--- spip-2.1.1.orig/debian/docs
+++ spip-2.1.1/debian/docs
@@ -0,0 +1 @@
+debian/apache2.conf
--- spip-2.1.1.orig/debian/config
+++ spip-2.1.1/debian/config
@@ -0,0 +1,17 @@
+#!/bin/sh
+
+# Debconf config script for spip
+
+set -e
+
+# Source debconf library
+. /usr/share/debconf/confmodule
+
+db_input medium spip/webserver || true
+db_go
+
+db_stop
+
+exit 0
+
+
--- spip-2.1.1.orig/debian/preinst
+++ spip-2.1.1/debian/preinst
@@ -0,0 +1,49 @@
+#!/bin/sh
+# preinst script for #PACKAGE#
+#
+# see: dh_installdeb(1)
+
+set -e
+
+# summary of how this script can be called:
+#        * <new-preinst> `install'
+#        * <new-preinst> `install' <old-version>
+#        * <new-preinst> `upgrade' <old-version>
+#        * <old-preinst> `abort-upgrade' <new-version>
+#
+# for details, see http://www.debian.org/doc/debian-policy/ or
+# the debian-policy package
+
+
+case "$1" in
+    upgrade)
+        if dpkg --compare-versions "$2" lt 2.0.0-1 && test -e /var/lib/spip/dist; then
+          if test -e /var/lib/spip/squelettes-dist; then
+            echo "could not move old default files of /var/lib/spip/dist"
+            echo "to /var/lib/spip/squelettes-dist: destination exists !"
+            echo "You have move them manually."
+          else
+            mv /var/lib/spip/dist /var/lib/spip/squelettes-dist
+          fi
+        fi
+    ;;
+
+    install|abort-upgrade)
+    ;;
+
+    *)
+        echo "preinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
+
+
+
+
--- spip-2.1.1.orig/debian/compat
+++ spip-2.1.1/debian/compat
@@ -0,0 +1 @@
+7
--- spip-2.1.1.orig/debian/spip_debian.1
+++ spip-2.1.1/debian/spip_debian.1
@@ -0,0 +1,33 @@
+.\"                                      Hey, EMACS: -*- nroff -*-
+.\" First parameter, NAME, should be all caps
+.\" Second parameter, SECTION, should be 1-8, maybe w/ subsection
+.\" other parameters are allowed: see man(7), man(1)
+.TH SPIP_DEBIAN 1 "june 29, 2007"
+.\" Please adjust this date whenever revising the manpage.
+.\"
+.\" Some roff macros, for reference:
+.\" .nh        disable hyphenation
+.\" .hy        enable hyphenation
+.\" .ad l      left justify
+.\" .ad b      justify to both left and right margins
+.\" .nf        disable filling
+.\" .fi        enable filling
+.\" .br        insert line break
+.\" .sp <n>    insert n+1 empty lines
+.\" for manpage-specific macros, see man(7)
+.SH NAME
+spip_*_site - commands for creating/removing spip sites
+.SH SYNOPSIS
+.B spip_add_site [\fIsite-name\fR]
+
+.B spip_del_site [\fIsite-name\fR]
+.SH DESCRIPTION
+.PP
+Those commands add and remove a virtual website for spip debian package.
+
+.SH AUTHOR
+This manual page was written by Romain Beauxis <toots@rastageeks.org>,
+for the Debian project  Permission is granted to copy, distribute and/or
+modify this document under the terms of the GNU General Public
+License, Version 2 any later version published by the Free Software Foundation.
+		  
--- spip-2.1.1.orig/debian/manpages
+++ spip-2.1.1/debian/manpages
@@ -0,0 +1 @@
+debian/spip_debian.1
--- spip-2.1.1.orig/debian/copyright
+++ spip-2.1.1/debian/copyright
@@ -0,0 +1,51 @@
+This package was debianized by Romain Beauxis <toots@rastageeks.org> on
+Sat, 26 May 2007 03:52:25 +0200.
+
+It was downloaded from http://www.spip.net/download
+
+Upstream Author: SPIP-Dev <spip-dev@rezo.net>
+
+Copyright: 
+
+	Most of the files are:
+	Copyright © 2001-2008
+	Arnaud Martin, Antoine Pitrou, Philippe Riviere, Emmanuel Saint-James
+
+	Other files' copyright are:
+	bgiframe.js: Copyright © 2006 Brandon Aaron
+	jquery.js: Copyright © 2007 John Resig (not distributed in the binary package)
+	md5.js: Copyright © 1996 Henri Torgemane
+	dragdrop_interface.js: Copyright © 2006 Stefan Petre
+	jquery.iepnghack.js: Copyright © 2007 Kush M.
+	multilang.js: Copyright © 2006 Renato Formato <renatoformato@virgilio.it>
+	jquery.js.html: Copyright © 2007 John Resig
+	dustismo_bold.ttf: Copyright © 2002 Dustin Norlander
+
+License:
+
+md5.js is licensed under the following terms:
+    Permission to use, copy, modify, and distribute this software
+    and its documentation for any purposes and without
+    fee is hereby granted provided that this copyright notice
+    appears in all copies.
+
+All other files are licensed with the GNU GPL license, version 3 or above:
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License
+    along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+On Debian systems, the complete text of the GNU General
+Public License can be found in `/usr/share/common-licenses/GPL-3'.
+
+The Debian packaging is © 2007, Romain Beauxis <toots@rastageeks.org> and
+is licensed under the GPL, see above.
--- spip-2.1.1.orig/debian/examples
+++ spip-2.1.1/debian/examples
@@ -0,0 +1 @@
+htaccess.txt
--- spip-2.1.1.orig/debian/templates
+++ spip-2.1.1/debian/templates
@@ -0,0 +1,7 @@
+Template: spip/webserver
+Type: multiselect
+_description: Web server(s) to configure automatically:
+ Please select the web server(s) that should be configured automatically
+ for spip.
+Choices: apache, apache-ssl, apache2, cherokee
+Default: apache2
--- spip-2.1.1.orig/debian/links
+++ spip-2.1.1/debian/links
@@ -0,0 +1,8 @@
+var/lib/spip/sites etc/spip/sites-files
+usr/share/man/man1/spip_debian.1 usr/share/man/man1/spip_add_site.1
+usr/share/man/man1/spip_debian.1 usr/share/man/man1/spip_rm_site.1
+etc/spip/mes_options.php usr/share/spip/config/mes_options.php
+etc/spip/ecran_securite.php usr/share/spip/config/ecran_securite.php
+usr/share/php/HTML/Safe.php usr/share/spip/extensions/safehtml/lib/safehtml/classes/safehtml.php
+/usr/share/php/XML/HTMLSax3.php usr/share/spip/extensions/safehtml/lib/safehtml/classes/HTMLSax3.php
+/usr/share/php/XML/HTMLSax3 usr/share/spip/extensions/safehtml/lib/safehtml/classes/HTMLSax3
--- spip-2.1.1.orig/debian/README.Debian-source
+++ spip-2.1.1/debian/README.Debian-source
@@ -0,0 +1,18 @@
+
+This tarball is taken from latest svn.
+
+To generate it you can do:
+
+ * Download the latest source for spip and extract it into the source directory.
+ * Get the mutualisation plugin and add it to the source directory:
+svn export svn://zone.spip.org/spip-zone/_plugins_/mutualisation mutualisation
+
+The security screen is added into debian's files. The latest version is located at:
+  svn://zone.spip.org/spip-zone/_core_/securite/ecran_securite.php
+
+Additionally, the files:
+  extensions/safehtml/lib/safehtml/classes/HTMLSax3/                   
+  extensions/safehtml/lib/safehtml/classes/HTMLSax3.php               
+  extensions/safehtml/lib/safehtml/classes/safehtml.php   
+has been removed because of a licence conflict.
+
--- spip-2.1.1.orig/debian/install
+++ spip-2.1.1/debian/install
@@ -0,0 +1,6 @@
+*.php ecrire/ extensions/ mutualisation/ prive/ rien.gif usr/share/spip
+IMG/ local/ config/ tmp/ var/lib/spip/sites/default
+squelettes-dist/ var/lib/spip
+debian/etc/* debian/custom/mes_options.php etc/spip
+debian/custom/spip_add_site debian/custom/spip_rm_site usr/sbin
+debian/security/ecran_securite.php etc/spip
--- spip-2.1.1.orig/debian/control
+++ spip-2.1.1/debian/control
@@ -0,0 +1,33 @@
+Source: spip
+Section: web
+Priority: extra
+Maintainer: SPIP packaging team <spip-maintainers@lists.alioth.debian.org>
+Uploaders: Romain Beauxis <toots@rastageeks.org>
+Build-Depends: debhelper (>= 7.0.1), quilt, patchutils (>= 0.2.25), cdbs (>= 0.4.27), po-debconf
+Homepage: http://www.spip.net/
+Standards-Version: 3.9.1
+
+Package: spip
+Architecture: all
+Depends: apache2 | httpd, php5, php5-mysql, php-html-safe, libjs-jquery, ${misc:Depends}
+Recommends: mysql-server, imagemagick | netpbm
+Description: website engine for publishing
+ SPIP is a publishing system for the Internet in which great importance 
+ is attached to collaborative working, to multilingual environments, 
+ and to simplicity of use for web authors.
+ .
+ SPIP's benefit consists in:
+ .
+  * managing a magazine type site i.e. made up mainly of 
+    articles and news items inserted in an arborescence 
+    of sections nested in each others.
+  * completely separating and distributing three kinds of tasks 
+    over various players: the graphic design, the site editorial 
+    input through the submission of articles and news items and 
+    the site editorial management.
+  * spare the webmaster and all the participants to the life of 
+    the site, a number of tedious aspects of web publishing as 
+    well as the need to learn lengthy technical skills. 
+    SPIP allows you to start creating your sections and 
+    articles straight away.
+
--- spip-2.1.1.orig/debian/control.in
+++ spip-2.1.1/debian/control.in
@@ -0,0 +1,33 @@
+Source: spip
+Section: web
+Priority: extra
+Maintainer: SPIP packaging team <spip-maintainers@lists.alioth.debian.org>
+Uploaders: Romain Beauxis <toots@rastageeks.org>
+Build-Depends: @cdbs@, po-debconf
+Homepage: http://www.spip.net/
+Standards-Version: 3.9.1
+
+Package: spip
+Architecture: all
+Depends: apache2 | httpd, php5, php5-mysql, php-html-safe, libjs-jquery, ${misc:Depends}
+Recommends: mysql-server, imagemagick | netpbm
+Description: website engine for publishing
+ SPIP is a publishing system for the Internet in which great importance 
+ is attached to collaborative working, to multilingual environments, 
+ and to simplicity of use for web authors.
+ .
+ SPIP's benefit consists in:
+ .
+  * managing a magazine type site i.e. made up mainly of 
+    articles and news items inserted in an arborescence 
+    of sections nested in each others.
+  * completely separating and distributing three kinds of tasks 
+    over various players: the graphic design, the site editorial 
+    input through the submission of articles and news items and 
+    the site editorial management.
+  * spare the webmaster and all the participants to the life of 
+    the site, a number of tedious aspects of web publishing as 
+    well as the need to learn lengthy technical skills. 
+    SPIP allows you to start creating your sections and 
+    articles straight away.
+
--- spip-2.1.1.orig/debian/README.Debian
+++ spip-2.1.1/debian/README.Debian
@@ -0,0 +1,21 @@
+
+To configure a spip website you should:
+* Point the required http address to /var/lib/spip in your web server
+* use this command: spip_add_site http-host
+This will register a spip for this host. 
+You can add more in /etc/spip/etc/spip/sites/http-host.php. 
+
+The correspondance between the various site files and the HTTP request
+is made using $GLOBALS['spip_sites'][$site], where $site is 
+the directory of the site's files (/var/lib/spip/sites/$site).
+
+You can use regular expressions. For instance:
+  $GLOBALS['spip_sites']['foo'] = array('foo.example.com\/spip_[^\/]+\/.*');
+Will match requests of the form: "http://foo.example.com/spip_bar/whatever"
+
+There is an apache configuration file at /etc/spip/apache.conf and
+a file for cherokee too.
+
+This file is included in your webser configuration if you requested it during
+package configuration.
+
--- spip-2.1.1.orig/debian/apache2.conf
+++ spip-2.1.1/debian/apache2.conf
@@ -0,0 +1,37 @@
+# vim:syntax=apache
+# Apache virtual host configuration example
+# for mutualized SPIP hosts
+#NameVirtualHost *:80
+<VirtualHost *:80>
+	ServerAdmin admin@domain.org
+	ServerName spip.domain.org
+	
+	DocumentRoot /var/lib/spip
+	Alias /IMG /var/lib/spip/sites/default/IMG
+	Alias /local /var/lib/spip/sites/default/local
+
+	<Directory />
+		Options FollowSymLinks
+		AllowOverride None
+	</Directory>
+
+        # Deny access to /tmp:
+        <Location /tmp/>
+          deny from all
+        </Location>
+
+        # Disable scripts in /IMG:
+        <Directory /var/lib/spip/sites/default/IMG>
+          php_flag engine Off
+        </Directory>
+
+	ErrorLog /var/log/apache2/spip.domain.org-error.log
+
+	# Possible values include: debug, info, notice, warn, error, crit,
+	# alert, emerg.
+	LogLevel warn
+
+	CustomLog /var/log/apache2/spip.domain.org-access.log combined
+	ServerSignature On
+
+</VirtualHost>
--- spip-2.1.1.orig/debian/postinst
+++ spip-2.1.1/debian/postinst
@@ -0,0 +1,79 @@
+#! /bin/sh
+# postinst script for spip
+#
+# see: dh_installdeb(1)
+
+set -e
+
+. /usr/share/debconf/confmodule
+
+case "$1" in
+    configure)
+
+        db_get spip/webserver || true
+        webserver=$RET
+
+        webserver=`echo $webserver|sed -e 's/,  */ /g'`
+
+        for i in $webserver; do
+            if [ "$webserver" != "cherokee" ]; then
+                if [ ! -d /etc/$i/conf.d/ ]; then
+                        install -d -m755 /etc/$i/conf.d/
+                fi
+                if [ ! -e /etc/$i/conf.d/spip.conf ]; then
+                        ln -s /etc/spip/apache.conf \
+                        /etc/$i/conf.d/spip.conf
+                        if [ -f /etc/init.d/$i ]; then
+                                if which invoke-rc.d >/dev/null 2>&1; then
+                                        invoke-rc.d $i reload
+                                else
+                                        /etc/init.d/$i reload
+                                fi
+                        fi
+                fi
+             else
+                if [ ! -d /etc/cherokee/sites-available/ ]; then
+                        install -d -m755 /etc/cherokee/sites-available/
+                fi
+                if [ ! -e /etc/cherokee/sites-available/spip ]; then
+                        ln -s /etc/spip/cherokee.conf \
+                        /etc/cherokee/sites-available/spip
+                        if [ -f /etc/init.d/$i ]; then
+                                if which invoke-rc.d >/dev/null 2>&1; then
+                                        invoke-rc.d $i reload
+                                else
+                                        /etc/init.d/$i reload
+                                fi
+                        fi
+                fi
+             fi
+        done
+
+	chown -R www-data /var/lib/spip/sites/default/IMG
+	chown -R www-data /var/lib/spip/sites/default/tmp
+	chown -R www-data /var/lib/spip/sites/default/local
+	chown -R www-data /var/lib/spip/sites/default/config
+	chown -R www-data /var/lib/spip/plugins
+	chown -R www-data /var/lib/spip/local
+	chown -R www-data /var/lib/spip/IMG
+
+    ;;
+
+    abort-upgrade|abort-remove|abort-deconfigure)
+
+    ;;
+
+    *)
+        echo "postinst called with unknown argument \`$1'" >&2
+        exit 1
+    ;;
+esac
+
+# dh_installdeb will replace this with shell code automatically
+# generated by other debhelper scripts.
+
+#DEBHELPER#
+
+exit 0
+
+
--- spip-2.1.1.orig/debian/postrm
+++ spip-2.1.1/debian/postrm
@@ -0,0 +1,24 @@
+#! /bin/sh
+# postrm script for spip
+#
+# see: dh_installdeb(1)
+
+set -e
+
+if [ -f /usr/share/debconf/confmodule ]; then
+. /usr/share/debconf/confmodule
+fi
+
+case "$1" in
+    purge)
+        rm -rf /etc/spip /var/lib/spip /etc/apache*/conf.d/spip.conf  /etc/cherokee/sites-available/spip
+    ;;
+    *)
+    ;;
+esac
+
+
+#DEBHELPER#
+
+exit 0
+
--- spip-2.1.1.orig/debian/dirs
+++ spip-2.1.1/debian/dirs
@@ -0,0 +1,5 @@
+var/lib/spip/sites/default/squelettes
+var/lib/spip/plugins
+var/lib/spip/local
+var/lib/spip/IMG
+var/lib/spip/themes
--- spip-2.1.1.orig/debian/rules
+++ spip-2.1.1/debian/rules
@@ -0,0 +1,50 @@
+#!/usr/bin/make -f
+  
+include /usr/share/cdbs/1/rules/debhelper.mk
+include /usr/share/cdbs/1/rules/patchsys-quilt.mk
+
+# In order to regenerate 'debian/control' :
+#   DEB_AUTO_UPDATE_DEBIAN_CONTROL=yes fakeroot debian/rules clean
+# Then check manually if everything's ok
+
+binary-install/spip::
+	# Link files from usr/share
+	find debian/spip/usr/share/spip -maxdepth 1 -mindepth 1 | \
+	while read i; do \
+		dh_link "`echo "$$i" | sed -e s#debian/spip/##`" \
+		"`echo "$$i" | sed -e s#debian/spip/usr/share/spip/#var/lib/spip/#`"; \
+	done
+	# Now the same from var/lib
+	dh_link var/lib/spip/squelettes-dist usr/share/spip/squelettes-dist
+	dh_link var/lib/spip/sites usr/share/spip/sites
+	dh_link var/lib/spip/plugins usr/share/spip/plugins
+	dh_link var/lib/spip/local usr/share/spip/local
+	dh_link var/lib/spip/IMG usr/share/spip/IMG
+	dh_link var/lib/spip/themes usr/share/spip/themes
+	# Some files whose rights are incorrect..
+	chmod -x $(CURDIR)/debian/spip/usr/share/spip/prive/images/rien.gif
+	chmod -x $(CURDIR)/debian/spip/var/lib/spip/squelettes-dist/spip.ico
+	chmod -x $(CURDIR)/debian/spip/var/lib/spip/squelettes-dist/impression.css
+	chmod -x $(CURDIR)/debian/spip/var/lib/spip/squelettes-dist/habillage.css
+	chmod -x $(CURDIR)/debian/spip/var/lib/spip/squelettes-dist/polices/dustismo.ttf
+	chmod -x $(CURDIR)/debian/spip/usr/share/spip/ecrire/lang/public_br.php
+	chmod -x $(CURDIR)/debian/spip/var/lib/spip/squelettes-dist/polices/dustismo_bold.ttf
+	chmod -x $(CURDIR)/debian/spip/usr/share/spip/ecrire/public/vertebrer.php
+	chmod -x $(CURDIR)/debian/spip/usr/share/spip/extensions/vertebres/public/vertebrer.php
+	chmod -x $(CURDIR)/debian/spip/usr/share/spip/prive/images/cfg-16.png 
+	chmod +x $(CURDIR)/debian/spip/usr/sbin/*
+	# Some files that must be removed..
+	for i in remove.txt license.txt gnu_lgpl_fr.txt gpl_fr.txt dustismo-license.txt readme-SPIP.txt readme.txt; do \
+	  find debian/spip -name "$$i" -exec rm {} \; ; \
+	done
+	# Use packaged jquery
+	find debian/spip -name jquery.js | while read i; do \
+	  rm -f "$$i"; dh_link usr/share/javascript/jquery/jquery.js \
+	  "`echo $$i | sed -e 's#debian/spip/##'`"; \
+	done
+	rm -f $(CURDIR)/debian/spip/usr/share/spip/mutualisation/synchronisons.ksh
+	rm -f $(CURDIR)/debian/spip/usr/share/spip/mutualisation/mes_options.php.txt
+
+clean::
+	debconf-updatepo
+
--- spip-2.1.1.orig/debian/changelog
+++ spip-2.1.1/debian/changelog
@@ -0,0 +1,338 @@
+spip (2.1.1-3squeeze8) squeeze; urgency=medium
+
+  * Document fixed #729172
+  * Document CVE in previous changelog entries
+  * Fix XSS on signature from author [CVE-2013-7303] (Closes: #736170)
+
+ -- David Prévot <taffit@debian.org>  Mon, 20 Jan 2014 14:42:46 -0400
+
+spip (2.1.1-3squeeze7) squeeze-security; urgency=high
+
+  * Fix upstream version in previous changelog entry
+  * Backport patches from 2.1.24
+    - Fix CSRF on logout [CVE-2013-4555]
+    - Fix XSS on author page [CVE-2013-4556]
+  * Update security screen to 1.1.8
+    - Avoid PHP injection in $connect [CVE-2013-4557]
+    (Closes: #729172)
+
+ -- David Prévot <taffit@debian.org>  Sat, 02 Nov 2013 13:13:30 -0400
+
+spip (2.1.1-3squeeze6) squeeze-security; urgency=high
+
+  * Update security screen to 1.1.7, prevent abusive inscription.
+  * Backport patch from 2.1.22:
+    - fix privilege escalation. Closes: #709674 [CVE-2013-2118]
+  * fix_XSS_in_variable_name.patch: Document bug number.
+
+ -- David Prévot <taffit@debian.org>  Sat, 25 May 2013 09:25:46 -0400
+
+spip (2.1.1-3squeeze5) stable; urgency=low
+
+  * Fix base name disclosure. Closes: #683667
+
+ -- David Prévot <taffit@debian.org>  Thu, 02 Aug 2012 14:27:29 -0400
+
+spip (2.1.1-3squeeze4) stable; urgency=low
+
+  * Updated security screen to 1.1.3. Prevent cross site scripting on referer
+    (addresses missing bits of [CVE-2012-2151]), cross site scripting and PHP
+    injections in internal functions. Closes: #680118
+  * Backport patch from 2.1.14:
+    - fix XSS on password. Closes: #672961
+  * Backport patch from 2.1.15:
+    - fix XSS injection in variable name. Closes: #677290
+
+ -- David Prévot <taffit@debian.org>  Sat, 28 Jul 2012 15:54:52 -0400
+
+spip (2.1.1-3squeeze3) stable-security; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * Updated security screen. Prevent several cross site scripting.
+  * Backport patches from 2.1.7:
+    - fix absolute redirection in actions;
+    - fix PHP injection via lang form.
+  * Backport patch from 2.1.8:
+    - fix XSS on action=converser.
+  * Backport patches from 2.1.11:
+    - fix configuration available to writers;
+    - fix XSS injection via prive/cfg.html;
+    - fix blocked server with action=tester_taille call.
+  * Backport patches from 2.1.13:
+    - fix open redirect on logout;
+    - fix arbitrary password change;
+    - fix XSS on referer.
+  Closes: #670110
+
+ -- David Prévot <taffit@debian.org>  Mon, 23 Apr 2012 17:37:13 -0400
+
+spip (2.1.1-3squeeze2) stable-security; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * Updated security screen. Prevent a cross site scripting.
+  * Backport patches from 2.1.12. Fixes a privilege escalation and a cross
+    site scripting.
+  Closes: #649113
+
+ -- David Prévot <taffit@debian.org>  Thu, 17 Nov 2011 22:08:36 -0400
+
+spip (2.1.1-3squeeze1) stable-security; urgency=high
+
+  * Updated security screen. Fixes a vulnerability 
+    that enabled a connected author to disconnect 
+    the website from its database. 
+
+ -- Romain Beauxis <toots@rastageeks.org>  Thu, 14 Apr 2011 11:04:36 -0500
+
+spip (2.1.1-3) unstable; urgency=high
+
+  * Added security screen file (ecran_securite.php).
+  Fixes all known security issues in spip.
+  Closes: #609212, Closes: #610016
+
+ -- Romain Beauxis <toots@rastageeks.org>  Tue, 18 Jan 2011 14:01:35 -0600
+
+spip (2.1.1-2) unstable; urgency=high
+
+  * Added patch to fix int overflow
+    in articles' published date.
+    Thanks to David Prévot for reporting.
+  Closes: #597026 
+
+ -- Romain Beauxis <toots@rastageeks.org>  Sat, 18 Sep 2010 15:08:53 -0500
+
+spip (2.1.1-1) unstable; urgency=low
+
+  * New upstream release.
+  * Bumped standards to 3.9.0 
+
+ -- Romain Beauxis <toots@rastageeks.org>  Tue, 03 Aug 2010 15:29:14 -0500
+
+spip (2.1-6) unstable; urgency=low
+
+  * There is no need to add a link to common/ in
+    each site's plugin directory. 
+
+ -- Romain Beauxis <toots@rastageeks.org>  Wed, 23 Jun 2010 02:03:09 +0200
+
+spip (2.1-5) unstable; urgency=high
+
+  * Added es.po debconf translation, thanks to
+    Ricardo Fraile.
+  Closes: #580617 
+  * Fixed safehtml class instantiation to 
+    use the packaged one. This issue lead 
+    to failures so setting priority to 
+    high to propagate quickly.
+
+ -- Romain Beauxis <toots@rastageeks.org>  Sat, 05 Jun 2010 22:25:18 -0500
+
+spip (2.1-4) unstable; urgency=low
+
+  * Added a themes/ directory to install optional themes. 
+  * Removed special chmod.php file not needed after the changes
+    in the previous upload.
+  * Now multisite can be defined using regexp.
+  * Install missing extensions/
+  * Added debian/watch.
+
+ -- Romain Beauxis <toots@rastageeks.org>  Tue, 04 May 2010 11:05:59 -0500
+
+spip (2.1-3) unstable; urgency=low
+
+  * Fixed default rights for created directories and files.
+  * Fixed default directory for automatically installed plugins.
+  * Enabled short images option by default. 
+
+ -- Romain Beauxis <toots@rastageeks.org>  Thu, 29 Apr 2010 17:47:04 -0500
+
+spip (2.1-2) unstable; urgency=low
+
+  * Fixed plugins and mutualisation: the variable 
+    _DIR_PLUGINS in mes_options.php is now called
+    _DIR_PLUGINS_SUPPL
+  * Fixed url_img_courtes. Thanks to David Prévot
+    for reporting and proposing a patch.
+  Closes: #577274
+
+ -- Romain Beauxis <toots@rastageeks.org>  Fri, 16 Apr 2010 17:14:11 -0500
+
+spip (2.1-1) experimental; urgency=low
+
+  * New upstream release.
+  * Removed safehtml patch, replaced by a symlink.
+  * Bumped standards to 3.8.4 
+  * There is a bug with the mutualisation
+    and the plugins so uploading to experimental for now..
+
+ -- Romain Beauxis <toots@rastageeks.org>  Mon, 12 Apr 2010 02:44:56 +0200
+
+spip (2.0.10-1) unstable; urgency=low
+
+  * New upstream release. 
+  * Bumped standards version to 3.8.3
+
+ -- Romain Beauxis <toots@rastageeks.org>  Thu, 05 Nov 2009 16:08:03 -0600
+
+spip (2.0.9-1) unstable; urgency=high
+
+  * New upstream release, fixing security issue.
+  See: http://www.spip-contrib.net/SPIP-Security-Alert-new-version
+  for more details.
+
+ -- Romain Beauxis <toots@rastageeks.org>  Sun, 09 Aug 2009 11:13:15 -0500
+
+spip (2.0.8-3) unstable; urgency=low
+
+  * Fixed bashism in spip_rm_site script.
+  Closes: #535885
+
+ -- Romain Beauxis <toots@rastageeks.org>  Fri, 31 Jul 2009 02:26:58 +0200
+
+spip (2.0.8-2) unstable; urgency=low
+
+  * Fix bashism in spip_add_site
+  Closes: #530193
+  * Added description of what exactly is SPIP
+    in long description.
+  Closes: #521682
+
+ -- Romain Beauxis <toots@rastageeks.org>  Fri, 19 Jun 2009 01:24:03 +0200
+
+spip (2.0.8-1) unstable; urgency=low
+
+  * New upstream release. 
+  * Bumped standards version to 3.8.2
+  * Bumped compat to 7
+
+ -- Romain Beauxis <toots@rastageeks.org>  Mon, 08 Jun 2009 17:40:44 +0200
+
+spip (2.0.7-1) unstable; urgency=high
+
+  * New upstream release.
+  * This release fixes security issues, hence setting
+    urgency to high. 
+  * Added extra security options for apache2.conf 
+
+ -- Romain Beauxis <toots@rastageeks.org>  Wed, 15 Apr 2009 23:34:13 -0400
+
+spip (2.0.6-2) unstable; urgency=low
+
+  * Fixed alias in apache.conf. 
+
+ -- Romain Beauxis <toots@rastageeks.org>  Wed, 18 Mar 2009 09:07:33 +0100
+
+spip (2.0.6-1) unstable; urgency=low
+
+  * New upstream release.
+  * Initial upload to unstable. 
+
+ -- Romain Beauxis <toots@rastageeks.org>  Tue, 17 Mar 2009 20:05:14 +0100
+
+spip (2.0.5-1) experimental; urgency=low
+
+  * New upstream version.
+  * Should upload to unstable quite soon.
+
+ -- Romain Beauxis <toots@rastageeks.org>  Fri, 06 Mar 2009 20:06:46 +0100
+
+spip (2.0.3-1) experimental; urgency=low
+
+  * New upstream release. 
+  * Added Italian debconf translations, thanks to Vincenzo Campanella !
+  Closes: #510291
+  * Added Basque debconf translations, thanks to Piarres Beobide !
+  Closes: #510299
+  * Added Czech debconf translations, thanks to Martin Šín !
+  Closes: #510301
+  * Added Swedish debconf translations, thanks to Martin Bagge !
+  Closes: #510302
+  * Added Finnish debconf translations, thanks to Esko Arajärvi !
+  Closes: #510384
+  * Added Galician debconf translations, thanks to Marce Villarino !
+  Closes: #510391
+  * Added German debconf translations, thanks to Helge Kreutzmann !
+  Closes: #510541
+  * Added Portuguese debconf translations, thanks to Miguel Figueiredo !
+  Closes: #510640
+  * Added Japanese debconf translations, thanks to Hideki Yamane !
+  Closes: #510892
+  * Added French debconf translations, thanks to Jean Guillou !
+  Closes: #511008
+  * Added Russian debconf translations, thanks to Yuri Kozlov !
+  Closes: #512165
+
+ -- Romain Beauxis <toots@rastageeks.org>  Sun, 18 Jan 2009 22:00:35 +0100
+
+spip (2.0.2-1) experimental; urgency=low
+
+  * New upstream release. 
+
+ -- Romain Beauxis <toots@rastageeks.org>  Wed, 31 Dec 2008 04:18:22 +0100
+
+spip (2.0.0-1) experimental; urgency=low
+
+  * First release of the 2.0 branch ! 
+  * Moved dist/ to squelettes-dist/, added preinst
+    maintainer script to handle that when upgrading
+    from previous package.
+  * Updated debian/copyright with GPL version 3 or above.
+
+ -- Romain Beauxis <toots@rastageeks.org>  Sat, 13 Dec 2008 03:25:47 +0100
+
+spip (2.0.0~beta12262-2) experimental; urgency=low
+
+  * Fixed safehtml inclusion patch 
+
+ -- Romain Beauxis <toots@rastageeks.org>  Tue, 19 Aug 2008 11:56:54 +0200
+
+spip (2.0.0~beta12262-1) experimental; urgency=low
+
+  * New upstream release, first beta for 2.0.0 release
+  * Added options details for mes_options.php
+  * Added apache2.conf virtual host configuration file example
+  * Depends and use libjs-jquery instead of shipped one
+  * Partially fixed default mod for created file
+
+ -- Romain Beauxis <toots@rastageeks.org>  Thu, 31 Jul 2008 01:34:34 +0200
+
+spip (1.9.3~svn12054-1) experimental; urgency=low
+
+  * New upstream release.
+  * Updated standards version.
+
+ -- Romain Beauxis <toots@rastageeks.org>  Sun, 13 Jul 2008 17:18:06 +0200
+
+spip (1.9.3~svn11347-2) experimental; urgency=low
+
+  * Added plugins support and directories 
+
+ -- Romain Beauxis <toots@rastageeks.org>  Thu, 27 Mar 2008 12:16:26 +0100
+
+spip (1.9.3~svn11347-1) experimental; urgency=low
+
+  * New svn snapshot
+  * Added recommends to image conversion tools supported.
+
+ -- Romain Beauxis <toots@rastageeks.org>  Tue, 29 Jan 2008 02:49:10 +0100
+
+spip (1.9.3~svn11152-1) experimental; urgency=low
+
+  * New upstream release
+  * Updated standards to 3.7.3
+
+ -- Romain Beauxis <toots@rastageeks.org>  Tue, 29 Jan 2008 02:38:39 +0100
+
+spip (1.9.3~svn10413-2) experimental; urgency=low
+
+  * Patched source to work with php-html-safe 
+
+ -- Romain Beauxis <toots@rastageeks.org>  Wed, 10 Oct 2007 02:58:22 +0200
+
+spip (1.9.3~svn10413-1) experimental; urgency=low
+
+  * Initial release (Closes: #426069)
+  * Temporaly removed file HTMLSax3.php
+
+ -- Romain Beauxis <toots@rastageeks.org>  Tue, 25 Sep 2007 00:31:03 +0200
+
--- spip-2.1.1.orig/debian/watch
+++ spip-2.1.1/debian/watch
@@ -0,0 +1,4 @@
+version=3
+
+opts=uversionmangle=s/-/./;s/\.0$// \
+http://files.spip.org/spip/archives/SPIP-v([0-9.-]*)\.zip
--- spip-2.1.1.orig/debian/custom/mes_options.php
+++ spip-2.1.1/debian/custom/mes_options.php
@@ -0,0 +1,22 @@
+<?php
+    require '/var/lib/spip/mutualisation/mutualiser.php';
+    require '/etc/spip/multisite.php';
+    $site = spip_get_site($_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI']);
+    define('_DIR_PLUGINS_SUPPL', _DIR_RACINE . "sites/$site/plugins/");
+    define('_DIR_PLUGINS_AUTO', _DIR_RACINE . "sites/$site/plugins/auto/");
+    demarrer_site($site
+     // See http://www.spip-contrib.net/La-mutualisation-facile
+     // for complete parameters definitions
+     ,array(
+     //   'creer_site' => true,
+     //   'creer_base' => true,
+     //   'code' => 'plouf',
+     //   Enable the following for having links to
+     //   images as '/IMG/jpg/image.jpg' instead of
+     //   '/sites/spip.domain.org/IMG/jpg/image.jpg'
+          'url_img_courtes' => true,
+     //   'creer_user_base' => true,
+     //   'mail' => 'admmin@spip.domain.org'
+         )   
+     );
+?>
--- spip-2.1.1.orig/debian/custom/spip_rm_site
+++ spip-2.1.1/debian/custom/spip_rm_site
@@ -0,0 +1,25 @@
+#!/bin/sh
+
+set -e
+
+SITE=$1
+
+# Script to add a site to spip
+if [ "$SITE" = "" ]; then 
+  echo "Usage: spip-rm-site site"
+  exit 1
+fi
+
+if [ "`whoami`" != "root" ]; then
+   echo "This script must be run by root!"
+   exit 1
+fi
+
+echo "Deleting site $SITE...."
+
+rm -rf /var/lib/spip/sites/$SITE
+rm -rf  /etc/spip/sites/$SITE.php 
+
+echo "Directories and files removed"
+exit 0
+
--- spip-2.1.1.orig/debian/custom/spip_add_site
+++ spip-2.1.1/debian/custom/spip_add_site
@@ -0,0 +1,54 @@
+#!/bin/sh
+
+set -e
+
+SITE=$1
+
+# Script to add a site to spip
+if [ "$SITE" = "" ]; then 
+  echo "Usage: spip-add-site site"
+  exit 1
+fi
+
+if [ "`whoami`" != "root" ]; then
+   echo "This script must be run by root!"
+   exit 1
+fi
+
+if [ -d "/var/lib/spip/sites/$SITE" ]; then
+   echo "/var/lib/spip/sites/$SITE already exists"
+   exit 1
+fi 
+
+if [ -f "/etc/spip/sites/$SITE.php" ]; then
+  echo "/etc/spip/sites/$SITE.php already exists"
+  exit 1
+fi
+
+echo "Creating site $SITE..."
+
+mkdir -p /var/lib/spip/sites/$SITE/IMG
+chown www-data /var/lib/spip/sites/$SITE/IMG
+mkdir -p /var/lib/spip/sites/$SITE/tmp
+chown www-data /var/lib/spip/sites/$SITE/tmp
+mkdir -p /var/lib/spip/sites/$SITE/local
+chown www-data /var/lib/spip/sites/$SITE/local
+mkdir -p /var/lib/spip/sites/$SITE/config
+chown www-data /var/lib/spip/sites/$SITE/config 
+mkdir -p /var/lib/spip/sites/$SITE/squelettes
+chown www-data /var/lib/spip/sites/$SITE/squelettes
+mkdir -p /var/lib/spip/sites/$SITE/plugins
+chown www-data /var/lib/spip/sites/$SITE/plugins
+
+cat >| /etc/spip/sites/$SITE.php << END
+<?php
+
+\$GLOBALS['spip_sites']['$SITE'] = array('$SITE');
+
+?>
+END
+
+echo "Directories and files created, you may add hosts for this site in:"
+echo "   /etc/spip/sites/$SITE.php"
+exit 0
+
--- spip-2.1.1.orig/debian/po/cs.po
+++ spip-2.1.1/debian/po/cs.po
@@ -0,0 +1,33 @@
+# Czech translation of spip templates.
+# Copyright (C) 2008
+# This file is distributed under the same license as the spip package.
+# Martin Sin <martin.sin@zshk.cz>, 2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: spip 2.0.2-1\n"
+"Report-Msgid-Bugs-To: spip-maintainers@lists.alioth.debian.org\n"
+"POT-Creation-Date: 2007-05-30 02:31+0200\n"
+"PO-Revision-Date: 2008-12-31 09:45+01000\n"
+"Last-Translator: Martin Sin <martin.sin@zshk.cz>\n"
+"Language-Team: Czech <debian-l10n-czech@lists.debian.org>\n"
+"Language: cs\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid "Web server(s) to configure automatically:"
+msgstr "Webový server(y) pro automatickou konfiguraci:"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid ""
+"Please select the web server(s) that should be configured automatically for "
+"spip."
+msgstr ""
+"Zadejte prosím webový server(y), který bude automaticky nastaven pro práci "
+"se spip."
--- spip-2.1.1.orig/debian/po/it.po
+++ spip-2.1.1/debian/po/it.po
@@ -0,0 +1,34 @@
+# ITALIAN TRANSLATION OF SPIP'S.PO-DEBCONF FILE
+# COPYRIGHT (C) 2007 THE SPIP'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the spip package.
+#
+# Vincenzo Campanella <vinz65@gmail.com>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: it\n"
+"Report-Msgid-Bugs-To: spip-maintainers@lists.alioth.debian.org\n"
+"POT-Creation-Date: 2007-05-30 02:31+0200\n"
+"PO-Revision-Date: 2008-12-31 06:24+0100\n"
+"Last-Translator: Vincenzo Campanella <vinz65@gmail.com>\n"
+"Language-Team: Italian <tp@lists.linux.it>\n"
+"Language: it\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid "Web server(s) to configure automatically:"
+msgstr "Server web da configurare automaticamente:"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid ""
+"Please select the web server(s) that should be configured automatically for "
+"spip."
+msgstr ""
+"Selezionare il o i server web che devono essere configurati automaticamente "
+"per spip."
--- spip-2.1.1.orig/debian/po/ru.po
+++ spip-2.1.1/debian/po/ru.po
@@ -0,0 +1,36 @@
+# translation of ru.po to Russian
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Yuri Kozlov <yuray@komyakino.ru>, 2009.
+msgid ""
+msgstr ""
+"Project-Id-Version: spip 2.0.2-1\n"
+"Report-Msgid-Bugs-To: spip-maintainers@lists.alioth.debian.org\n"
+"POT-Creation-Date: 2007-05-30 02:31+0200\n"
+"PO-Revision-Date: 2009-01-18 08:41+0300\n"
+"Last-Translator: Yuri Kozlov <yuray@komyakino.ru>\n"
+"Language-Team: Russian <debian-l10n-russian@lists.debian.org>\n"
+"Language: ru\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms:  nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n"
+"%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid "Web server(s) to configure automatically:"
+msgstr "Веб-сервер(ы) для автоматической настройки:"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid ""
+"Please select the web server(s) that should be configured automatically for "
+"spip."
+msgstr ""
+"Выберите веб-сервер(ы), который нужно автоматически настроить для работы "
+"spip."
--- spip-2.1.1.orig/debian/po/gl.po
+++ spip-2.1.1/debian/po/gl.po
@@ -0,0 +1,34 @@
+# translation of templates.pot_[AwmvGa].po to galician
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Marce Villarino <mvillarino@users.sourceforge.net>, 2009.
+msgid ""
+msgstr ""
+"Project-Id-Version: templates.pot_[AwmvGa]\n"
+"Report-Msgid-Bugs-To: spip-maintainers@lists.alioth.debian.org\n"
+"POT-Creation-Date: 2007-05-30 02:31+0200\n"
+"PO-Revision-Date: 2009-01-01 12:35+0100\n"
+"Last-Translator: Marce Villarino <mvillarino@users.sourceforge.net>\n"
+"Language-Team: galician <proxecto@trasno.net>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms: nplurals=2; plural=n != 1;\n"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid "Web server(s) to configure automatically:"
+msgstr "Servidor(es) web a configurar automaticamente:"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid ""
+"Please select the web server(s) that should be configured automatically for "
+"spip."
+msgstr ""
+"Escolla o servidor(es) web que debe configurarse automaticamente para spip."
--- spip-2.1.1.orig/debian/po/de.po
+++ spip-2.1.1/debian/po/de.po
@@ -0,0 +1,32 @@
+# Translation of spip debconf templates to German
+# Copyright (C) Helge Kreutzmann <debian@helgefjell.de>, 2009.
+# This file is distributed under the same license as the spip package.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: spip 2.0.2-1\n"
+"Report-Msgid-Bugs-To: spip-maintainers@lists.alioth.debian.org\n"
+"POT-Creation-Date: 2007-05-30 02:31+0200\n"
+"PO-Revision-Date: 2009-01-02 21:56+0100\n"
+"Last-Translator: Helge Kreutzmann <debian@helgefjell.de>\n"
+"Language-Team: de <debian-l10n-german@lists.debian.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid "Web server(s) to configure automatically:"
+msgstr "Web-Server, der/die automatisch konfiguriert werden soll(en):"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid ""
+"Please select the web server(s) that should be configured automatically for "
+"spip."
+msgstr ""
+"Bitte wählen Sie den/die Webserver, die automatisch für Spip konfiguriert "
+"werden sollen."
--- spip-2.1.1.orig/debian/po/pt.po
+++ spip-2.1.1/debian/po/pt.po
@@ -0,0 +1,34 @@
+# translation of spip debconf to Portuguese
+# Copyright (C) 2008 the spip's copyright holder
+# This file is distributed under the same license as the spip package.
+#
+# Américo Monteiro <a_monteiro@netcabo.pt>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: spip 2.0.2-1\n"
+"Report-Msgid-Bugs-To: spip-maintainers@lists.alioth.debian.org\n"
+"POT-Creation-Date: 2007-05-30 02:31+0200\n"
+"PO-Revision-Date: 2008-12-31 17:12+0000\n"
+"Last-Translator: Américo Monteiro <a_monteiro@netcabo.pt>\n"
+"Language-Team: Portuguese <traduz@debianpt.org>\n"
+"Language: pt\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid "Web server(s) to configure automatically:"
+msgstr "Servidor(es) Web a configurar automaticamente:"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid ""
+"Please select the web server(s) that should be configured automatically for "
+"spip."
+msgstr ""
+"Por favor seleccione o(s) servidor(es) Web a serem configurados "
+"automaticamente para o spip."
--- spip-2.1.1.orig/debian/po/sv.po
+++ spip-2.1.1/debian/po/sv.po
@@ -0,0 +1,34 @@
+# translation of spip.po to swedish
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Martin Bagge <brother@bsnet.se>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: spip\n"
+"Report-Msgid-Bugs-To: spip-maintainers@lists.alioth.debian.org\n"
+"POT-Creation-Date: 2007-05-30 02:31+0200\n"
+"PO-Revision-Date: 2008-12-31 10:00+0100\n"
+"Last-Translator: Martin Bagge <brother@bsnet.se>\n"
+"Language-Team: swedish <debian-l10n-swedish@lists.debian.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid "Web server(s) to configure automatically:"
+msgstr "Webservrar att ställa in automatiskt:"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid ""
+"Please select the web server(s) that should be configured automatically for "
+"spip."
+msgstr ""
+"Välj den eller de webbservrar som automatiskt ska ställas in så att spip kan "
+"användas."
--- spip-2.1.1.orig/debian/po/POTFILES.in
+++ spip-2.1.1/debian/po/POTFILES.in
@@ -0,0 +1 @@
+[type: gettext/rfc822deb] templates
--- spip-2.1.1.orig/debian/po/templates.pot
+++ spip-2.1.1/debian/po/templates.pot
@@ -0,0 +1,31 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: spip-maintainers@lists.alioth.debian.org\n"
+"POT-Creation-Date: 2007-05-30 02:31+0200\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=CHARSET\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid "Web server(s) to configure automatically:"
+msgstr ""
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid ""
+"Please select the web server(s) that should be configured automatically for "
+"spip."
+msgstr ""
--- spip-2.1.1.orig/debian/po/es.po
+++ spip-2.1.1/debian/po/es.po
@@ -0,0 +1,54 @@
+# spip po-debconf translation to Spanish
+# Copyright (C) 2010 Software in the Public Interest
+# This file is distributed under the same license as the spip package.
+#
+# Changes:
+#   - Initial translation
+#       Ricardo Fraile <rikr@esdebian.org>, 2010
+#
+# Traductores, si no conocen el formato PO, merece la pena leer la
+# documentación de gettext, especialmente las secciones dedicadas a este
+# formato, por ejemplo ejecutando:
+#       info -n '(gettext)PO Files'
+#       info -n '(gettext)Header Entry'
+#
+# Equipo de traducción al español, por favor lean antes de traducir
+# los siguientes documentos:
+#
+#   - El proyecto de traducción de Debian al español
+#     http://www.debian.org/intl/spanish/
+#     especialmente las notas y normas de traducción en
+#     http://www.debian.org/intl/spanish/notas
+#
+#   - La guía de traducción de po's de debconf:
+#     /usr/share/doc/po-debconf/README-trans
+#     o http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: spip 2.0.10-1\n"
+"Report-Msgid-Bugs-To: spip-maintainers@lists.alioth.debian.org\n"
+"POT-Creation-Date: 2007-05-30 02:31+0200\n"
+"PO-Revision-Date: 2010-04-15 10:52+0200\n"
+"Last-Translator: Ricardo Fraile <rikr@esdebian.org>\n"
+"Language-Team: Spanish <debian-l10n-spanish@lists.debian.org>\n"
+"Language: es\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid "Web server(s) to configure automatically:"
+msgstr "Servidores web que se van a configurar automáticamente:"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid ""
+"Please select the web server(s) that should be configured automatically for "
+"spip."
+msgstr ""
+"Por favor, seleccione los servidores web que se deben configurar "
+"automáticamente paraspip."
--- spip-2.1.1.orig/debian/po/eu.po
+++ spip-2.1.1/debian/po/eu.po
@@ -0,0 +1,34 @@
+# translation of spip-eu.po to Euskara
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Piarres Beobide <pi@beobide.net>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: spip-eu\n"
+"Report-Msgid-Bugs-To: spip-maintainers@lists.alioth.debian.org\n"
+"POT-Creation-Date: 2007-05-30 02:31+0200\n"
+"PO-Revision-Date: 2008-12-31 09:04+0100\n"
+"Last-Translator: Piarres Beobide <pi@beobide.net>\n"
+"Language-Team: Euskara <debian-l10n-basque@lists.debian.org>\n"
+"Language: \n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid "Web server(s) to configure automatically:"
+msgstr "Automatikoki konfiguratzeko web-zerbitzaria(k):"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid ""
+"Please select the web server(s) that should be configured automatically for "
+"spip."
+msgstr ""
+"Mesedez hautatu automatikoki konfiguratu spip-rentzat behar den web-"
+"zerbitzaria(k)."
--- spip-2.1.1.orig/debian/po/ja.po
+++ spip-2.1.1/debian/po/ja.po
@@ -0,0 +1,32 @@
+# Copyright (C) 2009 SPIP packaging team <spip-maintainers@lists.alioth.debian.org>
+# This file is distributed under the same license as the spip package.
+# Hideki Yamane (Debian-JP) <henrich@debian.or.jp>, 2009.
+# 
+msgid ""
+msgstr ""
+"Project-Id-Version: spip 2.0.2-1\n"
+"Report-Msgid-Bugs-To: spip-maintainers@lists.alioth.debian.org\n"
+"POT-Creation-Date: 2007-05-30 02:31+0200\n"
+"PO-Revision-Date: 2009-01-02 22:26+0900\n"
+"Last-Translator: Hideki Yamane (Debian-JP) <henrich@debian.or.jp>\n"
+"Language-Team: Japanese <debian-japanese@lists.debian.org>\n"
+"Language: ja\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid "Web server(s) to configure automatically:"
+msgstr "自動的に設定するウェブサーバ:"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid ""
+"Please select the web server(s) that should be configured automatically for "
+"spip."
+msgstr ""
+"spip に対して自動的に設定が行われます。設定の必要なウェブサーバを選んでくださ"
+"い。"
--- spip-2.1.1.orig/debian/po/fi.po
+++ spip-2.1.1/debian/po/fi.po
@@ -0,0 +1,30 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: spip\n"
+"Report-Msgid-Bugs-To: spip-maintainers@lists.alioth.debian.org\n"
+"POT-Creation-Date: 2007-05-30 02:31+0200\n"
+"PO-Revision-Date: \n"
+"Last-Translator: Esko Arajärvi <edu@iki.fi>\n"
+"Language-Team: Finnish <debian-l10n-finnish@lists.debian.org>\n"
+"Language: fi\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Poedit-Language: Finnish\n"
+"X-Poedit-Country: FINLAND\n"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid "Web server(s) to configure automatically:"
+msgstr "Verkkopalvelimet, joiden asetuksia muokataan automaattisesti:"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid ""
+"Please select the web server(s) that should be configured automatically for "
+"spip."
+msgstr ""
+"Valitse verkkopalvelimet, joiden asetuksia tulisi automaattisesti muokata "
+"ohjelmaa spip varten."
--- spip-2.1.1.orig/debian/po/fr.po
+++ spip-2.1.1/debian/po/fr.po
@@ -0,0 +1,35 @@
+# spip debconf screens: French translation.
+# Copyright (C) 2009, Debian French l10n team <debian-l10n-french@lists.debian.org>
+# This file is distributed under the same license as the spip package.
+#
+# Translators:
+# Jean Guillou <guillou.jean@free.fr>, 2009.
+msgid ""
+msgstr ""
+"Project-Id-Version: templates\n"
+"Report-Msgid-Bugs-To: spip-maintainers@lists.alioth.debian.org\n"
+"POT-Creation-Date: 2007-05-30 02:31+0200\n"
+"PO-Revision-Date: 2009-01-04 19:41+0100\n"
+"Last-Translator: Jean Guillou <guillou.jean@free.fr>\n"
+"Language-Team: French <debian-l10n-french@lists.debian.org>\n"
+"Language: fr\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms:  nplurals=2; plural=(n > 1);\n"
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid "Web server(s) to configure automatically:"
+msgstr "Serveur(s) web à configurer automatiquement : "
+
+#. Type: multiselect
+#. description
+#: ../templates:1001
+msgid ""
+"Please select the web server(s) that should be configured automatically for "
+"spip."
+msgstr ""
+"Veuillez choisir le(s) serveur(s) web à configurer automatiquement pour spip."
--- spip-2.1.1.orig/debian/patches/fix_php_injection_form_lang.patch
+++ spip-2.1.1/debian/patches/fix_php_injection_form_lang.patch
@@ -0,0 +1,35 @@
+From: Cédric Morin <cedric.morin@yterium.com>
+Subject: PHP injection via lang form
+
+* ecrire/public/styliser.php: Avoid wasting time looking for impossible
+  fond.
+* prive/modeles/formulaire.html: texte_script must always be used with
+  PHP #ENV in a squelette.
+  Thanks to Arnault Pachot
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/16948 http://core.spip.org/projects/spip/repository/revisions/16949
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670110
+
+--- a/ecrire/public/styliser.php
++++ b/ecrire/public/styliser.php
+@@ -21,6 +21,11 @@
+ // http://doc.spip.org/@public_styliser_dist
+ function public_styliser_dist($fond, $contexte, $lang='', $connect='', $ext='html') {
+ 
++	// s'assurer que le fond et licite
++	// car il peut etre construit a partir d'une variable d'environnement
++	if (strpos($fond,"../")!==false OR strncmp($fond,'/',1)==0)
++		$fond = "404";
++  
+ 	// Choisir entre $fond-dist.html, $fond=7.html, etc?
+ 	$id_rubrique = 0;
+ 	// Chercher le fond qui va servir de squelette
+--- a/prive/modeles/formulaire.html
++++ b/prive/modeles/formulaire.html
+@@ -1,4 +1,4 @@
+ <div><?php 
+ /* une fonction qui produit du php qui ne sera execute qu'au service final de la page */
+-echo executer_balise_dynamique('FORMULAIRE_[(#ENV{class}|strtoupper|texte_script)]',[(#ENV{args}|var_export{true})],array('','','','','#ENV{lang}'));
++echo executer_balise_dynamique('FORMULAIRE_[(#ENV{class}|strtoupper|texte_script)]',[(#ENV{args}|var_export{true})],array('','','','','[(#ENV{lang}|texte_script)]'));
+ ?></div>
+\ No newline at end of file
--- spip-2.1.1.orig/debian/patches/fix_privilege_escalation_2.1.21.patch
+++ spip-2.1.1/debian/patches/fix_privilege_escalation_2.1.21.patch
@@ -0,0 +1,22 @@
+From: Cédric Morin <cedric.morin@yterium.com>
+Subject: Fix privilege escalation
+
+* ecrire/inc/filtres.php: Fix privilege escalation on author inscription
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/20541
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=709674
+--- a/ecrire/inc/filtres.php
++++ b/ecrire/inc/filtres.php
+@@ -1515,8 +1515,10 @@
+ 	  return (($GLOBALS['meta']['accepter_visiteurs'] == 'oui' OR $GLOBALS['meta']['forums_publics'] == 'abo') ? $mode : '');
+ 
+ 	default:
+-	  if ($mode AND $mode == addslashes($mode))
+-	    return $mode;
++	  if ($mode AND $mode == addslashes($mode)){
++		include_spip("inc/autoriser");
++		return autoriser("inscrireauteur",$mode)?$mode:"";
++	  }
+ 	  if ($GLOBALS['meta']["accepter_inscriptions"] == "oui")
+ 	    return $GLOBALS['liste_des_statuts']['info_redacteurs'];
+ 	  if ($GLOBALS['meta']["accepter_visiteurs"] == "oui")
--- spip-2.1.1.orig/debian/patches/fix_privilege_escalation.patch
+++ spip-2.1.1/debian/patches/fix_privilege_escalation.patch
@@ -0,0 +1,33 @@
+From: Cédric Morin <cedric.morin@yterium.com>
+Subject: Fix privilege escalation
+
+* ecrire/action/editer_auteur.php: Verify connected author
+  privileges before modifying status (thanks to Davy Douhine).
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/18627, http://core.spip.org/projects/spip/repository/revisions/18700
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=649113
+--- a/ecrire/action/editer_auteur.php
++++ b/ecrire/action/editer_auteur.php
+@@ -170,9 +170,10 @@
+ 
+ 	
+ 	$champs = array();
+-	$statut =	$statut_ancien = sql_getfetsel('statut','spip_auteurs','id_auteur='.intval($id_auteur));
++	$statut = $statut_ancien = sql_getfetsel('statut','spip_auteurs','id_auteur='.intval($id_auteur));
+ 	
+-	if (isset($c['statut']))
++	if (isset($c['statut'])
++	AND (($statut_ancien == 'nouveau') OR autoriser('modifier', 'auteur', $id_auteur,null, array('statut' => '?'))))
+ 		$statut = $champs['statut'] = $c['statut'];
+ 
+ 	// Restreindre avant de declarer l'auteur
+@@ -184,7 +185,8 @@
+ 			$c['restreintes'] = array($c['id_parent']);
+ 	}
+ 
+-	if (isset($c['webmestre']) AND autoriser('modifier', 'auteur', $id_auteur,null, array('webmestre' => '?')))
++	if (isset($c['webmestre'])
++	  AND autoriser('modifier', 'auteur', $id_auteur,null, array('webmestre' => '?')))
+ 		$champs['webmestre'] = $c['webmestre']=='oui'?'oui':'non';
+ 	
+ 	// Envoyer aux plugins
--- spip-2.1.1.orig/debian/patches/series
+++ spip-2.1.1/debian/patches/series
@@ -0,0 +1,21 @@
+fix_int_overflow_in_published_articles_date.patch
+remove_dummy_umask.patch
+use_safehtml_packaged_class.patch
+fix_privilege_escalation.patch
+fix_XSS_in_help.patch
+avoid_spurious_redirections.patch
+fix_open_redirect_on_logout.patch
+fix_arbitrary_password_change.patch
+fix_referer_xss.patch
+fix_php_injection_form_lang.patch
+fix_XSS_injection_action_converser.patch
+fix_configuration_access_to_writers.patch
+fix_XSS_injection_via_prive_cfg.patch
+fix_blocked_server.patch
+fix_XSS_in_password.patch
+fix_XSS_in_variable_name.patch
+fix_base_disclosure.patch
+fix_privilege_escalation_2.1.21.patch
+fix_CSRF_on_logout.patch
+fix_XSS_on_author_page.patch
+fix_XSS_on_signature.patch
--- spip-2.1.1.orig/debian/patches/fix_XSS_in_help.patch
+++ spip-2.1.1/debian/patches/fix_XSS_in_help.patch
@@ -0,0 +1,19 @@
+From: Emmanuel Saint-James <esj@rezo.net>
+Subject: Fix XSS in help
+
+* ecrire/exec/aide_index.php: Fix cross site
+  scripting in help (thanks to Arnault Pachot).
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/18662
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=649113
+--- a/ecrire/exec/aide_index.php
++++ b/ecrire/exec/aide_index.php
+@@ -329,7 +329,7 @@
+ 		aide_index_frame(_request('var_lang_r'),
+ 				 _request('lang_r'),
+ 				 _request('frame'),
+-				 _request('aide'),
++				 strtr(_request('aide'),'<>"\'', '____'),
+ 				 $help_server);
+ 	} else {
+ 		list (,$server, $cache, $rep, $lang, $file, $ext) = $r;
--- spip-2.1.1.orig/debian/patches/fix_XSS_injection_action_converser.patch
+++ spip-2.1.1/debian/patches/fix_XSS_injection_action_converser.patch
@@ -0,0 +1,19 @@
+From: Cédric Morin <cedric.morin@yterium.com>
+Subject: Fix XSS injection on “action=converser”
+
+* ecrire/inc/filtres.php: Protect single quotes injected by form_hidden
+  (thanks to Davy Douhine).
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/17026
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670110
+--- a/ecrire/inc/filtres.php
++++ b/ecrire/inc/filtres.php
+@@ -1787,7 +1787,7 @@
+ 			.'"'
+ 			. (is_null($val)
+ 				? ''
+-				: ' value="'.entites_html($val).'"'
++				: ' value="'.str_replace("'","&#39;",entites_html($val)).'"'
+ 				)
+ 			. ' type="hidden" />';
+ 	}
--- spip-2.1.1.orig/debian/patches/fix_CSRF_on_logout.patch
+++ spip-2.1.1/debian/patches/fix_CSRF_on_logout.patch
@@ -0,0 +1,153 @@
+From: Emmanuel Saint-James <esj@rezo.net>
+Subject: Fix CSRF on logout
+
+* ecrire/action/logout.php: Add a confirmation step on logout if there
+  is no token.
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/20874
+Bug-Debian: http://bugs.debian.org/729172
+--- a/ecrire/action/logout.php
++++ b/ecrire/action/logout.php
+@@ -15,44 +15,116 @@
+ include_spip('inc/cookie');
+ include_spip('public/aiguiller');
+ 
+-// http://doc.spip.org/@action_logout_dist
++/**
++ * Se deloger
++ * Pour eviter les CSRF on passe par une etape de confirmation si pas de jeton,
++ * avec un autosubmit js pour ne pas compliquer l'experience utilisateur
++ *
++ * http://doc.spip.org/@action_logout_dist
++ *
++ */
+ function action_logout_dist()
+ {
+-	global $visiteur_session, $ignore_auth_http;
+ 	$logout =_request('logout');
+-	$url = securiser_redirect_action(_request('url'));
+-	// cas particulier, logout dans l'espace public
+-	if ($logout == 'public' AND !$url)
+-		$url = url_de_base();
+-
+-	// seul le loge peut se deloger (mais id_auteur peut valoir 0 apres une restauration avortee)
+-	if (is_numeric($visiteur_session['id_auteur'])) {
+-		include_spip('inc/auth');
+-		auth_trace($visiteur_session, '0000-00-00 00:00:00');
+-	// le logout explicite vaut destruction de toutes les sessions
+-		if (isset($_COOKIE['spip_session'])) {
++	$url = _request('url');
++	// seul le loge peut se deloger
++	// (mais id_auteur peut valoir 0 apres une restauration avortee)
++	if (isset($GLOBALS['visiteur_session']['id_auteur']) 
++	AND is_numeric($GLOBALS['visiteur_session']['id_auteur'])
++	// des sessions anonymes avec id_auteur=0 existent,
++	// mais elles n'ont pas de statut : verifier ca aussi
++	AND isset($GLOBALS['visiteur_session']['statut'])) {
++		// relancer si pas de jeton
++		if (!action_logout_secu($logout, $url, _request('jeton'))) {
++			return; // page submit retournee
++		} elseif (isset($_COOKIE['spip_session'])) {
++		// le logout explicite vaut destruction de toutes les sessions
++			
+ 			$session = charger_fonction('session', 'inc');
+-			$session($visiteur_session['id_auteur']);
++			$session($GLOBALS['visiteur_session']['id_auteur']);
+ 			spip_setcookie('spip_session', $_COOKIE['spip_session'], time()-3600);
+ 		}
+-		// si authentification http, et que la personne est loge,
+-		// pour se deconnecter, il faut proposer un nouveau formulaire de connexion http
+-		if (isset($_SERVER['PHP_AUTH_USER']) AND !$ignore_auth_http AND $GLOBALS['auth_can_disconnect']) {
+-			  ask_php_auth(_T('login_deconnexion_ok'),
+-				       _T('login_verifiez_navigateur'),
+-				       _T('login_retour_public'),
+-				       	"redirect=". _DIR_RESTREINT_ABS, 
+-				       _T('login_test_navigateur'),
+-				       true);
+-			
+-		}
++		include_spip('inc/auth');
++		auth_trace($GLOBALS['visiteur_session'],'0000-00-00 00:00:00');
+ 	}
+-
+-	// Rediriger en contrant le cache navigateur (Safari3)
++	// Action terminee (ou non faite si pas les droits) on redirige.
++	// Cas particulier, logout dans l'espace public
++	$url = securiser_redirect_action($url);
++	if ($logout == 'public' AND !$url)
++		$url = url_de_base();
+ 	include_spip('inc/headers');
+ 	redirige_par_entete($url
++		// contrer le cache navigateur (Safari3)
+ 		? parametre_url($url, 'var_hasard', uniqid(rand()), '&')
+ 		: generer_url_public('login'));
+ }
+ 
++/**
++ * Verifier un jeton si present, ou envoyer une page le produisant
++ * @param string $logout
++ * @param string $url
++ * @param string $jeton
++ * @return boolean
++ */
++
++function action_logout_secu($logout, $url, $jeton)
++{
++	if ($jeton AND verifier_jeton_logout($jeton,$GLOBALS['visiteur_session']))
++		return true;
++	$jeton = generer_jeton_logout($GLOBALS['visiteur_session']);
++	$action = generer_url_action("logout","jeton=$jeton");
++	$action = parametre_url($action,'logout',$logout);
++	$action = parametre_url($action,'url',$url);
++	include_spip("inc/minipres");
++	include_spip("inc/filtres");
++	$texte = bouton_action(_T('spip:icone_deconnecter'),$action);
++	$texte = "<div class='boutons'>$texte</div>";
++	$texte .= '<script type="text/javascript">document.write("<style>body{visibility:hidden;}</style>");window.document.forms[0].submit();</script>';
++	echo minipres(_T('spip:icone_deconnecter'),$texte,'',true);
++	return false;
++}
++
++/**
++ * Generer un jeton de logout personnel et ephemere
++ * @param array $session
++ * @param null|string $alea
++ * @return string
++ */
++function generer_jeton_logout($session,$alea=null){
++	if (is_null($alea)){
++		if (!isset($GLOBALS['meta']['alea_ephemere'])){
++			include_spip('base/abstract_sql');
++			$GLOBALS['meta']['alea_ephemere'] = sql_getfetsel('valeur', 'spip_meta', "nom='alea_ephemere'");
++		}
++		$alea = $GLOBALS['meta']['alea_ephemere'];
++	}
++
++	$jeton = md5($session['date_session']
++	  .$session['id_auteur']
++	  .$session['statut']
++	  .$alea
++	);
++	return $jeton;
++}
++
++/**
++ * Verifier que le jeton de logout est bon
++ * il faut verifier avec alea_ephemere_ancien si pas bon avec alea_ephemere
++ * pour gerer le cas de la rotation d'alea
++ * @param string $jeton
++ * @param array $session
++ * @return bool
++ */
++function verifier_jeton_logout($jeton,$session){
++	if (generer_jeton_logout($session)===$jeton)
++		return true;
++	if (!isset($GLOBALS['meta']['alea_ephemere_ancien'])){
++		include_spip('base/abstract_sql');
++		$GLOBALS['meta']['alea_ephemere_ancien'] = sql_getfetsel('valeur', 'spip_meta', "nom='alea_ephemere_ancien'");
++	}
++	if (generer_jeton_logout($session,$GLOBALS['meta']['alea_ephemere_ancien'])===$jeton)
++		return true;
++	return false;
++}
++
+ ?>
--- spip-2.1.1.orig/debian/patches/fix_referer_xss.patch
+++ spip-2.1.1/debian/patches/fix_referer_xss.patch
@@ -0,0 +1,21 @@
+From: Emmanuel Saint-James <esj@rezo.net>
+Subject: Prevent xss on referer (statistics)
+
+* ecrire/public/stats.php: Reject access with spurious referer (thanks
+  to Antoine Cervoise).
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/19253
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670110
+--- a/ecrire/public/stats.php
++++ b/ecrire/public/stats.php
+@@ -18,8 +18,8 @@
+ 	if (isset($_SERVER['HTTP_REFERER'])) $referer = $_SERVER['HTTP_REFERER'];
+ 	else if (isset($GLOBALS["HTTP_SERVER_VARS"]["HTTP_REFERER"])) $referer = $GLOBALS["HTTP_SERVER_VARS"]["HTTP_REFERER"];
+ 	
+-	// Rejet des robots (qui sont pourtant des humains comme les autres)
+-	if (_IS_BOT) return;
++	// Rejeter pirates et robots (qui sont pourtant des humains comme les autres)
++	if (_IS_BOT OR strpbrk($referer, '<>"\'')) return;
+ 
+ 	// Ne pas tenir compte des tentatives de spam des forums
+ 	if ($_SERVER['REQUEST_METHOD'] !== 'GET'
--- spip-2.1.1.orig/debian/patches/fix_XSS_injection_via_prive_cfg.patch
+++ spip-2.1.1/debian/patches/fix_XSS_injection_via_prive_cfg.patch
@@ -0,0 +1,37 @@
+From: Cédric Morin <cedric.morin@yterium.com>
+Subject: Fix XSS injection via prive/cfg.html
+
+* prive/cfg.html moved to /prive/modeles/cfg.html,
+  ecrire/plugins/afficher_plugin.php: move cfg squelette out of the
+  path (thanks to Arnault Pachot).
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/17727
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670110
+
+--- a/ecrire/plugins/afficher_plugin.php
++++ b/ecrire/plugins/afficher_plugin.php
+@@ -65,7 +65,7 @@
+ 	}
+ 
+ 	// sinon prendre le squelette std sur le nom std
+-	return recuperer_fond("prive/cfg",
++	return recuperer_fond("prive/modeles/cfg",
+ 			array('script' => 'configurer_' . $infos['prefix'],
+ 				'nom' => $nom));
+ }
+--- a/prive/cfg.html
++++ /dev/null
+@@ -1,5 +0,0 @@
+-<div class='cfg_link'>[<a href="(#URL_ECRIRE{#SCRIPT})"><img
+-	src="#EVAL{_DIR_IMG_PACK}/cfg-16.png" width="16" height="16"
+-	alt="<:icone_configuration_site:> #NOM"
+-	title="<:icone_configuration_site:> #NOM" /></a>]
+-</div>
+--- /dev/null
++++ b/prive/modeles/cfg.html
+@@ -0,0 +1,5 @@
++<div class='cfg_link cfg_exec'>[<a href="(#URL_ECRIRE{#SCRIPT})"><img
++	src="#EVAL{_DIR_IMG_PACK}/cfg-16.png" width="16" height="16"
++	alt="<:icone_configuration_site:> [(#NOM|attribut_html)]"
++	title="<:icone_configuration_site:> [(#NOM|attribut_html)]" /></a>]
++</div>
--- spip-2.1.1.orig/debian/patches/fix_blocked_server.patch
+++ spip-2.1.1/debian/patches/fix_blocked_server.patch
@@ -0,0 +1,22 @@
+From: b b
+Subject: Fix blocked server with action=tester_taille call
+
+* ecrire/action/tester_taille.php: Don't let anyone call tester_taille
+  (thanks to Arnault Pachot).
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/18302
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670110
+--- a/ecrire/action/tester_taille.php
++++ b/ecrire/action/tester_taille.php
+@@ -27,8 +27,9 @@
+ // http://doc.spip.org/@action_tester_taille_dist
+ function action_tester_taille_dist() {
+ 
+-	//$securiser_action = charger_fonction('securiser_action', 'inc');
+-	//$arg = $securiser_action();
++	if (!autoriser('configurer'))
++		return;
++	
+ 	$max_size = isset($GLOBALS['meta']['max_taille_vignettes'])?$GLOBALS['meta']['max_taille_vignettes']:0;
+ 	$max_size_echec = isset($GLOBALS['meta']['max_taille_vignettes_echec'])?$GLOBALS['meta']['max_taille_vignettes_echec']:0;
+ 	$max_size_test = isset($GLOBALS['meta']['max_taille_vignettes_test'])?$GLOBALS['meta']['max_taille_vignettes_test']:0;
--- spip-2.1.1.orig/debian/patches/remove_dummy_umask.patch
+++ spip-2.1.1/debian/patches/remove_dummy_umask.patch
@@ -0,0 +1,26 @@
+Index: spip-2.1.1/ecrire/inc_version.php
+===================================================================
+--- spip-2.1.1.orig/ecrire/inc_version.php	2010-07-29 16:32:35.000000000 -0500
++++ spip-2.1.1/ecrire/inc_version.php	2010-08-03 15:30:21.000000000 -0500
+@@ -396,7 +396,7 @@
+ # $table_des_traitements['TITRE'][]= 'typo(supprimer_numero(%s), "TYPO", $connect)';
+ 
+ // Droits d'acces maximum par defaut
+-@umask(0);
++//@umask(0);
+ 
+ // numero de branche, utilise par les plugins
+ // pour specifier les versions de SPIP necessaire
+Index: spip-2.1.1/ecrire/inc/charger_plugin.php
+===================================================================
+--- spip-2.1.1.orig/ecrire/inc/charger_plugin.php	2010-07-29 16:32:32.000000000 -0500
++++ spip-2.1.1/ecrire/inc/charger_plugin.php	2010-08-03 15:30:21.000000000 -0500
+@@ -257,7 +257,7 @@
+ 				? $dir_export
+ 				: $tmpname
+ 		,
+-		PCLZIP_OPT_SET_CHMOD, _SPIP_CHMOD,
++		//PCLZIP_OPT_SET_CHMOD, _SPIP_CHMOD,
+ 		PCLZIP_OPT_REPLACE_NEWER,
+ 		PCLZIP_OPT_REMOVE_PATH, $quoi['remove']
+ 	);
--- spip-2.1.1.orig/debian/patches/fix_XSS_in_variable_name.patch
+++ spip-2.1.1/debian/patches/fix_XSS_in_variable_name.patch
@@ -0,0 +1,19 @@
+From: denisb <denisb@laposte.net>
+Subject: Don't reinject unsanitize variable name in HTML
+
+* ecrire/inc/admin.php: Fix XSS injection in variable name (thanks to
+  AS ASafety).
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/19559
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=677290
+--- a/ecrire/inc/admin.php
++++ b/ecrire/inc/admin.php
+@@ -172,7 +172,7 @@
+         include_spip('inc/filtres');
+ 	foreach($_POST as $n => $c) {
+ 	  if (($n != 'fichier') AND !is_array($c))
+-		$suite .= "\n<input type='hidden' name='$n' value='" .
++		$suite .= "\n<input type='hidden' name='".htmlspecialchars($n)."' value='" .
+ 		  entites_html($c) .
+ 		  "'  />";
+ 	}
--- spip-2.1.1.orig/debian/patches/fix_arbitrary_password_change.patch
+++ spip-2.1.1/debian/patches/fix_arbitrary_password_change.patch
@@ -0,0 +1,22 @@
+From: b b
+Subject: Prevent an admin to change a webmaster password
+
+* ecrire/inc/autoriser.php: Don't touch the status before allowing
+  webmaster's actions (thanks to Maxime Pelletier).
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/19054
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670110
+
+--- a/ecrire/inc/autoriser.php
++++ b/ecrire/inc/autoriser.php
+@@ -567,8 +567,8 @@
+ 	// ou si les webmestres sont fixes par constante (securite)
+ 	elseif ($opt['webmestre'] AND (defined('_ID_WEBMESTRES') OR !autoriser('webmestre')))
+ 		return false;
+-	// et toucher au statut d'un webmestre si il ne l'est pas lui meme
+-	elseif ($opt['statut'] AND autoriser('webmestre','',0,$id) AND !autoriser('webmestre'))
++	// et modifier un webmestre si il ne l'est pas lui meme
++	elseif (autoriser('webmestre','',0,$id) AND !autoriser('webmestre'))
+ 		return false;
+ 	else
+ 		return true;
--- spip-2.1.1.orig/debian/patches/fix_int_overflow_in_published_articles_date.patch
+++ spip-2.1.1/debian/patches/fix_int_overflow_in_published_articles_date.patch
@@ -0,0 +1,16 @@
+Fix int overflow on 32-bit archs in article's published
+date.
+
+Index: spip-2.1.1/ecrire/public/quete.php
+===================================================================
+--- spip-2.1.1.orig/ecrire/public/quete.php	2010-09-18 15:07:44.000000000 -0500
++++ spip-2.1.1/ecrire/public/quete.php	2010-09-18 15:07:47.000000000 -0500
+@@ -79,7 +79,7 @@
+ 	  date('Y-m-d H:i:s',
+ 	       ($GLOBALS['meta']['date_prochain_postdate'] > time())
+ 			? $GLOBALS['meta']['date_prochain_postdate']
+-	       : (time()+(3600*24*10000))) ;
++	       : (time()+(3600*24*365*2))) ;
+ }
+ 
+ 
--- spip-2.1.1.orig/debian/patches/fix_XSS_in_password.patch
+++ spip-2.1.1/debian/patches/fix_XSS_in_password.patch
@@ -0,0 +1,18 @@
+From: Cédric Morin <cedric.morin@yterium.com>
+Subject: Fix auto-XSS on password
+
+* prive/javascript/login.js: fix auto-XSS on password (thanks to zataz).
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/19333
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=
+--- a/prive/javascript/login.js
++++ b/prive/javascript/login.js
+@@ -77,7 +77,7 @@
+ 			// - certains navigateurs memorisent le hash au lieu du pass ...
+ 			// on cree un input hidden a cote, on lui met le name="password"
+ 			// et on vide le champ visible
+-			inputpass.after('<input name="password" type="hidden" value="'+pass+'" />');
++			inputpass.after('<input name="password" type="hidden" value="" />').attr('value',pass);
+ 			inputpass.attr('name','nothing').attr('value','');
+ 			calcule_hash_pass(pass);
+ 		}
--- spip-2.1.1.orig/debian/patches/fix_base_disclosure.patch
+++ spip-2.1.1/debian/patches/fix_base_disclosure.patch
@@ -0,0 +1,155 @@
+From: b b
+Subject: Fix base name disclosure from form text field
+
+* ecrire/base/connect_sql.php, ecrire/req/mysql.php,
+  ecrire/req/sqlite_generique.php: escape text in traiter_query
+  (thanks to Philippe Brehmer).
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/19753
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683667
+--- a/ecrire/base/connect_sql.php
++++ b/ecrire/base/connect_sql.php
+@@ -335,6 +335,75 @@
+ 	return '';
+ }
+ 
++/**
++ * Echapper les textes entre ' ' ou " " d'une requete SQL
++ * avant son pre-traitement
++ * On renvoi la query sans textes et les textes separes, dans
++ * leur ordre d'apparition dans la query
++ *
++ * @param string $query
++ * @return array
++ */
++function query_echappe_textes($query){
++	static $codeEchappements = array("''"=>"\x1@##@\x1", "\'"=>"\x2@##@\x2", "\\\""=>"\x3@##@\x3");
++	$query = str_replace(array_keys($codeEchappements), array_values($codeEchappements), $query);
++	if (preg_match_all("/((['])[^']*(\\2))|(([\"])[^\"]*(\\5))/S",$query,$textes)){
++		$textes = reset($textes); // indice 0 du match
++		switch(count($textes)){
++			case 0:$replace=array();break;
++			case 1:$replace=array('%1$s');break;
++			case 2:$replace=array('%1$s','%2$s');break;
++			case 3:$replace=array('%1$s','%2$s','%3$s');break;
++			case 4:$replace=array('%1$s','%2$s','%3$s','%4$s');break;
++			case 5:$replace=array('%1$s','%2$s','%3$s','%4$s','%5$s');break;
++			default:
++				$replace = range(1,count($textes));
++				$replace = '%'.implode('$s,%',$replace).'$s';
++				$replace = explode(',',$replace);
++				break;
++		}
++		$query = str_replace($textes,$replace,$query);
++	}
++	else
++		$textes = array();
++
++	return array($query, $textes);
++}
++
++/**
++ * Reinjecter les textes d'une requete SQL a leur place initiale,
++ * apres traitement de la requete
++ *
++ * @param string $query
++ * @param array $textes
++ * @return string
++ */
++function query_reinjecte_textes($query, $textes){
++	static $codeEchappements = array("''"=>"\x1@##@\x1", "\'"=>"\x2@##@\x2", "\\\""=>"\x3@##@\x3");
++	# debug de la substitution
++	#if (($c1=substr_count($query,"%"))!=($c2=count($textes))){
++	#	spip_log("$c1 ::". $query,"tradquery"._LOG_ERREUR);
++	#	spip_log("$c2 ::". var_export($textes,1),"tradquery"._LOG_ERREUR);
++	#	spip_log("ini ::". $qi,"tradquery"._LOG_ERREUR);
++	#}
++	switch (count($textes)){
++		case 0:break;
++		case 1:$query=sprintf($query,$textes[0]);break;
++		case 2:$query=sprintf($query,$textes[0],$textes[1]);break;
++		case 3:$query=sprintf($query,$textes[0],$textes[1],$textes[2]);break;
++		case 4:$query=sprintf($query,$textes[0],$textes[1],$textes[2],$textes[3]);break;
++		case 5:$query=sprintf($query,$textes[0],$textes[1],$textes[2],$textes[3],$textes[4]);break;
++		default:
++			array_unshift($textes,$query);
++			$query = call_user_func_array('sprintf',$textes);
++			break;
++	}
++
++	$query = str_replace(array_values($codeEchappements), array_keys($codeEchappements), $query);
++
++	return $query;
++}
++
+ // Pour compatibilite. Ne plus utiliser.
+ // http://doc.spip.org/@spip_query
+ function spip_query($query, $serveur='') {
+--- a/ecrire/req/mysql.php
++++ b/ecrire/req/mysql.php
+@@ -286,8 +286,14 @@
+ 	} else {
+ 		$suite = strstr($query, $regs[0]);
+ 		$query = substr($query, 0, -strlen($suite));
+-		if (preg_match('/^(.*?)([(]\s*SELECT\b.*)$/si', $suite, $r)) {
+-		  $suite = $r[1] . traite_query($r[2], $db, $prefixe);
++		// propager le prefixe en cas de requete imbriquee
++		// il faut alors echapper les chaine avant de le faire, pour ne pas risquer de
++		// modifier une requete qui est en fait juste du texte dans un champ
++		if (stripos($suite,"SELECT")!==false) {
++			list($suite,$textes) = query_echappe_textes($suite);
++			if (preg_match('/^(.*?)([(]\s*SELECT\b.*)$/si', $suite, $r))
++		    $suite = $r[1] . traite_query($r[2], $db, $prefixe);
++			$suite = query_reinjecte_textes($suite, $textes);
+ 		}
+ 	}
+ 	$r = preg_replace(_SQL_PREFIXE_TABLE, '\1'.$pref, $query) . $suite;
+--- a/ecrire/req/sqlite_generique.php
++++ b/ecrire/req/sqlite_generique.php
+@@ -1611,7 +1611,6 @@
+ 	
+ 	// Pour les corrections a effectuer sur les requetes :
+ 	var $textes = array(); 	// array(code=>'texte') trouvé
+-	var $codeEchappements = "%@##@%";
+ 	
+ 	
+ 	// constructeur
+@@ -1681,16 +1680,13 @@
+ 	// enleve les textes, transforme la requete pour quelle soit
+ 	// bien interpretee par sqlite, puis remet les textes
+ 	// la fonction affecte $this->query
+-// http://doc.spip.org/@traduire_requete
++	// http://doc.spip.org/@traduire_requete
+ 	function traduire_requete(){
+ 		//
+ 		// 1) Protection des textes en les remplacant par des codes
+ 		//
+-		// enlever les echappements ''
+-		$this->query = str_replace("''", $this->codeEchappements, $this->query);
+-		// enlever les 'textes'
+-		$this->textes = array(); // vider 
+-		$this->query = preg_replace_callback("/('[^']*')/", array(&$this, '_remplacerTexteParCode'), $this->query);
++		// enlever les 'textes' et initialiser avec
++		list($this->query, $textes) = query_echappe_textes($this->query);
+ 		
+ 		//
+ 		// 2) Corrections de la requete
+@@ -1791,12 +1787,12 @@
+ 		//
+ 		// 3) Remise en place des textes d'origine
+ 		//
+-		// remettre les 'textes'
+-		foreach ($this->textes as $cle=>$val){
+-			$this->query = str_replace($cle, $val, $this->query);
+-		}
+-		// remettre les echappements ''
+-		$this->query = str_replace($this->codeEchappements,"''",$this->query);
++		// Correction Antiquotes et echappements
++		// ` => rien
++		if (strpos($this->query,'`')!==false)
++			$this->query = str_replace('`','', $this->query);
++
++		$this->query = query_reinjecte_textes($this->query, $textes);
+ 	}
+ 	
+ 
--- spip-2.1.1.orig/debian/patches/fix_XSS_on_author_page.patch
+++ spip-2.1.1/debian/patches/fix_XSS_on_author_page.patch
@@ -0,0 +1,29 @@
+From: denisb <denisb@laposte.net>
+Subject: Avoid XSS on URL from author page
+
+* prive/formulaires/editer_auteur.php: Do not allow any site URL
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/20880
+Bug-Debian: http://bugs.debian.org/729172
+--- a/ecrire/lang/ecrire_fr.php
++++ b/ecrire/lang/ecrire_fr.php
+@@ -491,6 +491,7 @@
+ 'info_nom_destinataire' => 'Nom du destinataire',
+ 'info_nom_site' => 'Nom de votre site',
+ 'info_nom_site_2' => '<b>Nom du site</b> [Obligatoire]',
++'info_url_site_pas_conforme' => 'l\'URL du site n\'est pas valide.',
+ 'info_nombre_articles' => '@nb_articles@ articles,',
+ 'info_nombre_breves' => '@nb_breves@ br&egrave;ves,',
+ 'info_nombre_partcipants' => 'PARTICIPANTS A LA DISCUSSION :',
+--- a/prive/formulaires/editer_auteur.php
++++ b/prive/formulaires/editer_auteur.php
+@@ -70,6 +70,10 @@
+ 		}
+ 	}
+ 
++	if (preg_match(",^\s*javascript,i", _request('url_site'))) {
++		$erreurs['url_site'] = _T('info_url_site_pas_conforme');
++	}
++
+ 	if ($err = auth_verifier_login($auth_methode, _request('new_login'), $id_auteur)){
+ 		$erreurs['new_login'] = $err;
+ 		$erreurs['message_erreur'] .= $err;
--- spip-2.1.1.orig/debian/patches/use_safehtml_packaged_class.patch
+++ spip-2.1.1/debian/patches/use_safehtml_packaged_class.patch
@@ -0,0 +1,13 @@
+Index: spip-2.1.1/extensions/safehtml/inc/safehtml.php
+===================================================================
+--- spip-2.1.1.orig/extensions/safehtml/inc/safehtml.php	2010-07-29 16:33:29.000000000 -0500
++++ spip-2.1.1/extensions/safehtml/inc/safehtml.php	2010-08-03 15:30:21.000000000 -0500
+@@ -24,7 +24,7 @@
+ 		if ($f = find_in_path('lib/safehtml/classes')) {
+ 			define('XML_HTMLSAX3', $f.'/');
+ 			require_once XML_HTMLSAX3.'safehtml.php';
+-			$process = new safehtml();
++			$process = new HTML_Safe();
+ 			$process->deleteTags[] = 'param'; // sinon bug Firefox
+ 		}
+ 		if ($process)
--- spip-2.1.1.orig/debian/patches/avoid_spurious_redirections.patch
+++ spip-2.1.1/debian/patches/avoid_spurious_redirections.patch
@@ -0,0 +1,122 @@
+From: Cédric Morin <cedric.morin@yterium.com>
+Subject: Fix absolute redirection in actions
+
+* ecrire/inc/utils.php: Add tester_url_absolue() function in order to
+  test if an URL is absolute.
+* prive/formulaires/login.php: Use this function in login form.
+  Workaround parse_url that doesn't work on relative URL.
+* ecrire/public/aiguiller.php: Add securiser_redirect_action() function
+  in redirect parameter of every action (also used later in logout);
+* ecrire/action/cookie.php: Use this function in URL parameter of
+  cookie action.
+  Thanks to Matsuyama
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/16904 http://core.spip.org/projects/spip/repository/revisions/16960 http://core.spip.org/projects/spip/repository/revisions/17014 http://core.spip.org/projects/spip/repository/revisions/17015 http://core.spip.org/projects/spip/repository/revisions/17016 http://core.spip.org/projects/spip/repository/revisions/18586
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670110
+--- a/ecrire/action/cookie.php
++++ b/ecrire/action/cookie.php
+@@ -19,8 +19,8 @@
+ function action_cookie_dist() {
+ 
+ 	// La cible de notre operation de connexion
+-	$url = _request('url');
+-	$redirect = isset($url) ? $url : _DIR_RESTREINT;
++	$url = securiser_redirect_action(_request('url'));
++	$redirect = $url ? $url : generer_url_ecrire('accueil');
+ 	$redirect_echec = _request('url_echec');
+ 	if (!isset($redirect_echec)) {
+ 		if (strpos($redirect,_DIR_RESTREINT_ABS)!==false)
+--- a/ecrire/inc/utils.php
++++ b/ecrire/inc/utils.php
+@@ -194,6 +194,16 @@
+ 	return false; # n'affecte pas $c
+ }
+ 
++
++/**
++ * Tester si une url est absolue
++ * @param  $url
++ * @return bool
++ */
++function tester_url_absolue($url){
++	return preg_match(";^([a-z]+:)?//;Uims",trim($url))?true:false;
++}
++
+ //
+ // Prend une URL et lui ajoute/retire un parametre.
+ // Exemples : [(#SELF|parametre_url{suite,18})] (ajout)
+--- a/ecrire/public/aiguiller.php
++++ b/ecrire/public/aiguiller.php
+@@ -12,6 +12,19 @@
+ 
+ if (!defined("_ECRIRE_INC_VERSION")) return;
+ 
++function securiser_redirect_action($redirect){
++	if (tester_url_absolue($redirect) AND !defined('_AUTORISER_ACTION_ABS_REDIRECT')){
++		$base = $GLOBALS['meta']['adresse_site']."/";
++		// si l'url est une url du site, on la laisse passer sans rien faire
++		// c'est encore le plus simple
++		if (strlen($base) AND strncmp($redirect,$base,strlen($base))==0)
++			return $redirect;
++		else
++			return "";
++	}
++	return $redirect;
++}
++
+ // http://doc.spip.org/@traiter_appels_actions
+ function traiter_appels_actions(){
+ 	// cas de l'appel qui renvoie une redirection (302) ou rien (204)
+@@ -30,13 +43,17 @@
+ 			$url = parametre_url($url,'var_ajax',$v,'&');
+ 			$url = parametre_url($url,'var_ajax_env',$args,'&');
+ 			set_request('redirect',$url);
+-		}		
++		}
++		else if(_request('redirect')){
++			set_request('redirect',securiser_redirect_action(_request('redirect')));
++		}
+ 		$var_f = charger_fonction($action, 'action');
+ 		$var_f();
+ 		if (!isset($GLOBALS['redirect'])) {
+ 			$GLOBALS['redirect'] = _request('redirect');
+ 			if ($_SERVER['REQUEST_METHOD'] == 'POST')
+ 				$GLOBALS['redirect'] = urldecode($GLOBALS['redirect']);
++			$GLOBALS['redirect'] = securiser_redirect_action($GLOBALS['redirect']);
+ 		}
+ 		if ($url = $GLOBALS['redirect']) {
+ 			// si l'action est provoque par un hit {ajax}
+--- a/prive/formulaires/login.php
++++ b/prive/formulaires/login.php
+@@ -15,8 +15,9 @@
+ include_spip('base/abstract_sql');
+ 
+ function is_url_prive($cible){
+-	$parse = parse_url($cible);
+-	return strncmp(substr($parse['path'],-strlen(_DIR_RESTREINT_ABS)), _DIR_RESTREINT_ABS, strlen(_DIR_RESTREINT_ABS))==0;
++	include_spip('inc/filtres_mini');
++	$path = parse_url(tester_url_absolue($cible)?$cible:url_absolue($cible),PHP_URL_PATH);
++	return strncmp(substr($path,-strlen(_DIR_RESTREINT_ABS)), _DIR_RESTREINT_ABS, strlen(_DIR_RESTREINT_ABS))==0;
+ }
+ 
+ function formulaires_login_charger_dist($cible="",$login="",$prive=null)
+--- a/ecrire/inc/headers.php
++++ b/ecrire/inc/headers.php
+@@ -25,7 +25,7 @@
+ 	# en theorie on devrait faire ca tout le temps, mais quand la chaine
+ 	# commence par ? c'est imperatif, sinon l'url finale n'est pas la bonne
+ 	if ($url[0]=='?')
+-		$url = url_de_base().$url;
++		$url = url_de_base().(_DIR_RESTREINT?'':_DIR_RESTREINT_ABS).$url;
+ 	if ($url[0]=='#')
+ 		$url = self('&').$url;
+ 
+@@ -98,7 +98,7 @@
+ 		# en theorie on devrait faire ca tout le temps, mais quand la chaine
+ 		# commence par ? c'est imperatif, sinon l'url finale n'est pas la bonne
+ 		if ($url[0]=='?')
+-			$url = url_de_base().$url;
++			$url = url_de_base().(_DIR_RESTREINT?'':_DIR_RESTREINT_ABS).$url;
+ 		$url = str_replace('&amp;','&',$url);
+ 		spip_log("redirige formulaire ajax: $url");
+ 		include_spip('inc/filtres');
--- spip-2.1.1.orig/debian/patches/fix_configuration_access_to_writers.patch
+++ spip-2.1.1/debian/patches/fix_configuration_access_to_writers.patch
@@ -0,0 +1,52 @@
+From: b b
+Subject: Fix configuration available to writers
+
+* ecrire/exec/configurer_notifications_forum.php,
+  ecrire/exec/configurer_relayeur.php,
+  ecrire/exec/configurer_previsualiseur.php: Don't keep configuration
+  bloc freely available (thanks to Arnault Pachot).
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/17676
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670110
+--- a/ecrire/exec/configurer_notifications_forum.php
++++ b/ecrire/exec/configurer_notifications_forum.php
+@@ -15,6 +15,11 @@
+ // http://doc.spip.org/@exec_configurer_notifications_forum_dist
+ function exec_configurer_notifications_forum_dist()
+ {
++	if(!autoriser('configurer', _request('configuration'))) {
++		include_spip('inc/minipres');
++		echo minipres(_T('info_acces_interdit'));
++		exit;
++	}
+ 	$f = charger_fonction('notifications_forum', 'configuration');
+ 	include_spip('inc/actions');
+ 	ajax_retour($f());
+--- a/ecrire/exec/configurer_previsualiseur.php
++++ b/ecrire/exec/configurer_previsualiseur.php
+@@ -15,6 +15,11 @@
+ // http://doc.spip.org/@exec_configurer_previsualiseur_dist
+ function exec_configurer_previsualiseur_dist()
+ {
++	if(!autoriser('configurer', _request('configuration'))) {
++		include_spip('inc/minipres');
++		echo minipres(_T('info_acces_interdit'));
++		exit;
++	}
+ 	$previsualiseur = charger_fonction('previsualiseur', 'configuration');
+ 	include_spip('inc/actions');
+ 	ajax_retour($previsualiseur());
+--- a/ecrire/exec/configurer_relayeur.php
++++ b/ecrire/exec/configurer_relayeur.php
+@@ -15,6 +15,11 @@
+ // http://doc.spip.org/@exec_configurer_relayeur_dist
+ function exec_configurer_relayeur_dist()
+ {
++	if(!autoriser('configurer', _request('configuration'))) {
++		include_spip('inc/minipres');
++		echo minipres(_T('info_acces_interdit'));
++		exit;
++	}
+ 	include_spip('inc/actions');
+ 	$relayeur = charger_fonction('relayeur', 'configuration');
+ 	ajax_retour($relayeur(_request('retour_proxy')));
--- spip-2.1.1.orig/debian/patches/fix_open_redirect_on_logout.patch
+++ spip-2.1.1/debian/patches/fix_open_redirect_on_logout.patch
@@ -0,0 +1,26 @@
+From: denisb <denisb@laposte.net>
+Subject: Avoid “open redirect” on logout link
+
+* ecrire/action/logout.php: Secure the redirect action (thanks to
+  Guillaume Fahrner).
+
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/18818 http://core.spip.org/projects/spip/repository/revisions/19028
+Bug-Debian: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=670110
+--- a/ecrire/action/logout.php
++++ b/ecrire/action/logout.php
+@@ -13,13 +13,14 @@
+ if (!defined("_ECRIRE_INC_VERSION")) return;
+ 
+ include_spip('inc/cookie');
++include_spip('public/aiguiller');
+ 
+ // http://doc.spip.org/@action_logout_dist
+ function action_logout_dist()
+ {
+ 	global $visiteur_session, $ignore_auth_http;
+ 	$logout =_request('logout');
+-	$url = _request('url');
++	$url = securiser_redirect_action(_request('url'));
+ 	// cas particulier, logout dans l'espace public
+ 	if ($logout == 'public' AND !$url)
+ 		$url = url_de_base();
--- spip-2.1.1.orig/debian/patches/fix_XSS_on_signature.patch
+++ spip-2.1.1/debian/patches/fix_XSS_on_signature.patch
@@ -0,0 +1,71 @@
+From: denisb <denisb@laposte.net>
+Subject: Avoid XSS on signature from author
+
+* ecrire/inc/filtres.php, ecrire/lang/ecrire_fr.php,
+  prive/formulaires/editer_auteur.php,
+  squelettes-dist/formulaires/inscription.php: Avoid XSS on name (signature)
+  from an author. [CVE-2013-7303]
+Origin: upstream, http://core.spip.org/projects/spip/repository/revisions/20972
+Bug-Debian: http://bugs.debian.org/736170
+--- a/ecrire/inc/filtres.php
++++ b/ecrire/inc/filtres.php
+@@ -1574,6 +1574,22 @@
+ 	return ($mod?$nb%$mod:0)+$add;
+ }
+ 
++/**
++ * Vérifie qu'un nom (d'auteur) ne comporte pas d'autres tags que <multi>
++ *
++ * @param string $nom
++ *      Nom (signature) proposé
++ * @return bool
++ *      - false si pas conforme,
++ *      - true sinon
++**/
++function nom_acceptable($nom) {
++	if (!is_string($nom)) {
++		return false;
++	}
++	$v_nom = str_replace(array('@multi@','@/multi@'), array('<multi>','</multi>'), supprimer_tags(str_replace(array('<multi>','</multi>'), array('@multi@','@/multi@'), $nom)));
++	return str_replace('&lt;', '<', $v_nom) == $nom;
++}
+ 
+ // Verifier la conformite d'une ou plusieurs adresses email
+ //  retourne false ou la  normalisation de la derniere adresse donnee
+--- a/ecrire/lang/ecrire_fr.php
++++ b/ecrire/lang/ecrire_fr.php
+@@ -489,6 +489,7 @@
+ 'info_multi_secteurs' => '... seulement pour les rubriques situ&eacute;es &agrave; la racine&nbsp;?',
+ 'info_nom' => 'Nom',
+ 'info_nom_destinataire' => 'Nom du destinataire',
++'info_nom_pas_conforme' => 'les tags html ne sont pas autoris&eacute;s',
+ 'info_nom_site' => 'Nom de votre site',
+ 'info_nom_site_2' => '<b>Nom du site</b> [Obligatoire]',
+ 'info_url_site_pas_conforme' => 'l\'URL du site n\'est pas valide.',
+--- a/prive/formulaires/editer_auteur.php
++++ b/prive/formulaires/editer_auteur.php
+@@ -54,9 +54,12 @@
+ 	$auth_methode = ($auth_methode ? $auth_methode : 'spip');
+ 	include_spip('inc/auth');
+ 	include_spip('inc/autoriser');
++	include_spip('inc/filtres');
+ 
++	if (!nom_acceptable(_request('nom'))) {
++		$erreurs['nom'] = _T("info_nom_pas_conforme");
++	}
+ 	if ($email = _request('email')){
+-		include_spip('inc/filtres');
+ 		// un redacteur qui modifie son email n'a pas le droit de le vider si il y en avait un
+ 		if (!autoriser('modifier','auteur',$id_auteur,null,array('email'=>'?'))
+ 			AND $GLOBALS['visiteur_session']['id_auteur']==$id_auteur
+--- a/squelettes-dist/formulaires/inscription.php
++++ b/squelettes-dist/formulaires/inscription.php
+@@ -35,6 +35,8 @@
+ 
+ 	if (!$nom = _request('nom_inscription'))
+ 		$erreurs['nom_inscription'] = _T("info_obligatoire");
++	elseif (!nom_acceptable(_request('nom_inscription')))
++		$erreurs['nom_inscription'] = _T("ecrire:info_nom_pas_conforme");
+ 	if (!$mail = _request('mail_inscription'))
+ 		$erreurs['mail_inscription'] = _T("info_obligatoire");
+ 	
--- spip-2.1.1.orig/debian/etc/multisite.php
+++ spip-2.1.1/debian/etc/multisite.php
@@ -0,0 +1,36 @@
+<?
+
+// Custom include for spip multisite under debian
+
+// First define a global variable for multiple sites:
+$GLOBALS['spip_sites'] = array();
+
+// Now include all defined sites:
+$dir = "/etc/spip/sites";
+
+// Including all enabled sites.
+if ( is_dir( $dir )
+   &&
+     $dh = opendir( $dir ) ) {
+        while ( ( $file = readdir( $dh ) ) !== false ) {
+	    if ( preg_match( "/.php$/",$file ) && is_readable($dir . DIRECTORY_SEPARATOR . $file) ) {
+                include_once( $dir . DIRECTORY_SEPARATOR . $file );
+            }
+        }
+        closedir( $dh );
+     }
+
+// then a function for getting them:
+function spip_get_site($query) {
+  foreach ($GLOBALS['spip_sites'] as $name => $hosts) {
+     foreach ($hosts as $def_host) {
+       if (preg_match('/' . $def_host . '/',$query) >= 1) { return $name; }
+     }
+  }
+
+  // If not matched, return default
+  return 'default';
+
+}
+
+?>
--- spip-2.1.1.orig/debian/etc/cherokee.conf
+++ spip-2.1.1/debian/etc/cherokee.conf
@@ -0,0 +1,9 @@
+
+##
+## Virtual server for mediawiki
+##
+Directory /spip {
+          Handler common
+          DocumentRoot /var/lib/spip/
+}
+ 
--- spip-2.1.1.orig/debian/etc/apache.conf
+++ spip-2.1.1/debian/etc/apache.conf
@@ -0,0 +1,17 @@
+# Uncomment this to add an alias.
+# This does not work properly with virtual hosts..
+#Alias /spip /var/lib/spip
+
+<Directory /var/lib/spip/>
+	Options +FollowSymLinks
+	AllowOverride All
+	order allow,deny
+	allow from all
+</Directory>
+
+# some directories must be protected
+<Directory /var/lib/spip/sites>
+	Options -FollowSymLinks
+	AllowOverride None
+</Directory>
+
--- spip-2.1.1.orig/debian/etc/sites/default.php
+++ spip-2.1.1/debian/etc/sites/default.php
@@ -0,0 +1,6 @@
+<?php
+
+$GLOBALS['spip_sites']['default'] = array('localhost');
+
+
+?>
--- spip-2.1.1.orig/debian/security/ecran_securite.php
+++ spip-2.1.1/debian/security/ecran_securite.php
@@ -0,0 +1,320 @@
+<?php
+
+/*
+ * ecran_securite.php
+ * ------------------
+ */
+
+define('_ECRAN_SECURITE', '1.1.8'); // 2013-08-29
+
+/*
+ * Documentation : http://www.spip.net/fr_article4200.html
+ */
+
+/*
+ * Test utilisateur
+ */
+if (isset($_GET['test_ecran_securite']))
+	$ecran_securite_raison = 'test '._ECRAN_SECURITE;
+
+/*
+ * Détecteur de robot d'indexation
+ */
+if (!defined('_IS_BOT'))
+	define('_IS_BOT',
+		isset($_SERVER['HTTP_USER_AGENT'])
+		AND preg_match(
+	    // mots generiques
+	    ',bot|slurp|crawler|spider|webvac|yandex|'
+	    // UA plus cibles
+	    . '80legs|accoona|AltaVista|ASPSeek|Baidu|Charlotte|EC2LinkFinder|eStyle|Google|INA dlweb|Java VM|LiteFinder|Lycos|Rambler|Scooter|ScrubbyBloglines|Yahoo|Yeti'
+	    . ',i',(string) $_SERVER['HTTP_USER_AGENT'])
+	);
+
+/*
+ * Interdit de passer une variable id_article (ou id_xxx) qui ne
+ * soit pas numérique (ce qui bloque l'exploitation de divers trous
+ * de sécurité, dont celui de toutes les versions < 1.8.2f)
+ * (sauf pour id_table, qui n'est pas numérique jusqu'à [5743])
+ */
+foreach ($_GET as $var => $val)
+	if ($_GET[$var] AND strncmp($var,"id_",3)==0 AND $var!='id_table')
+		$_GET[$var] = is_array($_GET[$var])?@array_map('intval',$_GET[$var]):intval($_GET[$var]);
+foreach ($_POST as $var => $val)
+	if ($_POST[$var] AND strncmp($var,"id_",3)==0 AND $var!='id_table')
+		$_POST[$var] = is_array($_POST[$var])?@array_map('intval',$_POST[$var]):intval($_POST[$var]);
+foreach ($GLOBALS as $var => $val)
+	if ($GLOBALS[$var] AND strncmp($var,"id_",3)==0 AND $var!='id_table')
+		$GLOBALS[$var] = is_array($GLOBALS[$var])?@array_map('intval',$GLOBALS[$var]):intval($GLOBALS[$var]);
+
+/*
+ * Interdit la variable $cjpeg_command, qui était utilisée sans
+ * précaution dans certaines versions de dev (1.8b2 -> 1.8b5)
+ */
+$cjpeg_command='';
+
+/*
+ * Contrôle de quelques variables (XSS)
+ */
+foreach(array('lang', 'var_recherche', 'aide', 'var_lang_r', 'lang_r', 'var_ajax_ancre') as $var) {
+	if (isset($_GET[$var]))
+		$_REQUEST[$var] = $GLOBALS[$var] = $_GET[$var] = preg_replace(',[^\w\,/#&;-]+,',' ',(string)$_GET[$var]);
+	if (isset($_POST[$var]))
+		$_REQUEST[$var] = $GLOBALS[$var] = $_POST[$var] = preg_replace(',[^\w\,/#&;-]+,',' ',(string)$_POST[$var]);
+}
+
+/*
+ * Filtre l'accès à spip_acces_doc (injection SQL en 1.8.2x)
+ */
+if (preg_match(',^(.*/)?spip_acces_doc\.,', (string)$_SERVER['REQUEST_URI'])) {
+	$file = addslashes((string)$_GET['file']);
+}
+
+/*
+ * Pas d'inscription abusive
+ */
+if (isset($_REQUEST['mode']) AND isset($_REQUEST['page'])
+AND !in_array($_REQUEST['mode'],array("6forum","1comite"))
+AND $_REQUEST['page'] == "identifiants")
+	$ecran_securite_raison = "identifiants";
+
+/*
+ * Agenda joue à l'injection php
+ */
+if (isset($_REQUEST['partie_cal'])
+AND $_REQUEST['partie_cal'] !== htmlentities((string)$_REQUEST['partie_cal']))
+	$ecran_securite_raison = "partie_cal";
+if (isset($_REQUEST['echelle'])
+AND $_REQUEST['echelle'] !== htmlentities((string)$_REQUEST['echelle']))
+	$ecran_securite_raison = "echelle";
+
+/*
+ * Espace privé
+ */
+if (isset($_REQUEST['exec'])
+AND !preg_match(',^[\w-]+$,', (string)$_REQUEST['exec']))
+	$ecran_securite_raison = "exec";
+if (isset($_REQUEST['cherche_auteur'])
+AND preg_match(',[<],', (string)$_REQUEST['cherche_auteur']))
+	$ecran_securite_raison = "cherche_auteur";
+if (isset($_REQUEST['exec'])
+AND $_REQUEST['exec'] == 'auteurs'
+AND preg_match(',[<],', (string)$_REQUEST['recherche']))
+	$ecran_securite_raison = "recherche";
+if (isset($_REQUEST['action'])
+AND $_REQUEST['action'] == 'configurer') {
+	if (@file_exists('inc_version.php')
+	OR @file_exists('ecrire/inc_version.php')) {
+		function action_configurer() {
+			include_spip('inc/autoriser');
+			if(!autoriser('configurer', _request('configuration'))) {
+				include_spip('inc/minipres');
+				echo minipres(_T('info_acces_interdit'));
+				exit;
+			}
+			require _DIR_RESTREINT.'action/configurer.php';
+			action_configurer_dist();
+		}
+	}
+}
+
+/*
+ * Bloque les requêtes contenant %00 (manipulation d'include)
+ */
+if (strpos(
+	@get_magic_quotes_gpc() ?
+		stripslashes(serialize($_REQUEST)) : serialize($_REQUEST),
+	chr(0)
+) !== false)
+	$ecran_securite_raison = "%00";
+
+/*
+ * Bloque les requêtes fond=formulaire_
+ */
+if (isset($_REQUEST['fond'])
+AND preg_match(',^formulaire_,i', $_REQUEST['fond']))
+	$ecran_securite_raison = "fond=formulaire_";
+
+/*
+ * Bloque les requêtes du type ?GLOBALS[type_urls]=toto (bug vieux php)
+ */
+if (isset($_REQUEST['GLOBALS']))
+	$ecran_securite_raison = "GLOBALS[GLOBALS]";
+
+/*
+ * Bloque les requêtes des bots sur:
+ * les agenda
+ * les paginations entremélées
+ */
+if (_IS_BOT AND (
+	(isset($_REQUEST['echelle']) AND isset($_REQUEST['partie_cal']) AND isset($_REQUEST['type']))
+	OR (strpos((string)$_SERVER['REQUEST_URI'],'debut_') AND preg_match(',[?&]debut_.*&debut_,', (string)$_SERVER['REQUEST_URI']))
+)
+)
+	$ecran_securite_raison = "robot agenda/double pagination";
+
+/*
+ * Bloque une vieille page de tests de CFG (<1.11)
+ * Bloque un XSS sur une page inexistante
+ */
+if (isset($_REQUEST['page'])) {
+	if ($_REQUEST['page']=='test_cfg')
+		$ecran_securite_raison = "test_cfg";
+	if ($_REQUEST['page'] !== htmlspecialchars((string)$_REQUEST['page']))
+		$ecran_securite_raison = "xsspage";
+	if ($_REQUEST['page'] == '404'
+	AND isset($_REQUEST['erreur']))
+		$ecran_securite_raison = "xss404";
+}
+
+/*
+ * XSS par array
+ */
+foreach (array('var_login') as $var)
+if (isset($_REQUEST[$var]) AND is_array($_REQUEST[$var]))
+	$ecran_securite_raison = "xss ".$var;
+
+/*
+ * Parade antivirale contre un cheval de troie
+ */
+if (!function_exists('tmp_lkojfghx')) {
+	function tmp_lkojfghx() {}
+	function tmp_lkojfghx2($a=0, $b=0, $c=0, $d=0) {
+		// si jamais on est arrivé ici sur une erreur php
+		// et qu'un autre gestionnaire d'erreur est défini, l'appeller
+		if ($b&&$GLOBALS['tmp_xhgfjokl'])
+			call_user_func($GLOBALS['tmp_xhgfjokl'],$a,$b,$c,$d);
+	}
+}
+if (isset($_POST['tmp_lkojfghx3']))
+	$ecran_securite_raison = "gumblar";
+
+/*
+ * Outils XML mal sécurisés < 2.0.9
+ */
+if (isset($_REQUEST['transformer_xml']))
+	$ecran_securite_raison = "transformer_xml";
+
+/*
+ * Sauvegarde mal securisée < 2.0.9
+ */
+if (isset($_REQUEST['nom_sauvegarde'])
+AND strstr((string)$_REQUEST['nom_sauvegarde'], '/'))
+	$ecran_securite_raison = 'nom_sauvegarde manipulee';
+if (isset($_REQUEST['znom_sauvegarde'])
+AND strstr((string)$_REQUEST['znom_sauvegarde'], '/'))
+	$ecran_securite_raison = 'znom_sauvegarde manipulee';
+
+
+/*
+ * op permet des inclusions arbitraires ;
+ * on vérifie 'page' pour ne pas bloquer ... drupal
+ */
+if (isset($_REQUEST['op']) AND isset($_REQUEST['page'])
+AND $_REQUEST['op'] !== preg_replace('/[^\-\w]/', '', $_REQUEST['op']))
+	$ecran_securite_raison = 'op';
+
+/*
+ * Forms & Table ne se méfiait pas assez des uploads de fichiers
+ */
+if (count($_FILES)){
+	foreach($_FILES as $k=>$v){
+		 if (preg_match(',^fichier_\d+$,',$k)
+		 AND preg_match(',\.php,i',$v['name']))
+		 	unset($_FILES[$k]);
+	}
+}
+
+/*
+ * reinstall=oui un peu trop permissif
+ */
+if (isset($_REQUEST['reinstall'])
+AND $_REQUEST['reinstall'] == 'oui')
+	$ecran_securite_raison = 'reinstall=oui';
+
+/*
+ * Échappement xss referer
+ */
+if (isset($_SERVER['HTTP_REFERER']))
+	$_SERVER['HTTP_REFERER'] = strtr($_SERVER['HTTP_REFERER'], '<>"\'', '[]##');
+
+/*
+ * Réinjection des clés en html dans l'admin r19561
+ */
+if (strpos($_SERVER['REQUEST_URI'],"ecrire/")!==false){
+	$zzzz=implode("",array_keys($_REQUEST));
+	if (strlen($zzzz)!=strcspn($zzzz,'<>"\''))
+		$ecran_securite_raison = 'Cle incorrecte en $_REQUEST';
+}
+
+/*
+ * Injection par connect
+ */
+if (isset($_REQUEST['connect'])
+	AND
+	// cas qui permettent de sortir d'un commentaire PHP
+	(strpos($_REQUEST['connect'], "?")!==false
+	 OR strpos($_REQUEST['connect'], ">")!==false
+	 OR strpos($_REQUEST['connect'], "\n")!==false
+	 OR strpos($_REQUEST['connect'], "\r")!==false)
+	) {
+	$_REQUEST['connect'] = str_replace(array("?", ">", "\r", "\n"), "", $_REQUEST['connect']);
+	if (isset($_GET['connect'])) $_GET['connect'] = $_REQUEST['connect'];
+	if (isset($_POST['connect'])) $_POST['connect'] = $_REQUEST['connect'];
+}
+
+/*
+ * S'il y a une raison de mourir, mourons
+ */
+if (isset($ecran_securite_raison)) {
+	header("HTTP/1.0 403 Forbidden");
+	header("Expires: Wed, 11 Jan 1984 05:00:00 GMT");
+	header("Cache-Control: no-cache, must-revalidate");
+	header("Pragma: no-cache");
+	header("Content-Type: text/html");
+	die("<html><title>Error 403: Forbidden</title><body><h1>Error 403</h1><p>You are not authorized to view this page ($ecran_securite_raison)</p></body></html>");
+}
+
+/*
+ * Fin sécurité
+ */
+
+
+
+/*
+ * Bloque les bots quand le load déborde
+ */
+if (!defined('_ECRAN_SECURITE_LOAD'))
+	define('_ECRAN_SECURITE_LOAD', 4);
+
+if (
+	defined('_ECRAN_SECURITE_LOAD')
+	AND _ECRAN_SECURITE_LOAD>0
+	AND _IS_BOT
+	AND $_SERVER['REQUEST_METHOD'] === 'GET'
+	AND (
+		(function_exists('sys_getloadavg')
+		  AND $load = sys_getloadavg()
+		  AND is_array($load)
+		  AND $load = array_shift($load)
+		)
+		OR
+		(@is_readable('/proc/loadavg')
+		  AND $load = file_get_contents('/proc/loadavg')
+		  AND $load = floatval($load)
+		)
+	)
+	AND $load > _ECRAN_SECURITE_LOAD // eviter l'evaluation suivante si de toute facon le load est inferieur a la limite
+	AND rand(0, $load*$load) > _ECRAN_SECURITE_LOAD*_ECRAN_SECURITE_LOAD
+) {
+	header("HTTP/1.0 503 Service Unavailable");
+	header("Retry-After: 300");
+	header("Expires: Wed, 11 Jan 1984 05:00:00 GMT");
+	header("Cache-Control: no-cache, must-revalidate");
+	header("Pragma: no-cache");
+	header("Content-Type: text/html");
+	die("<html><title>Status 503: Site temporarily unavailable</title><body><h1>Status 503</h1><p>Site temporarily unavailable (load average $load)</p></body></html>");
+}
+
+
+?>
