From 97a22e57c1ef3c3e41ed5666255c1e941df21f3e Mon Sep 17 00:00:00 2001
From: czaks <marcin@6irc.net>
Date: Sat, 20 Jul 2013 22:47:26 -0400
Subject: Remove imgcaptcha, this code is unused in any of our forks and needs
 work to get here back.

Revert "Merge branch 'imgcaptcha' of https://github.com/asiekierka/Tinyboard"

This reverts commit 49afb685c8e658c0f36b8171e176363538eb9419, reversing
changes made to 2451a0f29c08e23ff36ef113082c112224f7e576.

Conflicts:

	js/imgcaptcha.js
---
 post.php | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index 4ded8622..91d5a2f5 100644
--- a/post.php
+++ b/post.php
@@ -6,7 +6,6 @@
 
 require 'inc/functions.php';
 require 'inc/anti-bot.php';
-require 'inc/imgcaptcha.php';
 
 // Fix for magic quotes
 if (get_magic_quotes_gpc()) {
@@ -198,12 +197,7 @@ if (isset($_POST['delete'])) {
 			error($config['error']['captcha']);
 		}
 	}
-	if ($config['imgcaptcha']) {
-		if (!isset($_POST['imgcaptcha_verify']) || !isset($_POST['imgcaptcha_hash']))
-			error($config['error']['bot']);
-		if (ic_verifyHash($_POST['imgcaptcha_hash'],$_POST['imgcaptcha_verify']))
-			error($config['error']['captcha']);
-	}
+	
 	if ($post['mod'] = isset($_POST['mod']) && $_POST['mod']) {
 		require 'inc/mod.php';
 		if (!$mod) {
-- 
cgit v1.3


From 308f557fd503898406d7cb54ef7e6e6efb0f84ae Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 21 Jul 2013 15:50:45 -0400
Subject: Option to automatically strip EXIF metadata from JPEGs

---
 inc/config.php |  3 +++
 inc/image.php  | 12 ++++++++++--
 post.php       | 11 ++++++-----
 3 files changed, 19 insertions(+), 7 deletions(-)

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index 424d07d6..c2a68e6c 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -418,6 +418,9 @@
 	//	- 'convert'	The command line version of ImageMagick (`convert`). Fixes most of the bugs in PHP Imagick.
 	$config['thumb_method'] = 'gd';
 	
+	// Strip EXIF metadata from JPEG files
+	$config['strip_exif'] = false;
+	
 	// Regular expression to check for IE MIME type detection XSS exploit. To disable, comment the line out
 	// https://github.com/savetheinternet/Tinyboard/issues/20
 	$config['ie_mime_type_detection'] = '/<(?:body|head|html|img|plaintext|pre|script|table|title|a href|channel|scriptlet)/i';
diff --git a/inc/image.php b/inc/image.php
index abe27bcb..eb98ceda 100644
--- a/inc/image.php
+++ b/inc/image.php
@@ -166,6 +166,9 @@ class ImageImagick extends ImageBase {
 		}
 	}
 	public function to($src) {
+		if ($config['strip_exif']) {
+			$this->image->stripImage();
+		}
 		if (preg_match('/\.gif$/i', $src))
 			$this->image->writeImages($src, true);
 		else
@@ -236,9 +239,14 @@ class ImageConvert extends ImageBase {
 		}
 	}
 	public function to($src) {
+		global $config;
+		
 		if (!$this->temp) {
-			// $config['redraw_image']
-			shell_exec('convert ' . escapeshellarg($this->src) . ' ' . escapeshellarg($src));
+			if ($config['strip_exif']) {
+				shell_exec('convert ' . escapeshellarg($this->src) . ' -strip ' . escapeshellarg($src));
+			} else {
+				shell_exec('convert ' . escapeshellarg($this->src) . ' ' . escapeshellarg($src));
+			}
 		} else {
 			rename($this->temp, $src);
 			chmod($src, 0664);
diff --git a/post.php b/post.php
index 4e10c0cf..4e3a1a9f 100644
--- a/post.php
+++ b/post.php
@@ -420,10 +420,11 @@ if (isset($_POST['delete'])) {
 				error($config['error']['maxsize']);
 			}
 			
-			// The following code corrects the image orientation based on EXIF.
-			// Currently only works with the 'convert' option selected but it could easily be expanded to work with the rest if you can be bothered.
-			if ($config['thumb_method'] == 'convert') {
-				if ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg') {
+			
+			if ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg') {
+				// The following code corrects the image orientation.
+				// Currently only works with the 'convert' option selected but it could easily be expanded to work with the rest if you can be bothered.
+				if ($config['thumb_method'] == 'convert') {
 					$exif = exif_read_data($upload);
 					if (isset($exif['Orientation']) && $exif['Orientation'] != 1) {
 						shell_exec('convert ' . escapeshellarg($upload) . ' -auto-orient ' . escapeshellarg($upload));							
@@ -473,7 +474,7 @@ if (isset($_POST['delete'])) {
 				$thumb->_destroy();
 			}
 			
-			if ($config['redraw_image']) {
+			if ($config['redraw_image'] || ($config['strip_exif'] && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg'))) {
 				$image->to($post['file']);
 				$dont_copy_file = true;
 			}
-- 
cgit v1.3


From 57c8e4ee7cea126e68ade4913c57a46f06d1a2b0 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 28 Jul 2013 20:33:26 -0400
Subject: Strip combining characters from Unicode strings (eg. Zalgo)

---
 inc/config.php    |  2 ++
 inc/functions.php | 48 +++++++++++++++++++++++++++++++++++++++++++++++-
 post.php          |  9 ++++++++-
 3 files changed, 57 insertions(+), 2 deletions(-)

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index 98e127b3..d7580a8b 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -282,6 +282,8 @@
 	$config['strip_superfluous_returns'] = true;
 	// Require an image for threads?
 	$config['force_image_op'] = true;
+	// Strip combining characters from Unicode strings (eg. "Zalgo")
+	$config['strip_combining_chars'] = true;
 	
 	// Max body length
 	$config['max_body'] = 1800;
diff --git a/inc/functions.php b/inc/functions.php
index b5660664..9d398002 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -1526,7 +1526,53 @@ function utf8tohtml($utf8) {
 	return htmlspecialchars($utf8, ENT_NOQUOTES, 'UTF-8');
 }
 
-function buildThread($id, $return=false, $mod=false) {
+function ordutf8($string, &$offset) {
+	$code = ord(substr($string, $offset,1)); 
+	if ($code >= 128) { // otherwise 0xxxxxxx
+		if ($code < 224)
+			$bytesnumber = 2; // 110xxxxx
+		else if ($code < 240)
+			$bytesnumber = 3; // 1110xxxx
+		else if ($code < 248)
+			$bytesnumber = 4; // 11110xxx
+		$codetemp = $code - 192 - ($bytesnumber > 2 ? 32 : 0) - ($bytesnumber > 3 ? 16 : 0);
+		for ($i = 2; $i <= $bytesnumber; $i++) {
+			$offset ++;
+			$code2 = ord(substr($string, $offset, 1)) - 128; //10xxxxxx
+			$codetemp = $codetemp*64 + $code2;
+		}
+		$code = $codetemp;
+	}
+	$offset += 1;
+	if ($offset >= strlen($string))
+		$offset = -1;
+	return $code;
+}
+
+function strip_combining_chars($str) {
+	$chars = preg_split('//u', $str, -1, PREG_SPLIT_NO_EMPTY);
+	$str = '';
+	foreach ($chars as $char) {	
+		$ord = ordutf8($char, $o = 0);
+		
+		if ($ord >= 768 && $ord <= 879)
+			continue;
+		
+		if ($ord >= 7616 && $ord <= 7679)
+			continue;
+		
+		if ($ord >= 8400 && $ord <= 8447)
+			continue;
+		
+		if ($ord >= 65056 && $ord <= 65071)
+			continue;
+		
+		$str .= $char;
+	}
+	return $str;
+}
+
+function buildThread($id, $return = false, $mod = false) {
 	global $board, $config;
 	$id = round($id);
 	
diff --git a/post.php b/post.php
index 4e3a1a9f..6855fe14 100644
--- a/post.php
+++ b/post.php
@@ -357,6 +357,13 @@ if (isset($_POST['delete'])) {
 		$post['thumb'] = $board['dir'] . $config['dir']['thumb'] . $post['file_id'] . '.' . ($config['thumb_ext'] ? $config['thumb_ext'] : $post['extension']);
 	}
 	
+	if ($config['strip_combining_chars']) {
+		$post['name'] = strip_combining_chars($post['name']);
+		$post['email'] = strip_combining_chars($post['email']);
+		$post['subject'] = strip_combining_chars($post['name']);
+		$post['body'] = strip_combining_chars($post['body']);
+	}
+	
 	// Check string lengths
 	if (mb_strlen($post['name']) > 35)
 		error(sprintf($config['error']['toolong'], 'name'));	
@@ -368,7 +375,7 @@ if (isset($_POST['delete'])) {
 		error($config['error']['toolong_body']);
 	if (mb_strlen($post['password']) > 20)
 		error(sprintf($config['error']['toolong'], 'password'));
-	
+		
 	wordfilters($post['body']);
 	
 	$post['body_nomarkup'] = $post['body'];
-- 
cgit v1.3


From bd8bd3c02e6cb8e130058649e646a8c8071d3386 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 28 Jul 2013 20:46:00 -0400
Subject: Fix for last commit

---
 inc/functions.php | 5 +++--
 post.php          | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

(limited to 'post.php')

diff --git a/inc/functions.php b/inc/functions.php
index 9d398002..2915e1b6 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -1552,8 +1552,9 @@ function ordutf8($string, &$offset) {
 function strip_combining_chars($str) {
 	$chars = preg_split('//u', $str, -1, PREG_SPLIT_NO_EMPTY);
 	$str = '';
-	foreach ($chars as $char) {	
-		$ord = ordutf8($char, $o = 0);
+	foreach ($chars as $char) {
+		$o = 0;
+		$ord = ordutf8($char, $o);
 		
 		if ($ord >= 768 && $ord <= 879)
 			continue;
diff --git a/post.php b/post.php
index 6855fe14..ad045b66 100644
--- a/post.php
+++ b/post.php
@@ -360,7 +360,7 @@ if (isset($_POST['delete'])) {
 	if ($config['strip_combining_chars']) {
 		$post['name'] = strip_combining_chars($post['name']);
 		$post['email'] = strip_combining_chars($post['email']);
-		$post['subject'] = strip_combining_chars($post['name']);
+		$post['subject'] = strip_combining_chars($post['subject']);
 		$post['body'] = strip_combining_chars($post['body']);
 	}
 	
-- 
cgit v1.3


From 461084d400620c32ef262aab1f837573f47b0951 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Tue, 30 Jul 2013 16:41:10 -0400
Subject: MySQL's utf8 charset only supports up to 3-byte symbols. Insterting
 four byte symbols (U+010000 to U+10FFFF) can be done maliciously to break
 HTML mark-up. The ideal solution was to convert to MySQL's utf8mb4 charset,
 but then we would lose support for MySQL < 5.5.3. In this fix, incompatible
 characters are encoded as HTML numeric character references (eg. #65536) and
 just stripped from body_nommarkup.

---
 inc/functions.php | 2 +-
 post.php          | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'post.php')

diff --git a/inc/functions.php b/inc/functions.php
index 2915e1b6..4af7891a 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -1523,7 +1523,7 @@ function markup(&$body, $track_cites = false) {
 }
 
 function utf8tohtml($utf8) {
-	return htmlspecialchars($utf8, ENT_NOQUOTES, 'UTF-8');
+	return mb_encode_numericentity(htmlspecialchars($utf8, ENT_NOQUOTES, 'UTF-8'), array(0x010000, 0xffffff, 0, 0xffffff), 'UTF-8');
 }
 
 function ordutf8($string, &$offset) {
diff --git a/post.php b/post.php
index ad045b66..e9041ce8 100644
--- a/post.php
+++ b/post.php
@@ -378,7 +378,7 @@ if (isset($_POST['delete'])) {
 		
 	wordfilters($post['body']);
 	
-	$post['body_nomarkup'] = $post['body'];
+	$post['body_nomarkup'] = preg_replace('/[\x{010000}-\x{ffffff}]/u', '', $post['body']);
 	
 	if (!($mod && isset($post['raw']) && $post['raw']))
 		$post['tracked_cites'] = markup($post['body'], true);
-- 
cgit v1.3


From 8efab06616bfcdab49fb9e996cdc7ddfe79426bb Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Tue, 30 Jul 2013 22:08:56 -0400
Subject: Upgrade to utf8mb4 charset for MySQL server versions above 5.5.3.
 Keep support for older versions. Fix charsets for multiple columns and
 tables.

---
 inc/database.php    |  21 +++++++++--
 inc/functions.php   |   5 ++-
 install.php         | 100 +++++++++++++++++++++++++++++++++++++++++++++++++++-
 install.sql         |  95 +++++++++++++++++++++++--------------------------
 post.php            |   5 ++-
 templates/posts.sql |  63 +++++++++++++++++----------------
 6 files changed, 202 insertions(+), 87 deletions(-)

(limited to 'post.php')

diff --git a/inc/database.php b/inc/database.php
index a0edd1fb..3dc0f0ce 100644
--- a/inc/database.php
+++ b/inc/database.php
@@ -51,12 +51,16 @@ function sql_open() {
 	try {
 		$options = array(
 			PDO::ATTR_TIMEOUT => $config['db']['timeout'],
-			PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES utf8',
 			PDO::MYSQL_ATTR_USE_BUFFERED_QUERY => true
 		);
 		if ($config['db']['persistent'])
 			$options[PDO::ATTR_PERSISTENT] = true;
-		return $pdo = new PDO($dsn, $config['db']['user'], $config['db']['password'], $options);
+		$pdo = new PDO($dsn, $config['db']['user'], $config['db']['password'], $options);
+		if (mysql_version() >= 50503)
+			query('SET NAMES utf8mb4') or error(db_error());
+		else
+			query('SET NAMES utf8') or error(db_error());
+		return $pdo;
 	} catch(PDOException $e) {
 		$message = $e->getMessage();
 		
@@ -65,10 +69,21 @@ function sql_open() {
 		$message = str_replace($config['db']['password'], '<em>hidden</em>', $message);
 		
 		// Print error
-		error('Database error: ' . $message);
+		error(_('Database error: ') . $message);
 	}
 }
 
+// 5.6.10 becomes 50610
+function mysql_version() {
+	global $pdo;
+	
+	$version = $pdo->getAttribute(PDO::ATTR_SERVER_VERSION);
+	$v = explode('.', $version);
+	if (count($v) != 3)
+		return false;
+	return (int) sprintf("%02d%02d%02d", $v[0], $v[1], $v[2]);
+}
+
 function prepare($query) {
 	global $pdo, $debug, $config;
 	
diff --git a/inc/functions.php b/inc/functions.php
index 4af7891a..d5692be5 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -1399,6 +1399,9 @@ function markup(&$body, $track_cites = false) {
 	$body = str_replace("\r", '', $body);
 	$body = utf8tohtml($body);
 	
+	if (mysql_version() < 50503)
+		$body = mb_encode_numericentity($body, array(0x010000, 0xffffff, 0, 0xffffff), 'UTF-8');
+	
 	foreach ($config['markup'] as $markup) {
 		if (is_string($markup[1])) {
 			$body = preg_replace($markup[0], $markup[1], $body);
@@ -1523,7 +1526,7 @@ function markup(&$body, $track_cites = false) {
 }
 
 function utf8tohtml($utf8) {
-	return mb_encode_numericentity(htmlspecialchars($utf8, ENT_NOQUOTES, 'UTF-8'), array(0x010000, 0xffffff, 0, 0xffffff), 'UTF-8');
+	return htmlspecialchars($utf8, ENT_NOQUOTES, 'UTF-8');
 }
 
 function ordutf8($string, &$offset) {
diff --git a/install.php b/install.php
index 08e8046a..c2fe1a55 100644
--- a/install.php
+++ b/install.php
@@ -1,7 +1,7 @@
 <?php
 
 // Installation/upgrade file	
-define('VERSION', 'v0.9.6-dev-9');
+define('VERSION', 'v0.9.6-dev-10');
 
 require 'inc/functions.php';
 
@@ -248,6 +248,100 @@ if (file_exists($config['has_installed'])) {
 					$_query->execute() or error(db_error($_query));
 				}
 			}
+		case 'v0.9.6-dev-9':
+			function __query($sql) {
+				if (mysql_version() >= 50503)
+					return query($sql);
+				else
+					return query(str_replace('utf8mb4', 'utf8', $sql));
+			}
+			
+			foreach ($boards as &$board) {
+				__query(sprintf("ALTER TABLE `posts_%s`
+					CHANGE `subject` `subject` VARCHAR(100) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
+					CHANGE `email` `email` VARCHAR(30) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
+					CHANGE `name` `name` VARCHAR(35) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
+					CHANGE `trip` `trip` VARCHAR(15) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
+					CHANGE `capcode` `capcode` VARCHAR(50) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
+					CHANGE `body` `body` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL,
+					CHANGE `body_nomarkup` `body_nomarkup` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
+					CHANGE `thumb` `thumb` VARCHAR(50) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
+					CHANGE `thumbwidth` `thumbwidth` INT(11) NULL DEFAULT NULL,
+					CHANGE `thumbheight` `thumbheight` INT(11) NULL DEFAULT NULL,
+					CHANGE `file` `file` VARCHAR(50) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
+					CHANGE `filename` `filename` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
+					CHANGE `filehash` `filehash` TEXT CHARACTER SET ascii COLLATE ascii_general_ci NULL DEFAULT NULL,
+					CHANGE `password` `password` VARCHAR(20) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
+					CHANGE `ip` `ip` VARCHAR(39) CHARACTER SET ascii COLLATE ascii_general_ci NOT NULL,
+					CHANGE `embed` `embed` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
+					DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;", $board['uri'])) or error(db_error());
+			}
+			
+			__query("ALTER TABLE  `antispam`
+				CHANGE  `board`  `board` VARCHAR( 120 ) CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL ,
+				CHANGE  `hash`  `hash` CHAR( 40 ) CHARACTER SET ASCII COLLATE ascii_bin NOT NULL ,
+				DEFAULT CHARACTER SET ASCII COLLATE ascii_bin;") or error(db_error());
+			__query("ALTER TABLE  `bans`
+				CHANGE  `ip`  `ip` VARCHAR( 39 ) CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL ,
+				CHANGE  `reason`  `reason` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL ,
+				CHANGE  `board`  `board` VARCHAR( 120 ) CHARACTER SET ASCII COLLATE ascii_general_ci NULL DEFAULT NULL,
+				DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;") or error(db_error());
+			__query("ALTER TABLE  `boards`
+				CHANGE  `uri`  `uri` VARCHAR( 120 ) CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL ,
+				CHANGE  `title`  `title` TINYTEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL ,
+				CHANGE  `subtitle`  `subtitle` TINYTEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL,
+				DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;") or error(db_error());
+			__query("ALTER TABLE  `cites`
+				CHANGE  `board`  `board` VARCHAR( 120 ) CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL ,
+				CHANGE  `target_board`  `target_board` VARCHAR( 120 ) CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL ,
+				DEFAULT CHARACTER SET ASCII COLLATE ascii_general_ci;") or error(db_error());
+			__query("ALTER TABLE  `ip_notes`
+				CHANGE  `ip`  `ip` VARCHAR( 39 ) CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL ,
+				CHANGE  `body`  `body` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL ,
+				DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;") or error(db_error());
+			__query("ALTER TABLE  `ip_notes`
+				CHANGE  `ip`  `ip` VARCHAR( 39 ) CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL ,
+				CHANGE  `body`  `body` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL ,
+				DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;") or error(db_error());
+			__query("ALTER TABLE  `modlogs`
+				CHANGE  `ip`  `ip` VARCHAR( 39 ) CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL ,
+				CHANGE  `board`  `board` VARCHAR( 120 ) CHARACTER SET ASCII COLLATE ascii_general_ci NULL DEFAULT NULL ,
+				CHANGE  `text`  `text` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL ,
+				DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;") or error(db_error());
+			__query("ALTER TABLE  `mods`
+				CHANGE  `username`  `username` VARCHAR( 30 ) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL ,
+				CHANGE  `password`  `password` CHAR( 64 ) CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL COMMENT 'SHA256',
+				CHANGE  `salt`  `salt` CHAR( 32 ) CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL ,
+				CHANGE  `boards`  `boards` TEXT CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL ,
+				DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;") or error(db_error());
+			__query("ALTER TABLE  `mutes`
+				CHANGE  `ip`  `ip` VARCHAR( 39 ) CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL ,
+				DEFAULT CHARACTER SET ASCII COLLATE ascii_general_ci;") or error(db_error());
+			__query("ALTER TABLE  `news`
+				CHANGE  `name`  `name` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL ,
+				CHANGE  `subject`  `subject` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL ,
+				CHANGE  `body`  `body` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL ,
+				DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;") or error(db_error());
+			__query("ALTER TABLE  `noticeboard`
+				CHANGE  `subject`  `subject` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL ,
+				CHANGE  `body`  `body` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL ,
+				DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;") or error(db_error());
+			__query("ALTER TABLE  `pms`
+				CHANGE  `message`  `message` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL ,
+				DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;") or error(db_error());
+			__query("ALTER TABLE  `reports`
+				CHANGE  `ip`  `ip` VARCHAR( 39 ) CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL ,
+				CHANGE  `board`  `board` VARCHAR( 120 ) CHARACTER SET ASCII COLLATE ascii_general_ci NULL DEFAULT NULL ,
+				CHANGE  `reason`  `reason` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL ,
+				DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;") or error(db_error());
+			__query("ALTER TABLE  `robot`
+				CHANGE  `hash`  `hash` VARCHAR( 40 ) CHARACTER SET ASCII COLLATE ascii_bin NOT NULL COMMENT  'SHA1',
+				DEFAULT CHARACTER SET ASCII COLLATE ascii_bin;") or error(db_error());
+			__query("ALTER TABLE  `theme_settings`
+				CHANGE  `theme`  `theme` VARCHAR( 40 ) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL ,
+				CHANGE  `name`  `name` VARCHAR( 40 ) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL ,
+				CHANGE  `value`  `value` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL ,
+				DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;") or eror(db_error());
 		case false:
 			// Update version number
 			file_write($config['has_installed'], VERSION);
@@ -547,6 +641,10 @@ if ($step == 0) {
 	
 	$sql = @file_get_contents('install.sql') or error("Couldn't load install.sql.");
 	
+	sql_open();
+	if (mysql_version() < 50503)
+		$sql = str_replace('utf8', 'utf8mb4', $sql);
+	
 	// This code is probably horrible, but what I'm trying
 	// to do is find all of the SQL queires and put them
 	// in an array.
diff --git a/install.sql b/install.sql
index ee2ca8a9..c4e82820 100644
--- a/install.sql
+++ b/install.sql
@@ -1,25 +1,20 @@
 -- phpMyAdmin SQL Dump
--- version 3.4.2
+-- version 4.0.4.1
 -- http://www.phpmyadmin.net
 --
 -- Host: localhost
--- Generation Time: Apr 12, 2012 at 11:22 PM
--- Server version: 5.1.61
--- PHP Version: 5.3.3-7+squeeze8
+-- Generation Time: Jul 30, 2013 at 09:45 PM
+-- Server version: 5.6.10
+-- PHP Version: 5.3.15
 
-SET SQL_MODE="NO_AUTO_VALUE_ON_ZERO";
+SET SQL_MODE = "NO_AUTO_VALUE_ON_ZERO";
 SET time_zone = "+00:00";
 
-
 /*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
 /*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
 /*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
 /*!40101 SET NAMES utf8 */;
 
---
--- Database: `tinyboard`
---
-
 -- --------------------------------------------------------
 
 --
@@ -27,15 +22,15 @@ SET time_zone = "+00:00";
 --
 
 CREATE TABLE IF NOT EXISTS `antispam` (
-  `board` varchar(255) NOT NULL,
+  `board` varchar(120) CHARACTER SET ascii NOT NULL,
   `thread` int(11) DEFAULT NULL,
-  `hash` char(40) NOT NULL,
+  `hash` char(40) COLLATE ascii_bin NOT NULL,
   `created` int(11) NOT NULL,
   `expires` int(11) DEFAULT NULL,
   `passed` smallint(6) NOT NULL,
   PRIMARY KEY (`hash`),
   KEY `board` (`board`,`thread`)
-) ENGINE=MyISAM DEFAULT CHARSET=utf8;
+) ENGINE=MyISAM DEFAULT CHARSET=ascii COLLATE=ascii_bin;
 
 -- --------------------------------------------------------
 
@@ -44,17 +39,17 @@ CREATE TABLE IF NOT EXISTS `antispam` (
 --
 
 CREATE TABLE IF NOT EXISTS `bans` (
-  `id` int(11) UNSIGNED NOT NULL AUTO_INCREMENT,
-  `ip` varchar(45) NOT NULL,
+  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
+  `ip` varchar(39) CHARACTER SET ascii NOT NULL,
   `mod` int(11) NOT NULL COMMENT 'which mod made the ban',
   `set` int(11) NOT NULL,
   `expires` int(11) DEFAULT NULL,
   `reason` text,
-  `board` varchar(120) DEFAULT NULL,
+  `board` varchar(120) CHARACTER SET ascii DEFAULT NULL,
   `seen` tinyint(1) NOT NULL,
   PRIMARY KEY (`id`),
   FULLTEXT KEY `ip` (`ip`)
-) ENGINE=MyISAM DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;
+) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 AUTO_INCREMENT=1 ;
 
 -- --------------------------------------------------------
 
@@ -63,18 +58,18 @@ CREATE TABLE IF NOT EXISTS `bans` (
 --
 
 CREATE TABLE IF NOT EXISTS `boards` (
-  `uri` varchar(120) NOT NULL,
+  `uri` varchar(120) CHARACTER SET ascii NOT NULL,
   `title` tinytext NOT NULL,
   `subtitle` tinytext,
   PRIMARY KEY (`uri`)
-) ENGINE=MyISAM DEFAULT CHARSET=utf8;
+) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4;
 
 --
 -- Dumping data for table `boards`
 --
 
-INSERT INTO `boards` (`uri`, `title`, `subtitle`) VALUES
-('b', 'Beta', 'In development.');
+INSERT INTO `boards` VALUES
+('b', 'Random', NULL);
 
 -- --------------------------------------------------------
 
@@ -83,13 +78,13 @@ INSERT INTO `boards` (`uri`, `title`, `subtitle`) VALUES
 --
 
 CREATE TABLE IF NOT EXISTS `cites` (
-  `board` varchar(8) NOT NULL,
+  `board` varchar(120) NOT NULL,
   `post` int(11) NOT NULL,
-  `target_board` varchar(8) NOT NULL,
+  `target_board` varchar(120) NOT NULL,
   `target` int(11) NOT NULL,
   KEY `target` (`target_board`,`target`),
   KEY `post` (`board`,`post`)
-) ENGINE=MyISAM DEFAULT CHARSET=utf8;
+) ENGINE=MyISAM DEFAULT CHARSET=ascii;
 
 -- --------------------------------------------------------
 
@@ -98,14 +93,14 @@ CREATE TABLE IF NOT EXISTS `cites` (
 --
 
 CREATE TABLE IF NOT EXISTS `ip_notes` (
-  `id` int(11) UNSIGNED NOT NULL AUTO_INCREMENT,
-  `ip` varchar(45) NOT NULL,
+  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
+  `ip` varchar(39) CHARACTER SET ascii NOT NULL,
   `mod` int(11) DEFAULT NULL,
   `time` int(11) NOT NULL,
   `body` text NOT NULL,
   UNIQUE KEY `id` (`id`),
   KEY `ip` (`ip`)
-) ENGINE=MyISAM DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;
+) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 AUTO_INCREMENT=1 ;
 
 -- --------------------------------------------------------
 
@@ -115,12 +110,12 @@ CREATE TABLE IF NOT EXISTS `ip_notes` (
 
 CREATE TABLE IF NOT EXISTS `modlogs` (
   `mod` int(11) NOT NULL,
-  `ip` varchar(45) NOT NULL,
-  `board` varchar(120) DEFAULT NULL,
+  `ip` varchar(39) CHARACTER SET ascii NOT NULL,
+  `board` varchar(120) CHARACTER SET ascii DEFAULT NULL,
   `time` int(11) NOT NULL,
   `text` text NOT NULL,
   KEY `time` (`time`)
-) ENGINE=MyISAM DEFAULT CHARSET=utf8;
+) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4;
 
 -- --------------------------------------------------------
 
@@ -131,19 +126,19 @@ CREATE TABLE IF NOT EXISTS `modlogs` (
 CREATE TABLE IF NOT EXISTS `mods` (
   `id` smallint(6) unsigned NOT NULL AUTO_INCREMENT,
   `username` varchar(30) NOT NULL,
-  `password` char(64) NOT NULL COMMENT 'SHA256',
-  `salt` char(32) NOT NULL,
+  `password` char(64) CHARACTER SET ascii NOT NULL COMMENT 'SHA256',
+  `salt` char(32) CHARACTER SET ascii NOT NULL,
   `type` smallint(1) NOT NULL COMMENT '0: janitor, 1: mod, 2: admin',
-  `boards` text NOT NULL,
+  `boards` text CHARACTER SET ascii NOT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `id` (`id`,`username`)
-) ENGINE=MyISAM  DEFAULT CHARSET=utf8 AUTO_INCREMENT=2 ;
+) ENGINE=MyISAM  DEFAULT CHARSET=utf8mb4 AUTO_INCREMENT=4 ;
 
 --
 -- Dumping data for table `mods`
 --
 
-INSERT INTO `mods` (`id`, `username`, `password`, `salt`, `type`, `boards`) VALUES
+INSERT INTO `mods` VALUES
 (1, 'admin', 'cedad442efeef7112fed0f50b011b2b9bf83f6898082f995f69dd7865ca19fb7', '4a44c6c55df862ae901b413feecb0d49', 2, '*');
 
 -- --------------------------------------------------------
@@ -153,10 +148,10 @@ INSERT INTO `mods` (`id`, `username`, `password`, `salt`, `type`, `boards`) VALU
 --
 
 CREATE TABLE IF NOT EXISTS `mutes` (
-  `ip` varchar(45) NOT NULL,
+  `ip` varchar(39) NOT NULL,
   `time` int(11) NOT NULL,
   KEY `ip` (`ip`)
-) ENGINE=MyISAM DEFAULT CHARSET=utf8;
+) ENGINE=MyISAM DEFAULT CHARSET=ascii;
 
 -- --------------------------------------------------------
 
@@ -165,14 +160,14 @@ CREATE TABLE IF NOT EXISTS `mutes` (
 --
 
 CREATE TABLE IF NOT EXISTS `news` (
-  `id` int(11) UNSIGNED NOT NULL AUTO_INCREMENT,
+  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
   `name` text NOT NULL,
   `time` int(11) NOT NULL,
   `subject` text NOT NULL,
   `body` text NOT NULL,
   UNIQUE KEY `id` (`id`),
   KEY `time` (`time`)
-) ENGINE=MyISAM DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;
+) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 AUTO_INCREMENT=1 ;
 
 -- --------------------------------------------------------
 
@@ -181,13 +176,13 @@ CREATE TABLE IF NOT EXISTS `news` (
 --
 
 CREATE TABLE IF NOT EXISTS `noticeboard` (
-  `id` int(11) UNSIGNED NOT NULL AUTO_INCREMENT,
+  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
   `mod` int(11) NOT NULL,
   `time` int(11) NOT NULL,
   `subject` text NOT NULL,
   `body` text NOT NULL,
   UNIQUE KEY `id` (`id`)
-) ENGINE=MyISAM DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;
+) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 AUTO_INCREMENT=1 ;
 
 -- --------------------------------------------------------
 
@@ -196,14 +191,14 @@ CREATE TABLE IF NOT EXISTS `noticeboard` (
 --
 
 CREATE TABLE IF NOT EXISTS `pms` (
-  `id` int(11) UNSIGNED NOT NULL AUTO_INCREMENT,
+  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
   `sender` int(11) NOT NULL,
   `to` int(11) NOT NULL,
   `message` text NOT NULL,
   `time` int(11) NOT NULL,
   `unread` tinyint(1) NOT NULL,
   PRIMARY KEY (`id`)
-) ENGINE=MyISAM DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;
+) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 AUTO_INCREMENT=1 ;
 
 -- --------------------------------------------------------
 
@@ -212,14 +207,14 @@ CREATE TABLE IF NOT EXISTS `pms` (
 --
 
 CREATE TABLE IF NOT EXISTS `reports` (
-  `id` int(11) UNSIGNED NOT NULL AUTO_INCREMENT,
+  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
   `time` int(11) NOT NULL,
-  `ip` varchar(45) NOT NULL,
-  `board` varchar(120) DEFAULT NULL,
+  `ip` varchar(39) CHARACTER SET ascii NOT NULL,
+  `board` varchar(120) CHARACTER SET ascii DEFAULT NULL,
   `post` int(11) NOT NULL,
   `reason` text NOT NULL,
   PRIMARY KEY (`id`)
-) ENGINE=MyISAM DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;
+) ENGINE=MyISAM  DEFAULT CHARSET=utf8mb4 AUTO_INCREMENT=3 ;
 
 -- --------------------------------------------------------
 
@@ -228,9 +223,9 @@ CREATE TABLE IF NOT EXISTS `reports` (
 --
 
 CREATE TABLE IF NOT EXISTS `robot` (
-  `hash` varchar(40) NOT NULL COMMENT 'SHA1',
+  `hash` varchar(40) COLLATE ascii_bin NOT NULL COMMENT 'SHA1',
   PRIMARY KEY (`hash`)
-) ENGINE=MyISAM DEFAULT CHARSET=utf8;
+) ENGINE=MyISAM DEFAULT CHARSET=ascii COLLATE=ascii_bin;
 
 -- --------------------------------------------------------
 
@@ -243,7 +238,7 @@ CREATE TABLE IF NOT EXISTS `theme_settings` (
   `name` varchar(40) DEFAULT NULL,
   `value` text,
   KEY `theme` (`theme`)
-) ENGINE=MyISAM DEFAULT CHARSET=utf8;
+) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4;
 
 /*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
 /*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
diff --git a/post.php b/post.php
index e9041ce8..d1749fd1 100644
--- a/post.php
+++ b/post.php
@@ -378,7 +378,10 @@ if (isset($_POST['delete'])) {
 		
 	wordfilters($post['body']);
 	
-	$post['body_nomarkup'] = preg_replace('/[\x{010000}-\x{ffffff}]/u', '', $post['body']);
+	if (mysql_version() >= 50503)
+		$post['body_nomarkup'] = $post['body']; // Assume we're using the utf8mb4 charset
+	else
+		$post['body_nomarkup'] = preg_replace('/[\x{010000}-\x{ffffff}]/u', '', $post['body']); // MySQL's `utf8` charset only supports up to 3-byte symbols
 	
 	if (!($mod && isset($post['raw']) && $post['raw']))
 		$post['tracked_cites'] = markup($post['body'], true);
diff --git a/templates/posts.sql b/templates/posts.sql
index c766d38e..0a1dc92a 100644
--- a/templates/posts.sql
+++ b/templates/posts.sql
@@ -1,32 +1,33 @@
 CREATE TABLE IF NOT EXISTS `posts_{{ board }}` (
-  `id` int(11) UNSIGNED NOT NULL AUTO_INCREMENT,
-  `thread` int(11) DEFAULT NULL,
-  `subject` varchar(100) DEFAULT NULL,
-  `email` varchar(30) DEFAULT NULL,
-  `name` varchar(35) DEFAULT NULL,
-  `trip` varchar(15) DEFAULT NULL,
-  `capcode` varchar(50) DEFAULT NULL,
-  `body` text NOT NULL,
-  `body_nomarkup` text DEFAULT NULL,
-  `time` int(11) NOT NULL,
-  `bump` int(11) DEFAULT NULL,
-  `thumb` varchar(50) DEFAULT NULL,
-  `thumbwidth` int(11) DEFAULT NULL,
-  `thumbheight` int(11) DEFAULT NULL,
-  `file` varchar(50) DEFAULT NULL,
-  `filewidth` int(11) DEFAULT NULL,
-  `fileheight` int(11) DEFAULT NULL,
-  `filesize` int(11) DEFAULT NULL,
-  `filename` text DEFAULT NULL,
-  `filehash` text DEFAULT NULL,
-  `password` varchar(20) DEFAULT NULL,
-  `ip` varchar(45) NOT NULL,
-  `sticky` int(1) NOT NULL,
-  `locked` int(1) NOT NULL,
-  `sage` int(1) NOT NULL,
-  `embed` text,
-  UNIQUE KEY `id` (`id`),
-  KEY `thread_id` (`thread`, `id`),
-  KEY `time` (`time`),
-  FULLTEXT KEY `body` (`body`)
-) ENGINE=MyISAM DEFAULT CHARSET=utf8 AUTO_INCREMENT=1 ;
+   `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
+   `thread` int(11) DEFAULT NULL,
+   `subject` varchar(100) DEFAULT NULL,
+   `email` varchar(30) DEFAULT NULL,
+   `name` varchar(35) DEFAULT NULL,
+   `trip` varchar(15) DEFAULT NULL,
+   `capcode` varchar(50) DEFAULT NULL,
+   `body` text NOT NULL,
+   `body_nomarkup` text,
+   `time` int(11) NOT NULL,
+   `bump` int(11) DEFAULT NULL,
+   `thumb` varchar(50) DEFAULT NULL,
+   `thumbwidth` int(11) DEFAULT NULL,
+   `thumbheight` int(11) DEFAULT NULL,
+   `file` varchar(50) DEFAULT NULL,
+   `filewidth` int(11) DEFAULT NULL,
+   `fileheight` int(11) DEFAULT NULL,
+   `filesize` int(11) DEFAULT NULL,
+   `filename` text,
+   `filehash` text CHARACTER SET ascii,
+   `password` varchar(20) DEFAULT NULL,
+   `ip` varchar(39) CHARACTER SET ascii NOT NULL,
+   `sticky` int(1) NOT NULL,
+   `locked` int(1) NOT NULL,
+   `sage` int(1) NOT NULL,
+   `embed` text,
+   UNIQUE KEY `id` (`id`),
+   KEY `thread_id` (`thread`,`id`),
+   KEY `time` (`time`),
+   FULLTEXT KEY `body` (`body`)
+ ) ENGINE=MyISAM DEFAULT CHARSET=utf8mb4 AUTO_INCREMENT=1 ;
+ 
\ No newline at end of file
-- 
cgit v1.3


From 42cba538878cb695ba8b3093f72bc66ccd2fa074 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Wed, 31 Jul 2013 02:08:55 -0400
Subject: Allow Unicode in board URIs.

---
 inc/config.php    |  3 +++
 inc/display.php   |  6 +++---
 inc/functions.php |  8 ++++----
 inc/mod/pages.php |  9 ++++-----
 install.php       | 23 ++++++++++++++++++-----
 install.sql       | 22 +++++++++++-----------
 mod.php           | 33 +++++++++++++++++----------------
 post.php          |  6 +++---
 8 files changed, 63 insertions(+), 47 deletions(-)

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index 28a7a4db..36518028 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -1130,6 +1130,9 @@
 	//	'type' => 'scp'
 	//);
 	
+	// Regex for board URIs
+	$config['board_regex'] = '[0-9a-zA-Z$_\x{0080}-\x{FFFF}]{1,58}';
+	
 	// Complex regular expression to catch URLs
 	$config['url_regex'] = '/' . '(https?|ftp):\/\/' . '(([\w\-]+\.)+[a-zA-Z]{2,6}|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})' . '(:\d+)?' . '(\/([\w\-~.#\/?=&;:+%!*\[\]@$\'()+,|\^]+)?)?' . '/';
 
diff --git a/inc/display.php b/inc/display.php
index a7e4826e..0992166d 100644
--- a/inc/display.php
+++ b/inc/display.php
@@ -235,7 +235,7 @@ function bidi_cleanup($str){
 function secure_link_confirm($text, $title, $confirm_message, $href) {
 	global $config;
 
-	return '<a onclick="if (event.which==2) return true;if (confirm(\'' . htmlentities(addslashes($confirm_message)) . '\')) document.location=\'?/' . htmlentities(addslashes($href . '/' . make_secure_link_token($href))) . '\';return false;" title="' . htmlentities($title) . '" href="?/' . $href . '">' . $text . '</a>';
+	return '<a onclick="if (event.which==2) return true;if (confirm(\'' . htmlentities(addslashes($confirm_message)) . '\')) document.location=\'?/' . htmlspecialchars(addslashes($href . '/' . make_secure_link_token($href))) . '\';return false;" title="' . htmlentities($title) . '" href="?/' . $href . '">' . $text . '</a>';
 }
 function secure_link($href) {
 	return $href . '/' . make_secure_link_token($href);
@@ -299,7 +299,7 @@ class Post {
 			// Fix internal links
 			// Very complicated regex
 			$this->body = preg_replace(
-				'/<a((([a-zA-Z]+="[^"]+")|[a-zA-Z]+=[a-zA-Z]+|\s)*)href="' . preg_quote($config['root'], '/') . '(' . sprintf(preg_quote($config['board_path'], '/'), '\w+') . ')/',
+				'/<a((([a-zA-Z]+="[^"]+")|[a-zA-Z]+=[a-zA-Z]+|\s)*)href="' . preg_quote($config['root'], '/') . '(' . sprintf(preg_quote($config['board_path'], '/'), $config['board_regex']) . ')/u',
 				'<a $1href="?/$4',
 				$this->body
 			);
@@ -398,7 +398,7 @@ class Thread {
 			// Fix internal links
 			// Very complicated regex
 			$this->body = preg_replace(
-				'/<a((([a-zA-Z]+="[^"]+")|[a-zA-Z]+=[a-zA-Z]+|\s)*)href="' . preg_quote($config['root'], '/') . '(' . sprintf(preg_quote($config['board_path'], '/'), '\w+') . ')/',
+				'/<a((([a-zA-Z]+="[^"]+")|[a-zA-Z]+=[a-zA-Z]+|\s)*)href="' . preg_quote($config['root'], '/') . '(' . sprintf(preg_quote($config['board_path'], '/'), $config['board_regex']) . ')/u',
 				'<a $1href="?/$4',
 				$this->body
 			);
diff --git a/inc/functions.php b/inc/functions.php
index d5692be5..6db21c54 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -98,18 +98,18 @@ function loadConfig() {
 					'https?:\/\/' . $_SERVER['HTTP_HOST']) .
 					preg_quote($config['root'], '/') .
 				'(' .
-						str_replace('%s', '\w+', preg_quote($config['board_path'], '/')) .
+						str_replace('%s', $config['board_regex'], preg_quote($config['board_path'], '/')) .
 						'(' .
 							preg_quote($config['file_index'], '/') . '|' .
 							str_replace('%d', '\d+', preg_quote($config['file_page'])) .
 						')?' .
 					'|' .
-						str_replace('%s', '\w+', preg_quote($config['board_path'], '/')) .
+						str_replace('%s', $config['board_regex'], preg_quote($config['board_path'], '/')) .
 						preg_quote($config['dir']['res'], '/') .
 						str_replace('%d', '\d+', preg_quote($config['file_page'], '/')) .
 					'|' .
 						preg_quote($config['file_mod'], '/') . '\?\/.+' .
-				')([#?](.+)?)?$/i';
+				')([#?](.+)?)?$/ui';
 		} else {
 			// CLI mode
 			$config['referer_match'] = '//';
@@ -1468,7 +1468,7 @@ function markup(&$body, $track_cites = false) {
 	}
 		
 	// Cross-board linking
-	if (preg_match_all('/(^|\s)&gt;&gt;&gt;\/(\w+?)\/(\d+)?([\s,.)?]|$)/m', $body, $cites, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) {
+	if (preg_match_all('/(^|\s)&gt;&gt;&gt;\/(' . $config['board_regex'] . 'f?)\/(\d+)?([\s,.)?]|$)/um', $body, $cites, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) {
 		if (count($cites[0]) > $config['max_cites']) {
 			error($config['error']['toomanycross']);
 		}
diff --git a/inc/mod/pages.php b/inc/mod/pages.php
index fdf9d8e9..ab4cdaaf 100644
--- a/inc/mod/pages.php
+++ b/inc/mod/pages.php
@@ -443,7 +443,7 @@ function mod_new_board() {
 		if ($_POST['title'] == '')
 			error(sprintf($config['error']['required'], 'title'));
 		
-		if (!preg_match('/^\w+$/', $_POST['uri']))
+		if (!preg_match('/^' . $config['board_regex'] . '$/u', $_POST['uri']))
 			error(sprintf($config['error']['invalidfield'], 'URI'));
 		
 		if (openBoard($_POST['uri'])) {
@@ -746,7 +746,6 @@ function mod_page_ip($ip) {
 		openBoard($board['uri']);
 		if (!hasPermission($config['mod']['show_ip'], $board['uri']))
 			continue;
-		
 		$query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `ip` = :ip ORDER BY `sticky` DESC, `id` DESC LIMIT :limit', $board['uri']));
 		$query->bindValue(':ip', $ip);
 		$query->bindValue(':limit', $config['mod']['ip_recentposts'], PDO::PARAM_INT);
@@ -1420,7 +1419,7 @@ function mod_user($uid) {
 		
 			$boards = array();
 			foreach ($_POST as $name => $value) {
-				if (preg_match('/^board_(\w+)$/', $name, $matches) && in_array($matches[1], $_boards))
+				if (preg_match('/^board_(' . $config['board_regex'] . ')$/u', $name, $matches) && in_array($matches[1], $_boards))
 					$boards[] = $matches[1];
 			}
 		}
@@ -1541,7 +1540,7 @@ function mod_user_new() {
 			
 			$boards = array();
 			foreach ($_POST as $name => $value) {
-				if (preg_match('/^board_(\w+)$/', $name, $matches) && in_array($matches[1], $_boards))
+				if (preg_match('/^board_(' . $config['board_regex'] . ')$/u', $name, $matches) && in_array($matches[1], $_boards))
 					$boards[] = $matches[1];
 			}
 		}
@@ -2135,7 +2134,7 @@ function mod_debug_antispam() {
 			$where .= ' AND `thread` = ' . $pdo->quote($_POST['thread']);
 		
 		if (isset($_POST['purge'])) {
-			$query = prepare('UPDATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE' . $where);
+			$query = prepare(', DATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE' . $where);
 			$query->bindValue(':expires', $config['spam']['hidden_inputs_expire']);
 			$query->execute() or error(db_error());
 		}
diff --git a/install.php b/install.php
index 1f148e92..847876ab 100644
--- a/install.php
+++ b/install.php
@@ -1,7 +1,7 @@
 <?php
 
 // Installation/upgrade file	
-define('VERSION', 'v0.9.6-dev-10');
+define('VERSION', 'v0.9.6-dev-11');
 
 require 'inc/functions.php';
 
@@ -300,10 +300,6 @@ if (file_exists($config['has_installed'])) {
 				CHANGE  `ip`  `ip` VARCHAR( 39 ) CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL ,
 				CHANGE  `body`  `body` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL ,
 				DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;") or error(db_error());
-			__query("ALTER TABLE  `ip_notes`
-				CHANGE  `ip`  `ip` VARCHAR( 39 ) CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL ,
-				CHANGE  `body`  `body` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NOT NULL ,
-				DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;") or error(db_error());
 			__query("ALTER TABLE  `modlogs`
 				CHANGE  `ip`  `ip` VARCHAR( 39 ) CHARACTER SET ASCII COLLATE ascii_general_ci NOT NULL ,
 				CHANGE  `board`  `board` VARCHAR( 120 ) CHARACTER SET ASCII COLLATE ascii_general_ci NULL DEFAULT NULL ,
@@ -343,6 +339,23 @@ if (file_exists($config['has_installed'])) {
 				CHANGE  `name`  `name` VARCHAR( 40 ) CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL ,
 				CHANGE  `value`  `value` TEXT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci NULL DEFAULT NULL ,
 				DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;") or eror(db_error());
+		case 'v0.9.6-dev-10':
+			query("ALTER TABLE  `antispam`
+				CHANGE  `board`  `board` VARCHAR( 58 ) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL;") or error(db_error());
+			query("ALTER TABLE  `bans`
+				CHANGE  `board`  `board` VARCHAR( 58 ) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL;") or error(db_error());
+			query("ALTER TABLE  `boards`
+				CHANGE  `uri`  `uri` VARCHAR( 58 ) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL;") or error(db_error());
+			query("ALTER TABLE  `cites`
+				CHANGE  `board`  `board` VARCHAR( 58 ) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL ,
+				CHANGE  `target_board`  `target_board` VARCHAR( 58 ) CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL ,
+				DEFAULT CHARACTER SET utf8 COLLATE utf8_general_ci;") or error(db_error());
+			query("ALTER TABLE  `modlogs`
+				CHANGE  `board`  `board` VARCHAR( 58 ) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL;") or error(db_error());
+			query("ALTER TABLE  `mods`
+				CHANGE  `boards`  `boards` TEXT CHARACTER SET utf8 COLLATE utf8_general_ci NOT NULL;") or error(db_error());
+			query("ALTER TABLE  `reports`
+				CHANGE  `board`  `board` VARCHAR( 58 ) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL;") or error(db_error());
 		case false:
 			// Update version number
 			file_write($config['has_installed'], VERSION);
diff --git a/install.sql b/install.sql
index c4e82820..db89452b 100644
--- a/install.sql
+++ b/install.sql
@@ -22,7 +22,7 @@ SET time_zone = "+00:00";
 --
 
 CREATE TABLE IF NOT EXISTS `antispam` (
-  `board` varchar(120) CHARACTER SET ascii NOT NULL,
+  `board` varchar(58) CHARACTER SET utf8 NOT NULL,
   `thread` int(11) DEFAULT NULL,
   `hash` char(40) COLLATE ascii_bin NOT NULL,
   `created` int(11) NOT NULL,
@@ -45,7 +45,7 @@ CREATE TABLE IF NOT EXISTS `bans` (
   `set` int(11) NOT NULL,
   `expires` int(11) DEFAULT NULL,
   `reason` text,
-  `board` varchar(120) CHARACTER SET ascii DEFAULT NULL,
+  `board` varchar(58) CHARACTER SET utf8 DEFAULT NULL,
   `seen` tinyint(1) NOT NULL,
   PRIMARY KEY (`id`),
   FULLTEXT KEY `ip` (`ip`)
@@ -58,7 +58,7 @@ CREATE TABLE IF NOT EXISTS `bans` (
 --
 
 CREATE TABLE IF NOT EXISTS `boards` (
-  `uri` varchar(120) CHARACTER SET ascii NOT NULL,
+  `uri` varchar(58) CHARACTER SET utf8 NOT NULL,
   `title` tinytext NOT NULL,
   `subtitle` tinytext,
   PRIMARY KEY (`uri`)
@@ -78,13 +78,13 @@ INSERT INTO `boards` VALUES
 --
 
 CREATE TABLE IF NOT EXISTS `cites` (
-  `board` varchar(120) NOT NULL,
+  `board` varchar(58) NOT NULL,
   `post` int(11) NOT NULL,
-  `target_board` varchar(120) NOT NULL,
+  `target_board` varchar(58) NOT NULL,
   `target` int(11) NOT NULL,
   KEY `target` (`target_board`,`target`),
   KEY `post` (`board`,`post`)
-) ENGINE=MyISAM DEFAULT CHARSET=ascii;
+) ENGINE=MyISAM DEFAULT CHARSET=utf8;
 
 -- --------------------------------------------------------
 
@@ -111,7 +111,7 @@ CREATE TABLE IF NOT EXISTS `ip_notes` (
 CREATE TABLE IF NOT EXISTS `modlogs` (
   `mod` int(11) NOT NULL,
   `ip` varchar(39) CHARACTER SET ascii NOT NULL,
-  `board` varchar(120) CHARACTER SET ascii DEFAULT NULL,
+  `board` varchar(58) CHARACTER SET utf8 DEFAULT NULL,
   `time` int(11) NOT NULL,
   `text` text NOT NULL,
   KEY `time` (`time`)
@@ -129,10 +129,10 @@ CREATE TABLE IF NOT EXISTS `mods` (
   `password` char(64) CHARACTER SET ascii NOT NULL COMMENT 'SHA256',
   `salt` char(32) CHARACTER SET ascii NOT NULL,
   `type` smallint(1) NOT NULL COMMENT '0: janitor, 1: mod, 2: admin',
-  `boards` text CHARACTER SET ascii NOT NULL,
+  `boards` text CHARACTER SET utf8 NOT NULL,
   PRIMARY KEY (`id`),
   UNIQUE KEY `id` (`id`,`username`)
-) ENGINE=MyISAM  DEFAULT CHARSET=utf8mb4 AUTO_INCREMENT=4 ;
+) ENGINE=MyISAM  DEFAULT CHARSET=utf8mb4 AUTO_INCREMENT=5 ;
 
 --
 -- Dumping data for table `mods`
@@ -210,11 +210,11 @@ CREATE TABLE IF NOT EXISTS `reports` (
   `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
   `time` int(11) NOT NULL,
   `ip` varchar(39) CHARACTER SET ascii NOT NULL,
-  `board` varchar(120) CHARACTER SET ascii DEFAULT NULL,
+  `board` varchar(58) CHARACTER SET utf8 DEFAULT NULL,
   `post` int(11) NOT NULL,
   `reason` text NOT NULL,
   PRIMARY KEY (`id`)
-) ENGINE=MyISAM  DEFAULT CHARSET=utf8mb4 AUTO_INCREMENT=3 ;
+) ENGINE=MyISAM  DEFAULT CHARSET=utf8mb4 AUTO_INCREMENT=1 ;
 
 -- --------------------------------------------------------
 
diff --git a/mod.php b/mod.php
index 4c26b559..cd4d17d4 100644
--- a/mod.php
+++ b/mod.php
@@ -18,7 +18,7 @@ if (get_magic_quotes_gpc()) {
 	$_POST = strip_array($_POST);
 }
 
-$query = isset($_SERVER['QUERY_STRING']) ? $_SERVER['QUERY_STRING'] : '';
+$query = isset($_SERVER['QUERY_STRING']) ? urldecode($_SERVER['QUERY_STRING']) : '';
 
 $pages = array(
 	''					=> ':?/',		// redirect to dashboard
@@ -45,7 +45,7 @@ $pages = array(
 	'/news/(\d+)'				=> 'news',		// view news
 	'/news/delete/(\d+)'			=> 'news_delete',	// delete from news
 	
-	'/edit/(\w+)'				=> 'edit_board',	// edit board details
+	'/edit/(\%b)'				=> 'edit_board',	// edit board details
 	'/new-board'				=> 'new_board',		// create a new board
 	
 	'/rebuild'				=> 'rebuild',		// rebuild static files
@@ -63,15 +63,15 @@ $pages = array(
 
 	// CSRF-protected moderator actions
 	'/ban'					=> 'secure_POST ban',	// new ban
-	'/(\w+)/ban(&delete)?/(\d+)'		=> 'secure_POST ban_post', // ban poster
-	'/(\w+)/move/(\d+)'			=> 'secure_POST move',	// move thread
-	'/(\w+)/edit(_raw)?/(\d+)'		=> 'secure_POST edit_post', // edit post
-	'/(\w+)/delete/(\d+)'			=> 'secure delete',	// delete post
-	'/(\w+)/deletefile/(\d+)'		=> 'secure deletefile',	// delete file from post
-	'/(\w+)/deletebyip/(\d+)(/global)?'	=> 'secure deletebyip',	// delete all posts by IP address
-	'/(\w+)/(un)?lock/(\d+)'		=> 'secure lock',	// lock thread
-	'/(\w+)/(un)?sticky/(\d+)'		=> 'secure sticky',	// sticky thread
-	'/(\w+)/bump(un)?lock/(\d+)'		=> 'secure bumplock',	// "bumplock" thread
+	'/(\%b)/ban(&delete)?/(\d+)'		=> 'secure_POST ban_post', // ban poster
+	'/(\%b)/move/(\d+)'			=> 'secure_POST move',	// move thread
+	'/(\%b)/edit(_raw)?/(\d+)'		=> 'secure_POST edit_post', // edit post
+	'/(\%b)/delete/(\d+)'			=> 'secure delete',	// delete post
+	'/(\%b)/deletefile/(\d+)'		=> 'secure deletefile',	// delete file from post
+	'/(\%b)/deletebyip/(\d+)(/global)?'	=> 'secure deletebyip',	// delete all posts by IP address
+	'/(\%b)/(un)?lock/(\d+)'		=> 'secure lock',	// lock thread
+	'/(\%b)/(un)?sticky/(\d+)'		=> 'secure sticky',	// sticky thread
+	'/(\%b)/bump(un)?lock/(\d+)'		=> 'secure bumplock',	// "bumplock" thread
 	
 	'/themes'				=> 'themes_list',	// manage themes
 	'/themes/(\w+)'				=> 'theme_configure',	// configure/reconfigure theme
@@ -86,10 +86,10 @@ $pages = array(
 	'/debug/sql'				=> 'secure_POST debug_sql',
 	
 	// This should always be at the end:
-	'/(\w+)/'										=> 'view_board',
-	'/(\w+)/' . preg_quote($config['file_index'], '!')					=> 'view_board',
-	'/(\w+)/' . str_replace('%d', '(\d+)', preg_quote($config['file_page'], '!'))		=> 'view_board',
-	'/(\w+)/' . preg_quote($config['dir']['res'], '!') .
+	'/(\%b)/'										=> 'view_board',
+	'/(\%b)/' . preg_quote($config['file_index'], '!')					=> 'view_board',
+	'/(\%b)/' . str_replace('%d', '(\d+)', preg_quote($config['file_page'], '!'))		=> 'view_board',
+	'/(\%b)/' . preg_quote($config['dir']['res'], '!') .
 			str_replace('%d', '(\d+)', preg_quote($config['file_page'], '!'))	=> 'view_thread',
 );
 
@@ -109,7 +109,8 @@ $new_pages = array();
 foreach ($pages as $key => $callback) {
 	if (is_string($callback) && preg_match('/^secure /', $callback))
 		$key .= '(/(?P<token>[a-f0-9]{8}))?';
-	$new_pages[@$key[0] == '!' ? $key : '!^' . $key . '(?:&[^&=]+=[^&]*)*$!'] = $callback;
+	$key = str_replace('\%b', $config['board_regex'], $key);
+	$new_pages[@$key[0] == '!' ? $key : '!^' . $key . '(?:&[^&=]+=[^&]*)*$!u'] = $callback;
 }
 $pages = $new_pages;
 
diff --git a/post.php b/post.php
index d1749fd1..85dc2d05 100644
--- a/post.php
+++ b/post.php
@@ -170,7 +170,7 @@ if (isset($_POST['delete'])) {
 		error($config['error']['bot']);
 	
 	// Check the referrer
-	if (!isset($_SERVER['HTTP_REFERER']) || !preg_match($config['referer_match'], $_SERVER['HTTP_REFERER']))
+	if (!isset($_SERVER['HTTP_REFERER']) || !preg_match($config['referer_match'], urldecode($_SERVER['HTTP_REFERER'])))
 		error($config['error']['referer']);
 	
 	checkDNSBL();
@@ -547,9 +547,9 @@ if (isset($_POST['delete'])) {
 	// Remove board directories before inserting them into the database.
 	if ($post['has_file']) {
 		$post['file_path'] = $post['file'];
-		$post['file'] = substr_replace($post['file'], '', 0, mb_strlen($board['dir'] . $config['dir']['img']));
+		$post['file'] = mb_substr($post['file'], mb_strlen($board['dir'] . $config['dir']['img']));
 		if ($is_an_image && $post['thumb'] != 'spoiler')
-			$post['thumb'] = substr_replace($post['thumb'], '', 0, mb_strlen($board['dir'] . $config['dir']['thumb']));
+			$post['thumb'] = mb_substr($post['thumb'], mb_strlen($board['dir'] . $config['dir']['thumb']));
 	}
 	
 	$post = (object)$post;
-- 
cgit v1.3


From 8e4c493a4c5bbff07483fd4a11c44c687c99e441 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Wed, 31 Jul 2013 12:05:19 -0400
Subject: Issue #126

---
 post.php | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index 85dc2d05..a82b56ad 100644
--- a/post.php
+++ b/post.php
@@ -378,10 +378,22 @@ if (isset($_POST['delete'])) {
 		
 	wordfilters($post['body']);
 	
-	if (mysql_version() >= 50503)
+	if (mysql_version() >= 50503) {
 		$post['body_nomarkup'] = $post['body']; // Assume we're using the utf8mb4 charset
-	else
-		$post['body_nomarkup'] = preg_replace('/[\x{010000}-\x{ffffff}]/u', '', $post['body']); // MySQL's `utf8` charset only supports up to 3-byte symbols
+	} else {
+		// MySQL's `utf8` charset only supports up to 3-byte symbols
+		// Remove anything >= 0x010000
+		
+		$chars = preg_split('//u', $post['body'], -1, PREG_SPLIT_NO_EMPTY);
+		$post['body_nomarkup'] = '';
+		foreach ($chars as $char) {
+			$o = 0;
+			$ord = ordutf8($char, $o);
+			if ($ord >= 0x010000)
+				continue;
+			$post['body_nomarkup'] .= $char;
+		}
+	}
 	
 	if (!($mod && isset($post['raw']) && $post['raw']))
 		$post['tracked_cites'] = markup($post['body'], true);
-- 
cgit v1.3


From d692bce68674934a4af2e9cba79d65e72279b0a9 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Wed, 31 Jul 2013 16:34:50 -0400
Subject: Fix issue #74. Note: This bug may break the display of certain
 filenames prior to upgrade.

---
 post.php                  | 6 +++---
 templates/post_reply.html | 4 ++--
 2 files changed, 5 insertions(+), 5 deletions(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index a82b56ad..8820db2d 100644
--- a/post.php
+++ b/post.php
@@ -284,7 +284,7 @@ if (isset($_POST['delete'])) {
 	$post['has_file'] = !isset($post['embed']) && (($post['op'] && !isset($post['no_longer_require_an_image_for_op']) && $config['force_image_op']) || (isset($_FILES['file']) && $_FILES['file']['tmp_name'] != ''));
 	
 	if ($post['has_file'])
-		$post['filename'] = utf8tohtml(get_magic_quotes_gpc() ? stripslashes($_FILES['file']['name']) : $_FILES['file']['name']);
+		$post['filename'] = urldecode(get_magic_quotes_gpc() ? stripslashes($_FILES['file']['name']) : $_FILES['file']['name']);
 	
 	if (!($post['has_file'] || isset($post['embed'])) || (($post['op'] && $config['force_body_op']) || (!$post['op'] && $config['force_body']))) {
 		$stripped_whitespace = preg_replace('/[\s]/u', '', $post['body']);
@@ -347,7 +347,7 @@ if (isset($_POST['delete'])) {
 	} else $noko = false;
 	
 	if ($post['has_file']) {
-		$post['extension'] = strtolower(substr($post['filename'], strrpos($post['filename'], '.') + 1));
+		$post['extension'] = strtolower(mb_substr($post['filename'], mb_strrpos($post['filename'], '.') + 1));
 		if (isset($config['filename_func']))
 			$post['file_id'] = $config['filename_func']($post);
 		else
@@ -414,7 +414,7 @@ if (isset($_POST['delete'])) {
 		$is_an_image = !in_array($post['extension'], $config['allowed_ext_files']);
 		
 		// Truncate filename if it is too long
-		$post['filename'] = substr($post['filename'], 0, $config['max_filename_len']);
+		$post['filename'] = mb_substr($post['filename'], 0, $config['max_filename_len']);
 		
 		$upload = $_FILES['file']['tmp_name'];
 		
diff --git a/templates/post_reply.html b/templates/post_reply.html
index bc96e74c..b0391f19 100644
--- a/templates/post_reply.html
+++ b/templates/post_reply.html
@@ -66,9 +66,9 @@
 			{% if config.show_filename and post.filename %}
 				, 
 				{% if post.filename|length > config.max_filename_display %}
-					<span class="postfilename" title="{{ post.filename|bidi_cleanup }}">{{ post.filename|truncate(config.max_filename_display)|bidi_cleanup }}</span>
+					<span class="postfilename" title="{{ post.filename|e|bidi_cleanup }}">{{ post.filename|truncate(config.max_filename_display)|bidi_cleanup }}</span>
 				{% else %}
-					<span class="postfilename">{{ post.filename|bidi_cleanup }}</span>
+					<span class="postfilename">{{ post.filename|e|bidi_cleanup }}</span>
 				{% endif %}
 			{% endif %}
 			{% if post.thumb != 'file' and config.image_identification %}
-- 
cgit v1.3


From 6d52c8b42813722c49890b6e4f776dc0dabf382c Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Wed, 31 Jul 2013 18:59:54 -0400
Subject: Markup modifiers. Fix issue #66 (public ban message lost when
 rebuilding post body)

---
 inc/functions.php | 36 +++++++++++++++++++++++++++++++++++-
 inc/mod/pages.php | 10 ++++++++--
 post.php          |  3 ++-
 3 files changed, 45 insertions(+), 4 deletions(-)

(limited to 'post.php')

diff --git a/inc/functions.php b/inc/functions.php
index 7826d41b..e638f016 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -1456,13 +1456,43 @@ function markup(&$body, $track_cites = false) {
 		}
 	}
 	
+	if (preg_match_all('@&lt;tinyboard ([\w\s]+)&gt;(.+)&lt;/tinyboard&gt;@', $body, $modifiers, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) {
+		$skip_chars = 0;
+		$body_tmp = $body;
+		
+		foreach ($modifiers as $modifier) {
+			// preg_match_all is not multibyte-safe
+			foreach ($modifier as &$match) {
+				$match[1] = mb_strlen(substr($body_tmp, 0, $match[1]));
+			}
+			
+			$modifier['type'] = $modifier[1][0];
+			$modifier['content'] = $modifier[2][0];
+			
+			if ($modifier['type'] == 'ban message') {
+				// Public ban message
+				$replacement = sprintf($config['mod']['ban_message'], $modifier['content']);
+			} elseif (preg_match('/^escape /', $modifier['type'])) {
+				// Escaped (not a real modifier)
+				$replacement = '&lt;tinyboard ' . substr($modifier['type'], strlen('escape ')) . '&gt;' . $modifier['content'] . '&lt;/tinyboard&gt;';
+			} else {
+				// Unknown
+				$replacement = '';
+			}
+			
+			$body = mb_substr_replace($body, $replacement, $modifier[0][1] + $skip_chars, mb_strlen($modifier[0][0]));
+			$skip_chars += mb_strlen($replacement) - mb_strlen($modifier[0][0]);
+			
+		}
+	}
+	
 	// replace tabs with 8 spaces
 	$body = str_replace("\t", '        ', $body);
 	
 	$tracked_cites = array();
 	
 	// Cites
-	if (isset($board) && preg_match_all('/(^|\s)&gt;&gt;(\d+?)([\s,.)?]|$)/m', $body, $cites, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) {		
+	if (isset($board) && preg_match_all('/(^|\s)&gt;&gt;(\d+?)([\s,.)?]|$)/m', $body, $cites, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) {
 		if (count($cites[0]) > $config['max_cites']) {
 			error($config['error']['toomanycites']);
 		}
@@ -1561,6 +1591,10 @@ function markup(&$body, $track_cites = false) {
 	return $tracked_cites;
 }
 
+function escape_markup_modifiers($string) {
+	return preg_replace('@<tinyboard ([\w\s]+)>(.+)</tinyboard>@', '<tinyboard escape $1>$2</tinyboard>', $string);
+}
+
 function utf8tohtml($utf8) {
 	return htmlspecialchars($utf8, ENT_NOQUOTES, 'UTF-8');
 }
diff --git a/inc/mod/pages.php b/inc/mod/pages.php
index 08604039..351d3203 100644
--- a/inc/mod/pages.php
+++ b/inc/mod/pages.php
@@ -507,6 +507,7 @@ function mod_noticeboard($page_no = 1) {
 		if (!hasPermission($config['mod']['noticeboard_post']))
 			error($config['error']['noaccess']);
 		
+		$_POST['body'] = escape_markup_modifiers($_POST['body']);
 		markup($_POST['body']);
 		
 		$query = prepare('INSERT INTO `noticeboard` VALUES (NULL, :mod, :time, :subject, :body)');
@@ -568,6 +569,7 @@ function mod_news($page_no = 1) {
 		if (!hasPermission($config['mod']['news']))
 			error($config['error']['noaccess']);
 		
+		$_POST['body'] = escape_markup_modifiers($_POST['body']);
 		markup($_POST['body']);
 		
 		$query = prepare('INSERT INTO `news` VALUES (NULL, :name, :time, :subject, :body)');
@@ -737,6 +739,7 @@ function mod_page_ip($ip) {
 		if (!hasPermission($config['mod']['create_notes']))
 			error($config['error']['noaccess']);
 		
+		$_POST['note'] = escape_markup_modifiers($_POST['note']);
 		markup($_POST['note']);
 		$query = prepare('INSERT INTO `ip_notes` VALUES (NULL, :ip, :mod, :time, :body)');
 		$query->bindValue(':ip', $ip);
@@ -1214,12 +1217,14 @@ function mod_ban_post($board, $delete, $post, $token = false) {
 		if (isset($_POST['public_message'], $_POST['message'])) {
 			// public ban message
 			$length_english = parse_time($_POST['length']) ? 'for ' . until(parse_time($_POST['length'])) : 'permanently';
+			$_POST['message'] = preg_replace('/[\r\n]/', '', $_POST['message']);
 			$_POST['message'] = str_replace('%length%', $length_english, $_POST['message']);
 			$_POST['message'] = str_replace('%LENGTH%', strtoupper($length_english), $_POST['message']);
-			$query = prepare(sprintf('UPDATE `posts_%s` SET `body` = CONCAT(`body`, :body) WHERE `id` = :id', $board));
+			$query = prepare(sprintf('UPDATE `posts_%s` SET `body_nomarkup` = CONCAT(`body_nomarkup`, :body_nomarkup) WHERE `id` = :id', $board));
 			$query->bindValue(':id', $post);
-			$query->bindValue(':body', sprintf($config['mod']['ban_message'], utf8tohtml($_POST['message'])));
+			$query->bindValue(':body_nomarkup', sprintf('<tinyboard ban message>%s</tinyboard>', $_POST['message']));
 			$query->execute() or error(db_error($query));
+			rebuildPost($post);
 			
 			modLog("Attached a public ban message to post #{$post}: " . utf8tohtml($_POST['message']));
 			buildThread($thread ? $thread : $post);
@@ -1713,6 +1718,7 @@ function mod_new_pm($username) {
 	}
 	
 	if (isset($_POST['message'])) {
+		$_POST['message'] = escape_markup_modifiers($_POST['message']);
 		markup($_POST['message']);
 		
 		$query = prepare("INSERT INTO `pms` VALUES (NULL, :me, :id, :message, :time, 1)");
diff --git a/post.php b/post.php
index 8820db2d..adb44b58 100644
--- a/post.php
+++ b/post.php
@@ -107,7 +107,7 @@ if (isset($_POST['delete'])) {
 	if (count($report) > $config['report_limit'])
 		error($config['error']['toomanyreports']);
 	
-	$reason = &$_POST['reason'];
+	$reason = escape_markup_modifiers($_POST['reason']);
 	markup($reason);
 	
 	foreach ($report as &$id) {
@@ -377,6 +377,7 @@ if (isset($_POST['delete'])) {
 		error(sprintf($config['error']['toolong'], 'password'));
 		
 	wordfilters($post['body']);
+	$post['body'] = escape_markup_modifiers($post['body']);
 	
 	if (mysql_version() >= 50503) {
 		$post['body_nomarkup'] = $post['body']; // Assume we're using the utf8mb4 charset
-- 
cgit v1.3


From 6bbe407e18681f2812db4345036bb5ae639f5973 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Wed, 31 Jul 2013 19:18:55 -0400
Subject: Markup modifiers: raw HTML

---
 inc/functions.php | 65 +++++++++++++++++++++++++++++--------------------------
 post.php          |  7 ++++--
 2 files changed, 39 insertions(+), 33 deletions(-)

(limited to 'post.php')

diff --git a/inc/functions.php b/inc/functions.php
index e638f016..7cde156b 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -1421,6 +1421,39 @@ function markup(&$body, $track_cites = false) {
 	$body = str_replace("\r", '', $body);
 	$body = utf8tohtml($body);
 	
+	if (preg_match_all('@&lt;tinyboard ([\w\s]+)&gt;(.+)&lt;/tinyboard&gt;@um', $body, $modifiers, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) {
+		$skip_chars = 0;
+		$body_tmp = $body;
+		
+		foreach ($modifiers as $modifier) {
+			// preg_match_all is not multibyte-safe
+			foreach ($modifier as &$match) {
+				$match[1] = mb_strlen(substr($body_tmp, 0, $match[1]));
+			}
+			
+			$modifier['type'] = $modifier[1][0];
+			$modifier['content'] = $modifier[2][0];
+			
+			if ($modifier['type'] == 'ban message') {
+				// Public ban message
+				$replacement = sprintf($config['mod']['ban_message'], $modifier['content']);
+			} elseif ($modifier['type'] == 'raw html') {
+				$body = html_entity_decode($modifier['content']);
+				return array();
+			} elseif (preg_match('/^escape /', $modifier['type'])) {
+				// Escaped (not a real modifier)
+				$replacement = '&lt;tinyboard ' . substr($modifier['type'], strlen('escape ')) . '&gt;' . $modifier['content'] . '&lt;/tinyboard&gt;';
+			} else {
+				// Unknown
+				$replacement = '';
+			}
+			
+			$body = mb_substr_replace($body, $replacement, $modifier[0][1] + $skip_chars, mb_strlen($modifier[0][0]));
+			$skip_chars += mb_strlen($replacement) - mb_strlen($modifier[0][0]);
+			
+		}
+	}
+	
 	if (mysql_version() < 50503)
 		$body = mb_encode_numericentity($body, array(0x010000, 0xffffff, 0, 0xffffff), 'UTF-8');
 	
@@ -1456,36 +1489,6 @@ function markup(&$body, $track_cites = false) {
 		}
 	}
 	
-	if (preg_match_all('@&lt;tinyboard ([\w\s]+)&gt;(.+)&lt;/tinyboard&gt;@', $body, $modifiers, PREG_SET_ORDER | PREG_OFFSET_CAPTURE)) {
-		$skip_chars = 0;
-		$body_tmp = $body;
-		
-		foreach ($modifiers as $modifier) {
-			// preg_match_all is not multibyte-safe
-			foreach ($modifier as &$match) {
-				$match[1] = mb_strlen(substr($body_tmp, 0, $match[1]));
-			}
-			
-			$modifier['type'] = $modifier[1][0];
-			$modifier['content'] = $modifier[2][0];
-			
-			if ($modifier['type'] == 'ban message') {
-				// Public ban message
-				$replacement = sprintf($config['mod']['ban_message'], $modifier['content']);
-			} elseif (preg_match('/^escape /', $modifier['type'])) {
-				// Escaped (not a real modifier)
-				$replacement = '&lt;tinyboard ' . substr($modifier['type'], strlen('escape ')) . '&gt;' . $modifier['content'] . '&lt;/tinyboard&gt;';
-			} else {
-				// Unknown
-				$replacement = '';
-			}
-			
-			$body = mb_substr_replace($body, $replacement, $modifier[0][1] + $skip_chars, mb_strlen($modifier[0][0]));
-			$skip_chars += mb_strlen($replacement) - mb_strlen($modifier[0][0]);
-			
-		}
-	}
-	
 	// replace tabs with 8 spaces
 	$body = str_replace("\t", '        ', $body);
 	
@@ -1592,7 +1595,7 @@ function markup(&$body, $track_cites = false) {
 }
 
 function escape_markup_modifiers($string) {
-	return preg_replace('@<tinyboard ([\w\s]+)>(.+)</tinyboard>@', '<tinyboard escape $1>$2</tinyboard>', $string);
+	return preg_replace('@<tinyboard ([\w\s]+)>(.+)</tinyboard>@m', '<tinyboard escape $1>$2</tinyboard>', $string);
 }
 
 function utf8tohtml($utf8) {
diff --git a/post.php b/post.php
index adb44b58..db077866 100644
--- a/post.php
+++ b/post.php
@@ -379,6 +379,10 @@ if (isset($_POST['delete'])) {
 	wordfilters($post['body']);
 	$post['body'] = escape_markup_modifiers($post['body']);
 	
+	if ($mod && isset($post['raw']) && $post['raw']) {
+		$post['body'] = '<tinyboard raw html>' . $post['body'] . '</tinyboard>';
+	}
+	
 	if (mysql_version() >= 50503) {
 		$post['body_nomarkup'] = $post['body']; // Assume we're using the utf8mb4 charset
 	} else {
@@ -396,8 +400,7 @@ if (isset($_POST['delete'])) {
 		}
 	}
 	
-	if (!($mod && isset($post['raw']) && $post['raw']))
-		$post['tracked_cites'] = markup($post['body'], true);
+	$post['tracked_cites'] = markup($post['body'], true);
 	
 	// Check for a flood
 	if (!hasPermission($config['mod']['flood'], $board['uri']) && checkFlood($post)) {
-- 
cgit v1.3


From 328484bee7cab9ce354121413cc8d96c3e227aea Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Wed, 31 Jul 2013 20:51:43 -0400
Subject: SQL cleanup

---
 inc/functions.php                  | 63 +++++++++++++++++++-------------------
 inc/mod/auth.php                   |  2 +-
 inc/mod/pages.php                  | 32 +++++++++----------
 post.php                           | 10 +++---
 templates/themes/catalog/theme.php |  2 +-
 templates/themes/recent/theme.php  | 19 +++++-------
 templates/themes/rrdtool/theme.php |  5 ++-
 7 files changed, 64 insertions(+), 69 deletions(-)

(limited to 'post.php')

diff --git a/inc/functions.php b/inc/functions.php
index 7cde156b..0b4ac211 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -243,7 +243,7 @@ function rebuildThemes($action, $board = false) {
 	// List themes
 	$query = query("SELECT `theme` FROM `theme_settings` WHERE `name` IS NULL AND `value` IS NULL") or error(db_error());
 
-	while ($theme = $query->fetch()) {
+	while ($theme = $query->fetch(PDO::FETCH_ASSOC)) {
 		rebuildTheme($theme['theme'], $action, $board);
 	}
 }
@@ -281,7 +281,7 @@ function themeSettings($theme) {
 	$query->execute() or error(db_error($query));
 
 	$settings = array();
-	while ($s = $query->fetch()) {
+	while ($s = $query->fetch(PDO::FETCH_ASSOC)) {
 		$settings[$s['name']] = $s['value'];
 	}
 
@@ -351,7 +351,7 @@ function getBoardInfo($uri) {
 	$query->bindValue(':uri', $uri);
 	$query->execute() or error(db_error($query));
 	
-	if ($board = $query->fetch()) {
+	if ($board = $query->fetch(PDO::FETCH_ASSOC)) {
 		if ($config['cache']['enabled'])
 			cache::set('board_' . $uri, $board);
 		return $board;
@@ -543,7 +543,7 @@ function checkFlood($post) {
 	$query->bindValue(':floodsametime', time()-$config['flood_time_same'], PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
 	
-	$flood = (bool)$query->fetch();
+	$flood = (bool) $query->fetch(PDO::FETCH_ASSOC);
 	
 	if (event('check-flood', $post))
 		return true;
@@ -647,7 +647,7 @@ function checkBan($board = 0) {
 		$query->execute() or error(db_error($query));
 	}
 	
-	if ($ban = $query->fetch()) {
+	if ($ban = $query->fetch(PDO::FETCH_ASSOC)) {
 		if ($ban['expires'] && $ban['expires'] < time()) {
 			// Ban expired
 			$query = prepare("DELETE FROM `bans` WHERE `id` = :id");
@@ -685,12 +685,12 @@ function threadLocked($id) {
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error());
 	
-	if (!$post = $query->fetch()) {
+	if (($locked = $query->fetchColumn()) === false) {
 		// Non-existant, so it can't be locked...
 		return false;
 	}
 	
-	return (bool)$post['locked'];
+	return (bool)$locked;
 }
 
 function threadSageLocked($id) {
@@ -703,12 +703,12 @@ function threadSageLocked($id) {
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error());
 	
-	if (!$post = $query->fetch()) {
+	if (($sagelocked = $query->fetchColumn()) === false) {
 		// Non-existant, so it can't be locked...
 		return false;
 	}
 	
-	return (bool) $post['sage'];
+	return (bool)$sagelocked;
 }
 
 function threadExists($id) {
@@ -842,7 +842,7 @@ function deleteFile($id, $remove_entirely_if_already=true) {
 	$query = prepare(sprintf("SELECT `thread`,`thumb`,`file` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri']));
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
-	if (!$post = $query->fetch())
+	if (!$post = $query->fetch(PDO::FETCH_ASSOC))
 		error($config['error']['invalidpost']);
 	
 	if ($post['file'] == 'deleted' && !$post['thread'])
@@ -880,7 +880,7 @@ function rebuildPost($id) {
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
 	
-	if ((!$post = $query->fetch()) || !$post['body_nomarkup'])
+	if ((!$post = $query->fetch(PDO::FETCH_ASSOC)) || !$post['body_nomarkup'])
 		return false;
 	
 	markup($body = &$post['body_nomarkup']);
@@ -913,7 +913,7 @@ function deletePost($id, $error_if_doesnt_exist=true, $rebuild_after=true) {
 	$ids = array();
 	
 	// Delete posts and maybe replies
-	while ($post = $query->fetch()) {
+	while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 		if (!$post['thread']) {
 			// Delete thread HTML page
 			file_unlink($board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], $post['id']));
@@ -946,7 +946,7 @@ function deletePost($id, $error_if_doesnt_exist=true, $rebuild_after=true) {
 	$query = prepare("SELECT `board`, `post` FROM `cites` WHERE `target_board` = :board AND (`target` = " . implode(' OR `target` = ', $ids) . ")");
 	$query->bindValue(':board', $board['uri']);
 	$query->execute() or error(db_error($query));
-	while ($cite = $query->fetch()) {
+	while ($cite = $query->fetch(PDO::FETCH_ASSOC)) {
 		if ($board['uri'] != $cite['board']) {
 			if (!isset($tmp_board))
 				$tmp_board = $board['uri'];
@@ -979,7 +979,7 @@ function clean() {
 	$query->bindValue(':offset', $offset, PDO::PARAM_INT);
 	
 	$query->execute() or error(db_error($query));
-	while ($post = $query->fetch()) {
+	while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 		deletePost($post['id']);
 	}
 }
@@ -1000,7 +1000,7 @@ function index($page, $mod=false) {
 	
 	if ($query->rowCount() < 1 && $page > 1)
 		return false;
-	while ($th = $query->fetch()) {
+	while ($th = $query->fetch(PDO::FETCH_ASSOC)) {
 		$thread = new Thread(
 			$th['id'], $th['subject'], $th['email'], $th['name'], $th['trip'], $th['capcode'], $th['body'], $th['time'], $th['thumb'],
 			$th['thumbwidth'], $th['thumbheight'], $th['file'], $th['filewidth'], $th['fileheight'], $th['filesize'], $th['filename'], $th['ip'],
@@ -1115,7 +1115,7 @@ function getPages($mod=false) {
 		$count = $board['thread_count'];
 	} else {
 		// Count threads
-		$query = query(sprintf("SELECT COUNT(`id`) FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error());
+		$query = query(sprintf("SELECT COUNT(*) FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error());
 		$count = $query->fetchColumn();
 	}
 	$count = floor(($config['threads_per_page'] + $count - 1) / $config['threads_per_page']);
@@ -1155,7 +1155,7 @@ function checkRobot($body) {
 	$query->bindValue(':hash', $body);
 	$query->execute() or error(db_error($query));
 	
-	if ($query->fetch()) {
+	if ($query->fetchColumn()) {
 		return true;
 	}
 
@@ -1163,20 +1163,19 @@ function checkRobot($body) {
 	$query = prepare("INSERT INTO `robot` VALUES (:hash)");
 	$query->bindValue(':hash', $body);
 	$query->execute() or error(db_error($query));
+	
 	return false;
 }
 
 // Returns an associative array with 'replies' and 'images' keys
 function numPosts($id) {
 	global $board;
-	$query = prepare(sprintf("SELECT COUNT(*) as `num` FROM `posts_%s` WHERE `thread` = :thread UNION ALL SELECT COUNT(*) FROM `posts_%s` WHERE `file` IS NOT NULL AND `thread` = :thread", $board['uri'], $board['uri']));
+	$query = prepare(sprintf("SELECT COUNT(*) FROM `posts_%s` WHERE `thread` = :thread UNION ALL SELECT COUNT(*) FROM `posts_%s` WHERE `file` IS NOT NULL AND `thread` = :thread", $board['uri'], $board['uri']));
 	$query->bindValue(':thread', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
 	
-	$num_posts = $query->fetch();
-	$num_posts = $num_posts['num'];
-	$num_images = $query->fetch();
-	$num_images = $num_images['num'];
+	$num_posts = $query->fetchColumn();
+	$num_images = $query->fetchColumn();
 	
 	return array('replies' => $num_posts, 'images' => $num_images);
 }
@@ -1188,14 +1187,14 @@ function muteTime() {
 		return $time;
 	
 	// Find number of mutes in the past X hours
-	$query = prepare("SELECT COUNT(*) as `count` FROM `mutes` WHERE `time` >= :time AND `ip` = :ip");
+	$query = prepare("SELECT COUNT(*) FROM `mutes` WHERE `time` >= :time AND `ip` = :ip");
 	$query->bindValue(':time', time()-($config['robot_mute_hour']*3600), PDO::PARAM_INT);
 	$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
 	$query->execute() or error(db_error($query));
 	
-	$result = $query->fetch();
-	if ($result['count'] == 0) return 0;
-	return pow($config['robot_mute_multiplier'], $result['count']);
+	if (!$result = $query->fetchColumn())
+		return 0;
+	return pow($config['robot_mute_multiplier'], $result);
 }
 
 function mute() {
@@ -1225,7 +1224,7 @@ function checkMute() {
 		$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
 		$query->execute() or error(db_error($query));
 		
-		if (!$mute = $query->fetch()) {
+		if (!$mute = $query->fetch(PDO::FETCH_ASSOC)) {
 			// What!? He's muted but he's not muted...
 			return;
 		}
@@ -1514,7 +1513,7 @@ function markup(&$body, $track_cites = false) {
 				$match[1] = mb_strlen(substr($body_tmp, 0, $match[1]));
 			}
 			
-			if ($post = $query->fetch()) {
+			if ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 				$replacement = '<a onclick="highlightReply(\''.$cite.'\');" href="' .
 					$config['root'] . $board['dir'] . $config['dir']['res'] . ($post['thread']?$post['thread']:$post['id']) . '.html#' . $cite . '">' .
 						'&gt;&gt;' . $cite .
@@ -1557,7 +1556,7 @@ function markup(&$body, $track_cites = false) {
 					$query->bindValue(':id', $cite);
 					$query->execute() or error(db_error($query));
 					
-					if ($post = $query->fetch()) {
+					if ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 						$replacement = '<a onclick="highlightReply(\''.$cite.'\');" href="' .
 							$config['root'] . $board['dir'] . $config['dir']['res'] . ($post['thread']?$post['thread']:$post['id']) . '.html#' . $cite . '">' .
 								'&gt;&gt;&gt;/' . $_board . '/' . $cite .
@@ -1666,7 +1665,7 @@ function buildThread($id, $return = false, $mod = false) {
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
 	
-	while ($post = $query->fetch()) {
+	while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 		if (!isset($thread)) {
 			$thread = new Thread(
 				$post['id'], $post['subject'], $post['email'], $post['name'], $post['trip'], $post['capcode'], $post['body'], $post['time'],
@@ -1801,7 +1800,7 @@ function getPostByHash($hash) {
 	$query->bindValue(':hash', $hash, PDO::PARAM_STR);
 	$query->execute() or error(db_error($query));
 	
-	if ($post = $query->fetch()) {
+	if ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 		return $post;
 	}
 	
@@ -1815,7 +1814,7 @@ function getPostByHashInThread($hash, $thread) {
 	$query->bindValue(':thread', $thread, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
 	
-	if ($post = $query->fetch()) {
+	if ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 		return $post;
 	}
 	
diff --git a/inc/mod/auth.php b/inc/mod/auth.php
index 1bc27dff..a0986a1f 100644
--- a/inc/mod/auth.php
+++ b/inc/mod/auth.php
@@ -147,7 +147,7 @@ function create_pm_header() {
 	$query->bindValue(':id', $mod['id'], PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
 	
-	if ($pm = $query->fetch())
+	if ($pm = $query->fetch(PDO::FETCH_ASSOC))
 		$header = array('id' => $pm['id'], 'waiting' => $query->rowCount() - 1);
 	else
 		$header = true;
diff --git a/inc/mod/pages.php b/inc/mod/pages.php
index 351d3203..f5b1101d 100644
--- a/inc/mod/pages.php
+++ b/inc/mod/pages.php
@@ -96,14 +96,14 @@ function mod_dashboard() {
 		$query = prepare('SELECT COUNT(*) FROM `pms` WHERE `to` = :id AND `unread` = 1');
 		$query->bindValue(':id', $mod['id']);
 		$query->execute() or error(db_error($query));
-		$args['unread_pms'] = $query->fetchColumn(0);
+		$args['unread_pms'] = $query->fetchColumn();
 		
 		if ($config['cache']['enabled'])
 			cache::set('pm_unreadcount_' . $mod['id'], $args['unread_pms']);
 	}
 	
 	$query = query('SELECT COUNT(*) FROM `reports`') or error(db_error($query));
-	$args['reports'] = $query->fetchColumn(0);
+	$args['reports'] = $query->fetchColumn();
 	
 	if ($mod['type'] >= ADMIN && $config['check_updates']) {
 		if (!$config['version'])
@@ -536,7 +536,7 @@ function mod_noticeboard($page_no = 1) {
 	
 	$query = prepare("SELECT COUNT(*) FROM `noticeboard`");
 	$query->execute() or error(db_error($query));
-	$count = $query->fetchColumn(0);
+	$count = $query->fetchColumn();
 	
 	mod_page(_('Noticeboard'), 'mod/noticeboard.html', array('noticeboard' => $noticeboard, 'count' => $count));
 }
@@ -597,7 +597,7 @@ function mod_news($page_no = 1) {
 	
 	$query = prepare("SELECT COUNT(*) FROM `news`");
 	$query->execute() or error(db_error($query));
-	$count = $query->fetchColumn(0);
+	$count = $query->fetchColumn();
 	
 	mod_page(_('News'), 'mod/news.html', array('news' => $news, 'count' => $count));
 }
@@ -637,7 +637,7 @@ function mod_log($page_no = 1) {
 	
 	$query = prepare("SELECT COUNT(*) FROM `modlogs`");
 	$query->execute() or error(db_error($query));
-	$count = $query->fetchColumn(0);
+	$count = $query->fetchColumn();
 	
 	mod_page(_('Moderation log'), 'mod/log.html', array('logs' => $logs, 'count' => $count));
 }
@@ -664,7 +664,7 @@ function mod_user_log($username, $page_no = 1) {
 	$query = prepare("SELECT COUNT(*) FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `username` = :username");
 	$query->bindValue(':username', $username);
 	$query->execute() or error(db_error($query));
-	$count = $query->fetchColumn(0);
+	$count = $query->fetchColumn();
 	
 	mod_page(_('Moderation log'), 'mod/log.html', array('logs' => $logs, 'count' => $count, 'username' => $username));
 }
@@ -906,7 +906,7 @@ function mod_bans($page_no = 1) {
 	
 	$query = prepare("SELECT COUNT(*) FROM `bans`");
 	$query->execute() or error(db_error($query));
-	$count = $query->fetchColumn(0);
+	$count = $query->fetchColumn();
 	
 	foreach ($bans as &$ban) {
 		if (filter_var($ban['ip'], FILTER_VALIDATE_IP) !== false)
@@ -1058,7 +1058,7 @@ function mod_move($originBoard, $postID) {
 		
 		$replies = array();
 		
-		while ($post = $query->fetch()) {
+		while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 			$post['mod'] = true;
 			$post['thread'] = $newID;
 			
@@ -1365,7 +1365,7 @@ function mod_deletebyip($boardName, $post, $global = false) {
 	$query = prepare(sprintf('SELECT `ip` FROM `posts_%s` WHERE `id` = :id', $boardName));
 	$query->bindValue(':id', $post);
 	$query->execute() or error(db_error($query));
-	if (!$ip = $query->fetchColumn(0))
+	if (!$ip = $query->fetchColumn())
 		error($config['error']['invalidpost']);
 	
 	$boards = $global ? listBoards() : array(array('uri' => $boardName));
@@ -1387,7 +1387,7 @@ function mod_deletebyip($boardName, $post, $global = false) {
 	
 	$threads_to_rebuild = array();
 	$threads_deleted = array();
-	while ($post = $query->fetch()) {
+	while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 		openBoard($post['board']);
 		
 		deletePost($post['id'], false, false);
@@ -1684,7 +1684,7 @@ function mod_inbox() {
 	$query = prepare('SELECT COUNT(*) FROM `pms` WHERE `to` = :mod AND `unread` = 1');
 	$query->bindValue(':mod', $mod['id']);
 	$query->execute() or error(db_error($query));
-	$unread = $query->fetchColumn(0);
+	$unread = $query->fetchColumn();
 	
 	foreach ($messages as &$message) {
 		$message['snippet'] = pm_snippet($message['message']);
@@ -1706,12 +1706,12 @@ function mod_new_pm($username) {
 	$query = prepare("SELECT `id` FROM `mods` WHERE `username` = :username");
 	$query->bindValue(':username', $username);
 	$query->execute() or error(db_error($query));
-	if (!$id = $query->fetchColumn(0)) {
+	if (!$id = $query->fetchColumn()) {
 		// Old style ?/PM: by user ID
 		$query = prepare("SELECT `username` FROM `mods` WHERE `id` = :username");
 		$query->bindValue(':username', $username);
 		$query->execute() or error(db_error($query));
-		if ($username = $query->fetchColumn(0))
+		if ($username = $query->fetchColumn())
 			header('Location: ?/new_PM/' . $username, true, $config['redirect_http']);
 		else
 			error($config['error']['404']);
@@ -1832,7 +1832,7 @@ function mod_reports() {
 		$report_posts[$board] = array();
 		
 		$query = query(sprintf('SELECT * FROM `posts_%s` WHERE `id` = ' . implode(' OR `id` = ', $posts), $board)) or error(db_error());
-		while ($post = $query->fetch()) {
+		while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 			$report_posts[$board][$post['id']] = $post;
 		}
 	}
@@ -2169,10 +2169,10 @@ function mod_debug_antispam() {
 	}
 	
 	$query = query('SELECT COUNT(*) FROM `antispam`' . ($where ? " WHERE $where" : '')) or error(db_error());
-	$args['total'] = number_format($query->fetchColumn(0));
+	$args['total'] = number_format($query->fetchColumn());
 	
 	$query = query('SELECT COUNT(*) FROM `antispam` WHERE `expires` IS NOT NULL' . ($where ? " AND $where" : '')) or error(db_error());
-	$args['expiring'] = number_format($query->fetchColumn(0));
+	$args['expiring'] = number_format($query->fetchColumn());
 	
 	$query = query('SELECT * FROM `antispam` ' . ($where ? "WHERE $where" : '') . ' ORDER BY `passed` DESC LIMIT 40') or error(db_error());
 	$args['top'] = $query->fetchAll(PDO::FETCH_ASSOC);
diff --git a/post.php b/post.php
index db077866..f4499845 100644
--- a/post.php
+++ b/post.php
@@ -52,7 +52,7 @@ if (isset($_POST['delete'])) {
 		$query->bindValue(':id', $id, PDO::PARAM_INT);
 		$query->execute() or error(db_error($query));
 		
-		if ($post = $query->fetch()) {
+		if ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 			if ($password != '' && $post['password'] != $password)
 				error($config['error']['invalidpassword']);
 			
@@ -115,12 +115,12 @@ if (isset($_POST['delete'])) {
 		$query->bindValue(':id', $id, PDO::PARAM_INT);
 		$query->execute() or error(db_error($query));
 		
-		$post = $query->fetch();
+		$thread = $query->fetchColumn();
 		
-		if ($post) {
+		if ($thread) {
 			if ($config['syslog'])
 				_syslog(LOG_INFO, 'Reported post: ' .
-					'/' . $board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], $post['thread'] ? $post['thread'] : $id) . ($post['thread'] ? '#' . $id : '') .
+					'/' . $board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], $thread ? $thread : $id) . ($thread ? '#' . $id : '') .
 					' for "' . $reason . '"'
 				);
 			$query = prepare("INSERT INTO `reports` VALUES (NULL, :time, :ip, :board, :post, :reason)");
@@ -231,7 +231,7 @@ if (isset($_POST['delete'])) {
 		$query->bindValue(':id', $post['thread'], PDO::PARAM_INT);
 		$query->execute() or error(db_error());
 		
-		if (!$thread = $query->fetch()) {
+		if (!$thread = $query->fetch(PDO::FETCH_ASSOC)) {
 			// Non-existant
 			error($config['error']['nonexistant']);
 		}
diff --git a/templates/themes/catalog/theme.php b/templates/themes/catalog/theme.php
index e585cf17..5c9f6769 100644
--- a/templates/themes/catalog/theme.php
+++ b/templates/themes/catalog/theme.php
@@ -39,7 +39,7 @@
 			
 			$query = query(sprintf("SELECT *, `id` AS `thread_id`, (SELECT COUNT(*) FROM `posts_%s` WHERE `thread` = `thread_id`) AS `reply_count`, '%s' AS `board` FROM `posts_%s` WHERE `thread` IS NULL ORDER BY `bump` DESC", $board_name, $board_name, $board_name)) or error(db_error());
 			
-			while ($post = $query->fetch()) {
+			while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 				$post['link'] = $config['root'] . $board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], ($post['thread'] ? $post['thread'] : $post['id']));
 				$post['board_name'] = $board['name'];
 				$post['file'] = $config['uri_thumb'] . $post['thumb'];
diff --git a/templates/themes/recent/theme.php b/templates/themes/recent/theme.php
index 75907e77..98fabfa1 100644
--- a/templates/themes/recent/theme.php
+++ b/templates/themes/recent/theme.php
@@ -47,7 +47,7 @@
 			$query = preg_replace('/UNION ALL $/', 'ORDER BY `time` DESC LIMIT ' . (int)$settings['limit_images'], $query);
 			$query = query($query) or error(db_error());
 			
-			while ($post = $query->fetch()) {
+			while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 				openBoard($post['board']);
 				
 				// board settings won't be available in the template file, so generate links now
@@ -67,7 +67,7 @@
 			$query = preg_replace('/UNION ALL $/', 'ORDER BY `time` DESC LIMIT ' . (int)$settings['limit_posts'], $query);
 			$query = query($query) or error(db_error());
 			
-			while ($post = $query->fetch()) {
+			while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 				openBoard($post['board']);
 				
 				$post['link'] = $config['root'] . $board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], ($post['thread'] ? $post['thread'] : $post['id'])) . '#' . $post['id'];
@@ -78,7 +78,7 @@
 			}
 			
 			// Total posts
-			$query = 'SELECT SUM(`top`) AS `count` FROM (';
+			$query = 'SELECT SUM(`top`) FROM (';
 			foreach ($boards as &$_board) {
 				if (in_array($_board['uri'], $this->excluded))
 					continue;
@@ -86,11 +86,10 @@
 			}
 			$query = preg_replace('/UNION ALL $/', ') AS `posts_all`', $query);
 			$query = query($query) or error(db_error());
-			$res = $query->fetch();
-			$stats['total_posts'] = number_format($res['count']);
+			$stats['total_posts'] = number_format($query->fetchColumn());
 			
 			// Unique IPs
-			$query = 'SELECT COUNT(DISTINCT(`ip`)) AS `count` FROM (';
+			$query = 'SELECT COUNT(DISTINCT(`ip`)) FROM (';
 			foreach ($boards as &$_board) {
 				if (in_array($_board['uri'], $this->excluded))
 					continue;
@@ -98,11 +97,10 @@
 			}
 			$query = preg_replace('/UNION ALL $/', ') AS `posts_all`', $query);
 			$query = query($query) or error(db_error());
-			$res = $query->fetch();
-			$stats['unique_posters'] = number_format($res['count']);
+			$stats['unique_posters'] = number_format($query->fetchColumn());
 			
 			// Active content
-			$query = 'SELECT SUM(`filesize`) AS `count` FROM (';
+			$query = 'SELECT SUM(`filesize`) FROM (';
 			foreach ($boards as &$_board) {
 				if (in_array($_board['uri'], $this->excluded))
 					continue;
@@ -110,8 +108,7 @@
 			}
 			$query = preg_replace('/UNION ALL $/', ') AS `posts_all`', $query);
 			$query = query($query) or error(db_error());
-			$res = $query->fetch();
-			$stats['active_content'] = $res['count'];
+			$stats['active_content'] = $query->fetchColumn();
 			
 			return Element('themes/recent/recent.html', Array(
 				'settings' => $settings,
diff --git a/templates/themes/rrdtool/theme.php b/templates/themes/rrdtool/theme.php
index 68fc1850..0e0a2f15 100644
--- a/templates/themes/rrdtool/theme.php
+++ b/templates/themes/rrdtool/theme.php
@@ -61,9 +61,8 @@
 					// debug just the graphing (not updating) with the --debug switch
 					if (!isset($argv[1]) || $argv[1] != '--debug') {
 						// Update graph
-						$query = query(sprintf("SELECT MAX(`id`) AS `count` FROM `posts_%s`", $board));
-						$count = $query->fetch();
-						$count = $count['count'];
+						$query = query(sprintf("SELECT MAX(`id`) FROM `posts_%s`", $board));
+						$count = $query->fetchColumn();
 					
 						if (!rrd_update($file, Array(
 							'-t',
-- 
cgit v1.3


From a052a791b553c770ef407f91b697bef7a62df5b1 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Wed, 31 Jul 2013 22:14:26 -0400
Subject: Add optional database table prefix (issue #118; see issue comments
 for details)

---
 inc/anti-bot.php                      |  12 +--
 inc/config.php                        |   2 +
 inc/database.php                      |   4 +
 inc/filters.php                       |   2 +-
 inc/functions.php                     |  80 +++++++--------
 inc/mod/auth.php                      |   8 +-
 inc/mod/ban.php                       |   6 +-
 inc/mod/pages.php                     | 188 +++++++++++++++++-----------------
 install.php                           |   6 +-
 post.php                              |  10 +-
 templates/posts.sql                   |   2 +-
 templates/themes/basic/theme.php      |   2 +-
 templates/themes/catalog/theme.php    |   2 +-
 templates/themes/categories/theme.php |   2 +-
 templates/themes/frameset/theme.php   |   2 +-
 templates/themes/recent/theme.php     |  10 +-
 templates/themes/rrdtool/theme.php    |   2 +-
 templates/themes/sitemap/theme.php    |   2 +-
 18 files changed, 177 insertions(+), 165 deletions(-)

(limited to 'post.php')

diff --git a/inc/anti-bot.php b/inc/anti-bot.php
index bf29b3cb..fde97096 100644
--- a/inc/anti-bot.php
+++ b/inc/anti-bot.php
@@ -182,12 +182,12 @@ function _create_antibot($board, $thread) {
 	
 	$antibot = new AntiBot(array($board, $thread));
 	
-	query('DELETE FROM `antispam` WHERE `expires` < UNIX_TIMESTAMP()') or error(db_error());
+	query('DELETE FROM ``antispam`` WHERE `expires` < UNIX_TIMESTAMP()') or error(db_error());
 	
 	if ($thread)
-		$query = prepare('UPDATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE `board` = :board AND `thread` = :thread AND `expires` IS NULL');
+		$query = prepare('UPDATE ``antispam`` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE `board` = :board AND `thread` = :thread AND `expires` IS NULL');
 	else
-		$query = prepare('UPDATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE `board` = :board AND `thread` IS NULL AND `expires` IS NULL');
+		$query = prepare('UPDATE ``antispam`` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE `board` = :board AND `thread` IS NULL AND `expires` IS NULL');
 	
 	$query->bindValue(':board', $board);
 	if ($thread)
@@ -195,7 +195,7 @@ function _create_antibot($board, $thread) {
 	$query->bindValue(':expires', $config['spam']['hidden_inputs_expire']);
 	$query->execute() or error(db_error($query));
 	
-	$query = prepare('INSERT INTO `antispam` VALUES (:board, :thread, :hash, UNIX_TIMESTAMP(), NULL, 0)');
+	$query = prepare('INSERT INTO ``antispam`` VALUES (:board, :thread, :hash, UNIX_TIMESTAMP(), NULL, 0)');
 	$query->bindValue(':board', $board);
 	$query->bindValue(':thread', $thread);
 	$query->bindValue(':hash', $antibot->hash());
@@ -248,7 +248,7 @@ function checkSpam(array $extra_salt = array()) {
 	if ($hash != $_hash)
 		return true;
 
-	$query = prepare('SELECT `passed` FROM `antispam` WHERE `hash` = :hash');
+	$query = prepare('SELECT `passed` FROM ``antispam`` WHERE `hash` = :hash');
 	$query->bindValue(':hash', $hash);
 	$query->execute() or error(db_error($query));
 	if ((($passed = $query->fetchColumn(0)) === false) || ($passed > $config['spam']['hidden_inputs_max_pass'])) {
@@ -260,7 +260,7 @@ function checkSpam(array $extra_salt = array()) {
 }
 
 function incrementSpamHash($hash) {
-	$query = prepare('UPDATE `antispam` SET `passed` = `passed` + 1 WHERE `hash` = :hash');
+	$query = prepare('UPDATE ``antispam`` SET `passed` = `passed` + 1 WHERE `hash` = :hash');
 	$query->bindValue(':hash', $hash);
 	$query->execute() or error(db_error($query));
 }
diff --git a/inc/config.php b/inc/config.php
index 6f2371ec..75384d3f 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -76,6 +76,8 @@
 	$config['db']['password'] = '';
 	// Tinyboard database
 	$config['db']['database'] = '';
+	// Table prefix
+	$config['db']['prefix'] = '';
 	// Use a persistent connection (experimental)
 	$config['db']['persistent'] = false;
 	// Anything more to add to the DSN string (eg. port=xxx;foo=bar)
diff --git a/inc/database.php b/inc/database.php
index 3dc0f0ce..7be001ea 100644
--- a/inc/database.php
+++ b/inc/database.php
@@ -87,6 +87,8 @@ function mysql_version() {
 function prepare($query) {
 	global $pdo, $debug, $config;
 	
+	$query = preg_replace('/``([0-9a-zA-Z$_\x{0080}-\x{FFFF}]+)``/u', '`' . $config['db']['prefix'] . '$1`', $query);
+	
 	sql_open();
 	
 	if ($config['debug'])
@@ -98,6 +100,8 @@ function prepare($query) {
 function query($query) {
 	global $pdo, $debug, $config;
 	
+	$query = preg_replace('/``([0-9a-zA-Z$_\x{0080}-\x{FFFF}]+)``/u', '`' . $config['db']['prefix'] . '$1`', $query);
+	
 	sql_open();
 	
 	if ($config['debug']) {
diff --git a/inc/filters.php b/inc/filters.php
index 524d37cf..9f03154d 100644
--- a/inc/filters.php
+++ b/inc/filters.php
@@ -81,7 +81,7 @@ class Filter {
 				else
 					$all_boards = false;
 				
-				$query = prepare("INSERT INTO `bans` VALUES (NULL, :ip, :mod, :set, :expires, :reason, :board, 0)");
+				$query = prepare("INSERT INTO ``bans`` VALUES (NULL, :ip, :mod, :set, :expires, :reason, :board, 0)");
 				$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
 				$query->bindValue(':mod', -1);
 				$query->bindValue(':set', time());
diff --git a/inc/functions.php b/inc/functions.php
index 403f6112..e871fee0 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -241,7 +241,7 @@ function create_antibot($board, $thread = null) {
 
 function rebuildThemes($action, $board = false) {
 	// List themes
-	$query = query("SELECT `theme` FROM `theme_settings` WHERE `name` IS NULL AND `value` IS NULL") or error(db_error());
+	$query = query("SELECT `theme` FROM ``theme_settings`` WHERE `name` IS NULL AND `value` IS NULL") or error(db_error());
 
 	while ($theme = $query->fetch(PDO::FETCH_ASSOC)) {
 		rebuildTheme($theme['theme'], $action, $board);
@@ -276,7 +276,7 @@ function rebuildTheme($theme, $action, $board = false) {
 
 
 function themeSettings($theme) {
-	$query = prepare("SELECT `name`, `value` FROM `theme_settings` WHERE `theme` = :theme AND `name` IS NOT NULL");
+	$query = prepare("SELECT `name`, `value` FROM ``theme_settings`` WHERE `theme` = :theme AND `name` IS NOT NULL");
 	$query->bindValue(':theme', $theme);
 	$query->execute() or error(db_error($query));
 
@@ -347,7 +347,7 @@ function getBoardInfo($uri) {
 		return $board;
 	}
 	
-	$query = prepare("SELECT * FROM `boards` WHERE `uri` = :uri LIMIT 1");
+	$query = prepare("SELECT * FROM ``boards`` WHERE `uri` = :uri LIMIT 1");
 	$query->bindValue(':uri', $uri);
 	$query->execute() or error(db_error($query));
 	
@@ -523,7 +523,7 @@ function listBoards() {
 	if ($config['cache']['enabled'] && ($boards = cache::get('all_boards')))
 		return $boards;
 	
-	$query = query("SELECT * FROM `boards` ORDER BY `uri`") or error(db_error());
+	$query = query("SELECT * FROM ``boards`` ORDER BY `uri`") or error(db_error());
 	$boards = $query->fetchAll();
 	
 	if ($config['cache']['enabled'])
@@ -535,7 +535,7 @@ function listBoards() {
 function checkFlood($post) {
 	global $board, $config;
 	
-	$query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE (`ip` = :ip AND `time` >= :floodtime) OR (`ip` = :ip AND `body` != '' AND `body` = :body AND `time` >= :floodsameiptime) OR (`body` != ''  AND `body` = :body AND `time` >= :floodsametime) LIMIT 1", $board['uri']));
+	$query = prepare(sprintf("SELECT * FROM ``posts_%s`` WHERE (`ip` = :ip AND `time` >= :floodtime) OR (`ip` = :ip AND `body` != '' AND `body` = :body AND `time` >= :floodsameiptime) OR (`body` != ''  AND `body` = :body AND `time` >= :floodsametime) LIMIT 1", $board['uri']));
 	$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
 	$query->bindValue(':body', $post['body']);
 	$query->bindValue(':floodtime', time()-$config['flood_time'], PDO::PARAM_INT);
@@ -589,7 +589,7 @@ function displayBan($ban) {
 	global $config;
 	
 	if (!$ban['seen']) {
-		$query = prepare("UPDATE `bans` SET `seen` = 1 WHERE `id` = :id");
+		$query = prepare("UPDATE ``bans`` SET `seen` = 1 WHERE `id` = :id");
 		$query->bindValue(':id', $ban['id'], PDO::PARAM_INT);
 		$query->execute() or error(db_error($query));
 	}
@@ -620,12 +620,12 @@ function checkBan($board = 0) {
 	if (event('check-ban', $board))
 		return true;
 	
-	$query = prepare("SELECT `set`, `expires`, `reason`, `board`, `seen`, `bans`.`id` FROM `bans` WHERE (`board` IS NULL OR `board` = :board) AND `ip` = :ip ORDER BY `expires` IS NULL DESC, `expires` DESC, `expires` DESC LIMIT 1");
+	$query = prepare("SELECT `set`, `expires`, `reason`, `board`, `seen`, ``bans``.`id` FROM ``bans`` WHERE (`board` IS NULL OR `board` = :board) AND `ip` = :ip ORDER BY `expires` IS NULL DESC, `expires` DESC, `expires` DESC LIMIT 1");
 	$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
 	$query->bindValue(':board', $board);
 	$query->execute() or error(db_error($query));
 	if ($query->rowCount() < 1 && $config['ban_range']) {
-		$query = prepare("SELECT `set`, `expires`, `reason`, `board`, `seen`, `bans`.`id` FROM `bans` WHERE (`board` IS NULL OR `board` = :board) AND :ip LIKE REPLACE(REPLACE(`ip`, '%', '!%'), '*', '%') ESCAPE '!' ORDER BY `expires` IS NULL DESC, `expires` DESC LIMIT 1");
+		$query = prepare("SELECT `set`, `expires`, `reason`, `board`, `seen`, ``bans``.`id` FROM ``bans`` WHERE (`board` IS NULL OR `board` = :board) AND :ip LIKE REPLACE(REPLACE(`ip`, '%', '!%'), '*', '%') ESCAPE '!' ORDER BY `expires` IS NULL DESC, `expires` DESC LIMIT 1");
 		$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
 		$query->bindValue(':board', $board);
 		$query->execute() or error(db_error($query));
@@ -633,7 +633,7 @@ function checkBan($board = 0) {
 	
 	if ($query->rowCount() < 1 && $config['ban_cidr'] && !isIPv6()) {
 		// my most insane SQL query yet
-		$query = prepare("SELECT `set`, `expires`, `reason`, `board`, `seen`, `bans`.`id` FROM `bans` WHERE (`board` IS NULL OR `board` = :board)
+		$query = prepare("SELECT `set`, `expires`, `reason`, `board`, `seen`, ``bans``.`id` FROM ``bans`` WHERE (`board` IS NULL OR `board` = :board)
 			AND (					
 				`ip` REGEXP '^(\[0-9]+\.\[0-9]+\.\[0-9]+\.\[0-9]+\)\/(\[0-9]+)$'
 					AND
@@ -650,7 +650,7 @@ function checkBan($board = 0) {
 	if ($ban = $query->fetch(PDO::FETCH_ASSOC)) {
 		if ($ban['expires'] && $ban['expires'] < time()) {
 			// Ban expired
-			$query = prepare("DELETE FROM `bans` WHERE `id` = :id");
+			$query = prepare("DELETE FROM ``bans`` WHERE `id` = :id");
 			$query->bindValue(':id', $ban['id'], PDO::PARAM_INT);
 			$query->execute() or error(db_error($query));
 			
@@ -670,7 +670,7 @@ function checkBan($board = 0) {
 
 // No reason to keep expired bans in the database (except those that haven't been viewed yet)
 function purge_bans() {
-	$query = prepare("DELETE FROM `bans` WHERE `expires` IS NOT NULL AND `expires` < :time AND `seen` = 1");
+	$query = prepare("DELETE FROM ``bans`` WHERE `expires` IS NOT NULL AND `expires` < :time AND `seen` = 1");
 	$query->bindValue(':time', time());
 	$query->execute() or error(db_error($query));
 }
@@ -681,7 +681,7 @@ function threadLocked($id) {
 	if (event('check-locked', $id))
 		return true;
 	
-	$query = prepare(sprintf("SELECT `locked` FROM `posts_%s` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri']));
+	$query = prepare(sprintf("SELECT `locked` FROM ``posts_%s`` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri']));
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error());
 	
@@ -699,7 +699,7 @@ function threadSageLocked($id) {
 	if (event('check-sage-locked', $id))
 		return true;
 	
-	$query = prepare(sprintf("SELECT `sage` FROM `posts_%s` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri']));
+	$query = prepare(sprintf("SELECT `sage` FROM ``posts_%s`` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri']));
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error());
 	
@@ -714,7 +714,7 @@ function threadSageLocked($id) {
 function threadExists($id) {
 	global $board;
 	
-	$query = prepare(sprintf("SELECT 1 FROM `posts_%s` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri']));
+	$query = prepare(sprintf("SELECT 1 FROM ``posts_%s`` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri']));
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error());
 	
@@ -727,7 +727,7 @@ function threadExists($id) {
 
 function post(array $post) {
 	global $pdo, $board;
-	$query = prepare(sprintf("INSERT INTO `posts_%s` (`id`, `thread`, `subject`, `email`, `name`, `trip`, `capcode`, `body`, `body_nomarkup`, `time`, `bump`, `thumb`, `thumbwidth`, `thumbheight`, `file`, `filewidth`, `fileheight`, `filesize`, `filename`, `filehash`, `password`, `ip`, `sticky`, `locked`, `sage`, `embed`) VALUES ( NULL, :thread, :subject, :email, :name, :trip, :capcode, :body, :body_nomarkup, :time, :time, :thumb, :thumbwidth, :thumbheight, :file, :width, :height, :filesize, :filename, :filehash, :password, :ip, :sticky, :locked, 0, :embed)", $board['uri']));
+	$query = prepare(sprintf("INSERT INTO ``posts_%s`` VALUES ( NULL, :thread, :subject, :email, :name, :trip, :capcode, :body, :body_nomarkup, :time, :time, :thumb, :thumbwidth, :thumbheight, :file, :width, :height, :filesize, :filename, :filehash, :password, :ip, :sticky, :locked, 0, :embed)", $board['uri']));
 	
 	// Basic stuff
 	if (!empty($post['subject'])) {
@@ -829,7 +829,7 @@ function bumpThread($id) {
 	if (event('bump', $id))
 		return true;
 	
-	$query = prepare(sprintf("UPDATE `posts_%s` SET `bump` = :time WHERE `id` = :id AND `thread` IS NULL", $board['uri']));
+	$query = prepare(sprintf("UPDATE ``posts_%s`` SET `bump` = :time WHERE `id` = :id AND `thread` IS NULL", $board['uri']));
 	$query->bindValue(':time', time(), PDO::PARAM_INT);
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
@@ -839,7 +839,7 @@ function bumpThread($id) {
 function deleteFile($id, $remove_entirely_if_already=true) {
 	global $board, $config;
 	
-	$query = prepare(sprintf("SELECT `thread`,`thumb`,`file` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri']));
+	$query = prepare(sprintf("SELECT `thread`,`thumb`,`file` FROM ``posts_%s`` WHERE `id` = :id LIMIT 1", $board['uri']));
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
 	if (!$post = $query->fetch(PDO::FETCH_ASSOC))
@@ -848,7 +848,7 @@ function deleteFile($id, $remove_entirely_if_already=true) {
 	if ($post['file'] == 'deleted' && !$post['thread'])
 		return; // Can't delete OP's image completely.
 	
-	$query = prepare(sprintf("UPDATE `posts_%s` SET `thumb` = NULL, `thumbwidth` = NULL, `thumbheight` = NULL, `filewidth` = NULL, `fileheight` = NULL, `filesize` = NULL, `filename` = NULL, `filehash` = NULL, `file` = :file WHERE `id` = :id", $board['uri']));
+	$query = prepare(sprintf("UPDATE ``posts_%s`` SET `thumb` = NULL, `thumbwidth` = NULL, `thumbheight` = NULL, `filewidth` = NULL, `fileheight` = NULL, `filesize` = NULL, `filename` = NULL, `filehash` = NULL, `file` = :file WHERE `id` = :id", $board['uri']));
 	if ($post['file'] == 'deleted' && $remove_entirely_if_already) {
 		// Already deleted; remove file fully
 		$query->bindValue(':file', null, PDO::PARAM_NULL);
@@ -876,7 +876,7 @@ function deleteFile($id, $remove_entirely_if_already=true) {
 function rebuildPost($id) {
 	global $board;
 	
-	$query = prepare(sprintf("SELECT `body_nomarkup`, `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri']));
+	$query = prepare(sprintf("SELECT `body_nomarkup`, `thread` FROM ``posts_%s`` WHERE `id` = :id", $board['uri']));
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
 	
@@ -885,7 +885,7 @@ function rebuildPost($id) {
 	
 	markup($body = &$post['body_nomarkup']);
 	
-	$query = prepare(sprintf("UPDATE `posts_%s` SET `body` = :body WHERE `id` = :id", $board['uri']));
+	$query = prepare(sprintf("UPDATE ``posts_%s`` SET `body` = :body WHERE `id` = :id", $board['uri']));
 	$query->bindValue(':body', $body);
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
@@ -900,7 +900,7 @@ function deletePost($id, $error_if_doesnt_exist=true, $rebuild_after=true) {
 	global $board, $config;
 	
 	// Select post and replies (if thread) in one query
-	$query = prepare(sprintf("SELECT `id`,`thread`,`thumb`,`file` FROM `posts_%s` WHERE `id` = :id OR `thread` = :id", $board['uri']));
+	$query = prepare(sprintf("SELECT `id`,`thread`,`thumb`,`file` FROM ``posts_%s`` WHERE `id` = :id OR `thread` = :id", $board['uri']));
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
 	
@@ -918,7 +918,7 @@ function deletePost($id, $error_if_doesnt_exist=true, $rebuild_after=true) {
 			// Delete thread HTML page
 			file_unlink($board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], $post['id']));
 			
-			$antispam_query = prepare('DELETE FROM `antispam` WHERE `board` = :board AND `thread` = :thread');
+			$antispam_query = prepare('DELETE FROM ``antispam`` WHERE `board` = :board AND `thread` = :thread');
 			$antispam_query->bindValue(':board', $board['uri']);
 			$antispam_query->bindValue(':thread', $post['id']);
 			$antispam_query->execute() or error(db_error($antispam_query));
@@ -939,11 +939,11 @@ function deletePost($id, $error_if_doesnt_exist=true, $rebuild_after=true) {
 		
 	}
 	
-	$query = prepare(sprintf("DELETE FROM `posts_%s` WHERE `id` = :id OR `thread` = :id", $board['uri']));
+	$query = prepare(sprintf("DELETE FROM ``posts_%s`` WHERE `id` = :id OR `thread` = :id", $board['uri']));
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
 	
-	$query = prepare("SELECT `board`, `post` FROM `cites` WHERE `target_board` = :board AND (`target` = " . implode(' OR `target` = ', $ids) . ")");
+	$query = prepare("SELECT `board`, `post` FROM ``cites`` WHERE `target_board` = :board AND (`target` = " . implode(' OR `target` = ', $ids) . ")");
 	$query->bindValue(':board', $board['uri']);
 	$query->execute() or error(db_error($query));
 	while ($cite = $query->fetch(PDO::FETCH_ASSOC)) {
@@ -958,7 +958,7 @@ function deletePost($id, $error_if_doesnt_exist=true, $rebuild_after=true) {
 	if (isset($tmp_board))
 		openBoard($tmp_board);
 	
-	$query = prepare("DELETE FROM `cites` WHERE (`target_board` = :board AND `target` = :id) OR (`board` = :board AND `post` = :id)");
+	$query = prepare("DELETE FROM ``cites`` WHERE (`target_board` = :board AND `target` = :id) OR (`board` = :board AND `post` = :id)");
 	$query->bindValue(':board', $board['uri']);
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
@@ -975,7 +975,7 @@ function clean() {
 	$offset = round($config['max_pages']*$config['threads_per_page']);
 	
 	// I too wish there was an easier way of doing this...
-	$query = prepare(sprintf("SELECT `id` FROM `posts_%s` WHERE `thread` IS NULL ORDER BY `sticky` DESC, `bump` DESC LIMIT :offset, 9001", $board['uri']));
+	$query = prepare(sprintf("SELECT `id` FROM ``posts_%s`` WHERE `thread` IS NULL ORDER BY `sticky` DESC, `bump` DESC LIMIT :offset, 9001", $board['uri']));
 	$query->bindValue(':offset', $offset, PDO::PARAM_INT);
 	
 	$query->execute() or error(db_error($query));
@@ -990,7 +990,7 @@ function index($page, $mod=false) {
 	$body = '';
 	$offset = round($page*$config['threads_per_page']-$config['threads_per_page']);
 	
-	$query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` IS NULL ORDER BY `sticky` DESC, `bump` DESC LIMIT :offset,:threads_per_page", $board['uri']));
+	$query = prepare(sprintf("SELECT * FROM ``posts_%s`` WHERE `thread` IS NULL ORDER BY `sticky` DESC, `bump` DESC LIMIT :offset,:threads_per_page", $board['uri']));
 	$query->bindValue(':offset', $offset, PDO::PARAM_INT);
 	$query->bindValue(':threads_per_page', $config['threads_per_page'], PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
@@ -1011,7 +1011,7 @@ function index($page, $mod=false) {
 			$replies = $cached['replies'];
 			$omitted = $cached['omitted'];
 		} else {
-			$posts = prepare(sprintf("SELECT * FROM `posts_%s` WHERE `thread` = :id ORDER BY `id` DESC LIMIT :limit", $board['uri']));
+			$posts = prepare(sprintf("SELECT * FROM ``posts_%s`` WHERE `thread` = :id ORDER BY `id` DESC LIMIT :limit", $board['uri']));
 			$posts->bindValue(':id', $th['id']);
 			$posts->bindValue(':limit', ($th['sticky'] ? $config['threads_preview_sticky'] : $config['threads_preview']), PDO::PARAM_INT);
 			$posts->execute() or error(db_error($posts));
@@ -1115,7 +1115,7 @@ function getPages($mod=false) {
 		$count = $board['thread_count'];
 	} else {
 		// Count threads
-		$query = query(sprintf("SELECT COUNT(*) FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error());
+		$query = query(sprintf("SELECT COUNT(*) FROM ``posts_%s`` WHERE `thread` IS NULL", $board['uri'])) or error(db_error());
 		$count = $query->fetchColumn();
 	}
 	$count = floor(($config['threads_per_page'] + $count - 1) / $config['threads_per_page']);
@@ -1151,7 +1151,7 @@ function checkRobot($body) {
 		return true;
 	
 	$body = makerobot($body);
-	$query = prepare("SELECT 1 FROM `robot` WHERE `hash` = :hash LIMIT 1");
+	$query = prepare("SELECT 1 FROM ``robot`` WHERE `hash` = :hash LIMIT 1");
 	$query->bindValue(':hash', $body);
 	$query->execute() or error(db_error($query));
 	
@@ -1160,7 +1160,7 @@ function checkRobot($body) {
 	}
 
 	// Insert new hash
-	$query = prepare("INSERT INTO `robot` VALUES (:hash)");
+	$query = prepare("INSERT INTO ``robot`` VALUES (:hash)");
 	$query->bindValue(':hash', $body);
 	$query->execute() or error(db_error($query));
 	
@@ -1170,7 +1170,7 @@ function checkRobot($body) {
 // Returns an associative array with 'replies' and 'images' keys
 function numPosts($id) {
 	global $board;
-	$query = prepare(sprintf("SELECT COUNT(*) FROM `posts_%s` WHERE `thread` = :thread UNION ALL SELECT COUNT(*) FROM `posts_%s` WHERE `file` IS NOT NULL AND `thread` = :thread", $board['uri'], $board['uri']));
+	$query = prepare(sprintf("SELECT COUNT(*) FROM ``posts_%s`` WHERE `thread` = :thread UNION ALL SELECT COUNT(*) FROM ``posts_%s`` WHERE `file` IS NOT NULL AND `thread` = :thread", $board['uri'], $board['uri']));
 	$query->bindValue(':thread', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
 	
@@ -1187,7 +1187,7 @@ function muteTime() {
 		return $time;
 	
 	// Find number of mutes in the past X hours
-	$query = prepare("SELECT COUNT(*) FROM `mutes` WHERE `time` >= :time AND `ip` = :ip");
+	$query = prepare("SELECT COUNT(*) FROM ``mutes`` WHERE `time` >= :time AND `ip` = :ip");
 	$query->bindValue(':time', time()-($config['robot_mute_hour']*3600), PDO::PARAM_INT);
 	$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
 	$query->execute() or error(db_error($query));
@@ -1199,7 +1199,7 @@ function muteTime() {
 
 function mute() {
 	// Insert mute
-	$query = prepare("INSERT INTO `mutes` VALUES (:ip, :time)");
+	$query = prepare("INSERT INTO ``mutes`` VALUES (:ip, :time)");
 	$query->bindValue(':time', time(), PDO::PARAM_INT);
 	$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
 	$query->execute() or error(db_error($query));
@@ -1220,7 +1220,7 @@ function checkMute() {
 	$mutetime = muteTime();
 	if ($mutetime > 0) {
 		// Find last mute time
-		$query = prepare("SELECT `time` FROM `mutes` WHERE `ip` = :ip ORDER BY `time` DESC LIMIT 1");
+		$query = prepare("SELECT `time` FROM ``mutes`` WHERE `ip` = :ip ORDER BY `time` DESC LIMIT 1");
 		$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
 		$query->execute() or error(db_error($query));
 		
@@ -1514,7 +1514,7 @@ function markup(&$body, $track_cites = false) {
 		
 		foreach ($cites as $matches) {
 			$cite = $matches[2][0];
-			$query = prepare(sprintf("SELECT `thread`,`id` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri']));
+			$query = prepare(sprintf("SELECT `thread`,`id` FROM ``posts_%s`` WHERE `id` = :id LIMIT 1", $board['uri']));
 			$query->bindValue(':id', $cite);
 			$query->execute() or error(db_error($query));
 			
@@ -1562,7 +1562,7 @@ function markup(&$body, $track_cites = false) {
 			// Check if the board exists, and load settings
 			if (openBoard($_board)) {
 				if ($cite) {
-					$query = prepare(sprintf("SELECT `thread`,`id` FROM `posts_%s` WHERE `id` = :id LIMIT 1", $board['uri']));
+					$query = prepare(sprintf("SELECT `thread`,`id` FROM ``posts_%s`` WHERE `id` = :id LIMIT 1", $board['uri']));
 					$query->bindValue(':id', $cite);
 					$query->execute() or error(db_error($query));
 					
@@ -1671,7 +1671,7 @@ function buildThread($id, $return = false, $mod = false) {
 		cache::delete("thread_{$board['uri']}_{$id}");
 	}
 	
-	$query = prepare(sprintf("SELECT * FROM `posts_%s` WHERE (`thread` IS NULL AND `id` = :id) OR `thread` = :id ORDER BY `thread`,`id`", $board['uri']));
+	$query = prepare(sprintf("SELECT * FROM ``posts_%s`` WHERE (`thread` IS NULL AND `id` = :id) OR `thread` = :id ORDER BY `thread`,`id`", $board['uri']));
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
 	
@@ -1806,7 +1806,7 @@ function fraction($numerator, $denominator, $sep) {
 
 function getPostByHash($hash) {
 	global $board;
-	$query = prepare(sprintf("SELECT `id`,`thread` FROM `posts_%s` WHERE `filehash` = :hash", $board['uri']));
+	$query = prepare(sprintf("SELECT `id`,`thread` FROM ``posts_%s`` WHERE `filehash` = :hash", $board['uri']));
 	$query->bindValue(':hash', $hash, PDO::PARAM_STR);
 	$query->execute() or error(db_error($query));
 	
@@ -1819,7 +1819,7 @@ function getPostByHash($hash) {
 
 function getPostByHashInThread($hash, $thread) {
 	global $board;
-	$query = prepare(sprintf("SELECT `id`,`thread` FROM `posts_%s` WHERE `filehash` = :hash AND ( `thread` = :thread OR `id` = :thread )", $board['uri']));
+	$query = prepare(sprintf("SELECT `id`,`thread` FROM ``posts_%s`` WHERE `filehash` = :hash AND ( `thread` = :thread OR `id` = :thread )", $board['uri']));
 	$query->bindValue(':hash', $hash, PDO::PARAM_STR);
 	$query->bindValue(':thread', $thread, PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
diff --git a/inc/mod/auth.php b/inc/mod/auth.php
index a0986a1f..bfab0f7e 100644
--- a/inc/mod/auth.php
+++ b/inc/mod/auth.php
@@ -42,7 +42,7 @@ function login($username, $password, $makehash=true) {
 		$password = sha1($password);
 	}
 	
-	$query = prepare("SELECT `id`, `type`, `boards`, `password`, `salt` FROM `mods` WHERE `username` = :username");
+	$query = prepare("SELECT `id`, `type`, `boards`, `password`, `salt` FROM ``mods`` WHERE `username` = :username");
 	$query->bindValue(':username', $username);
 	$query->execute() or error(db_error($query));
 	
@@ -83,7 +83,7 @@ function destroyCookies() {
 
 function modLog($action, $_board=null) {
 	global $mod, $board, $config;
-	$query = prepare("INSERT INTO `modlogs` VALUES (:id, :ip, :board, :time, :text)");
+	$query = prepare("INSERT INTO ``modlogs`` VALUES (:id, :ip, :board, :time, :text)");
 	$query->bindValue(':id', $mod['id'], PDO::PARAM_INT);
 	$query->bindValue(':ip', $_SERVER['REMOTE_ADDR']);
 	$query->bindValue(':time', time(), PDO::PARAM_INT);
@@ -112,7 +112,7 @@ if (isset($_COOKIE[$config['cookies']['mod']])) {
 		exit;
 	}
 	
-	$query = prepare("SELECT `id`, `type`, `boards`, `password` FROM `mods` WHERE `username` = :username");
+	$query = prepare("SELECT `id`, `type`, `boards`, `password` FROM ``mods`` WHERE `username` = :username");
 	$query->bindValue(':username', $cookie[0]);
 	$query->execute() or error(db_error($query));
 	$user = $query->fetch(PDO::FETCH_ASSOC);
@@ -143,7 +143,7 @@ function create_pm_header() {
 		return $header;
 	}
 	
-	$query = prepare("SELECT `id` FROM `pms` WHERE `to` = :id AND `unread` = 1");
+	$query = prepare("SELECT `id` FROM ``pms`` WHERE `to` = :id AND `unread` = 1");
 	$query->bindValue(':id', $mod['id'], PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
 	
diff --git a/inc/mod/ban.php b/inc/mod/ban.php
index cfc2636f..9166223f 100644
--- a/inc/mod/ban.php
+++ b/inc/mod/ban.php
@@ -56,7 +56,7 @@ function parse_time($str) {
 function ban($mask, $reason, $length, $board) {
 	global $mod, $pdo;
 	
-	$query = prepare("INSERT INTO `bans` VALUES (NULL, :ip, :mod, :time, :expires, :reason, :board, 0)");
+	$query = prepare("INSERT INTO ``bans`` VALUES (NULL, :ip, :mod, :time, :expires, :reason, :board, 0)");
 	$query->bindValue(':ip', $mask);
 	$query->bindValue(':mod', $mod['id']);
 	$query->bindValue(':time', time());
@@ -89,12 +89,12 @@ function ban($mask, $reason, $length, $board) {
 }
 
 function unban($id) {
-	$query = prepare("SELECT `ip` FROM `bans` WHERE `id` = :id");
+	$query = prepare("SELECT `ip` FROM ``bans`` WHERE `id` = :id");
 	$query->bindValue(':id', $id);
 	$query->execute() or error(db_error($query));
 	$mask = $query->fetchColumn();
 		
-	$query = prepare("DELETE FROM `bans` WHERE `id` = :id");
+	$query = prepare("DELETE FROM ``bans`` WHERE `id` = :id");
 	$query->bindValue(':id', $id);
 	$query->execute() or error(db_error($query));
 	
diff --git a/inc/mod/pages.php b/inc/mod/pages.php
index 3ff6a9b1..1e0dc7c9 100644
--- a/inc/mod/pages.php
+++ b/inc/mod/pages.php
@@ -82,7 +82,7 @@ function mod_dashboard() {
 	
 	if (hasPermission($config['mod']['noticeboard'])) {
 		if (!$config['cache']['enabled'] || !$args['noticeboard'] = cache::get('noticeboard_preview')) {
-			$query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :limit");
+			$query = prepare("SELECT ``noticeboard``.*, `username` FROM ``noticeboard`` LEFT JOIN ``mods`` ON ``mods``.`id` = `mod` ORDER BY `id` DESC LIMIT :limit");
 			$query->bindValue(':limit', $config['mod']['noticeboard_dashboard'], PDO::PARAM_INT);
 			$query->execute() or error(db_error($query));
 			$args['noticeboard'] = $query->fetchAll(PDO::FETCH_ASSOC);
@@ -93,7 +93,7 @@ function mod_dashboard() {
 	}
 	
 	if (!$config['cache']['enabled'] || ($args['unread_pms'] = cache::get('pm_unreadcount_' . $mod['id'])) == false) {
-		$query = prepare('SELECT COUNT(*) FROM `pms` WHERE `to` = :id AND `unread` = 1');
+		$query = prepare('SELECT COUNT(*) FROM ``pms`` WHERE `to` = :id AND `unread` = 1');
 		$query->bindValue(':id', $mod['id']);
 		$query->execute() or error(db_error($query));
 		$args['unread_pms'] = $query->fetchColumn();
@@ -102,7 +102,7 @@ function mod_dashboard() {
 			cache::set('pm_unreadcount_' . $mod['id'], $args['unread_pms']);
 	}
 	
-	$query = query('SELECT COUNT(*) FROM `reports`') or error(db_error($query));
+	$query = query('SELECT COUNT(*) FROM ``reports``') or error(db_error($query));
 	$args['reports'] = $query->fetchColumn();
 	
 	if ($mod['type'] >= ADMIN && $config['check_updates']) {
@@ -208,6 +208,8 @@ function mod_search($type, $search_query_escaped, $page_no = 1) {
 	// Use asterisk as wildcard instead
 	$query = str_replace('*', '%', $query);
 	
+	$query = str_replace('`', '!`', $query);
+	
 	// Array of phrases to match
 	$match = array();
 	
@@ -271,7 +273,7 @@ function mod_search($type, $search_query_escaped, $page_no = 1) {
 			
 			if (!empty($query))
 				$query .= ' UNION ALL ';
-			$query .= sprintf("SELECT *, '%s' AS `board` FROM `posts_%s` WHERE %s", $board['uri'], $board['uri'], $sql_like);
+			$query .= sprintf("SELECT *, '%s' AS `board` FROM ``posts_%s`` WHERE %s", $board['uri'], $board['uri'], $sql_like);
 		}
 		
 		// You weren't allowed to search any boards
@@ -282,21 +284,21 @@ function mod_search($type, $search_query_escaped, $page_no = 1) {
 	}
 	
 	if ($type == 'IP_notes') {
-		$query = 'SELECT * FROM `ip_notes` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE ' . $sql_like . ' ORDER BY `time` DESC';
+		$query = 'SELECT * FROM ``ip_notes`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE ' . $sql_like . ' ORDER BY `time` DESC';
 		$sql_table = 'ip_notes';
 		if (!hasPermission($config['mod']['view_notes']) || !hasPermission($config['mod']['show_ip']))
 			error($config['error']['noaccess']);
 	}
 	
 	if ($type == 'bans') {
-		$query = 'SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE ' . $sql_like . ' ORDER BY (`expires` IS NOT NULL AND `expires` < UNIX_TIMESTAMP()), `set` DESC';
+		$query = 'SELECT ``bans``.*, `username` FROM ``bans`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE ' . $sql_like . ' ORDER BY (`expires` IS NOT NULL AND `expires` < UNIX_TIMESTAMP()), `set` DESC';
 		$sql_table = 'bans';
 		if (!hasPermission($config['mod']['view_banlist']))
 			error($config['error']['noaccess']);
 	}
 	
 	if ($type == 'log') {
-		$query = 'SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE ' . $sql_like . ' ORDER BY `time` DESC';
+		$query = 'SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM ``modlogs`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE ' . $sql_like . ' ORDER BY `time` DESC';
 		$sql_table = 'modlogs';
 		if (!hasPermission($config['mod']['modlog']))
 			error($config['error']['noaccess']);
@@ -353,7 +355,7 @@ function mod_edit_board($boardName) {
 			if (!hasPermission($config['mod']['manageboards'], $board['uri']))
 				error($config['error']['deleteboard']);
 			
-			$query = prepare('DELETE FROM `boards` WHERE `uri` = :uri');
+			$query = prepare('DELETE FROM ``boards`` WHERE `uri` = :uri');
 			$query->bindValue(':uri', $board['uri']);
 			$query->execute() or error(db_error($query));
 			
@@ -363,19 +365,19 @@ function mod_edit_board($boardName) {
 			rrmdir($board['uri'] . '/');
 			
 			// Delete posting table
-			$query = query(sprintf('DROP TABLE IF EXISTS `posts_%s`', $board['uri'])) or error(db_error());
+			$query = query(sprintf('DROP TABLE IF EXISTS ``posts_%s``', $board['uri'])) or error(db_error());
 			
 			// Clear reports
-			$query = prepare('DELETE FROM `reports` WHERE `board` = :id');
+			$query = prepare('DELETE FROM ``reports`` WHERE `board` = :id');
 			$query->bindValue(':id', $board['uri'], PDO::PARAM_INT);
 			$query->execute() or error(db_error($query));
 			
 			// Delete from table
-			$query = prepare('DELETE FROM `boards` WHERE `uri` = :uri');
+			$query = prepare('DELETE FROM ``boards`` WHERE `uri` = :uri');
 			$query->bindValue(':uri', $board['uri'], PDO::PARAM_INT);
 			$query->execute() or error(db_error($query));
 			
-			$query = prepare("SELECT `board`, `post` FROM `cites` WHERE `target_board` = :board");
+			$query = prepare("SELECT `board`, `post` FROM ``cites`` WHERE `target_board` = :board");
 			$query->bindValue(':board', $board['uri']);
 			$query->execute() or error(db_error($query));
 			while ($cite = $query->fetch(PDO::FETCH_ASSOC)) {
@@ -387,28 +389,28 @@ function mod_edit_board($boardName) {
 				}
 			}
 			
-			$query = prepare('DELETE FROM `cites` WHERE `board` = :board OR `target_board` = :board');
+			$query = prepare('DELETE FROM ``cites`` WHERE `board` = :board OR `target_board` = :board');
 			$query->bindValue(':board', $board['uri']);
 			$query->execute() or error(db_error($query));
 			
-			$query = prepare('DELETE FROM `antispam` WHERE `board` = :board');
+			$query = prepare('DELETE FROM ``antispam`` WHERE `board` = :board');
 			$query->bindValue(':board', $board['uri']);
 			$query->execute() or error(db_error($query));
 			
 			// Remove board from users/permissions table
-			$query = query('SELECT `id`,`boards` FROM `mods`') or error(db_error());
+			$query = query('SELECT `id`,`boards` FROM ``mods``') or error(db_error());
 			while ($user = $query->fetch(PDO::FETCH_ASSOC)) {
 				$user_boards = explode(',', $user['boards']);
 				if (in_array($board['uri'], $user_boards)) {
 					unset($user_boards[array_search($board['uri'], $user_boards)]);
-					$_query = prepare('UPDATE `mods` SET `boards` = :boards WHERE `id` = :id');
+					$_query = prepare('UPDATE ``mods`` SET `boards` = :boards WHERE `id` = :id');
 					$_query->bindValue(':boards', implode(',', $user_boards));
 					$_query->bindValue(':id', $user['id']);
 					$_query->execute() or error(db_error($_query));
 				}
 			}
 		} else {
-			$query = prepare('UPDATE `boards` SET `title` = :title, `subtitle` = :subtitle WHERE `uri` = :uri');
+			$query = prepare('UPDATE ``boards`` SET `title` = :title, `subtitle` = :subtitle WHERE `uri` = :uri');
 			$query->bindValue(':uri', $board['uri']);
 			$query->bindValue(':title', $_POST['title']);
 			$query->bindValue(':subtitle', $_POST['subtitle']);
@@ -467,7 +469,7 @@ function mod_new_board() {
 			error(sprintf($config['error']['boardexists'], $board['url']));
 		}
 		
-		$query = prepare('INSERT INTO `boards` VALUES (:uri, :title, :subtitle)');
+		$query = prepare('INSERT INTO ``boards`` VALUES (:uri, :title, :subtitle)');
 		$query->bindValue(':uri', $_POST['uri']);
 		$query->bindValue(':title', $_POST['title']);
 		$query->bindValue(':subtitle', $_POST['subtitle']);
@@ -510,7 +512,7 @@ function mod_noticeboard($page_no = 1) {
 		$_POST['body'] = escape_markup_modifiers($_POST['body']);
 		markup($_POST['body']);
 		
-		$query = prepare('INSERT INTO `noticeboard` VALUES (NULL, :mod, :time, :subject, :body)');
+		$query = prepare('INSERT INTO ``noticeboard`` VALUES (NULL, :mod, :time, :subject, :body)');
 		$query->bindValue(':mod', $mod['id']);
 		$query->bindvalue(':time', time());
 		$query->bindValue(':subject', $_POST['subject']);
@@ -525,7 +527,7 @@ function mod_noticeboard($page_no = 1) {
 		header('Location: ?/noticeboard#' . $pdo->lastInsertId(), true, $config['redirect_http']);
 	}
 	
-	$query = prepare("SELECT `noticeboard`.*, `username` FROM `noticeboard` LEFT JOIN `mods` ON `mods`.`id` = `mod` ORDER BY `id` DESC LIMIT :offset, :limit");
+	$query = prepare("SELECT ``noticeboard``.*, `username` FROM ``noticeboard`` LEFT JOIN ``mods`` ON ``mods``.`id` = `mod` ORDER BY `id` DESC LIMIT :offset, :limit");
 	$query->bindValue(':limit', $config['mod']['noticeboard_page'], PDO::PARAM_INT);
 	$query->bindValue(':offset', ($page_no - 1) * $config['mod']['noticeboard_page'], PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
@@ -534,7 +536,7 @@ function mod_noticeboard($page_no = 1) {
 	if (empty($noticeboard) && $page_no > 1)
 		error($config['error']['404']);
 	
-	$query = prepare("SELECT COUNT(*) FROM `noticeboard`");
+	$query = prepare("SELECT COUNT(*) FROM ``noticeboard``");
 	$query->execute() or error(db_error($query));
 	$count = $query->fetchColumn();
 	
@@ -547,7 +549,7 @@ function mod_noticeboard_delete($id) {
 	if (!hasPermission($config['mod']['noticeboard_delete']))
 			error($config['error']['noaccess']);
 	
-	$query = prepare('DELETE FROM `noticeboard` WHERE `id` = :id');
+	$query = prepare('DELETE FROM ``noticeboard`` WHERE `id` = :id');
 	$query->bindValue(':id', $id);
 	$query->execute() or error(db_error($query));
 	
@@ -572,7 +574,7 @@ function mod_news($page_no = 1) {
 		$_POST['body'] = escape_markup_modifiers($_POST['body']);
 		markup($_POST['body']);
 		
-		$query = prepare('INSERT INTO `news` VALUES (NULL, :name, :time, :subject, :body)');
+		$query = prepare('INSERT INTO ``news`` VALUES (NULL, :name, :time, :subject, :body)');
 		$query->bindValue(':name', isset($_POST['name']) && hasPermission($config['mod']['news_custom']) ? $_POST['name'] : $mod['username']);
 		$query->bindvalue(':time', time());
 		$query->bindValue(':subject', $_POST['subject']);
@@ -586,7 +588,7 @@ function mod_news($page_no = 1) {
 		header('Location: ?/news#' . $pdo->lastInsertId(), true, $config['redirect_http']);
 	}
 	
-	$query = prepare("SELECT * FROM `news` ORDER BY `id` DESC LIMIT :offset, :limit");
+	$query = prepare("SELECT * FROM ``news`` ORDER BY `id` DESC LIMIT :offset, :limit");
 	$query->bindValue(':limit', $config['mod']['news_page'], PDO::PARAM_INT);
 	$query->bindValue(':offset', ($page_no - 1) * $config['mod']['news_page'], PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
@@ -595,7 +597,7 @@ function mod_news($page_no = 1) {
 	if (empty($news) && $page_no > 1)
 		error($config['error']['404']);
 	
-	$query = prepare("SELECT COUNT(*) FROM `news`");
+	$query = prepare("SELECT COUNT(*) FROM ``news``");
 	$query->execute() or error(db_error($query));
 	$count = $query->fetchColumn();
 	
@@ -608,7 +610,7 @@ function mod_news_delete($id) {
 	if (!hasPermission($config['mod']['news_delete']))
 			error($config['error']['noaccess']);
 	
-	$query = prepare('DELETE FROM `news` WHERE `id` = :id');
+	$query = prepare('DELETE FROM ``news`` WHERE `id` = :id');
 	$query->bindValue(':id', $id);
 	$query->execute() or error(db_error($query));
 	
@@ -626,7 +628,7 @@ function mod_log($page_no = 1) {
 	if (!hasPermission($config['mod']['modlog']))
 		error($config['error']['noaccess']);
 	
-	$query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY `time` DESC LIMIT :offset, :limit");
+	$query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM ``modlogs`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` ORDER BY `time` DESC LIMIT :offset, :limit");
 	$query->bindValue(':limit', $config['mod']['modlog_page'], PDO::PARAM_INT);
 	$query->bindValue(':offset', ($page_no - 1) * $config['mod']['modlog_page'], PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
@@ -635,7 +637,7 @@ function mod_log($page_no = 1) {
 	if (empty($logs) && $page_no > 1)
 		error($config['error']['404']);
 	
-	$query = prepare("SELECT COUNT(*) FROM `modlogs`");
+	$query = prepare("SELECT COUNT(*) FROM ``modlogs``");
 	$query->execute() or error(db_error($query));
 	$count = $query->fetchColumn();
 	
@@ -651,7 +653,7 @@ function mod_user_log($username, $page_no = 1) {
 	if (!hasPermission($config['mod']['modlog']))
 		error($config['error']['noaccess']);
 	
-	$query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `username` = :username ORDER BY `time` DESC LIMIT :offset, :limit");
+	$query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM ``modlogs`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `username` = :username ORDER BY `time` DESC LIMIT :offset, :limit");
 	$query->bindValue(':username', $username);
 	$query->bindValue(':limit', $config['mod']['modlog_page'], PDO::PARAM_INT);
 	$query->bindValue(':offset', ($page_no - 1) * $config['mod']['modlog_page'], PDO::PARAM_INT);
@@ -661,7 +663,7 @@ function mod_user_log($username, $page_no = 1) {
 	if (empty($logs) && $page_no > 1)
 		error($config['error']['404']);
 	
-	$query = prepare("SELECT COUNT(*) FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `username` = :username");
+	$query = prepare("SELECT COUNT(*) FROM ``modlogs`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `username` = :username");
 	$query->bindValue(':username', $username);
 	$query->execute() or error(db_error($query));
 	$count = $query->fetchColumn();
@@ -707,7 +709,7 @@ function mod_ip_remove_note($ip, $id) {
 	if (filter_var($ip, FILTER_VALIDATE_IP) === false)
 		error("Invalid IP address.");
 	
-	$query = prepare('DELETE FROM `ip_notes` WHERE `ip` = :ip AND `id` = :id');
+	$query = prepare('DELETE FROM ``ip_notes`` WHERE `ip` = :ip AND `id` = :id');
 	$query->bindValue(':ip', $ip);
 	$query->bindValue(':id', $id);
 	$query->execute() or error(db_error($query));
@@ -741,7 +743,7 @@ function mod_page_ip($ip) {
 		
 		$_POST['note'] = escape_markup_modifiers($_POST['note']);
 		markup($_POST['note']);
-		$query = prepare('INSERT INTO `ip_notes` VALUES (NULL, :ip, :mod, :time, :body)');
+		$query = prepare('INSERT INTO ``ip_notes`` VALUES (NULL, :ip, :mod, :time, :body)');
 		$query->bindValue(':ip', $ip);
 		$query->bindValue(':mod', $mod['id']);
 		$query->bindValue(':time', time());
@@ -766,7 +768,7 @@ function mod_page_ip($ip) {
 		openBoard($board['uri']);
 		if (!hasPermission($config['mod']['show_ip'], $board['uri']))
 			continue;
-		$query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `ip` = :ip ORDER BY `sticky` DESC, `id` DESC LIMIT :limit', $board['uri']));
+		$query = prepare(sprintf('SELECT * FROM ``posts_%s`` WHERE `ip` = :ip ORDER BY `sticky` DESC, `id` DESC LIMIT :limit', $board['uri']));
 		$query->bindValue(':ip', $ip);
 		$query->bindValue(':limit', $config['mod']['ip_recentposts'], PDO::PARAM_INT);
 		$query->execute() or error(db_error($query));
@@ -798,21 +800,21 @@ function mod_page_ip($ip) {
 	$args['token'] = make_secure_link_token('ban');
 	
 	if (hasPermission($config['mod']['view_ban'])) {
-		$query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `ip` = :ip");
+		$query = prepare("SELECT ``bans``.*, `username` FROM ``bans`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `ip` = :ip");
 		$query->bindValue(':ip', $ip);
 		$query->execute() or error(db_error($query));
 		$args['bans'] = $query->fetchAll(PDO::FETCH_ASSOC);
 	}
 	
 	if (hasPermission($config['mod']['view_notes'])) {
-		$query = prepare("SELECT `ip_notes`.*, `username` FROM `ip_notes` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `ip` = :ip");
+		$query = prepare("SELECT ``ip_notes``.*, `username` FROM ``ip_notes`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `ip` = :ip");
 		$query->bindValue(':ip', $ip);
 		$query->execute() or error(db_error($query));
 		$args['notes'] = $query->fetchAll(PDO::FETCH_ASSOC);
 	}
 	
 	if (hasPermission($config['mod']['modlog_ip'])) {
-		$query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM `modlogs` LEFT JOIN `mods` ON `mod` = `mods`.`id` WHERE `text` LIKE :search ORDER BY `time` DESC LIMIT 20");
+		$query = prepare("SELECT `username`, `mod`, `ip`, `board`, `time`, `text` FROM ``modlogs`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `text` LIKE :search ORDER BY `time` DESC LIMIT 20");
 		$query->bindValue(':search', '%' . $ip . '%');
 		$query->execute() or error(db_error($query));
 		$args['logs'] = $query->fetchAll(PDO::FETCH_ASSOC);
@@ -865,7 +867,7 @@ function mod_bans($page_no = 1) {
 		if (isset($config['mod']['unban_limit'])){
 		if (count($unban) <= $config['mod']['unban_limit'] || $config['mod']['unban_limit'] == -1){ 
 		if (!empty($unban)) {
-			query('DELETE FROM `bans` WHERE `id` = ' . implode(' OR `id` = ', $unban)) or error(db_error());
+			query('DELETE FROM ``bans`` WHERE `id` = ' . implode(' OR `id` = ', $unban)) or error(db_error());
 		
 			foreach ($unban as $id) {
 				modLog("Removed ban #{$id}");
@@ -878,7 +880,7 @@ function mod_bans($page_no = 1) {
 	} else {
 		
 			if (!empty($unban)) {
-			query('DELETE FROM `bans` WHERE `id` = ' . implode(' OR `id` = ', $unban)) or error(db_error());
+			query('DELETE FROM ``bans`` WHERE `id` = ' . implode(' OR `id` = ', $unban)) or error(db_error());
 		
 			foreach ($unban as $id) {
 				modLog("Removed ban #{$id}");
@@ -890,10 +892,10 @@ function mod_bans($page_no = 1) {
 	}
 	
 	if ($config['mod']['view_banexpired']) {
-		$query = prepare("SELECT `bans`.*, `username` FROM `bans` LEFT JOIN `mods` ON `mod` = `mods`.`id` ORDER BY (`expires` IS NOT NULL AND `expires` < :time), `set` DESC LIMIT :offset, :limit");
+		$query = prepare("SELECT ``bans``.*, `username` FROM ``bans`` LEFT JOIN ``mods`` ON `mod` = ``mods``.`id` ORDER BY (`expires` IS NOT NULL AND `expires` < :time), `set` DESC LIMIT :offset, :limit");
 	} else {
 		// Filter out expired bans
-		$query = prepare("SELECT `bans`.*, `username` FROM `bans` INNER JOIN `mods` ON `mod` = `mods`.`id` WHERE `expires` = 0 OR `expires` > :time ORDER BY `set` DESC LIMIT :offset, :limit");
+		$query = prepare("SELECT ``bans``.*, `username` FROM ``bans`` INNER JOIN ``mods`` ON `mod` = ``mods``.`id` WHERE `expires` = 0 OR `expires` > :time ORDER BY `set` DESC LIMIT :offset, :limit");
 	}
 	$query->bindValue(':time', time(), PDO::PARAM_INT);
 	$query->bindValue(':limit', $config['mod']['banlist_page'], PDO::PARAM_INT);
@@ -904,7 +906,7 @@ function mod_bans($page_no = 1) {
 	if (empty($bans) && $page_no > 1)
 		error($config['error']['404']);
 	
-	$query = prepare("SELECT COUNT(*) FROM `bans`");
+	$query = prepare("SELECT COUNT(*) FROM ``bans``");
 	$query->execute() or error(db_error($query));
 	$count = $query->fetchColumn();
 	
@@ -926,7 +928,7 @@ function mod_lock($board, $unlock, $post) {
 	if (!hasPermission($config['mod']['lock'], $board))
 		error($config['error']['noaccess']);
 	
-	$query = prepare(sprintf('UPDATE `posts_%s` SET `locked` = :locked WHERE `id` = :id AND `thread` IS NULL', $board));
+	$query = prepare(sprintf('UPDATE ``posts_%s`` SET `locked` = :locked WHERE `id` = :id AND `thread` IS NULL', $board));
 	$query->bindValue(':id', $post);
 	$query->bindValue(':locked', $unlock ? 0 : 1);
 	$query->execute() or error(db_error($query));
@@ -937,7 +939,7 @@ function mod_lock($board, $unlock, $post) {
 	}
 	
 	if ($config['mod']['dismiss_reports_on_lock']) {
-		$query = prepare('DELETE FROM `reports` WHERE `board` = :board AND `post` = :id');
+		$query = prepare('DELETE FROM ``reports`` WHERE `board` = :board AND `post` = :id');
 		$query->bindValue(':board', $board);
 		$query->bindValue(':id', $post);
 		$query->execute() or error(db_error($query));
@@ -960,7 +962,7 @@ function mod_sticky($board, $unsticky, $post) {
 	if (!hasPermission($config['mod']['sticky'], $board))
 		error($config['error']['noaccess']);
 	
-	$query = prepare(sprintf('UPDATE `posts_%s` SET `sticky` = :sticky WHERE `id` = :id AND `thread` IS NULL', $board));
+	$query = prepare(sprintf('UPDATE ``posts_%s`` SET `sticky` = :sticky WHERE `id` = :id AND `thread` IS NULL', $board));
 	$query->bindValue(':id', $post);
 	$query->bindValue(':sticky', $unsticky ? 0 : 1);
 	$query->execute() or error(db_error($query));
@@ -982,7 +984,7 @@ function mod_bumplock($board, $unbumplock, $post) {
 	if (!hasPermission($config['mod']['bumplock'], $board))
 		error($config['error']['noaccess']);
 	
-	$query = prepare(sprintf('UPDATE `posts_%s` SET `sage` = :bumplock WHERE `id` = :id AND `thread` IS NULL', $board));
+	$query = prepare(sprintf('UPDATE ``posts_%s`` SET `sage` = :bumplock WHERE `id` = :id AND `thread` IS NULL', $board));
 	$query->bindValue(':id', $post);
 	$query->bindValue(':bumplock', $unbumplock ? 0 : 1);
 	$query->execute() or error(db_error($query));
@@ -1004,7 +1006,7 @@ function mod_move($originBoard, $postID) {
 	if (!hasPermission($config['mod']['move'], $originBoard))
 		error($config['error']['noaccess']);
 	
-	$query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `id` = :id AND `thread` IS NULL', $originBoard));
+	$query = prepare(sprintf('SELECT * FROM ``posts_%s`` WHERE `id` = :id AND `thread` IS NULL', $originBoard));
 	$query->bindValue(':id', $postID);
 	$query->execute() or error(db_error($query));
 	if (!$post = $query->fetch(PDO::FETCH_ASSOC))
@@ -1052,7 +1054,7 @@ function mod_move($originBoard, $postID) {
 		// go back to the original board to fetch replies
 		openBoard($originBoard);
 		
-		$query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `thread` = :id ORDER BY `id`', $originBoard));
+		$query = prepare(sprintf('SELECT * FROM ``posts_%s`` WHERE `thread` = :id ORDER BY `id`', $originBoard));
 		$query->bindValue(':id', $postID, PDO::PARAM_INT);
 		$query->execute() or error(db_error($query));
 		
@@ -1081,7 +1083,7 @@ function mod_move($originBoard, $postID) {
 		openBoard($targetBoard);
 		
 		foreach ($replies as &$post) {
-			$query = prepare('SELECT `target` FROM `cites` WHERE `target_board` = :board AND `board` = :board AND `post` = :post');
+			$query = prepare('SELECT `target` FROM ``cites`` WHERE `target_board` = :board AND `board` = :board AND `post` = :post');
 			$query->bindValue(':board', $originBoard);
 			$query->bindValue(':post', $post['id'], PDO::PARAM_INT);
 			$query->execute() or error(db_error($qurey));
@@ -1113,7 +1115,7 @@ function mod_move($originBoard, $postID) {
 			}
 			
 			foreach ($post['tracked_cites'] as $cite) {
-				$query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)');
+				$query = prepare('INSERT INTO ``cites`` VALUES (:board, :post, :target_board, :target)');
 				$query->bindValue(':board', $board['uri']);
 				$query->bindValue(':post', $newPostID, PDO::PARAM_INT);
 				$query->bindValue(':target_board',$cite[0]);
@@ -1138,7 +1140,7 @@ function mod_move($originBoard, $postID) {
 		
 		if ($shadow) {
 			// lock old thread
-			$query = prepare(sprintf('UPDATE `posts_%s` SET `locked` = 1 WHERE `id` = :id', $originBoard));
+			$query = prepare(sprintf('UPDATE ``posts_%s`` SET `locked` = 1 WHERE `id` = :id', $originBoard));
 			$query->bindValue(':id', $postID, PDO::PARAM_INT);
 			$query->execute() or error(db_error($query));
 			
@@ -1197,7 +1199,7 @@ function mod_ban_post($board, $delete, $post, $token = false) {
 	
 	$security_token = make_secure_link_token($board . '/ban/' . $post);
 	
-	$query = prepare(sprintf('SELECT `ip`, `thread` FROM `posts_%s` WHERE `id` = :id', $board));
+	$query = prepare(sprintf('SELECT `ip`, `thread` FROM ``posts_%s`` WHERE `id` = :id', $board));
 	$query->bindValue(':id', $post);
 	$query->execute() or error(db_error($query));
 	if (!$_post = $query->fetch(PDO::FETCH_ASSOC))
@@ -1220,7 +1222,7 @@ function mod_ban_post($board, $delete, $post, $token = false) {
 			$_POST['message'] = preg_replace('/[\r\n]/', '', $_POST['message']);
 			$_POST['message'] = str_replace('%length%', $length_english, $_POST['message']);
 			$_POST['message'] = str_replace('%LENGTH%', strtoupper($length_english), $_POST['message']);
-			$query = prepare(sprintf('UPDATE `posts_%s` SET `body_nomarkup` = CONCAT(`body_nomarkup`, :body_nomarkup) WHERE `id` = :id', $board));
+			$query = prepare(sprintf('UPDATE ``posts_%s`` SET `body_nomarkup` = CONCAT(`body_nomarkup`, :body_nomarkup) WHERE `id` = :id', $board));
 			$query->bindValue(':id', $post);
 			$query->bindValue(':body_nomarkup', sprintf("\n<tinyboard ban message>%s</tinyboard>", utf8tohtml($_POST['message'])));
 			$query->execute() or error(db_error($query));
@@ -1267,7 +1269,7 @@ function mod_edit_post($board, $edit_raw_html, $postID) {
 
 	$security_token = make_secure_link_token($board . '/edit' . ($edit_raw_html ? '_raw' : '') . '/' . $postID);
 	
-	$query = prepare(sprintf('SELECT * FROM `posts_%s` WHERE `id` = :id', $board));
+	$query = prepare(sprintf('SELECT * FROM ``posts_%s`` WHERE `id` = :id', $board));
 	$query->bindValue(':id', $postID);
 	$query->execute() or error(db_error($query));
 
@@ -1276,9 +1278,9 @@ function mod_edit_post($board, $edit_raw_html, $postID) {
 	
 	if (isset($_POST['name'], $_POST['email'], $_POST['subject'], $_POST['body'])) {
 		if ($edit_raw_html)
-			$query = prepare(sprintf('UPDATE `posts_%s` SET `name` = :name, `email` = :email, `subject` = :subject, `body` = :body, `body_nomarkup` = :body_nomarkup WHERE `id` = :id', $board));
+			$query = prepare(sprintf('UPDATE ``posts_%s`` SET `name` = :name, `email` = :email, `subject` = :subject, `body` = :body, `body_nomarkup` = :body_nomarkup WHERE `id` = :id', $board));
 		else
-			$query = prepare(sprintf('UPDATE `posts_%s` SET `name` = :name, `email` = :email, `subject` = :subject, `body_nomarkup` = :body WHERE `id` = :id', $board));
+			$query = prepare(sprintf('UPDATE ``posts_%s`` SET `name` = :name, `email` = :email, `subject` = :subject, `body_nomarkup` = :body WHERE `id` = :id', $board));
 		$query->bindValue(':id', $postID);
 		$query->bindValue('name', $_POST['name']);
 		$query->bindValue(':email', $_POST['email']);
@@ -1369,7 +1371,7 @@ function mod_deletebyip($boardName, $post, $global = false) {
 		error($config['error']['noaccess']);
 	
 	// Find IP address
-	$query = prepare(sprintf('SELECT `ip` FROM `posts_%s` WHERE `id` = :id', $boardName));
+	$query = prepare(sprintf('SELECT `ip` FROM ``posts_%s`` WHERE `id` = :id', $boardName));
 	$query->bindValue(':id', $post);
 	$query->execute() or error(db_error($query));
 	if (!$ip = $query->fetchColumn())
@@ -1379,7 +1381,7 @@ function mod_deletebyip($boardName, $post, $global = false) {
 	
 	$query = '';
 	foreach ($boards as $_board) {
-		$query .= sprintf("SELECT `thread`, `id`, '%s' AS `board` FROM `posts_%s` WHERE `ip` = :ip UNION ALL ", $_board['uri'], $_board['uri']);
+		$query .= sprintf("SELECT `thread`, `id`, '%s' AS `board` FROM ``posts_%s`` WHERE `ip` = :ip UNION ALL ", $_board['uri'], $_board['uri']);
 	}
 	$query = preg_replace('/UNION ALL $/', '', $query);
 	
@@ -1431,7 +1433,7 @@ function mod_user($uid) {
 	if (!hasPermission($config['mod']['editusers']) && !(hasPermission($config['mod']['change_password']) && $uid == $mod['id']))
 		error($config['error']['noaccess']);
 	
-	$query = prepare('SELECT * FROM `mods` WHERE `id` = :id');
+	$query = prepare('SELECT * FROM ``mods`` WHERE `id` = :id');
 	$query->bindValue(':id', $uid);
 	$query->execute() or error(db_error($query));
 	if (!$user = $query->fetch(PDO::FETCH_ASSOC))
@@ -1457,7 +1459,7 @@ function mod_user($uid) {
 			if (!hasPermission($config['mod']['deleteusers']))
 				error($config['error']['noaccess']);
 			
-			$query = prepare('DELETE FROM `mods` WHERE `id` = :id');
+			$query = prepare('DELETE FROM ``mods`` WHERE `id` = :id');
 			$query->bindValue(':id', $uid);
 			$query->execute() or error(db_error($query));
 			
@@ -1471,7 +1473,7 @@ function mod_user($uid) {
 		if ($_POST['username'] == '')
 			error(sprintf($config['error']['required'], 'username'));
 		
-		$query = prepare('UPDATE `mods` SET `username` = :username, `boards` = :boards WHERE `id` = :id');
+		$query = prepare('UPDATE ``mods`` SET `username` = :username, `boards` = :boards WHERE `id` = :id');
 		$query->bindValue(':id', $uid);
 		$query->bindValue(':username', $_POST['username']);
 		$query->bindValue(':boards', implode(',', $boards));
@@ -1486,7 +1488,7 @@ function mod_user($uid) {
 			$salt = generate_salt();
 			$password = hash('sha256', $salt . sha1($_POST['password']));
 			
-			$query = prepare('UPDATE `mods` SET `password` = :password, `salt` = :salt WHERE `id` = :id');
+			$query = prepare('UPDATE ``mods`` SET `password` = :password, `salt` = :salt WHERE `id` = :id');
 			$query->bindValue(':id', $uid);
 			$query->bindValue(':password', $password);
 			$query->bindValue(':salt', $salt);
@@ -1513,7 +1515,7 @@ function mod_user($uid) {
 			$salt = generate_salt();
 			$password = hash('sha256', $salt . sha1($_POST['password']));
 
-			$query = prepare('UPDATE `mods` SET `password` = :password, `salt` = :salt WHERE `id` = :id');
+			$query = prepare('UPDATE ``mods`` SET `password` = :password, `salt` = :salt WHERE `id` = :id');
 			$query->bindValue(':id', $uid);
 			$query->bindValue(':password', $password);
 			$query->bindValue(':salt', $salt);
@@ -1534,7 +1536,7 @@ function mod_user($uid) {
 	}
 	
 	if (hasPermission($config['mod']['modlog'])) {
-		$query = prepare('SELECT * FROM `modlogs` WHERE `mod` = :id ORDER BY `time` DESC LIMIT 5');
+		$query = prepare('SELECT * FROM ``modlogs`` WHERE `mod` = :id ORDER BY `time` DESC LIMIT 5');
 		$query->bindValue(':id', $uid);
 		$query->execute() or error(db_error($query));
 		$log = $query->fetchAll(PDO::FETCH_ASSOC);
@@ -1581,7 +1583,7 @@ function mod_user_new() {
 		$salt = generate_salt();
 		$password = hash('sha256', $salt . sha1($_POST['password']));
 		
-		$query = prepare('INSERT INTO `mods` VALUES (NULL, :username, :password, :salt, :type, :boards)');
+		$query = prepare('INSERT INTO ``mods`` VALUES (NULL, :username, :password, :salt, :type, :boards)');
 		$query->bindValue(':username', $_POST['username']);
 		$query->bindValue(':password', $password);
 		$query->bindValue(':salt', $salt);
@@ -1607,7 +1609,7 @@ function mod_users() {
 	if (!hasPermission($config['mod']['manageusers']))
 		error($config['error']['noaccess']);
 	
-	$query = query("SELECT *, (SELECT `time` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `last`, (SELECT `text` FROM `modlogs` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `action` FROM `mods` ORDER BY `type` DESC,`id`") or error(db_error());
+	$query = query("SELECT *, (SELECT `time` FROM ``modlogs`` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `last`, (SELECT `text` FROM ``modlogs`` WHERE `mod` = `id` ORDER BY `time` DESC LIMIT 1) AS `action` FROM ``mods`` ORDER BY `type` DESC,`id`") or error(db_error());
 	$users = $query->fetchAll(PDO::FETCH_ASSOC);
 	
 	mod_page(sprintf('%s (%d)', _('Manage users'), count($users)), 'mod/users.html', array('users' => $users));
@@ -1619,7 +1621,7 @@ function mod_user_promote($uid, $action) {
 	if (!hasPermission($config['mod']['promoteusers']))
 		error($config['error']['noaccess']);
 	
-	$query = prepare("UPDATE `mods` SET `type` = `type` " . ($action == 'promote' ? "+1 WHERE `type` < " . (int)ADMIN : "-1 WHERE `type` > " . (int)JANITOR) . " AND `id` = :id");
+	$query = prepare("UPDATE ``mods`` SET `type` = `type` " . ($action == 'promote' ? "+1 WHERE `type` < " . (int)ADMIN : "-1 WHERE `type` > " . (int)JANITOR) . " AND `id` = :id");
 	$query->bindValue(':id', $uid);
 	$query->execute() or error(db_error($query));
 	
@@ -1634,7 +1636,7 @@ function mod_pm($id, $reply = false) {
 	if ($reply && !hasPermission($config['mod']['create_pm']))
 		error($config['error']['noaccess']);
 	
-	$query = prepare("SELECT `mods`.`username`, `mods_to`.`username` AS `to_username`, `pms`.* FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` LEFT JOIN `mods` AS `mods_to` ON `mods_to`.`id` = `to` WHERE `pms`.`id` = :id");
+	$query = prepare("SELECT ``mods``.`username`, `mods_to`.`username` AS `to_username`, ``pms``.* FROM ``pms`` LEFT JOIN ``mods`` ON ``mods``.`id` = `sender` LEFT JOIN ``mods`` AS `mods_to` ON `mods_to`.`id` = `to` WHERE ``pms``.`id` = :id");
 	$query->bindValue(':id', $id);
 	$query->execute() or error(db_error($query));
 	
@@ -1642,7 +1644,7 @@ function mod_pm($id, $reply = false) {
 		error($config['error']['404']);
 	
 	if (isset($_POST['delete'])) {
-		$query = prepare("DELETE FROM `pms` WHERE `id` = :id");
+		$query = prepare("DELETE FROM ``pms`` WHERE `id` = :id");
 		$query->bindValue(':id', $id);
 		$query->execute() or error(db_error($query));
 		
@@ -1656,7 +1658,7 @@ function mod_pm($id, $reply = false) {
 	}
 	
 	if ($pm['unread'] && $pm['to'] == $mod['id']) {
-		$query = prepare("UPDATE `pms` SET `unread` = 0 WHERE `id` = :id");
+		$query = prepare("UPDATE ``pms`` SET `unread` = 0 WHERE `id` = :id");
 		$query->bindValue(':id', $id);
 		$query->execute() or error(db_error($query));
 		
@@ -1683,12 +1685,12 @@ function mod_pm($id, $reply = false) {
 function mod_inbox() {
 	global $config, $mod;
 	
-	$query = prepare('SELECT `unread`,`pms`.`id`, `time`, `sender`, `to`, `message`, `username` FROM `pms` LEFT JOIN `mods` ON `mods`.`id` = `sender` WHERE `to` = :mod ORDER BY `unread` DESC, `time` DESC');
+	$query = prepare('SELECT `unread`,``pms``.`id`, `time`, `sender`, `to`, `message`, `username` FROM ``pms`` LEFT JOIN ``mods`` ON ``mods``.`id` = `sender` WHERE `to` = :mod ORDER BY `unread` DESC, `time` DESC');
 	$query->bindValue(':mod', $mod['id']);
 	$query->execute() or error(db_error($query));
 	$messages = $query->fetchAll(PDO::FETCH_ASSOC);
 	
-	$query = prepare('SELECT COUNT(*) FROM `pms` WHERE `to` = :mod AND `unread` = 1');
+	$query = prepare('SELECT COUNT(*) FROM ``pms`` WHERE `to` = :mod AND `unread` = 1');
 	$query->bindValue(':mod', $mod['id']);
 	$query->execute() or error(db_error($query));
 	$unread = $query->fetchColumn();
@@ -1710,12 +1712,12 @@ function mod_new_pm($username) {
 	if (!hasPermission($config['mod']['create_pm']))
 		error($config['error']['noaccess']);
 	
-	$query = prepare("SELECT `id` FROM `mods` WHERE `username` = :username");
+	$query = prepare("SELECT `id` FROM ``mods`` WHERE `username` = :username");
 	$query->bindValue(':username', $username);
 	$query->execute() or error(db_error($query));
 	if (!$id = $query->fetchColumn()) {
 		// Old style ?/PM: by user ID
-		$query = prepare("SELECT `username` FROM `mods` WHERE `id` = :username");
+		$query = prepare("SELECT `username` FROM ``mods`` WHERE `id` = :username");
 		$query->bindValue(':username', $username);
 		$query->execute() or error(db_error($query));
 		if ($username = $query->fetchColumn())
@@ -1728,7 +1730,7 @@ function mod_new_pm($username) {
 		$_POST['message'] = escape_markup_modifiers($_POST['message']);
 		markup($_POST['message']);
 		
-		$query = prepare("INSERT INTO `pms` VALUES (NULL, :me, :id, :message, :time, 1)");
+		$query = prepare("INSERT INTO ``pms`` VALUES (NULL, :me, :id, :message, :time, 1)");
 		$query->bindValue(':me', $mod['id']);
 		$query->bindValue(':id', $id);
 		$query->bindValue(':message', $_POST['message']);
@@ -1801,7 +1803,7 @@ function mod_rebuild() {
 			}
 			
 			if (isset($_POST['rebuild_thread'])) {
-				$query = query(sprintf("SELECT `id` FROM `posts_%s` WHERE `thread` IS NULL", $board['uri'])) or error(db_error());
+				$query = query(sprintf("SELECT `id` FROM ``posts_%s`` WHERE `thread` IS NULL", $board['uri'])) or error(db_error());
 				while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 					$log[] = '<strong>' . sprintf($config['board_abbreviation'], $board['uri']) . '</strong>: Rebuilding thread #' . $post['id'];
 					buildThread($post['id']);
@@ -1822,7 +1824,7 @@ function mod_reports() {
 	if (!hasPermission($config['mod']['reports']))
 		error($config['error']['noaccess']);
 	
-	$query = prepare("SELECT * FROM `reports` ORDER BY `time` DESC LIMIT :limit");
+	$query = prepare("SELECT * FROM ``reports`` ORDER BY `time` DESC LIMIT :limit");
 	$query->bindValue(':limit', $config['mod']['recent_reports'], PDO::PARAM_INT);
 	$query->execute() or error(db_error($query));
 	$reports = $query->fetchAll(PDO::FETCH_ASSOC);
@@ -1838,7 +1840,7 @@ function mod_reports() {
 	foreach ($report_queries as $board => $posts) {
 		$report_posts[$board] = array();
 		
-		$query = query(sprintf('SELECT * FROM `posts_%s` WHERE `id` = ' . implode(' OR `id` = ', $posts), $board)) or error(db_error());
+		$query = query(sprintf('SELECT * FROM ``posts_%s`` WHERE `id` = ' . implode(' OR `id` = ', $posts), $board)) or error(db_error());
 		while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 			$report_posts[$board][$post['id']] = $post;
 		}
@@ -1849,7 +1851,7 @@ function mod_reports() {
 	foreach ($reports as $report) {
 		if (!isset($report_posts[$report['board']][$report['post']])) {
 			// // Invalid report (post has since been deleted)
-			$query = prepare("DELETE FROM `reports` WHERE `post` = :id AND `board` = :board");
+			$query = prepare("DELETE FROM ``reports`` WHERE `post` = :id AND `board` = :board");
 			$query->bindValue(':id', $report['post'], PDO::PARAM_INT);
 			$query->bindValue(':board', $report['board']);
 			$query->execute() or error(db_error($query));
@@ -1905,7 +1907,7 @@ function mod_reports() {
 function mod_report_dismiss($id, $all = false) {
 	global $config;
 	
-	$query = prepare("SELECT `post`, `board`, `ip` FROM `reports` WHERE `id` = :id");
+	$query = prepare("SELECT `post`, `board`, `ip` FROM ``reports`` WHERE `id` = :id");
 	$query->bindValue(':id', $id);
 	$query->execute() or error(db_error($query));
 	if ($report = $query->fetch(PDO::FETCH_ASSOC)) {
@@ -1922,10 +1924,10 @@ function mod_report_dismiss($id, $all = false) {
 		error($config['error']['noaccess']);
 	
 	if ($all) {
-		$query = prepare("DELETE FROM `reports` WHERE `ip` = :ip");
+		$query = prepare("DELETE FROM ``reports`` WHERE `ip` = :ip");
 		$query->bindValue(':ip', $ip);
 	} else {
-		$query = prepare("DELETE FROM `reports` WHERE `id` = :id");
+		$query = prepare("DELETE FROM ``reports`` WHERE `id` = :id");
 		$query->bindValue(':id', $id);
 	}
 	$query->execute() or error(db_error($query));
@@ -2035,7 +2037,7 @@ function mod_themes_list() {
 	if (!$dir = opendir($config['dir']['themes']))
 		error(_('Cannot open themes directory; check permissions.'));
 
-	$query = query('SELECT `theme` FROM `theme_settings` WHERE `name` IS NULL AND `value` IS NULL') or error(db_error());
+	$query = query('SELECT `theme` FROM ``theme_settings`` WHERE `name` IS NULL AND `value` IS NULL') or error(db_error());
 	$themes_in_use = $query->fetchAll(PDO::FETCH_COLUMN);
 
 	// Scan directory for themes
@@ -2071,19 +2073,19 @@ function mod_theme_configure($theme_name) {
 		}
 		
 		// Clear previous settings
-		$query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme");
+		$query = prepare("DELETE FROM ``theme_settings`` WHERE `theme` = :theme");
 		$query->bindValue(':theme', $theme_name);
 		$query->execute() or error(db_error($query));
 		
 		foreach ($theme['config'] as &$conf) {
-			$query = prepare("INSERT INTO `theme_settings` VALUES(:theme, :name, :value)");
+			$query = prepare("INSERT INTO ``theme_settings`` VALUES(:theme, :name, :value)");
 			$query->bindValue(':theme', $theme_name);
 			$query->bindValue(':name', $conf['name']);
 			$query->bindValue(':value', $_POST[$conf['name']]);
 			$query->execute() or error(db_error($query));
 		}
 		
-		$query = prepare("INSERT INTO `theme_settings` VALUES(:theme, NULL, NULL)");
+		$query = prepare("INSERT INTO ``theme_settings`` VALUES(:theme, NULL, NULL)");
 		$query->bindValue(':theme', $theme_name);
 		$query->execute() or error(db_error($query));
 		
@@ -2101,7 +2103,7 @@ function mod_theme_configure($theme_name) {
 		
 		if (!$result) {
 			// Install failed
-			$query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme");
+			$query = prepare("DELETE FROM ``theme_settings`` WHERE `theme` = :theme");
 			$query->bindValue(':theme', $theme_name);
 			$query->execute() or error(db_error($query));
 		}
@@ -2133,7 +2135,7 @@ function mod_theme_uninstall($theme_name) {
 	if (!hasPermission($config['mod']['themes']))
 		error($config['error']['noaccess']);
 	
-	$query = prepare("DELETE FROM `theme_settings` WHERE `theme` = :theme");
+	$query = prepare("DELETE FROM ``theme_settings`` WHERE `theme` = :theme");
 	$query->bindValue(':theme', $theme_name);
 	$query->execute() or error(db_error($query));
 
@@ -2164,7 +2166,7 @@ function mod_debug_antispam() {
 			$where .= ' AND `thread` = ' . $pdo->quote($_POST['thread']);
 		
 		if (isset($_POST['purge'])) {
-			$query = prepare(', DATE `antispam` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE' . $where);
+			$query = prepare(', DATE ``antispam`` SET `expires` = UNIX_TIMESTAMP() + :expires WHERE' . $where);
 			$query->bindValue(':expires', $config['spam']['hidden_inputs_expire']);
 			$query->execute() or error(db_error());
 		}
@@ -2175,16 +2177,16 @@ function mod_debug_antispam() {
 		$where = '';
 	}
 	
-	$query = query('SELECT COUNT(*) FROM `antispam`' . ($where ? " WHERE $where" : '')) or error(db_error());
+	$query = query('SELECT COUNT(*) FROM ``antispam``' . ($where ? " WHERE $where" : '')) or error(db_error());
 	$args['total'] = number_format($query->fetchColumn());
 	
-	$query = query('SELECT COUNT(*) FROM `antispam` WHERE `expires` IS NOT NULL' . ($where ? " AND $where" : '')) or error(db_error());
+	$query = query('SELECT COUNT(*) FROM ``antispam`` WHERE `expires` IS NOT NULL' . ($where ? " AND $where" : '')) or error(db_error());
 	$args['expiring'] = number_format($query->fetchColumn());
 	
-	$query = query('SELECT * FROM `antispam` ' . ($where ? "WHERE $where" : '') . ' ORDER BY `passed` DESC LIMIT 40') or error(db_error());
+	$query = query('SELECT * FROM ``antispam`` ' . ($where ? "WHERE $where" : '') . ' ORDER BY `passed` DESC LIMIT 40') or error(db_error());
 	$args['top'] = $query->fetchAll(PDO::FETCH_ASSOC);
 	
-	$query = query('SELECT * FROM `antispam` ' . ($where ? "WHERE $where" : '') . ' ORDER BY `created` DESC LIMIT 20') or error(db_error());
+	$query = query('SELECT * FROM ``antispam`` ' . ($where ? "WHERE $where" : '') . ' ORDER BY `created` DESC LIMIT 20') or error(db_error());
 	$args['recent'] = $query->fetchAll(PDO::FETCH_ASSOC);
 	
 	mod_page(_('Debug: Anti-spam'), 'mod/debug/antispam.html', $args);
@@ -2200,7 +2202,7 @@ function mod_debug_recent_posts() {
 	// Manually build an SQL query
 	$query = 'SELECT * FROM (';
 	foreach ($boards as $board) {
-		$query .= sprintf('SELECT *, %s AS `board` FROM `posts_%s` UNION ALL ', $pdo->quote($board['uri']), $board['uri']);
+		$query .= sprintf('SELECT *, %s AS `board` FROM ``posts_%s`` UNION ALL ', $pdo->quote($board['uri']), $board['uri']);
 	}
 	// Remove the last "UNION ALL" seperator and complete the query
 	$query = preg_replace('/UNION ALL $/', ') AS `all_posts` ORDER BY `time` DESC LIMIT ' . $limit, $query);
diff --git a/install.php b/install.php
index 847876ab..2f51b22f 100644
--- a/install.php
+++ b/install.php
@@ -501,6 +501,9 @@ if ($step == 0) {
 		<label for="db_db">Database:</label> 
 		<input type="text" id="db_db" name="db[database]" value="" />
 		
+		<label for="db_pass">Table prefix (optional):</label> 
+		<input type="password" id="db_pass" name="db[prefix]" value="" />
+		
 		<label for="db_user">Username:</label> 
 		<input type="text" id="db_user" name="db[user]" value="" />
 		
@@ -668,7 +671,8 @@ if ($step == 0) {
 	$queries[] = Element('posts.sql', array('board' => 'b'));
 	
 	$sql_errors = '';
-	foreach ($queries as &$query) {
+	foreach ($queries as $query) {
+		$query = preg_replace('/^([\w\s]*)`([0-9a-zA-Z$_\x{0080}-\x{FFFF}]+)`/u', '$1``$2``', $query);
 		if (!query($query))
 			$sql_errors .= '<li>' . db_error() . '</li>';
 	}
diff --git a/post.php b/post.php
index f4499845..22782ca7 100644
--- a/post.php
+++ b/post.php
@@ -48,7 +48,7 @@ if (isset($_POST['delete'])) {
 		error($config['error']['nodelete']);
 		
 	foreach ($delete as &$id) {
-		$query = prepare(sprintf("SELECT `thread`, `time`,`password` FROM `posts_%s` WHERE `id` = :id", $board['uri']));
+		$query = prepare(sprintf("SELECT `thread`, `time`,`password` FROM ``posts_%s`` WHERE `id` = :id", $board['uri']));
 		$query->bindValue(':id', $id, PDO::PARAM_INT);
 		$query->execute() or error(db_error($query));
 		
@@ -111,7 +111,7 @@ if (isset($_POST['delete'])) {
 	markup($reason);
 	
 	foreach ($report as &$id) {
-		$query = prepare(sprintf("SELECT `thread` FROM `posts_%s` WHERE `id` = :id", $board['uri']));
+		$query = prepare(sprintf("SELECT `thread` FROM ``posts_%s`` WHERE `id` = :id", $board['uri']));
 		$query->bindValue(':id', $id, PDO::PARAM_INT);
 		$query->execute() or error(db_error($query));
 		
@@ -123,7 +123,7 @@ if (isset($_POST['delete'])) {
 					'/' . $board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], $thread ? $thread : $id) . ($thread ? '#' . $id : '') .
 					' for "' . $reason . '"'
 				);
-			$query = prepare("INSERT INTO `reports` VALUES (NULL, :time, :ip, :board, :post, :reason)");
+			$query = prepare("INSERT INTO ``reports`` VALUES (NULL, :time, :ip, :board, :post, :reason)");
 			$query->bindValue(':time', time(), PDO::PARAM_INT);
 			$query->bindValue(':ip', $_SERVER['REMOTE_ADDR'], PDO::PARAM_STR);
 			$query->bindValue(':board', $board['uri'], PDO::PARAM_INT);
@@ -227,7 +227,7 @@ if (isset($_POST['delete'])) {
 	
 	//Check if thread exists
 	if (!$post['op']) {
-		$query = prepare(sprintf("SELECT `sticky`,`locked`,`sage` FROM `posts_%s` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri']));
+		$query = prepare(sprintf("SELECT `sticky`,`locked`,`sage` FROM ``posts_%s`` WHERE `id` = :id AND `thread` IS NULL LIMIT 1", $board['uri']));
 		$query->bindValue(':id', $post['thread'], PDO::PARAM_INT);
 		$query->execute() or error(db_error());
 		
@@ -583,7 +583,7 @@ if (isset($_POST['delete'])) {
 	
 	if (isset($post['tracked_cites'])) {
 		foreach ($post['tracked_cites'] as $cite) {
-			$query = prepare('INSERT INTO `cites` VALUES (:board, :post, :target_board, :target)');
+			$query = prepare('INSERT INTO ``cites`` VALUES (:board, :post, :target_board, :target)');
 			$query->bindValue(':board', $board['uri']);
 			$query->bindValue(':post', $id, PDO::PARAM_INT);
 			$query->bindValue(':target_board',$cite[0]);
diff --git a/templates/posts.sql b/templates/posts.sql
index 698fad77..ca2ec304 100644
--- a/templates/posts.sql
+++ b/templates/posts.sql
@@ -1,4 +1,4 @@
-CREATE TABLE IF NOT EXISTS `posts_{{ board }}` (
+CREATE TABLE IF NOT EXISTS ``posts_{{ board }}`` (
    `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
    `thread` int(11) DEFAULT NULL,
    `subject` varchar(100) DEFAULT NULL,
diff --git a/templates/themes/basic/theme.php b/templates/themes/basic/theme.php
index 7ba0d1e7..6ba09ce6 100644
--- a/templates/themes/basic/theme.php
+++ b/templates/themes/basic/theme.php
@@ -25,7 +25,7 @@
 			
 			$settings['no_recent'] = (int) $settings['no_recent'];
 			
-			$query = query("SELECT * FROM `news` ORDER BY `time` DESC" . ($settings['no_recent'] ? ' LIMIT ' . $settings['no_recent'] : '')) or error(db_error());
+			$query = query("SELECT * FROM ``news`` ORDER BY `time` DESC" . ($settings['no_recent'] ? ' LIMIT ' . $settings['no_recent'] : '')) or error(db_error());
 			$news = $query->fetchAll(PDO::FETCH_ASSOC);
 			
 			return Element('themes/basic/index.html', Array(
diff --git a/templates/themes/catalog/theme.php b/templates/themes/catalog/theme.php
index 5c9f6769..4e2d40db 100644
--- a/templates/themes/catalog/theme.php
+++ b/templates/themes/catalog/theme.php
@@ -37,7 +37,7 @@
 			$recent_posts = array();
 			$stats = array();
 			
-			$query = query(sprintf("SELECT *, `id` AS `thread_id`, (SELECT COUNT(*) FROM `posts_%s` WHERE `thread` = `thread_id`) AS `reply_count`, '%s' AS `board` FROM `posts_%s` WHERE `thread` IS NULL ORDER BY `bump` DESC", $board_name, $board_name, $board_name)) or error(db_error());
+			$query = query(sprintf("SELECT *, `id` AS `thread_id`, (SELECT COUNT(*) FROM ``posts_%s`` WHERE `thread` = `thread_id`) AS `reply_count`, '%s' AS `board` FROM ``posts_%s`` WHERE `thread` IS NULL ORDER BY `bump` DESC", $board_name, $board_name, $board_name)) or error(db_error());
 			
 			while ($post = $query->fetch(PDO::FETCH_ASSOC)) {
 				$post['link'] = $config['root'] . $board['dir'] . $config['dir']['res'] . sprintf($config['file_page'], ($post['thread'] ? $post['thread'] : $post['id']));
diff --git a/templates/themes/categories/theme.php b/templates/themes/categories/theme.php
index 7d468d0d..74ed61ed 100644
--- a/templates/themes/categories/theme.php
+++ b/templates/themes/categories/theme.php
@@ -36,7 +36,7 @@
 		public static function news($settings) {
 			global $config;
 			
-			$query = query("SELECT * FROM `news` ORDER BY `time` DESC") or error(db_error());
+			$query = query("SELECT * FROM ``news`` ORDER BY `time` DESC") or error(db_error());
 			$news = $query->fetchAll(PDO::FETCH_ASSOC);
 			
 			return Element('themes/categories/news.html', Array(
diff --git a/templates/themes/frameset/theme.php b/templates/themes/frameset/theme.php
index 5fd9d29e..ffab0538 100644
--- a/templates/themes/frameset/theme.php
+++ b/templates/themes/frameset/theme.php
@@ -36,7 +36,7 @@
 		public static function news($settings) {
 			global $config;
 			
-			$query = query("SELECT * FROM `news` ORDER BY `time` DESC") or error(db_error());
+			$query = query("SELECT * FROM ``news`` ORDER BY `time` DESC") or error(db_error());
 			$news = $query->fetchAll(PDO::FETCH_ASSOC);
 			
 			return Element('themes/frameset/news.html', Array(
diff --git a/templates/themes/recent/theme.php b/templates/themes/recent/theme.php
index 98fabfa1..08d910f8 100644
--- a/templates/themes/recent/theme.php
+++ b/templates/themes/recent/theme.php
@@ -42,7 +42,7 @@
 			foreach ($boards as &$_board) {
 				if (in_array($_board['uri'], $this->excluded))
 					continue;
-				$query .= sprintf("SELECT *, '%s' AS `board` FROM `posts_%s` WHERE `file` IS NOT NULL AND `file` != 'deleted' AND `thumb` != 'spoiler' UNION ALL ", $_board['uri'], $_board['uri']);
+				$query .= sprintf("SELECT *, '%s' AS `board` FROM ``posts_%s`` WHERE `file` IS NOT NULL AND `file` != 'deleted' AND `thumb` != 'spoiler' UNION ALL ", $_board['uri'], $_board['uri']);
 			}
 			$query = preg_replace('/UNION ALL $/', 'ORDER BY `time` DESC LIMIT ' . (int)$settings['limit_images'], $query);
 			$query = query($query) or error(db_error());
@@ -62,7 +62,7 @@
 			foreach ($boards as &$_board) {
 				if (in_array($_board['uri'], $this->excluded))
 					continue;
-				$query .= sprintf("SELECT *, '%s' AS `board` FROM `posts_%s` UNION ALL ", $_board['uri'], $_board['uri']);
+				$query .= sprintf("SELECT *, '%s' AS `board` FROM ``posts_%s`` UNION ALL ", $_board['uri'], $_board['uri']);
 			}
 			$query = preg_replace('/UNION ALL $/', 'ORDER BY `time` DESC LIMIT ' . (int)$settings['limit_posts'], $query);
 			$query = query($query) or error(db_error());
@@ -82,7 +82,7 @@
 			foreach ($boards as &$_board) {
 				if (in_array($_board['uri'], $this->excluded))
 					continue;
-				$query .= sprintf("SELECT MAX(`id`) AS `top` FROM `posts_%s` UNION ALL ", $_board['uri']);
+				$query .= sprintf("SELECT MAX(`id`) AS `top` FROM ``posts_%s`` UNION ALL ", $_board['uri']);
 			}
 			$query = preg_replace('/UNION ALL $/', ') AS `posts_all`', $query);
 			$query = query($query) or error(db_error());
@@ -93,7 +93,7 @@
 			foreach ($boards as &$_board) {
 				if (in_array($_board['uri'], $this->excluded))
 					continue;
-				$query .= sprintf("SELECT `ip` FROM `posts_%s` UNION ALL ", $_board['uri']);
+				$query .= sprintf("SELECT `ip` FROM ``posts_%s`` UNION ALL ", $_board['uri']);
 			}
 			$query = preg_replace('/UNION ALL $/', ') AS `posts_all`', $query);
 			$query = query($query) or error(db_error());
@@ -104,7 +104,7 @@
 			foreach ($boards as &$_board) {
 				if (in_array($_board['uri'], $this->excluded))
 					continue;
-				$query .= sprintf("SELECT `filesize` FROM `posts_%s` UNION ALL ", $_board['uri']);
+				$query .= sprintf("SELECT `filesize` FROM ``posts_%s`` UNION ALL ", $_board['uri']);
 			}
 			$query = preg_replace('/UNION ALL $/', ') AS `posts_all`', $query);
 			$query = query($query) or error(db_error());
diff --git a/templates/themes/rrdtool/theme.php b/templates/themes/rrdtool/theme.php
index 0e0a2f15..a14169a3 100644
--- a/templates/themes/rrdtool/theme.php
+++ b/templates/themes/rrdtool/theme.php
@@ -61,7 +61,7 @@
 					// debug just the graphing (not updating) with the --debug switch
 					if (!isset($argv[1]) || $argv[1] != '--debug') {
 						// Update graph
-						$query = query(sprintf("SELECT MAX(`id`) FROM `posts_%s`", $board));
+						$query = query(sprintf("SELECT MAX(`id`) FROM ``posts_%s``", $board));
 						$count = $query->fetchColumn();
 					
 						if (!rrd_update($file, Array(
diff --git a/templates/themes/sitemap/theme.php b/templates/themes/sitemap/theme.php
index e210316b..226f8357 100644
--- a/templates/themes/sitemap/theme.php
+++ b/templates/themes/sitemap/theme.php
@@ -19,7 +19,7 @@
 		$threads = array();
 		
 		foreach ($boards as $board) {
-			$query = query(sprintf("SELECT `id` AS `thread_id`, (SELECT `time` FROM `posts_%s` WHERE `thread` = `thread_id` OR `id` = `thread_id` ORDER BY `time` DESC LIMIT 1) AS `lastmod` FROM `posts_%s` WHERE `thread` IS NULL", $board, $board)) or error(db_error());
+			$query = query(sprintf("SELECT `id` AS `thread_id`, (SELECT `time` FROM ``posts_%s`` WHERE `thread` = `thread_id` OR `id` = `thread_id` ORDER BY `time` DESC LIMIT 1) AS `lastmod` FROM ``posts_%s`` WHERE `thread` IS NULL", $board, $board)) or error(db_error());
 			$threads[$board] = $query->fetchAll(PDO::FETCH_ASSOC);
 		}
 				
-- 
cgit v1.3


From 40ab2e0c1728fab613bc16a19ab8fcb3fa78c1d4 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Thu, 1 Aug 2013 21:28:16 -0400
Subject: Don't redraw image again after correcting image orientation; Correct
 image orientation with convert+gifsicle too

---
 inc/image.php |  4 ++--
 post.php      | 10 ++++++----
 2 files changed, 8 insertions(+), 6 deletions(-)

(limited to 'post.php')

diff --git a/inc/image.php b/inc/image.php
index 5910cb85..51db2f83 100644
--- a/inc/image.php
+++ b/inc/image.php
@@ -251,9 +251,9 @@ class ImageConvert extends ImageBase {
 		
 		if (!$this->temp) {
 			if ($config['strip_exif']) {
-				shell_exec('convert ' . escapeshellarg($this->src) . ' -strip ' . escapeshellarg($src));
+				shell_exec('convert ' . escapeshellarg($this->src) . ' -auto-orient -strip ' . escapeshellarg($src));
 			} else {
-				shell_exec('convert ' . escapeshellarg($this->src) . ' ' . escapeshellarg($src));
+				shell_exec('convert ' . escapeshellarg($this->src) . ' -auto-orient ' . escapeshellarg($src));
 			}
 		} else {
 			rename($this->temp, $src);
diff --git a/post.php b/post.php
index 22782ca7..5031830f 100644
--- a/post.php
+++ b/post.php
@@ -450,10 +450,12 @@ if (isset($_POST['delete'])) {
 			if ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg') {
 				// The following code corrects the image orientation.
 				// Currently only works with the 'convert' option selected but it could easily be expanded to work with the rest if you can be bothered.
-				if ($config['thumb_method'] == 'convert') {
-					$exif = exif_read_data($upload);
-					if (isset($exif['Orientation']) && $exif['Orientation'] != 1) {
-						shell_exec('convert ' . escapeshellarg($upload) . ' -auto-orient ' . escapeshellarg($upload));							
+				if (!($config['redraw_image'] || ($config['strip_exif'] && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg')))) {
+					if ($config['thumb_method'] == 'convert' || $config['thumb_method'] == 'convert+gifsicle') {
+						$exif = exif_read_data($upload);
+						if (isset($exif['Orientation']) && $exif['Orientation'] != 1) {
+							shell_exec('convert ' . escapeshellarg($upload) . ' -auto-orient ' . escapeshellarg($upload));							
+						}
 					}
 				}
 			}
-- 
cgit v1.3


From 4fce9b63aee89c04ea0d833992e72ab75585f630 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Fri, 2 Aug 2013 20:52:58 -0400
Subject: Major config.php cleanup and a few minor misc fixes.

---
 inc/config.php              | 1040 +++++++++++++++++++++++--------------------
 inc/display.php             |   42 +-
 inc/filters.php             |    4 +-
 inc/functions.php           |   13 +-
 inc/image.php               |   14 +-
 mod.php                     |   11 +-
 post.php                    |    2 +-
 templates/generic_page.html |    2 +-
 templates/index.html        |    2 +-
 templates/thread.html       |    2 +-
 10 files changed, 605 insertions(+), 527 deletions(-)

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index fe771358..c181c0c5 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -29,45 +29,49 @@
  *  General/misc settings
  * =======================
  */
- 	// Blotter -- the simple version.
-	//$config['blotter'] = 'This is an important announcement!';
- 	
-	// Automatically check if a newer version of Tinyboard is available when an administrator logs in
+
+	// Global announcement -- the very simple version.
+	// This used to be wrongly named $config['blotter'] (still exists as an alias).
+	// $config['global_message'] = 'This is an important announcement!';
+	$config['blotter'] = &$config['global_message'];
+
+	// Automatically check if a newer version of Tinyboard is available when an administrator logs in.
 	$config['check_updates'] = true;
 	// How often to check for updates
 	$config['check_updates_time'] = 43200; // 12 hours
-	
-	// Shows some extra information at the bottom of pages. Good for debugging development.
+
+	// Shows some extra information at the bottom of pages. Good for development/debugging.
 	$config['debug'] = false;
-	// For development purposes. Turns 'display_errors' on. Not recommended for production.
+	// For development purposes. All this does is turn 'display_errors' on.
 	$config['verbose_errors'] = true;
-	
-	// Directory where temporary files will be created. Not really used much yet except for some experimental stuff.
+
+	// Directory where temporary files will be created.
 	$config['tmp'] = sys_get_temp_dir();
-	
+
 	// The HTTP status code to use when redirecting. http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html
 	// Can be either 303 "See Other" or 302 "Found". (303 is more correct but both should work.)
+	// There is really no reason for you to ever need to change this.
 	$config['redirect_http'] = 303;
-	
-	// A small file in the main directory indicating that the script has been ran and the board(s) have been generated.
-	// This keeps the script from querying the database and causing strain when not needed.
+
+	// A tiny text file in the main directory indicating that the script has been ran and the board(s) have
+	// been generated. This keeps the script from querying the database and causing strain when not needed.
 	$config['has_installed'] = '.installed';
-	
+
 	// Use syslog() for logging all error messages and unauthorized login attempts.
 	$config['syslog'] = false;
-	
+
 	// Use `host` via shell_exec() to lookup hostnames, avoiding query timeouts. May not work on your system.
 	// Requires safe_mode to be disabled.
 	$config['dns_system'] = false;
-	
+
 /*
  * ====================
  *  Database settings
  * ====================
  */
-	
-	// SQL driver ("mysql", "pgsql", "sqlite", "dblib", etc)
-	// http://www.php.net/manual/en/pdo.drivers.php
+
+	// Database driver (http://www.php.net/manual/en/pdo.drivers.php)
+	// Only MySQL is supported by Tinyboard at the moment, sorry.
 	$config['db']['type'] = 'mysql';
 	// Hostname or IP address
 	$config['db']['server'] = 'localhost';
@@ -81,60 +85,72 @@
 	// Use a persistent connection (experimental)
 	$config['db']['persistent'] = false;
 	// Anything more to add to the DSN string (eg. port=xxx;foo=bar)
-	$config['db']['dsn'] = 'charset=UTF8';
+	$config['db']['dsn'] = '';
 	// Timeout duration in seconds (not all drivers support this)
 	$config['db']['timeout'] = 5;
-	
+
 /*
  * ====================
  *  Cache settings
  * ====================
  */
- 	
- 	$config['cache']['enabled'] = false;
- 	// $config['cache']['enabled'] = 'memcached';
- 	// $config['cache']['enabled'] = 'redis';
- 	// $config['cache']['enabled'] = 'apc';
- 	// $config['cache']['enabled'] = 'xcache';
- 	
- 	// Timeout for cached objects such as posts and HTML
-	$config['cache']['timeout'] = 43200; // 12 hours
-	
-	// Optional prefix if you're running multiple Tinyboard instances on the same machine
+
+	/*
+	 * On top of the static file caching system, you can enable the additional caching system which is
+	 * designed to minimize SQL queries and can significantly increase speed when posting or using the 
+	 * moderator interface. APC is the recommended method of caching.
+	 *
+	 * http://tinyboard.org/docs/index.php?p=Config/Cache
+	 */
+
+	$config['cache']['enabled'] = false;
+	// $config['cache']['enabled'] = 'xcache';
+	// $config['cache']['enabled'] = 'apc';
+	// $config['cache']['enabled'] = 'memcached';
+	// $config['cache']['enabled'] = 'redis';
+
+	// Timeout for cached objects such as posts and HTML.
+	$config['cache']['timeout'] = 60 * 60 * 48; // 48 hours
+
+	// Optional prefix if you're running multiple Tinyboard instances on the same machine.
 	$config['cache']['prefix'] = '';
-	
-	// Memcached servers to use - http://www.php.net/manual/en/memcached.addservers.php
+
+	// Memcached servers to use. Read more: http://www.php.net/manual/en/memcached.addservers.php
 	$config['cache']['memcached'] = array(
 		array('localhost', 11211)
 	);
 
 	// Redis server to use. Location, port, password, database id.
-	// Note that Tinyboard may clear the database at times, so you may want to pick a
-	// database id just for Tinyboard to use.
+	// Note that Tinyboard may clear the database at times, so you may want to pick a database id just for
+	// Tinyboard to use.
 	$config['cache']['redis'] = array('localhost', 6379, '', 1);
-	
+
 /*
  * ====================
  *  Cookie settings
  * ====================
  */
- 
-	// Used for moderation login
+
+	// Used for moderation login.
 	$config['cookies']['mod'] = 'mod';
+
 	// Used for communicating with Javascript; telling it when posts were successful.
-	// Rebuild Javascript file after changing this value or it won't work.
 	$config['cookies']['js'] = 'serv';
-	// Cookies "path". Defaults to $config['root']. If $config['root'] is a URL, you need to set this. Should be '/' or '/board/', depending on your installation.
+
+	// Cookies path. Defaults to $config['root']. If $config['root'] is a URL, you need to set this. Should
+	// be '/' or '/board/', depending on your installation.
 	// $config['cookies']['path'] = '/';
 	// Where to set the 'path' parameter to $config['cookies']['path'] when creating cookies. Recommended.
 	$config['cookies']['jail'] = true;
-	// How long should the cookies last (in seconds)
-	$config['cookies']['expire'] = 15778463; //6 months
-	// Make this something long and random for security
+
+	// How long should the cookies last (in seconds). Defines how long should moderators should remain logged
+	// in (0 = browser session).
+	$config['cookies']['expire'] = 60 * 60 * 24 * 30 * 6; // ~6 months
+
+	// Make this something long and random for security.
 	$config['cookies']['salt'] = 'abcdefghijklmnopqrstuvwxyz09123456789!@#$%^&*()';
-	// How long should moderators should remain logged in (0=browser session) (in seconds)
-	$config['mod']['expire'] = 15778463; //6 months
-	// Used to salt secure tripcodes (##trip) and poster IDs (if enabled)
+
+	// Used to salt secure tripcodes ("##trip") and poster IDs (if enabled).
 	$config['secure_trip_salt'] = ')(*&^%$#@!98765432190zyxwvutsrqponmlkjihgfedcba';
 
 /*
@@ -142,22 +158,29 @@
  *  Flood/spam settings
  * ====================
  */
-	
-	// How many seconds between each post
+
+	// Minimum time between between each post by the same IP address.
 	$config['flood_time'] = 10;
-	// How many seconds between each post with exactly the same content and same IP
+	// Minimum time between between each post with the exact same content AND same IP address.
 	$config['flood_time_ip'] = 120;
-	// Same as above but different IP address
+	// Same as above but by a different IP address. (Same content, not necessarily same IP address.)
 	$config['flood_time_same'] = 30;
-	
-	// DNS blacklists (DNSBL) http://tinyboard.org/docs/?p=Config/DNSBL
-	
-	// http://www.sectoor.de/tor.php
-	$config['dnsbl'][] = array('tor.dnsbl.sectoor.de', 1); // Tor exit servers
-	
+
+	/*
+	 * To further prevent spam and abuse, you can use DNS blacklists (DNSBL). A DNSBL is a list of IP
+	 * addresses published through the Internet Domain Name Service (DNS) either as a zone file that can be
+	 * used by DNS server software, or as a live DNS zone that can be queried in real-time.
+	 *
+	 * Read more: http://tinyboard.org/docs/?p=Config/DNSBL
+	 */
+
+	// Prevents most Tor exit nodes from making posts. Recommended, as a lot of abuse comes from Tor because
+	// of the strong anonymity associated with it.
+	$config['dnsbl'][] = array('tor.dnsbl.sectoor.de', 1);
+
 	// http://www.sorbs.net/using.shtml
 	// $config['dnsbl'][] = array('dnsbl.sorbs.net', array(2, 3, 4, 5, 6, 7, 8, 9));
-	
+
 	// http://www.projecthoneypot.org/httpbl.php
 	// $config['dnsbl'][] = array('<your access key>.%.dnsbl.httpbl.org', function($ip) {
 	//	$octets = explode('.', $ip);
@@ -172,11 +195,10 @@
 	//	
 	//	return true;
 	// }, 'dnsbl.httpbl.org'); // hide our access key
-	
-	
+
 	// Skip checking certain IP addresses against blacklists (for troubleshooting or whatever)
 	$config['dnsbl_exceptions'][] = '127.0.0.1';
-	
+
 	/*
 	 * Introduction to Tinyboard's spam filter:
 	 *
@@ -196,14 +218,17 @@
 	 * See also: http://tinyboard.org/docs/?p=Your_request_looks_automated
 	 *
 	 */
-	
-	// Number of hidden fields to generate
+
+	// Number of hidden fields to generate.
 	$config['spam']['hidden_inputs_min'] = 4;
 	$config['spam']['hidden_inputs_max'] = 12;
+
 	// How many times can a "hash" be used to post?
 	$config['spam']['hidden_inputs_max_pass'] = 12;
+
 	// How soon after regeneration do hashes expire (in seconds)?
 	$config['spam']['hidden_inputs_expire'] = 60 * 60 * 3; // three hours
+
 	// These are fields used to confuse the bots. Make sure they aren't actually used by Tinyboard, or it won't work.
 	$config['spam']['hidden_input_names'] = array(
 		'user',
@@ -217,6 +242,7 @@
 		'text',
 		'message'
 	);
+
 	// Always update this when adding new valid fields to the post form, or EVERYTHING WILL BE DETECTED AS SPAM!
 	$config['spam']['valid_inputs'] = array(
 		'hash',
@@ -238,38 +264,14 @@
 		'spoiler',
 		'quick-reply'
 	);
-	
-	// Custom flood filters. Detect flood attacks and reject new posts if there's a positive match.
-	// See http://tinyboard.org/wiki/index.php?title=Flood_filters for more information.
-	//$config['flood_filters'][] = array(
-	//	'condition' => array(
-	//		// 100 posts in the past 5 minutes (~20 p/m)
-	//		'posts_in_past_x_minutes' => array(100, 5)
-	//	),
-	//	// Don't allow the user to post
-	//	'action' => 'reject',
-	//	// Display this message
-	//	'message' => 'Your post has been rejected on the suspicion of a flood attack on this board.'
-	//);
-	
-	// Another filter
-	//$config['flood_filters'][] = array(
-	//	'condition' => array(
-	//		// 10 new empty threads in the past 2 minutes
-	//		'threads_with_no_replies_in_past_x_minutes' => array(10, 2),
-	//		// Allow replies, but not new threads (ie. reject topics only).
-	//		'OP' => true
-	//	),
-	//	'action' => 'reject',
-	//	'message' => 'Your post has been rejected on the suspicion of a flood attack on this board (too many new threads); post a reply instead.'
-	//);
-	
-	// Enable reCaptcha to make spam even harder
+
+	// Enable reCaptcha to make spam even harder. Rarely necessary.
 	$config['recaptcha'] = false;
+
 	// Public and private key pair from https://www.google.com/recaptcha/admin/create
 	$config['recaptcha_public'] = '6LcXTcUSAAAAAKBxyFWIt2SO8jwx4W7wcSMRoN3f';
 	$config['recaptcha_private'] = '6LcXTcUSAAAAAOGVbVdhmEM1_SyRF4xTKe8jbzf_';
-	
+
 /*
  * ====================
  *  Post settings
@@ -279,103 +281,155 @@
 	// Do you need a body for your reply posts?
 	$config['force_body'] = false;
 	// Do you need a body for new threads?
-	$config['force_body_op'] = true;
-	// Strip superfluous new lines at the end of a post
-	$config['strip_superfluous_returns'] = true;
+	$config['force_body_op'] = true;	
 	// Require an image for threads?
 	$config['force_image_op'] = true;
-	// Strip combining characters from Unicode strings (eg. "Zalgo")
+
+	// Strip superfluous new lines at the end of a post.
+	$config['strip_superfluous_returns'] = true;
+	// Strip combining characters from Unicode strings (eg. "Zalgo").
 	$config['strip_combining_chars'] = true;
-	
-	// Max body length
+
+	// Maximum post body length.
 	$config['max_body'] = 1800;
-	// Amount of post lines to show on the index page
+	// Maximum number of post body lines to show on the index page.
 	$config['body_truncate'] = 15;
-	// Amount of characters to show on the index page
+	// Maximum number of characters to show on the index page.
 	$config['body_truncate_char'] = 2500;
-	
-	// Typically spambots try to post a lot of links. Refuse a post with X standalone links?
+
+	// Typically spambots try to post many links. Refuse a post with X links?
 	$config['max_links'] = 20;
-	// Maximum number of cites per post (protects against abuse)
+	// Maximum number of cites per post (prevents abuse, as more citations mean more database queries).
 	$config['max_cites'] = 45;
-	// Maximum number of cross-board links/cites per post
+	// Maximum number of cross-board links/citations per post.
 	$config['max_cross'] = $config['max_cites'];
-	
+
 	// Track post citations (>>XX). Rebuilds posts after a cited post is deleted, removing broken links.
-	// A little more database load.
+	// Puts a little more load on the database.
 	$config['track_cites'] = true;
-	
-	// Maximum filename length (will be truncated)
+
+	// Maximum filename length (will be truncated).
 	$config['max_filename_len'] = 255;
-	// Maximum filename length to display (the rest can be viewed upon mouseover)
+	// Maximum filename length to display (the rest can be viewed upon mouseover).
 	$config['max_filename_display'] = 30;
-	
-	// How long before you can delete a post after posting, in seconds.
+
+	// How long after posting should you have to wait before being able to delete that post? (In seconds.)
 	$config['delete_time'] = 10;
-	// Reply limit (stops bumping thread when this is reached)
+	// Reply limit (stops bumping thread when this is reached).
 	$config['reply_limit'] = 250;
-	
-	// Image hard limit (stops allowing new image replies when this is reached if not zero)
+
+	// Image hard limit (stops allowing new image replies when this is reached if not zero).
 	$config['image_hard_limit'] = 0;
-	// Reply hard limit (stops allowing new replies when this is reached if not zero)
+	// Reply hard limit (stops allowing new replies when this is reached if not zero).
 	$config['reply_hard_limit'] = 0;
-	
-	// Strip repeating characters when making hashes
+
+
 	$config['robot_enable'] = false;
+	// Strip repeating characters when making hashes.
 	$config['robot_strip_repeating'] = true;
-	
-	// Enable mutes
-	// Tinyboard uses ROBOT9000's original 2^x implementation
+	// Enabled mutes? Tinyboard uses ROBOT9000's original 2^x implementation where x is the number of times
+	// you have been muted in the past.
 	$config['robot_mute'] = true;
-	// How many mutes x hours ago to include in the algorithm
+	// How long before Tinyboard forgets about a mute?
 	$config['robot_mute_hour'] = 336; // 2 weeks
-	// If you want to alter the algorithm a bit. Default value is 2. n^x
-	$config['robot_mute_multiplier'] = 2;
+	// If you want to alter the algorithm a bit. Default value is 2.
+	$config['robot_mute_multiplier'] = 2; // (n^x where x is the number of previous mutes)
 	$config['robot_mute_descritpion'] = _('You have been muted for unoriginal content.');
-	
-	// Automatically convert things like "..." to Unicode characters ("…")
+
+	// Automatically convert things like "..." to Unicode characters ("…").
 	$config['auto_unicode'] = true;
-	// Whether to turn URLs into functional links
+	// Whether to turn URLs into functional links.
 	$config['markup_urls'] = true;
-	// Optional URL prefix for links (eg. "http://anonym.to/?")
+	// Optional URL prefix for links (eg. "http://anonym.to/?").
 	$config['link_prefix'] = ''; 
-	
-	
-	// Wordfilters are used to automatically replace certain words/phrases with something else.
+
+
+	// A wordfilter (sometimes referred to as just a "filter" or "censor") automatically scans users’ posts
+	// as they are submitted and changes or censors particular words or phrases.
+
 	// For a normal string replacement:
-	// $config['wordfilters'][] = array('cat', 'dog');
-	
+	// $config['wordfilters'][] = array('cat', 'dog');	
 	// Advanced raplcement (regular expressions):
-	// $config['wordfilters'][] = array('/cat/', 'dog', true); // 'true' means it's a regular expression
-	
-	// Always act as if they had typed "noko" in the email field no mattter what
+	// $config['wordfilters'][] = array('/ca[rt]/', 'dog', true); // 'true' means it's a regular expression
+
+	// Always act as if the user had typed "noko" into the email field.
 	$config['always_noko'] = false;
-	
-	// Custom tripcodes. The below example makes a tripcode
-	//  of "#test123" evaluate to "!HelloWorld"
+
+	// Custom tripcodes. The below example makes a tripcode of "#test123" evaluate to "!HelloWorld".
 	// $config['custom_tripcode']['#test123'] = '!HelloWorld';
 	// $config['custom_tripcode']['##securetrip'] = '!!somethingelse';
-	
-	// Optional spoiler images
+
+	// Allow users to mark their image as a "spoiler" when posting. The thumbnail will be replaced with a
+	// static spoiler image instead (see $config['spoiler_image']).
 	$config['spoiler_images'] = false;
-	
-	
+
 	// With the following, you can disable certain superfluous fields or enable "forced anonymous".
-	
+
 	// When true, all names will be set to $config['anonymous'].
 	$config['field_disable_name'] = false;
-	// When true, no email will be able to be set.
+	// When true, there will be no email field.
 	$config['field_disable_email'] = false;
-	// When true, no subject will be able to be set.
+	// When true, there will be no subject field.
 	$config['field_disable_subject'] = false;
-	// When true, no subject will be able to be set in replies.
+	// When true, there will be no subject field for replies.
 	$config['field_disable_reply_subject'] = false;
 	// When true, a blank password will be used for files (not usable for deletion).
 	$config['field_disable_password'] = false;
-	
-	// Require users to see the ban page at least once for a ban even if it has since expired?
-	$config['require_ban_view'] = false;
-	
+
+	// Require users to see the ban page at least once for a ban even if it has since expired.
+	$config['require_ban_view'] = true;
+
+	/*
+	* Custom filters detect certain posts and reject/ban accordingly. They are made up of a 
+	* condition and an action (for when ALL conditions are met). As every single post has to
+	* be put through each filter, having hundreds probably isn’t ideal as it could slow things down.
+	*
+	* Read more: http://tinyboard.org/docs/index.php?p=Config/Filters
+	* 
+	* This used to be named $config['flood_filters'] (still exists as an alias).
+	*/
+
+	// An example of blocking an imaginary known spammer, who keeps posting a reply with the name "surgeon",
+	// ending his posts with "regards, the surgeon" or similar.
+	// $config['filters'][] = array(
+	// 	'condition' => array(
+	// 		'name' => '/^surgeon$/',
+	// 		'body' => '/regards,\s+(the )?surgeon$/i',
+	// 		'OP' => false
+	// 	),
+	// 	'action' => 'reject',
+	// 	'message' => 'Go away, spammer.'
+	// );
+
+	// Same as above, but issuing a 3-hour ban instead of just reject the post.
+	// $config['filters'][] = array(
+	// 	'condition' => array(
+	// 		'name' => '/^surgeon$/',
+	// 		'body' => '/regards,\s+(the )?surgeon$/i',
+	// 		'OP' => false
+	// 	),
+	// 	'action' => 'ban',
+	// 	'expires' => 60 * 60 * 3, // 3 hours
+	// 	'reason' => 'Go away, spammer.'
+	// );
+
+	// PHP 5.3+ (anonymous functions)
+	// There is also a "custom" condition, making the possibilities of this feature pretty much endless.
+	// This is a bad example, because there is already a "name" condition built-in.
+	// $config['filters'][] = array(
+	// 	'condition' => array(
+	// 		'body' => '/h$/i',
+	// 		'OP' => false,
+	// 		'custom' => function($post) {
+	// 			if($post['name'] == 'Anonymous')
+	// 				return true;
+	// 			else
+	// 				return false;
+	// 		}
+	// 	),
+	// 	'action' => 'reject'
+	// );
+
 /*
  * ====================
  *  Markup settings
@@ -386,122 +440,136 @@
 	$config['markup'][] = array("/'''([^<]+?)'''/", "<strong>\$1</strong>");
 	$config['markup'][] = array("/''([^<]+?)''/", "<em>\$1</em>");
 	$config['markup'][] = array("/\*\*([^<]+?)\*\*/", "<span class=\"spoiler\">\$1</span>");
-	$config['markup'][] = array("/^[ |\t]*==([^<]+?)==[ |\t]*$/m", "<span class=\"heading\">\$1</span>");
-	
-	// Highlight PHP code wrapped in <code> tags (PHP 5.3.0+)
+	// $config['markup'][] = array("/^[ |\t]*==([^<]+?)==[ |\t]*$/m", "<span class=\"heading\">\$1</span>");
+
+	// Highlight PHP code wrapped in <code> tags (PHP 5.3+)
 	// $config['markup'][] = array(
 	// 	'/^&lt;code&gt;(.+)&lt;\/code&gt;/ms',
 	// 	function($matches) {
 	// 		return highlight_string(html_entity_decode($matches[1]), true);
 	// 	}
 	// );
-	
+
 /*
  * ====================
  *  Image settings
  * ====================
  */
- 
-	// For resizing, max thumbnail size
+
+	// For resizing, maximum thumbnail dimensions.
 	$config['thumb_width'] = 255;
 	$config['thumb_height'] = 255;
-	// Max thumbnail size for thread images
+	// Maximum thumbnail dimensions for thread (OP) images.
 	$config['thumb_op_width'] = 255;
 	$config['thumb_op_height'] = 255;
-	
-	// Thumbnail extension, empty for inherited (png recommended)
+
+	// Thumbnail extension ("png" recommended). Leave this empty if you want the extension to be inherited
+	// from the uploaded file.
 	$config['thumb_ext'] = 'png';
-	
-	// Maximum amount of frames to resize (more frames means more processing power). "1" means no animated thumbnails.
-	// Requires $config['thumb_ext'] to be 'gif' and $config['thumb_method'] to be 'imagick', 'convert', or 'convert+gifsicle'.
-	// Not respected by 'convert'; will just resize all frames if this is > 1.
+
+	// Maximum amount of animated GIF frames to resize (more frames can mean more processing power). A value
+	// of "1" means thumbnails will not be animated. Requires $config['thumb_ext'] to be 'gif' (or blank) and
+	// $config['thumb_method'] to be 'imagick', 'convert', or 'convert+gifsicle'. This value is not respected
+	// by 'convert'; will just resize all frames if this is > 1.
 	$config['thumb_keep_animation_frames'] = 1;
-	
-	// Thumbnailing method:
-	// - 'gd'           PHP GD (default). Only handles the most basic image formats (GIF, JPEG, PNG).
-	//                  This is a prerequisite for Tinyboard no matter what method you choose.
-	// - 'imagick'      PHP's ImageMagick bindings. Fast and efficient, supporting many image formats. 
-	//                  A few minor bugs. http://pecl.php.net/package/imagick
-	// - 'convert'      The command line version of ImageMagick (`convert`). Fixes most of the bugs in
-	//                  PHP Imagick. `convert` produces the best still thumbnails and is highly recommended.
-	// - 'convert+gifsicle'  Same as above, with the exception of using `gifsicle` (command line application)
-	//                       instead of `convert` for resizing GIFs. It's faster and resulting animated thumbnails
-	//                       have less artifacts than if resized with ImageMagick.
+
+	/*
+	 * Thumbnailing method:
+	 *
+	 *   'gd'           PHP GD (default). Only handles the most basic image formats (GIF, JPEG, PNG).
+	 *                  GD is a prerequisite for Tinyboard no matter what method you choose.
+	 *
+	 *   'imagick'      PHP's ImageMagick bindings. Fast and efficient, supporting many image formats. 
+	 *                  A few minor bugs. http://pecl.php.net/package/imagick
+	 *
+	 *   'convert'      The command line version of ImageMagick (`convert`). Fixes most of the bugs in
+	 *                  PHP Imagick. `convert` produces the best still thumbnails and is highly recommended.
+	 *
+	 *   'convert+gifsicle'  Same as above, with the exception of using `gifsicle` (command line application)
+	 *                       instead of `convert` for resizing GIFs. It's faster and resulting animated
+	 *                       thumbnails have less artifacts than if resized with ImageMagick.
+	 */
 	$config['thumb_method'] = 'gd';
 	// $config['thumb_method'] = 'convert';
-	
-	// Strip EXIF metadata from JPEG files
+
+	// Command-line options passed to ImageMagick when using `convert` for thumbnailing.
+	// http://www.imagemagick.org/ImageMagick-7.0.0/script/command-line-options.php
+	$config['convert_args'] = '-background transparent -filter Point -sample %dx%d +antialias -quality 50';
+
+	// Strip EXIF metadata from JPEG files.
 	$config['strip_exif'] = false;
-	
-	// Regular expression to check for IE MIME type detection XSS exploit. To disable, comment the line out
-	// https://github.com/savetheinternet/Tinyboard/issues/20
+
+	// Regular expression to check for an XSS exploit with IE 6 and 7. To disable, set to false.
+	// Details: https://github.com/savetheinternet/Tinyboard/issues/20
 	$config['ie_mime_type_detection'] = '/<(?:body|head|html|img|plaintext|pre|script|table|title|a href|channel|scriptlet)/i';
-	
-	// Allowed image file extensions
+
+	// Allowed image file extensions.
 	$config['allowed_ext'][] = 'jpg';
 	$config['allowed_ext'][] = 'jpeg';
 	$config['allowed_ext'][] = 'bmp';
 	$config['allowed_ext'][] = 'gif';
 	$config['allowed_ext'][] = 'png';
 	// $config['allowed_ext'][] = 'svg';
-	
-	// Allowed additional file extensions (not images; downloadable files)
+
+	// Allowed additional file extensions (not images; downloadable files).
 	// $config['allowed_ext_files'][] = 'txt';
 	// $config['allowed_ext_files'][] = 'zip';
-	
-	// An alternative function for generating a filename, instead of the default UNIX timestamp.
-	// http://tinyboard.org/wiki/index.php?title=Filenames
-	// $config['filename_func'] = 'some_function_you_have_created';
-	
-	// Non-image file icons
+
+	// An alternative function for generating image filenames, instead of the default UNIX timestamp.
+	// $config['filename_func'] = function($post) {
+	//      return sprintf("%s", time() . substr(microtime(), 2, 3));
+	// };
+
+	// Thumbnail to use for the non-image file uploads.
 	$config['file_icons']['default'] = 'file.png';
 	$config['file_icons']['zip'] = 'zip.png';
-	
-	// Thumbnail to use for the downloadable files (not images)
+	// $config['file_icons']['extension'] = 'some_file.png';
+
+	// Location of above images.
 	$config['file_thumb'] = 'static/%s';
-	// Thumbnail to use for spoiler images
+	// Location of thumbnail to use for spoiler images.
 	$config['spoiler_image'] = 'static/spoiler.png';
-	
-	// Thumbnail quality (compression level), from 0 to 9
-	$config['thumb_quality'] = 8;
-	
-	// When a thumbnailed image is going to be the same (in dimension), just copy the entire file and use that as a thumbnail instead of resizing/redrawing
+	// Location of thumbnail to use for deleted images.
+	$config['image_deleted'] = $config['dir']['static'] . 'deleted.png';
+
+	// When a thumbnailed image is going to be the same (in dimension), just copy the entire file and use
+	// that as a thumbnail instead of resizing/redrawing.
 	$config['minimum_copy_resize'] = false;
-	
-	// Store image hash in the database for r9k-like boards implementation soon
-	// Function name for hashing
+
+	// Image hashing function. There's really no reason to change this.
 	// sha1_file, md5_file, etc. You can also define your own similar function.
 	$config['file_hash'] = 'sha1_file';
-	
-	// Maximum image upload size in bytes
-	$config['max_filesize'] = 10*1024*1024; // 10MB
-	// Maximum image dimensions
+
+	// Maximum image upload size in bytes.
+	$config['max_filesize'] = 10 * 1024 * 1024; // 10MB
+	// Maximum image dimensions.
 	$config['max_width'] = 10000;
-	$config['max_height'] = $config['max_width']; // 1:1
-	// Reject duplicate image uploads
+	$config['max_height'] = $config['max_width'];
+	// Reject duplicate image uploads.
 	$config['image_reject_repost'] = true;
-	// Reject duplicate image uploads within the same thread. Doesn't change anything if image_reject_repost is true.
+	// Reject duplicate image uploads within the same thread. Doesn't change anything if
+	// $config['image_reject_repost'] is true.
 	$config['image_reject_repost_in_thread'] = false;
-	
-	// Display the aspect ratio in a post's file info
+
+	// Display the aspect ratio of uploaded files.
 	$config['show_ratio'] = false;
-	// Display the file's original filename
+	// Display the file's original filename.
 	$config['show_filename']= true;
 
-	// Image identification links using regex.info/exif, TinEye and Google Images
+	// Display image identification links using regex.info/exif, TinEye and Google Images.
 	$config['image_identification'] = false;
-	
-	// Redraw the image using GD functions to strip any excess data (commonly ZIP archives)
-	// WARNING: Currently strips animated GIFs too
+
+	// Redraw the image to strip any excess data (commonly ZIP archives) WARNING: This might strip the
+	// animation of GIFs, depending on the chosen thumbnailing method.
 	$config['redraw_image'] = false;
-	
+
 /*
  * ====================
  *  Board settings
  * ====================
  */
 
-	// Maximum amount of threads to display on a given page.
+	// Maximum amount of threads to display per page.
 	$config['threads_per_page'] = 10;
 	// Maximum number of pages. Content past the last page is automatically purged.
 	$config['max_pages'] = 10;
@@ -510,106 +578,111 @@
 	// Same as above, but for stickied threads.
 	$config['threads_preview_sticky'] = 1;
 
-	// Name of the boards. Usually '/%s/' (/b/, /mu/, etc)
-	// $config['board_abbreviation'] - BOARD_TITLE
+	// How to display the URI of boards. Usually '/%s/' (/b/, /mu/, etc). This doesn't change the URL. Find
+	// $config['board_path'] if you wish to change the URL.
 	$config['board_abbreviation'] = '/%s/';
-	
-	// The default name (ie. Anonymous)
+
+	// The default name (ie. Anonymous).
 	$config['anonymous'] = 'Anonymous';
-	
-	// How many reports you can create in the same request.
+
+	// Number of reports you can create at once.
 	$config['report_limit'] = 3;
-	
+
 /*
  * ====================
  *  Display settings
  * ====================
  */
- 	
- 	// Locale (en, ru_RU.UTF-8, fi_FI.UTF-8, pl_PL.UTF-8)
- 	$config['locale'] = 'en';
- 	
- 	// Timezone
+
+	// Tinyboard has been translated into a few langauges. See inc/locale for available translations.
+	$config['locale'] = 'en'; // (en, ru_RU.UTF-8, fi_FI.UTF-8, pl_PL.UTF-8)
+
+	// Timezone to use for displaying dates/tiems.
 	$config['timezone'] = 'America/Los_Angeles';
-	
- 	// The format string passed to strftime() for post times
+	// The format string passed to strftime() for displaying dates.
 	// http://www.php.net/manual/en/function.strftime.php
 	$config['post_date'] = '%m/%d/%y (%a) %H:%M:%S';
-	
 	// Same as above, but used for "you are banned' pages.
 	$config['ban_date'] = '%A %e %B, %Y';
-	
-	// The names on the post buttons. (On most imageboards, these are both "Post")
+
+	// The names on the post buttons. (On most imageboards, these are both just "Post").
 	$config['button_newtopic'] = _('New Topic');
 	$config['button_reply'] = _('New Reply');
-	
-	// Assign each poster in a thread a unique ID, shown by "ID: {id}" before the post number.
+
+	// Assign each poster in a thread a unique ID, shown by "ID: xxxxx" before the post number.
 	$config['poster_ids'] = false;
-	// Number of characters in the poster ID (maximum is 40)
+	// Number of characters in the poster ID (maximum is 40).
 	$config['poster_id_length'] = 5;
-	
-	// Show thread subject in page title?
+
+	// Show thread subject in page title.
 	$config['thread_subject_in_title'] = false;
-	
-	// Page footer
+
+	// Additional lines added to the footer of all pages.
 	$config['footer'][] = _('All trademarks, copyrights, comments, and images on this page are owned by and are the responsibility of their respective parties.');
-	
-	// Characters used to generate a random password (with Javascript)
+
+	// Characters used to generate a random password (with Javascript).
 	$config['genpassword_chars'] = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()_+';
-	
-	// Optional banner at the top of every page.
+
+	// Optional banner image at the top of every page.
 	// $config['url_banner'] = '/banner.php';
-	// Banner dimensions are also optional. As the banner loads after the rest of the page, everything
-	// may be shifted down a few pixels when it does. Making the banner a fixed size will prevent this.
+	// Banner dimensions are also optional. As the banner loads after the rest of the page, everything may be
+	// shifted down a few pixels when it does. Making the banner a fixed size will prevent this.
 	// $config['banner_width'] = 300;
 	// $config['banner_height'] = 100;
-	
-	// Custom stylesheets available. The prefix for each stylesheet URI is defined below.
-	$config['stylesheets']['Yotsuba B'] = ''; // default
+
+	// Custom stylesheets available for the user to choose. See the "stylesheets/" folder for a list of
+	// available stylesheets (or create your own).
+	$config['stylesheets']['Yotsuba B'] = ''; // Default; there is no additional/custom stylesheet for this.
 	$config['stylesheets']['Yotsuba'] = 'yotsuba.css';
 	// $config['stylesheets']['Futaba'] = 'futaba.css';
-	
+	// $config['stylesheets']['Dark'] = 'dark.css';
+
 	// The prefix for each stylesheet URI. Defaults to $config['root']/stylesheets/
 	// $config['uri_stylesheets'] = 'http://static.example.org/stylesheets/';
-	
-	// The default stylesheet to use
+
+	// The default stylesheet to use.
 	$config['default_stylesheet'] = array('Yotsuba B', $config['stylesheets']['Yotsuba B']);
-	
-	// Make stylesheet selections board-specific
+
+	// Make stylesheet selections board-specific.
 	$config['stylesheets_board'] = false;
-	
+
 	// Use Font-Awesome for displaying lock and pin icons, instead of the images in static/.
 	// http://fortawesome.github.io/Font-Awesome/icon/pushpin/
 	// http://fortawesome.github.io/Font-Awesome/icon/lock/
 	$config['font_awesome'] = true;
 	$config['font_awesome_css'] = 'stylesheets/font-awesome/css/font-awesome.min.css';
-	
-	// Boardlinks
-	// You can group, order and place the boardlist at the top of every page, using the following template.	
-	//$config['boards'] = array(
-	//	array('a', 'b'),
-	//	array('c', 'd', 'e', 'f', 'g'),
-	//	array('h', 'i', 'j'),
-	//	array('k', array('l', 'm')),
-	//	array('status' => 'http://status.example.org/')
-	//);
-	
-	// Categories
-	// Required for the Categories theme.
-	//$config['categories'] = array(
-	//	'Group Name' => array('a', 'b', 'c'),
-	//	'Another Group' => array('d')
-	//);
-	
-	// Custom_categories
-	// Optional for the Categories theme. array of name => (title, url) groups for categories with non-board links.
-	//$config['custom_categories'] = array(
-	//	'Links' => array(
-	//		'Tinyboard' => 'http://tinyboard.org',
-	//		'Donate' => 'donate.html'
-	//	)
-	//);
-	
+
+	/*
+	 * For lack of a better name, “boardlinks” are those sets of navigational links that appear at the top
+	 * and bottom of board pages. They can be a list of links to boards and/or other pages such as status
+	 * blogs and social network profiles/pages.
+	 *
+	 * "Groups" in the boardlinks are marked with square brackets. Tinyboard allows for infinite recursion
+	 * with groups. Each array() in $config['boards'] represents a new square bracket group.
+	 */
+
+	// $config['boards'] = array(
+	// 	array('a', 'b'),
+	// 	array('c', 'd', 'e', 'f', 'g'),
+	// 	array('h', 'i', 'j'),
+	// 	array('k', array('l', 'm')),
+	// 	array('status' => 'http://status.example.org/')
+	// );
+
+	// Board categories. Only used in the "Categories" theme.
+	// $config['categories'] = array(
+	// 	'Group Name' => array('a', 'b', 'c'),
+	// 	'Another Group' => array('d')
+	// );
+	// Optional for the Categories theme. This is an array of name => (title, url) groups for categories
+	// with non-board links.
+	// $config['custom_categories'] = array(
+	// 	'Links' => array(
+	// 		'Tinyboard' => 'http://tinyboard.org',
+	// 		'Donate' => 'donate.html'
+	// 	)
+	// );
+
 	// Automatically remove unnecessary whitespace when compiling HTML files from templates.
 	$config['minify_html'] = true;
 
@@ -619,25 +692,31 @@
  * ====================
  */
 
-	// Additional Javascript files to include on board index and thread pages.
+	// Additional Javascript files to include on board index and thread pages. See js/ for available scripts.
 	$config['additional_javascript'][] = 'js/inline-expanding.js';
 	// $config['additional_javascript'][] = 'js/local-time.js';
-	
-	// Some scripts require jQuery. Check the comments in script files to see what's needed.
+
+	// Some scripts require jQuery. Check the comments in script files to see what's needed. When enabling
+	// jQuery, you should first empty the array so that "js/query.min.js" can be the first, and then re-add
+	// "js/inline-expanding.js" or else the inline-expanding script might not interact properly with other
+	// scripts.
+	// $config['additional_javascript'] = array();
 	// $config['additional_javascript'][] = 'js/jquery.min.js';
+	// $config['additional_javascript'][] = 'js/inline-expanding.js';
 	// $config['additional_javascript'][] = 'js/auto-reload.js';
-	 
-	// Where these script files are located on the web (defaults to $config['root']).
-	// $config['additional_javascript_url'] = '/js/';
-	
+	// $config['additional_javascript'][] = 'js/post-hover.js';
+	// $config['additional_javascript'][] = 'js/style-select.js';
+
+	// Where these script files are located on the web. Defaults to $config['root'].
+	// $config['additional_javascript_url'] = 'http://static.example.org/tinyboard-javascript-stuff/';
+
 	// Compile all additional scripts into one file ($config['file_script']) instead of including them seperately.
 	$config['additional_javascript_compile'] = false;
-	
-	// Minify Javascript using http://code.google.com/p/minify/
+
+	// Minify Javascript using http://code.google.com/p/minify/.
 	$config['minify_js'] = false;
 
-	// Allows js/quick-reply.js to work
-	// This will make your imageboard more vulnerable to flood attacks.
+	// Allows js/quick-reply.js to work. This could make your imageboard more vulnerable to flood attacks.
 	$config['quick_reply'] = false;
 
 /*
@@ -645,12 +724,12 @@
  *  Video embedding
  * ====================
  */
- 
-	// Enable embedding (see below)
+
+	// Enable embedding (see below).
 	$config['enable_embedding'] = false;
-	
+
 	// Custom embedding (YouTube, vimeo, etc.)
-	// It's very important that you match the full string (with ^ and $) or things will not work correctly.
+	// It's very important that you match the entire input (with ^ and $) or things will not work correctly.
 	$config['embedding'] = array(
 		array(
 			'/^https?:\/\/(\w+\.)?youtube\.com\/watch\?v=([a-zA-Z0-9\-_]{10,11})(&.+)?$/i',
@@ -677,39 +756,39 @@
 			'<object style="float: left;margin: 10px 20px;" width="148" height="44"><param name="movie" value="http://vocaroo.com/player.swf?playMediaID=$2&autoplay=0"></param><param name="wmode" value="transparent"></param><embed src="http://vocaroo.com/player.swf?playMediaID=$2&autoplay=0" width="148" height="44" wmode="transparent" type="application/x-shockwave-flash"></embed></object>'
 		)
 	);
-	
-	// Embedding width and height
+
+	// Embedding width and height.
 	$config['embed_width'] = 300;
 	$config['embed_height'] = 246;
-	
+
 /*
  * ====================
  *  Error messages
  * ====================
  */
- 
+
 	// Error messages
-	$config['error']['lurk']		= _('Lurk some more before posting.');
-	$config['error']['bot']			= _('You look like a bot.');
-	$config['error']['referer']		= _('Your browser sent an invalid or no HTTP referer.');
-	$config['error']['toolong']		= _('The %s field was too long.');
+	$config['error']['lurk']			= _('Lurk some more before posting.');
+	$config['error']['bot']				= _('You look like a bot.');
+	$config['error']['referer']			= _('Your browser sent an invalid or no HTTP referer.');
+	$config['error']['toolong']			= _('The %s field was too long.');
 	$config['error']['toolong_body']	= _('The body was too long.');
 	$config['error']['tooshort_body']	= _('The body was too short or empty.');
-	$config['error']['noimage']		= _('You must upload an image.');
-	$config['error']['nomove']		= _('The server failed to handle your upload.');
-	$config['error']['fileext']		= _('Unsupported image format.');
-	$config['error']['noboard']		= _('Invalid board!');
+	$config['error']['noimage']			= _('You must upload an image.');
+	$config['error']['nomove']			= _('The server failed to handle your upload.');
+	$config['error']['fileext']			= _('Unsupported image format.');
+	$config['error']['noboard']			= _('Invalid board!');
 	$config['error']['nonexistant']		= _('Thread specified does not exist.');
-	$config['error']['locked']		= _('Thread locked. You may not reply at this time.');
+	$config['error']['locked']			= _('Thread locked. You may not reply at this time.');
 	$config['error']['reply_hard_limit']	= _('Thread has reached its maximum reply limit.');
 	$config['error']['image_hard_limit']	= _('Thread has reached its maximum image limit.');
-	$config['error']['nopost']		= _('You didn\'t make a post.');
-	$config['error']['flood']		= _('Flood detected; Post discarded.');
-	$config['error']['spam']		= _('Your request looks automated; Post discarded.');
+	$config['error']['nopost']			= _('You didn\'t make a post.');
+	$config['error']['flood']			= _('Flood detected; Post discarded.');
+	$config['error']['spam']			= _('Your request looks automated; Post discarded.');
 	$config['error']['unoriginal']		= _('Unoriginal content!');
-	$config['error']['muted']		= _('Unoriginal content! You have been muted for %d seconds.');
+	$config['error']['muted']			= _('Unoriginal content! You have been muted for %d seconds.');
 	$config['error']['youaremuted']		= _('You are muted! Expires in %d seconds.');
-	$config['error']['dnsbl']		= _('Your IP address is listed in %s.');
+	$config['error']['dnsbl']			= _('Your IP address is listed in %s.');
 	$config['error']['toomanylinks']	= _('Too many links; flood detected.');
 	$config['error']['toomanycites']	= _('Too many cites; post discarded.');
 	$config['error']['toomanycross']	= _('Too many cross-board links; post discarded.');
@@ -720,19 +799,19 @@
 	$config['error']['invalidimg']		= _('Invalid image.');
 	$config['error']['unknownext']		= _('Unknown file extension.');
 	$config['error']['filesize']		= _('Maximum file size: %maxsz% bytes<br>Your file\'s size: %filesz% bytes');
-	$config['error']['maxsize']		= _('The file was too big.');
+	$config['error']['maxsize']			= _('The file was too big.');
 	$config['error']['invalidzip']		= _('Invalid archive!');
 	$config['error']['fileexists']		= _('That file <a href="%s">already exists</a>!');
 	$config['error']['fileexistsinthread']	= _('That file <a href="%s">already exists</a> in this thread!');
 	$config['error']['delete_too_soon']	= _('You\'ll have to wait another %s before deleting that.');
 	$config['error']['mime_exploit']	= _('MIME type detection XSS exploit (IE) detected; post discarded.');
 	$config['error']['invalid_embed']	= _('Couldn\'t make sense of the URL of the video you tried to embed.');
-	$config['error']['captcha']		= _('You seem to have mistyped the verification.');
-	
+	$config['error']['captcha']			= _('You seem to have mistyped the verification.');
+
 	// Moderator errors
 	$config['error']['toomanyunban']	= _('You are only allowed to unban %s users at a time. You tried to unban %u users.');
-	$config['error']['invalid']		= _('Invalid username and/or password.');
-	$config['error']['notamod']		= _('You are not a mod…');
+	$config['error']['invalid']			= _('Invalid username and/or password.');
+	$config['error']['notamod']			= _('You are not a mod…');
 	$config['error']['invalidafter']	= _('Invalid username and/or password. Your user may have been deleted or changed.');
 	$config['error']['malformed']		= _('Invalid/malformed cookies.');
 	$config['error']['missedafield']	= _('Your browser didn\'t submit an input when it should have.');
@@ -741,98 +820,96 @@
 	$config['error']['boardexists']		= _('There is already a %s board.');
 	$config['error']['noaccess']		= _('You don\'t have permission to do that.');
 	$config['error']['invalidpost']		= _('That post doesn\'t exist…');
-	$config['error']['404']			= _('Page not found.');
+	$config['error']['404']				= _('Page not found.');
 	$config['error']['modexists']		= _('That mod <a href="?/users/%d">already exists</a>!');
 	$config['error']['invalidtheme']	= _('That theme doesn\'t exist!');
-	$config['error']['csrf']		= _('Invalid security token! Please go back and try again.');
+	$config['error']['csrf']			= _('Invalid security token! Please go back and try again.');
 
 /*
  * =========================
  *  Directory/file settings
  * =========================
  */
-	
+
 	// The root directory, including the trailing slash, for Tinyboard.
-	// examples: '/', 'http://boards.chan.org/', '/chan/'
+	// Examples: '/', 'http://boards.chan.org/', '/chan/'.
 	if (isset($_SERVER['REQUEST_URI']))
-		$config['root']	 = (str_replace('\\', '/', dirname($_SERVER['REQUEST_URI'])) == '/' ? '/' : str_replace('\\', '/', dirname($_SERVER['REQUEST_URI'])) . '/');
+		$config['root']	 = str_replace('\\', '/', dirname($_SERVER['REQUEST_URI'])) == '/' ? '/' : str_replace('\\', '/', dirname($_SERVER['REQUEST_URI'])) . '/';
 	else
 		$config['root'] = '/'; // CLI mode
 
 	// The scheme and domain. This is used to get the site's absolute URL (eg. for image identification links).
 	// If you use the CLI tools, it would be wise to override this setting.
-	$config['domain'] = (isset ($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off') ? "https://" : "http://";
-	$config['domain'] .=  isset ($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : 'localhost';
-	
+	$config['domain'] = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off') ? 'https://' : 'http://';
+	$config['domain'] .= isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : 'localhost';
+
 	// If for some reason the folders and static HTML index files aren't in the current working direcotry,
 	// enter the directory path here. Otherwise, keep it false.
 	$config['root_file'] = false;
-	
+
+	// Location of files.
 	$config['file_index'] = 'index.html';
 	$config['file_page'] = '%d.html';
 	$config['file_mod'] = 'mod.php';
 	$config['file_post'] = 'post.php';
 	$config['file_script'] = 'main.js';
-	
-	// Board directory, followed by a forward-slash (/). (%s is board abbreviation)
+
+	// Board directory, followed by a forward-slash (/).
 	$config['board_path'] = '%s/';
-	
+	// Misc directories.
 	$config['dir']['img'] = 'src/';
 	$config['dir']['thumb'] = 'thumb/';
 	$config['dir']['res'] = 'res/';
-	// For load balancing, having a seperate server (and domain/subdomain) for serving static content is possible.
-	// This can either be a directory or a URL (eg. http://static.example.org/)
-	//$config['dir']['static'] = $config['root'] . 'static/';
-	// Where to store the .html templates. This folder and templates must exist or fatal errors will be thrown.
+
+	// For load balancing, having a seperate server (and domain/subdomain) for serving static content is
+	// possible. This can either be a directory or a URL. Defaults to $config['root'] . 'static/'.
+	// $config['dir']['static'] = 'http://static.example.org/';
+
+	// Where to store the .html templates. This folder and the template files must exist.
 	$config['dir']['template'] = getcwd() . '/templates';
-	// For the themes (homepages, etc.)
+	// Location of Tinyboard "themes".
 	$config['dir']['themes'] = getcwd() . '/templates/themes';
-	// Same as above, but a URI (accessable by web interface, not locally)
+	// Same as above, but a URI (accessable by web interface).
 	$config['dir']['themes_uri'] = 'templates/themes';
-	// Homepage directory
+	// Home directory. Used by themes.
 	$config['dir']['home'] = '';
-	
-	// Static images
-	// These can be URLs OR base64 (data URI scheme)
-	//$config['image_sticky']	= $config['dir']['static'] . 'sticky.gif';
-	//$config['image_locked']	= $config['dir']['static'] . 'locked.gif';
-	//$config['image_bumplocked']	= $config['dir']['static'] . 'sage.gif';
-	//$config['image_deleted']	= $config['dir']['static'] . 'deleted.';
-	//$config['image_zip']		= $config['dir']['static'] . 'zip.';
-	
-	// If you want to put images and other dynamic-static stuff on another (preferably cookieless) domain, you can use this:
-	// This will override $config['root'] and $config['dir']['...'] directives.
-	// "%s" will get replaced with $board['dir'], which usually includes a trailing slash. To avoid double slashes, you don't need
-	// to put a slash after %s
+
+	// Static images. These can be URLs OR base64 (data URI scheme). These are only used if
+	// $config['font_awesome'] is false (default).
+	// $config['image_sticky']	= $config['dir']['static'] . 'sticky.gif';
+	// $config['image_locked']	= $config['dir']['static'] . 'locked.gif';
+	// $config['image_bumplocked']	= $config['dir']['static'] . 'sage.gif'.
+
+	// If you want to put images and other dynamic-static stuff on another (preferably cookieless) domain.
+	// This will override $config['root'] and $config['dir']['...'] directives. "%s" will get replaced with
+	// $board['dir'], which includes a trailing slash.
 	// $config['uri_thumb'] = 'http://images.example.org/%sthumb/';
 	// $config['uri_img'] = 'http://images.example.org/%ssrc/';
-	
-	// Set custom locations for stylesheets, scripts and maybe a banner.
-	// This can be good for load balancing across multiple servers or hostnames.
+
+	// Set custom locations for stylesheets and the main script file. This can be used for load balancing
+	// across multiple servers or hostnames.
 	// $config['url_stylesheet'] = 'http://static.example.org/style.css'; // main/base stylesheet
 	// $config['url_javascript'] = 'http://static.example.org/main.js';
+
+	// Website favicon.
 	// $config['url_favicon'] = '/favicon.gif';
-	
+
 /*
  * ====================
  *  Mod settings
  * ====================
  */
- 
- 	// Limit how many bans can be removed via the ban list. (Set too -1 to remove limit.)
-	$config['mod']['unban_limit'] = 5;
-	
-	// Whether or not to lock moderator sessions to the IP address that was logged in with.
+
+	// Limit how many bans can be removed via the ban list. Set to -1 for no limit.
+	$config['mod']['unban_limit'] = -1;
+
+	// Whether or not to lock moderator sessions to IP addresses. This makes cookie theft ineffective.
 	$config['mod']['lock_ip'] = true;
-	
-	// The page that is first shown when a moderator logs in. Defaults to the dashboard.
+
+	// The page that is first shown when a moderator logs in. Defaults to the dashboard (?/).
 	$config['mod']['default'] = '/';
-	
-	// Don't even display MySQL password to administrators (in the configuration page).
-	$config['mod']['never_reveal_password'] = true;
-	
- 	// Mod links (full HTML)
-	// Correspond to above permission directives
+
+	// Mod links (full HTML).
 	$config['mod']['link_delete'] = '[D]';
 	$config['mod']['link_ban'] = '[B]';
 	$config['mod']['link_bandelete'] = '[B&amp;D]';
@@ -847,92 +924,94 @@
 	$config['mod']['link_bumpunlock'] = '[-Sage]';
 	$config['mod']['link_editpost'] = '[Edit]';
 	$config['mod']['link_move'] = '[Move]';
-	
-	// Moderator capcodes
+
+	// Moderator capcodes.
 	$config['capcode'] = ' <span class="capcode">## %s</span>';
-	
-	// Custom capcodes, by example:
-	// "## Custom" becomes lightgreen, italic and bold
+
+	// "## Custom" becomes lightgreen, italic and bold:
 	//$config['custom_capcode']['Custom'] ='<span class="capcode" style="color:lightgreen;font-style:italic;font-weight:bold"> ## %s</span>';
-	
-	// "## Mod" makes everything purple, including the name and tripcode
+
+	// "## Mod" makes everything purple, including the name and tripcode:
 	//$config['custom_capcode']['Mod'] = array(
 	//	'<span class="capcode" style="color:purple"> ## %s</span>',
 	//	'color:purple', // Change name style; optional
 	//	'color:purple' // Change tripcode style; optional
 	//);
-	
-	// "## Admin" makes everything red and bold, including the name and tripcode
+
+	// "## Admin" makes everything red and bold, including the name and tripcode:
 	//$config['custom_capcode']['Admin'] = array(
 	//	'<span class="capcode" style="color:red;font-weight:bold"> ## %s</span>',
 	//	'color:red;font-weight:bold', // Change name style; optional
 	//	'color:red;font-weight:bold' // Change tripcode style; optional
 	//);
-	
-	// Enable IP range bans (eg. "127.*.0.1", "127.0.0.*", and "12*.0.0.1" all match "127.0.0.1").
-	// A little more load on the database
+
+	// Enable IP range bans (eg. "127.*.0.1", "127.0.0.*", and "12*.0.0.1" all match "127.0.0.1"). Puts a
+	// little more load on the database
 	$config['ban_range'] = true;
-	
-	// Enable CDIR netmask bans (eg. "10.0.0.0/8" for 10.0.0.0.0 - 10.255.255.255). Useful for stopping persistent spammers.
-	// Again, a little more database load.
+
+	// Enable CDIR netmask bans (eg. "10.0.0.0/8" for 10.0.0.0.0 - 10.255.255.255). Useful for stopping
+	// persistent spammers and ban evaders. Again, a little more database load.
 	$config['ban_cidr'] = true;
-	
-	// Do a DNS lookup on IP addresses to get their hostname on the IP summary page
+
+	// Do DNS lookups on IP addresses to get their hostname for the moderator IP pages (?/IP/x.x.x.x).
 	$config['mod']['dns_lookup'] = true;
-	// How many recent posts, per board, to show in the IP summary page
+	// How many recent posts, per board, to show in ?/IP/x.x.x.x.
 	$config['mod']['ip_recentposts'] = 5;
-	
-	// How many posts to display on the reports page
+
+	// Number of posts to display on the reports page.
 	$config['mod']['recent_reports'] = 10;
-	
-	// How many actions to show per page in the moderation log
+	// Number of actions to show per page in the moderation log.
 	$config['mod']['modlog_page'] = 350;
-	// How many bans to show per page in the ban list
+	// Number of bans to show per page in the ban list.
 	$config['mod']['banlist_page'] = 350;
-	
-	// Number of news entries to display per page
+	// Number of news entries to display per page.
 	$config['mod']['news_page'] = 40;
-	
-	// Number of results to display per page
+	// Number of results to display per page.
 	$config['mod']['search_page'] = 200;
-	
-	// How many entries to show per page in the moderator noticeboard
+	// Number of entries to show per page in the moderator noticeboard.
 	$config['mod']['noticeboard_page'] = 50;
-	// Number of entries to summarize and display on the dashboard
+	// Number of entries to summarize and display on the dashboard.
 	$config['mod']['noticeboard_dashboard'] = 5;
-	
-	// Check public ban message by default
+
+	// Check public ban message by default.
 	$config['mod']['check_ban_message'] = false;
-	// Default public ban message.
-	// In public ban messages, %length% is replaced with "for x days" or "permanently" (with %LENGTH% being the uppercase equivalent).
+	// Default public ban message. In public ban messages, %length% is replaced with "for x days" or
+	// "permanently" (with %LENGTH% being the uppercase equivalent).
 	$config['mod']['default_ban_message'] = _('USER WAS BANNED FOR THIS POST');
-	// $config['mod']['default_ban_message'] = 'USER WAS BANNED %LENGTH% FOR THIS POST'; // Include length in ban message
-	// What to append to the post for public bans ("%s" is the message)
+	// $config['mod']['default_ban_message'] = 'USER WAS BANNED %LENGTH% FOR THIS POST';
+	// HTML to append to post bodies for public bans messages (where "%s" is the message).
 	$config['mod']['ban_message'] = '<span class="public_ban">(%s)</span>';
-	
-	// When moving a thread to another board and choosing to keep a "shadow thread", an automated post (with a capcode) will
-	// be made, linking to the new location for the thread. "%s" will be replaced with a standard cross-board post citation (>>>/board/xxx)
+
+	// When moving a thread to another board and choosing to keep a "shadow thread", an automated post (with
+	// a capcode) will be made, linking to the new location for the thread. "%s" will be replaced with a
+	// standard cross-board post citation (>>>/board/xxx)
 	$config['mod']['shadow_mesage'] = 'Moved to %s.';
 	// Capcode to use when posting the above message.
 	$config['mod']['shadow_capcode'] = 'Mod';
-	// Name to use when posting the above message. If false, the default board name will be used. If something else, that will be used.
+	// Name to use when posting the above message. If false, $config['anonymous'] will be used.
 	$config['mod']['shadow_name'] = false;
-	
-	// Wait indefinitely when rebuilding everything
+
+	// PHP time limit for ?/rebuild. A value of 0 should cause PHP to wait indefinitely.
 	$config['mod']['rebuild_timelimit'] = 0;
-	
-	// PM snippet (for ?/inbox) length in characters
+
+	// PM snippet (for ?/inbox) length in characters.
 	$config['mod']['snippet_length'] = 75;
-	
-	// Edit raw HTML in posts by default
+
+	// Edit raw HTML in posts by default.
 	$config['mod']['raw_html_default'] = false;
-	
-	// Automatically dismiss all reports regarding a thread when it is locked
+
+	// Automatically dismiss all reports regarding a thread when it is locked.
 	$config['mod']['dismiss_reports_on_lock'] = true;
-	
-	// Replace ?/config with a simple text editor for editing inc/instance-config.php
+
+	// Replace ?/config with a simple text editor for editing inc/instance-config.php.
 	$config['mod']['config_editor_php'] = false;
-	
+
+/*
+ * ====================
+ *  Mod permissions
+ * ====================
+ */
+
 	// Probably best not to change these:
 	if (!defined('JANITOR')) {
 		define('JANITOR',	0,	true);
@@ -940,31 +1019,24 @@
 		define('ADMIN',		2,	true);
 		define('DISABLED',	3,	true);
 	}
-	
-/*
- * ====================
- *  Mod permissions
- * ====================
- */
- 
- 	// Capcode permissions
+
+	// Capcode permissions.
 	$config['mod']['capcode'] = array(
 	//	JANITOR		=> array('Janitor'),
-		MOD		=> array('Mod'),
+		MOD			=> array('Mod'),
 		ADMIN		=> true
 	);
-	
+
 	// Example: Allow mods to post with "## Moderator" as well
 	// $config['mod']['capcode'][MOD][] = 'Moderator';
-	
 	// Example: Allow janitors to post with any capcode
 	// $config['mod']['capcode'][JANITOR] = true;
- 
- 	// Set any of the below to "DISABLED" to make them unavailable for everyone.
- 
+
+	// Set any of the below to "DISABLED" to make them unavailable for everyone.
+
 	// Don't worry about per-board moderators. Let all mods moderate any board.
 	$config['mod']['skip_per_board'] = false;
-	
+
 	/* Post Controls */
 	// View IP addresses
 	$config['mod']['show_ip'] = MOD;
@@ -1004,7 +1076,7 @@
 	$config['mod']['flood'] = ADMIN;
 	// Raw HTML posting
 	$config['mod']['rawhtml'] = ADMIN;
-	
+
 	/* Administration */
 	// View the report queue
 	$config['mod']['reports'] = JANITOR;
@@ -1016,8 +1088,8 @@
 	$config['mod']['view_banlist'] = MOD;
 	// View the username of the mod who made a ban
 	$config['mod']['view_banstaff'] = MOD;
-	// If the moderator doesn't fit the $config['mod']['view_banstaff''] (previous) permission,
-	// show him just a "?" instead. Otherwise, it will be "Mod" or "Admin"
+	// If the moderator doesn't fit the $config['mod']['view_banstaff''] (previous) permission, show him just
+	// a "?" instead. Otherwise, it will be "Mod" or "Admin".
 	$config['mod']['view_banquestionmark'] = false;
 	// Show expired bans in the ban list (they are kept in cache until the culprit returns)
 	$config['mod']['view_banexpired'] = true;
@@ -1051,8 +1123,8 @@
 	$config['mod']['modlog'] = ADMIN;
 	// View IP addresses of other mods in ?/log
 	$config['mod']['show_ip_modlog'] = ADMIN;
-	// View relevant moderation log entries on IP address pages (ie. ban history, etc.)
-	// Warning: Can be pretty resource exhaustive if your mod logs are huge.
+	// View relevant moderation log entries on IP address pages (ie. ban history, etc.) Warning: Can be
+	// pretty resource intensive if your mod logs are huge.
 	$config['mod']['modlog_ip'] = MOD;
 	// Create a PM (viewing mod usernames)
 	$config['mod']['create_pm'] = JANITOR;
@@ -1062,7 +1134,8 @@
 	$config['mod']['rebuild'] = ADMIN;
 	// Search through posts, IP address notes and bans
 	$config['mod']['search'] = JANITOR;
-	// Allow searching posts (can be used with board configuration file to disallow searching through a certain board)
+	// Allow searching posts (can be used with board configuration file to disallow searching through a
+	// certain board)
 	$config['mod']['search_posts'] = JANITOR;
 	// Read the moderator noticeboard
 	$config['mod']['noticeboard'] = JANITOR;
@@ -1080,13 +1153,13 @@
 	$config['mod']['news_custom'] = ADMIN;
 	// Delete news entries
 	$config['mod']['news_delete'] = ADMIN;
-	
+
 	// Edit the current configuration (via web interface)
 	$config['mod']['edit_config'] = ADMIN;
-	
+
 	// Execute un-filtered SQL queries on the database (?/debug/sql)
 	$config['mod']['debug_sql'] = DISABLED;
-	
+
 /*
  * ====================
  *  Events (PHP 5.3.0+)
@@ -1098,7 +1171,7 @@
 	// event_handler('post', function($post) {
 	// 	// do something
 	// });
-	
+
 	// event_handler('post', function($post) {
 	// 	// do something else
 	// 	
@@ -1111,51 +1184,50 @@
  *  Other/uncategorized
  * ====================
  */
- 	
- 	// Meta keywords. It's probably best to include these in per-board configurations.
-	//$config['meta_keywords'] = 'chan,anonymous discussion,imageboard,tinyboard';
-	
-	// Link imageboard to your Google Analytics account to track users and provide marketing insights.
+
+	// Meta keywords. It's probably best to include these in per-board configurations.
+	// $config['meta_keywords'] = 'chan,anonymous discussion,imageboard,tinyboard';
+
+	// Link imageboard to your Google Analytics account to track users and provide traffic insights.
 	// $config['google_analytics'] = 'UA-xxxxxxx-yy';
 	// Keep the Google Analytics cookies to one domain -- ga._setDomainName()
 	// $config['google_analytics_domain'] = 'www.example.org';
-	
- 	// If you use Varnish, Squid, or any similar caching reverse-proxy in front of Tinyboard,
-	// you can configure Tinyboard to PURGE files when they're written to
-	//$config['purge'] = array(
-	//	array('127.0.0.1', 80)
-	//	array('127.0.0.1', 80, 'example.org')
-	//);
-	// Connection timeout, in seconds
+
+	// If you use Varnish, Squid, or any similar caching reverse-proxy in front of Tinyboard, you can
+	// configure Tinyboard to PURGE files when they're written to.
+	// $config['purge'] = array(
+	// 	array('127.0.0.1', 80)
+	// 	array('127.0.0.1', 80, 'example.org')
+	// );
+	// Connection timeout, in seconds.
 	$config['purge_timeout'] = 3;
-	
-	// Additional mod.php?/ pages (for developers). Look in inc/mod/pages.php for help.
-	//$config['mod']['custom_pages']['/something/(\d+)'] = function($id) {
-	//	global $config;
-	//	if (!hasPermission($config['mod']['something']))
-	//		error($config['error']['noaccess']);
-	//	// ...
-	//};
-	
-	// Add links to dashboard (will all be in "Other" category)
-	$config['mod']['dashboard_links'] = array();
+
+	// Additional mod.php?/ pages. Look in inc/mod/pages.php for help.
+	// $config['mod']['custom_pages']['/something/(\d+)'] = function($id) {
+	// 	global $config;
+	// 	if (!hasPermission($config['mod']['something']))
+	// 		error($config['error']['noaccess']);
+	// 	// ...
+	// };
+
+	// Add links to dashboard (will all be in a new "Other" category).
 	// $config['mod']['dashboard_links']['Something'] = '?/something';
-	
-	// Remote servers
-	// http://tinyboard.org/wiki/index.php?title=Multiple_Servers
-	//$config['remote']['static'] = array(
-	//	'host' => 'static.example.org',
-	//	'auth' => array(
-	//		'method' => 'plain',
-	//		'username' => 'username',
-	//		'password' => 'password!123'
-	//	),
-	//	'type' => 'scp'
-	//);
-	
-	// Regex for board URIs
+
+	// Remote servers. I'm not even sure if this code works anymore. It might. Haven't tried it in a while.
+	// $config['remote']['static'] = array(
+	// 	'host' => 'static.example.org',
+	// 	'auth' => array(
+	// 		'method' => 'plain',
+	// 		'username' => 'username',
+	// 		'password' => 'password!123'
+	// 	),
+	// 	'type' => 'scp'
+	// );
+
+	// Regex for board URIs. Don't add "`" character or any Unicode that MySQL can't handle. 58 characters
+	// is the absolute maximum, because MySQL cannot handle table names greater than 64 characters.
 	$config['board_regex'] = '[0-9a-zA-Z$_\x{0080}-\x{FFFF}]{1,58}';
-	
-	// Complex regular expression to catch URLs
+
+	// Complex regular expression to catch URLs.
 	$config['url_regex'] = '/' . '(https?|ftp):\/\/' . '(([\w\-]+\.)+[a-zA-Z]{2,6}|\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})' . '(:\d+)?' . '(\/([\w\-~.#\/?=&;:+%!*\[\]@$\'()+,|\^]+)?)?' . '/';
 
diff --git a/inc/display.php b/inc/display.php
index 5da2f302..7c2665e1 100644
--- a/inc/display.php
+++ b/inc/display.php
@@ -319,31 +319,31 @@ class Post {
 			
 			// Delete
 			if (hasPermission($config['mod']['delete'], $board['uri'], $this->mod))
-				$built .= ' ' . secure_link_confirm($config['mod']['link_delete'], 'Delete', 'Are you sure you want to delete this?', $board['uri'] . '/delete/' . $this->id);
+				$built .= ' ' . secure_link_confirm($config['mod']['link_delete'], 'Delete', 'Are you sure you want to delete this?', $board['dir'] . 'delete/' . $this->id);
 			
 			// Delete all posts by IP
 			if (hasPermission($config['mod']['deletebyip'], $board['uri'], $this->mod))
-				$built .= ' ' . secure_link_confirm($config['mod']['link_deletebyip'], 'Delete all posts by IP', 'Are you sure you want to delete all posts by this IP address?', $board['uri'] . '/deletebyip/' . $this->id);
+				$built .= ' ' . secure_link_confirm($config['mod']['link_deletebyip'], 'Delete all posts by IP', 'Are you sure you want to delete all posts by this IP address?', $board['dir'] . 'deletebyip/' . $this->id);
 			
 			// Delete all posts by IP (global)
 			if (hasPermission($config['mod']['deletebyip_global'], $board['uri'], $this->mod))
-				$built .= ' ' . secure_link_confirm($config['mod']['link_deletebyip_global'], 'Delete all posts by IP across all boards', 'Are you sure you want to delete all posts by this IP address, across all boards?', $board['uri'] . '/deletebyip/' . $this->id . '/global');
+				$built .= ' ' . secure_link_confirm($config['mod']['link_deletebyip_global'], 'Delete all posts by IP across all boards', 'Are you sure you want to delete all posts by this IP address, across all boards?', $board['dir'] . 'deletebyip/' . $this->id . '/global');
 			
 			// Ban
 			if (hasPermission($config['mod']['ban'], $board['uri'], $this->mod))
-				$built .= ' <a title="'._('Ban').'" href="?/' . $board['uri'] . '/ban/' . $this->id . '">' . $config['mod']['link_ban'] . '</a>';
+				$built .= ' <a title="'._('Ban').'" href="?/' . $board['dir'] . 'ban/' . $this->id . '">' . $config['mod']['link_ban'] . '</a>';
 			
 			// Ban & Delete
 			if (hasPermission($config['mod']['bandelete'], $board['uri'], $this->mod))
-				$built .= ' <a title="'._('Ban & Delete').'" href="?/' . $board['uri'] . '/ban&amp;delete/' . $this->id . '">' . $config['mod']['link_bandelete'] . '</a>';
+				$built .= ' <a title="'._('Ban & Delete').'" href="?/' . $board['dir'] . 'ban&amp;delete/' . $this->id . '">' . $config['mod']['link_bandelete'] . '</a>';
 			
 			// Delete file (keep post)
 			if (!empty($this->file) && hasPermission($config['mod']['deletefile'], $board['uri'], $this->mod))
-				$built .= ' ' . secure_link_confirm($config['mod']['link_deletefile'], _('Delete file'), _('Are you sure you want to delete this file?'), $board['uri'] . '/deletefile/' . $this->id);
+				$built .= ' ' . secure_link_confirm($config['mod']['link_deletefile'], _('Delete file'), _('Are you sure you want to delete this file?'), $board['dir'] . 'deletefile/' . $this->id);
 			
 			// Edit post
 			if (hasPermission($config['mod']['editpost'], $board['uri'], $this->mod))
-				$built .= ' <a title="'._('Edit post').'" href="?/' . $board['uri'] . '/edit' . ($config['mod']['raw_html_default'] ? '_raw' : '') . '/' . $this->id . '">' . $config['mod']['link_editpost'] . '</a>';
+				$built .= ' <a title="'._('Edit post').'" href="?/' . $board['dir'] . 'edit' . ($config['mod']['raw_html_default'] ? '_raw' : '') . '/' . $this->id . '">' . $config['mod']['link_editpost'] . '</a>';
 			
 			if (!empty($built))
 				$built = '<span class="controls">' . $built . '</span>';
@@ -420,54 +420,54 @@ class Thread {
 			// Mod controls (on posts)
 			// Delete
 			if (hasPermission($config['mod']['delete'], $board['uri'], $this->mod))
-				$built .= ' ' . secure_link_confirm($config['mod']['link_delete'], _('Delete'), _('Are you sure you want to delete this?'), $board['uri'] . '/delete/' . $this->id);
+				$built .= ' ' . secure_link_confirm($config['mod']['link_delete'], _('Delete'), _('Are you sure you want to delete this?'), $board['dir'] . 'delete/' . $this->id);
 			
 			// Delete all posts by IP
 			if (hasPermission($config['mod']['deletebyip'], $board['uri'], $this->mod))
-				$built .= ' ' . secure_link_confirm($config['mod']['link_deletebyip'], _('Delete all posts by IP'), _('Are you sure you want to delete all posts by this IP address?'), $board['uri'] . '/deletebyip/' . $this->id);
+				$built .= ' ' . secure_link_confirm($config['mod']['link_deletebyip'], _('Delete all posts by IP'), _('Are you sure you want to delete all posts by this IP address?'), $board['dir'] . 'deletebyip/' . $this->id);
 			
 			// Delete all posts by IP (global)
 			if (hasPermission($config['mod']['deletebyip_global'], $board['uri'], $this->mod))
-				$built .= ' ' . secure_link_confirm($config['mod']['link_deletebyip_global'], _('Delete all posts by IP across all boards'), _('Are you sure you want to delete all posts by this IP address, across all boards?'), $board['uri'] . '/deletebyip/' . $this->id . '/global');
+				$built .= ' ' . secure_link_confirm($config['mod']['link_deletebyip_global'], _('Delete all posts by IP across all boards'), _('Are you sure you want to delete all posts by this IP address, across all boards?'), $board['dir'] . 'deletebyip/' . $this->id . '/global');
 			
 			// Ban
 			if (hasPermission($config['mod']['ban'], $board['uri'], $this->mod))
-				$built .= ' <a title="'._('Ban').'" href="?/' . $board['uri'] . '/ban/' . $this->id . '">' . $config['mod']['link_ban'] . '</a>';
+				$built .= ' <a title="'._('Ban').'" href="?/' . $board['dir'] . 'ban/' . $this->id . '">' . $config['mod']['link_ban'] . '</a>';
 			
 			// Ban & Delete
 			if (hasPermission($config['mod']['bandelete'], $board['uri'], $this->mod))
-				$built .= ' <a title="'._('Ban & Delete').'" href="?/' . $board['uri'] . '/ban&amp;delete/' . $this->id . '">' . $config['mod']['link_bandelete'] . '</a>';
+				$built .= ' <a title="'._('Ban & Delete').'" href="?/' . $board['dir'] . 'ban&amp;delete/' . $this->id . '">' . $config['mod']['link_bandelete'] . '</a>';
 			
 			// Delete file (keep post)
 			if (!empty($this->file) && $this->file != 'deleted' && hasPermission($config['mod']['deletefile'], $board['uri'], $this->mod))
-				$built .= ' ' . secure_link_confirm($config['mod']['link_deletefile'], _('Delete file'), _('Are you sure you want to delete this file?'), $board['uri'] . '/deletefile/' . $this->id);
+				$built .= ' ' . secure_link_confirm($config['mod']['link_deletefile'], _('Delete file'), _('Are you sure you want to delete this file?'), $board['dir'] . 'deletefile/' . $this->id);
 			
 			// Sticky
 			if (hasPermission($config['mod']['sticky'], $board['uri'], $this->mod))
 				if ($this->sticky)
-					$built .= ' <a title="'._('Make thread not sticky').'" href="?/' . secure_link($board['uri'] . '/unsticky/' . $this->id) . '">' . $config['mod']['link_desticky'] . '</a>';
+					$built .= ' <a title="'._('Make thread not sticky').'" href="?/' . secure_link($board['dir'] . 'unsticky/' . $this->id) . '">' . $config['mod']['link_desticky'] . '</a>';
 				else
-					$built .= ' <a title="'._('Make thread sticky').'" href="?/' . secure_link($board['uri'] . '/sticky/' . $this->id) . '">' . $config['mod']['link_sticky'] . '</a>';
+					$built .= ' <a title="'._('Make thread sticky').'" href="?/' . secure_link($board['dir'] . 'sticky/' . $this->id) . '">' . $config['mod']['link_sticky'] . '</a>';
 			
 			if (hasPermission($config['mod']['bumplock'], $board['uri'], $this->mod))
 				if ($this->bumplocked)
-					$built .= ' <a title="'._('Allow thread to be bumped').'" href="?/' . secure_link($board['uri'] . '/bumpunlock/' . $this->id) . '">' . $config['mod']['link_bumpunlock'] . '</a>';
+					$built .= ' <a title="'._('Allow thread to be bumped').'" href="?/' . secure_link($board['dir'] . 'bumpunlock/' . $this->id) . '">' . $config['mod']['link_bumpunlock'] . '</a>';
 				else
-					$built .= ' <a title="'._('Prevent thread from being bumped').'" href="?/' . secure_link($board['uri'] . '/bumplock/' . $this->id) . '">' . $config['mod']['link_bumplock'] . '</a>';
+					$built .= ' <a title="'._('Prevent thread from being bumped').'" href="?/' . secure_link($board['dir'] . 'bumplock/' . $this->id) . '">' . $config['mod']['link_bumplock'] . '</a>';
 			
 			// Lock
 			if (hasPermission($config['mod']['lock'], $board['uri'], $this->mod))
 				if ($this->locked)
-					$built .= ' <a title="'._('Unlock thread').'" href="?/' . secure_link($board['uri'] . '/unlock/' . $this->id) . '">' . $config['mod']['link_unlock'] . '</a>';
+					$built .= ' <a title="'._('Unlock thread').'" href="?/' . secure_link($board['dir'] . 'unlock/' . $this->id) . '">' . $config['mod']['link_unlock'] . '</a>';
 				else
-					$built .= ' <a title="'._('Lock thread').'" href="?/' . secure_link($board['uri'] . '/lock/' . $this->id) . '">' . $config['mod']['link_lock'] . '</a>';
+					$built .= ' <a title="'._('Lock thread').'" href="?/' . secure_link($board['dir'] . 'lock/' . $this->id) . '">' . $config['mod']['link_lock'] . '</a>';
 			
 			if (hasPermission($config['mod']['move'], $board['uri'], $this->mod))
-				$built .= ' <a title="'._('Move thread to another board').'" href="?/' . $board['uri'] . '/move/' . $this->id . '">' . $config['mod']['link_move'] . '</a>';
+				$built .= ' <a title="'._('Move thread to another board').'" href="?/' . $board['dir'] . 'move/' . $this->id . '">' . $config['mod']['link_move'] . '</a>';
 			
 			// Edit post
 			if (hasPermission($config['mod']['editpost'], $board['uri'], $this->mod))
-				$built .= ' <a title="'._('Edit post').'" href="?/' . $board['uri'] . '/edit' . ($config['mod']['raw_html_default'] ? '_raw' : '') . '/' . $this->id . '">' . $config['mod']['link_editpost'] . '</a>';
+				$built .= ' <a title="'._('Edit post').'" href="?/' . $board['dir'] . 'edit' . ($config['mod']['raw_html_default'] ? '_raw' : '') . '/' . $this->id . '">' . $config['mod']['link_editpost'] . '</a>';
 			
 			if (!empty($built))
 				$built = '<span class="controls op">' . $built . '</span>';
diff --git a/inc/filters.php b/inc/filters.php
index 9f03154d..cd512821 100644
--- a/inc/filters.php
+++ b/inc/filters.php
@@ -132,10 +132,10 @@ class Filter {
 function do_filters(array $post) {
 	global $config;
 	
-	if (!isset($config['flood_filters']))
+	if (!isset($config['filters']))
 		return;
 	
-	foreach ($config['flood_filters'] as $arr) {
+	foreach ($config['filters'] as $arr) {
 		$filter = new Filter($arr);
 		if ($filter->check($post))
 			$filter->action();
diff --git a/inc/functions.php b/inc/functions.php
index e871fee0..f000dc3c 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -40,7 +40,7 @@ function loadConfig() {
 		'dir',
 		'mod',
 		'spam',
-		'flood_filters',
+		'filters',
 		'wordfilters',
 		'custom_capcode',
 		'custom_tripcode',
@@ -54,7 +54,8 @@ function loadConfig() {
 		'stylesheets',
 		'additional_javascript',
 		'markup',
-		'custom_pages'
+		'custom_pages',
+		'dashboard_links'
 	);
 	
 	$config = array();
@@ -85,8 +86,8 @@ function loadConfig() {
 	
 	date_default_timezone_set($config['timezone']);
 	
-	if (!isset($config['blotter']))
-		$config['blotter'] = false;
+	if (!isset($config['global_message']))
+		$config['global_message'] = false;
 	
 	if (!isset($config['post_url']))
 		$config['post_url'] = $config['root'] . $config['file_post'];
@@ -128,8 +129,6 @@ function loadConfig() {
 		$config['image_bumplocked'] = $config['dir']['static'] . 'sage.gif';
 	if (!isset($config['image_deleted']))
 		$config['image_deleted'] = $config['dir']['static'] . 'deleted.png';
-	if (!isset($config['image_zip']))
-		$config['image_zip'] = $config['dir']['static'] . 'zip.png';
 	
 	if (!isset($config['uri_thumb']))
 		$config['uri_thumb'] = $config['root'] . $board['dir'] . $config['dir']['thumb'];
@@ -1704,7 +1703,7 @@ function buildThread($id, $return = false, $mod = false) {
 		'mod' => $mod,
 		'antibot' => $mod ? false : create_antibot($board['uri'], $id),
 		'boardlist' => createBoardlist($mod),
-		'return' => ($mod ? '?' . $board['url'] . $config['file_index'] : $config['root'] . $board['uri'] . '/' . $config['file_index'])
+		'return' => ($mod ? '?' . $board['url'] . $config['file_index'] : $config['root'] . $board['dir'] . $config['file_index'])
 	));
 
 	if ($return)
diff --git a/inc/image.php b/inc/image.php
index 51db2f83..bfb77d30 100644
--- a/inc/image.php
+++ b/inc/image.php
@@ -279,10 +279,8 @@ class ImageConvert extends ImageBase {
 		}
 		
 		$this->temp = tempnam($config['tmp'], 'imagick');
-		
-		$quality = $config['thumb_quality'] * 10;
-		
-		$config['thumb_keep_animation_frames'] = (int) $config['thumb_keep_animation_frames'];
+				
+		$config['thumb_keep_animation_frames'] = (int)$config['thumb_keep_animation_frames'];
 		
 		if ($this->format == 'gif' && ($config['thumb_ext'] == 'gif' || $config['thumb_ext'] == '') && $config['thumb_keep_animation_frames'] > 1) {
 			if ($this->gifsicle) {
@@ -291,12 +289,12 @@ class ImageConvert extends ImageBase {
 					escapeshellarg($this->temp)) || !file_exists($this->temp))
 					error('Failed to resize image!');
 			} else {
-				if (shell_exec("convert -background transparent -filter Point -sample {$this->width}x{$this->height} +antialias -quality {$quality} " .
+				if (shell_exec('convert ' . sprintf($config['convert_args'], $this->width, $this->height) . ' ' .
 					escapeshellarg($this->src . '') . " " . escapeshellarg($this->temp)) || !file_exists($this->temp))
 					error('Failed to resize image!');
 			}
 		} else {
-			if (shell_exec("convert -background transparent -flatten -filter Point -scale {$this->width}x{$this->height} +antialias -quality {$quality} " .
+			if (shell_exec('convert ' . sprintf($config['convert_args'], $this->width, $this->height) .
 				escapeshellarg($this->src . '[0]') . " " . escapeshellarg($this->temp)) || !file_exists($this->temp))
 				error('Failed to resize image!');
 		}
@@ -309,7 +307,7 @@ class ImagePNG extends ImageBase {
 	}
 	public function to($src) {
 		global $config;
-		imagepng($this->image, $src, $config['thumb_quality']);
+		imagepng($this->image, $src);
 	}
 	public function resize() {
 		$this->GD_create();
@@ -322,7 +320,7 @@ class ImagePNG extends ImageBase {
 
 class ImageGIF extends ImageBase {
 	public function from() {
-		$this->image = @imagecreatefromgif ($this->src);
+		$this->image = @imagecreatefromgif($this->src);
 	}
 	public function to($src) {
 		imagegif ($this->image, $src);
diff --git a/mod.php b/mod.php
index cd4d17d4..ee05c349 100644
--- a/mod.php
+++ b/mod.php
@@ -109,7 +109,7 @@ $new_pages = array();
 foreach ($pages as $key => $callback) {
 	if (is_string($callback) && preg_match('/^secure /', $callback))
 		$key .= '(/(?P<token>[a-f0-9]{8}))?';
-	$key = str_replace('\%b', $config['board_regex'], $key);
+	$key = str_replace('\%b', '?P<board>' . sprintf(substr($config['board_path'], 0, -1), $config['board_regex']), $key);
 	$new_pages[@$key[0] == '!' ? $key : '!^' . $key . '(?:&[^&=]+=[^&]*)*$!u'] = $callback;
 }
 $pages = $new_pages;
@@ -118,6 +118,15 @@ foreach ($pages as $uri => $handler) {
 	if (preg_match($uri, $query, $matches)) {
 		$matches = array_slice($matches, 1);
 		
+		if (isset($matches['board'])) {
+			$board_match = $matches['board'];
+			unset($matches['board']);
+			$key = array_search($board_match, $matches);
+			if (preg_match('/^' . sprintf(substr($config['board_path'], 0, -1), '(' . $config['board_regex'] . ')') . '$/u', $matches[$key], $board_match)) {
+				$matches[$key] = $board_match[1];
+			}
+		}
+		
 		if (is_string($handler) && preg_match('/^secure(_POST)? /', $handler, $m)) {
 			$secure_post_only = isset($m[1]);
 			if (!$secure_post_only || $_SERVER['REQUEST_METHOD'] == 'POST') {
diff --git a/post.php b/post.php
index 5031830f..103894db 100644
--- a/post.php
+++ b/post.php
@@ -428,7 +428,7 @@ if (isset($_POST['delete'])) {
 		$post['filehash'] = $config['file_hash']($upload);
 		$post['filesize'] = filesize($upload);
 		
-		if ($is_an_image) {
+		if ($is_an_image && $config['ie_mime_type_detection'] !== false) {
 			// Check IE MIME type detection XSS exploit
 			$buffer = file_get_contents($upload, null, null, null, 255);
 			if (preg_match($config['ie_mime_type_detection'], $buffer)) {
diff --git a/templates/generic_page.html b/templates/generic_page.html
index 0c8f9867..8f608a6a 100644
--- a/templates/generic_page.html
+++ b/templates/generic_page.html
@@ -22,7 +22,7 @@
 	
 	{% include 'post_form.html' %}
 	
-	{% if config.blotter %}<hr /><div class="blotter">{{ config.blotter }}</div>{% endif %}
+	{% if config.global_message %}<hr /><div class="blotter">{{ config.global_message }}</div>{% endif %}
 	<hr />
 	<form name="postcontrols" action="{{ config.post_url }}" method="post">
 	<input type="hidden" name="board" value="{{ board.uri }}" />
diff --git a/templates/index.html b/templates/index.html
index 1cde9882..e32ac253 100644
--- a/templates/index.html
+++ b/templates/index.html
@@ -21,7 +21,7 @@
 	
 	{% include 'post_form.html' %}
 	
-	{% if config.blotter %}<hr /><div class="blotter">{{ config.blotter }}</div>{% endif %}
+	{% if config.global_message %}<hr /><div class="blotter">{{ config.global_message }}</div>{% endif %}
 	<hr />
 	<form name="postcontrols" action="{{ config.post_url }}" method="post">
 	<input type="hidden" name="board" value="{{ board.uri }}" />
diff --git a/templates/thread.html b/templates/thread.html
index a6b8793f..97f8a3db 100644
--- a/templates/thread.html
+++ b/templates/thread.html
@@ -23,7 +23,7 @@
 
 	{% include 'post_form.html' %}
 
-	{% if config.blotter %}<hr /><div class="blotter">{{ config.blotter }}</div>{% endif %}
+	{% if config.global_message %}<hr /><div class="blotter">{{ config.global_message }}</div>{% endif %}
 	<hr />
 	<form name="postcontrols" action="{{ config.post_url }}" method="post">
 	<input type="hidden" name="board" value="{{ board.uri }}" />
-- 
cgit v1.3


From a3fbff225927469e68efc7ab31977736f34c7480 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sat, 3 Aug 2013 17:42:34 -0400
Subject: Update $config['try_smarter']. Should be working now.

---
 inc/config.php           |  3 ++-
 inc/functions.php        | 13 ++++++++++---
 post.php                 |  9 ++++++---
 templates/post_form.html |  3 +++
 4 files changed, 21 insertions(+), 7 deletions(-)

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index 120f3865..15af9661 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -262,7 +262,8 @@
 		'recaptcha_challenge_field',
 		'recaptcha_response_field',
 		'spoiler',
-		'quick-reply'
+		'quick-reply',
+		'page'
 	);
 
 	// Enable reCaptcha to make spam even harder. Rarely necessary.
diff --git a/inc/functions.php b/inc/functions.php
index b6862444..309546ef 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -841,11 +841,14 @@ function post(array $post) {
 }
 
 function bumpThread($id) {
-	global $board;
+	global $config, $board, $build_pages;
 
 	if (event('bump', $id))
 		return true;
 
+	if ($config['try_smarter'])
+		$build_pages[] = thread_find_page($id);
+	
 	$query = prepare(sprintf("UPDATE ``posts_%s`` SET `bump` = :time WHERE `id` = :id AND `thread` IS NULL", $board['uri']));
 	$query->bindValue(':time', time(), PDO::PARAM_INT);
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
@@ -1274,7 +1277,8 @@ function buildIndex() {
 	global $board, $config, $build_pages;
 
 	$pages = getPages();
-	$antibot = create_antibot($board['uri']);
+	if (!$config['try_smarter'])
+		$antibot = create_antibot($board['uri']);
 
 	for ($page = 1; $page <= $config['max_pages']; $page++) {
 		$filename = $board['dir'] . ($page == 1 ? $config['file_index'] : sprintf($config['file_page'], $page));
@@ -1285,8 +1289,11 @@ function buildIndex() {
 		if (!$content)
 			break;
 
+		if ($config['try_smarter']) {
+			$antibot = create_antibot($board['uri'], 0 - $page);
+			$content['current_page'] = $page;
+		}
 		$antibot->reset();
-
 		$content['pages'] = $pages;
 		$content['pages'][$page-1]['selected'] = true;
 		$content['btn'] = getPageButtons($content['pages']);
diff --git a/post.php b/post.php
index 103894db..65e85bcc 100644
--- a/post.php
+++ b/post.php
@@ -216,7 +216,7 @@ if (isset($_POST['delete'])) {
 	}
 	
 	if (!$post['mod']) {
-		$post['antispam_hash'] = checkSpam(array($board['uri'], isset($post['thread']) && !($config['quick_reply'] && isset($_POST['quick-reply'])) ? $post['thread'] : null));
+		$post['antispam_hash'] = checkSpam(array($board['uri'], isset($post['thread']) && !($config['quick_reply'] && isset($_POST['quick-reply'])) ? $post['thread'] : ($config['try_smarter'] && isset($_POST['page']) ? 0 - (int)$_POST['page'] : null)));
 		if ($post['antispam_hash'] === true)
 			error($config['error']['spam']);
 	}
@@ -594,12 +594,15 @@ if (isset($_POST['delete'])) {
 		}
 	}
 	
-	buildThread($post['op'] ? $id : $post['thread']);
-	
 	if (!$post['op'] && strtolower($post['email']) != 'sage' && !$thread['sage'] && ($config['reply_limit'] == 0 || $numposts['replies']+1 < $config['reply_limit'])) {
 		bumpThread($post['thread']);
 	}
 	
+	buildThread($post['op'] ? $id : $post['thread']);
+	
+	if ($config['try_smarter'] && $post['op'])
+		$build_pages = range(1, $config['max_pages']);
+	
 	if ($post['op'])
 		clean();
 	
diff --git a/templates/post_form.html b/templates/post_form.html
index 31fe88c6..4d7a37b7 100644
--- a/templates/post_form.html
+++ b/templates/post_form.html
@@ -4,6 +4,9 @@
 {{ antibot.html() }}
 <input type="hidden" name="board" value="{{ board.uri }}">
 {{ antibot.html() }}
+{% if current_page %}
+	<input type="hidden" name="page" value="{{ current_page }}">
+{% endif %}
 {% if mod %}<input type="hidden" name="mod" value="1">{% endif %}
 	<table>
 		{% if not config.field_disable_name or (mod and post.mod|hasPermission(config.mod.bypass_field_disable, board.uri)) %}<tr>
-- 
cgit v1.3


From 5300ffadf1c7faf3f505a585f2223fb6448b86bf Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sat, 3 Aug 2013 20:34:59 -0400
Subject: Better image processing. Add support for GraphicsMagick (a fork of
 ImageMagick) and `exiftool` (for stripping EXIF metadata quickly).

---
 inc/config.php    | 30 ++++++++++++++++++++++++------
 inc/functions.php | 27 ++++++++++++++++++++++++---
 inc/image.php     | 55 ++++++++++++++++++++++++++++++++++++++++++-------------
 post.php          | 21 ++++++++++++++-------
 4 files changed, 104 insertions(+), 29 deletions(-)

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index 15af9661..45fa957c 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -63,6 +63,10 @@
 	// Use `host` via shell_exec() to lookup hostnames, avoiding query timeouts. May not work on your system.
 	// Requires safe_mode to be disabled.
 	$config['dns_system'] = false;
+	
+	// When executing most command-line tools (such as `convert` for ImageMagick image processing), add this
+	// to the environment path (seperated by :).
+	$config['shell_path'] = '/usr/local/bin';
 
 /*
  * ====================
@@ -487,7 +491,11 @@
 	 *   'convert'      The command line version of ImageMagick (`convert`). Fixes most of the bugs in
 	 *                  PHP Imagick. `convert` produces the best still thumbnails and is highly recommended.
 	 *
-	 *   'convert+gifsicle'  Same as above, with the exception of using `gifsicle` (command line application)
+	 *   'gm'           GraphicsMagick (`gm`) is a fork of ImageMagick with many improvements. It is more
+	 *                  efficient and gets thumbnailing done using fewer resources.
+	 *
+	 *   'convert+gifscale'
+	 *    OR  'gm+gifsicle'  Same as above, with the exception of using `gifsicle` (command line application)
 	 *                       instead of `convert` for resizing GIFs. It's faster and resulting animated
 	 *                       thumbnails have less artifacts than if resized with ImageMagick.
 	 */
@@ -496,10 +504,24 @@
 
 	// Command-line options passed to ImageMagick when using `convert` for thumbnailing. Don't touch the
 	// placement of "%s" and "%d".
-	$config['convert_args'] = '-background transparent %s -strip -thumbnail %dx%d -quality 65';
+	$config['convert_args'] = '-size %dx%d %s -thumbnail %dx%d +profile "*" %s';
 
 	// Strip EXIF metadata from JPEG files.
 	$config['strip_exif'] = false;
+	// Use the command-line `exiftool` tool to strip EXIF metadata without decompressing/recompressing JPEGs.
+	// Ignored when $config['redraw_image'] is true.
+	$config['strip_with_exiftool'] = false;
+	
+	// Redraw the image to strip any excess data (commonly ZIP archives) WARNING: This might strip the
+	// animation of GIFs, depending on the chosen thumbnailing method. It also requires recompressing
+	// the image, so more processing power is required.
+	$config['redraw_image'] = false;
+	
+	// Automatically correct the orientation of JPEG files using -auto-orient in `convert`. This only works
+	// when `convert` or `gm` is selected for thumbnailing. Again, requires more processing power because
+	// this basically does the same thing as $config['redraw_image']. (If $config['redraw_image'] is enabled,
+	// this value doesn't matter as $config['redraw_image'] attempts to correct orientation too.)
+	$config['convert_auto_orient'] = false;
 
 	// Regular expression to check for an XSS exploit with IE 6 and 7. To disable, set to false.
 	// Details: https://github.com/savetheinternet/Tinyboard/issues/20
@@ -562,10 +584,6 @@
 	// Display image identification links using regex.info/exif, TinEye and Google Images.
 	$config['image_identification'] = false;
 
-	// Redraw the image to strip any excess data (commonly ZIP archives) WARNING: This might strip the
-	// animation of GIFs, depending on the chosen thumbnailing method.
-	$config['redraw_image'] = false;
-
 /*
  * ====================
  *  Board settings
diff --git a/inc/functions.php b/inc/functions.php
index 309546ef..8b2c4c7b 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -79,7 +79,7 @@ function loadConfig() {
 
 	if ($config['debug']) {
 		if (!isset($debug)) {
-			$debug = array('sql' => array(), 'purge' => array(), 'cached' => array(), 'write' => array());
+			$debug = array('sql' => array(), 'exec' => array(), 'purge' => array(), 'cached' => array(), 'write' => array());
 			$debug['start'] = microtime(true);
 		}
 	}
@@ -848,7 +848,7 @@ function bumpThread($id) {
 
 	if ($config['try_smarter'])
 		$build_pages[] = thread_find_page($id);
-	
+
 	$query = prepare(sprintf("UPDATE ``posts_%s`` SET `bump` = :time WHERE `id` = :id AND `thread` IS NULL", $board['uri']));
 	$query->bindValue(':time', time(), PDO::PARAM_INT);
 	$query->bindValue(':id', $id, PDO::PARAM_INT);
@@ -1282,7 +1282,7 @@ function buildIndex() {
 
 	for ($page = 1; $page <= $config['max_pages']; $page++) {
 		$filename = $board['dir'] . ($page == 1 ? $config['file_index'] : sprintf($config['file_page'], $page));
-		
+
 		if ($config['try_smarter'] && isset($build_pages) && count($build_pages) && !in_array($page, $build_pages) && is_file($filename))
 			continue;
 		$content = index($page);
@@ -1928,3 +1928,24 @@ function DNS($host) {
 
 	return $ip_addr;
 }
+
+function shell_exec_error($command) {
+	global $config, $debug;
+
+	if ($config['debug'])
+		$start = microtime(true);
+
+	$return = trim(shell_exec('PATH="' . escapeshellcmd($config['shell_path']) . ':$PATH";' . $command . ' 2>&1 && echo "TB_SUCCESS"'));
+	$return = preg_replace('/TB_SUCCESS$/', '', $return);
+
+	if ($config['debug']) {
+		$time = round((microtime(true) - $start) * 1000, 2) . 'ms';
+		$debug['exec'][] = array(
+			'command' => $command,
+			'time' => '~' . $time,
+			'response' => $return ? $return : null
+		);
+	}
+
+	return $return === 'TB_SUCCESS' ? false : $return;
+}
diff --git a/inc/image.php b/inc/image.php
index 88f735dd..1dac4724 100644
--- a/inc/image.php
+++ b/inc/image.php
@@ -19,7 +19,7 @@ class Image {
 
 		if ($config['thumb_method'] == 'imagick') {
 			$classname = 'ImageImagick';
-		} elseif ($config['thumb_method'] == 'convert' || $config['thumb_method'] == 'convert+gifsicle') {
+		} elseif (in_array($config['thumb_method'], array('convert', 'convert+gifsicle', 'gm', 'gm+gifsicle'))) {
 			$classname = 'ImageConvert';
 		} else {
 			$classname = 'Image' . strtoupper($this->format);
@@ -44,8 +44,6 @@ class Image {
 	
 	public function resize($extension, $max_width, $max_height) {
 		global $config;
-		
-		$gifsicle = false;
 
 		if ($config['thumb_method'] == 'imagick') {
 			$classname = 'ImageImagick';
@@ -54,6 +52,13 @@ class Image {
 		} elseif ($config['thumb_method'] == 'convert+gifsicle') {
 			$classname = 'ImageConvert';
 			$gifsicle = true;
+		} elseif ($config['thumb_method'] == 'gm') {
+			$classname = 'ImageConvert';
+			$gm = true;
+		} elseif ($config['thumb_method'] == 'gm+gifsicle') {
+			$classname = 'ImageConvert';
+			$gm = true;
+			$gifsicle = true;
 		} else {
 			$classname = 'Image' . strtoupper($extension);
 			if (!class_exists($classname)) {
@@ -81,7 +86,6 @@ class Image {
 			$height = $max_height;
 		}
 		
-		$thumb->gifsicle = $gifsicle;
 		$thumb->_resize($this->image->image, $width, $height);
 		
 		return $thumb;
@@ -227,15 +231,20 @@ class ImageImagick extends ImageBase {
 
 
 class ImageConvert extends ImageBase {
-	public $width, $height, $temp, $gifsicle;
+	public $width, $height, $temp, $gm = false, $gifsicle = false;
 	
 	public function init() {
 		global $config;
 		
+		if ($config['thumb_method'] == 'gm' || $config['thumb_method'] == 'gm+gifsicle')
+			$this->gm = true;
+		if ($config['thumb_method'] == 'convert+gifsicle' || $config['thumb_method'] == 'gm+gifsicle')
+			$this->gifsicle = true;
+		
 		$this->temp = false;
 	}
-	public function from() {	
-		$size = trim(shell_exec('identify -format "%w %h" ' . escapeshellarg($this->src . '[0]')));	
+	public function from() {
+		$size = shell_exec_error(($this->gm ? 'gm ' : '') . 'identify -format "%w %h" ' . escapeshellarg($this->src . '[0]'));
 		if (preg_match('/^(\d+) (\d+)$/', $size, $m)) {
 			$this->width = $m[1];
 			$this->height = $m[2];
@@ -251,9 +260,17 @@ class ImageConvert extends ImageBase {
 		
 		if (!$this->temp) {
 			if ($config['strip_exif']) {
-				shell_exec('convert ' . escapeshellarg($this->src) . ' -auto-orient -strip ' . escapeshellarg($src));
+				if($error = shell_exec_error(($this->gm ? 'gm ' : '') . 'convert ' .
+						escapeshellarg($this->src) . ' -auto-orient -strip ' . escapeshellarg($src))) {
+					$this->destroy();
+					error('Failed to resize image!', null, $error);
+				}
 			} else {
-				shell_exec('convert ' . escapeshellarg($this->src) . ' -auto-orient ' . escapeshellarg($src));
+				if($error = shell_exec_error(($this->gm ? 'gm ' : '') . 'convert ' .
+						escapeshellarg($this->src) . ' -auto-orient ' . escapeshellarg($src))) {
+					$this->destroy();
+					error('Failed to resize image!', null, $error);
+				}
 			}
 		} else {
 			rename($this->temp, $src);
@@ -289,13 +306,25 @@ class ImageConvert extends ImageBase {
 					escapeshellarg($this->temp) . '2>&1 &&echo $?') !== '0') || !file_exists($this->temp))
 					error('Failed to resize image!', null, $error);
 			} else {
-				if (trim($error = shell_exec('convert ' . sprintf($config['convert_args'], '', $this->width, $this->height) . ' ' .
-					escapeshellarg($this->src) . ' ' . escapeshellarg($this->temp) . ' 2>&1 &&echo $?')) !== '0' || !file_exists($this->temp))
+				if ($error = shell_exec_error(($this->gm ? 'gm ' : '') . 'convert ' .
+					sprintf($config['convert_args'],
+						$this->width,
+						$this->height,
+						escapeshellarg($this->src),
+						$this->width,
+						$this->height,
+						escapeshellarg($this->temp))) || !file_exists($this->temp))
 					error('Failed to resize image!', null, $error);
 			}
 		} else {
-			if (trim($error = shell_exec('convert ' . sprintf($config['convert_args'], '-flatten', $this->width, $this->height) . ' ' .
-				escapeshellarg($this->src . '[0]') . " " . escapeshellarg($this->temp) . ' 2>&1 &&echo $?')) !== '0' || !file_exists($this->temp))
+			if ($error = shell_exec_error(($this->gm ? 'gm ' : '') . 'convert ' .
+				sprintf($config['convert_args'],
+					$this->width,
+					$this->height,
+					escapeshellarg($this->src . '[0]'),
+					$this->width,
+					$this->height,
+					escapeshellarg($this->temp))) || !file_exists($this->temp))
 				error('Failed to resize image!', null, $error);
 		}
 	}
diff --git a/post.php b/post.php
index 65e85bcc..905110d4 100644
--- a/post.php
+++ b/post.php
@@ -447,14 +447,17 @@ if (isset($_POST['delete'])) {
 			}
 			
 			
-			if ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg') {
+			if ($config['convert_auto_orient'] && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg')) {
 				// The following code corrects the image orientation.
 				// Currently only works with the 'convert' option selected but it could easily be expanded to work with the rest if you can be bothered.
 				if (!($config['redraw_image'] || ($config['strip_exif'] && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg')))) {
-					if ($config['thumb_method'] == 'convert' || $config['thumb_method'] == 'convert+gifsicle') {
+					if (in_array($config['thumb_method'], array('convert', 'convert+gifsicle', 'gm', 'gm+gifsicle'))) {
 						$exif = exif_read_data($upload);
+						$gm = in_array($config['thumb_method'], array('gm', 'gm+gifsicle'));
 						if (isset($exif['Orientation']) && $exif['Orientation'] != 1) {
-							shell_exec('convert ' . escapeshellarg($upload) . ' -auto-orient ' . escapeshellarg($upload));							
+							if($error = shell_exec_error(($gm ? 'gm ' : '') . 'convert ' .
+									escapeshellarg($upload) . ' -auto-orient ' . escapeshellarg($upload)))
+								error('Could not auto-orient image!', null, $error);
 						}
 					}
 				}
@@ -462,7 +465,6 @@ if (isset($_POST['delete'])) {
 			
 			// create image object
 			$image = new Image($upload, $post['extension']);
-			
 			if ($image->size->width > $config['max_width'] || $image->size->height > $config['max_height']) {
 				$image->delete();
 				error($config['error']['maxsize']);
@@ -503,8 +505,13 @@ if (isset($_POST['delete'])) {
 			}
 			
 			if ($config['redraw_image'] || ($config['strip_exif'] && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg'))) {
-				$image->to($post['file']);
-				$dont_copy_file = true;
+				if (!$config['redraw_image'] && $config['strip_with_exiftool']) {
+					if($error = shell_exec_error('exiftool -q -all= ' . escapeshellarg($upload)))
+						error('Could not strip EXIF metadata!', null, $error);
+				} else {
+					$image->to($post['file']);
+					$dont_copy_file = true;
+				}
 			}
 			$image->destroy();
 		} else {
@@ -518,7 +525,7 @@ if (isset($_POST['delete'])) {
 		}
 		
 		if (!isset($dont_copy_file) || !$dont_copy_file) {
-			if (!@move_uploaded_file($_FILES['file']['tmp_name'], $post['file']))
+			if (!@move_uploaded_file($upload, $post['file']))
 				error($config['error']['nomove']);
 		}
 	}
-- 
cgit v1.3


From b67fc7d54e3fbde2f9e117a961998c5f8440679a Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sat, 3 Aug 2013 20:50:37 -0400
Subject: Only use `identify` if we have to

---
 inc/image.php | 15 ++++++++++++---
 post.php      |  2 +-
 2 files changed, 13 insertions(+), 4 deletions(-)

(limited to 'post.php')

diff --git a/inc/image.php b/inc/image.php
index 1dac4724..92e74277 100644
--- a/inc/image.php
+++ b/inc/image.php
@@ -11,7 +11,7 @@ if (realpath($_SERVER['SCRIPT_FILENAME']) == str_replace('\\', '/', __FILE__)) {
 
 class Image {
 	public $src, $format, $image, $size;
-	public function __construct($src, $format = false) {
+	public function __construct($src, $format = false, $size = false) {
 		global $config;
 		
 		$this->src = $src;
@@ -28,7 +28,7 @@ class Image {
 			}
 		}
 		
-		$this->image = new $classname($this);
+		$this->image = new $classname($this, $size);
 
 		if (!$this->image->valid()) {
 			$this->delete();
@@ -122,10 +122,15 @@ class ImageBase extends ImageGD {
 		return (bool)$this->image;
 	}
 	
-	public function __construct($img) {
+	public function __construct($img, $size = false) {
 		if (method_exists($this, 'init'))
 			$this->init();
 		
+		if ($size && $size[0] > 0 && $size[1] > 0) {
+			$this->width = $size[0];
+			$this->height = $size[1];
+		}
+		
 		if ($img !== false) {
 			$this->src = $img->src;
 			$this->from();
@@ -244,6 +249,10 @@ class ImageConvert extends ImageBase {
 		$this->temp = false;
 	}
 	public function from() {
+		if ($this->width > 0 && $this->height > 0) {
+			$this->image = true;
+			return;
+		}
 		$size = shell_exec_error(($this->gm ? 'gm ' : '') . 'identify -format "%w %h" ' . escapeshellarg($this->src . '[0]'));
 		if (preg_match('/^(\d+) (\d+)$/', $size, $m)) {
 			$this->width = $m[1];
diff --git a/post.php b/post.php
index 905110d4..434bc7e2 100644
--- a/post.php
+++ b/post.php
@@ -464,7 +464,7 @@ if (isset($_POST['delete'])) {
 			}
 			
 			// create image object
-			$image = new Image($upload, $post['extension']);
+			$image = new Image($upload, $post['extension'], $size);
 			if ($image->size->width > $config['max_width'] || $image->size->height > $config['max_height']) {
 				$image->delete();
 				error($config['error']['maxsize']);
-- 
cgit v1.3


From b373b39f44d87a8c1085433c5e848addcf1a8d72 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sat, 3 Aug 2013 21:47:24 -0400
Subject: Bugfix: gm and auto-orient thumbnailing

---
 inc/config.php |  2 +-
 inc/image.php  | 32 +++++++++++++++++++++++++-------
 post.php       |  3 ++-
 3 files changed, 28 insertions(+), 9 deletions(-)

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index 805c2de4..704889fa 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -504,7 +504,7 @@
 
 	// Command-line options passed to ImageMagick when using `convert` for thumbnailing. Don't touch the
 	// placement of "%s" and "%d".
-	$config['convert_args'] = '-size %dx%d %s -thumbnail %dx%d +profile "*" %s';
+	$config['convert_args'] = '-size %dx%d %s -thumbnail %dx%d -auto-orient +profile "*" %s';
 
 	// Strip EXIF metadata from JPEG files.
 	$config['strip_exif'] = false;
diff --git a/inc/image.php b/inc/image.php
index 92e74277..97ef8454 100644
--- a/inc/image.php
+++ b/inc/image.php
@@ -87,7 +87,7 @@ class Image {
 		}
 		
 		$thumb->_resize($this->image->image, $width, $height);
-		
+				
 		return $thumb;
 	}
 	
@@ -248,15 +248,25 @@ class ImageConvert extends ImageBase {
 		
 		$this->temp = false;
 	}
+	public function get_size($src, $try_gd_first = true) {
+		if ($try_gd_first) {
+			if ($size = @getimagesize($src))
+				return $size;
+		}
+		$size = shell_exec_error(($this->gm ? 'gm ' : '') . 'identify -format "%w %h" ' . escapeshellarg($src . '[0]'));
+		if (preg_match('/^(\d+) (\d+)$/', $size, $m))
+			return array($m[1], $m[2]);
+		return false;
+	}
 	public function from() {
 		if ($this->width > 0 && $this->height > 0) {
 			$this->image = true;
 			return;
 		}
-		$size = shell_exec_error(($this->gm ? 'gm ' : '') . 'identify -format "%w %h" ' . escapeshellarg($this->src . '[0]'));
-		if (preg_match('/^(\d+) (\d+)$/', $size, $m)) {
-			$this->width = $m[1];
-			$this->height = $m[2];
+		$size = $this->get_size($this->src, false);
+		if ($size) {
+			$this->width = $size[1];
+			$this->height = $size[2];
 			
 			$this->image = true;
 		} else {
@@ -272,13 +282,13 @@ class ImageConvert extends ImageBase {
 				if($error = shell_exec_error(($this->gm ? 'gm ' : '') . 'convert ' .
 						escapeshellarg($this->src) . ' -auto-orient -strip ' . escapeshellarg($src))) {
 					$this->destroy();
-					error('Failed to resize image!', null, $error);
+					error('Failed to redraw image!', null, $error);
 				}
 			} else {
 				if($error = shell_exec_error(($this->gm ? 'gm ' : '') . 'convert ' .
 						escapeshellarg($this->src) . ' -auto-orient ' . escapeshellarg($src))) {
 					$this->destroy();
-					error('Failed to resize image!', null, $error);
+					error('Failed to redraw image!', null, $error);
 				}
 			}
 		} else {
@@ -324,6 +334,10 @@ class ImageConvert extends ImageBase {
 						$this->height,
 						escapeshellarg($this->temp))) || !file_exists($this->temp))
 					error('Failed to resize image!', null, $error);
+				if ($size = $this->get_size($this->temp)) {
+					$this->width = $size[0];
+					$this->height = $size[1];
+				}
 			}
 		} else {
 			if ($error = shell_exec_error(($this->gm ? 'gm ' : '') . 'convert ' .
@@ -335,6 +349,10 @@ class ImageConvert extends ImageBase {
 					$this->height,
 					escapeshellarg($this->temp))) || !file_exists($this->temp))
 				error('Failed to resize image!', null, $error);
+			if ($size = $this->get_size($this->temp)) {
+				$this->width = $size[0];
+				$this->height = $size[1];
+			}
 		}
 	}
 }
diff --git a/post.php b/post.php
index 434bc7e2..3c3d6e62 100644
--- a/post.php
+++ b/post.php
@@ -450,7 +450,7 @@ if (isset($_POST['delete'])) {
 			if ($config['convert_auto_orient'] && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg')) {
 				// The following code corrects the image orientation.
 				// Currently only works with the 'convert' option selected but it could easily be expanded to work with the rest if you can be bothered.
-				if (!($config['redraw_image'] || ($config['strip_exif'] && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg')))) {
+				if (!($config['redraw_image'] || (($config['strip_exif'] && !$config['strip_with_exiftool']) && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg')))) {
 					if (in_array($config['thumb_method'], array('convert', 'convert+gifsicle', 'gm', 'gm+gifsicle'))) {
 						$exif = exif_read_data($upload);
 						$gm = in_array($config['thumb_method'], array('gm', 'gm+gifsicle'));
@@ -458,6 +458,7 @@ if (isset($_POST['delete'])) {
 							if($error = shell_exec_error(($gm ? 'gm ' : '') . 'convert ' .
 									escapeshellarg($upload) . ' -auto-orient ' . escapeshellarg($upload)))
 								error('Could not auto-orient image!', null, $error);
+							$size = @getimagesize($upload);
 						}
 					}
 				}
-- 
cgit v1.3


From ac4306555bf3bce78401918e23b81e863fcd37fb Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sat, 3 Aug 2013 22:14:25 -0400
Subject: Fix for instances with old GraphicsMagick or ImageMagick versions (no
 -auto-orient).

---
 inc/config.php    |  7 ++++-
 inc/display.php   |  2 +-
 inc/functions.php |  2 +-
 inc/image.php     | 87 ++++++++++++++++++++++++++++++++++++++++++++++++++-----
 post.php          | 12 ++++++--
 5 files changed, 97 insertions(+), 13 deletions(-)

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index 704889fa..832706e0 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -504,7 +504,7 @@
 
 	// Command-line options passed to ImageMagick when using `convert` for thumbnailing. Don't touch the
 	// placement of "%s" and "%d".
-	$config['convert_args'] = '-size %dx%d %s -thumbnail %dx%d -auto-orient +profile "*" %s';
+	$config['convert_args'] = '-size %dx%djjj %s -thumbnail %dx%d -auto-orient +profile "*" %s';
 
 	// Strip EXIF metadata from JPEG files.
 	$config['strip_exif'] = false;
@@ -522,6 +522,11 @@
 	// this basically does the same thing as $config['redraw_image']. (If $config['redraw_image'] is enabled,
 	// this value doesn't matter as $config['redraw_image'] attempts to correct orientation too.)
 	$config['convert_auto_orient'] = false;
+	
+	// Is your version of ImageMagick or GraphicsMagick old? Older versions may not include the -auto-orient
+	// switch. This is a manual replacement for that switch. This is independent from the above switch;
+	// -auto-orrient is applied when thumbnailing too.
+	$config['convert_manual_orient'] = false;
 
 	// Regular expression to check for an XSS exploit with IE 6 and 7. To disable, set to false.
 	// Details: https://github.com/savetheinternet/Tinyboard/issues/20
diff --git a/inc/display.php b/inc/display.php
index dddb6559..97b8c744 100644
--- a/inc/display.php
+++ b/inc/display.php
@@ -69,7 +69,7 @@ function error($message, $priority = true, $debug_stuff = false) {
 		// Running from CLI
 		die('Error: ' . $message . "\n");
 	}
-	
+
 	if ($config['debug'] && isset($db_error)) {
 		$debug_stuff = array_combine(array('SQLSTATE', 'Error code', 'Error message'), $db_error);
 	}
diff --git a/inc/functions.php b/inc/functions.php
index 7c202380..8b2c4c7b 100644
--- a/inc/functions.php
+++ b/inc/functions.php
@@ -1947,5 +1947,5 @@ function shell_exec_error($command) {
 		);
 	}
 
-	return ($return === 'TB_SUCCESS') ? false : $return;
+	return $return === 'TB_SUCCESS' ? false : $return;
 }
diff --git a/inc/image.php b/inc/image.php
index 97ef8454..f4c21917 100644
--- a/inc/image.php
+++ b/inc/image.php
@@ -320,19 +320,23 @@ class ImageConvert extends ImageBase {
 		
 		if ($this->format == 'gif' && ($config['thumb_ext'] == 'gif' || $config['thumb_ext'] == '') && $config['thumb_keep_animation_frames'] > 1) {
 			if ($this->gifsicle) {
-				if (trim($error = shell_exec("gifsicle --unoptimize -O2 --resize {$this->width}x{$this->height} < " .
+				if (($error = shell_exec_error("gifsicle --unoptimize -O2 --resize {$this->width}x{$this->height} < " .
 					escapeshellarg($this->src . '') . " \"#0-{$config['thumb_keep_animation_frames']}\" > " .
-					escapeshellarg($this->temp) . '2>&1 &&echo $?') !== '0') || !file_exists($this->temp))
+					escapeshellarg($this->temp))) || !file_exists($this->temp))
 					error('Failed to resize image!', null, $error);
 			} else {
-				if ($error = shell_exec_error(($this->gm ? 'gm ' : '') . 'convert ' .
-					sprintf($config['convert_args'],
+				if ($config['convert_manual_orient'])
+					$convert_args = str_replace('-auto-orient', ImageConvert::jpeg_exif_orientation($this->src), $config['convert_args']);
+				else
+					$convert_args = &$config['convert_args'];
+				if (($error = shell_exec_error(($this->gm ? 'gm ' : '') . 'convert ' .
+					sprintf($convert_args,
 						$this->width,
 						$this->height,
 						escapeshellarg($this->src),
 						$this->width,
 						$this->height,
-						escapeshellarg($this->temp))) || !file_exists($this->temp))
+						escapeshellarg($this->temp)))) || !file_exists($this->temp))
 					error('Failed to resize image!', null, $error);
 				if ($size = $this->get_size($this->temp)) {
 					$this->width = $size[0];
@@ -340,14 +344,18 @@ class ImageConvert extends ImageBase {
 				}
 			}
 		} else {
-			if ($error = shell_exec_error(($this->gm ? 'gm ' : '') . 'convert ' .
-				sprintf($config['convert_args'],
+			if ($config['convert_manual_orient'])
+				$convert_args = str_replace('-auto-orient', ImageConvert::jpeg_exif_orientation($this->src), $config['convert_args']);
+			else
+				$convert_args = &$config['convert_args'];
+			if (($error = shell_exec_error(($this->gm ? 'gm ' : '') . 'convert ' .
+				sprintf($convert_args,
 					$this->width,
 					$this->height,
 					escapeshellarg($this->src . '[0]'),
 					$this->width,
 					$this->height,
-					escapeshellarg($this->temp))) || !file_exists($this->temp))
+					escapeshellarg($this->temp)))) || !file_exists($this->temp))
 				error('Failed to resize image!', null, $error);
 			if ($size = $this->get_size($this->temp)) {
 				$this->width = $size[0];
@@ -355,6 +363,69 @@ class ImageConvert extends ImageBase {
 			}
 		}
 	}
+	
+	// For when -auto-orient doesn't exist (older versions)
+	static public function jpeg_exif_orientation($src, $exif = false) {
+		if (!$exif) {
+			$exif = exif_read_data($src);
+			if (!isset($exif['Orientation']))
+				return false;
+		}
+		switch($exif['Orientation']) {
+			case 1:
+				// Normal
+				return false;
+			case 2:
+				// 888888
+				//     88
+				//   8888
+				//     88
+				//     88
+			
+				return '-flop';
+			case 3:
+			
+				//     88
+				//     88
+				//   8888
+				//     88
+				// 888888
+			
+				return '-flip -flop';
+			case 4:
+				// 88
+				// 88
+				// 8888
+				// 88
+				// 888888
+			
+				return '-flip';
+			case 5:
+				// 8888888888
+				// 88  88
+				// 88
+			
+				return '-rotate 90 -flop';
+			case 6:
+				// 88
+				// 88  88
+				// 8888888888
+			
+				return '-rotate 90';
+			case 7:
+				//         88
+				//     88  88
+				// 8888888888
+			
+				return '-rotate "-90" -flop';
+			case 8:
+				// 8888888888
+				//     88  88
+				//         88
+			
+				return '-rotate "-90"';
+		}
+	}
 }
 
 class ImagePNG extends ImageBase {
diff --git a/post.php b/post.php
index 3c3d6e62..c355eca6 100644
--- a/post.php
+++ b/post.php
@@ -455,8 +455,16 @@ if (isset($_POST['delete'])) {
 						$exif = exif_read_data($upload);
 						$gm = in_array($config['thumb_method'], array('gm', 'gm+gifsicle'));
 						if (isset($exif['Orientation']) && $exif['Orientation'] != 1) {
-							if($error = shell_exec_error(($gm ? 'gm ' : '') . 'convert ' .
-									escapeshellarg($upload) . ' -auto-orient ' . escapeshellarg($upload)))
+							if ($config['convert_manual_orient']) {
+								$error = shell_exec_error(($gm ? 'gm ' : '') . 'convert ' .
+									escapeshellarg($upload) . ' ' .
+									ImageConvert::jpeg_exif_orientation(false, $exif) . ' +profile "*" ' .
+									escapeshellarg($upload));
+							} else {
+								$error = shell_exec_error(($gm ? 'gm ' : '') . 'convert ' .
+										escapeshellarg($upload) . ' -auto-orient ' . escapeshellarg($upload));
+							}
+							if ($error)
 								error('Could not auto-orient image!', null, $error);
 							$size = @getimagesize($upload);
 						}
-- 
cgit v1.3


From 0387ae1b46c62bc977172fd1c35f9684461e73d6 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 4 Aug 2013 00:48:28 -0400
Subject: Use exiftool to patch bug for now.

---
 inc/config.php |  5 +++--
 post.php       | 15 ++++++++++++---
 2 files changed, 15 insertions(+), 5 deletions(-)

(limited to 'post.php')

diff --git a/inc/config.php b/inc/config.php
index 0771bd51..06c6c243 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -509,8 +509,9 @@
 	// Strip EXIF metadata from JPEG files.
 	$config['strip_exif'] = false;
 	// Use the command-line `exiftool` tool to strip EXIF metadata without decompressing/recompressing JPEGs.
-	// Ignored when $config['redraw_image'] is true.
-	$config['strip_with_exiftool'] = false;
+	// Ignored when $config['redraw_image'] is true. This is also used to adjust the Orientation tag when
+	// $config['strip_exif'] is false and $config['convert_manual_orient'] is true.
+	$config['use_exiftool'] = false;
 	
 	// Redraw the image to strip any excess data (commonly ZIP archives) WARNING: This might strip the
 	// animation of GIFs, depending on the chosen thumbnailing method. It also requires recompressing
diff --git a/post.php b/post.php
index c355eca6..b159361a 100644
--- a/post.php
+++ b/post.php
@@ -450,7 +450,7 @@ if (isset($_POST['delete'])) {
 			if ($config['convert_auto_orient'] && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg')) {
 				// The following code corrects the image orientation.
 				// Currently only works with the 'convert' option selected but it could easily be expanded to work with the rest if you can be bothered.
-				if (!($config['redraw_image'] || (($config['strip_exif'] && !$config['strip_with_exiftool']) && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg')))) {
+				if (!($config['redraw_image'] || (($config['strip_exif'] && !$config['use_exiftool']) && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg')))) {
 					if (in_array($config['thumb_method'], array('convert', 'convert+gifsicle', 'gm', 'gm+gifsicle'))) {
 						$exif = exif_read_data($upload);
 						$gm = in_array($config['thumb_method'], array('gm', 'gm+gifsicle'));
@@ -458,8 +458,17 @@ if (isset($_POST['delete'])) {
 							if ($config['convert_manual_orient']) {
 								$error = shell_exec_error(($gm ? 'gm ' : '') . 'convert ' .
 									escapeshellarg($upload) . ' ' .
-									ImageConvert::jpeg_exif_orientation(false, $exif) . ' +profile "*" ' .
+									ImageConvert::jpeg_exif_orientation(false, $exif) . ' ' .
+									($config['strip_exif'] ? '+profile "*"' : ($config['use_exiftool'] ? '' : '+profile "*"')) . ' ' .
 									escapeshellarg($upload));
+								if ($config['use_exiftool']) {
+									if ($exiftool_error = shell_exec_error(
+										'exiftool -q -orientation=1 -n ' . escapeshellarg($upload)))
+										error('exiftool failed!', null, $exiftool_error);
+								} else {
+									// TODO: Find another way to remove the Orientation tag from the EXIF profile
+									// without needing `exiftool`.
+								}
 							} else {
 								$error = shell_exec_error(($gm ? 'gm ' : '') . 'convert ' .
 										escapeshellarg($upload) . ' -auto-orient ' . escapeshellarg($upload));
@@ -514,7 +523,7 @@ if (isset($_POST['delete'])) {
 			}
 			
 			if ($config['redraw_image'] || ($config['strip_exif'] && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg'))) {
-				if (!$config['redraw_image'] && $config['strip_with_exiftool']) {
+				if (!$config['redraw_image'] && $config['use_exiftool']) {
 					if($error = shell_exec_error('exiftool -q -all= ' . escapeshellarg($upload)))
 						error('Could not strip EXIF metadata!', null, $error);
 				} else {
-- 
cgit v1.3


From a2b432cfb08c75159f73e2112be600cb5c0a4ef1 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 4 Aug 2013 00:54:27 -0400
Subject: Some logic fixes. Don't strip exif twice.

---
 post.php | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index b159361a..09819ed3 100644
--- a/post.php
+++ b/post.php
@@ -459,9 +459,11 @@ if (isset($_POST['delete'])) {
 								$error = shell_exec_error(($gm ? 'gm ' : '') . 'convert ' .
 									escapeshellarg($upload) . ' ' .
 									ImageConvert::jpeg_exif_orientation(false, $exif) . ' ' .
-									($config['strip_exif'] ? '+profile "*"' : ($config['use_exiftool'] ? '' : '+profile "*"')) . ' ' .
+									($config['strip_exif'] ? '+profile "*"' :
+										($config['use_exiftool'] ? '' : '+profile "*"')
+									) . ' ' .
 									escapeshellarg($upload));
-								if ($config['use_exiftool']) {
+								if ($config['use_exiftool'] && !$config['strip_exif']) {
 									if ($exiftool_error = shell_exec_error(
 										'exiftool -q -orientation=1 -n ' . escapeshellarg($upload)))
 										error('exiftool failed!', null, $exiftool_error);
@@ -476,6 +478,8 @@ if (isset($_POST['delete'])) {
 							if ($error)
 								error('Could not auto-orient image!', null, $error);
 							$size = @getimagesize($upload);
+							if ($config['strip_exif'])
+								$post['exif_stripped'] = true;
 						}
 					}
 				}
@@ -522,7 +526,7 @@ if (isset($_POST['delete'])) {
 				$thumb->_destroy();
 			}
 			
-			if ($config['redraw_image'] || ($config['strip_exif'] && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg'))) {
+			if ($config['redraw_image'] || (!@$post['exif_stripped'] && $config['strip_exif'] && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg'))) {
 				if (!$config['redraw_image'] && $config['use_exiftool']) {
 					if($error = shell_exec_error('exiftool -q -all= ' . escapeshellarg($upload)))
 						error('Could not strip EXIF metadata!', null, $error);
-- 
cgit v1.3


From 373fb99a7fa6271178da3d014d5f35cc5ca4c0a8 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 4 Aug 2013 23:02:15 -0400
Subject: Bugfix: exif_read_data() Incorrect APP1 Exif Identifier Code

---
 inc/image.php | 2 +-
 post.php      | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'post.php')

diff --git a/inc/image.php b/inc/image.php
index 920cf8f9..9c4bbef4 100644
--- a/inc/image.php
+++ b/inc/image.php
@@ -371,7 +371,7 @@ class ImageConvert extends ImageBase {
 	// For when -auto-orient doesn't exist (older versions)
 	static public function jpeg_exif_orientation($src, $exif = false) {
 		if (!$exif) {
-			$exif = exif_read_data($src);
+			$exif = @exif_read_data($src);
 			if (!isset($exif['Orientation']))
 				return false;
 		}
diff --git a/post.php b/post.php
index 09819ed3..11d9a581 100644
--- a/post.php
+++ b/post.php
@@ -452,7 +452,7 @@ if (isset($_POST['delete'])) {
 				// Currently only works with the 'convert' option selected but it could easily be expanded to work with the rest if you can be bothered.
 				if (!($config['redraw_image'] || (($config['strip_exif'] && !$config['use_exiftool']) && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg')))) {
 					if (in_array($config['thumb_method'], array('convert', 'convert+gifsicle', 'gm', 'gm+gifsicle'))) {
-						$exif = exif_read_data($upload);
+						$exif = @exif_read_data($upload);
 						$gm = in_array($config['thumb_method'], array('gm', 'gm+gifsicle'));
 						if (isset($exif['Orientation']) && $exif['Orientation'] != 1) {
 							if ($config['convert_manual_orient']) {
-- 
cgit v1.3


From c9fe458152c9fa3ceccc635a8ce3dafc069885c6 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 4 Aug 2013 23:05:20 -0400
Subject: exiftool: -ignoreMinorErrors

---
 post.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index 11d9a581..768199a8 100644
--- a/post.php
+++ b/post.php
@@ -528,7 +528,7 @@ if (isset($_POST['delete'])) {
 			
 			if ($config['redraw_image'] || (!@$post['exif_stripped'] && $config['strip_exif'] && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg'))) {
 				if (!$config['redraw_image'] && $config['use_exiftool']) {
-					if($error = shell_exec_error('exiftool -q -all= ' . escapeshellarg($upload)))
+					if($error = shell_exec_error('exiftool -ignoreMinorErrors -q -all= ' . escapeshellarg($upload)))
 						error('Could not strip EXIF metadata!', null, $error);
 				} else {
 					$image->to($post['file']);
-- 
cgit v1.3


From f1e3c53d8d504cfd2ad34b948462f0486c02cc65 Mon Sep 17 00:00:00 2001
From: Michael Foster <savetheinternet@tinyboard.org>
Date: Sun, 4 Aug 2013 23:15:01 -0400
Subject: exiftool: -q needed twice to suppress warning messages

---
 post.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'post.php')

diff --git a/post.php b/post.php
index 768199a8..ab4775eb 100644
--- a/post.php
+++ b/post.php
@@ -528,7 +528,7 @@ if (isset($_POST['delete'])) {
 			
 			if ($config['redraw_image'] || (!@$post['exif_stripped'] && $config['strip_exif'] && ($post['extension'] == 'jpg' || $post['extension'] == 'jpeg'))) {
 				if (!$config['redraw_image'] && $config['use_exiftool']) {
-					if($error = shell_exec_error('exiftool -ignoreMinorErrors -q -all= ' . escapeshellarg($upload)))
+					if($error = shell_exec_error('exiftool -ignoreMinorErrors -q -q -all= ' . escapeshellarg($upload)))
 						error('Could not strip EXIF metadata!', null, $error);
 				} else {
 					$image->to($post['file']);
-- 
cgit v1.3