		
+		$query = prepare(sprintf("UPDATE `posts_%s` SET `sticky` = :sticky WHERE `id` = :id AND `thread` IS NULL", $board['uri']));
+		$query->bindValue(':id', $post, PDO::PARAM_INT);
+		
+		if($matches[2] == 'un') {
+			// Record the action
+			modLog("Unstickied post #{$post}");
+			$query->bindValue(':sticky', 0, PDO::PARAM_INT);
+		} else {
+			// Record the action
+			modLog("Stickied post #{$post}");
+			$query->bindValue(':sticky', 1, PDO::PARAM_INT);
+		}
+		
+		$query->execute() or error(db_error($query));
+		
+		buildIndex();
+		buildThread($post);
+		
+		
+		// Redirect
+		header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
+	} elseif(preg_match('/^\/' . $regex['board'] . '(un)?lock\/(\d+)$/', $query, $matches)) {
+		// Lock/Unlock
+		
+		$boardName = &$matches[1];
+		
+		// Open board
+		if(!openBoard($boardName))
+			error($config['error']['noboard']);
+		
+		if(!hasPermission($config['mod']['lock'], $boardName)) error($config['error']['noaccess']);
+		
+		$post = &$matches[3];
+		
+		$query = prepare(sprintf("UPDATE `posts_%s` SET `locked` = :locked WHERE `id` = :id AND `thread` IS NULL", $board['uri']));
+		$query->bindValue(':id', $post, PDO::PARAM_INT);
+		
+		if($matches[2] == 'un') {
+			// Record the action
+			modLog("Unlocked post #{$post}");
+			$query->bindValue(':locked', 0, PDO::PARAM_INT);
+		} else {
+			// Record the action
+			modLog("Locked post #{$post}");
+			$query->bindValue(':locked', 1, PDO::PARAM_INT);
+		}
+		
+		$query->execute() or error(db_error($query));
+		
+		buildIndex();
+		buildThread($post);
+		
+		
+		// Redirect
+		header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
+	} elseif(preg_match('/^\/' . $regex['board'] . 'bump(un)?lock\/(\d+)$/', $query, $matches)) {
+		// Lock/Unlock
+		
+		$boardName = &$matches[1];
+		// Open board
+		if(!openBoard($boardName))
+			error($config['error']['noboard']);
+		
+		if(!hasPermission($config['mod']['bumplock'], $boardName)) error($config['error']['noaccess']);
+		
+		$post = &$matches[3];
+		
+		$query = prepare(sprintf("UPDATE `posts_%s` SET `sage` = :bumplocked WHERE `id` = :id AND `thread` IS NULL", $board['uri']));
+		$query->bindValue(':id', $post, PDO::PARAM_INT);
+		
+		if($matches[2] == 'un') {
+			// Record the action
+			modLog("Unbumplocked post #{$post}");
+			$query->bindValue(':bumplocked', 0, PDO::PARAM_INT);
+		} else {
+			// Record the action
+			modLog("Bumplocked post #{$post}");
+			$query->bindValue(':bumplocked', 1, PDO::PARAM_INT);
+		}
+		
+		$query->execute() or error(db_error($query));
+		
+		buildIndex();
+		buildThread($post);
+		
+		
+		// Redirect
+		header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
+	} elseif(preg_match('/^\/' . $regex['board'] . 'deletebyip\/(\d+)(\/global)?$/', $query, $matches)) {
+		// Delete all posts by an IP
+		
+		$boardName = &$matches[1];
+		$post = &$matches[2];
+		$global = isset($matches[3]) && $matches[3] == '/global';
+		
+		// Open board
+		if(!openBoard($boardName))
+			error($config['error']['noboard']);
+		
+		$query = prepare(sprintf("SELECT `ip` FROM `posts_%s` WHERE `id` = :id", $board['uri']));
+		$query->bindValue(':id', $post);
+		$query->execute() or error(db_error($query));
+		
+		if(!$post = $query->fetch())
+			error($config['error']['invalidpost']);
+		
+		$ip = $post['ip'];
+		
+		if($global)
+			$boards = listBoards();
+		else
+			$boards = array(array('uri' => $board['uri']));
+		
+		$query = '';
+		foreach($boards as $_board) {
+			$query .= sprintf("SELECT `id`, '%s' AS `board` FROM `posts_%s` WHERE `ip` = :ip UNION ALL ", $_board['uri'], $_board['uri']);
+		}
+		$query = preg_replace('/UNION ALL $/', '', $query);
+		
+		$query = prepare($query);
+		$query->bindValue(':ip', $ip);
+		$query->execute() or error(db_error($query));
+		
+		if($query->rowCount() < 1)
+			error($config['error']['invalidpost']);
+		
+		$boards = array();
+		while($post = $query->fetch()) {
+			openBoard($post['board']);
+			$boards[] = $post['board'];
+			
+			deletePost($post['id'], false);
+		}
+		
+		foreach($boards as &$_board) {
+			openBoard($_board);
+			buildIndex();
+		}
+		
+		// Record the action
+		modLog("Deleted all posts by IP address: {$ip}");
+		
+		header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
+	} elseif(preg_match('/^\/ban$/', $query)) {
+		if(!hasPermission($config['mod']['ban'])) error($config['error']['noaccess']);
+		// Ban page
+		
+		if(isset($_POST['new_ban'])) {
+			if(	!isset($_POST['ip']) ||
+				!isset($_POST['reason']) ||
+				!isset($_POST['length'])
+			)	error($config['error']['missedafield']);
+			
+			// Check required fields
+			if(empty($_POST['ip']))
+				error(sprintf($config['error']['required'], 'IP address'));
+			
+			$query = prepare("INSERT INTO `bans` VALUES (NULL, :ip, :mod, :set, :expires, :reason, :board)");
+			
+			// 1yr2hrs30mins
+			// 1y2h30m
+			$expire = 0;
+			if(preg_match('/^((\d+)\s?ye?a?r?s?)?\s?+((\d+)\s?mon?t?h?s?)?\s?+((\d+)\s?we?e?k?s?)?\s?+((\d+)\s?da?y?s?)?((\d+)\s?ho?u?r?s?)?\s?+((\d+)\s?mi?n?u?t?e?s?)?\s?+((\d+)\s?se?c?o?n?d?s?)?$/', $_POST['length'], $m)) {
+				if(isset($m[2])) {
+					// Years
+					$expire += $m[2]*60*60*24*365;
+				}
+				if(isset($m[4])) {
+					// Months
+					$expire += $m[4]*60*60*24*30;
+				}
+				if(isset($m[6])) {
+					// Weeks
+					$expire += $m[6]*60*60*24*7;
+				}
+				if(isset($m[8])) {
+					// Days
+					$expire += $m[8]*60*60*24;
+				}
+				if(isset($m[10])) {
+					// Hours
+					$expire += $m[10]*60*60;
+				}
+				if(isset($m[12])) {
+					// Minutes
+					$expire += $m[12]*60;
+				}
+				if(isset($m[14])) {
+					// Seconds
+					$expire += $m[14];
+				}
+			}
+			if($expire) {
+				$query->bindValue(':expires', time()+$expire, PDO::PARAM_INT);
+			} else {
+				// Never expire
+				$query->bindValue(':expires', null, PDO::PARAM_NULL);
+			}
+			
+			$query->bindValue(':ip', $_POST['ip'], PDO::PARAM_STR);
+			$query->bindValue(':mod', $mod['id'], PDO::PARAM_INT);
+			$query->bindValue(':set', time(), PDO::PARAM_INT);
+			
+			
+			
+			if(!empty($_POST['reason'])) {
+				$reason = $_POST['reason'];
+				markup($reason);
+				$query->bindValue(':reason', $reason, PDO::PARAM_STR);
+			} else {
+				$query->bindValue(':reason', null, PDO::PARAM_NULL);
+			}
+			
+			if($_POST['board'] == '') {
+				$query->bindValue(':board', null, PDO::PARAM_NULL);
+			} else {
+				$query->bindValue(':board', $_POST['board'], PDO::PARAM_INT);
+			}
+			
+			// Record the action
+			modLog('Created a ' . ($expire ? $expire . ' second' : 'permanent') . " ban for {$_POST['ip']} with " . (!empty($_POST['reason']) ? "reason \"${reason}\"" : 'no reason'));
+			
+			$query->execute() or error(db_error($query));
+			
+			if(isset($_POST['board']))
+				openBoard($_POST['board']);
+			
+			// Delete too
+			if(isset($_POST['delete']) && isset($_POST['board']) && hasPermission($config['mod']['delete'], $_POST['board'])) {					
+				$post = round($_POST['delete']);
+				
+				deletePost($post);
+				
+				// Record the action
+				modLog("Deleted post #{$post}");
+				
+				// Rebuild board
+				buildIndex();
+			}
+			
+			if(hasPermission($config['mod']['public_ban']) && isset($_POST['post']) && isset($_POST['board']) && isset($_POST['public_message']) && isset($_POST['message'])) {					
+				$post = round($_POST['post']);
+				
+				$query = prepare(sprintf("UPDATE `posts_%s` SET `body` = CONCAT(`body`, :body) WHERE `id` = :id", $board['uri']));
+				$query->bindValue(':id', $post, PDO::PARAM_INT);
+				$query->bindValue(':body', sprintf($config['mod']['ban_message'], utf8tohtml($_POST['message'])));
+				$query->execute() or error(db_error($query));
+				
+				// Rebuild thread
+				$query = prepare(sprintf("SELECT `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri']));
+				$query->bindValue(':id', $post, PDO::PARAM_INT);
+				$query->execute() or error(db_error($query));
+				$thread = $query->fetch();
+				if($thread['thread'])
+					buildThread($thread['thread']);
+				else
+					buildThread($post);
+				
+				// Rebuild board
+				buildIndex();
+				
+				// Record the action
+				modLog("Attached a public ban message for post #{$post}: " . $_POST['message']);
+			}
+			
+			// Redirect
+			if(isset($_POST['continue']))
+				header('Location: ' . $_POST['continue'], true, $config['redirect_http']);
+			elseif(isset($board))
+				header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
+			else
+				header('Location: ?/', true, $config['redirect_http']);
+		}
+	} elseif(preg_match('/^\/' . $regex['board'] . 'move\/(\d+)$/', $query, $matches)) {
+		
+		$boardName = &$matches[1];
+		$postID = $matches[2];
+		
+		// Open board
+		if(!openBoard($boardName))
+			error($config['error']['noboard']);
+		
+		if(!hasPermission($config['mod']['move'], $boardName)) error($config['error']['noaccess']);
+		
+		if(isset($_POST['board'])) {
+			$targetBoard = $_POST['board'];
+			$shadow = isset($_POST['shadow']);
+			
+			if($targetBoard == $boardName)
+				error(_("Target and source board are the same."));
+			
+			// copy() if leaving a shadow thread behind. otherwise, rename().
+			$clone = $shadow ? 'copy' : 'rename';
+			
+			$query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` IS NULL AND `id` = :id", $board['uri']));
+			$query->bindValue(':id', $postID, PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+			if(!$post = $query->fetch()) {
+				error($config['error']['nonexistant']);
+			}
+			$post['op'] = true;
+			
+			if($post['file']) {
+				$post['has_file'] = true;
+				$post['width'] = &$post['filewidth'];
+				$post['height'] = &$post['fileheight'];
+				
+				$file_src = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file'];
+				$file_thumb = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb'];
+			} else $post['has_file'] = false;
+			
+			// allow thread to keep its same traits (stickied, locked, etc.)
+			$post['mod'] = true;
+			
+			if(!openBoard($targetBoard))
+				error($config['error']['noboard']);
+			
+			$newID = post($post);
+			
+			if($post['has_file']) {
+				$clone($file_src, sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']);
+				$clone($file_thumb, sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']);
+			}
+			
+			// move replies too...
+			openBoard($boardName);
+			
+			$query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` = :id ORDER BY `id`", $board['uri']));
+			$query->bindValue(':id', $postID, PDO::PARAM_INT);
+			$query->execute() or error(db_error($query));
+			
+			$replies = array();
+			while($post = $query->fetch()) {
+				$post['mod'] = true;
+				$post['thread'] = $newID;
+				
+				if($post['file']) {
+					$post['has_file'] = true;
+					$post['width'] = &$post['filewidth'];
+					$post['height'] = &$post['fileheight'];
+					
+					$post['file_src'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file'];
+					$post['file_thumb'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb'];
+				} else $post['has_file'] = false;
+				
+				$replies[] = $post;
+			}
+			
+			$newIDs = array($postID => $newID);
+			
+			openBoard($targetBoard);
+			foreach($replies as &$post) {
+				$query = prepare("SELECT `target` FROM `cites` WHERE `target_board` = :board AND `board` = :board AND `post` = :post");
+				$query->bindValue(':board', $boardName);
+				$query->bindValue(':post', $post['id'], PDO::PARAM_INT);
+				$query->execute() or error(db_error($qurey));
+				while($cite = $query->fetch(PDO::FETCH_ASSOC)) {
+					if(isset($newIDs[$cite['target']])) {
+						$post['body_nomarkup'] = preg_replace(
+								'/(>>(>\/' . preg_quote($boardName, '/') . '\/)?)' . preg_quote($cite['target'], '/') . '/',
+								'>>' . $newIDs[$cite['target']],
+								$post['body_nomarkup']);
+						
+						$post['body'] = $post['body_nomarkup'];
+					}
+				}
+				$post['op'] = false;
+				$post['tracked_cites'] = markup($post['body'], true);
+				
+				$newIDs[$post['id']] = $newPostID = post($post);
+				
+				if($post['has_file']) {
+					$clone($post['file_src'], sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']);
+					$clone($post['file_thumb'], sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']);
+				}
+				
+				foreach($post['tracked_cites'] as $cite) {
+					$query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)');
+					$query->bindValue(':board', $board['uri']);
+					$query->bindValue(':post', $newPostID, PDO::PARAM_INT);
+					$query->bindValue(':target_board',$cite[0]);
+					$query->bindValue(':target', $cite[1], PDO::PARAM_INT);
+					$query->execute() or error(db_error($query));
+				}
+			}
+			
+			// build thread
+			buildThread($newID);
+			buildIndex();
+			
+			// trigger themes
+			rebuildThemes('post');
+			
+			openBoard($boardName);
+			
+			if($shadow) {
+				// lock thread
+				$query = prepare(sprintf("UPDATE `posts_%s` SET `locked` = 1 WHERE `id` = :id", $board['uri']));
+				$query->bindValue(':id', $postID, PDO::PARAM_INT);
+				$query->execute() or error(db_error($query));
+				
+				$post = array(
+					'mod' => true,
+					'subject' => '',
+					'email' => '',
+					'name' => $config['mod']['shadow_name'],
+					'capcode' => $config['mod']['shadow_capcode'],
+					'trip' => '',
+					'body' => sprintf($config['mod']['shadow_mesage'], '>>>/' . $targetBoard . '/' . $newID),
+					'password' => '',
+					'has_file' => false,
+					// attach to original thread
+					'thread' => $postID,
+					'op' => false
+				);
+				
+				markup($post['body']);
+				
+				$botID = post($post);
+				buildThread($postID);
+				
+				header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['dir']['res'] . sprintf($config['file_page'], $postID) . '#' . $botID, true, $config['redirect_http']);
+			} else {
+				deletePost($postID);
+				buildIndex();
+				
+				openBoard($targetBoard);
+				header('Location: ?/' . sprintf($config['board_path'], $board['uri']) . $config['dir']['res'] . sprintf($config['file_page'], $newID), true, $config['redirect_http']);
+			}
+		} else {
+		
+			$body = '<fieldset><legend>Move thread</legend>' .
+				'<form action="?/' . $boardName . '/move/' . $postID . '" method="post">' .
+					'<table>'
+				;
+		
+			$boards = listBoards();
+			if(count($boards) <= 1)
+				error(_('No board to move to; there is only one.'));
+			
+			$__boards = '';
+			foreach($boards as &$_board) {
+				if($_board['uri'] == $board['uri'])
+					continue;
+				$__boards .= '<li>' .
+					'<input type="radio" name="board" id="board_' . $_board['uri'] . '" value="' . $_board['uri'] . '">' .
+					'<label style="display:inline" for="board_' . $_board['uri'] . '"> ' .
+							sprintf($config['board_abbreviation'], $_board['uri']) .
+						' - ' . $_board['title'] .
+					'</label>' .
+					'</li>';
+			}
+		
+			$body .= '<tr>' .
+						'<th>Thread ID</th>' .
+						'<td><input type="text" size="7" value="' . $postID . '" disabled /></td>' .
+					'</tr>' .
+				
+					'<tr>' . 
+						'<th><label for="message">Leave shadow thread</label></th>' .
+						'<td>' .
+							'<input type="checkbox" id="shadow" name="shadow" checked/>' .
+							' <span class="unimportant">(locks thread; replies to it with a link.)</span>' .
+						'</td>' .
+					'</tr>' .
+				
+					'<tr>' .
+						'<th>Target board</th>' .
+						'<td><ul style="list-style:none;padding:2px 5px">' . $__boards . '</tl></td>' .
+					'</tr>' .
+				
+					'<tr>' . 
+						'<td></td>' . 
+						'<td><input type="submit" value="Move thread" /></td>' . 
+					'</tr>' . 
+				'</table>' .
+			'</form></fieldset>';
+	
+			echo Element('page.html', array(
+				'config'=>$config,
+				'title'=>'Move #' . $postID,
+				'body'=>$body,
+				'mod'=>true
+				)
+			);
+		}
+	} elseif(preg_match('/^\/' . $regex['board'] . 'ban(&delete)?\/(\d+)$/', $query, $matches)) {
+		
+		// Ban by post
+		
+		$boardName = &$matches[1];
+		// Open board
+		if(!openBoard($boardName))
+			error($config['error']['noboard']);
+		
+		if(!hasPermission($config['mod']['ban'], $boardName)) error($config['error']['noaccess']);
+		
+		$delete = isset($matches[2]) && $matches[2] == '&delete';
+		if($delete && !hasPermission($config['mod']['delete'], $boardName)) error($config['error']['noaccess']);
+		
+		$post = $matches[3];
+		
+		$query = prepare(sprintf("SELECT `ip`,`id` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri']));
+		$query->bindValue(':id', $post, PDO::PARAM_INT);
+		$query->execute() or error(db_error($query));
+		
+		if($query->rowCount() < 1) {
+			error($config['error']['invalidpost']);
+		}
+	
+		$post = $query->fetch();
+		
+		$body = form_newBan($post['ip'], null, '?/' . sprintf($config['board_path'], $board['uri']) . $config['file_index'], $post['id'], $boardName, !$delete);
+		
+		echo Element('page.html', array(
+			'config'=>$config,
+			'title'=>'New ban',
+			'body'=>$body,
+			'mod'=>true
+			)
+		);
+	} elseif(preg_match('/^\/IP\/(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')\/deletenote\/(?P<id>\d+)$/', $query, $matches)) {
+		if(!hasPermission($config['mod']['remove_notes'])) error($config['error']['noaccess']);
+		
+		$ip = $matches[1];
+		$id = $matches['id'];
+
+		$query = prepare("DELETE FROM `ip_notes` WHERE `ip` = :ip AND `id` = :id");
+		$query->bindValue(':ip', $ip);
+		$query->bindValue(':id', $id);
+		$query->execute() or error(db_error($query));
+		
+		header('Location: ?/IP/' . $ip, true, $config['redirect_http']);
+	} elseif(preg_match('/^\/IP\/(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')$/', $query, $matches)) {
+		// View information on an IP address
+		
+		$ip = $matches[1];
+		$host = $config['mod']['dns_lookup'] ? rDNS($ip) : false;
+		
+		if(hasPermission($config['mod']['unban']) && isset($_POST['unban']) && isset($_POST['ban_id'])) {
+			removeBan($_POST['ban_id']);
+			header('Location: ?/IP/' . $ip, true, $config['redirect_http']);
+		} elseif(hasPermission($config['mod']['create_notes']) && isset($_POST['note'])) {
+			$query = prepare("INSERT INTO `ip_notes` VALUES(NULL, :ip, :mod, :time, :body)");
+			$query->bindValue(':ip', $ip);
+			$query->bindValue(':mod', $mod['id'], PDO::PARAM_INT);
+			$query->bindValue(':time', time(), PDO::PARAM_INT);
+			markup($_POST['note']);
+			$query->bindValue(':body', $_POST['note']);
+			$query->execute() or error(db_error($query));
+			
+			header('Location: ?/IP/' . $ip, true, $config['redirect_http']);
+		} else {
+			$body = '';
+			$boards = listBoards();
+			foreach($boards as &$_board) {
+				openBoard($_board['uri']);
+			
+				$temp = '';
+				$query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `ip` = :ip ORDER BY `sticky` DESC, `time` DESC LIMIT :limit", $_board['uri']));
+				$query->bindValue(':ip', $ip);
+				$query->bindValue(':limit', $config['mod']['ip_recentposts'], PDO::PARAM_INT);
+				$query->execute() or error(db_error($query));
+			
+				while($post = $query->fetch()) {
+					if(!$post['thread']) {
+						$po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false);
+					} else {
+						$po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'],  $post['embed'], '?/', $mod);
+					}
+					$temp .= $po->build(true) . '<hr/>';
+				}
+			
+				if(!empty($temp))
+					$body .= '<fieldset><legend>Last ' . $query->rowCount() . ' posts on <a href="?/' .
+							sprintf($config['board_path'], $_board['uri']) . $config['file_index'] .
+						'">' .
+						sprintf($config['board_abbreviation'], $_board['uri']) . ' - ' . $_board['title'] .
+						'</a></legend>' . $temp . '</fieldset>';
+			}
+		
+			if(hasPermission($config['mod']['view_notes'])) {
+				$query = prepare("SELECT * FROM `ip_notes` WHERE `ip` = :ip ORDER BY `id` DESC");
+				$query->bindValue(':ip', $ip);
+				$query->execute() or error(db_error($query));
+			
+				if($query->rowCount() > 0 || hasPermission($config['mod']['create_notes'])) {
+					$body .= '<fieldset><legend>' .
+							$query->rowCount() . ' note' . ($query->rowCount() == 1 ?'' : 's') . ' on record' . 
+						'</legend>';
+					if($query->rowCount() > 0) {
+						$body .= '<table class="modlog">' .
+						'<tr><th>Staff</th><th>Note</th><th>Date</th>' .
+							(hasPermission($config['mod']['remove_notes']) ? '<th>Actions</th>' : '') .
+						'</td>';
+						while($note = $query->fetch()) {
+						
+							if($note['mod']) {
+								$_query = prepare("SELECT `username` FROM `mods` WHERE `id` = :id");
+								$_query->bindValue(':id', $note['mod']);
+								$_query->execute() or error(db_error($_query));
+								if($_mod = $_query->fetch()) {
+									$staff = '<a href="?/new_PM/' . $note['mod'] . '">' . utf8tohtml($_mod['username']) . '</a>';
+								} else {
+									$staff = '<em>???</em>';
+								}
+							} else {
+								$staff = '<em>system</em>';
+							}
+							$body .= '<tr>' .
+								'<td class="minimal">' .
+									$staff .
+								'</td><td>' .
+									$note['body'] .
+								'</td><td class="minimal">' .
+									strftime($config['post_date'], $note['time']) .
+								'</td>' .
+								(hasPermission($config['mod']['remove_notes']) ?
+									'<td class="minimal"><a class="unimportant" href="?/IP/' . $ip . '/deletenote/' . $note['id'] . '">[delete]</a></td>'
+								: '') .
+							'</tr>';
+						}
+						$body .= '</table>';
+					}
+		
+					if(hasPermission($config['mod']['create_notes'])) {
+						$body .= '<form action="" method="post" style="text-align:center;margin:0">' . 
+								'<table>' .
+									'<tr>' .
+										'<th>Staff</th>' .
+										'<td>' . $mod['username'] . '</td>' .
+									'</tr>' .
+									'<tr>' .
+										'<th><label for="note">Note</label></th>' .
+										'<td><textarea id="note" name="note" rows="5" cols="30"></textarea></td>' .
+									'</tr>' .
+									'<tr>' .
+										'<td></td>' .
+										'<td><input type="submit" value="New note" /></td>' .
+									'</tr>' .
+								'</table>' .
+							'</form>';
+					}
+				
+					$body .= '</fieldset>';
+				}
+			}
+		
+			if(hasPermission($config['mod']['view_ban'])) {
+				$query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `ip` = :ip");
+				$query->bindValue(':ip', $ip);
+				$query->execute() or error(db_error($query));
+			
+				if($query->rowCount() > 0) {
+					$body .= '<fieldset><legend>Ban' . ($query->rowCount() == 1 ? '' : 's') . ' on record</legend>';
+				
+					while($ban = $query->fetch()) {
+						$body .= '<form action="" method="post" style="text-align:center">' .
+						'<table style="width:400px;margin-bottom:10px;border-bottom:1px solid #ddd;padding:5px"><tr><th>Status</th><td>' . 
+							($config['mod']['view_banexpired'] && $ban['expires'] != 0 && $ban['expires'] < time() ?
+								'Expired'
+							: 'Active') .
+						'</td></tr>' .
+					
+						// IP
+						'<tr><th>IP</th><td>' . $ban['ip'] . '</td></tr>' .
+					
+						// Reason
+						'<tr><th>Reason</th><td>' . $ban['reason'] . '</td></tr>' .
+					
+						// Board
+						'<tr><th>Board</th><td>' .
+						(isset($ban['board']) ?
+							sprintf($config['board_abbreviation'], $ban['board'])
+						:
+							'<em>' . _('all boards') . '</em>'
+						) .
+						'</td></tr>' .
+					
+						// Set
+						'<tr><th>Set</th><td>' . strftime($config['post_date'], $ban['set']) . '</td></tr>' .
+					
+						// Expires
+						'<tr><th>Expires</th><td>' . 
+							($ban['expires'] == 0 ?
+								'<em>Never</em>'
+							:
+								strftime($config['post_date'], $ban['expires'])
+							) .
+						'</td></tr>' .
+					
+						// Staff
+						'<tr><th>Staff</th><td>' .
+							(isset($ban['username']) ?
+								(!hasPermission($config['mod']['view_banstaff']) ?
+									($config['mod']['view_banquestionmark'] ?
+										'?'
+									:
+										($ban['type'] == JANITOR ? 'Janitor' :
+										($ban['type'] == MOD ? 'Mod' :
+										($ban['type'] == ADMIN ? 'Admin' :
+										'?')))
+									)
+								:
+									utf8tohtml($ban['username'])
+								)
+								: '<em>deleted?</em>'
+							) .
+						'</td></tr></table>' .
+						
+						'<input type="hidden" name="ban_id" value="' . $ban['id'] . '" />' .
+						
+						'<input type="submit" name="unban" value="Remove ban" ' .
+							(!hasPermission($config['mod']['unban']) ? 'disabled' : '') .
+						'/></form>';
+					}
+					
+					$body .= '</fieldset>';
+					
+				}
+			}
+		
+			if(hasPermission($config['mod']['ip_banform']))
+				$body .= form_newBan($ip, null, '?/IP/' . $ip);
+		
+			echo Element('page.html', array(
+				'config'=>$config,
+				'title'=>'IP: ' . $ip,
+				'subtitle' => $host,
+				'body'=>$body,
+				'mod'=>true
+				)
+			);
+		}
+	} else {
+		error($config['error']['404']);
+	}
+}
+
diff --git a/mod.php b/mod.php
index e434a80d..52f340d2 100644
--- a/mod.php
+++ b/mod.php
@@ -4,11 +4,11 @@
  *  Copyright (c) 2010-2012 Tinyboard Development Group
  */
 
-// WARNING: This file is currently a clusterfuck of code. I will be rewriting it very soon.
-
 require 'inc/functions.php';
-require 'inc/mod.php';
+require 'inc/mod/auth.php';
+require 'inc/mod/pages.php';
 
+// Fix for magic quotes
 if (get_magic_quotes_gpc()) {
 	function strip_array($var) {
 		return is_array($var) ? array_map('strip_array', $var) : stripslashes($var);
@@ -20,3103 +20,119 @@ if (get_magic_quotes_gpc()) {
 
 $query = isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '';
 
-// If not logged in
-if(!$mod) {
-	if(isset($_POST['login'])) {
-		// Check if inputs are set and not empty
-		if(	!isset($_POST['username']) ||
-			!isset($_POST['password']) ||
-			empty($_POST['username']) ||
-			empty($_POST['password'])
-			) loginForm($config['error']['invalid'], $_POST['username'], '?' . $query);
-		
-		
-		if(!login($_POST['username'], $_POST['password'])) {
-			if($config['syslog'])
-				_syslog(LOG_WARNING, 'Unauthorized login attempt!');
-			loginForm($config['error']['invalid'], $_POST['username'], '?' . $query);
-		}
-		
-		modLog("Logged in.");
-		
-		// Login successful
-		// Set cookies
-		setCookies();
-		
-		// Redirect
-		if(isset($_POST['redirect']))
-			header('Location: ' . $_POST['redirect'], true, $config['redirect_http']);
-		else
-			header('Location: ?' . $config['mod']['default'], true, $config['redirect_http']);
-	} else {
-		loginForm(false, false, '?' . $query);
-	}
-} else {
-	// Redirect (for index pages)
-	if(count($_GET) == 2 && isset($_GET['status']) && isset($_GET['r'])) {
-		header('Location: ' . $_GET['r'], true, $_GET['status']);
-		exit;
-	}
+$pages = array(
+	''					=> ':?/',		// redirect to dashboard
+	'/'					=> 'dashboard',		// dashboard
+	'/confirm/(.+)'				=> 'confirm',		// confirm action (if javascript didn't work)
+	'/logout'				=> 'logout',		// logout
 	
-	// A sort of "cache"
-	// Stops calling preg_quote and str_replace when not needed; only does it once
-	$regex = array(
-		'board' => str_replace('%s', '(\w{1,8})', preg_quote($config['board_path'], '/')),
-		'page' => str_replace('%d', '(\d+)', preg_quote($config['file_page'], '/')),
-		'img' => preg_quote($config['dir']['img'], '/'),
-		'thumb' => preg_quote($config['dir']['thumb'], '/'),
-		'res' => preg_quote($config['dir']['res'], '/'),
-		'index' => preg_quote($config['file_index'], '/')
-	);
+	'/users'				=> 'users',		// manage users
+	'/users/(\d+)'				=> 'user',		// edit user
+	'/users/(\d+)/(promote|demote)'		=> 'user_promote',	// prmote/demote user
+	'/users/new'				=> 'user_new',		// create a new user
+	'/new_PM/([^/]+)'			=> 'new_pm',		// create a new pm
+	'/PM/(\d+)(/reply)?'			=> 'pm',		// read a pm
+	'/inbox'				=> 'inbox',		// pm inbox
 	
-	if(preg_match('/^\/?$/', $query)) {
-		// Dashboard
-		$fieldset = array(
-			'Boards' => '',
-			'Noticeboard' => '',
-			'Administration' => '',
-			'Themes' => '',
-			'Search' => '',
-			'Update' => '',
-			'Logout' => ''
-		);
-		
-		// Boards
-		$fieldset['Boards'] .= ulBoards();
-		
-		if(hasPermission($config['mod']['noticeboard'])) {
-			if(!$config['cache']['enabled'] || !($fieldset['Noticeboard'] = cache::get('noticeboard_preview'))) {
-				$query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit");
-				$query->bindValue(':limit', $config['mod']['noticeboard_dashboard'], PDO::PARAM_INT);
-				$query->execute() or error(db_error($query));
-			
-				$fieldset['Noticeboard'] .= '<li>';
-			
-				$_body = '';
-				while($notice = $query->fetch()) {					
-					$_body .= '<li><a href="?/noticeboard#' .
-						$notice['id'] .
-					'">' .
-					($notice['subject'] ?
-						$notice['subject']
-					:
-						'<em>' . _('no subject') . '</em>'
-					) .
-				'</a><span class="unimportant"> &mdash; by ' .
-					(isset($notice['username']) ?
-						utf8tohtml($notice['username'])
-					: '<em>???</em>') .
-				' at ' .
-					strftime($config['post_date'], $notice['time']) .
-				'</span></li>';
-				}
-				if(!empty($_body)) {
-					$fieldset['Noticeboard'] .= '<ul>' . $_body . '</ul></li><li>';
-				}
-				if($config['cache']['enabled'])
-					cache::set('noticeboard_preview', $fieldset['Noticeboard']);
-			}
-			
-			$fieldset['Noticeboard'] .= '<a href="?/noticeboard">' . _('View all entries') . '</a></li>';
-		
-			$query = prepare("SELECT COUNT(*) AS `count` FROM `pms` WHERE `to` = :id AND `unread` = 1");
-			$query->bindValue(':id', $mod['id']);
-			$query->execute() or error(db_error($query));
-			$count = $query->fetch();
-			$count = $count['count'];
-		
-			$fieldset['Noticeboard'] .= '<li><a href="?/inbox">' . _('PM Inbox') . 
-				($count > 0
-				?
-					' <strong>(' . $count . ' unread)</strong>'
-				: '') .
-			'</a></li>';
-		
-			$fieldset['Noticeboard'] .= '<li><a href="?/news">' . _('News') . '</a></li>';
-		}
-		
-		
-		if(hasPermission($config['mod']['reports'])) {
-			$fieldset['Administration'] .= 	'<li><a href="?/reports">' . _('Report queue') . '</a></li>';
-		}
-		if(hasPermission($config['mod']['view_banlist'])) {
-			$fieldset['Administration'] .= 	'<li><a href="?/bans">' . _('Ban list') . '</a></li>';
-		}
-		if(hasPermission($config['mod']['manageusers'])) {
-			$fieldset['Administration'] .= 	'<li><a href="?/users">' . _('Manage users') . '</a></li>';
-		} elseif(hasPermission($config['mod']['change_password'])) {
-			$fieldset['Administration'] .= 	'<li><a href="?/users/' . $user['id'] . '">' . _('Change own password') . '</a></li>';
-		}
-		if(hasPermission($config['mod']['modlog'])) {
-			$fieldset['Administration'] .= 	'<li><a href="?/log">' . _('Moderation log') . '</a></li>';
-		}
-		if(hasPermission($config['mod']['rebuild'])) {
-			$fieldset['Administration'] .= 	'<li><a href="?/rebuild">' . _('Rebuild static files') . '</a></li>';
-		}
-		if(hasPermission($config['mod']['rebuild']) && $config['cache']['enabled']) {
-			$fieldset['Administration'] .= 	'<li><a href="?/flush">' . _('Clear cache') . '</a></li>';
-		}
-		if(hasPermission($config['mod']['show_config'])) {
-			$fieldset['Administration'] .= 	'<li><a href="?/config">' . _('Show configuration') . '</a></li>';
-		}
-		
-		if(hasPermission($config['mod']['themes'])) {
-			$fieldset['Themes'] .= 	'<li><a href="?/themes">' . _('Manage themes') . '</a></li>';
-		}
-		
-		if(hasPermission($config['mod']['search'])) {
-			$fieldset['Search'] .= 	'<li><form style="display:inline" action="?/search" method="post">' .
-			'<label style="display:inline" for="search">' . _('Phrase:') . '</label> ' .
-				'<input id="search" name="search" type="text" size="35" />' .
-				'<input type="submit" value="' . _('Search') . '" />' .
-			'</form>' .
-				'<p class="unimportant">' . _('(Search is case-insensitive, and based on keywords. To match exact phrases, use "quotes". Use an asterisk (*) for wildcard.)') . '</p>' .
-			'</li>';
-		}
-		
-		if($mod['type'] >= ADMIN && $config['check_updates']) {
-			if(!$config['version'])
-				error(_('Could not find current version! (Check .installed)'));
-			if(isset($_COOKIE['update'])) {
-				$latest = unserialize($_COOKIE['update']);
-			} else {
-				$ctx = stream_context_create(array( 
-					'http' => array(
-						'timeout' => 3
-						) 
-					) 
-				);
-				
-				if($code = @file_get_contents('http://tinyboard.org/version.txt', 0, $ctx)) {
-					eval($code);
-					if(preg_match('/v(\d+)\.(\d)\.(\d+)(-dev.+)?$/', $config['version'], $m)) {
-						$current = array(
-							'massive' => (int)$m[1],
-							'major' => (int)$m[2],
-							'minor' => (int)$m[3]
-						);
-						if(isset($m[4])) { 
-							// Development versions are always ahead in the versioning numbers
-							$current['minor'] --;
-						}
-					}
-					// Check if it's newer
-					if(	$latest['massive'] > $current['massive'] ||
-						$latest['major'] > $current['major'] ||
-							($latest['massive'] == $current['massive'] &&
-								$latest['major'] == $current['major'] &&
-								$latest['minor'] > $current['minor']
-							)) {
-						$latest = $latest;
-					} else $latest = false;
-				} else {
-					// Couldn't get latest version
-					// TODO: Display some sort of warning message
-					$latest = false;
-				}
-				
-				
-				setcookie('update', serialize($latest), time() + $config['check_updates_time'], $config['cookies']['jail'] ? $config['cookies']['path'] : '/', null, false, true);
-			}
-			
-			if($latest) {
-				$fieldset['Update'] .=
-					'<li>A newer version of Tinyboard (<strong>v' .
-						$latest['massive'] . '.' .
-						$latest['major'] . '.' . 
-						$latest['minor'] .
-					'</strong>) is available! See <a href="http://tinyboard.org">http://tinyboard.org/</a> for upgrade instructions.</li>';
-			}
-		}
-		
-		$fieldset['Logout'] .= '<li><a href="?/logout">' . _('Logout') . '</a></li>';
-		
-		// TODO: Statistics, etc, in the dashboard.
-		
-		$body = '';
-		foreach($fieldset as $title => $data) {
-			if($data)
-				$body .= '<fieldset><legend>' . _($title) . '</legend><ul>' . $data . '</ul></fieldset>';
-		}
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>_('Dashboard'),
-			'body'=>$body,
-			'__mod'=>true
-		));
-	} elseif(preg_match('/^\/logout$/', $query)) {
-		destroyCookies();
-		
-		header('Location: ?/', true, $config['redirect_http']);
-	} elseif(preg_match('/^\/confirm\/(.+)$/', $query, $matches)) {
-		$uri = &$matches[1];
-		
-		$body = '<p style="text-align:center">' .
-		'<span class="heading" style="margin-bottom:6px">Are you sure you want to do that?</span>' .
-			'We were unable to serve a confirmation dialog for ' .
-				'<strong>?/' . utf8tohtml($uri) . '</strong>' .
-			', probably due to Javascript being disabled.' .
-		'</p>' .
-		'<p style="text-align:center"><a style="margin:block;font-size:150%;font-weight:bold" href="?/' . utf8tohtml($uri) . '">Confirm</a></p>';
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>'Confirm',
-			'body'=>$body,
-			'mod'=>true
-			)
-		);
-	} elseif(preg_match('/^\/upgrade$/', $query)) {
-		if($mod['type'] != ADMIN)
-			error($config['error']['noaccess']);
-		
-		if(is_dir('.git')) {
-			// use git instead
-			
-			$body = '<div class="ban"><h2>git pull</h2>';
-			$body .= '<p>' . str_replace("\n", '<br/>', shell_exec('git pull')) . '</p>';
-			$body .= '</div>';
-			echo Element('page.html', array(
-				'config' => $config,
-				'title' => 'Upgraded',
-				'body' => $body
-			));
-			exit;
-		}
-		
-		if(!extension_loaded('curl'))
-			error('You need the cURL PHP extension to do that.');
-		
-		if(!class_exists('ZipArchive'))
-			error('You need <a href="http://php.net/manual/en/class.ziparchive.php">the ZipArchive class</a> to do that.');
-		
-		if(!in_array('zip', stream_get_wrappers()))
-			error('You need the zip:// stream wrapper to do that.');
-		
-		$temp = tempnam($config['tmp'], 'tinyboard');
-		
-		$fp = fopen($temp, 'w+');
-		
-		$curl = curl_init();
-		curl_setopt($curl, CURLOPT_URL, 'https://github.com/savetheinternet/Tinyboard/zipball/master');
-		curl_setopt($curl, CURLOPT_FAILONERROR, true);
-		curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
-		curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, true);
-		curl_setopt($curl, CURLOPT_SSL_VERIFYHOST, 2);
-		curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, 5);
-		curl_setopt($curl, CURLOPT_TIMEOUT, 45);
-		curl_setopt($curl, CURLOPT_FILE, $fp);
-		curl_setopt($curl, CURLOPT_WRITEHEADER, $header = tmpfile());
-		curl_setopt($curl, CURLOPT_HEADER, true);
-		
-		curl_exec($curl);
-		
-		if(curl_errno($curl))
-			error('Failed downloading newest revision: ' . curl_error($curl));
-		
-		curl_close($curl);
-		
-		fflush($fp);
-		fclose($fp);
-		
-		fseek($header, 0);
-		$version = false;
-		while($line = fgets($header)) {
-			if(preg_match('/^Content-Disposition: attachment; filename=savetheinternet-Tinyboard-(.+)\.zip\s?$/', $line, $m)) {
-				$version = $m[1];
-			}
-		}
-		fclose($header);
-		
-		$zip = new ZipArchive();
-		if(!$zip->open($temp))
-			error('Could not make sense of the ZIP archive.');
-		
-		$version = preg_replace('/^savetheinternet-Tinyboard-(\w+)\//', '$1', $dir = $zip->getNameIndex(0));
-		
-		$errors = array();
-		for($i = 1; $i < $zip->numFiles; $i++) {
-			$filename = str_replace($dir, '', $zip->getNameIndex($i));
-			
-			if($filename == 'inc/instance-config.php')
-				continue; // don't override config
-			
-			// are we able to write here?
-			if(!((file_exists($filename) && is_writable($filename)) || (!file_exists($filename) && is_writable(dirname($filename))))) {
-				// nope
-				$errors[] = 'Cannot write to ' . $filename . '!';
-			}
-		}
-		
-		$zip->close();
-		
-		if($errors) {
-			$body = '<div class="ban"><h2>Error(s) upgrading</h2><p>Tinyboard can not self-upgrade until the following is fixed:</p><ul>';
-			foreach($errors as $error) {
-				$body .= '<li>' . $error . '</li>';
-			}
-			$body .= '</ul><p>Please fix the above errors and refresh to try again.</p></div>';
-			
-			unlink($temp);
-			
-			echo Element('page.html', array(
-				'config' => $config,
-				'title' => 'Error(s) upgrading',
-				'body' => $body
-			));
-			exit;
-		}
-		
-		// For some reason, reading the ZIP entries in PHP doesn't seem to work very well.
-		// Use shell instead.
-		shell_exec('TEMP_DIR=$(mktemp -d); unzip -q ' . escapeshellarg($temp) . ' -d $TEMP_DIR -x "' . escapeshellarg($dir) . 'inc/instance-config.php"; mv -v $TEMP_DIR/' . escapeshellarg($dir) . '* "' . getcwd() . '"; rm -rf $TEMP_DIR');
-		
-		unlink($temp);
-		
-		echo Element('page.html', array(
-			'config' => $config,
-			'title' => 'Upgraded',
-			'body' => '<p style="text-align:center">Upgrading seems to have gone okay. You are now at revision <strong>' . $version . '</strong>.</p>'
-		));		
-	} elseif(preg_match('/^\/log(\/(\d+))?$/', $query, $match)) {
-		if(!hasPermission($config['mod']['modlog'])) error($config['error']['noaccess']);
-		
-		$page = isset($match[2]) ? $match[2] : 1;
-		
-		$query = prepare("SELECT `mod` as `id`, `username`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY `time` DESC LIMIT :offset, :limit");
-		$query->bindValue(':limit', $config['mod']['modlog_page'], PDO::PARAM_INT);
-		$query->bindValue(':offset', ($page - 1) * $config['mod']['modlog_page'], PDO::PARAM_INT);
-		$query->execute() or error(db_error($query));
-		
-		if(!$query->rowCount()) {
-			$body = '<p class="unimportant" style="text-align:center">(Nothing to display.)</p>';
-		} else {
-			$body = '<table class="modlog">' . 
-				'<tr>' . 
-					'<th>' . _('User') . '</th>' . 
-					'<th>' . _('IP address') . '</th>' .
-					'<th>' . _('Ago') . '</th>' . 
-					'<th>' . _('Board') . '</th>' . 
-					'<th>' . _('Action') . '</th>' . 
-				'</tr>';
-			while($log = $query->fetch()) {
-				$log_id = 'log_' . md5($log['text']);
-				
-				if($config['cache']['enabled'] && $_log = cache::get($log_id))
-					$log['text'] = $_log;
-				else {
-				
-					$log['text'] = utf8tohtml($log['text']);
-					$log['text'] = preg_replace('/(\d+\.\d+\.\d+\.\d+)/', '<a href="?/IP/$1">$1</a>', $log['text']);
-				
-					if(isset($log['board'])) {
-						if(preg_match('/post #(\d+)/', $log['text'], $match)) {
-							$post_query = prepare(sprintf("SELECT `thread` FROM `posts_%s` WHERE `id` = :id", $log['board']));
-							$post_query->bindValue(':id', $match[1], PDO::PARAM_INT);
-							$post_query->execute() or error(db_error($query));
-						
-							if($post = $post_query->fetch()) {
-								$log['text'] = preg_replace('/post (#(\d+))/',
-									'post <a href="' .
-										'?/' .
-										sprintf($config['board_path'], $log['board']) .
-										$config['dir']['res'] .
-										($post['thread'] ?
-											sprintf($config['file_page'], $post['thread']) . '#' . $match[1]
-										: sprintf($config['file_page'], $match[1])) .
-									'">$1</a>', $log['text']);
-							} else {
-								$log['text'] = preg_replace('/post (#(\d+))/', 'post <s>$1</s>', $log['text']);
-							}
-							
-							if($config['cache']['enabled'])
-								cache::set($log_id, $log['text']);
-						}
-					}
-				}
-				
-				$body .= '<tr>' .
-				'<td class="minimal">' .
-					($log['username'] ? 
-						'<a href="?/new_PM/' . $log['id'] . '">' . $log['username'] . '</a>'
-					: '<em>' . ($log['id'] < 0 ? 'system' : 'deleted?') . '</em>') .
-				'</td>' .
-				'<td class="minimal">' . ($log['id'] < 0 ? '&ndash;' : '<a href="?/IP/' . $log['ip'] . '">' . $log['ip'] . '</a>') . '</td>' .
-				'<td class="minimal">' . ago($log['time']) . '</td>' .
-				'<td class="minimal">' .
-					($log['board'] ?
-						'<a href="?/' . sprintf($config['board_path'], $log['board']) . $config['file_index'] . '">' . sprintf($config['board_abbreviation'], $log['board']) . '</a></td>'
-					: '-') .
-				'<td>' . $log['text'] . '</td>' .
-				'</tr>';
-			}
-		
-			$body .= '</table>';
-			
-			$query = prepare("SELECT COUNT(*) AS `count` FROM `modlogs`");
-			$query->execute() or error(db_error($query));
-			$count = $query->fetch();
-			
-			$body .= '<p class="unimportant" style="text-align:center;word-wrap:break-word">';
-			for($x = 0; $x < $count['count'] / $config['mod']['modlog_page']; $x ++) {
-				$body .= '<a href="?/log/' . ($x+1) . '">[' . ($x + 1) . ']</a> ';
-			}
-			$body .= '</p>';
-		}
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>_('Moderation log'),
-			'body'=>$body,
-			'mod'=>true
-			)
-		);
-	} elseif(preg_match('/^\/themes\/none$/', $query, $match)) {
-		if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']);
-		
-		// Clearsettings
-		query("TRUNCATE TABLE `theme_settings`") or error(db_error());
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>'No theme',
-			'body'=>'<p style="text-align:center">Successfully uninstalled all themes.</p>' .
-				'<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>',
-			'mod'=>true
-			)
-		);
-	} elseif(preg_match('/^\/themes\/([\w\-]+)\/rebuild$/', $query, $match)) {
-		if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']);
-		
-		rebuildTheme($match[1], 'all');
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>'Rebuilt',
-			'body'=>'<p style="text-align:center">Successfully rebuilt the <strong>' . $match[1] . '</strong> theme.</p>' .
-				'<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>',
-			'mod'=>true
-			)
-		);
-	} elseif(preg_match('/^\/themes\/(\w+)\/uninstall$/', $query, $match)) {
-		if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']);
-		
-		$query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme");
-		$query->bindValue(':theme', $match[1]);
-		$query->execute() or error(db_error($query));
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>'Uninstalled',
-			'body'=>'<p style="text-align:center">Successfully uninstalled the <strong>' . $match[1] . '</strong> theme.</p>' .
-				'<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>',
-			'mod'=>true
-			)
-		);
-	} elseif(preg_match('/^\/themes(\/([\w\-]+))?$/', $query, $match)) {
-		if(!hasPermission($config['mod']['themes'])) error($config['error']['noaccess']);
-		
-		if(!is_dir($config['dir']['themes']))
-			error(_('Themes directory doesn\'t exist!'));
-		if(!$dir = opendir($config['dir']['themes']))
-			error(_('Cannot open themes directory; check permissions.'));
-		
-		if(isset($match[2])) {
-			$_theme = &$match[2];
-			
-			if(!$theme = loadThemeConfig($_theme)) {
-				error($config['error']['invalidtheme']);
-			}
-			
-			if(isset($_POST['install'])) {
-				// Check if everything is submitted
-				foreach($theme['config'] as &$c) {
-					if(!isset($_POST[$c['name']]) && $c['type'] != 'checkbox')
-						error(sprintf($config['error']['required'], $c['title']));
-				}
-				
-				// Clear previous settings
-				$query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme");
-				$query->bindValue(':theme', $_theme);
-				$query->execute() or error(db_error($query));
-				
-				foreach($theme['config'] as &$c) {
-					$query = prepare("INSERT INTO `theme_settings` VALUES(:theme, :name, :value)");
-					$query->bindValue(':theme', $_theme);
-					$query->bindValue(':name', $c['name']);
-					$query->bindValue(':value', $_POST[$c['name']]);
-					$query->execute() or error(db_error($query));
-				}
-				
-				$query = prepare("INSERT INTO `theme_settings` VALUES(:theme, NULL, NULL)");
-				$query->bindValue(':theme', $_theme);
-				$query->execute() or error(db_error($query));
-				
-				$result = true;
-				$body = '';
-				if(isset($theme['install_callback'])) {
-					$ret = $theme['install_callback'](themeSettings($_theme));
-					if($ret && !empty($ret)) {
-						if(is_array($ret) && count($ret) == 2) {
-							$result = $ret[0];
-							$ret = $ret[1];
-						}
-						$body .= '<div style="border:1px dashed maroon;padding:20px;margin:auto;max-width:800px">' . $ret . '</div>';
-					}
-				}
-				
-				if($result) {
-					$body .= '<p style="text-align:center">Successfully installed and built theme.</p>';
-				} else {
-					// install failed
-					$query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme");
-					$query->bindValue(':theme', $_theme);
-					$query->execute() or error(db_error($query));
-				}
-				
-				$body .= '<p style="text-align:center"><a href="?/themes">Go back to themes</a>.</p>';
-				
-				// Build themes
-				rebuildThemes('all');
-				
-				echo Element('page.html', array(
-					'config'=>$config,
-					'title'=>($result ? 'Installed "' . utf8tohtml($theme['name']) . '"' : 'Installation failed!'),
-					'body'=>$body,
-					'mod'=>true
-					)
-				);
-			} else {
-				$body = '<form action="" method="post">';
-				
-				if(!isset($theme['config']) || empty($theme['config'])) {
-					$body .= '<p style="text-align:center" class="unimportant">(No configuration required.)</p>';
-				} else {
-					$settings = themeSettings($_theme);
-					
-					$body .= '<table>';
-					foreach($theme['config'] as &$c) {
-						$body .= '<tr><th>' . $c['title'] . '</th><td>';
-						switch($c['type']) {
-							case 'text':
-							default:
-								$body .= '<input type="text" name="' . utf8tohtml($c['name']) . '" ' .
-									(isset($settings[$c['name']]) ?
-										' value="' . utf8tohtml($settings[$c['name']]) . '" '
-									:
-										(isset($c['default']) ?
-											'value="' . utf8tohtml($c['default']) . '" '
-										: '')
-									) .
-									(isset($c['size']) ? 'size="' . (int)$c['size'] . '" ' :'') .
-								'/>';
-						}
-						if(isset($c['comment']))
-							$body .= ' <span class="unimportant">' . $c['comment'] . '</span>';
-						$body .= '</td></tr>';
-					}
-					$body .= '</table>';
-				}
-				
-				$body .= '<p style="text-align:center"><input name="install" type="submit" value="Install theme" /></p></form>';
-				
-				echo Element('page.html', array(
-					'config'=>$config,
-					'title'=>'Installing "' . utf8tohtml($theme['name']) . '"',
-					'body'=>$body,
-					'mod'=>true
-					)
-				);
-			}
-		} else {
-			
-			$themes_in_use = array();
-			$query = query("SELECT `theme` FROM `theme_settings` WHERE `name` IS NULL AND `value` IS NULL") or error(db_error());
-			while($theme = $query->fetch()) {
-				$themes_in_use[$theme['theme']] = true;
-			}
-			
-			// Scan directory for themes
-			$themes = array();
-			while($file = readdir($dir)) {
-				if($file[0] != '.' && is_dir($config['dir']['themes'] . '/' . $file)) {
-					$themes[] = $file;
-				}
-			}
-			closedir($dir);
-			
-			$body = '';
-			if(empty($themes)) {
-				$body = '<p style="text-align:center" class="unimportant">(No themes installed.)</p>';
-			} else {
-				$body .= '<table class="modlog">';
-				foreach($themes as &$_theme) {
-					$theme = loadThemeConfig($_theme);
-					
-					markup($theme['description']);
-					
-					$body .= '<tr>' .
-								'<th class="minimal">' . _('Name') . '</th>' .
-								'<td>' . utf8tohtml($theme['name']) . '</td>' .
-							'</tr>' .
-							'<tr>' .
-								'<th class="minimal">' . _('Version') . '</th>' .
-								'<td>' . utf8tohtml($theme['version']) . '</td>' .
-							'</tr>' .
-							'<tr>' .
-								'<th class="minimal">' . _('Description') . '</th>' .
-								'<td>' . $theme['description'] . '</td>' .
-							'</tr>' .
-							'<tr>' .
-								'<th class="minimal">' . _('Thumbnail') . '</th>' .
-								'<td><img style="float:none;margin:4px' . 
-									(isset($themes_in_use[$_theme]) ?
-										';border:2px solid red;padding:4px'
-									: '') .
-									'" src="' . $config['dir']['themes_uri'] . '/' . $_theme . '/thumb.png" /></td>' .
-							'</tr>' .
-							'<tr>' .
-								'<th class="minimal">' . _('Actions') . '</th>' .
-								'<td><ul style="padding:0 20px">' .
-									'<li><a title="' . _('Use theme') . '" href="?/themes/' . $_theme . '">' .
-										(isset($themes_in_use[$_theme]) ? _('Reconfigure') : _('Install')) .
-									'</a></li>' .
-									(isset($themes_in_use[$_theme]) ?
-										'<li><a href="?/themes/' . $_theme . '/rebuild">' . _('Rebuild') . '</a></li>' .
-										'<li><a href="?/themes/' . $_theme . '/uninstall">' . _('Uninstall') . '</a></li>'
-									:
-										'') .
-								'</ul></td>' .
-							'</tr>' .
-							'<tr style="height:40px"><td colspan="2"><hr/></td></tr>';
-				}
-				$body .= '</table>';
-			}
-			
-			if(!empty($themes_in_use))
-				$body .= '<p style="text-align:center"><a href="?/themes/none">' . _('Uninstall all themes.') . '</a></p>';
-			
-			echo Element('page.html', array(
-				'config'=>$config,
-				'title'=>_('Manage themes'),
-				'body'=>$body,
-				'mod'=>true
-				)
-			);
-		}
-	} elseif(preg_match('/^\/noticeboard\/delete\/(\d+)$/', $query, $match)) {
-		if(!hasPermission($config['mod']['noticeboard_delete'])) error($config['error']['noaccess']);
-		
-		$query = prepare("DELETE FROM `noticeboard` WHERE `id` = :id");
-		$query->bindValue(':id', $match[1], PDO::PARAM_INT);
-		$query->execute() or error(db_error($query));
-		
-		if($config['cache']['enabled'])
-			cache::delete('noticeboard_preview');
-		
-		header('Location: ?/noticeboard', true, $config['redirect_http']);
-	} elseif(preg_match('/^\/noticeboard$/', $query)) {
-		if(!hasPermission($config['mod']['noticeboard'])) error($config['error']['noaccess']);
-		
-		$body = '';
-		
-		if(hasPermission($config['mod']['noticeboard_post']) && isset($_POST['subject']) && isset($_POST['body']) && !empty($_POST['body'])) {
-				$query = prepare("INSERT INTO `noticeboard` VALUES (NULL, :mod, :time, :subject, :body)");
-				$query->bindValue(':mod', $mod['id'], PDO::PARAM_INT);
-				$query->bindvalue(':time', time(), PDO::PARAM_INT);
-				$query->bindValue(':subject', utf8tohtml($_POST['subject']));
-				
-				markup($_POST['body']);
-				$query->bindValue(':body', $_POST['body']);
-				$query->execute() or error(db_error($query));
-				
-				if($config['cache']['enabled'])
-					cache::delete('noticeboard_preview');
-				
-				header('Location: ?/noticeboard#' . $pdo->lastInsertId(), true, $config['redirect_http']);
-		} else {
-			
-			if(hasPermission($config['mod']['noticeboard_post'])) {
-				$body .= '<fieldset><legend>New post</legend><form style="display:inline" action="" method="post"><table>' .
-				'<tr>' .
-					'<th><label for="subject">' . _('Name') . '</label></th>' .
-					'<td>' . $mod['username'] . '</td>' .
-				'</tr><tr>' .
-					'<th>' . _('Subject') . '</th>' .
-					'<td><input type="text" size="55" name="subject" id="subject" /></td>' .
-				'</tr><tr>' .
-					'<th>' . _('Body') . '</th>' .
-					'<td><textarea name="body" style="width:100%;height:100px"></textarea></td>' .
-				'</tr><tr>' .
-					'<td></td><td><input type="submit" value="' . _('Post to noticeboard') . '" /></td>' .
-				'</tr></table>' .
-				'</form></fieldset>';
-			}
-			
-			$query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit");
-			$query->bindValue(':limit', $config['mod']['noticeboard_display'], PDO::PARAM_INT);
-			$query->execute() or error(db_error($query));
-			while($notice = $query->fetch()) {
-				$body .= '<div class="ban">' .
-					(hasPermission($config['mod']['noticeboard_delete']) ?
-						'<span style="float:right;padding:2px"><a class="unimportant" href="?/noticeboard/delete/' . $notice['id'] . '">[delete]</a></span>'
-					: '') .
-				'<h2 id="' . $notice['id'] . '">' .
-					($notice['subject'] ?
-						$notice['subject']
-					:
-						'<em>' . _('no subject') . '</em>'
-					) .
-				'<span class="unimportant"> &mdash; by ' .
-					(isset($notice['username']) ?
-						utf8tohtml($notice['username'])
-					:
-						'<em>???</em>'
-					) .
-				' at ' .
-					strftime($config['post_date'], $notice['time']) .
-				'</span></h2><p>' . $notice['body'] . '</p></div>';
-			}
-		
-		
-			echo Element('page.html', array(
-				'config'=>$config,
-				'title'=>_('Noticeboard'),
-				'body'=>$body,
-				'mod'=>true
-				)
-			);
-		}
-	} elseif(preg_match('/^\/news\/delete\/(\d+)$/', $query, $match)) {
-		if(!hasPermission($config['mod']['noticeboard_delete'])) error($config['error']['noaccess']);
-		
-		$query = prepare("DELETE FROM `news` WHERE `id` = :id");
-		$query->bindValue(':id', $match[1], PDO::PARAM_INT);
-		$query->execute() or error(db_error($query));
-		
-		rebuildThemes('news');
-		
-		header('Location: ?/news', true, $config['redirect_http']);
-	} elseif(preg_match('/^\/news$/', $query)) {			
-		$body = '';
-		
-		if(hasPermission($config['mod']['news'])) {
-			if(isset($_POST['subject']) && isset($_POST['body']) && !empty($_POST['body'])) {
-				$query = prepare("INSERT INTO `news` VALUES (NULL, :name, :time, :subject, :body)");
-				
-				if(isset($_POST['name']) && hasPermission($config['mod']['news_custom']))
-					$name = &$_POST['name'];
-				else
-					$name = &$mod['username'];
-				
-				$query->bindValue(':name', utf8tohtml($name), PDO::PARAM_INT);
-				$query->bindvalue(':time', time(), PDO::PARAM_INT);
-				$query->bindValue(':subject', utf8tohtml($_POST['subject']));
-				
-				markup($_POST['body']);
-				$query->bindValue(':body', $_POST['body']);
-				$query->execute() or error(db_error($query));
-				
-				rebuildThemes('news');
-			}
-			
-			$body .= '<fieldset><legend>New post</legend><form style="display:inline" action="" method="post"><table>' .
-			'<tr>' .
-				'<th>' . _('Name') . '</th>' .
-				(hasPermission($config['mod']['news_custom']) ?
-					'<td><input type="text" size="55" name="name" id="name" value="' . utf8tohtml($mod['username']) . '" /></td>'
-				:
-					'<td>' . $mod['username'] . '</td>') .
-			'</tr><tr>' .
-				'<th>' . _('Subject') . '</th>' .
-				'<td><input type="text" size="55" name="subject" id="subject" /></td>' .
-			'</tr><tr>' .
-				'<th>' . _('Body') . '</th>' .
-				'<td><textarea name="body" style="width:100%;height:100px"></textarea></td>' .
-			'</tr><tr>' .
-				'<td></td><td><input type="submit" value="' . _('Post to news') . '" /></td>' .
-			'</tr></table>' .
-			'</form></fieldset>';
-		}
-		
-		$query = prepare("SELECT * FROM `news` ORDER BY `id` DESC LIMIT :limit");
-		$query->bindValue(':limit', $config['mod']['noticeboard_display'], PDO::PARAM_INT);
-		$query->execute() or error(db_error($query));
-		while($news = $query->fetch()) {			
-			$body .= '<div class="ban">' .
-				(hasPermission($config['mod']['news_delete']) ?
-					'<span style="float:right;padding:2px"><a class="unimportant" href="?/news/delete/' . $news['id'] . '">[delete]</a></span>'
-				: '') .
-			'<h2 id="' . $news['id'] . '">' .
-				($news['subject'] ?
-					$news['subject']
-				:
-					'<em>' . _('no subject') . '</em>'
-				) .
-			'<span class="unimportant"> &mdash; by ' .
-				$news['name'] .
-			' at ' .
-				strftime($config['post_date'], $news['time']) .
-			'</span></h2><p>' . $news['body'] . '</p></div>';
-		}
-		
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>_('News'),
-			'body'=>$body,
-			'mod'=>true
-			)
-		);
-	} elseif(preg_match('/^\/inbox\/readall$/', $query, $match)) {
-		$query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `to` = :id");
-		$query->bindValue(':id', $mod['id'], PDO::PARAM_INT);
-		$query->execute() or error(db_error($query));
-		
-		modLog('Marked all PMs as read');
-		
-		header('Location: ?/inbox', true, $config['redirect_http']);
-	} elseif(preg_match('/^\/inbox$/', $query, $match)) {
-		$query = prepare("SELECT `unread`,`pms`.`id`, `time`, `sender`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `to` = :mod ORDER BY `unread` DESC, `time` DESC");
-		$query->bindValue(':mod', $mod['id'], PDO::PARAM_INT);
-		$query->execute() or error(db_error($query));
-		
-		if($query->rowCount() == 0) {
-			$body = '<p style="text-align:center" class="unimportant">(' . _('No private messages for you.') . ')</p>';
-		} else {
-			$unread_pms = 0;
-			
-			$body = '<table class="modlog"><tr><th>ID</th><th>From</th><th>Date</th><th>Message snippet</th></tr>';
-			while($pm = $query->fetch()) {
-				$body .= '<tr' . ($pm['unread'] ? ' style="font-weight:bold"' : '') . '>' . 
-						'<td class="minimal"><a href="?/PM/' . $pm['id'] . '">' . $pm['id'] . '</a></td>' .
-						'<td class="minimal">' .
-							($pm['username'] ?
-								'<a href="?/new_PM/' . $pm['sender'] . '">' . $pm['username'] . '</a>'
-							: '<em>deleted?</em>') .
-						'</td>' .
-						'<td class="minimal">' . strftime($config['post_date'], $pm['time']) . '</td>' .
-						'<td><a href="?/PM/' . $pm['id'] . '">' . pm_snippet($pm['message']) . '</a></td>' .
-					'</tr>';
-				
-				if($pm['unread'])
-					$unread_pms++;
-			}
-			$body .= '</table>';
-			
-			if($unread_pms) {
-				$body = '<p style="text-align:center" class="unimportant">(<a href="?/inbox/readall">Mark all as read</a>)</p>' . $body;
-			}
-		}
-		
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>_('PM Inbox') . ' (' . ($query->rowCount() == 0 ? _('empty') : $unread_pms . ' ' . _('unread')) . ')',
-			'body'=>$body,
-			'mod'=>true
-			)
-		);
-	} elseif(preg_match('/^\/PM\/(\d+)$/', $query, $match)) {
-		$id = &$match[1];
-		
-		if(hasPermission($config['mod']['master_pm'])) {
-			$query = prepare("SELECT `pms`.`id`, `time`, `sender`, `unread`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `pms`.`id` = :id");
-		} else {
-			$query = prepare("SELECT `pms`.`id`, `time`, `sender`, `unread`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `pms`.`id` = :id AND `to` = :mod");
-			$query->bindValue(':mod', $mod['id'], PDO::PARAM_INT);
-		}
-		
-		$query->bindValue(':id', $id, PDO::PARAM_INT);
-		$query->execute() or error(db_error($query));
-		
-		if(!$pm = $query->fetch()) {
-			// Mod doesn't exist
-			error($config['error']['404']);
-		}
-		
-		if(isset($_POST['delete'])) {
-			$query = prepare("DELETE FROM `pms` WHERE `id` = :id");
-			$query->bindValue(':id', $id, PDO::PARAM_INT);
-			$query->execute() or error(db_error($query));
-			
-			modLog('Deleted a PM');
-			
-			header('Location: ?/inbox', true, $config['redirect_http']);
-		} else {
-			if($pm['unread']) {
-				$query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `id` = :id");
-				$query->bindValue(':id', $id, PDO::PARAM_INT);
-				$query->execute() or error(db_error($query));
-				
-				modLog('Read a PM');
-			}
-			
-			if($pm['to'] != $mod['id']) {
-				$query = prepare("SELECT `username` FROM `mods` WHERE `id` = :id");
-				$query->bindValue(':id', $pm['to'], PDO::PARAM_INT);
-				$query->execute() or error(db_error($query));
-				
-				if($_mod = $query->fetch()) {
-					$__to = &$_mod['username'];
-				} else {
-					$__to = false;
-				}
-			}
-			
-			$body = '<form action="" method="post" style="margin:0"><table>' . 
-			
-			'<th>From</th><td>' .
-				(!$pm['username'] ?
-					'<em>???</em>'
-				:
-					'<a href="?/new_PM/' . $pm['sender'] . '">' . utf8tohtml($pm['username']) . '</a>'
-				) .
-			'</td></tr>' .
-			
-			(isset($__to) ?
-				'<th>To</th><td>' .
-					($__to === false ?
-						'<em>???</em>'
-					:
-						'<a href="?/new_PM/' . $pm['to'] . '">' . utf8tohtml($__to) . '</a>'
-					) .
-				'</td></tr>'
-			: '') .
-			
-			'<tr><th>Date</th><td> ' . strftime($config['post_date'], $pm['time']) . '</td></tr>' .
-			
-			'<tr><th>Message</th><td> ' . $pm['message'] . '</td></tr>' .
-			
-			'</table>' . 
-			
-			'<p style="text-align:center"><input type="submit" name="delete" value="Delete forever" /></p>' .
-			
-			'</form>' .
-			
-			'<p style="text-align:center"><a href="?/new_PM/' . $pm['sender'] . '/' . $pm['id'] . '">Reply with quote</a></p>';
-			
-			echo Element('page.html', array(
-				'config'=>$config,
-				'title'=>'Private message',
-				'body'=>$body,
-				'mod'=>true
-				)
-			);
-		}
-	} elseif(preg_match('/^\/new_PM\/(\d+)(\/(\d+))?$/', $query, $match)) {
-		if(!hasPermission($config['mod']['create_pm'])) error($config['error']['noaccess']);
-		
-		$to = &$match[1];
-		
-		$query = prepare("SELECT `username`,`id` FROM `mods` WHERE `id` = :id");
-		$query->bindValue(':id', $to, PDO::PARAM_INT);
-		$query->execute() or error(db_error($query));
-		
-		if(!$to = $query->fetch()) {
-			// Mod doesn't exist
-			error($config['error']['404']);
-		}
-		
-		if(isset($_POST['message'])) {
-			// Post message
-			$message = &$_POST['message'];
-			
-			if(empty($message))
-				error($config['error']['tooshort_body']);
-			
-			markup($message);
-			
-			$query = prepare("INSERT INTO `pms` VALUES (NULL, :sender, :to, :message, :time, 1)");
-			$query->bindValue(':sender', $mod['id'], PDO::PARAM_INT);
-			$query->bindValue(':to', $to['id'], PDO::PARAM_INT);
-			$query->bindValue(':message', $message);
-			$query->bindValue(':time', time(), PDO::PARAM_INT);
-			$query->execute() or error(db_error($query));
-			
-			modLog('Sent a PM to ' . $to['username']);
-			
-			echo Element('page.html', array(
-				'config'=>$config,
-				'title'=>'PM sent',
-				'body'=>'<p style="text-align:center">Message sent successfully to ' . utf8tohtml($to['username']) . '.</p>',
-				'mod'=>true
-				)
-			);
-		} else {
-			$value = '';
-			if(isset($match[3])) {
-				$reply = &$match[3];
-				
-				$query = prepare("SELECT `message` FROM `pms` WHERE `sender` = :sender AND `to` = :mod AND `id` = :id");
-				$query->bindValue(':sender', $to['id'], PDO::PARAM_INT);
-				$query->bindValue(':mod', $mod['id'], PDO::PARAM_INT);
-				$query->bindValue(':id', $reply, PDO::PARAM_INT);
-				$query->execute() or error(db_error($query));
-				if($pm = $query->fetch()) {
-					$value = quote($pm['message']);
-				}
-			}
-			
-			
-			$body = '<form action="" method="post">' .
-			
-			'<table>' . 
-			
-			'<tr><th>To</th><td>' .
-				(hasPermission($config['mod']['editusers']) ?
-					'<a href="?/users/' . $to['id'] . '">' . utf8tohtml($to['username']) . '</a>' :
-					utf8tohtml($to['username'])
-				) .
-			'</td>' .
-			
-			'<tr><th>Message</th><td><textarea name="message" rows="10" cols="40">' . $value . '</textarea></td>' .
-			
-			'</table>' .
-			
-			'<p style="text-align:center"><input type="submit" value="Send message" /></p>' .
-			
-			'</form>';
-			
-			echo Element('page.html', array(
-				'config'=>$config,
-				'title'=>'New PM for ' . utf8tohtml($to['username']),
-				'body'=>$body,
-				'mod'=>true
-				)
-			);
-		}
-	} elseif(preg_match('/^\/search$/', $query)) {
-		if(!hasPermission($config['mod']['search'])) error($config['error']['noaccess']);
-		
-		$body = '<div class="ban"><h2>Search</h2><form style="display:inline" action="?/search" method="post">' .
-			'<p><label style="display:inline" for="search">Phrase:</label> ' .
-				'<input id="search" name="search" type="text" size="35" ' .
-					(isset($_POST['search']) ? 'value="' . str_replace('"', '&quot;', utf8tohtml($_POST['search'])) . '" ' : '') .
-				'/>' .
-				'<input type="submit" value="Search" />' .
-			'</p></form>' .
-				'<p><span class="unimportant">(Search is case-insensitive, and based on keywords. To match exact phrases, use "quotes". Use an asterisk (*) for wildcard.)</span></p>' .
-			'</div>';
-		
-		if(isset($_POST['search']) && !empty($_POST['search'])) {
-			$phrase = &$_POST['search'];
-			$_body = '';
-			
-			$filters = array();
-			
-			function search_filters($m) {
-				global $filters;
-				$name = $m[2];
-				$value = isset($m[4]) ? $m[4] : $m[3];
-				
-				if(!in_array($name, array('id', 'thread', 'subject', 'email', 'name', 'trip', 'capcode', 'filename', 'filehash', 'ip'))) {
-					// unknown filter
-					return $m[0];
-				}
-				
-				$filters[$name] = $value;
-				
-				return $m[1];
-			}
-			
-			$phrase = trim(preg_replace_callback('/(^|\s)(\w+):("(.*)?"|[^\s]*)/', 'search_filters', $phrase));
-			
-			// Escape escape character
-			$phrase = str_replace('!', '!!', $phrase);
-			
-			// Remove SQL wildcard
-			$phrase = str_replace('%', '!%', $phrase);
-			
-			// Use asterisk as wildcard to suit convention
-			$phrase = str_replace('*', '%', $phrase);
-			
-			$like = '';
-			$match = array();
-			
-			// Find exact phrases
-			if(preg_match_all('/"(.+?)"/', $phrase, $m)) {
-				foreach($m[1] as &$quote) {
-					$phrase = str_replace("\"{$quote}\"", '', $phrase);
-					$match[] = $pdo->quote($quote);
-				}
-			}
-			
-			$words = explode(' ', $phrase);
-			foreach($words as &$word) {
-				if(empty($word))
-					continue;
-				$match[] = $pdo->quote($word);
-			}
-			
-			$like = '';
-			foreach($match as &$phrase) {
-				if(!empty($like))
-					$like .= ' AND ';
-				$phrase = preg_replace('/^\'(.+)\'$/', '\'%$1%\'', $phrase);
-				$like .= '`body` LIKE ' . $phrase . ' ESCAPE \'!\'';
-			}
-			
-			foreach($filters as $name => $value) {
-				if(!empty($like))
-					$like .= ' AND ';
-				$like .= '`' . $name . '` = '. $pdo->quote($value);
-			}
-			
-			$like = str_replace('%', '%%', $like);
-			
-			$boards = listBoards();
-			foreach($boards as &$_b) {
-				openBoard($_b['uri']);
-				
-				$query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE " . $like . " ORDER BY `time` DESC LIMIT :limit", $board['uri']));
-				$query->bindValue(':limit', $config['mod']['search_results'], PDO::PARAM_INT);
-				$query->execute() or error(db_error($query));
-				
-				$temp = '';
-				while($post = $query->fetch()) {
-					if(!$post['thread']) {
-						$po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false);
-					} else {
-						$po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod);
-					}
-					$temp .= $po->build(true) . '<hr/>';
-				}
-				
-				if(!empty($temp))
-					$_body .= '<fieldset><legend>' . $query->rowCount() . ' result' . ($query->rowCount() != 1 ? 's' : '') . ' on <a href="?/' .
-							sprintf($config['board_path'], $board['uri']) . $config['file_index'] .
-					'">' .
-					sprintf($config['board_abbreviation'], $board['uri']) . ' - ' . $board['title'] .
-					'</a></legend>' . $temp . '</fieldset>';
-			}
-			
-			$body .= '<hr/>';
-			if(!empty($_body))
-				$body .= $_body;
-			else
-				$body .= '<p style="text-align:center" class="unimportant">(No results.)</p>';
-		}
-			
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>'Search',
-			'body'=>$body,
-			'mod'=>true
-			)
-		);
-	} elseif(preg_match('/^\/users$/', $query)) {
-		if(!hasPermission($config['mod']['manageusers'])) error($config['error']['noaccess']);
-		
-		$body = '<form action="" method="post"><table class="modlog" style="width:auto"><tr><th>' . _('ID') . '</th><th>' . _('Username') . '</th><th>' . _('Type') . '</th><th>' . _('Boards') . '</th><th>' . _('Last action') . '</th><th>&hellip;</th></tr>';
-		
-		$query = query("SELECT *, (SELECT `time` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `last`, (SELECT `text` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `action` FROM `mods` ORDER BY `type` DESC,`id`") or error(db_error());
-		while($_mod = $query->fetch()) {				
-			$type = $_mod['type'] == JANITOR ? 'Janitor' : ($_mod['type'] == MOD ? 'Mod' : 'Admin');
-			
-			$_mod['boards'] = explode(',', $_mod['boards']);
-			foreach($_mod['boards'] as &$_board) {
-				if($_board != '*')
-					$_board = '/' . $_board . '/';
-			}
-			
-			$body .= '<tr>' .
-				'<td>' .
-					$_mod['id'] .
-				'</td>' .
-				
-				'<td>' .
-					utf8tohtml($_mod['username']) .
-				'</td>' .
-				
-				'<td>' .
-					$type .
-				'</td>' .
-				
-				'<td>' .
-					implode(', ', $_mod['boards']) .
-				'</td>' .
-				
-				'<td>' .
-					($_mod['last'] ?
-						(hasPermission($config['mod']['modlog']) ?
-							'<span title="' . str_replace('"', '&quot;', utf8tohtml($_mod['action'])) . '">' . ago($_mod['last']) . '</span>'
-						: ago($_mod['last']))
-					: '<em>never</em>') .
-				'</td>' .
-				
-				'<td style="white-space:nowrap">' .
-					(hasPermission($config['mod']['promoteusers']) ?
-						($_mod['type'] != ADMIN ?
-							'<a style="float:left;text-decoration:none" href="?/users/' . $_mod['id'] . '/promote" title="Promote">▲</a>'
-						:'') .
-						($_mod['type'] != JANITOR ?
-							'<a style="float:left;text-decoration:none" href="?/users/' . $_mod['id'] . '/demote" title="Demote">▼</a>'
-						:'')
-					: ''
-					) .
-					(hasPermission($config['mod']['editusers']) ||
-					(hasPermission($config['mod']['change_password']) && $_mod['id'] == $mod['id'])?
-						'<a class="unimportant" style="margin-left:5px;float:right" href="?/users/' . $_mod['id'] . '">[edit]</a>'
-					: '' ) .
-					(hasPermission($config['mod']['create_pm']) ?
-						'<a class="unimportant" style="margin-left:5px;float:right" href="?/new_PM/' . $_mod['id'] . '">[PM]</a>'
-					: '' ) .
-				'</td></tr>';
-		}
-		
-		$body .= '</table>';
-		
-		if(hasPermission($config['mod']['createusers'])) {
-			$body .= '<p style="text-align:center"><a href="?/users/new">' . _('Create new user') . '</a></p>';
-		}
-		
-		$body .= '</form>';
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>_('Manage users'),
-			'body'=>$body
-			,'mod'=>true
-			)
-		);
-	} elseif(preg_match('/^\/users\/new$/', $query)) {
-		if(!hasPermission($config['mod']['createusers'])) error($config['error']['noaccess']);
-		
-		if(isset($_POST['username']) && isset($_POST['password'])) {
-			if(!isset($_POST['type'])) {
-				error(sprintf($config['error']['required'], 'type'));
-			}
-			
-			if($_POST['type'] != ADMIN && $_POST['type'] != MOD && $_POST['type'] != JANITOR) {
-				error(sprintf($config['error']['invalidfield'], 'type'));
-			}
-			
-			// Check if already exists
-			$query = prepare("SELECT `id` FROM `mods` WHERE `username` = :username");
-			$query->bindValue(':username', $_POST['username']);
-			$query->execute() or error(db_error($query));
-			
-			if($_mod = $query->fetch()) {
-				error(sprintf($config['error']['modexists'], $_mod['id']));
-			}
-			
-			$boards = array();
-			foreach($_POST as $name => $null) {
-				if(preg_match('/^board_(.+)$/', $name, $m))
-					$boards[] = $m[1];
-			}
-			$boards = implode(',', $boards);
-			
-			$query = prepare("INSERT INTO `mods` VALUES (NULL, :username, :password, :type, :boards)");
-			$query->bindValue(':username', $_POST['username']);
-			$query->bindValue(':password', sha1($_POST['password']));
-			$query->bindValue(':type', $_POST['type'], PDO::PARAM_INT);
-			$query->bindValue(':boards', $boards);
-			$query->execute() or error(db_error($query));
-			
-			modLog('Create a new user: "' . $_POST['username'] . '"');
-			header('Location: ?/users', true, $config['redirect_http']);
-		} else {
-		
-			$__boards = '<ul style="list-style:none;padding:2px 5px">';			
-			$boards = array_merge(
-					array(array('uri' => '*', 'title' => 'All')
-				), listBoards());
-			foreach($boards as &$_board) {
-				$__boards .= '<li>' .
-					'<input type="checkbox" name="board_' . $_board['uri'] . '" id="board_' . $_board['uri'] . '">' .
-					'<label style="display:inline" for="board_' . $_board['uri'] . '"> ' .
-						($_board['uri'] == '*' ?
-							'<em>"*"</em>'
-						:
-							sprintf($config['board_abbreviation'], $_board['uri'])
-						) .
-						' - ' . $_board['title'] .
-					'</label>' .
-					'</li>';
-			}
-		
-			$body = '<fieldset><legend>New user</legend>' . 
-			
-				// Begin form
-				'<form style="text-align:center" action="" method="post">' .
-			
-				'<table>' .
-			
-				'<tr><th>Username</th><td><input size="20" maxlength="30" type="text" name="username" value="" autocomplete="off" /></td></tr>' .
-				'<tr><th>Password</th><td><input size="20" maxlength="30" type="password" name="password" value="" autocomplete="off" /></td></tr>' .
-				'<tr><th>Type</th><td>' .
-					'<div><label for="janitor">Janitor</label> <input type="radio" id="janitor" name="type" value="' . JANITOR . '" /></div>' .
-					'<div><label for="mod">Mod</label> <input type="radio" id="mod" name="type" value="' . MOD . '" /></div>' .
-					'<div><label for="admin">Admin</label> <input type="radio" id="admin" name="type" value="' . ADMIN . '" /></div>' .
-				'</td></tr>' .
-				'<tr><th>Boards</th><td>' . $__boards . '</td></tr>' .
-				'</table>' .
-			
-				'<input style="margin-top:10px" type="submit" value="Create user" />' .
-			
-				// End form
-				'</form></fieldset>';
-			
-				echo Element('page.html', array(
-					'config'=>$config,
-					'title'=>'New user',
-					'body'=>$body
-					,'mod'=>true
-					)
-				);
-			}
-	} elseif(preg_match('/^\/users\/(\d+)(\/(promote|demote|delete))?$/', $query, $matches)) {
-		$modID = &$matches[1];
-		
-		if(isset($matches[2])) {
-			if($matches[3] == 'delete') {
-				if(!hasPermission($config['mod']['deleteusers'])) error($config['error']['noaccess']);
-				
-				$query = prepare("DELETE FROM `mods` WHERE `id` = :id");
-				$query->bindValue(':id', $modID, PDO::PARAM_INT);
-				$query->execute() or error(db_error($query));
-				
-				modLog('Deleted user #' . $modID);
-			} else {
-				// Promote/demote
-				if(!hasPermission($config['mod']['promoteusers'])) error($config['error']['noaccess']);
-				
-				if($matches[3] == 'promote') {
-					$query = prepare("UPDATE `mods` SET `type` = `type` + 1 WHERE `type` != :admin AND `id` = :id");
-					$query->bindValue(':admin', ADMIN, PDO::PARAM_INT);
-				} else {
-					$query = prepare("UPDATE `mods` SET `type` = `type` - 1 WHERE `type` != :janitor AND `id` = :id");
-					$query->bindValue(':janitor', JANITOR, PDO::PARAM_INT);
-				}
-				
-				$query->bindValue(':id', $modID, PDO::PARAM_INT);
-				$query->execute() or error(db_error($query));
-			}
-			header('Location: ?/users', true, $config['redirect_http']);
-		} else {
-			// Edit user
-			if(!hasPermission($config['mod']['editusers']) && !hasPermission($config['mod']['change_password']))
-				error($config['error']['noaccess']);
-			
-			$query = prepare("SELECT * FROM `mods` WHERE `id` = :id");
-			$query->bindValue(':id', $modID, PDO::PARAM_INT);
-			$query->execute() or error(db_error($query));
-			
-			if(!$_mod = $query->fetch()) {
-				error($config['error']['404']);
-			}
-			
-			if(!hasPermission($config['mod']['editusers']) && !(hasPermission($config['mod']['change_password']) && $mod['id'] == $_mod['id'] && $change_password_only = true))
-				error($config['error']['noaccess']);
-			
-			if((isset($_POST['username']) && isset($_POST['password'])) || (isset($change_password_only) && isset($_POST['password']))) {
-				if(!isset($change_password_only)) {
-					$boards = array();
-					foreach($_POST as $name => $null) {
-						if(preg_match('/^board_(.+)$/', $name, $m))
-							$boards[] = $m[1];
-					}
-					$boards = implode(',', $boards);
-					
-					$query = prepare("UPDATE `mods` SET `username` = :username, `boards` = :boards WHERE `id` = :id");
-					$query->bindValue(':username', $_POST['username'], PDO::PARAM_STR);
-					$query->bindValue(':boards', $boards, PDO::PARAM_STR);
-					$query->bindValue(':id', $modID, PDO::PARAM_INT);
-					$query->execute() or error(db_error($query));
-					modLog('Edited login details for user "' . $_mod['username'] . '"');
-				} else {
-					modLog('Changed own password');
-				}
-				if(!empty($_POST['password'])) {
-					$query = prepare("UPDATE `mods` SET `password` = :password WHERE `id` = :id");
-					$query->bindValue(':password', sha1($_POST['password']));
-					$query->bindValue(':id', $modID, PDO::PARAM_INT);
-					$query->execute() or error(db_error($query));
-				}
-				
-				// Refresh
-				$query = prepare("SELECT * FROM `mods` WHERE `id` = :id");
-				$query->bindValue(':id', $modID, PDO::PARAM_INT);
-				$query->execute() or error(db_error($query));
-				
-				if(!$_mod = $query->fetch()) {
-					error($config['error']['404']);
-				}
-				
-				if($_mod['id'] == $mod['id']) {
-					// Changed own password. Update cookies
-					
-					if(!login($_mod['username'], $_mod['password'], false, true))
-						error(_('Could not re-login after changing password. (?)'));
-					
-					setCookies();
-				}
-				
-				if(hasPermission($config['mod']['manageusers']))
-					header('Location: ?/users', true, $config['redirect_http']);
-				else
-					header('Location: ?/', true, $config['redirect_http']);
-				exit;
-			}
-			
-			$__boards = '<ul style="list-style:none;padding:2px 5px">';
-			$boards = array_merge(
-					array(array('uri' => '*', 'title' => 'All')
-				), listBoards());
-			
-			$_mod['boards'] = explode(',', $_mod['boards']);
-			foreach($boards as &$_board) {
-				$__boards .= '<li>' .
-					'<input type="checkbox" name="board_' . $_board['uri'] . '" id="board_' . $_board['uri'] . '"' .
-						(in_array($_board['uri'], $_mod['boards']) ? 
-							' checked="checked"'
-						: '') .
-					'/> ' . 
-					'<label style="display:inline" for="board_' . $_board['uri'] . '">' .
-						($_board['uri'] == '*' ?
-							'<em>"*"</em>'
-						:
-							sprintf($config['board_abbreviation'], $_board['uri'])
-						) .
-						' - ' . $_board['title'] .
-					'</label>' .
-					'</li>';
-			}
-			$__boards .= '</ul>';
-			
-			$body = '<fieldset><legend>Edit user</legend>' . 
-			
-			// Begin form
-			'<form style="text-align:center" action="" method="post">' .
-			
-			'<table>' .
-			
-			'<tr><th>Username</th><td>' . 
-			
-			(isset($change_password_only) ?
-				utf8tohtml($_mod['username'])
-			: '<input size="20" maxlength="30" type="text" name="username" value="' . utf8tohtml($_mod['username']) . '" autocomplete="off" />') .
-			
-			'</td></tr>' .
-			'<tr><th>Password <span class="unimportant">(new; optional)</span></th><td><input size="20" maxlength="30" type="password" name="password" value="" autocomplete="off" /></td></tr>' .
-			
-			(isset($change_password_only) ? '' :
-				'<tr><th>Boards</th><td>' . $__boards . '</td></tr>'
-			) .
-			
-			'</table>' .
-			
-			'<input type="submit" value="Save changes" />' .
-			
-			// End form
-			'</form> ' .
-			
-			// Delete button
-			(hasPermission($config['mod']['deleteusers']) ?
-				'<p style="text-align:center"><a href="?/users/' . $_mod['id'] . '/delete">Delete user</a></p>'
-			:'') .
-			
-			'</fieldset>';
-			
-			echo Element('page.html', array(
-				'config'=>$config,
-				'title'=>'Edit user',
-				'body'=>$body
-				,'mod'=>true
-				)
-			);
-		}
-	} elseif(preg_match('/^\/reports$/', $query)) {
-		if(!hasPermission($config['mod']['reports'])) error($config['error']['noaccess']);
-		
-		$body = '';
-		$reports = 0;
-		
-		$query = prepare("SELECT * FROM `reports` ORDER BY `time` DESC LIMIT :limit");
-		$query->bindValue(':limit', $config['mod']['recent_reports'], PDO::PARAM_INT);
-		$query->execute() or error(db_error($query));
-		
-		while($report = $query->fetch()) {
-			$p_query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `id` = :id", $report['board']));
-			$p_query->bindValue(':id', $report['post'], PDO::PARAM_INT);
-			$p_query->execute() or error(db_error($p_query));
-			
-			if(!$post = $p_query->fetch()) {
-				// Invalid report (post has since been deleted)
-				$p_query = prepare("DELETE FROM `reports` WHERE `post` = :id AND `board` = :board");
-				$p_query->bindValue(':id', $report['post'], PDO::PARAM_INT);
-				$p_query->bindValue(':board', $report['board']);
-				$p_query->execute() or error(db_error($p_query));
-				continue;
-			}
-			
-			$reports++;
-			openBoard($report['board']);
-			
-			if(!$post['thread']) {
-				$po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false);
-			} else {
-				$po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['embed'], '?/', $mod);
-			}
-			
-			$append_html =
-				'<div class="report">' .
-					'<hr/>' .
-					'Board: <a href="?/' . $report['board'] . '/' . $config['file_index'] . '">' . sprintf($config['board_abbreviation'], $report['board']) . '</a><br/>' .
-					'Reason: ' . $report['reason'] . '<br/>' .
-					'Report date: ' . strftime($config['post_date'], $report['time']) . '<br/>' .
-					(hasPermission($config['mod']['show_ip']) ?
-						'Reported by: <a href="?/IP/' . $report['ip'] . '">' . $report['ip'] . '</a><br/>'
-					: '') .
-					'<hr/>' .
-						(hasPermission($config['mod']['report_dismiss']) ?
-							'<a title="Discard abuse report" href="?/reports/' . $report['id'] . '/dismiss">Dismiss</a> | ' : '') .
-						(hasPermission($config['mod']['report_dismiss_ip']) ?
-							'<a title="Discard all abuse reports by this user" href="?/reports/' . $report['id'] . '/dismiss/all">Dismiss+</a>' : '') .
-				'</div>';
-			
-			// Bug fix for https://github.com/savetheinternet/Tinyboard/issues/21
-			$po->body = truncate($po->body, $po->link(), $config['body_truncate'] - substr_count($append_html, '<br/>'));
-			
-			if(mb_strlen($po->body) + mb_strlen($append_html) > $config['body_truncate_char']) {
-				// still too long. temporarily increase limit in the config
-				$__old_body_truncate_char = $config['body_truncate_char'];
-				$config['body_truncate_char'] = mb_strlen($po->body) + mb_strlen($append_html);
-			}
-			
-			$po->body .= $append_html;
-			
-			$body .= $po->build(true) . '<hr/>';
-			
-			if(isset($__old_body_truncate_char))
-				$config['body_truncate_char'] = $__old_body_truncate_char;
-		}
-		
-		$query = query("SELECT COUNT(`id`) AS `count` FROM `reports`") or error(db_error());
-		$count = $query->fetch();
-		
-		$body .= '<p class="unimportant" style="text-align:center">Showing ' . 
-			($reports == $count['count'] ? 'all ' . $reports . ' reports' : $reports . ' of ' . $count['count'] . ' reports') . '.</p>';
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>_('Report queue') . ' (' . $count['count'] . ')',
-			'body'=>$body,
-			'mod'=>true
-		));
-	} elseif(preg_match('/^\/reports\/(\d+)\/dismiss(\/all)?$/', $query, $matches)) {
-		if(isset($matches[2]) && $matches[2] == '/all') {
-			if(!hasPermission($config['mod']['report_dismiss_ip'])) error($config['error']['noaccess']);
-			
-			$query = prepare("SELECT `ip` FROM `reports` WHERE `id` = :id");
-			$query->bindValue(':id', $matches[1], PDO::PARAM_INT);
-			$query->execute() or error(db_error($query));
-			
-			if($report = $query->fetch()) {
-				$query = prepare("DELETE FROM `reports` WHERE `ip` = :ip");
-				$query->bindValue(':ip', $report['ip'], PDO::PARAM_INT);
-				$query->execute() or error(db_error($query));
-				
-				modLog('Dismissed all reports by ' . $report['ip']);
-			}
-		} else {
-			if(!hasPermission($config['mod']['report_dismiss'])) error($config['error']['noaccess']);
-			
-			$query = prepare("SELECT `post`, `board` FROM `reports` WHERE `id` = :id");
-			$query->bindValue(':id', $matches[1], PDO::PARAM_INT);
-			$query->execute() or error(db_error($query));
-			
-			if($report = $query->fetch()) {
-				modLog('Dismissed a report for post #' . $report['post'], $report['board']);
-				
-				$query = prepare("DELETE FROM `reports` WHERE `post` = :post AND `board` = :board");
-				$query->bindValue(':board', $report['board'], PDO::PARAM_INT);
-				$query->bindValue(':post', $report['post'], PDO::PARAM_INT);
-				$query->execute() or error(db_error($query));
-			}
-		}
-		
-		// Redirect
-		header('Location: ?/reports', true, $config['redirect_http']);
-	} elseif(preg_match('/^\/(\w+)\/edit(\/delete)?$/', $query, $matches)) {
-		if(!hasPermission($config['mod']['manageboards'])) error($config['error']['noaccess']);
-		
-		if(!openBoard($matches[1]))
-			error($config['error']['noboard']);
-		
-		if(isset($matches[2]) && $matches[2] == '/delete') {
-			if(!hasPermission($config['mod']['deleteboard'])) error($config['error']['noaccess']);
-			// Delete board
-			
-			modLog('Deleted board ' . sprintf($config['board_abbreviation'], $board['uri']));
-			
-			// Delete entire board directory
-			rrmdir($board['uri'] . '/');
-			
-			// Delete posting table
-			$query = query(sprintf("DROP TABLE IF EXISTS `posts_%s`", $board['uri'])) or error(db_error());
-			
-			// Clear reports
-			$query = prepare("DELETE FROM `reports` WHERE `board` = :id");
-			$query->bindValue(':id', $board['uri'], PDO::PARAM_INT);
-			$query->execute() or error(db_error($query));
-			
-			// Delete from table
-			$query = prepare("DELETE FROM `boards` WHERE `uri` = :uri");
-			$query->bindValue(':uri', $board['uri'], PDO::PARAM_INT);
-			$query->execute() or error(db_error($query));
-			
-			if($config['cache']['enabled']) {
-				cache::delete('board_' . $board['uri']);
-				cache::delete('all_boards');
-			}
-			
-			$query = prepare("SELECT `board`, `post` FROM `cites` WHERE `target_board` = :board");
-			$query->bindValue(':board', $board['uri']);
-			$query->execute() or error(db_error($query));
-			while($cite = $query->fetch()) {
-				if($board['uri'] != $cite['board']) {
-					if(!isset($tmp_board))
-						$tmp_board = $board;
-					openBoard($cite['board']);
-					rebuildPost($cite['post']);
-				}
-			}
-			
-			if(isset($tmp_board))
-				$board = $tmp_board;
-			
-			$query = prepare("DELETE FROM `cites` WHERE `board` = :board OR `target_board` = :board");
-			$query->bindValue(':board', $board['uri']);
-			$query->execute() or error(db_error($query));
-			
-			$query = prepare("DELETE FROM `antispam` WHERE `board` = :board");
-			$query->bindValue(':board', $board['uri']);
-			$query->execute() or error(db_error($query));
-			
-			$_board = $board;
-			
-			rebuildThemes('boards');
-			
-			$board = $_board;
-			
-			header('Location: ?/', true, $config['redirect_http']);
-		} else {
-			if(isset($_POST['title']) && isset($_POST['subtitle'])) {
-				$query = prepare("UPDATE `boards` SET `title` = :title, `subtitle` = :subtitle WHERE `uri` = :uri");
-				$query->bindValue(':title', utf8tohtml($_POST['title'], true));
-				
-				if(!empty($_POST['subtitle']))
-					$query->bindValue(':subtitle', utf8tohtml($_POST['subtitle'], true));
-				else
-					$query->bindValue(':subtitle', null, PDO::PARAM_NULL);
-				
-				$query->bindValue(':uri', $board['uri']);
-				$query->execute() or error(db_error($query));
-				
-				if($config['cache']['enabled']) {
-					cache::delete('board_' . $board['uri']);
-					cache::delete('all_boards');
-				}
-				
-				$_board = $board;
-				
-				rebuildThemes('boards');
-				
-				$board = $_board;
-				
-				openBoard($board['uri']);
-			}
-			
-			$body =
-			'<fieldset><legend><a href="?/' .
-			$board['uri'] .	'/' . $config['file_index'] . '">' .
-			sprintf($config['board_abbreviation'], $board['uri']) . '</a>' . 
-			' - ' . $board['name'] . '</legend>' . 
-			
-			// Begin form
-			'<form style="text-align:center" action="" method="post">' .
-			
-			'<table>' .
-			
-			'<tr><th>URI</th><td>' . $board['uri'] . '</td>' .
-			'<tr><th>Title</th><td><input size="20" type="text" name="title" value="' . $board['name'] . '" /></td></tr>' .
-			'<tr><th>Subtitle</th><td><input size="20" type="text" name="subtitle" value="' .
-				(isset($board['title']) ? $board['title'] : '') . '" /></td></tr>' .
-			
-			'</table>' .
-			
-			'<input type="submit" value="Update" />' .
-			
-			// End form
-			'</form> ' .
-			
-			// Delete button
-			(hasPermission($config['mod']['deleteboard']) ?
-				'<p style="text-align:center"><a href="?/' . $board['uri'] . '/edit/delete">Delete board</a></p>'
-			:'') .
-			
-			'</fieldset>';
-			
-			echo Element('page.html', array(
-				'config'=>$config,
-				'title'=>'Manage &ndash; ' . sprintf($config['board_abbreviation'], $board['uri']),
-				'body'=>$body,
-				'mod'=>true
-			));
-		}
-	} elseif(preg_match('/^\/bans$/', $query)) {
-		if(!hasPermission($config['mod']['view_banlist'])) error($config['error']['noaccess']);
-		
-		if(isset($_POST['unban'])) {
-			if(!hasPermission($config['mod']['unban'])) error($config['error']['noaccess']);
-			
-			foreach($_POST as $post => $value) {
-				if(preg_match('/^ban_(\d+)$/', $post, $m)) {
-					removeBan($m[1]);
-				}
-			}
-		}
-		if(hasPermission($config['mod']['view_banexpired'])) {
-			$query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY (`expires` IS NOT NULL AND `expires` < :time), `set` DESC");
-			$query->bindValue(':time', time(), PDO::PARAM_INT);
-			$query->execute() or error(db_error($query));
-		} else {
-			// Filter out expired bans
-			$query = prepare("SELECT `bans`.*, `username` FROM `bans` INNER JOIN `mods` ON `mod` = `mods`.`id` WHERE `expires` = 0 OR `expires` > :time ORDER BY `set` DESC");
-			$query->bindValue(':time', time(), PDO::PARAM_INT);
-			$query->execute() or error(db_error($query));
-		}
-		
-		if($query->rowCount() < 1) {
-			$body = '<p style="text-align:center" class="unimportant">(There are no active bans.)</p>';
-		} else {
-			$body = '<form action="" method="post">';
-			$body .= '<table><tr><th>' . _('IP address') . '</th><th>' . _('Reason') . '</th><th>' . _('Board') . '</th><th>' . _('Set') . '</th><th>' . _('Expires') . '</th><th>' . _('Staff') . '</th></tr>';
-			
-			while($ban = $query->fetch()) {
-				$body .=
-					'<tr' .
-						($config['mod']['view_banexpired'] && $ban['expires'] != 0 && $ban['expires'] < time() ?
-							' style="text-decoration:line-through"'
-						:'') .
-					'>' .
-				
-				'<td style="white-space: nowrap">' .
-				
-				// Checkbox
-				'<input type="checkbox" name="ban_' . $ban['id'] . '" id="ban_' . $ban['id'] . '" /> ' .
-				
-				// IP address
-				(preg_match('/^(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')$/', $ban['ip']) ?
-					'<a href="?/IP/' .
-						$ban['ip'] .
-					'">'. $ban['ip'] . '</a>'
-				: utf8tohtml($ban['ip'])) .
-				
-				'</td>' .
-				
-				// Reason
-				'<td>' . ($ban['reason'] ? $ban['reason'] : '<em>-</em>') . '</td>' .
-				
-				
-				'<td style="white-space: nowrap">' .
-				(isset($ban['board']) ?
-					sprintf($config['board_abbreviation'], $ban['board'])
-				:
-					'<em>' . _('all boards') . '</em>'
-				) . '</td>' .
-				
-				// Set
-				'<td style="white-space: nowrap">' . strftime($config['post_date'], $ban['set']) . '</td>' .
-				
-				// Expires
-				'<td style="white-space: nowrap">' . 
-					($ban['expires'] == 0 ?
-						'<em>Never</em>'
-					:
-						strftime($config['post_date'], $ban['expires'])
-					) .
-				'</td>' .
-				
-				// Staff
-				'<td>' .
-					(isset($ban['username']) ?
-						(!hasPermission($config['mod']['view_banstaff']) ?
-							($config['mod']['view_banquestionmark'] ?
-								'?'
-							:
-								($ban['type'] == JANITOR ? 'Janitor' :
-								($ban['type'] == MOD ? 'Mod' :
-								($ban['type'] == ADMIN ? 'Admin' :
-								'?')))
-							)
-						:
-							utf8tohtml($ban['username'])
-						)
-					:
-						'<em>deleted?</em>'
-					) .
-				'</td>' .
-				
-				'</tr>';
-			}
-			
-			$body .= '</table>' .
-			
-			(hasPermission($config['mod']['unban']) ?
-				'<p style="text-align:center"><input name="unban" type="submit" value="Unban selected" /></p>'
-			: '') .
-			
-			'</form>';
-		}
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>_('Ban list'),
-			'body'=>$body,
-			'mod'=>true
-		)
-	);
-	} elseif(preg_match('/^\/flush$/', $query)) {
-		if(!hasPermission($config['mod']['rebuild'])) error($config['error']['noaccess']);
-		if(!$config['cache']['enabled']) error(_('Cache is not enabled.'));
-		
-		if(cache::flush()) {
-			$body = 'Successfully invalidated all items in cache.';
-			modLog('Cleared cache');
-		} else {
-			$body = 'An error occured while trying to flush cache.';
-		}
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>'Flushed',
-			'body'=>'<p style="text-align:center">' . $body . '</p>',
-			'mod'=>true
-		));
-	} elseif(preg_match('/^\/rebuild$/', $query)) {
-		if(!hasPermission($config['mod']['rebuild'])) error($config['error']['noaccess']);
-		
-		set_time_limit($config['mod']['rebuild_timelimit']);
-		
-		$body = '<div class="ban"><h2>Rebuilding&hellip;</h2><p>';
-		
-		$body .= 'Clearing template cache&hellip;<br/>';
-		
-		load_twig();
-		$twig->clearCacheFiles();
+	'/noticeboard'				=> 'noticeboard',	// view noticeboard
+	'/noticeboard/(\d+)'			=> 'noticeboard',	// view noticeboard
+	'/noticeboard/delete/(\d+)'		=> 'noticeboard_delete',// delete from noticeboard
+	'/log'					=> 'log',		// modlog
+	'/log/(\d+)'				=> 'log',		// modlog
+	'/news'					=> 'news',		// view news
+	'/news/(\d+)'				=> 'news',		// view news
+	'/news/delete/(\d+)'			=> 'news_delete',	// delete from news
 	
-		$body .= 'Regenerating theme files&hellip;<br/>';
-		rebuildThemes('all');
-		
-		$body .= 'Generating Javascript file&hellip;<br/>';
-		buildJavascript();
-		
-		$main_js = $config['file_script'];
-		
-		$boards = listBoards();
-		
-		foreach($boards as &$board) {
-			$body .= "<strong style=\"display:inline-block;margin: 15px 0 2px 0;\">Opening board /{$board['uri']}/</strong><br/>";
-			openBoard($board['uri']);
-			
-			$body .= 'Creating index pages<br/>';
-			buildIndex();
-			
-			if($config['file_script'] != $main_js) {
-				// different javascript file
-				$body .= 'Generating Javascript file&hellip;<br/>';
-				buildJavascript();
-			}
-			
-			$query = query(sprintf("SELECT `id` FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error());
-			while($post = $query->fetch()) {
-				$body .= "Rebuilding #{$post['id']}<br/>";
-				buildThread($post['id']);
-			}
-		}
-		$body .= 'Complete!</p></div>';
-		
-		unset($board);
-		modLog('Rebuilt everything');
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>'Rebuilt',
-			'body'=>$body,
-			'mod'=>true
-		));
-	} elseif(preg_match('/^\/config\/edit$/', $query)) {
-		if(!hasPermission($config['mod']['edit_config']))
-			error($config['error']['noaccess']);
-		
-		// TODO: display "unset variables"
-		// $config_file = file_get_contents('inc/config.php');
-		// preg_match_all('/\$config\[\'(\w+)\']/', $config_file, $matches);
-		// $config_variables = array_unique($matches[1]);
-		
-		$body = '<fieldset><legend>' . _('Configuration') . '</legend><form action="" method="post"><table style="width:100%">';
-		
-		$var_force_string = array('blotter');
-		$var_system = array('version');
-		
-		if(isset($_POST['save_changes'])) {
-			$config_append = '';
-			
-			foreach($config as $name => $original_value) {
-				if(in_array($name, $var_system))
-					continue;
-				$type = gettype($original_value);
-				if($type == 'array' || $type == 'NULL')
-					continue;
-				
-				if($type == 'boolean' && in_array($name, $var_force_string))
-					$type = 'string';
-				
-				if(!isset($_POST[$name]) && $type != 'boolean')
-					continue;
-				
-				if($type == 'boolean')
-					$value = isset($_POST[$name]);
-				else
-					$value = $_POST[$name];
-				
-				if($value != $original_value) {
-					// value has been changed
-					$config_append .= "\$config['" . addslashes($name) . "'] = ";
-					if($type == 'boolean')
-						$config_append .= $value ? 'true' : 'false';
-					elseif($type == 'integer')
-						$config_append .= (int)$value;
-					elseif($type == 'string')
-						$config_append .= '\'' . addslashes($value) . '\'';
-					$config_append .= ";\n";
-				}
-			}
-			
-			if(!empty($config_append)) {
-				$config_append = "\n// Changes made via web editor by \"" . $mod['username'] . "\" @ " . date('r') . ":\n" . $config_append . "\n";
-				if(@file_put_contents('inc/instance-config.php', $config_append, FILE_APPEND)) {
-					header('Location: ?/config' . $b['uri'], true, $config['redirect_http']);
-					exit;
-				} else {
-					$config_append = htmlentities($config_append);
-					
-					if($config['minify_html'])
-						$config_append = str_replace("\n", '&#010;', $config_append);
-					$page = array();
-					$page['title'] = 'Cannot write to file!';
-					$page['config'] = $config;
-					$page['body'] = '
-						<p>Tinyboard could not write to <strong>inc/instance-config.php</strong> with the ammended configuration, probably due to a permissions error.</p>
-						<p>You may proceed with these changes manually by copying and pasting the following code to the bottom of <strong>inc/instance-config.php</strong>:</p>
-						<textarea style="width:700px;height:370px;margin:auto;display:block;background:white;color:black" readonly>' . $config_append . '</textarea>
-					';
-					echo Element('page.html', $page);
-					exit;
-				}
-			}
-		}
-		
-		foreach($config as $name => $value) {
-			$body .= '<tr>';
-			
-			$body .= '<th style="text-align:left" class="minimal">' . utf8tohtml($name) . '</th>';
-			$type = gettype($value);
-			if($type == 'array') {
-				$body .= '<td><a href="?/config/edit/' . utf8tohtml($name) . '">[edit]' . '</a></td>';
-			} else {
-				if($type == 'string' || $type == 'integer') {
-					$body .= '<td><input style="width:100%" type="text" name="' .utf8tohtml($name) . '" value="'. str_replace('"', '&quot;', utf8tohtml($value)) . '"' .
-							(in_array($name, $var_system) ? ' readonly="readonly"' : '') . '></td>';
-				} elseif($type == 'boolean') {
-					if(in_array($name, $var_force_string))
-						$body .= '<td><input style="width:100%" type="text" name="' . utf8tohtml($name) . '" value=""></td>';
-					else
-						$body .= '<td><input type="checkbox" name="' . utf8tohtml($name) . '" ' . ($value ? 'checked' : '') . '></td>';
-				} else {
-					$body .= '<td>' . utf8tohtml($value) . '</td>';
-				}
-			}
-			
-			$body .= '</tr>';
-		}
-		
-		$body .= '</table><div style="text-align:center"><input name="save_changes" type="submit" value="Save changes"></div></form></fieldset>';
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>_('Configuration'),
-			'body'=>$body,
-			'mod'=>true
-			)
-		);			
-	} elseif(preg_match('/^\/config$/', $query)) {
-		if(!hasPermission($config['mod']['show_config']))
-			error($config['error']['noaccess']);
-		
-		// Show instance-config.php	
-		
-		$data = '';
-		
-		function do_array_part($array, $prefix = '') {
-			global $data, $config;
-			
-			foreach($array as $name => $value) {
-				if(is_array($value)) {
-					do_array_part($value, $prefix . $name . ' → ');
-				} else {
-					if($config['mod']['never_reveal_password'] && $prefix == 'db → ' && $name == 'password') {
-						$value = '<em>hidden</em>';
-					} elseif(gettype($value) == 'boolean') {
-						$value = $value ? '<span style="color:green;">On</span>' : '<span style="color:red;">Off</span>';
-					} elseif(gettype($value) == 'string') {
-						if(empty($value))
-							$value = '<em>empty</em>';
-						else
-							$value = '<span style="color:maroon;">' . utf8tohtml(substr($value, 0, 110) . (mb_strlen($value) > 110 ? '&hellip;' : '')) . '</span>';
-					} elseif(gettype($value) == 'integer') {
-						$value = '<span style="color:black;">' . $value . '</span>';
-					} elseif(is_object($value) && get_class($value) == 'Closure') {
-						$value = '[callback]';
-					}
-					
-					$data .= 
-							'<tr><th style="text-align:left;">' . 
-								$prefix . (gettype($name) == 'integer' ? '[]' : utf8tohtml($name)) .
-							'</th><td>' .
-								$value .
-							'</td></tr>';
-					}
-				}
-			}
-		
-		do_array_part($config);
-		
-		
-		$body = (hasPermission($config['mod']['edit_config']) ?
-				'<p style="text-align:center" class="unimportant">' .
-					'<a href="?/config/edit">[Edit using web editor]</a>' : '') .
-				'<fieldset><legend>' . _('Configuration') . '</legend><table>' . $data . '</table></fieldset>';
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>_('Configuration'),
-			'body'=>$body,
-			'mod'=>true
-			)
-		);
-	} elseif(preg_match('/^\/new$/', $query)) {
-		if(!hasPermission($config['mod']['newboard'])) error($config['error']['noaccess']);
-		
-		// New board
-		$body = '';
-		
-		if(isset($_POST['new_board'])) {
-			// Create new board
-			if(	!isset($_POST['uri']) ||
-				!isset($_POST['title']) ||
-				!isset($_POST['subtitle'])
-			)	error($config['error']['missedafield']);
-			
-			$b = array(
-				'uri' => $_POST['uri'],
-				'title' => $_POST['title'],
-				'subtitle' => $_POST['subtitle']
-			);
-			
-			// HTML characters
-			$b['title'] = utf8tohtml($b['title'], true);
-			$b['subtitle'] = utf8tohtml($b['subtitle'], true);
-			
-			// Check required fields
-			if(empty($b['uri']))
-				error(sprintf($config['error']['required'], 'URI'));
-			if(empty($b['title']))
-				error(sprintf($config['error']['required'], 'title'));
-			
-			if(!preg_match('/^\w+$/', $b['uri']))
-				error(sprintf($config['error']['invalidfield'], 'URI'));
-			
-			if(openBoard($b['uri'])) {
-				unset($board);
-				error(sprintf($config['error']['boardexists'], sprintf($config['board_abbreviation'], $b['uri'])));
-			}
-			
-			$query = prepare("INSERT INTO `boards` VALUES (:uri, :title, :subtitle)");
-			$query->bindValue(':uri', $b['uri']);
-			$query->bindValue(':title', $b['title']);
-			if(!empty($b['subtitle'])) {
-				$query->bindValue(':subtitle', $b['subtitle']);
-			} else {
-				$query->bindValue(':subtitle', null, PDO::PARAM_NULL);
-			}
-			$query->execute() or error(db_error($query));
-			
-			// Record the action
-			modLog("Created a new board: {$b['title']}");
-			
-			// Open the board
-			openBoard($b['uri']) or error(_("Couldn't open board after creation."));
-			
-			// Create the posts table
-			query(Element('posts.sql', array('board' => $board['uri']))) or error(db_error());
-			
-			if($config['cache']['enabled'])
-				cache::delete('all_boards');
-			
-			// Build the board
-			buildIndex();
-			
-			rebuildThemes('boards');
-			
-			header('Location: ?/' . $b['uri'] . '/' . $config['file_index'], true, $config['redirect_http']);
-		} else {
-			
-			$body .= form_newBoard();
-			
-			// TODO: Statistics, etc, in the dashboard.
-			
-			echo Element('page.html', array(
-				'config'=>$config,
-				'title'=>'New board',
-				'body'=>$body,
-				'mod'=>true
-				)
-			);
-		}
-	} elseif(preg_match('/^\/' . $regex['board'] . '(' . $regex['index'] . '|' . $regex['page'] . ')?$/', $query, $matches)) {
-		// Board index
-		
-		$boardName = &$matches[1];
-		
-		// Open board
-		if(!openBoard($boardName))
-			error($config['error']['noboard']);
-		
-		$page_no = empty($matches[2]) || $matches[2] == $config['file_index'] ? 1 : $matches[2];
-		
-		if(!$page = index($page_no, $mod)) {
-			error($config['error']['404']);
-		}
-		
-		$page['pages'] = getPages(true);
-		$page['pages'][$page_no-1]['selected'] = true;
-		$page['btn'] = getPageButtons($page['pages'], true);
-		$page['mod'] = true;
-		echo Element('index.html', $page);
-	} elseif(preg_match('/^\/' . $regex['board'] . $regex['res'] . $regex['page'] . '$/', $query, $matches)) {
-		// View thread
-		
-		$boardName = &$matches[1];
-		$thread = &$matches[2];
-		// Open board
-		if(!openBoard($boardName))
-			error($config['error']['noboard']);
-		
-		$page = buildThread($thread, true, $mod);
-		
-		echo $page;
-	} elseif(preg_match('/^\/' . $regex['board'] . 'edit\/(\d+)$/', $query, $matches)) {
-		// Edit post body
-		
-		$boardName = &$matches[1];
-		
-		// Open board
-		if(!openBoard($boardName))
-			error($config['error']['noboard']);
-		
-		if(!hasPermission($config['mod']['editpost'], $boardName)) error($config['error']['noaccess']);
-		
-		$postID = &$matches[2];
-		
-		$query = prepare(sprintf("SELECT `body_nomarkup`, `name`, `subject`, `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri']));
-		$query->bindValue(':id', $postID, PDO::PARAM_INT);
-		$query->execute() or error(db_error($query));
-		$post = $query->fetch() or error($config['error']['invalidpost']);
-		
-		if(isset($_POST['submit']) && isset($_POST['body']) && isset($_POST['subject'])) {
-			if(mb_strlen($_POST['subject']) > 100)
-				error(sprintf($config['error']['toolong'], 'subject'));
-			
-			$body = $_POST['body'];
-			$body_nomarkup = $body;
-			
-			wordfilters($body);
-			$tracked_cites = markup($body, true);
-			
-			$query = prepare("DELETE FROM `cites` WHERE `board` = :board AND `post` = :post");
-			$query->bindValue(':board', $board['uri']);
-			$query->bindValue(':post', $postID, PDO::PARAM_INT);
-			$query->execute() or error(db_error($query));
-		
-			$query = prepare(sprintf("UPDATE `posts_%s` SET `body` = :body, `body_nomarkup` = :body_nomarkup, `subject` = :subject WHERE `id` = :id", $board['uri']));
-			$query->bindValue(':id', $postID, PDO::PARAM_INT);
-			$query->bindValue(':body', $body);
-			$query->bindValue(':body_nomarkup', $body_nomarkup);
-			$query->bindValue(':subject', utf8tohtml($_POST['subject']));
-			$query->execute() or error(db_error($query));
-			
-			if(isset($tracked_cites)) {
-				foreach($tracked_cites as $cite) {
-					$query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)');
-					$query->bindValue(':board', $board['uri']);
-					$query->bindValue(':post', $postID, PDO::PARAM_INT);
-					$query->bindValue(':target_board',$cite[0]);
-					$query->bindValue(':target', $cite[1], PDO::PARAM_INT);
-					$query->execute() or error(db_error($query));
-				}
-			}
+	'/edit/(\w+)'				=> 'edit_board',	// edit board details
+	'/new-board'				=> 'new_board',		// create a new board
 	
-			// Record the action
-			modLog("Edited post #{$postID}");
-			
-			buildThread($post['thread'] ? $post['thread'] : $postID);
-			
-			// Rebuild board
-			buildIndex();
-		
-			// Redirect
-			header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
-			exit;
-		}
-		
-		$post['body_nomarkup'] = utf8tohtml($post['body_nomarkup']);
-		
-		if($config['minify_html'])
-			$post['body_nomarkup'] = str_replace("\n", '&#010;', $post['body_nomarkup']);
-		
-		$body = '<form name="post" action="" method="post">' .
-				'<table>' .
-					'<tr>' .
-						'<th>Name</th>' .
-						'<td>' . utf8tohtml($post['name']) . '</td>' .
-					'</tr>' .
-					'<tr>' .
-						'<th>Subject</th>' .
-						'<td>' .
-							'<input style="float:left;" type="text" name="subject" size="25" maxlength="50" value="' . str_replace('"', '&quot;', $post['subject']) . '"/>' .
-							'<input style="margin-left:2px;" type="submit" name="submit" value="Edit Post"/>' .
-						'</td>' .
-					'</tr>' .
-					'<tr>' .
-						'<th>Body</th>' .
-						'<td>' .
-							'<textarea name="body" rows="8" cols="38">' .
-								 $post['body_nomarkup'] .
-							'</textarea>' .
-						'</td>' .
-					'</tr>' .
-				'</table>' .
-			'</form>';
-		
-		echo Element('page.html', array(
-			'config' => $config,
-			'body' => $body,
-			'title' => 'Edit Post #' . $postID
-		));
-	} elseif(preg_match('/^\/' . $regex['board'] . 'deletefile\/(\d+)$/', $query, $matches)) {
-		// Delete file from post
-		
-		$boardName = &$matches[1];
-		
-		// Open board
-		if(!openBoard($boardName))
-			error($config['error']['noboard']);
-		
-		if(!hasPermission($config['mod']['deletefile'], $boardName)) error($config['error']['noaccess']);
-		
-		$post = &$matches[2];
-		
-		// Delete post
-		deleteFile($post);
-		
-		// Record the action
-		modLog("Removed file from post #{$post}");
-		
-		// Rebuild board
-		buildIndex();
-		
-		// Redirect
-		header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
-	} elseif(preg_match('/^\/' . $regex['board'] . 'delete\/(\d+)$/', $query, $matches)) {
-		// Delete post
-		
-		$boardName = &$matches[1];
-		
-		// Open board
-		if(!openBoard($boardName))
-			error($config['error']['noboard']);
-		
-		if(!hasPermission($config['mod']['delete'], $boardName))
-			error($config['error']['noaccess']);
-		
-		$post = &$matches[2];
-		
-		// Delete post
-		deletePost($post);
-		
-		// Record the action
-		modLog("Deleted post #{$post}");
-		
-		// Rebuild board
-		buildIndex();
-		
-		// Redirect
-		header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
-	} elseif(preg_match('/^\/' . $regex['board'] . '(un)?sticky\/(\d+)$/', $query, $matches)) {
-		// Add/remove sticky
-		
-		$boardName = &$matches[1];
-		
-		// Open board
-		if(!openBoard($boardName))
-			error($config['error']['noboard']);
-		
-		if(!hasPermission($config['mod']['sticky'], $boardName)) error($config['error']['noaccess']);
-		
-		$post = &$matches[3];
-		
-		$query = prepare(sprintf("UPDATE `posts_%s` SET `sticky` = :sticky WHERE `id` = :id AND `thread` IS NULL", $board['uri']));
-		$query->bindValue(':id', $post, PDO::PARAM_INT);
-		
-		if($matches[2] == 'un') {
-			// Record the action
-			modLog("Unstickied post #{$post}");
-			$query->bindValue(':sticky', 0, PDO::PARAM_INT);
-		} else {
-			// Record the action
-			modLog("Stickied post #{$post}");
-			$query->bindValue(':sticky', 1, PDO::PARAM_INT);
-		}
-		
-		$query->execute() or error(db_error($query));
-		
-		buildIndex();
-		buildThread($post);
-		
-		
-		// Redirect
-		header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
-	} elseif(preg_match('/^\/' . $regex['board'] . '(un)?lock\/(\d+)$/', $query, $matches)) {
-		// Lock/Unlock
-		
-		$boardName = &$matches[1];
-		
-		// Open board
-		if(!openBoard($boardName))
-			error($config['error']['noboard']);
-		
-		if(!hasPermission($config['mod']['lock'], $boardName)) error($config['error']['noaccess']);
-		
-		$post = &$matches[3];
-		
-		$query = prepare(sprintf("UPDATE `posts_%s` SET `locked` = :locked WHERE `id` = :id AND `thread` IS NULL", $board['uri']));
-		$query->bindValue(':id', $post, PDO::PARAM_INT);
-		
-		if($matches[2] == 'un') {
-			// Record the action
-			modLog("Unlocked post #{$post}");
-			$query->bindValue(':locked', 0, PDO::PARAM_INT);
-		} else {
-			// Record the action
-			modLog("Locked post #{$post}");
-			$query->bindValue(':locked', 1, PDO::PARAM_INT);
-		}
-		
-		$query->execute() or error(db_error($query));
-		
-		buildIndex();
-		buildThread($post);
-		
-		
-		// Redirect
-		header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
-	} elseif(preg_match('/^\/' . $regex['board'] . 'bump(un)?lock\/(\d+)$/', $query, $matches)) {
-		// Lock/Unlock
-		
-		$boardName = &$matches[1];
-		// Open board
-		if(!openBoard($boardName))
-			error($config['error']['noboard']);
-		
-		if(!hasPermission($config['mod']['bumplock'], $boardName)) error($config['error']['noaccess']);
-		
-		$post = &$matches[3];
-		
-		$query = prepare(sprintf("UPDATE `posts_%s` SET `sage` = :bumplocked WHERE `id` = :id AND `thread` IS NULL", $board['uri']));
-		$query->bindValue(':id', $post, PDO::PARAM_INT);
-		
-		if($matches[2] == 'un') {
-			// Record the action
-			modLog("Unbumplocked post #{$post}");
-			$query->bindValue(':bumplocked', 0, PDO::PARAM_INT);
-		} else {
-			// Record the action
-			modLog("Bumplocked post #{$post}");
-			$query->bindValue(':bumplocked', 1, PDO::PARAM_INT);
-		}
-		
-		$query->execute() or error(db_error($query));
-		
-		buildIndex();
-		buildThread($post);
-		
-		
-		// Redirect
-		header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
-	} elseif(preg_match('/^\/' . $regex['board'] . 'deletebyip\/(\d+)(\/global)?$/', $query, $matches)) {
-		// Delete all posts by an IP
-		
-		$boardName = &$matches[1];
-		$post = &$matches[2];
-		$global = isset($matches[3]) && $matches[3] == '/global';
-		
-		// Open board
-		if(!openBoard($boardName))
-			error($config['error']['noboard']);
-		
-		$query = prepare(sprintf("SELECT `ip` FROM `posts_%s` WHERE `id` = :id", $board['uri']));
-		$query->bindValue(':id', $post);
-		$query->execute() or error(db_error($query));
-		
-		if(!$post = $query->fetch())
-			error($config['error']['invalidpost']);
-		
-		$ip = $post['ip'];
-		
-		if($global)
-			$boards = listBoards();
-		else
-			$boards = array(array('uri' => $board['uri']));
-		
-		$query = '';
-		foreach($boards as $_board) {
-			$query .= sprintf("SELECT `id`, '%s' AS `board` FROM `posts_%s` WHERE `ip` = :ip UNION ALL ", $_board['uri'], $_board['uri']);
-		}
-		$query = preg_replace('/UNION ALL $/', '', $query);
-		
-		$query = prepare($query);
-		$query->bindValue(':ip', $ip);
-		$query->execute() or error(db_error($query));
-		
-		if($query->rowCount() < 1)
-			error($config['error']['invalidpost']);
-		
-		$boards = array();
-		while($post = $query->fetch()) {
-			openBoard($post['board']);
-			$boards[] = $post['board'];
-			
-			deletePost($post['id'], false);
-		}
-		
-		foreach($boards as &$_board) {
-			openBoard($_board);
-			buildIndex();
-		}
-		
-		// Record the action
-		modLog("Deleted all posts by IP address: {$ip}");
-		
-		header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
-	} elseif(preg_match('/^\/ban$/', $query)) {
-		if(!hasPermission($config['mod']['ban'])) error($config['error']['noaccess']);
-		// Ban page
+	'/rebuild'				=> 'rebuild',		// rebuild static files
+	'/reports'				=> 'reports',		// report queue
+	'/reports/(\d+)/dismiss(all)?'		=> 'report_dismiss',	// dismiss a report
+	
+	'/ban'					=> 'ban',		// new ban
+	'/IP/([\w.:]+)'				=> 'ip',		// view ip address
+	'/IP/([\w.:]+)/remove_note/(\d+)'	=> 'ip_remove_note',	// remove note from ip address
+	'/bans'					=> 'bans',		// ban list
+	'/bans/(\d+)'				=> 'bans',		// ban list
+	
+	'/(\w+)/delete/(\d+)'			=> 'delete',		// delete post
+	'/(\w+)/ban(&delete)?/(\d+)'		=> 'ban_post',		// ban poster
+	'/(\w+)/deletefile/(\d+)'		=> 'deletefile',	// delete file from post
+	'/(\w+)/deletebyip/(\d+)(/global)?'	=> 'deletebyip',	// delete all posts by IP address
+	'/(\w+)/(un)?lock/(\d+)'		=> 'lock',		// lock thread
+	'/(\w+)/(un)?sticky/(\d+)'		=> 'sticky',		// sticky thread
+	'/(\w+)/bump(un)?lock/(\d+)'		=> 'bumplock',		// "bumplock" thread
+	'/(\w+)/move/(\d+)'			=> 'move',		// move thread
+	
+	'/themes'				=> 'themes_list',	// manage themes
+	'/themes/(\w+)'				=> 'theme_configure',	// configure/reconfigure theme
+	'/themes/(\w+)/rebuild'			=> 'theme_rebuild',	// rebuild theme
+	'/themes/(\w+)/uninstall'		=> 'theme_uninstall',	// uninstall theme
+	
+	'/config'				=> 'config',		// config editor
+	
+	// these pages aren't listed in the dashboard without $config['debug']
+	'/debug/antispam'			=> 'debug_antispam',
+	
+	// This should always be at the end:
+	'/(\w+)/'										=> 'view_board',
+	'/(\w+)/' . preg_quote($config['file_index'], '!')					=> 'view_board',
+	'/(\w+)/' . str_replace('%d', '(\d+)', preg_quote($config['file_page'], '!'))		=> 'view_board',
+	'/(\w+)/' . preg_quote($config['dir']['res'], '!') .
+			str_replace('%d', '(\d+)', preg_quote($config['file_page'], '!'))	=> 'view_thread',
+);
+
+
+
+if (!$mod) {
+	$pages = array('!!' => 'login');
+} elseif (isset($_GET['status'], $_GET['r'])) {
+	header('Location: ' . $_GET['r'], true, (int)$_GET['status']);
+	exit;
+}
+
+if (isset($config['mod']['custom_pages'])) {
+	$pages = array_merge($pages, $config['mod']['custom_pages']);
+}
+
+$new_pages = array();
+foreach ($pages as $key => $callback) {
+	$new_pages[@$key[0] == '!' ? $key : "!^$key$!"] = $callback;
+}
+$pages = $new_pages;
+
+foreach ($pages as $uri => $handler) {
+	if (preg_match($uri, $query, $matches)) {
+		$matches = array_slice($matches, 1);
 		
-		if(isset($_POST['new_ban'])) {
-			if(	!isset($_POST['ip']) ||
-				!isset($_POST['reason']) ||
-				!isset($_POST['length'])
-			)	error($config['error']['missedafield']);
-			
-			// Check required fields
-			if(empty($_POST['ip']))
-				error(sprintf($config['error']['required'], 'IP address'));
-			
-			$query = prepare("INSERT INTO `bans` VALUES (NULL, :ip, :mod, :set, :expires, :reason, :board)");
-			
-			// 1yr2hrs30mins
-			// 1y2h30m
-			$expire = 0;
-			if(preg_match('/^((\d+)\s?ye?a?r?s?)?\s?+((\d+)\s?mon?t?h?s?)?\s?+((\d+)\s?we?e?k?s?)?\s?+((\d+)\s?da?y?s?)?((\d+)\s?ho?u?r?s?)?\s?+((\d+)\s?mi?n?u?t?e?s?)?\s?+((\d+)\s?se?c?o?n?d?s?)?$/', $_POST['length'], $m)) {
-				if(isset($m[2])) {
-					// Years
-					$expire += $m[2]*60*60*24*365;
-				}
-				if(isset($m[4])) {
-					// Months
-					$expire += $m[4]*60*60*24*30;
-				}
-				if(isset($m[6])) {
-					// Weeks
-					$expire += $m[6]*60*60*24*7;
-				}
-				if(isset($m[8])) {
-					// Days
-					$expire += $m[8]*60*60*24;
-				}
-				if(isset($m[10])) {
-					// Hours
-					$expire += $m[10]*60*60;
-				}
-				if(isset($m[12])) {
-					// Minutes
-					$expire += $m[12]*60;
-				}
-				if(isset($m[14])) {
-					// Seconds
-					$expire += $m[14];
-				}
-			}
-			if($expire) {
-				$query->bindValue(':expires', time()+$expire, PDO::PARAM_INT);
-			} else {
-				// Never expire
-				$query->bindValue(':expires', null, PDO::PARAM_NULL);
-			}
-			
-			$query->bindValue(':ip', $_POST['ip'], PDO::PARAM_STR);
-			$query->bindValue(':mod', $mod['id'], PDO::PARAM_INT);
-			$query->bindValue(':set', time(), PDO::PARAM_INT);
-			
-			
-			
-			if(!empty($_POST['reason'])) {
-				$reason = $_POST['reason'];
-				markup($reason);
-				$query->bindValue(':reason', $reason, PDO::PARAM_STR);
-			} else {
-				$query->bindValue(':reason', null, PDO::PARAM_NULL);
-			}
-			
-			if($_POST['board'] == '') {
-				$query->bindValue(':board', null, PDO::PARAM_NULL);
-			} else {
-				$query->bindValue(':board', $_POST['board'], PDO::PARAM_INT);
-			}
-			
-			// Record the action
-			modLog('Created a ' . ($expire ? $expire . ' second' : 'permanent') . " ban for {$_POST['ip']} with " . (!empty($_POST['reason']) ? "reason \"${reason}\"" : 'no reason'));
-			
-			$query->execute() or error(db_error($query));
-			
-			if(isset($_POST['board']))
-				openBoard($_POST['board']);
-			
-			// Delete too
-			if(isset($_POST['delete']) && isset($_POST['board']) && hasPermission($config['mod']['delete'], $_POST['board'])) {					
-				$post = round($_POST['delete']);
-				
-				deletePost($post);
-				
-				// Record the action
-				modLog("Deleted post #{$post}");
-				
-				// Rebuild board
-				buildIndex();
-			}
-			
-			if(hasPermission($config['mod']['public_ban']) && isset($_POST['post']) && isset($_POST['board']) && isset($_POST['public_message']) && isset($_POST['message'])) {					
-				$post = round($_POST['post']);
-				
-				$query = prepare(sprintf("UPDATE `posts_%s` SET `body` = CONCAT(`body`, :body) WHERE `id` = :id", $board['uri']));
-				$query->bindValue(':id', $post, PDO::PARAM_INT);
-				$query->bindValue(':body', sprintf($config['mod']['ban_message'], utf8tohtml($_POST['message'])));
-				$query->execute() or error(db_error($query));
-				
-				// Rebuild thread
-				$query = prepare(sprintf("SELECT `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri']));
-				$query->bindValue(':id', $post, PDO::PARAM_INT);
-				$query->execute() or error(db_error($query));
-				$thread = $query->fetch();
-				if($thread['thread'])
-					buildThread($thread['thread']);
-				else
-					buildThread($post);
-				
-				// Rebuild board
-				buildIndex();
-				
-				// Record the action
-				modLog("Attached a public ban message for post #{$post}: " . $_POST['message']);
-			}
-			
-			// Redirect
-			if(isset($_POST['continue']))
-				header('Location: ' . $_POST['continue'], true, $config['redirect_http']);
-			elseif(isset($board))
-				header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['file_index'], true, $config['redirect_http']);
-			else
-				header('Location: ?/', true, $config['redirect_http']);
+		if ($config['debug']) {
+			$debug['mod_page'] = array(
+				'req' => $query,
+				'match' => $uri,
+				'handler' => $handler
+			);
 		}
-	} elseif(preg_match('/^\/' . $regex['board'] . 'move\/(\d+)$/', $query, $matches)) {
-		
-		$boardName = &$matches[1];
-		$postID = $matches[2];
-		
-		// Open board
-		if(!openBoard($boardName))
-			error($config['error']['noboard']);
 		
-		if(!hasPermission($config['mod']['move'], $boardName)) error($config['error']['noaccess']);
-		
-		if(isset($_POST['board'])) {
-			$targetBoard = $_POST['board'];
-			$shadow = isset($_POST['shadow']);
-			
-			if($targetBoard == $boardName)
-				error(_("Target and source board are the same."));
-			
-			// copy() if leaving a shadow thread behind. otherwise, rename().
-			$clone = $shadow ? 'copy' : 'rename';
-			
-			$query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` IS NULL AND `id` = :id", $board['uri']));
-			$query->bindValue(':id', $postID, PDO::PARAM_INT);
-			$query->execute() or error(db_error($query));
-			if(!$post = $query->fetch()) {
-				error($config['error']['nonexistant']);
-			}
-			$post['op'] = true;
-			
-			if($post['file']) {
-				$post['has_file'] = true;
-				$post['width'] = &$post['filewidth'];
-				$post['height'] = &$post['fileheight'];
-				
-				$file_src = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file'];
-				$file_thumb = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb'];
-			} else $post['has_file'] = false;
-			
-			// allow thread to keep its same traits (stickied, locked, etc.)
-			$post['mod'] = true;
-			
-			if(!openBoard($targetBoard))
-				error($config['error']['noboard']);
-			
-			$newID = post($post);
-			
-			if($post['has_file']) {
-				$clone($file_src, sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']);
-				$clone($file_thumb, sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']);
-			}
-			
-			// move replies too...
-			openBoard($boardName);
-			
-			$query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` = :id ORDER BY `id`", $board['uri']));
-			$query->bindValue(':id', $postID, PDO::PARAM_INT);
-			$query->execute() or error(db_error($query));
-			
-			$replies = array();
-			while($post = $query->fetch()) {
-				$post['mod'] = true;
-				$post['thread'] = $newID;
-				
-				if($post['file']) {
-					$post['has_file'] = true;
-					$post['width'] = &$post['filewidth'];
-					$post['height'] = &$post['fileheight'];
-					
-					$post['file_src'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file'];
-					$post['file_thumb'] = sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb'];
-				} else $post['has_file'] = false;
-				
-				$replies[] = $post;
-			}
-			
-			$newIDs = array($postID => $newID);
-			
-			openBoard($targetBoard);
-			foreach($replies as &$post) {
-				$query = prepare("SELECT `target` FROM `cites` WHERE `target_board` = :board AND `board` = :board AND `post` = :post");
-				$query->bindValue(':board', $boardName);
-				$query->bindValue(':post', $post['id'], PDO::PARAM_INT);
-				$query->execute() or error(db_error($qurey));
-				while($cite = $query->fetch(PDO::FETCH_ASSOC)) {
-					if(isset($newIDs[$cite['target']])) {
-						$post['body_nomarkup'] = preg_replace(
-								'/(>>(>\/' . preg_quote($boardName, '/') . '\/)?)' . preg_quote($cite['target'], '/') . '/',
-								'>>' . $newIDs[$cite['target']],
-								$post['body_nomarkup']);
-						
-						$post['body'] = $post['body_nomarkup'];
-					}
-				}
-				$post['op'] = false;
-				$post['tracked_cites'] = markup($post['body'], true);
-				
-				$newIDs[$post['id']] = $newPostID = post($post);
-				
-				if($post['has_file']) {
-					$clone($post['file_src'], sprintf($config['board_path'], $board['uri']) . $config['dir']['img'] . $post['file']);
-					$clone($post['file_thumb'], sprintf($config['board_path'], $board['uri']) . $config['dir']['thumb'] . $post['thumb']);
-				}
-				
-				foreach($post['tracked_cites'] as $cite) {
-					$query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)');
-					$query->bindValue(':board', $board['uri']);
-					$query->bindValue(':post', $newPostID, PDO::PARAM_INT);
-					$query->bindValue(':target_board',$cite[0]);
-					$query->bindValue(':target', $cite[1], PDO::PARAM_INT);
-					$query->execute() or error(db_error($query));
-				}
-			}
-			
-			// build thread
-			buildThread($newID);
-			buildIndex();
-			
-			// trigger themes
-			rebuildThemes('post');
-			
-			openBoard($boardName);
-			
-			if($shadow) {
-				// lock thread
-				$query = prepare(sprintf("UPDATE `posts_%s` SET `locked` = 1 WHERE `id` = :id", $board['uri']));
-				$query->bindValue(':id', $postID, PDO::PARAM_INT);
-				$query->execute() or error(db_error($query));
-				
-				$post = array(
-					'mod' => true,
-					'subject' => '',
-					'email' => '',
-					'name' => $config['mod']['shadow_name'],
-					'capcode' => $config['mod']['shadow_capcode'],
-					'trip' => '',
-					'body' => sprintf($config['mod']['shadow_mesage'], '>>>/' . $targetBoard . '/' . $newID),
-					'password' => '',
-					'has_file' => false,
-					// attach to original thread
-					'thread' => $postID,
-					'op' => false
-				);
-				
-				markup($post['body']);
-				
-				$botID = post($post);
-				buildThread($postID);
-				
-				header('Location: ?/' . sprintf($config['board_path'], $boardName) . $config['dir']['res'] . sprintf($config['file_page'], $postID) . '#' . $botID, true, $config['redirect_http']);
+		if (is_string($handler)) {
+			if ($handler[0] == ':') {
+				header('Location: ' . substr($handler, 1),  true, $config['redirect_http']);
+			} elseif (is_callable("mod_page_$handler")) {
+				call_user_func_array("mod_page_$handler", $matches);
+			} elseif (is_callable("mod_$handler")) {
+				call_user_func_array("mod_$handler", $matches);
 			} else {
-				deletePost($postID);
-				buildIndex();
-				
-				openBoard($targetBoard);
-				header('Location: ?/' . sprintf($config['board_path'], $board['uri']) . $config['dir']['res'] . sprintf($config['file_page'], $newID), true, $config['redirect_http']);
+				error("Mod page '$handler' not found!");
 			}
+		} elseif (is_callable($handler)) {
+			call_user_func_array($handler, $matches);
 		} else {
-		
-			$body = '<fieldset><legend>Move thread</legend>' .
-				'<form action="?/' . $boardName . '/move/' . $postID . '" method="post">' .
-					'<table>'
-				;
-		
-			$boards = listBoards();
-			if(count($boards) <= 1)
-				error(_('No board to move to; there is only one.'));
-			
-			$__boards = '';
-			foreach($boards as &$_board) {
-				if($_board['uri'] == $board['uri'])
-					continue;
-				$__boards .= '<li>' .
-					'<input type="radio" name="board" id="board_' . $_board['uri'] . '" value="' . $_board['uri'] . '">' .
-					'<label style="display:inline" for="board_' . $_board['uri'] . '"> ' .
-							sprintf($config['board_abbreviation'], $_board['uri']) .
-						' - ' . $_board['title'] .
-					'</label>' .
-					'</li>';
-			}
-		
-			$body .= '<tr>' .
-						'<th>Thread ID</th>' .
-						'<td><input type="text" size="7" value="' . $postID . '" disabled /></td>' .
-					'</tr>' .
-				
-					'<tr>' . 
-						'<th><label for="message">Leave shadow thread</label></th>' .
-						'<td>' .
-							'<input type="checkbox" id="shadow" name="shadow" checked/>' .
-							' <span class="unimportant">(locks thread; replies to it with a link.)</span>' .
-						'</td>' .
-					'</tr>' .
-				
-					'<tr>' .
-						'<th>Target board</th>' .
-						'<td><ul style="list-style:none;padding:2px 5px">' . $__boards . '</tl></td>' .
-					'</tr>' .
-				
-					'<tr>' . 
-						'<td></td>' . 
-						'<td><input type="submit" value="Move thread" /></td>' . 
-					'</tr>' . 
-				'</table>' .
-			'</form></fieldset>';
-	
-			echo Element('page.html', array(
-				'config'=>$config,
-				'title'=>'Move #' . $postID,
-				'body'=>$body,
-				'mod'=>true
-				)
-			);
-		}
-	} elseif(preg_match('/^\/' . $regex['board'] . 'ban(&delete)?\/(\d+)$/', $query, $matches)) {
-		
-		// Ban by post
-		
-		$boardName = &$matches[1];
-		// Open board
-		if(!openBoard($boardName))
-			error($config['error']['noboard']);
-		
-		if(!hasPermission($config['mod']['ban'], $boardName)) error($config['error']['noaccess']);
-		
-		$delete = isset($matches[2]) && $matches[2] == '&delete';
-		if($delete && !hasPermission($config['mod']['delete'], $boardName)) error($config['error']['noaccess']);
-		
-		$post = $matches[3];
-		
-		$query = prepare(sprintf("SELECT `ip`,`id` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri']));
-		$query->bindValue(':id', $post, PDO::PARAM_INT);
-		$query->execute() or error(db_error($query));
-		
-		if($query->rowCount() < 1) {
-			error($config['error']['invalidpost']);
+			error("Mod page '$handler' not a string, and not callable!");
 		}
-	
-		$post = $query->fetch();
-		
-		$body = form_newBan($post['ip'], null, '?/' . sprintf($config['board_path'], $board['uri']) . $config['file_index'], $post['id'], $boardName, !$delete);
-		
-		echo Element('page.html', array(
-			'config'=>$config,
-			'title'=>'New ban',
-			'body'=>$body,
-			'mod'=>true
-			)
-		);
-	} elseif(preg_match('/^\/IP\/(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')\/deletenote\/(?P<id>\d+)$/', $query, $matches)) {
-		if(!hasPermission($config['mod']['remove_notes'])) error($config['error']['noaccess']);
-		
-		$ip = $matches[1];
-		$id = $matches['id'];
-
-		$query = prepare("DELETE FROM `ip_notes` WHERE `ip` = :ip AND `id` = :id");
-		$query->bindValue(':ip', $ip);
-		$query->bindValue(':id', $id);
-		$query->execute() or error(db_error($query));
-		
-		header('Location: ?/IP/' . $ip, true, $config['redirect_http']);
-	} elseif(preg_match('/^\/IP\/(\d+\.\d+\.\d+\.\d+|' . $config['ipv6_regex'] . ')$/', $query, $matches)) {
-		// View information on an IP address
-		
-		$ip = $matches[1];
-		$host = $config['mod']['dns_lookup'] ? rDNS($ip) : false;
 		
-		if(hasPermission($config['mod']['unban']) && isset($_POST['unban']) && isset($_POST['ban_id'])) {
-			removeBan($_POST['ban_id']);
-			header('Location: ?/IP/' . $ip, true, $config['redirect_http']);
-		} elseif(hasPermission($config['mod']['create_notes']) && isset($_POST['note'])) {
-			$query = prepare("INSERT INTO `ip_notes` VALUES(NULL, :ip, :mod, :time, :body)");
-			$query->bindValue(':ip', $ip);
-			$query->bindValue(':mod', $mod['id'], PDO::PARAM_INT);
-			$query->bindValue(':time', time(), PDO::PARAM_INT);
-			markup($_POST['note']);
-			$query->bindValue(':body', $_POST['note']);
-			$query->execute() or error(db_error($query));
-			
-			header('Location: ?/IP/' . $ip, true, $config['redirect_http']);
-		} else {
-			$body = '';
-			$boards = listBoards();
-			foreach($boards as &$_board) {
-				openBoard($_board['uri']);
-			
-				$temp = '';
-				$query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `ip` = :ip ORDER BY `sticky` DESC, `time` DESC LIMIT :limit", $_board['uri']));
-				$query->bindValue(':ip', $ip);
-				$query->bindValue(':limit', $config['mod']['ip_recentposts'], PDO::PARAM_INT);
-				$query->execute() or error(db_error($query));
-			
-				while($post = $query->fetch()) {
-					if(!$post['thread']) {
-						$po = new Thread($post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'], $post['sticky'], $post['locked'], $post['sage'], $post['embed'], '?/', $mod, false);
-					} else {
-						$po = new Post($post['id'], $post['thread'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'], $post['thumb'], $post['thumbwidth'], $post['thumbheight'], $post['file'], $post['filewidth'], $post['fileheight'], $post['filesize'], $post['filename'], $post['ip'],  $post['embed'], '?/', $mod);
-					}
-					$temp .= $po->build(true) . '<hr/>';
-				}
-			
-				if(!empty($temp))
-					$body .= '<fieldset><legend>Last ' . $query->rowCount() . ' posts on <a href="?/' .
-							sprintf($config['board_path'], $_board['uri']) . $config['file_index'] .
-						'">' .
-						sprintf($config['board_abbreviation'], $_board['uri']) . ' - ' . $_board['title'] .
-						'</a></legend>' . $temp . '</fieldset>';
-			}
-		
-			if(hasPermission($config['mod']['view_notes'])) {
-				$query = prepare("SELECT * FROM `ip_notes` WHERE `ip` = :ip ORDER BY `id` DESC");
-				$query->bindValue(':ip', $ip);
-				$query->execute() or error(db_error($query));
-			
-				if($query->rowCount() > 0 || hasPermission($config['mod']['create_notes'])) {
-					$body .= '<fieldset><legend>' .
-							$query->rowCount() . ' note' . ($query->rowCount() == 1 ?'' : 's') . ' on record' . 
-						'</legend>';
-					if($query->rowCount() > 0) {
-						$body .= '<table class="modlog">' .
-						'<tr><th>Staff</th><th>Note</th><th>Date</th>' .
-							(hasPermission($config['mod']['remove_notes']) ? '<th>Actions</th>' : '') .
-						'</td>';
-						while($note = $query->fetch()) {
-						
-							if($note['mod']) {
-								$_query = prepare("SELECT `username` FROM `mods` WHERE `id` = :id");
-								$_query->bindValue(':id', $note['mod']);
-								$_query->execute() or error(db_error($_query));
-								if($_mod = $_query->fetch()) {
-									$staff = '<a href="?/new_PM/' . $note['mod'] . '">' . utf8tohtml($_mod['username']) . '</a>';
-								} else {
-									$staff = '<em>???</em>';
-								}
-							} else {
-								$staff = '<em>system</em>';
-							}
-							$body .= '<tr>' .
-								'<td class="minimal">' .
-									$staff .
-								'</td><td>' .
-									$note['body'] .
-								'</td><td class="minimal">' .
-									strftime($config['post_date'], $note['time']) .
-								'</td>' .
-								(hasPermission($config['mod']['remove_notes']) ?
-									'<td class="minimal"><a class="unimportant" href="?/IP/' . $ip . '/deletenote/' . $note['id'] . '">[delete]</a></td>'
-								: '') .
-							'</tr>';
-						}
-						$body .= '</table>';
-					}
-		
-					if(hasPermission($config['mod']['create_notes'])) {
-						$body .= '<form action="" method="post" style="text-align:center;margin:0">' . 
-								'<table>' .
-									'<tr>' .
-										'<th>Staff</th>' .
-										'<td>' . $mod['username'] . '</td>' .
-									'</tr>' .
-									'<tr>' .
-										'<th><label for="note">Note</label></th>' .
-										'<td><textarea id="note" name="note" rows="5" cols="30"></textarea></td>' .
-									'</tr>' .
-									'<tr>' .
-										'<td></td>' .
-										'<td><input type="submit" value="New note" /></td>' .
-									'</tr>' .
-								'</table>' .
-							'</form>';
-					}
-				
-					$body .= '</fieldset>';
-				}
-			}
-		
-			if(hasPermission($config['mod']['view_ban'])) {
-				$query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `ip` = :ip");
-				$query->bindValue(':ip', $ip);
-				$query->execute() or error(db_error($query));
-			
-				if($query->rowCount() > 0) {
-					$body .= '<fieldset><legend>Ban' . ($query->rowCount() == 1 ? '' : 's') . ' on record</legend>';
-				
-					while($ban = $query->fetch()) {
-						$body .= '<form action="" method="post" style="text-align:center">' .
-						'<table style="width:400px;margin-bottom:10px;border-bottom:1px solid #ddd;padding:5px"><tr><th>Status</th><td>' . 
-							($config['mod']['view_banexpired'] && $ban['expires'] != 0 && $ban['expires'] < time() ?
-								'Expired'
-							: 'Active') .
-						'</td></tr>' .
-					
-						// IP
-						'<tr><th>IP</th><td>' . $ban['ip'] . '</td></tr>' .
-					
-						// Reason
-						'<tr><th>Reason</th><td>' . $ban['reason'] . '</td></tr>' .
-					
-						// Board
-						'<tr><th>Board</th><td>' .
-						(isset($ban['board']) ?
-							sprintf($config['board_abbreviation'], $ban['board'])
-						:
-							'<em>' . _('all boards') . '</em>'
-						) .
-						'</td></tr>' .
-					
-						// Set
-						'<tr><th>Set</th><td>' . strftime($config['post_date'], $ban['set']) . '</td></tr>' .
-					
-						// Expires
-						'<tr><th>Expires</th><td>' . 
-							($ban['expires'] == 0 ?
-								'<em>Never</em>'
-							:
-								strftime($config['post_date'], $ban['expires'])
-							) .
-						'</td></tr>' .
-					
-						// Staff
-						'<tr><th>Staff</th><td>' .
-							(isset($ban['username']) ?
-								(!hasPermission($config['mod']['view_banstaff']) ?
-									($config['mod']['view_banquestionmark'] ?
-										'?'
-									:
-										($ban['type'] == JANITOR ? 'Janitor' :
-										($ban['type'] == MOD ? 'Mod' :
-										($ban['type'] == ADMIN ? 'Admin' :
-										'?')))
-									)
-								:
-									utf8tohtml($ban['username'])
-								)
-								: '<em>deleted?</em>'
-							) .
-						'</td></tr></table>' .
-						
-						'<input type="hidden" name="ban_id" value="' . $ban['id'] . '" />' .
-						
-						'<input type="submit" name="unban" value="Remove ban" ' .
-							(!hasPermission($config['mod']['unban']) ? 'disabled' : '') .
-						'/></form>';
-					}
-					
-					$body .= '</fieldset>';
-					
-				}
-			}
-		
-			if(hasPermission($config['mod']['ip_banform']))
-				$body .= form_newBan($ip, null, '?/IP/' . $ip);
-		
-			echo Element('page.html', array(
-				'config'=>$config,
-				'title'=>'IP: ' . $ip,
-				'subtitle' => $host,
-				'body'=>$body,
-				'mod'=>true
-				)
-			);
-		}
-	} else {
-		error($config['error']['404']);
+		exit;
 	}
 }
 
+error($config['error']['404']);
+
diff --git a/post.php b/post.php
index aa4d915b..16566b51 100644
--- a/post.php
+++ b/post.php
@@ -281,7 +281,7 @@ if (isset($_POST['delete'])) {
 	
 	$post['name'] = $_POST['name'] != '' ? $_POST['name'] : $config['anonymous'];
 	$post['subject'] = $_POST['subject'];
-	$post['email'] = utf8tohtml($_POST['email']);
+	$post['email'] = str_replace(' ', '%20', htmlspecialchars($_POST['email']));
 	$post['body'] = $_POST['body'];
 	$post['password'] = $_POST['password'];
 	$post['has_file'] = !isset($post['embed']) && (($post['op'] && !isset($post['no_longer_require_an_image_for_op']) && $config['force_image_op']) || (isset($_FILES['file']) && $_FILES['file']['tmp_name'] != ''));
@@ -313,13 +313,23 @@ if (isset($_POST['delete'])) {
 			)));
 	}
 	
-	if ($mod && $mod['type'] >= MOD && preg_match('/^((.+) )?## (.+)$/', $post['name'], $match)) {
-		if (($mod['type'] == MOD && $match[3] == 'Mod') || $mod['type'] >= ADMIN) {
-			$post['capcode'] = utf8tohtml($match[3]);
-			$post['name'] = $match[2] != '' ? $match[2] : $config['anonymous'];
+	
+	$post['capcode'] = false;
+	
+	if ($mod && preg_match('/^((.+) )?## (.+)$/', $post['name'], $matches)) {
+		$name = $matches[2] != '' ? $matches[2] : $config['anonymous'];
+		$cap = $matches[3];
+		
+		if (isset($config['mod']['capcode'][$mod['type']])) {
+			if (	$config['mod']['capcode'][$mod['type']] === true ||
+				(is_array($config['mod']['capcode'][$mod['type']]) &&
+					in_array($cap, $config['mod']['capcode'][$mod['type']])
+				)) {
+				
+				$post['capcode'] = utf8tohtml($cap);
+				$post['name'] = $name;
+			}
 		}
-	} else {
-		$post['capcode'] = false;
 	}
 	
 	$trip = generate_tripcode($post['name']);
@@ -527,7 +537,11 @@ if (isset($_POST['delete'])) {
 	}
 	$post = (array)$post;
 	
-	$id = post($post);
+	$post['id'] = $id = post($post);
+	
+	if (isset($post['antispam_hash'])) {
+		incrementSpamHash($post['antispam_hash']);
+	}
 	
 	if (isset($post['antispam_hash'])) {
 		incrementSpamHash($post['antispam_hash']);
diff --git a/stylesheets/style.css b/stylesheets/style.css
index a262eb35..80042bd6 100644
--- a/stylesheets/style.css
+++ b/stylesheets/style.css
@@ -70,15 +70,18 @@ form table input {
 }
 input[type="text"], input[type="password"], textarea {
 	border: 1px solid #a9a9a9;
-	text-indent: 0px;
+	text-indent: 0;
 	text-shadow: none;
 	text-transform: none;
 	word-spacing: normal;
 }
 form table tr td {
 	text-align: left;
-	margin: 0px;
-	padding: 0px;
+	margin: 0;
+	padding: 0;
+}
+form table.mod tr td {
+	padding: 2px;
 }
 form table tr th {
 	text-align: left;
@@ -104,7 +107,7 @@ form table tr td div label {
 }
 p.fileinfo {
 	display: block;
-	margin: 0px;
+	margin: 0;
 	padding-right: 7em;
 }
 div.banner {
@@ -263,11 +266,11 @@ span.heading {
 	color: #AF0A0F;
 	font-size: 11pt;
 	font-weight: bold;
-	display: block;
 }
 span.spoiler {
 	background: black;
 	color: black;
+	padding: 0px 1px;
 }
 div.post.reply p.body span.spoiler a {
 	color: black;
@@ -328,7 +331,7 @@ div.pages form input {
 hr {
 	border: none;
 	border-top: 1px solid #B7C5D9;
-	height: 0px;
+	height: 0;
 	clear: left;
 }
 div.boardlist {
@@ -351,7 +354,7 @@ table.modlog {
 }
 table.modlog tr td {
 	text-align: left;
-	margin: 0px;
+	margin: 0;
 	padding: 4px 15px 0 0;
 }
 table.modlog tr th {
@@ -385,19 +388,15 @@ div.blotter {
 	font-weight: bold;
 	text-align: center;
 }
-
-/* Uboachan stuff */
-div.styles-sidebar {
-	text-align: center;
-	padding-bottom: 0px;
-}
-div.styles-sidebar a {
-	margin: 0 5px;
+table.mod.config-editor {
+	font-size: 9pt;
+	width: 100%;
 }
-div.styles-sidebar a.selected {
-	text-decoration: none;
+table.mod.config-editor td {
+	text-align: left;
+	padding: 5px;
+	border-bottom: 1px solid #98e;
 }
-.category {
-	background: #98E;
-	color: black;
+table.mod.config-editor input[type="text"] {
+	width: 98%;
 }
diff --git a/templates/generic_page.html b/templates/generic_page.html
new file mode 100644
index 00000000..e834aad0
--- /dev/null
+++ b/templates/generic_page.html
@@ -0,0 +1,71 @@
+<!doctype html>
+<html>
+<head>
+	{% block head %}
+		<link rel="stylesheet" media="screen" href="{{ config.url_stylesheet }}">
+		{% if config.url_favicon %}<link rel="shortcut icon" href="{{ config.url_favicon }}">{% endif %}
+		<title>{{ board.url }} - {{ board.name }}</title>
+		<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
+		<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=yes">
+		{% if config.meta_keywords %}<meta name="keywords" content="{{ config.meta_keywords }}">{% endif %}
+		{% if config.default_stylesheet.1 != '' %}<link rel="stylesheet" type="text/css" id="stylesheet" href="{{ config.uri_stylesheets }}{{ config.default_stylesheet.1 }}">{% endif %}
+		{% if not nojavascript %}
+			<script type="text/javascript" src="{{ config.url_javascript }}"></script>
+			{% if not config.additional_javascript_compile %}
+			{% for javascript in config.additional_javascript %}<script type="text/javascript" src="{{ config.additional_javascript_url }}{{ javascript }}"></script>{% endfor %}
+			{% endif %}
+		{% endif %}
+		{% if config.recaptcha %}<style type="text/css">{% raw %}
+			.recaptcha_image_cell {
+				background: none !important;
+			}
+			table.recaptchatable {
+				border: none !important;
+			}
+			#recaptcha_logo, #recaptcha_tagline {
+				display: none;
+				float: right;
+			}
+			.recaptchatable a {
+				display: block;
+			}
+		{% endraw %}</style>{% endif %}
+	{% endblock %}
+</head>
+<body>	
+	{{ boardlist.top }}
+	{% if pm %}<div class="top_notice">You have <a href="?/PM/{{ pm.id }}">an unread PM</a>{% if pm.waiting > 0 %}, plus {{ pm.waiting }} more waiting{% endif %}.</div><hr />{% endif %}
+	{% if config.url_banner %}<img class="banner" src="{{ config.url_banner }}" {% if config.banner_width or config.banner_height %}style="{% if config.banner_width %}width:{{ config.banner_width }}px{% endif %};{% if config.banner_width %}height:{{ config.banner_height }}px{% endif %}" {% endif %}alt="" />{% endif %}
+	<header>
+		<h1>{{ board.url }} - {{ board.name }}</h1>
+		<div class="subtitle">
+			{% if board.title %}
+				{{ board.title|e }}
+			{% endif %}
+			{% if mod %}<p><a href="?/">{% trans %}Return to dashboard{% endtrans %}</a></p>{% endif %}
+		</div>
+	</header>
+	
+	{% include 'post_form.html' %}
+	
+	{% if config.blotter %}<hr /><div class="blotter">{{ config.blotter }}</div>{% endif %}
+	<hr />
+	<form name="postcontrols" action="{{ config.post_url }}" method="post">
+	<input type="hidden" name="board" value="{{ board.uri }}" />
+	{% if mod %}<input type="hidden" name="mod" value="1" />{% endif %}
+	{{ body }}
+	{% include 'report_delete.html' %}
+	</form>
+	<div class="pages">{{ btn.prev }} {% for page in pages %}
+		 [<a {% if page.selected %}class="selected"{% endif %}{% if not page.selected %}href="{{ page.link }}"{% endif %}>{{ page.num }}</a>]{% if loop.last %} {% endif %}
+	{% endfor %} {{ btn.next }}</div>
+	{{ boardlist.bottom }}
+	<footer>
+		<p class="unimportant" style="margin-top:20px;text-align:center;">Powered by <a href="http://tinyboard.org/">Tinyboard</a> {{ config.version }} | <a href="http://tinyboard.org/">Tinyboard</a> Copyright &copy; 2010-2012 Tinyboard Development Group</p>
+		{% for footer in config.footer %}<p class="unimportant" style="text-align:center;">{{ footer }}</p>{% endfor %}
+	</footer>
+	<script type="text/javascript">{% raw %}
+		ready();
+	{% endraw %}</script>
+</body>
+</html>
diff --git a/templates/index.html b/templates/index.html
index e0fa6fe0..a28724a1 100644
--- a/templates/index.html
+++ b/templates/index.html
@@ -1,11 +1,11 @@
 <!doctype html>

 <html>

 <head>

+	<meta charset="utf-8">

 	<link rel="stylesheet" media="screen" href="{{ config.url_stylesheet }}">

 	{% if config.url_favicon %}<link rel="shortcut icon" href="{{ config.url_favicon }}">{% endif %}

 	<title>{{ board.url }} - {{ board.name }}</title>

-	<meta http-equiv="Content-Type" content="text/html; charset=utf-8">

-	<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=yes">

+	<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">

 	{% if config.meta_keywords %}<meta name="keywords" content="{{ config.meta_keywords }}">{% endif %}

 	{% if config.default_stylesheet.1 != '' %}<link rel="stylesheet" type="text/css" id="stylesheet" href="{{ config.uri_stylesheets }}{{ config.default_stylesheet.1 }}">{% endif %}

 	{% if not nojavascript %}

@@ -35,10 +35,10 @@
 	{% if pm %}<div class="top_notice">You have <a href="?/PM/{{ pm.id }}">an unread PM</a>{% if pm.waiting > 0 %}, plus {{ pm.waiting }} more waiting{% endif %}.</div><hr />{% endif %}

 	{% if config.url_banner %}<img class="banner" src="{{ config.url_banner }}" {% if config.banner_width or config.banner_height %}style="{% if config.banner_width %}width:{{ config.banner_width }}px{% endif %};{% if config.banner_width %}height:{{ config.banner_height }}px{% endif %}" {% endif %}alt="" />{% endif %}

 	<header>

-		<h1>{{ board.url }} - {{ board.name }}</h1>

+		<h1>{{ board.url }} - {{ board.title|e }}</h1>

 		<div class="subtitle">

-			{% if board.title %}

-				{{ board.title }}

+			{% if board.subtitle %}

+				{{ board.subtitle|e }}

 			{% endif %}

 			{% if mod %}<p><a href="?/">{% trans %}Return to dashboard{% endtrans %}</a></p>{% endif %}

 		</div>

diff --git a/templates/mod/ban_form.html b/templates/mod/ban_form.html
new file mode 100644
index 00000000..5d5f2b81
--- /dev/null
+++ b/templates/mod/ban_form.html
@@ -0,0 +1,91 @@
+{% if post and board %}
+	{% set action = '?/' ~ board ~ '/ban/' ~ post %}
+{% else %}
+	{% set action = '?/ban' %}
+{% endif %}
+
+<form action="{{ action }}" method="post">
+	{% if redirect %}
+		<input type="hidden" name="redirect" value="{{ redirect|e }}">
+	{% endif %}
+	{% if post and board %}
+		<input type="hidden" name="delete" value="{% if delete %}1{% else %}0{% endif %}">
+	{% endif %}
+	
+	<table>
+		
+		<tr>
+			<th>
+				<label for="ip">{% trans 'IP' %} <span class="unimportant">{% trans '(or subnet)' %}</span></label>
+			</th>
+			<td>
+				{% if not hide_ip %}
+					<input type="text" name="ip" id="ip" size="30" maxlength="40" value="{{ ip }}">
+				{% else %}
+					<em>{% trans 'hidden' %}</em>
+				{% endif %}
+			</td>
+		</tr>
+		<tr>
+			<th>
+				<label for="reason">{% trans 'Reason' %}</label>
+			</th>
+			<td>
+				<textarea name="reason" id="reason" rows="5" cols="30">{{ reason|e }}</textarea>
+			</td>
+		</tr>
+		{% if post and board and not delete %}
+			<tr>
+				<th>
+					<label for="reason">{% trans 'Message' %}</label>
+				</th>
+				<td>
+					<input type="checkbox" id="public_message" name="public_message"> 
+					<input type="text" name="message" id="message" size="35" maxlength="200" value="{{ config.mod.default_ban_message|e }}"> 
+					<span class="unimportant">({% trans 'public; attached to post' %})</span>
+					<script type="text/javascript">
+						document.getElementById('message').disabled = true;
+						document.getElementById('public_message').onchange = function() {
+							document.getElementById('message').disabled = !this.checked;
+						}
+					</script>
+				</td>
+			</tr>
+		{% endif %}
+		<tr>
+			<th>
+				<label for="length">{% trans 'Length' %}</label>
+			</th>
+			<td>
+				<input type="text" name="length" id="length" size="20" maxlength="40"> 
+					<span class="unimportant">(eg. "2d1h30m" or "2 days")</span></td>
+			</tr>
+		<tr>
+			<th>{% trans 'Board' %}</th>
+			<td>
+				<ul style="list-style:none;padding:2px 5px">
+					<li>
+						<input type="radio" name="board" value="*" id="ban-allboards" checked> 
+						<label style="display:inline" for="ban-allboards">
+							<em>{% trans 'all boards' %}</em>
+						</label>
+					</li>
+					
+					{% for board in boards %}
+						<li>
+							<input type="radio" name="board" value="{{ board.uri }}" id="ban-board-{{ board.uri }}"> 
+							<label style="display:inline" for="ban-board-{{ board.uri }}">
+								{{ config.board_abbreviation|sprintf(board.uri) }} - {{ board.title|e }}
+							</label>
+						</li>
+					{% endfor %}
+				</ul>
+			</td>
+		</tr>
+		<tr>
+			<td></td>
+			<td><input name="new_ban" type="submit" value="{% trans 'New Ban' %}"></td>
+		</tr>
+	</table>
+</form>
+
diff --git a/templates/mod/ban_list.html b/templates/mod/ban_list.html
new file mode 100644
index 00000000..2edb9cdf
--- /dev/null
+++ b/templates/mod/ban_list.html
@@ -0,0 +1,95 @@
+{% if bans|count == 0 %}
+	<p style="text-align:center" class="unimportant">({% trans 'There are no active bans.' %})</p>
+{% else %}
+	<form action="" method="post">
+		<table class="mod" style="width:100%">
+			<tr>
+				<th>{% trans 'IP address/mask' %}</th>
+				<th>{% trans 'Reason' %}</th>
+				<th>{% trans 'Board' %}</th>
+				<th>{% trans 'Set' %}</th>
+				<th>{% trans 'Duration' %}</th>
+				<th>{% trans 'Expires' %}</th>
+				<th>{% trans 'Staff' %}</th>
+			</tr>
+			{% for ban in bans %}
+				<tr{% if ban.expires != 0 and ban.expires < time() %} style="text-decoration:line-through"{% endif %}>
+					<td style="white-space: nowrap">
+						<input type="checkbox" name="ban_{{ ban.id }}"> 
+						{% if ban.real_ip %}
+							<a href="?/IP/{{ ban.ip }}">{{ ban.ip }}</a>
+						{% else %}
+							{{ ban.ip|e }}
+						{% endif %}
+					</td>
+					<td>
+						{% if ban.reason %}
+							{{ ban.reason }}
+						{% else %}
+							-
+						{% endif %}
+					</td>
+					<td  style="white-space: nowrap">
+						{% if ban.board %}
+							{{ config.board_abbreviation|sprintf(ban.board) }}
+						{% else %}
+							<em>{% trans 'all boards' %}</em>
+						{% endif %}					
+					</td>
+					<td style="white-space: nowrap">
+						<span title="{{ ban.set|date(config.post_date) }}">
+							{{ ban.set|ago }} ago
+						</span>
+					</td>
+					<td style="white-space: nowrap">
+						{% if ban.expires == 0 %}
+							-
+						{% else %}
+							{{ (ban.expires - ban.set + time()) | until }}
+						{% endif %}
+					</td>
+					<td style="white-space: nowrap">
+						{% if ban.expires == 0 %}
+							<em>{% trans 'never' %}</em>
+						{% else %}
+							{{ ban.expires|date(config.post_date) }}
+							{% if ban.expires > time() %}
+								 <small>(in {{ ban.expires|until }})</small>
+							{% endif %}
+						{% endif %}
+					</td>
+					<td>
+						{% if ban.username %}
+							{% if mod|hasPermission(config.mod.view_banstaff) %}
+								<a href="?/new_PM/{{ ban.username|e }}">{{ ban.username|e }}</a>
+							{% else %}
+								{% if mod|hasPermission(config.mod.view_banquestionmark) %}
+									<em>?</em>
+								{% else %}
+							
+								{% endif %}
+							{% endif %}
+						{% elseif ban.mod == -1 %}
+							<em>system</em>
+						{% else %}
+							<em>{% trans 'deleted?' %}</em>
+						{% endif %}
+					</td>
+				</tr>
+			{% endfor %}
+		</table>
+		
+		<p style="text-align:center">
+			<input type="submit" name="unban" value="{% trans 'Unban selected' %}">
+		</p>
+	</form>
+{% endif %}
+
+{% if count > bans|count %}
+	<p class="unimportant" style="text-align:center;word-wrap:break-word">
+		{% for i in range(0, (count - 1) / config.mod.modlog_page) %}
+			<a href="?/bans/{{ i + 1 }}">[{{ i + 1 }}]</a> 
+		{% endfor %}
+	</p>
+{% endif %}
+
diff --git a/templates/mod/board.html b/templates/mod/board.html
new file mode 100644
index 00000000..0775e421
--- /dev/null
+++ b/templates/mod/board.html
@@ -0,0 +1,44 @@
+{% if new %}
+	{% set action = '?/new-board' %}
+{% else %}
+	{% set action = '?/edit/' ~ board.uri %}
+{% endif %}
+
+<form action="{{ action }}" method="post">
+	<table>
+		<tr>
+			<th>{% trans 'URI' %}</th>
+			<td>
+				{% if not new %}
+					{{ config.board_abbreviation|sprintf(board.uri) }}
+				{% else %}
+					/<input size="10" maxlength="255" type="text" name="uri" autocomplete="off">/
+				{% endif %}
+			</td>
+		</tr>
+		<tr>
+			<th>{% trans 'Title' %}</th>
+			<td>
+				<input size="25" type="text" name="title" value="{{ board.title|e }}" autocomplete="off">
+			</td>
+		</tr>
+		<tr>
+			<th>{% trans 'Subtitle' %}</th>
+			<td>
+				<input size="25" type="text" name="subtitle" value="{{ board.subtitle|e }}" autocomplete="off">
+			</td>
+		</tr>
+	</table>
+	
+	<ul style="padding:0;text-align:center;list-style:none">
+		{% if new %}
+			<li><input type="submit" value="{% trans 'Create board' %}"></li>
+		{% else %}
+			<li><input type="submit" value="{% trans 'Save changes' %}"></li>
+			{% if mod|hasPermission(config.mod.deleteboard) %}
+				<li><input name="delete" onclick="return confirm('Are you sure you want to permanently delete this board?');" type="submit" value="{% trans 'Delete board' %}"></li>
+			{% endif %}
+		{% endif %}
+	</ul>
+</form>
+
diff --git a/templates/mod/config-editor.html b/templates/mod/config-editor.html
new file mode 100644
index 00000000..ec7213bb
--- /dev/null
+++ b/templates/mod/config-editor.html
@@ -0,0 +1,56 @@
+<form method="post" action="">
+	<table class="mod config-editor">
+		<tr>
+			<th class="minimal">Name</th>
+			<th>Value</th>
+			<th class="minimal">Type</th>
+			<th>Description</th>
+		</tr>
+		{% for var in conf if var.type != 'array' %}
+			{% if var.name|count == 1 %}
+				{% set name = 'cf_' ~ var.name %}
+			{% else %}
+				{% set name = 'cf_' ~ var.name|join('/') %}
+			{% endif %}
+			
+			<tr>
+				<th class="minimal">
+					{% if var.name|count == 1 %}
+						{{ var.name }}
+					{% else %}
+						{{ var.name|join(' &rarr; ') }}
+					{% endif %}
+				</th>
+				
+				<td>
+					{% if var.type == 'string' %}
+						<input name="{{ name }}" type="text" value="{{ var.value|e }}">
+					{% elseif var.type == 'integer' %}
+						<input name="{{ name }}" type="number" value="{{ var.value|e }}">
+					{% elseif var.type == 'boolean' %}
+						<input name="{{ name }}" type="checkbox" {% if var.value %}checked{% endif %}>
+					{% else %}
+						?
+					{% endif %}
+					
+					{% if var.type == 'integer' or var.type == 'boolean' %}
+					 <small>Default: <code>{{ var.default }}</code></small>
+					{% endif %}
+				</td>
+				
+				<td class="minimal">
+					{{ var.type|e }}
+				</td>
+				
+				<td>
+					{{ var.comment|join('<br>') }}
+				</td>
+			</tr>
+		{% endfor %}
+	</table>
+	
+	<ul style="padding:0;text-align:center;list-style:none">
+		<li><input name="save" type="submit" value="{% trans 'Save changes' %}"></li>
+	</ul>
+</form>
+
diff --git a/templates/mod/confirm.html b/templates/mod/confirm.html
new file mode 100644
index 00000000..6dc4d66a
--- /dev/null
+++ b/templates/mod/confirm.html
@@ -0,0 +1,7 @@
+<p style="text-align:center;font-size:1.1em">
+	{% trans 'Are you sure you want to do that?' %} <a href="?/{{ request }}">{% trans 'Click to proceed to' %} ?/{{ request }}</a>.
+</p>
+<p class="unimportant" style="text-align:center">
+	{% trans 'You are seeing this message because we were unable to serve a confirmation dialog, probably due to Javascript being disabled.' %}
+</p>
+
diff --git a/templates/mod/dashboard.html b/templates/mod/dashboard.html
new file mode 100644
index 00000000..30742dc1
--- /dev/null
+++ b/templates/mod/dashboard.html
@@ -0,0 +1,139 @@
+<fieldset>
+	<legend>{% trans 'Boards' %}</legend>
+	
+	<ul>
+		{% for board in boards %}
+			<li>
+				<a href="?/{{ config.board_path|sprintf(board.uri) }}{{ config.file_index }}">{{ config.board_abbreviation|sprintf(board.uri) }}</a>
+					 - 
+				{{ board.title|e }}
+				{% if board.subtitle %}
+					 <small>&mdash; {{ board.subtitle|e }}</small>
+				{% endif %}
+				{% if mod|hasPermission(config.mod.manageboards) %}
+					 <a href="?/edit/{{ board.uri }}"><small>[{% trans 'edit' %}]</small></a>
+				{% endif %}
+			</li>
+		{% endfor %}
+		
+		{% if mod|hasPermission(config.mod.newboard) %}
+			<li style="margin-top:15px"><a href="?/new-board"><strong>{% trans 'Create new board' %}</strong></a></li>
+		{% endif %}
+	</ul>
+</fieldset>
+
+<fieldset>
+	<legend>{% trans 'Messages' %}</legend>
+	<ul>
+		{% if mod|hasPermission(config.mod.noticeboard) %}
+			{% if noticeboard|count > 0 %}
+				<li>
+					{% trans 'Noticeboard' %}:
+					<ul>
+						{% for post in noticeboard %}
+							<li>
+								<a href="?/noticeboard#{{ post.id }}">
+									{% if post.subject %}
+										{{ post.subject|e }}
+									{% else %}
+										<em>{% trans 'no subject' %}</em>
+									{% endif %}
+								</a> 
+								<small class="unimportant">
+									&mdash; by 
+									{% if post.username %}
+										{{ post.username|e }}
+									{% else %}
+										<em>deleted?</em>
+									{% endif %} 
+									at 
+									{{ post.time|date(config.post_date) }} 
+								</small>
+							</li>
+						{% endfor %}
+					</ul>
+				</li>
+			{% endif %}
+			<li><a href="?/noticeboard">{% trans 'View all entries' %}</a></li>
+		{% endif %}
+		<li><a href="?/news">{% trans 'News' %}</a></li>
+		<li>
+			<a href="?/inbox">
+				{% trans 'PM inbox' %} 
+				{% if unread_pms > 0 %}<strong>{%endif %}({{ unread_pms }} unread){% if unread_pms > 0 %}</strong>{%endif %}
+			</a>
+		</li>
+	</ul>
+</fieldset>
+
+<fieldset>
+	<legend>{% trans 'Administration' %}</legend>
+	
+	<ul>
+		{% if mod|hasPermission(config.mod.reports) %}
+			<li>
+				{% if reports > 0 %}<strong>{% endif %}
+					<a href="?/reports">{% trans 'Report queue' %} ({{ reports }})</a>
+				{% if reports > 0 %}</strong>{% endif %}
+			</li>
+		{% endif %}
+		{% if mod|hasPermission(config.mod.view_banlist) %}
+			<li><a href="?/bans">{% trans 'Ban list' %}</a></li>
+		{% endif %}
+		{% if mod|hasPermission(config.mod.manageusers) %}
+			<li><a href="?/users">{% trans 'Manage users' %}</a></li>
+		{% elseif mod|hasPermission(config.mod.change_password) %}
+			<li><a href="?/users/{{ mod.id }}">{% trans 'Change password' %}</a></li>
+		{% endif %}
+		{% if mod|hasPermission(config.mod.themes) %}
+			<li><a href="?/themes">{% trans 'Manage themes' %}</a></li>
+		{% endif %}
+		{% if mod|hasPermission(config.mod.modlog) %}
+			<li><a href="?/log">{% trans 'Moderation log' %}</a></li>
+		{% endif %}
+		{% if mod|hasPermission(config.mod.rebuild) %}
+			<li><a href="?/rebuild">{% trans 'Rebuild' %}</a></li>
+		{% endif %}
+		{% if mod|hasPermission(config.mod.show_config) %}
+			<li><a href="?/config">{% trans 'Configuration' %}</a></li>
+		{% endif %}
+		
+	</ul>
+</fieldset>
+
+<fieldset>
+	<legend>{% trans 'Search' %}</legend>
+	
+	{# TODO #}
+</fieldset>
+
+{% if config.debug %}
+	<fieldset>
+		<legend>{% trans 'Debug' %}</legend>
+		<ul>
+			<li><a href="?/debug/antispam">{% trans 'Anti-spam' %}</a></li>
+		</ul>
+	</fieldset>
+{% endif %}
+
+{% if newer_release %}
+	<fieldset>
+		<legend>Update</legend>
+		<ul>
+			<li>
+				A newer version of Tinyboard 
+				(<strong>v{{ newer_release.massive }}.{{ newer_release.major }}.{{ newer_release.minor }}</strong>) is available! 
+				See <a href="http://tinyboard.org">http://tinyboard.org/</a> for upgrade instructions.
+			</li>
+		</ul>
+	</fieldset>
+{% endif %}
+
+<fieldset>
+	<legend>{% trans 'User account' %}</legend>
+	
+	<ul>
+		<li><a href="?/logout">{% trans 'Logout' %}</a></li>
+	</ul>
+</fieldset>
+
diff --git a/templates/mod/debug/antispam.html b/templates/mod/debug/antispam.html
new file mode 100644
index 00000000..a846bc17
--- /dev/null
+++ b/templates/mod/debug/antispam.html
@@ -0,0 +1,65 @@
+<p style="text-align:center">
+	Most used (in active):
+</p>
+<table class="modlog" style="width:700px;margin:auto">
+	<tr>
+		<th>Board</th>
+		<th>Thread</th>
+		<th>Hash (SHA1)</th>
+		<th>Created</th>
+		<th>Expires</th>
+		<th>Passed</th>
+	</tr>
+	{% for hash in top %}
+		<tr>
+			<td>{{ config.board_abbreviation|sprintf(hash.board) }}</td>
+			<td>
+				{% if hash.thread %}
+					{{ hash.thread }}
+				{% else %}
+					-
+				{% endif %}</td>
+			<td>
+				<small><code>{{ hash.hash }}</code></small>
+			</td>
+			<td>
+				<span title="{{ hash.created|date(config.post_date) }}">{{ hash.created|ago }} ago</span>
+			</td>
+			<td>
+				{% if hash.expires %}
+					<span title="{{ hash.expires|date(config.post_date) }}">
+						{{ hash.expires|until }}
+					</span>
+				{% else %}
+					-
+				{% endif %}
+			</td>
+			<td>{{ hash.passed }}</td>
+		</tr>
+	{% endfor %}
+</table>
+<p style="text-align:center">
+	Total: <strong>{{ total }}</strong> (<strong>{{ expiring }}</strong> set to expire)
+</p>
+
+<form method="post" action="?/debug/antispam">
+	<table class="modlog" style="width:1%;white-space:nowrap;margin:auto">
+		<tr>
+			<th>Board</th>
+			<th>Thread</th>
+			<th></th>
+		</tr>
+		<tr>
+			<td>
+				<input type="text" name="board" style="width:90px" value="{{ board }}">
+			</td>
+			<td>
+				<input type="text" name="thread" style="width:90px" value="{{ thread }}">
+			</td>
+			<td>
+				<input type="submit" name="filter" value="Filter"> 
+				<input type="submit" name="purge" value="Purge">
+			</td>
+		</tr>
+	</table>
+</form>
diff --git a/templates/mod/inbox.html b/templates/mod/inbox.html
new file mode 100644
index 00000000..97afe446
--- /dev/null
+++ b/templates/mod/inbox.html
@@ -0,0 +1,36 @@
+{% if messages|count == 0 %}
+	<p style="text-align:center" class="unimportant">({% trans 'No private messages for you.' %})</p>
+{% else %}
+	<table class="modlog">
+		<tr>
+			<th>{% trans 'ID' %}</th>
+			<th>{% trans 'From' %}</th>
+			<th>{% trans 'Date' %}</th>
+			<th>{% trans 'Message snippet' %}</th>
+		</tr>
+		{% for message in messages %}
+			<tr{% if message.unread %} style="font-weight:bold"{% endif %}>
+				<td class="minimal">
+					<a href="?/PM/{{ message.id }}">
+						{{ message.id }}
+					</a>
+				</td>
+				<td class="minimal">
+					{% if message.username %}
+						<a href="?/new_PM/{{ message.username|e }}">{{ message.username|e }}</a>
+					{% else %}
+						<em>{% trans 'deleted?' %}</em>
+					{% endif %}
+				</td>
+				<td class="minimal">
+					{{ message.time|date(config.post_date) }}
+				</td>
+				<td>
+					<a href="?/PM/{{ message.id }}">
+						{{ message.snippet }}
+					</a>
+				</td>
+			</tr>
+		{% endfor %}
+	</table>
+{% endif %}
diff --git a/templates/mod/log.html b/templates/mod/log.html
new file mode 100644
index 00000000..dca1b2d0
--- /dev/null
+++ b/templates/mod/log.html
@@ -0,0 +1,47 @@
+<table class="modlog">
+	<tr>
+		<th>{% trans 'Staff' %}</th>
+		<th>{% trans 'IP address' %}</th>
+		<th>{% trans 'Time' %}</th>
+		<th>{% trans 'Board' %}</th>
+		<th>{% trans 'Action' %}</th>
+	</tr>
+	{% for log in logs %}
+		<tr>
+			<td class="minimal">
+				{% if log.username %}
+					<a href="?/new_PM/{{ log.username|e }}">{{ log.username|e }}</a>
+				{% elseif log.mod == -1 %}
+					<em>system</em>
+				{% else %}
+					<em>{% trans 'deleted?' %}</em>
+				{% endif %}
+			</td>
+			<td class="minimal">
+				<a href="?/IP/{{ log.ip }}">{{ log.ip }}</a>
+			</td>
+			<td class="minimal">
+				<span title="{{ log.time|date(config.post_date) }}">{{ log.time|ago }}</span>
+			</td>
+			<td class="minimal">
+				{% if log.board %}
+					<a href="?/{{ config.board_path|sprintf(log.board) }}{{ config.file_index }}">{{ config.board_abbreviation|sprintf(log.board) }}</a>
+				{% else %}
+					-
+				{% endif %}
+			</td>
+			<td>
+				{{ log.text }}
+			</td>
+		</tr>
+	{% endfor %}
+</table>
+
+{% if count > logs|count %}
+	<p class="unimportant" style="text-align:center;word-wrap:break-word">
+		{% for i in range(0, (count - 1) / config.mod.modlog_page) %}
+			<a href="?/log/{{ i + 1 }}">[{{ i + 1 }}]</a> 
+		{% endfor %}
+	</p>
+{% endif %}
+
diff --git a/templates/login.html b/templates/mod/login.html
index 709bad86..43a28d56 100644
--- a/templates/login.html
+++ b/templates/mod/login.html
@@ -1,18 +1,17 @@
 {% if error %}<h2 style="text-align:center">{{ error }}</h2>{% endif %}

 <form action="" method="post">

-{% if redirect %}<input type="hidden" name="redirect" value="{{ redirect }}" />{% endif %}

 <table style="margin-top:25px;">

 	<tr>

 		<th>

-			{% trans %}Username{% endtrans %}

+			{% trans 'Username' %}

 		</th>

 		<td>

-			<input type="text" name="username" size="20" maxlength="30" value="{{ username }}">

+			<input type="text" name="username" size="20" maxlength="30" value="{{ username|e }}">

 		</td>

 	</tr>

 	<tr>

 		<th>

-			{% trans %}Password{% endtrans %}

+			{% trans 'Password' %}

 		</th>

 		<td>

 			<input type="password" name="password" size="20" maxlength="30" value="">

diff --git a/templates/mod/move.html b/templates/mod/move.html
new file mode 100644
index 00000000..802903b2
--- /dev/null
+++ b/templates/mod/move.html
@@ -0,0 +1,41 @@
+<form action="?/{{ board }}/move/{{ post }}" method="post">	
+	<table>
+		<tr>
+			<th>
+				{% trans 'Thread ID' %}
+			</th>
+			<td>
+				&gt;&gt;&gt;{{ config.board_abbreviation|sprintf(board) }}{{ post }}
+			</td>
+		</tr>
+		<tr>
+			<th>
+				{% trans 'Leave shadow thread' %}
+			</th>
+			<td>
+				<input type="checkbox" name="shadow" checked> 
+				<span class="unimportant">({% trans 'locks thread; replies to it with a link.' %})</span>
+				</td>
+		</tr>
+		<tr>
+			<th>{% trans 'Target board' %}</th>
+			<td>
+				<ul style="list-style:none;padding:0">
+					{% for targetboard in boards if targetboard.uri != board %}
+						<li>
+							<input type="radio" name="board" value="{{ targetboard.uri }}" id="ban-board-{{ targetboard.uri }}"> 
+							<label style="display:inline" for="ban-board-{{ targetboard.uri }}">
+								{{ config.board_abbreviation|sprintf(targetboard.uri) }} - {{ targetboard.title|e }}
+							</label>
+						</li>
+					{% endfor %}
+				</ul>
+			</td>
+		</tr>
+	</table>
+	
+	<ul style="padding:0;text-align:center;list-style:none">
+		<li><input type="submit" value="{% trans 'Move thread' %}"></li>
+	</ul>
+</form>
+
diff --git a/templates/mod/new_pm.html b/templates/mod/new_pm.html
new file mode 100644
index 00000000..3fd78ac6
--- /dev/null
+++ b/templates/mod/new_pm.html
@@ -0,0 +1,18 @@
+<form action="?/new_PM/{{ username|e }}" method="post">
+	<table>
+		<tr>
+			<th>To</th>
+			{% if mod|hasPermission(config.mod.editusers) %}
+				<td><a href="?/users/{{ id }}">{{ username|e }}</a></td>
+			{% else %}
+				<td>{{ username|e }}</td>
+			{% endif %}
+		</tr>
+		<tr>
+			<th>Message</th>
+			<td><textarea name="message" rows="10" cols="40">{{ message }}</textarea></td>
+		</tr>
+	</table>
+
+	<p style="text-align:center"><input type="submit" value="{% trans 'Send message' %}"></p>
+</form>
diff --git a/templates/mod/news.html b/templates/mod/news.html
new file mode 100644
index 00000000..b6c35798
--- /dev/null
+++ b/templates/mod/news.html
@@ -0,0 +1,70 @@
+{% if mod|hasPermission(config.mod.news) %}
+	<fieldset>
+		<legend>{% trans 'New post' %}</legend>
+		<form style="margin:0" action="" method="post">
+			<table>
+				<tr>
+					<th>
+						{% if mod|hasPermission(config.mod.news_custom) %}
+							<label for="name">{% trans 'Name' %}</label>
+						{% else %}
+							{% trans 'Name' %}
+						{% endif %}
+					</th>
+					<td>
+						{% if mod|hasPermission(config.mod.news_custom) %}
+							<input type="text" size="55" name="name" id="name" value="{{ mod.username|e }}">
+						{% else %}
+							{{ mod.username|e }}
+						{% endif %}
+					</td>
+				</tr>
+				<tr>
+					<th><label for="subject">{% trans 'Subject' %}</label></th>
+					<td><input type="text" size="55" name="subject" id="subject"></td>
+				</tr>
+				<tr>
+					<th><label for="body">{% trans 'Body' %}</label></th>
+					<td><textarea name="body" id="body" style="width:100%;height:100px"></textarea></td>
+				</tr>
+			</table>
+			<p style="text-align:center">
+				<input type="submit" value="{% trans 'Post news entry' %}">
+			</p>
+		</form>
+	</fieldset>
+{% endif %}
+
+{% for post in news %}
+	<div class="ban">
+		{% if mod|hasPermission(config.mod.news_delete) %}
+			<span style="float:right;padding:2px">
+				<a class="unimportant" href="?/news/delete/{{ post.id }}">[{% trans 'delete' %}]</a>
+			</span>
+		{% endif %}
+		<h2 id="{{ post.id }}">
+			<small class="unimportant">
+				<a href="#{{ post.id }}">#</a>
+			</small> 
+			{% if post.subject %}
+				{{ post.subject|e }}
+			{% else %}
+				<em>{% trans 'no subject' %}</em>
+			{% endif %} 
+			<small class="unimportant">
+				&mdash; {% trans 'by' %} {{ post.name }} {% trans 'at' %} {{ notice.time|date(config.post_date) }} 
+			</small>
+		</h2>
+		<p>
+			{{ post.body }}
+		</p>
+	</div>
+{% endfor %}
+
+{% if count > news|count %}
+	<p class="unimportant" style="text-align:center;word-wrap:break-word">
+		{% for i in range(0, (count - 1) / config.mod.news_page) %}
+			<a href="?/news/{{ i + 1 }}">[{{ i + 1 }}]</a> 
+		{% endfor %}
+	</p>
+{% endif %}
diff --git a/templates/mod/noticeboard.html b/templates/mod/noticeboard.html
new file mode 100644
index 00000000..463b8430
--- /dev/null
+++ b/templates/mod/noticeboard.html
@@ -0,0 +1,65 @@
+{% if mod|hasPermission(config.mod.noticeboard_post) %}
+	<fieldset>
+		<legend>{% trans 'New post' %}</legend>
+		<form style="margin:0" action="" method="post">
+			<table>
+				<tr>
+					<th>{% trans 'Name' %}</th>
+					<td>{{ mod.username|e }}</td>
+				</tr>
+				<tr>
+					<th><label for="subject">{% trans 'Subject' %}</label></th>
+					<td><input type="text" size="55" name="subject" id="subject" /></td>
+				</tr>
+				<tr>
+					<th>{% trans 'Body' %}</th>
+					<td><textarea name="body" style="width:100%;height:100px"></textarea></td>
+				</tr>
+			</table>
+			<p style="text-align:center">
+				<input type="submit" value="{% trans 'Post to noticeboard' %}" />
+			</p>
+		</form>
+	</fieldset>
+{% endif %}
+
+{% for post in noticeboard %}
+	<div class="ban">
+		{% if mod|hasPermission(config.mod.noticeboard_delete) %}
+			<span style="float:right;padding:2px">
+				<a class="unimportant" href="?/noticeboard/delete/{{ post.id }}">[{% trans 'delete' %}]</a>
+			</span>
+		{% endif %}
+		<h2 id="{{ post.id }}">
+			<small class="unimportant">
+				<a href="#{{ post.id }}">#</a>
+			</small> 
+			{% if post.subject %}
+				{{ post.subject|e }}
+			{% else %}
+				<em>{% trans 'no subject' %}</em>
+			{% endif %} 
+			<small class="unimportant">
+				&mdash; {% trans 'by' %} 
+				{% if post.username %}
+					{{ post.username|e }}
+				{% else %}
+					<em>{% trans 'deleted?' %}</em>
+				{% endif %} 
+				{% trans 'at' %} 
+				{{ post.time|date(config.post_date) }} 
+			</small>
+		</h2>
+		<p>
+			{{ post.body }}
+		</p>
+	</div>
+{% endfor %}
+
+{% if count > noticeboard|count %}
+	<p class="unimportant" style="text-align:center;word-wrap:break-word">
+		{% for i in range(0, (count - 1) / config.mod.noticeboard_page) %}
+			<a href="?/noticeboard/{{ i + 1 }}">[{{ i + 1 }}]</a> 
+		{% endfor %}
+	</p>
+{% endif %}
diff --git a/templates/mod/pm.html b/templates/mod/pm.html
new file mode 100644
index 00000000..c62cae58
--- /dev/null
+++ b/templates/mod/pm.html
@@ -0,0 +1,44 @@
+<form action="" method="post">
+	<table>
+		<tr>
+			<th>{% trans 'From' %}</th>
+			{% if username %}
+				<td><a href="?/new_PM/{{ username|e }}">{{ username|e }}</a></td>
+			{% else %}
+				<td><em>{% trans 'deleted?' %}</em></td>
+			{% endif %}
+		</tr>
+		{% if to != mod.id %}
+			<tr>
+				<th>To</th>
+				{% if to_username %}
+					<td><a href="?/new_PM/{{ to_username|e }}">{{ to_username|e }}</a></td>
+				{% else %}
+					<td><em>{% trans 'deleted?' %}</em></td>
+				{% endif %}
+			</tr>
+		{% endif %}
+		<tr>
+			<th>{% trans 'Date' %}</th>
+			<td>{{ time|date(config.post_date) }} <small>({{ time|ago }} ago)</small></td>
+			
+		</tr>
+		<tr>
+			<th>{% trans 'Message' %}</th>
+			<td>{{ message }}</td>
+		</tr>
+	</table>
+	
+	<ul style="list-style:none;text-align:center;padding:0">
+		<li style="padding:5px 0">
+			<input type="submit" name="delete" value="{% trans 'Delete forever' %}">
+		</li>
+		{% if mod|hasPermission(config.mod.create_pm) %}
+			<li style="padding:5px 0">
+				<a href="?/PM/{{ id }}/reply">
+					{% trans 'Reply with quote' %}
+				</a>
+			</li>
+		{% endif %}
+	</ul>
+</form>
diff --git a/templates/mod/rebuild.html b/templates/mod/rebuild.html
new file mode 100644
index 00000000..7c6b28ba
--- /dev/null
+++ b/templates/mod/rebuild.html
@@ -0,0 +1,71 @@
+<form style="width:300px;margin:auto" action="?/rebuild" method="post">
+	<ul id="rebuild">
+		<li style="margin-bottom:8px">
+			<input type="checkbox" name="rebuild_all" id="rebuild_all" onchange="toggleall(this.checked)"> 
+			<label for="rebuild_all"><strong>{% trans 'Toggle all' %}</strong></label>
+			<script>
+				function toggleall(val) {
+					/* TODO: something more suitable for all browsers? */
+					var elements = document.getElementById('rebuild').querySelectorAll('input');
+					for (i in elements) {
+						elements[i].checked = val;
+					}
+				}
+			</script>
+		</li>
+		<li>
+			<input type="checkbox" name="rebuild_cache" id="rebuild_cache" checked> 
+			<label for="rebuild_cache">{% trans 'Flush cache' %}</label>
+		</li>
+		<li>
+			<input type="checkbox" name="rebuild_javascript" id="rebuild_javascript" checked> 
+			<label for="rebuild_javascript">{% trans 'Rebuild Javascript' %}</label>
+		</li>
+		<li>
+			<input type="checkbox" name="rebuild_index" id="rebuild_index" checked> 
+			<label for="rebuild_index">{% trans 'Rebuild index pages' %}</label>
+		</li>
+		<li>
+			<input type="checkbox" name="rebuild_thread" id="rebuild_thread" checked> 
+			<label for="rebuild_thread">{% trans 'Rebuild thread pages' %}</label>
+		</li>
+		<li>
+			<input type="checkbox" name="rebuild_themes" id="rebuild_themes" checked> 
+			<label for="rebuild_themes">{% trans 'Rebuild themes' %}</label>
+		</li>
+		<li>
+			<input type="checkbox" name="rebuild_posts" id="rebuild_posts"> 
+			<label for="rebuild_posts">{% trans 'Rebuild replies' %}</label>
+		</li>
+	</ul>
+	
+	<hr>
+	
+	<ul id="boards">
+		<li style="margin-bottom:8px">
+			<input type="checkbox" name="boards_all" id="boards_all" onchange="toggleallboards(this.checked)" checked> 
+			<label for="boards_all"><strong>{% trans 'All boards' %}</strong></label>
+			<script>
+				function toggleallboards(val) {
+					/* TODO: something more suitable for all browsers? */
+					var elements = document.getElementById('boards').querySelectorAll('input');
+					for (i in elements) {
+						elements[i].checked = val;
+					}
+				}
+			</script>
+		</li>
+		{% for board in boards %}
+			<li>
+				<input type="checkbox" name="board_{{ board.uri }}" id="board-{{ board.uri }}" checked> 
+				<label for="board-{{ board.uri }}">
+					{{ config.board_abbreviation|sprintf(board.uri) }} - {{ board.title|e }}
+				</label>
+			</li>
+		{% endfor %}
+	</ul>
+	
+	<p style="text-align:center">
+		<input type="submit" value="{% trans 'Rebuild' %}" name="rebuild">
+	</p>
+</form>
diff --git a/templates/mod/rebuilt.html b/templates/mod/rebuilt.html
new file mode 100644
index 00000000..57d16fff
--- /dev/null
+++ b/templates/mod/rebuilt.html
@@ -0,0 +1,12 @@
+<div class="ban">
+	<h2>{% trans 'Rebuilt' %}</h2>
+	<ul>
+		{% for log in logs %}
+			<li>{{ log }}</li>
+		{% endfor %}
+	</ul>
+	<p>
+		<a href="?/rebuild">{% trans 'Go back and rebuild again' %}</a>.
+	</p>
+</div>
+
diff --git a/templates/mod/report.html b/templates/mod/report.html
new file mode 100644
index 00000000..9c8463ed
--- /dev/null
+++ b/templates/mod/report.html
@@ -0,0 +1,26 @@
+<div class="report">
+	<hr>
+	{% trans 'Board' %}: <a href="?/{{ report.board }}/{{ config.file_index }}">{{ config.board_abbreviation|sprintf(report.board) }}</a>
+	<br>
+	{% trans 'Reason' %}: {{ report.reason }}
+	<br>
+	{% trans 'Report date' %}: {{ report.time|date(config.post_date) }}
+	<br>
+	{% if mod|hasPermission(config.mod.show_ip, report.board) %}
+		{% trans 'Reported by' %}: <a href="?/IP/{{ report.ip }}">{{ report.ip }}</a>
+		<br>
+	{% endif %}
+	{% if mod|hasPermission(config.mod.report_dismiss, report.board) or mod|hasPermission(config.mod.report_dismiss_ip, report.board) %}
+		<hr>
+		{% if mod|hasPermission(config.mod.report_dismiss, report.board) %}
+			<a title="{% trans 'Discard abuse report' %}" href="?/reports/{{ report.id }}/dismiss">Dismiss</a>
+		{% endif %}
+		{% if mod|hasPermission(config.mod.report_dismiss_ip, report.board) %}
+			{% if mod|hasPermission(config.mod.report_dismiss, report.board) %}
+			 | 
+			{% endif %}
+			<a title="{% trans 'Discard all abuse reports by this IP address' %}" href="?/reports/{{ report.id }}/dismissall">Dismiss+</a>
+		{% endif %}
+	{% endif %}
+</div>
+
diff --git a/templates/mod/reports.html b/templates/mod/reports.html
new file mode 100644
index 00000000..26bceacc
--- /dev/null
+++ b/templates/mod/reports.html
@@ -0,0 +1,6 @@
+{% if reports %}
+	{{ reports }}
+{% else %}
+	<p style="text-align:center" class="unimportant">({% trans 'There are no reports.' %})</p>
+{% endif %}
+
diff --git a/templates/mod/theme_config.html b/templates/mod/theme_config.html
new file mode 100644
index 00000000..2dbb8397
--- /dev/null
+++ b/templates/mod/theme_config.html
@@ -0,0 +1,27 @@
+<form action="" method="post">
+	{% if not config %}
+		<p style="text-align:center" class="unimportant">(No configuration required.)</p>
+	{% else %}
+		<table>
+			{% for conf in theme.config %}
+				<tr>
+					<th>{{ conf.title }}</th>
+					<td>
+						<input type="text" name="{{ conf.name }}" 
+						{% if settings[conf.name] %}value="{{ settings[conf.name] }}"{% else %}{% if conf.default %}value="{{ conf.default }}"{% endif %}{% endif %}
+						{% if conf.size %}
+							size="{{ conf.size }}"
+						{% endif %}
+						/>
+					{% if conf.comment %}
+						 <span class="unimportant">{{ conf.comment }}</span>
+					{% endif %}
+					</td>
+				</tr>
+			{% endfor %}
+		</table>
+	{% endif %}
+	<p style="text-align:center">
+		<input name="install" type="submit" value="{% trans 'Install theme' %}" />
+	</p>
+</form>
diff --git a/templates/mod/theme_installed.html b/templates/mod/theme_installed.html
new file mode 100644
index 00000000..e6beec10
--- /dev/null
+++ b/templates/mod/theme_installed.html
@@ -0,0 +1,9 @@
+{% if message %}
+	<div style="border:1px dashed maroon;padding:20px;margin:auto;max-width:800px">{{ message }}</div>
+{% endif %}
+
+{% if result %}
+	<p style="text-align:center">{% trans 'Successfully installed and built theme.' %}</p>
+{% endif %}
+
+<p style="text-align:center"><a href="?/themes">{% trans 'Go back to themes' %}</a>.</p>
diff --git a/templates/mod/theme_rebuilt.html b/templates/mod/theme_rebuilt.html
new file mode 100644
index 00000000..b366e7a6
--- /dev/null
+++ b/templates/mod/theme_rebuilt.html
@@ -0,0 +1,2 @@
+<p style="text-align:center">{{ 'Successfully rebuilt the <strong>%s</strong> theme.'|trans|sprintf(theme_name) }}</p>
+<p style="text-align:center"><a href="?/themes">{% trans 'Go back to themes' %}</a>.</p>
diff --git a/templates/mod/themes.html b/templates/mod/themes.html
new file mode 100644
index 00000000..b596826d
--- /dev/null
+++ b/templates/mod/themes.html
@@ -0,0 +1,40 @@
+{% if themes|count == 0 %}
+	<p style="text-align:center" class="unimportant">({% trans 'There are no themes available.' %})</p>
+{% else %}
+	<table class="modlog">
+		{% for theme_name, theme in themes %}
+			<tr>
+				<th class="minimal">{% trans 'Name' %}</th>
+					<td>{{ theme.name }}</td>
+				</tr>
+				<tr>
+					<th class="minimal">{% trans 'Version' %}</th>
+					<td>{{ theme.version }}</td>
+				</tr>
+				<tr>
+					<th class="minimal">{% trans 'Description' %}</th>
+					<td>{{ theme.description }}</td>
+				</tr>
+				<tr>
+					<th class="minimal">{% trans 'Thumbnail' %}</th>
+					<td>
+						<img style="float:none;margin:4px{% if theme_name in themes_in_use %};border:2px solid red;padding:4px{% endif %}" src="{{ config.dir.themes_uri }}/{{ theme_name }}/thumb.png" />
+					</td>
+				</tr>
+				<tr>
+					<th class="minimal">{% trans 'Actions' %}</th>
+					<td><ul style="padding:0 20px">
+						<li><a title=" {% trans 'Use theme' %}" href="?/themes/{{ theme_name }}">
+							{% if theme_name in themes_in_use %}{% trans 'Reconfigure' %}{% else %}{% trans 'Install' %}{% endif %}
+						</a></li>
+						{% if theme_name in themes_in_use %}
+							<li><a href="?/themes/{{ theme_name }}/rebuild">{% trans 'Rebuild' %}</a></li>
+							<li><a href="?/themes/{{ theme_name }}/uninstall" onclick="return confirm('Are you sure you want to uninstall this theme?');">{% trans 'Uninstall' %}</a></li>
+						{% endif %}
+					</ul></td>
+				</tr>
+				<tr style="height:40px"><td colspan="2"><hr/></td></tr>
+			</tr>
+		{% endfor %}
+	</table>
+{% endif %}
diff --git a/templates/mod/user.html b/templates/mod/user.html
new file mode 100644
index 00000000..3c4b89cf
--- /dev/null
+++ b/templates/mod/user.html
@@ -0,0 +1,125 @@
+{% if new %}
+	{% set action = '?/users/new' %}
+{% else %}
+	{% set action = '?/users/' ~ user.id %}
+{% endif %}
+
+<form action="{{ action }}" method="post">
+	<table>
+		<tr>
+			<th>{% trans 'Username' %}</th>
+			<td>
+				{% if new or mod|hasPermission(config.mod.editusers) %}
+					<input size="20" maxlength="30" type="text" name="username" value="{{ user.username|e }}" autocomplete="off">
+				{% else %}
+					{{ user.username|e }}
+				{% endif %}
+			</td>
+		</tr>
+		<tr>
+			<th>{% trans 'Password' %}{% if not new %} <small style="font-weight:normal">({% trans 'new; optional' %})</small>{% endif %}</th>
+			<td>
+				{% if new or (mod|hasPermission(config.mod.editusers) or (mod|hasPermission(config.mod.change_password) and user.id == mod.id)) %}
+					<input size="20" maxlength="30" type="password" name="password" value="" autocomplete="off">
+				{% else %}
+					-
+				{% endif %}
+			</td>
+		</tr>
+		{% if new %}
+			<tr>
+				<th>{% trans 'Class' %}</th>
+				<td>
+					<ul style="padding:5px 8px;list-style:none">
+						<li>
+							<input type="radio" name="type" id="janitor" value="{{ constant('JANITOR') }}"> 
+							<label for="janitor">{% trans 'Janitor' %}</label>
+						</li>
+						<li>
+							<input type="radio" name="type" id="mod" value="{{ constant('MOD') }}" checked> 
+							<label for="mod">{% trans 'Mod' %}</label>
+						</li>
+						<li>
+							<input type="radio" name="type" id="admin" value="{{ constant('Admin') }}"> 
+							<label for="admin">{% trans 'Admin' %}</label>
+						</li>
+					</ul>
+				</td>
+			</tr>
+		{% endif %}
+		<tr>
+			<th>{% trans 'Boards' %}</th>
+			<td>
+				<ul style="padding:0 5px;list-style:none">
+					<li>
+						<input type="checkbox" id="allboards" name="allboards"
+						{% if '*' in user.boards %} checked{% endif %}
+						{% if not mod|hasPermission(config.mod.editusers) %}
+						 disabled
+						{% endif %}
+						> 
+						<label for="allboards">"*" - {% trans 'All boards' %}</label>
+					</li>
+					{% for board in boards %}
+						<li>
+							<input type="checkbox" id="board_{{ board.uri }}" name="board_{{ board.uri }}"
+								{% if board.uri in user.boards %} checked{% endif %}
+								{% if not mod|hasPermission(config.mod.editusers) %}
+								 disabled
+								{% endif %}
+								> 
+							<label for="board_{{ board.uri }}">
+								{{ config.board_abbreviation|sprintf(board.uri) }}
+								 - 
+								{{ board.title|e }}
+							</label>
+						</li>
+					{% endfor %}
+				</ul>
+			</td>
+		</tr>
+	</table>
+	
+	<ul style="padding:0;text-align:center;list-style:none">
+		{% if new %}
+			<li><input type="submit" value="{% trans 'Create user' %}"></li>
+		{% else %}
+			<li><input type="submit" value="{% trans 'Save changes' %}"></li>
+			{% if mod|hasPermission(config.mod.deleteusers) %}
+				<li><input name="delete" onclick="return confirm('Are you sure you want to permanently delete this user?');" type="submit" value="{% trans 'Delete user' %}"></li>
+			{% endif %}
+		{% endif %}
+	</ul>
+</form>
+
+{% if logs|count > 0  %}
+	<table class="modlog" style="width:600px">
+		<tr>
+			<th>{% trans 'IP address' %}</th>			
+			<th>{% trans 'Time' %}</th>
+			<th>{% trans 'Board' %}</th>
+			<th>{% trans 'Action' %}</th>
+		</tr>
+		{% for log in logs %}
+			<tr>
+				<td class="minimal">
+					<a href="?/IP/{{ log.ip }}">{{ log.ip }}</a>
+				</td>
+				<td class="minimal">
+					<span title="{{ log.time|date(config.post_date) }}">{{ log.time|ago }}</span>
+				</td>
+				<td class="minimal">
+					{% if log.board %}
+						<a href="?/{{ config.board_path|sprintf(log.board) }}{{ config.file_index }}">{{ config.board_abbreviation|sprintf(log.board) }}</a>
+					{% else %}
+						-
+					{% endif %}
+				</td>
+				<td>
+					{{ log.text }}
+				</td>
+			</tr>
+		{% endfor %}
+	</table>
+{% endif %}
+
diff --git a/templates/mod/users.html b/templates/mod/users.html
new file mode 100644
index 00000000..6ea6248f
--- /dev/null
+++ b/templates/mod/users.html
@@ -0,0 +1,71 @@
+<table class="modlog" style="width:auto">
+	<tr>
+		<th>{% trans 'ID' %}</th>
+		<th>{% trans 'Username' %}</th>
+		<th>{% trans 'Type' %}</th>
+		<th>{% trans 'Boards' %}</th>
+		{% if mod|hasPermission(config.mod.modlog) %}
+			<th>{% trans 'Last action' %}</th>
+		{% endif %}
+		<th>&hellip;</th>
+	</tr>
+	
+	{% for user in users %}
+		<tr>
+			<td><small>{{ user.id }}</small></td>
+			<td>{{ user.username|e }}</td>
+			<td>
+				{% if user.type == constant('JANITOR') %}{% trans 'Janitor' %}
+				{% elseif user.type == constant('MOD') %}{% trans 'Mod' %}
+				{% elseif user.type == constant('ADMIN') %}{% trans 'Admin' %}
+				{% endif %}
+			</td>
+			<td>
+				{% if user.boards == '' %}
+					<em>{% trans 'none' %}</em>
+				{% elseif user.boards == '*' %}
+					<em>{% trans 'all boards' %}</em>
+				{% else %}
+					{# This is really messy, but IMO it beats doing it in PHP. #}
+					{% set boards = user.boards|split(',') %}
+					{% set _boards = [] %}
+					{% for board in boards %}
+						{% set _boards = _boards|push(board == '*' ? '*' : config.board_abbreviation|sprintf(board)) %}
+					{% endfor %}
+					{% set _boards = _boards|sort %}
+					{{ _boards|join(', ') }}
+				{% endif %}
+			</td>
+			{% if mod|hasPermission(config.mod.modlog) %}
+				<td>
+					{% if user.last %}
+						<span title="{{ user.action|e }}">{{ user.last|ago }}</span>
+					{% else %}
+						<em>{% trans 'never' %}</em>
+					{% endif %}
+				</td>
+			{% endif %}
+			<td>
+				{% if mod|hasPermission(config.mod.promoteusers) and user.type < constant('ADMIN') %}
+					<a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/promote" title="{% trans 'Promote' %}">&#9650;</a> 
+				{% endif %}
+				{% if mod|hasPermission(config.mod.promoteusers) and user.type > constant('JANITOR') %}
+					<a style="float:left;text-decoration:none" href="?/users/{{ user.id }}/demote" title="{% trans 'Demote' %}">&#9660;</a> 
+				{% endif %}
+				{% if mod|hasPermission(config.mod.editusers) or (mod|hasPermission(config.mod.change_password) and mod.id == user.id) %}
+					<a class="unimportant" style="margin-left:5px;float:right" href="?/users/{{ user.id }}">[{% trans 'edit' %}]</a> 
+				{% endif %}
+				{% if mod|hasPermission(config.mod.create_pm) %}
+					<a class="unimportant" style="margin-left:5px;float:right" href="?/new_PM/{{ user.username|e }}">[{% trans 'PM' %}]</a>
+				{% endif %}
+			</td>
+		</tr>
+	{% endfor %}
+</table>
+
+{% if mod|hasPermission(config.mod.createusers) %}
+	<p style="text-align:center">
+		<a href="?/users/new">Create a new user</a>
+	</p>
+{% endif %}
+
diff --git a/templates/mod/view_ip.html b/templates/mod/view_ip.html
new file mode 100644
index 00000000..c49880ae
--- /dev/null
+++ b/templates/mod/view_ip.html
@@ -0,0 +1,163 @@
+{% for board_posts in posts %}
+	<fieldset>
+		<legend>
+			<a href="?/{{ config.board_path|sprintf(board_posts.board.uri) }}{{ config.file_index }}">
+				{{ config.board_abbreviation|sprintf(board_posts.board.uri) }}
+				 - 
+				 {{ board_posts.board.title|e }}
+			</a>
+		</legend>
+		{{ board_posts.posts|join('<hr>') }}
+	</fieldset>
+{% endfor %}
+
+{% if mod|hasPermission(config.mod.view_notes) %}
+	<fieldset id="notes">
+		<legend>
+			{% set notes_on_record = 'note' ~ (notes|count != 1 ? 's' : '') ~ ' on record' %}
+			<legend>{{ notes|count }} {% trans notes_on_record %}</legend>
+		</legend>
+		
+		{% if notes|count > 0 %}
+			<table class="modlog">
+				<tr>
+					<th>{% trans 'Staff' %}</th>
+					<th>{% trans 'Note' %}</th>
+					<th>{% trans 'Date' %}</th>
+					{% if mod|hasPermission(config.mod.remove_notes) %}
+						<th>{% trans 'Actions' %}</th>
+					{% endif %}
+				</tr>
+				{% for note in notes %}
+					<tr>
+						<td class="minimal">
+							{% if note.username %}
+								<a href="?/new_PM/{{ note.username|e }}">{{ note.username|e }}</a>
+							{% else %}
+								<em>{% trans 'deleted?' %}</em>
+							{% endif %}
+						</td>
+						<td>
+							{{ note.body }}
+						</td>
+						<td class="minimal">
+							{{ note.time|date(config.post_date) }}
+						</td>
+						{% if mod|hasPermission(config.mod.remove_notes) %}
+							<td class="minimal">
+								<a href="?/IP/{{ ip }}/remove_note/{{ note.id }}">
+									<small>[{% trans 'remove' %}]</small>
+								</a>
+							</td>
+						{% endif %}
+					</tr>
+				{% endfor %}
+			</table>
+		{% endif %}
+		
+		{% if mod|hasPermission(config.mod.create_notes) %}
+			<form action="" method="post" style="margin:0">
+				<table>
+					<tr>
+						<th>{% trans 'Staff' %}</th>
+						<td>{{ mod.username|e }}</td>
+					</tr>
+					<tr>
+						<th>
+							<label for="note">{% trans 'Note' %}</label>
+						</th>
+						<td>
+							<textarea id="note" name="note" rows="5" cols="30"></textarea>
+						</td>
+					</tr>
+					<tr>
+						<td></td>
+						<td><input type="submit" value="{% trans 'New note' %}"></td>
+					</tr>
+				</table>
+			</form>
+		{% endif %}
+	</fieldset>
+{% endif %}
+
+{% if bans|count > 0 and mod|hasPermission(config.mod.view_ban) %}
+	<fieldset id="bans">
+		{% set bans_on_record = 'ban' ~ (bans|count != 1 ? 's' : '') ~ ' on record' %}
+		<legend>{{ bans|count }} {% trans bans_on_record %}</legend>
+		
+		{% for ban in bans %}
+			<form action="" method="post" style="text-align:center">
+				<table style="width:400px;margin-bottom:10px;border-bottom:1px solid #ddd;padding:5px">
+					<tr>
+						<th>{% trans 'Status' %}</th>
+						<td>
+							{% if config.mod.view_banexpired and ban.expires != 0 and ban.expires < time() %}
+								{% trans 'Expired' %}
+							{% else %}
+								{% trans 'Active' %}
+							{% endif %}
+						</td>
+					</tr>
+					<tr>
+						<th>{% trans 'IP' %}</th>
+						<td>{{ ban.ip }}</td>
+					</tr>
+					<tr>
+						<th>{% trans 'Reason' %}</th>
+						<td>
+							{% if ban.reason %}
+								{{ ban.reason }}
+							{% else %}
+								<em>{% trans 'no reason' %}</em>
+							{% endif %}
+						</td>
+					</tr>
+					<tr>
+						<th>{% trans 'Board' %}</th>
+						<td>
+							{% if ban.board %}
+								{{ config.board_abbreviation|sprintf(ban.board) }}
+							{% else %}
+								<em>{% trans 'all boards' %}</em>
+							{% endif %}
+						</td>
+					</tr>
+					<tr>
+						<th>{% trans 'Set' %}</th>
+						<td>{{ ban.set|date(config.post_date) }}</td>
+					</tr>
+					<tr>
+						<th>{% trans 'Expires' %}</th>
+						<td>
+							{% if ban.expires %}
+								{{ ban.expires|date(config.post_date) }}
+							{% else %}
+								<em>{% trans 'never' %}</em>
+							{% endif %}
+						</td>
+					</tr>
+					<tr>
+						<th>{% trans 'Staff' %}</th>
+						<td>
+							{% if ban.username %}
+								{{ ban.username|e }}
+							{% else %}
+								<em>{% trans 'deleted?' %}</em>
+							{% endif %}
+						</td>
+					</tr>
+				</table>
+				<input type="hidden" name="ban_id" value="{{ ban.id }}">
+				<input type="submit" name="unban" value="{% trans 'Remove ban' %}">
+			</form>
+		{% endfor %}
+	</fieldset>
+{% endif %}
+
+{% if mod|hasPermission(config.mod.ban) %}
+	<fieldset>
+		<legend>{% trans 'New ban' %}</legend>
+		{% set redirect = '?/IP/' ~ ip ~ '#bans' %}
+		{% include 'mod/ban_form.html' %}
+	</fieldset>
+{% endif %}
diff --git a/templates/page.html b/templates/page.html
index 0b15d815..0f59e6b1 100644
--- a/templates/page.html
+++ b/templates/page.html
@@ -1,11 +1,11 @@
 <!doctype html>

 <html>

 <head>

+	<meta charset="utf-8">

 	<link rel="stylesheet" media="screen" href="{{ config.url_stylesheet }}">

 	{% if config.url_favicon %}<link rel="shortcut icon" href="{{ config.url_favicon }}">{% endif %}

 	<title>{{ title }}</title>

-	<meta http-equiv="Content-Type" content="text/html; charset=utf-8">

-	<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=yes">

+	<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">

 	{% if config.default_stylesheet.1 != '' %}<link rel="stylesheet" type="text/css" id="stylesheet" href="{{ config.uri_stylesheets }}{{ config.default_stylesheet.1 }}">{% endif %}

 	{% if not nojavascript %}<script type="text/javascript" src="{{ config.url_javascript }}"></script>{% endif %}

 </head>

@@ -17,7 +17,7 @@
 			{% if subtitle %}

 				{{ subtitle }}

 			{% endif %}

-			{% if mod %}<p><a href="?/">{% trans %}Return to dashboard{% endtrans %}</a></p>{% endif %}

+			{% if mod and not hide_dashboard_link %}<p><a href="?/">{% trans %}Return to dashboard{% endtrans %}</a></p>{% endif %}

 		</div>

 	</header>

 	{{ body }}

diff --git a/templates/themes/basic/info.php b/templates/themes/basic/info.php
index b782a6d4..0b8ba98b 100644
--- a/templates/themes/basic/info.php
+++ b/templates/themes/basic/info.php
@@ -44,9 +44,9 @@
 	$theme['build_function'] = 'basic_build';
 	$theme['install_callback'] = 'build_install';
 
-	if(!function_exists('build_install')) {
+	if (!function_exists('build_install')) {
 		function build_install($settings) {
-			if(!is_numeric($settings['no_recent']) || $settings['no_recent'] < 0)
+			if (!is_numeric($settings['no_recent']) || $settings['no_recent'] < 0)
 				return Array(false, '<strong>' . utf8tohtml($settings['no_recent']) . '</strong> is not a non-negative integer.');
 		}
 	}
diff --git a/templates/themes/basic/theme.php b/templates/themes/basic/theme.php
index a07dc7ec..806a331a 100644
--- a/templates/themes/basic/theme.php
+++ b/templates/themes/basic/theme.php
@@ -15,7 +15,7 @@
 		public static function build($action, $settings) {
 			global $config;
 			
-			if($action == 'all' || $action == 'news')
+			if ($action == 'all' || $action == 'news')
 				file_write($config['dir']['home'] . $settings['file'], Basic::homepage($settings));
 		}
 		
diff --git a/templates/themes/categories/info.php b/templates/themes/categories/info.php
index 5ae3d296..62d8f6bb 100644
--- a/templates/themes/categories/info.php
+++ b/templates/themes/categories/info.php
@@ -54,11 +54,11 @@ Requires $config[\'categories\'].';
 	$theme['build_function'] = 'categories_build';
 	$theme['install_callback'] = 'categories_install';
 	
-	if(!function_exists('categories_install')) {
+	if (!function_exists('categories_install')) {
 		function categories_install($settings) {
 			global $config;
 			
-			if(!isset($config['categories'])) {
+			if (!isset($config['categories'])) {
 				return Array(false, '<h2>Prerequisites not met!</h2>' . 
 					'This theme requires $config[\'boards\'] and $config[\'categories\'] to be set.');
 			}
diff --git a/templates/themes/categories/sidebar.html b/templates/themes/categories/sidebar.html
index a4bc28ae..856930ab 100644
--- a/templates/themes/categories/sidebar.html
+++ b/templates/themes/categories/sidebar.html
@@ -31,7 +31,7 @@
 			</legend>
 			{% for board in boards %}
 				<li>
-					<a href="{{ board.uri }}">{{ board.title }}</a>
+					<a href="{{ board.uri }}">{{ board.title|e }}</a>
 				</li>
 			{% endfor %}
 		</fieldset>
diff --git a/templates/themes/categories/theme.php b/templates/themes/categories/theme.php
index 648034e7..11fcbbaf 100644
--- a/templates/themes/categories/theme.php
+++ b/templates/themes/categories/theme.php
@@ -15,13 +15,13 @@
 		public static function build($action, $settings) {
 			global $config;
 			
-			if($action == 'all')
+			if ($action == 'all')
 				file_write($config['dir']['home'] . $settings['file_main'], Categories::homepage($settings));
 			
-			if($action == 'all' || $action == 'boards')
+			if ($action == 'all' || $action == 'boards')
 				file_write($config['dir']['home'] . $settings['file_sidebar'], Categories::sidebar($settings));
 			
-			if($action == 'all' || $action == 'news')
+			if ($action == 'all' || $action == 'news')
 				file_write($config['dir']['home'] . $settings['file_news'], Categories::news($settings));
 		}
 		
@@ -52,10 +52,10 @@
 			
 			$categories = $config['categories'];
 			
-			foreach($categories as &$boards) {
-				foreach($boards as &$board) {
+			foreach ($categories as &$boards) {
+				foreach ($boards as &$board) {
 					$title = boardTitle($board);
-					if(!$title)
+					if (!$title)
 						$title = $board; // board doesn't exist, but for some reason you want to display it anyway
 					$board = Array('title' => $title, 'uri' => sprintf($config['board_path'], $board));
 				}
diff --git a/templates/themes/frameset/sidebar.html b/templates/themes/frameset/sidebar.html
index 457ecec8..40e2d719 100644
--- a/templates/themes/frameset/sidebar.html
+++ b/templates/themes/frameset/sidebar.html
@@ -30,7 +30,7 @@
 			{% for board in boards %}
 				<li>
 					<a href="{{ config.board_path|sprintf(board.uri) }}">
-						{{ board.title }}
+						{{ board.title|e }}
 					</a>
 				</li>
 			{% endfor %}
diff --git a/templates/themes/frameset/theme.php b/templates/themes/frameset/theme.php
index f3e1b139..015eebaf 100644
--- a/templates/themes/frameset/theme.php
+++ b/templates/themes/frameset/theme.php
@@ -15,13 +15,13 @@
 		public static function build($action, $settings) {
 			global $config;
 			
-			if($action == 'all')
+			if ($action == 'all')
 				file_write($config['dir']['home'] . $settings['file_main'], Frameset::homepage($settings));
 			
-			if($action == 'all' || $action == 'boards')
+			if ($action == 'all' || $action == 'boards')
 				file_write($config['dir']['home'] . $settings['file_sidebar'], Frameset::sidebar($settings));
 			
-			if($action == 'all' || $action == 'news')
+			if ($action == 'all' || $action == 'news')
 				file_write($config['dir']['home'] . $settings['file_news'], Frameset::news($settings));
 		}
 		
diff --git a/templates/themes/recent/info.php b/templates/themes/recent/info.php
index 83d7477a..d4cf1029 100644
--- a/templates/themes/recent/info.php
+++ b/templates/themes/recent/info.php
@@ -60,11 +60,11 @@
 	$theme['build_function'] = 'recentposts_build';
 	$theme['install_callback'] = 'recentposts_install';
 
-	if(!function_exists('recentposts_install')) {
+	if (!function_exists('recentposts_install')) {
 		function recentposts_install($settings) {
-			if(!is_numeric($settings['limit_images']) || $settings['limit_images'] < 0)
+			if (!is_numeric($settings['limit_images']) || $settings['limit_images'] < 0)
 				return Array(false, '<strong>' . utf8tohtml($settings['limit_images']) . '</strong> is not a non-negative integer.');
-			if(!is_numeric($settings['limit_posts']) || $settings['limit_posts'] < 0)
+			if (!is_numeric($settings['limit_posts']) || $settings['limit_posts'] < 0)
 				return Array(false, '<strong>' . utf8tohtml($settings['limit_posts']) . '</strong> is not a non-negative integer.');
 		}
 	}
diff --git a/templates/themes/recent/theme.php b/templates/themes/recent/theme.php
index 13a5546f..986fac6a 100644
--- a/templates/themes/recent/theme.php
+++ b/templates/themes/recent/theme.php
@@ -17,13 +17,13 @@
 		public function build($action, $settings) {
 			global $config, $_theme;
 			
-			if($action == 'all') {
+			if ($action == 'all') {
 				copy('templates/themes/recent/recent.css', $config['dir']['home'] . $settings['css']);
 			}
 			
 			$this->excluded = explode(' ', $settings['exclude']);
 			
-			if($action == 'all' || $action == 'post')
+			if ($action == 'all' || $action == 'post')
 				file_write($config['dir']['home'] . $settings['html'], $this->homepage($settings));
 		}
 		
@@ -38,15 +38,15 @@
 			$boards = listBoards();
 			
 			$query = '';
-			foreach($boards as &$_board) {
-				if(in_array($_board['uri'], $this->excluded))
+			foreach ($boards as &$_board) {
+				if (in_array($_board['uri'], $this->excluded))
 					continue;
 				$query .= sprintf("SELECT *, '%s' AS `board` FROM `posts_%s` WHERE `file` IS NOT NULL AND `file` != 'deleted' AND `thumb` != 'spoiler' UNION ALL ", $_board['uri'], $_board['uri']);
 			}
 			$query = preg_replace('/UNION ALL $/', 'ORDER BY `time` DESC LIMIT ' . (int)$settings['limit_images'], $query);
 			$query = query($query) or error(db_error());
 			
-			while($post = $query->fetch()) {
+			while ($post = $query->fetch()) {
 				openBoard($post['board']);
 				
 				// board settings won't be available in the template file, so generate links now
@@ -58,15 +58,15 @@
 			
 			
 			$query = '';
-			foreach($boards as &$_board) {
-				if(in_array($_board['uri'], $this->excluded))
+			foreach ($boards as &$_board) {
+				if (in_array($_board['uri'], $this->excluded))
 					continue;
 				$query .= sprintf("SELECT *, '%s' AS `board` FROM `posts_%s` UNION ALL ", $_board['uri'], $_board['uri']);
 			}
 			$query = preg_replace('/UNION ALL $/', 'ORDER BY `time` DESC LIMIT ' . (int)$settings['limit_posts'], $query);
 			$query = query($query) or error(db_error());
 			
-			while($post = $query->fetch()) {
+			while ($post = $query->fetch()) {
 				openBoard($post['board']);
 				
 				$post['link'] = $config['root'] . $board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], ($post['thread'] ? $post['thread'] : $post['id'])) . '#' . $post['id'];
@@ -78,8 +78,8 @@
 			
 			// Total posts
 			$query = 'SELECT SUM(`top`) AS `count` FROM (';
-			foreach($boards as &$_board) {
-				if(in_array($_board['uri'], $this->excluded))
+			foreach ($boards as &$_board) {
+				if (in_array($_board['uri'], $this->excluded))
 					continue;
 				$query .= sprintf("SELECT MAX(`id`) AS `top` FROM `posts_%s` UNION ALL ", $_board['uri']);
 			}
@@ -90,8 +90,8 @@
 			
 			// Unique IPs
 			$query = 'SELECT COUNT(DISTINCT(`ip`)) AS `count` FROM (';
-			foreach($boards as &$_board) {
-				if(in_array($_board['uri'], $this->excluded))
+			foreach ($boards as &$_board) {
+				if (in_array($_board['uri'], $this->excluded))
 					continue;
 				$query .= sprintf("SELECT `ip` FROM `posts_%s` UNION ALL ", $_board['uri']);
 			}
@@ -102,8 +102,8 @@
 			
 			// Active content
 			$query = 'SELECT SUM(`filesize`) AS `count` FROM (';
-			foreach($boards as &$_board) {
-				if(in_array($_board['uri'], $this->excluded))
+			foreach ($boards as &$_board) {
+				if (in_array($_board['uri'], $this->excluded))
 					continue;
 				$query .= sprintf("SELECT `filesize` FROM `posts_%s` UNION ALL ", $_board['uri']);
 			}
diff --git a/templates/themes/rrdtool/info.php b/templates/themes/rrdtool/info.php
index 73658a22..46a20587 100644
--- a/templates/themes/rrdtool/info.php
+++ b/templates/themes/rrdtool/info.php
@@ -28,7 +28,7 @@
 	
 	$__boards = listBoards();
 	$__default_boards = Array();
-	foreach($__boards as $__board)
+	foreach ($__boards as $__board)
 		$__default_boards[] = $__board['uri'];
 	
 	$theme['config'][] = Array(
@@ -83,31 +83,31 @@
 	);
 	
 	$theme['install_callback'] = 'rrdtool_install';
-	if(!function_exists('rrdtool_install')) {
+	if (!function_exists('rrdtool_install')) {
 		function rrdtool_install($settings) {
 			global $config;
 			
-			if(!is_numeric($settings['interval']) || $settings['interval'] < 1 || $settings['interval'] > 86400)
+			if (!is_numeric($settings['interval']) || $settings['interval'] < 1 || $settings['interval'] > 86400)
 				return Array(false, 'Invalid interval: <strong>' . $settings['interval'] . '</strong>. Must be an integer greater than 1 and less than 86400.');
 			
-			if(!is_numeric($settings['width']) || $settings['width'] < 1)
+			if (!is_numeric($settings['width']) || $settings['width'] < 1)
 				return Array(false, 'Invalid width: <strong>' . $settings['width'] . '</strong>!');
 			
-			if(!is_numeric($settings['height']) || $settings['height'] < 1)
+			if (!is_numeric($settings['height']) || $settings['height'] < 1)
 				return Array(false, 'Invalid height: <strong>' . $settings['height'] . '</strong>!');
 			
-			if(!in_array($settings['rate'], Array('second', 'minute', 'day', 'hour', 'week', 'month', 'year')))
+			if (!in_array($settings['rate'], Array('second', 'minute', 'day', 'hour', 'week', 'month', 'year')))
 				return Array(false, 'Invalid rate: <strong>' . $settings['rate'] . '</strong>!');
 			
 			$job = '*/' . $settings['interval'] . ' * * * * php -q ' . str_replace('\\', '/', dirname(__FILE__)) . '/cron.php' . PHP_EOL;
 			
-			if(function_exists('system')) {
+			if (function_exists('system')) {
 				$crontab = tempnam($config['tmp'], 'tinyboard-rrdtool');
 				file_write($crontab, $job);
 				@system('crontab ' . escapeshellarg($crontab), $ret);
 				unlink($crontab);
 				
-				if($ret === 0)
+				if ($ret === 0)
 					return ''; // it seems to install okay?
 			}
 			
diff --git a/templates/themes/rrdtool/theme.php b/templates/themes/rrdtool/theme.php
index 20a00e76..eed2ac9a 100644
--- a/templates/themes/rrdtool/theme.php
+++ b/templates/themes/rrdtool/theme.php
@@ -17,7 +17,7 @@
 		public function build($action, $settings) {
 			global $config, $_theme, $argv;
 			
-			if(!$settings) {
+			if (!$settings) {
 				error('This theme is not currently installed.');
 			}
 			
@@ -26,18 +26,18 @@
 			// exclude boards from the "combined" graph
 			$this->combined_exclude = Array();
 			
-			if($action == 'cron') {
-				if(!file_exists($settings['path']))
+			if ($action == 'cron') {
+				if (!file_exists($settings['path']))
 					mkdir($settings['path']);
-				if(!file_exists($settings['images']))
+				if (!file_exists($settings['images']))
 					mkdir($settings['images']);
 				
-				foreach($this->boards as &$board) {
+				foreach ($this->boards as &$board) {
 					$file = $settings['path'] . '/' . $board . '.rrd';
 					
-					if(!file_exists($file)) {
+					if (!file_exists($file)) {
 						// Create graph
-						if(!rrd_create($file, Array(
+						if (!rrd_create($file, Array(
 							'-s 60',
 							'DS:posts:COUNTER:86400:0:10000',
 							
@@ -59,22 +59,22 @@
 					}
 					
 					// debug just the graphing (not updating) with the --debug switch
-					if(!isset($argv[1]) || $argv[1] != '--debug') {
+					if (!isset($argv[1]) || $argv[1] != '--debug') {
 						// Update graph
 						$query = query(sprintf("SELECT MAX(`id`) AS `count` FROM `posts_%s`", $board));
 						$count = $query->fetch();
 						$count = $count['count'];
 					
-						if(!rrd_update($file, Array(
+						if (!rrd_update($file, Array(
 							'-t',
 							'posts',
 							'N:' . $count)))
 								error('RRDtool failed: ' . htmlentities(rrd_error()));
 					}
 					
-					foreach($this->spans as &$span) {
+					foreach ($this->spans as &$span) {
 						// Graph graph
-						if(!rrd_graph($settings['images'] . '/' . $board . '-' . $span . '.png', Array(
+						if (!rrd_graph($settings['images'] . '/' . $board . '-' . $span . '.png', Array(
 							'-s -1' . $span,
 							'-t Posts on ' . sprintf($config['board_abbreviation'], $board) .' this ' . $span,
 							'--lazy',
@@ -105,7 +105,7 @@
 				}
 				
 				// combined graph
-				foreach($this->spans as &$span) {
+				foreach ($this->spans as &$span) {
 					$options = Array(
 						'-s -1' . $span,
 						'-t Posts this ' . $span,
@@ -129,8 +129,8 @@
 					$c = 1;
 					$cc = 0;
 					$red = 2;
-					foreach($this->boards as &$board) {
-						if(in_array($board, $this->combined_exclude))
+					foreach ($this->boards as &$board) {
+						if (in_array($board, $this->combined_exclude))
 							continue;
 						$color =	str_pad(dechex($red*85), 2, '0', STR_PAD_LEFT) .
 									str_pad(dechex($green*85), 2, '0', STR_PAD_LEFT) .
@@ -147,31 +147,35 @@
 							sprintf($config['board_abbreviation'], $board);
 						
 						// Randomize colors using this horrible undocumented algorithm I threw together while debugging
-						if($c == 0)
+						if ($c == 0)
 							$red++;
-						elseif($c == 1)
+						elseif ($c == 1)
 							$green++;
-						elseif($c == 2)
+						elseif ($c == 2)
 							$blue++;
-						elseif($c == 3)
+						elseif ($c == 3)
 							$green--;
-						elseif($c == 4)
+						elseif ($c == 4)
 							$red--;
 						
 						$cc++;
-						if($cc > 2) {
+						if ($cc > 2) {
 							$c++;
 							$cc = 0;
 						}
-						if($c>4) $c = 0;
+						if ($c > 4)
+							$c = 0;
 						
-						if($red>3) $red = 0;
-						if($green>3) $green = 0;
-						if($blue>3) $blue = 0;
+						if ($red > 3)
+							$red = 0;
+						if ($green > 3)
+							$green = 0;
+						if ($blue > 3)
+							$blue = 0;
 					}
 					$options[] = 'HRULE:0#000000';
 					
-					if(!rrd_graph($settings['images'] . '/combined-' . $span . '.png', $options))
+					if (!rrd_graph($settings['images'] . '/combined-' . $span . '.png', $options))
 							error('RRDtool failed: ' . htmlentities(rrd_error()));
 				}
 			}
diff --git a/templates/thread.html b/templates/thread.html
index ac6bc609..e7c65f9b 100644
--- a/templates/thread.html
+++ b/templates/thread.html
@@ -1,11 +1,11 @@
 <!doctype html>

 <html>

 <head>

+	<meta charset="utf-8">

 	<link rel="stylesheet" media="screen" href="{{ config.url_stylesheet }}">

 	{% if config.url_favicon %}<link rel="shortcut icon" href="{{ config.url_favicon }}">{% endif %}

 	<title>{{ board.url }} - {{ board.name }}</title>

-	<meta http-equiv="Content-Type" content="text/html; charset=utf-8">

-	<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=yes">

+	<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes">

 	{% if config.meta_keywords %}<meta name="keywords" content="{{ config.meta_keywords }}">{% endif %}

 	{% if config.default_stylesheet.1 != '' %}<link rel="stylesheet" type="text/css" id="stylesheet" href="{{ config.uri_stylesheets }}{{ config.default_stylesheet.1 }}">{% endif %}

 	{% if not nojavascript %}

@@ -29,17 +29,16 @@
 			display: block;

 		}

 	{% endraw %}</style>{% endif %}

-

 </head>

 <body>

 	{{ boardlist.top }}

 	{% if pm %}<div class="top_notice">You have <a href="?/PM/{{ pm.id }}">an unread PM</a>{% if pm.waiting > 0 %}, plus {{ pm.waiting }} more waiting{% endif %}.</div><hr />{% endif %}

 	{% if config.url_banner %}<img class="banner" src="{{ config.url_banner }}" {% if config.banner_width or config.banner_height %}style="{% if config.banner_width %}width:{{ config.banner_width }}px{% endif %};{% if config.banner_width %}height:{{ config.banner_height }}px{% endif %}" {% endif %}alt="" />{% endif %}

 	<header>

-		<h1>{{ board.url }} - {{ board.name }}</h1>

+		<h1>{{ board.url }} - {{ board.title|e }}</h1>

 		<div class="subtitle">

-			{% if board.title %}

-				{{ board.title }}

+			{% if board.subtitle %}

+				{{ board.subtitle|e }}

 			{% endif %}

 			{% if mod %}<p><a href="?/">{% trans %}Return to dashboard{% endtrans %}</a></p>{% endif %}

 		</div>