Modified: pear/packages/Bugtracker/trunk/include/functions.inc
===================================================================
--- pear/packages/Bugtracker/trunk/include/functions.inc	2009-08-13 16:29:31 UTC (rev 287256)
+++ pear/packages/Bugtracker/trunk/include/functions.inc	2009-08-13 16:30:38 UTC (rev 287257)
@@ -1410,7 +1410,7 @@
 {
 	if (DEVBOX === true) {
 		echo '<pre>';
-		var_dump($to, $subject, $message, $headers, $parameters);
+		var_dump(htmlspecialchars($to), htmlspecialchars($subject), htmlspecialchars($message), htmlspecialchars($headers), htmlspecialchars($parameters));
 		echo '</pre>';
 		return true;
 	}

Modified: pear/packages/Bugtracker/trunk/site/patch-add.php
===================================================================
--- pear/packages/Bugtracker/trunk/site/patch-add.php	2009-08-13 16:29:31 UTC (rev 287256)
+++ pear/packages/Bugtracker/trunk/site/patch-add.php	2009-08-13 16:30:38 UTC (rev 287257)
@@ -42,18 +42,16 @@
 require_once "{$ROOT_DIR}/include/classes/bug_patchtracker.php";
 $patchinfo = new Bug_Patchtracker;

+$patch_name = (!empty($_POST['name']) && is_string($_POST['name'])) ? $_POST['name'] : '';
+$patch_name_url = urlencode($patch_name);
+
 if (isset($_POST['addpatch'])) {
 	if (!isset($_POST['obsoleted'])) {
 		$_POST['obsoleted'] = array();
 	}

-	$email = isset($_POST['email']) ? $_POST['email'] : '';
-
-	if (!isset($_POST['name']) || empty($_POST['name']) || !is_string($_POST['name'])) {
-		if (!is_string($_POST['name'])) {
-			$_POST['name'] = '';
-		}
-		$name = $_POST['name'];
+	// Check that patch name is given (required always)
+	if (empty($patch_name)) {
 		$patches = $patchinfo->listPatches($bug_id);
 		$errors[] = 'No patch name entered';
 		include "{$ROOT_DIR}/templates/addpatch.php";
@@ -64,7 +62,9 @@
 		try {
 			$errors = array();

-			if (!is_valid_email($_POST['email'])) {
+			$email = isset($_POST['email']) ? $_POST['email'] : '';
+
+			if (!is_valid_email($email)) {
 				$errors[] = 'Email address must be valid!';
 			}

@@ -84,55 +84,43 @@
 			}

 			PEAR::pushErrorHandling(PEAR_ERROR_RETURN);
-			$e = $patchinfo->attach($bug_id, 'patch', $_POST['name'], $_POST['email'], $_POST['obsoleted']);
+			$e = $patchinfo->attach($bug_id, 'patch', $patch_name, $email, $_POST['obsoleted']);
 			PEAR::popErrorHandling();

 			if (PEAR::isError($e)) {
-				if (!is_string($_POST['name'])) {
-					$_POST['name'] = '';
-				}
-				$name = $_POST['name'];
 				$patches = $patchinfo->listPatches($bug_id);
 				$errors[] = $e->getMessage();
-				$errors[] = 'Could not attach patch "' . htmlspecialchars($_POST['name']) . '" to Bug #' . $bug_id;
+				$errors[] = 'Could not attach patch "' . htmlspecialchars($patch_name) . '" to Bug #' . $bug_id;
 				include "{$ROOT_DIR}/templates/addpatch.php";
 				exit;
 			}

-			redirect("patch-display.php?bug={$bug_id}&patch=" . urlencode($_POST['name']) . "&revision={$e}");
+			redirect("patch-display.php?bug={$bug_id}&patch={$patch_name_url}&revision={$e}");
 			exit;
 		} catch (Exception $e) {
-			if (!is_string($_POST['name'])) {
-				$_POST['name'] = '';
-			}
-			$name = $_POST['name'];
 			$patches = $patchinfo->listPatches($bug_id);
 			include "{$ROOT_DIR}/templates/addpatch.php";
 			exit;
 		}
+	} else {
+		$email = $auth_user->email;
 	}

 	PEAR::pushErrorHandling(PEAR_ERROR_RETURN);
-	$e = $patchinfo->attach($bug_id, 'patch', $_POST['name'], $auth_user->handle, $_POST['obsoleted']);
+	$e = $patchinfo->attach($bug_id, 'patch', $patch_name, $auth_user->email, $_POST['obsoleted']);
 	PEAR::popErrorHandling();
 	if (PEAR::isError($e)) {
-		if (!is_string($_POST['name'])) {
-			$_POST['name'] = '';
-		}
-		$name = $_POST['name'];
 		$patches = $patchinfo->listPatches($bug_id);
 		$errors = array($e->getMessage(),
 			'Could not attach patch "' .
-			htmlspecialchars($_POST['name']) .
+			htmlspecialchars($patch_name) .
 			'" to Bug #' . $bug_id);
 		include "{$ROOT_DIR}/templates/addpatch.php";
 		exit;
 	}

 	// Add a comment to the bug report.
-	$patch_name = $_POST['name'];
-	$patch_name_url = urlencode($patch_name);
-	$patch_url = "http://{$site_url}{$basedir}/{$url}patch-display.php?bug={$bug_id}&patch={$patch_name_url}&revision={$e}&display=1";
+	$patch_url = "http://{$site_url}{$basedir}/patch-display.php?bug={$bug_id}&patch={$patch_name_url}&revision={$e}&display=1";

 	$text = <<<TXT
 The following patch has been added/updated:
@@ -159,7 +147,7 @@

 	$protected_email  = '"' . spam_protect($email, 'text') . '"' .  "<{$mailfrom}>";
 	$extra_headers  = "From: {$protected_email}\n";
-	$extra_headers .= "Message-ID: <bug-{$cid}@{$site_url}>";
+	$extra_headers .= "Message-ID: <bug-{$bug_id}@{$site_url}>";

 	bugs_mail(
 		$mailto,
@@ -169,7 +157,6 @@
 		'-f bounce-no-user@php.net'
 	);

-	$name    = $_POST['name'];
 	$patches = $patchinfo->listPatches($bug_id);
 	$errors  = array();
 	include "{$ROOT_DIR}/templates/patchadded.php";
@@ -178,8 +165,7 @@
 }

 $email   = isset($_GET['email']) ? $_GET['email'] : '';
-$errors  = array();
 $name    = isset($_GET['patch']) ? $_GET['patch'] : '';
-$patches = $patchinfo->listPatches($bug);
+$patches = $patchinfo->listPatches($bug_id);

 include "{$ROOT_DIR}/templates/addpatch.php";

Modified: pear/packages/Bugtracker/trunk/site/patch-display.php
===================================================================
--- pear/packages/Bugtracker/trunk/site/patch-display.php	2009-08-13 16:29:31 UTC (rev 287256)
+++ pear/packages/Bugtracker/trunk/site/patch-display.php	2009-08-13 16:30:38 UTC (rev 287257)
@@ -13,8 +13,11 @@
 bugs_authenticate($user, $pw, $logged_in, $is_trusted_developer);
 $canpatch = ($logged_in == 'developer');

-$revision = isset($_GET['revision']) ? $_GET['revision'] : null;
-$patch    = isset($_GET['patch'])    ? $_GET['patch'] : null;
+$revision   = isset($_GET['revision']) ? $_GET['revision'] : null;
+$patch_name = isset($_GET['patch'])    ? $_GET['patch'] : null;
+if ($patch_name) {
+	$patch_name_url = urlencode($patch_name);
+}

 $bug_id = !empty($_GET['bug']) ? (int) $_GET['bug'] : 0;
 if (empty($bug_id)) {
@@ -33,15 +36,15 @@

 $pseudo_pkgs = get_pseudo_packages($site);

-if (isset($patch) && isset($revision)) {
+if (isset($patch_name) && isset($revision)) {
     if ($revision == 'latest') {
-        $revisions = $patchinfo->listRevisions($buginfo['id'], $patch);
+        $revisions = $patchinfo->listRevisions($buginfo['id'], $patch_name);
         if (isset($revisions[0])) {
             $revision = $revisions[0][0];
         }
     }

-    $path = $patchinfo->getPatchFullpath($bug_id, $patch, $revision);
+    $path = $patchinfo->getPatchFullpath($bug_id, $patch_name, $revision);
     if (!file_exists($path)) {
         response_header('Error :: no such patch/revision');
         display_bug_error('Invalid patch/revision specified');
@@ -49,28 +52,16 @@
         exit;
     }

-    if ($site != 'php' && $patchinfo->userNotRegistered($bug_id, $patch, $revision)) {
-        response_header('User has not confirmed identity');
-        display_bug_error('The user who submitted this patch has not yet confirmed their email address.');
-        echo '<p>If you submitted this patch, please check your email.</p>' .
-            '<p><strong>If you do not have a confirmation message</strong>, <a href="resend-request-email.php?' .
-            'handle=' . urlencode($patchinfo->getDeveloper($bug_id, $patch, $revision))
-            . '">click here to re-send</a> or write a message to' .
-            ' <a href="mailto:' . PEAR_DEV_EMAIL . '">' . PEAR_DEV_EMAIL . '</a> asking for manual approval of your account.</p>';
-        response_footer();
-        exit;
-    }
-
     require_once 'HTTP.php';
     if (isset($_GET['download'])) {
         header('Last-modified: ' . HTTP::date(filemtime($path)));
         header('Content-type: application/octet-stream');
-        header('Content-disposition: attachment; filename="' . $patch . '.patch.txt"');
+        header('Content-disposition: attachment; filename="' . $patch_name . '.patch.txt"');
         header('Content-length: '.filesize($path));
         readfile($path);
         exit;
     }
-    $patchcontents = $patchinfo->getPatch($buginfo['id'], $patch, $revision);
+    $patchcontents = $patchinfo->getPatch($buginfo['id'], $patch_name, $revision);

     if (PEAR::isError($patchcontents)) {
         response_header('Error :: Cannot retrieve patch');
@@ -79,19 +70,18 @@
         exit;
     }

-    $package     = $buginfo['package_name'];
-    $bug         = $buginfo['id'];
-    $handle      = $patchinfo->getDeveloper($bug, $patch, $revision);
-    $obsoletedby = $patchinfo->getObsoletingPatches($bug, $patch, $revision);
-    $obsoletes   = $patchinfo->getObsoletePatches($bug, $patch, $revision);
-    $patches     = $patchinfo->listPatches($bug);
-    $revisions   = $patchinfo->listRevisions($bug, $patch);
+    $package_name = $buginfo['package_name'];
+    $handle       = $patchinfo->getDeveloper($bug_id, $patch_name, $revision);
+    $obsoletedby  = $patchinfo->getObsoletingPatches($bug_id, $patch_name, $revision);
+    $obsoletes    = $patchinfo->getObsoletePatches($bug_id, $patch_name, $revision);
+    $patches      = $patchinfo->listPatches($bug_id);
+    $revisions    = $patchinfo->listRevisions($bug_id, $patch_name);

-    response_header('Bug #' . clean($bug) . ' :: Patches');
+    response_header("Bug #{$bug_id} :: Patches");
     include "{$ROOT_DIR}/templates/listpatches.php";

     if (isset($_GET['diff']) && $_GET['diff'] && isset($_GET['old']) && is_numeric($_GET['old'])) {
-        $old = $patchinfo->getPatchFullpath($bug_id, $patch, $_GET['old']);
+        $old = $patchinfo->getPatchFullpath($bug_id, $patch_name, $_GET['old']);
         $new = $path;
         if (!realpath($old) || !realpath($new)) {
             response_header('Error :: Cannot retrieve patch');
@@ -114,8 +104,7 @@
     exit;
 }

-$bug      = $buginfo['id'];
-$patches  = $patchinfo->listPatches($bug);
-response_header('Bug #' . clean($bug) . ' :: Patches');
+$patches  = $patchinfo->listPatches($bug_id);
+response_header("Bug #{$bug_id} :: Patches");
 include "{$ROOT_DIR}/templates/listpatches.php";
 response_footer();

Modified: pear/packages/Bugtracker/trunk/templates/addpatch.php
===================================================================
--- pear/packages/Bugtracker/trunk/templates/addpatch.php	2009-08-13 16:29:31 UTC (rev 287256)
+++ pear/packages/Bugtracker/trunk/templates/addpatch.php	2009-08-13 16:30:38 UTC (rev 287257)
@@ -1,7 +1,7 @@
 <?php
 response_header('Add Patch :: ' . clean($package_name));
 ?>
-<h2>Add a Patch to <a href="<?php echo $bug_id; ?>">Bug #<?php echo $bug_id; ?></a></h2>
+<h2>Add a Patch to <a href="bug.php?id=<?php echo $bug_id; ?>">Bug #<?php echo $bug_id; ?></a></h2>
 <ul>
  <li>One problem per patch, please</li>
  <li>Patches must be 100k or smaller</li>
@@ -12,7 +12,7 @@
 <input type="hidden" name="MAX_FILE_SIZE" value="102400" />
 <input type="hidden" name="bug" value="<?php echo $bug_id; ?>" />
 <?php
-if ($errors) {
+if (!empty($errors)) {
     foreach ($errors as $err) {
         echo '<div class="errors">' . htmlspecialchars($err) . '</div>';
     }
@@ -42,7 +42,7 @@
    Patch Name
   </th>
   <td class="form-input">
-   <input type="text" maxlength="80" size="40" name="name" value="<?php echo clean($name); ?>" /><br />
+   <input type="text" maxlength="80" size="40" name="name" value="<?php echo clean($patch_name); ?>" /><br />
    <small>The patch name must be shorter than 80 characters and it must only contain alpha-numeric characters, dots, underscores or hyphens.</small>
   </td>
  </tr>

Modified: pear/packages/Bugtracker/trunk/templates/listpatches.php
===================================================================
--- pear/packages/Bugtracker/trunk/templates/listpatches.php	2009-08-13 16:29:31 UTC (rev 287256)
+++ pear/packages/Bugtracker/trunk/templates/listpatches.php	2009-08-13 16:30:38 UTC (rev 287257)
@@ -3,22 +3,22 @@
 <table>
  <tr>
   <td>
-   <a href="bug.php?id=<?php echo $bug_id; ?>">Return to Bug #<?php echo clean($bug_id) ?></a>
+   <a href="bug.php?id=<?php echo $bug_id; ?>">Return to Bug #<?php echo $bug_id; ?></a>
    <?php if ($canpatch) { ?>
         | <a href="patch-add.php?bug_id=<?php echo $bug_id; ?>">Add a Patch</a>
    <?php } ?>
   </td>
  </tr>
-<?php foreach ($patches as $patch_name => $revs) { ?>
+<?php foreach ($patches as $pname => $revs) { ?>
  <tr>
   <th class="details">
-  		Patch <a href="?bug_id=<?php echo $bug_id; ?>&amp;patch=<?php echo urlencode($patch_name); ?>"><?php echo clean($patch_name); ?></a>
+  		Patch <a href="?bug_id=<?php echo $bug_id; ?>&amp;patch=<?php echo urlencode($pname); ?>&amp;revision=latest"><?php echo clean($pname); ?></a>
   </th>
   <td>
    <?php foreach ($revs as $rev) { ?>
-        revision <a href="patch-display.php?bug_id=<?php echo $bug_id;?>&amp;patch=<?php echo urlencode($patch_name); ?>&amp;revision=<?php echo $rev[0]; ?>&amp;display=1"><?php echo format_date($rev[0]); ?></a>
-        by <a href="/user/<?php echo $rev[1] ?>"><?php echo $rev[1]; ?></a><br />
-   <?php } //foreach ($revs as $rev) ?>
+        revision <a href="patch-display.php?bug_id=<?php echo $bug_id;?>&amp;patch=<?php echo urlencode($pname); ?>&amp;revision=<?php echo $rev[0]; ?>&amp;display=1"><?php echo format_date($rev[0]); ?></a>
+        by <?php echo spam_protect($rev[1]); ?></a><br />
+   <?php } //foreach ($revs as $rev); ?>
   </td>
  </tr>
 <?php } ?>

Modified: pear/packages/Bugtracker/trunk/templates/patchdiff.php
===================================================================
--- pear/packages/Bugtracker/trunk/templates/patchdiff.php	2009-08-13 16:29:31 UTC (rev 287256)
+++ pear/packages/Bugtracker/trunk/templates/patchdiff.php	2009-08-13 16:30:38 UTC (rev 287257)
@@ -1,12 +1,8 @@
+<h2>Patch <?php echo clean($patch_name); ?> for <?php echo clean($package_name); ?> Bug #<?php echo $bug_id; ?></h2>
+<p><b>Patch version <?php echo format_date($revision); ?></b></p>
+<a href="bug.php?id=<?php echo $bug_id; ?>">Return to Bug #<?php echo $bug_id; ?></a>
+| <a href="patch-display.php?bug_id=<?php echo $bug_id; ?>&amp;patch=<?php echo $patch_name_url; ?>&amp;revision=<?php echo urlencode($revision); ?>&amp;download=1">Download this patch</a><br />
 <?php
-response_header('Patch :: ' . clean($package) . ' :: Bug #' . clean($bug));
-?>
-<h1>Patch version <?php echo format_date($revision) ?> for <?php echo clean($package) ?> Bug #<?php
-    echo clean($bug) ?></h1>
-<a href="bug.php?id=<?php echo urlencode($bug) ?>">Return to Bug #<?php echo clean($bug) ?></a>
-| <a href="patch-display.php?bug_id=<?php echo urlencode($bug) ?>&amp;patch=<?php echo urlencode($patch)
-    ?>&amp;revision=<?php echo urlencode($revision) ?>&amp;download=1">Download this patch</a><br />
-<?php
 if (count($obsoletedby)) {
     echo '<div class="warnings">This patch is obsolete</div><p>Obsoleted by patches:<ul>';
     foreach ($obsoletedby as $betterpatch) {
@@ -34,9 +30,9 @@
 ?>
 Patch Revisions:
 <?php foreach ($revisions as $i => $revision) { ?>
-<a href="patch-display.php?bug_id=<?php echo urlencode($bug) ?>&amp;patch=<?php
-    echo urlencode($patch) ?>&amp;revision=<?php echo urlencode($revision[0]); ?>"><?php
-    echo format_date($revision[0]) ?></a><?php if ($i < count($revisions) - 1) echo ' | '; ?>
+<a href="patch-display.php?bug_id=<?php echo $bug_id; ?>&amp;patch=<?php
+    echo $patch_name_url; ?>&amp;revision=<?php echo urlencode($revision[0]); ?>"><?php
+    echo format_date($revision[0]); ?></a><?php if ($i < count($revisions) - 1) echo ' | '; ?>
 <?php } ?>
 <h3>Developer: <?php echo $handle; ?></h3>
 <pre>

Modified: pear/packages/Bugtracker/trunk/templates/patchdisplay.php
===================================================================
--- pear/packages/Bugtracker/trunk/templates/patchdisplay.php	2009-08-13 16:29:31 UTC (rev 287256)
+++ pear/packages/Bugtracker/trunk/templates/patchdisplay.php	2009-08-13 16:30:38 UTC (rev 287257)
@@ -1,18 +1,14 @@
+<h2>Patch <?php echo clean($patch_name); ?> for <?php echo clean($package_name); ?> Bug #<?php echo $bug_id; ?></h2>
+<p><b>Patch version <?php echo format_date($revision); ?></b></p>
+<a href="bug.php?id=<?php echo $bug_id; ?>">Return to Bug #<?php echo $bug_id; ?></a> |
+<a href="patch-display.php?bug_id=<?php echo $bug_id; ?>&amp;patch=<?php echo $patch_name_url; ?>&amp;revision=<?php echo urlencode($revision); ?>&amp;download=1">Download this patch</a><br />
 <?php
-response_header('Patch :: ' . clean($package_name) . ' :: Bug #' . $bug_id);
-?>
-<h1>Patch version <?php echo format_date($revision) ?> for <?php echo clean($package_name); ?> Bug #<?php
-    echo $bug_id; ?></h1>
-<a href="bug.php?id=<?php echo urlencode($bug) ?>">Return to Bug #<?php echo $bug_id; ?></a>
-| <a href="patch-display.php?bug_id=<?php echo urlencode($bug) ?>&amp;patch=<?php echo urlencode($patch)
-    ?>&amp;revision=<?php echo urlencode($revision) ?>&amp;download=1">Download this patch</a><br />
-<?php
 if (count($obsoletedby)) {
     echo '<div class="warnings">This patch is obsolete</div><p>Obsoleted by patches:<ul>';
     foreach ($obsoletedby as $betterpatch) {
         echo '<li><a href="patch-display.php?patch=',
              urlencode($betterpatch['patch']),
-             '&amp;bug_id=', $bug, '&amp;revision=', $betterpatch['revision'],
+             '&amp;bug_id=', $bug_id, '&amp;revision=', $betterpatch['revision'],
              '">', htmlspecialchars($betterpatch['patch']), ', revision ',
              format_date($betterpatch['revision']), '</a></li>';
     }
@@ -24,7 +20,7 @@
     foreach ($obsoletes as $betterpatch) {
         echo '<li><a href="patch-display.php?patch=',
              urlencode($betterpatch['obsolete_patch']),
-             '&amp;bug_id=', $bug,
+             '&amp;bug_id=', $bug_id,
              '&amp;revision=', $betterpatch['obsolete_revision'],
              '">', htmlspecialchars($betterpatch['obsolete_patch']), ', revision ',
              format_date($betterpatch['obsolete_revision']), '</a></li>';
@@ -36,12 +32,12 @@
 <?php
 echo '<ul>';
 foreach ($revisions as $i => $rev) {
-    echo '<li><a href="patch-display.php?bug_id=', urlencode($bug), '&amp;patch=',
-         urlencode($patch), '&amp;revision=', urlencode($rev[0]), '">',
+    echo '<li><a href="patch-display.php?bug_id=', $bug_id, '&amp;patch=',
+         $patch_name_url, '&amp;revision=', urlencode($rev[0]), '">',
          format_date($rev[0]), '</a>',
          ' <a href="patch-display.php?patch=',
-             urlencode($patch),
-             '&amp;bug_id=', $bug, '&amp;diff=1&amp;old=', $rev[0], '&amp;revision=',
+             $patch_name_url,
+             '&amp;bug_id=', $bug_id, '&amp;diff=1&amp;old=', $rev[0], '&amp;revision=',
              $revision, '">[diff to current]</a></li>';
 }
 echo '</ul></li>';