Index: /FCKeditor/releases/latest/_samples/asp/sample02.asp
===================================================================
--- /FCKeditor/releases/latest/_samples/asp/sample02.asp	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/asp/sample02.asp	(revision 3825)
@@ -87,4 +87,10 @@
 sBasePath = Left( sBasePath, InStrRev( sBasePath, "/_samples" ) )
 
+'This RegExp is used to sanitize recived lang parameter
+Dim oRegex
+Set oRegex = New RegExp
+oRegex.Global		= True
+oRegex.Pattern = "[^a-z\-]"
+
 Dim oFCKeditor
 Set oFCKeditor = New FCKeditor
@@ -96,5 +102,5 @@
 Else
 	oFCKeditor.Config("AutoDetectLanguage") = False
-	oFCKeditor.Config("DefaultLanguage")    = Request.QueryString("Lang")
+	oFCKeditor.Config("DefaultLanguage")    =  oRegex.Replace( Request.QueryString("Lang"), "")
 End If
 
Index: /FCKeditor/releases/latest/_samples/asp/sample03.asp
===================================================================
--- /FCKeditor/releases/latest/_samples/asp/sample03.asp	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/asp/sample03.asp	(revision 3825)
@@ -75,4 +75,10 @@
 sBasePath = Left( sBasePath, InStrRev( sBasePath, "/_samples" ) )
 
+'This RegExp is used to sanitize recived toolbar parameter
+Dim oRegex
+Set oRegex = New RegExp
+oRegex.Global		= True
+oRegex.Pattern = "[^a-zA-Z]"
+
 Dim oFCKeditor
 Set oFCKeditor = New FCKeditor
@@ -80,5 +86,5 @@
 
 If Request.QueryString("Toolbar") <> "" Then
-	oFCKeditor.ToolbarSet = Server.HTMLEncode( Request.QueryString("Toolbar") )
+	oFCKeditor.ToolbarSet = oRegex.Replace( Request.QueryString("Toolbar"), "" )
 End If
 
Index: /FCKeditor/releases/latest/_samples/asp/sample04.asp
===================================================================
--- /FCKeditor/releases/latest/_samples/asp/sample04.asp	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/asp/sample04.asp	(revision 3825)
@@ -81,4 +81,10 @@
 sBasePath = Left( sBasePath, InStrRev( sBasePath, "/_samples" ) )
 
+'This RegExp is used to sanitize recived skin parameter
+Dim oRegex
+Set oRegex = New RegExp
+oRegex.Global		= True
+oRegex.Pattern = "[^a-zA-Z0-9]"
+
 Dim oFCKeditor
 Set oFCKeditor = New FCKeditor
@@ -86,5 +92,5 @@
 
 If Request.QueryString("Skin") <> "" Then
-	oFCKeditor.Config("SkinPath") = sBasePath + "editor/skins/" & Server.HTMLEncode( Request.QueryString("Skin") ) + "/"
+	oFCKeditor.Config("SkinPath") = sBasePath + "editor/skins/" & oRegex.Replace( Request.QueryString("Skin"), "" ) + "/"
 End If
 
Index: /FCKeditor/releases/latest/_samples/asp/sampleposteddata.asp
===================================================================
--- /FCKeditor/releases/latest/_samples/asp/sampleposteddata.asp	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/asp/sampleposteddata.asp	(revision 3825)
@@ -48,5 +48,5 @@
 			%>
 			<tr>
-				<th><%=sForm%></th>
+				<th><%=Server.HTMLEncode( sForm )%></th>
 				<td><pre><%=Server.HTMLEncode( Request.Form(sForm) )%></pre></td>
 			</tr>
Index: /FCKeditor/releases/latest/_samples/cfm/sample02.cfm
===================================================================
--- /FCKeditor/releases/latest/_samples/cfm/sample02.cfm	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/cfm/sample02.cfm	(revision 3825)
@@ -83,5 +83,5 @@
 <cfif isDefined( "URL.Lang" )>
 	<cfset config["AutoDetectLanguage"]		= false>
-	<cfset config["DefaultLanguage"]		= HTMLEditFormat( URL.Lang )>
+	<cfset config["DefaultLanguage"]		= REReplaceNoCase( URL.Lang, "[^a-z\-]", "", "all" )>
 <cfelse>
 	<cfset config["AutoDetectLanguage"]		= true>
Index: /FCKeditor/releases/latest/_samples/cfm/sample02_mx.cfm
===================================================================
--- /FCKeditor/releases/latest/_samples/cfm/sample02_mx.cfm	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/cfm/sample02_mx.cfm	(revision 3825)
@@ -96,5 +96,5 @@
 		{
 			fckEditor.config["AutoDetectLanguage"]		= false ;
-			fckEditor.config["DefaultLanguage"]			= HTMLEditFormat( URL.Lang ) ;
+			fckEditor.config["DefaultLanguage"]			= REReplaceNoCase( URL.Lang, "[^a-z\-]", "", "all" ) ;
 		}
 		else
Index: /FCKeditor/releases/latest/_samples/cfm/sample03.cfm
===================================================================
--- /FCKeditor/releases/latest/_samples/cfm/sample03.cfm	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/cfm/sample03.cfm	(revision 3825)
@@ -68,5 +68,5 @@
 
 <cfif isDefined( "URL.Toolbar" )>
-	<cfset toolbarSet = HTMLEditFormat( URL.Toolbar )>
+	<cfset toolbarSet = REReplaceNoCase( URL.Toolbar, "[^a-z]", "", "all" )>
 <cfelse>
 	<cfset toolbarSet = "Default">
Index: /FCKeditor/releases/latest/_samples/cfm/sample03_mx.cfm
===================================================================
--- /FCKeditor/releases/latest/_samples/cfm/sample03_mx.cfm	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/cfm/sample03_mx.cfm	(revision 3825)
@@ -82,5 +82,5 @@
 		if ( isDefined( "URL.Toolbar" ) )
 		{
-			fckEditor.ToolbarSet		= HTMLEditFormat( URL.Toolbar ) ;
+			fckEditor.ToolbarSet		= REReplaceNoCase( URL.Toolbar, "[^a-z]", "", "all" ) ;
 		}
 		fckEditor.create() ; // create the editor.
Index: /FCKeditor/releases/latest/_samples/cfm/sample04.cfm
===================================================================
--- /FCKeditor/releases/latest/_samples/cfm/sample04.cfm	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/cfm/sample04.cfm	(revision 3825)
@@ -78,5 +78,5 @@
 <cfset config = structNew()>
 <cfif isDefined( "URL.Skin" )>
-	<cfset config["SkinPath"] = basePath & 'editor/skins/' & HTMLEditFormat( URL.Skin ) & '/'>
+	<cfset config["SkinPath"] = basePath & 'editor/skins/' & REReplaceNoCase( URL.Skin, "[^a-z0-9]", "", "all" ) & '/'>
 </cfif>
 
Index: /FCKeditor/releases/latest/_samples/cfm/sample04_mx.cfm
===================================================================
--- /FCKeditor/releases/latest/_samples/cfm/sample04_mx.cfm	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/cfm/sample04_mx.cfm	(revision 3825)
@@ -88,5 +88,5 @@
 		if ( isDefined( "URL.Skin" ) )
 		{
-			fckEditor.config['SkinPath'] = basePath & 'editor/skins/' & HTMLEditFormat( URL.Skin ) & '/' ;
+			fckEditor.config['SkinPath'] = basePath & 'editor/skins/' & REReplaceNoCase( URL.Skin, "[^a-z0-9]", "", "all" ) & '/' ;
 		}
 		fckEditor.create() ; // create the editor.
Index: /FCKeditor/releases/latest/_samples/cfm/sampleposteddata.cfm
===================================================================
--- /FCKeditor/releases/latest/_samples/cfm/sampleposteddata.cfm	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/cfm/sampleposteddata.cfm	(revision 3825)
@@ -35,5 +35,4 @@
 		This page lists all data posted by the form.
 		<hr>
-<cfif listFirst( server.coldFusion.productVersion ) LT 6>
 	<cfif isDefined( 'FORM.fieldnames' )>
 		<cfoutput>
@@ -49,20 +48,23 @@
 		<tr>
 			<th>FieldNames</th>
-			<td>#FORM.fieldNames#</td>
+			<td>#HTMLEditFormat( FORM.fieldNames )#</td>
 		</tr>
 		<cfloop list="#FORM.fieldnames#" index="key">
-		<tr>
-			<th>#key#</th>
-			<td><pre>#HTMLEditFormat( evaluate( "FORM.#key#" ) )#</pre></td>
-		</tr>
+			<tr>
+				<th>#HTMLEditFormat( key )#</th>
+				<td><pre>
+			<cftry>
+				<cfif isDefined( 'FORM.' & #key# ) and REFindNoCase("^[a-z0-9]+$", key)>
+					#HTMLEditFormat( evaluate( "FORM.#key#" ) )#
+				</cfif>
+			<cfcatch type="any">
+			</cfcatch>
+			</cftry>
+				</pre></td>
+			</tr>
 		</cfloop>
 		</table>
 		</cfoutput>
 	</cfif>
-<cfelse>
-	<cfdump var="#FORM#" label="Dump of FORM Variables">
-</cfif>
-
-
 	</body>
 </html>
Index: /FCKeditor/releases/latest/_samples/lasso/sample02.lasso
===================================================================
--- /FCKeditor/releases/latest/_samples/lasso/sample02.lasso	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/lasso/sample02.lasso	(revision 3825)
@@ -85,5 +85,5 @@
 		var('config') = array(
 			'AutoDetectLanguage' = 'false',
-			'DefaultLanguage' = action_param('Lang')
+			'DefaultLanguage' = (String_ReplaceRegExp: action_param('Lang'), -find='[^a-z\-]', -replace='')
 		);
 	else;
Index: /FCKeditor/releases/latest/_samples/lasso/sample03.lasso
===================================================================
--- /FCKeditor/releases/latest/_samples/lasso/sample03.lasso	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/lasso/sample03.lasso	(revision 3825)
@@ -76,5 +76,5 @@
 
 	if(action_param('Toolbar'));
-		$myeditor->toolbarset = action_param('Toolbar');
+		$myeditor->toolbarset = (String_ReplaceRegExp: action_param('Toolbar'), -find='[^a-zA-Z]', -replace='');
 	/if;
 
Index: /FCKeditor/releases/latest/_samples/lasso/sample04.lasso
===================================================================
--- /FCKeditor/releases/latest/_samples/lasso/sample04.lasso	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/lasso/sample04.lasso	(revision 3825)
@@ -82,5 +82,6 @@
 
 	if(action_param('Skin'));
-		$myeditor->config = array('SkinPath' = $basepath + 'editor/skins/' + action_param('Skin') + '/');
+		var('skin') = (String_ReplaceRegExp: action_param('Skin'), -find='[^a-zA-Z0-9]', -replace='');
+		$myeditor->config = array('SkinPath' = $basepath + 'editor/skins/' + $skin + '/');
 	/if;
 
Index: /FCKeditor/releases/latest/_samples/lasso/sampleposteddata.lasso
===================================================================
--- /FCKeditor/releases/latest/_samples/lasso/sampleposteddata.lasso	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/lasso/sampleposteddata.lasso	(revision 3825)
@@ -45,6 +45,6 @@
 [iterate(client_postparams, local('this'))]
 			<tr>
-				<th>[#this->first]</th>
-				<td><pre>[#this->second]</pre></td>
+				<th>[Encode_HTML: #this->first]</th>
+				<td><pre>[Encode_HTML: #this->second]</pre></td>
 			</tr>
 [/iterate]
Index: /FCKeditor/releases/latest/_samples/perl/sample01.cgi
===================================================================
--- /FCKeditor/releases/latest/_samples/perl/sample01.cgi	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/perl/sample01.cgi	(revision 3825)
Index: /FCKeditor/releases/latest/_samples/perl/sample02.cgi
===================================================================
--- /FCKeditor/releases/latest/_samples/perl/sample02.cgi	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/perl/sample02.cgi	(revision 3825)
@@ -145,5 +145,7 @@
 	if($FORM{'Lang'} ne "") {
 		$Config{'AutoDetectLanguage'}	= "false";
-		$Config{'DefaultLanguage'}		= $FORM{'Lang'};
+		$lang = $FORM{'Lang'};
+		$lang =~ s/[^a-z\-]//ig;
+		$Config{'DefaultLanguage'}		= $lang;
 	} else {
 		$Config{'AutoDetectLanguage'}	= "true";
Index: /FCKeditor/releases/latest/_samples/perl/sample03.cgi
===================================================================
--- /FCKeditor/releases/latest/_samples/perl/sample03.cgi	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/perl/sample03.cgi	(revision 3825)
@@ -133,5 +133,6 @@
 
 	if($FORM{'Toolbar'} ne "") {
-		$ToolbarSet = &specialchar_cnv( $FORM{'Toolbar'} );
+		$ToolbarSet = $FORM{'Toolbar'};
+		$ToolbarSet =~ s/[^a-z]//ig;
 	}
 	$Value = '<p>This is some <strong>sample text</strong>. You are using <a href="http://www.fckeditor.net/">FCKeditor</a>.</p>' ;
Index: /FCKeditor/releases/latest/_samples/perl/sample04.cgi
===================================================================
--- /FCKeditor/releases/latest/_samples/perl/sample04.cgi	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/perl/sample04.cgi	(revision 3825)
@@ -140,5 +140,7 @@
 
 	if($FORM{'Skin'} ne "") {
-		$Config{'SkinPath'} = $sBasePath . 'editor/skins/' . &specialchar_cnv( $FORM{'Skin'} ) . '/' ;
+		$skin = $FORM{'Skin'};
+		$skin =~ s/[^a-z0-9]//ig;
+		$Config{'SkinPath'} = $sBasePath . 'editor/skins/' . $skin . '/' ;
 	}
 	$Value = '<p>This is some <strong>sample text</strong>. You are using <a href="http://www.fckeditor.net/">FCKeditor</a>.</p>' ;
Index: /FCKeditor/releases/latest/_samples/perl/sampleposteddata.cgi
===================================================================
--- /FCKeditor/releases/latest/_samples/perl/sampleposteddata.cgi	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/perl/sampleposteddata.cgi	(revision 3825)
@@ -94,4 +94,5 @@
 	foreach $key (keys %FORM) {
 		$postedValue = &specialchar_cnv($FORM{$key});
+		$key = &specialchar_cnv($key);
 		print <<"_HTML_TAG_";
 			<tr>
Index: /FCKeditor/releases/latest/_samples/php/sample02.php
===================================================================
--- /FCKeditor/releases/latest/_samples/php/sample02.php	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/php/sample02.php	(revision 3825)
@@ -92,5 +92,5 @@
 {
 	$oFCKeditor->Config['AutoDetectLanguage']	= false ;
-	$oFCKeditor->Config['DefaultLanguage']		= $_GET['Lang'] ;
+	$oFCKeditor->Config['DefaultLanguage']		= preg_replace("/[^a-z\-]/i", "", $_GET['Lang']) ;
 }
 else
Index: /FCKeditor/releases/latest/_samples/php/sample03.php
===================================================================
--- /FCKeditor/releases/latest/_samples/php/sample03.php	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/php/sample03.php	(revision 3825)
@@ -78,5 +78,5 @@
 
 if ( isset($_GET['Toolbar']) )
-	$oFCKeditor->ToolbarSet = htmlspecialchars($_GET['Toolbar']);
+	$oFCKeditor->ToolbarSet = preg_replace("/[^a-z]/i", "", $_GET['Toolbar']);
 
 $oFCKeditor->Value = '<p>This is some <strong>sample text</strong>. You are using <a href="http://www.fckeditor.net/">FCKeditor</a>.</p>' ;
Index: /FCKeditor/releases/latest/_samples/php/sample04.php
===================================================================
--- /FCKeditor/releases/latest/_samples/php/sample04.php	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/php/sample04.php	(revision 3825)
@@ -84,5 +84,5 @@
 
 if ( isset($_GET['Skin']) )
-	$oFCKeditor->Config['SkinPath'] = $sBasePath . 'editor/skins/' . htmlspecialchars($_GET['Skin']) . '/' ;
+	$oFCKeditor->Config['SkinPath'] = $sBasePath . 'editor/skins/' . preg_replace("/[^a-z0-9]/i", "", $_GET['Skin']) . '/' ;
 
 $oFCKeditor->Value = '<p>This is some <strong>sample text</strong>. You are using <a href="http://www.fckeditor.net/">FCKeditor</a>.</p>' ;
Index: /FCKeditor/releases/latest/_samples/php/sampleposteddata.php
===================================================================
--- /FCKeditor/releases/latest/_samples/php/sampleposteddata.php	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/php/sampleposteddata.php	(revision 3825)
@@ -59,5 +59,5 @@
 ?>
 			<tr>
-				<th><?php echo $sForm?></th>
+				<th><?php echo htmlspecialchars($sForm) ?></th>
 				<td><pre><?php echo $postedValue?></pre></td>
 			</tr>
Index: /FCKeditor/releases/latest/_samples/py/sample01.py
===================================================================
--- /FCKeditor/releases/latest/_samples/py/sample01.py	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/py/sample01.py	(revision 3825)
@@ -69,8 +69,8 @@
 
 # For testing your environments
-print "<hr>"
-for key in os.environ.keys():
-	print "%s: %s<br>" % (key, os.environ.get(key, ""))
-print "<hr>"
+#print "<hr>"
+#for key in os.environ.keys():
+#	print "%s: %s<br>" % (key, os.environ.get(key, ""))
+#print "<hr>"
 
 # Document footer
Index: /FCKeditor/releases/latest/_samples/py/sampleposteddata.py
===================================================================
--- /FCKeditor/releases/latest/_samples/py/sampleposteddata.py	(revision 3824)
+++ /FCKeditor/releases/latest/_samples/py/sampleposteddata.py	(revision 3825)
@@ -71,5 +71,5 @@
 					<td><pre>%s</pre></td>
 				</tr>
-			""" % (key, value)
+			""" % (cgi.escape(key), cgi.escape(value))
 	except Exception, e:
 		print e
@@ -77,8 +77,8 @@
 
 # For testing your environments
-print "<hr>"
-for key in os.environ.keys():
-	print "%s: %s<br>" % (key, os.environ.get(key, ""))
-print "<hr>"
+#print "<hr>"
+#for key in os.environ.keys():
+#	print "%s: %s<br>" % (key, os.environ.get(key, ""))
+#print "<hr>"
 
 # Document footer
Index: /FCKeditor/releases/latest/_whatsnew.html
===================================================================
--- /FCKeditor/releases/latest/_whatsnew.html	(revision 3824)
+++ /FCKeditor/releases/latest/_whatsnew.html	(revision 3825)
@@ -33,4 +33,11 @@
 	<h1>
 		FCKeditor ChangeLog - What's New?</h1>
+	<h3>
+		Version 2.6.4.1</h3>
+	<p>
+		Fixed Bugs:</p>
+	<ul>
+		<li><strong>Security release, upgrade is highly recommended.</strong></li>
+	</ul>
 	<h3>
 		Version 2.6.4</h3>
Index: /FCKeditor/releases/latest/editor/_source/fckeditorapi.js
===================================================================
--- /FCKeditor/releases/latest/editor/_source/fckeditorapi.js	(revision 3824)
+++ /FCKeditor/releases/latest/editor/_source/fckeditorapi.js	(revision 3825)
@@ -41,6 +41,6 @@
 		var sScript =
 			'window.FCKeditorAPI = {' +
-				'Version : "2.6.4",' +
-				'VersionBuild : "21629",' +
+				'Version : "2.6.4.1",' +
+				'VersionBuild : "23187",' +
 				'Instances : window.FCKeditorAPI && window.FCKeditorAPI.Instances || {},' +
 
Index: /FCKeditor/releases/latest/editor/dialog/fck_about.html
===================================================================
--- /FCKeditor/releases/latest/editor/dialog/fck_about.html	(revision 3824)
+++ /FCKeditor/releases/latest/editor/dialog/fck_about.html	(revision 3825)
@@ -79,6 +79,6 @@
 								<span fcklang="DlgAboutVersion">version</span>
 								<br />
-								<b>2.6.4</b><br />
-								Build 21629</td>
+								<b>2.6.4.1</b><br />
+								Build 23187</td>
 						</tr>
 					</table>
Index: /FCKeditor/releases/latest/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.pl
===================================================================
--- /FCKeditor/releases/latest/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.pl	(revision 3824)
+++ /FCKeditor/releases/latest/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.pl	(revision 3825)
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/asp/basexml.asp
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/asp/basexml.asp	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/asp/basexml.asp	(revision 3825)
@@ -57,5 +57,9 @@
 	Response.Write "<?xml version=""1.0"" encoding=""utf-8"" ?>"
 
+	If text <> "" then
 	Response.Write "<Connector><Error number=""" & number & """ text=""" & Server.HTMLEncode( text ) & """ /></Connector>"
+	else
+	Response.Write "<Connector><Error number=""" & number & """ /></Connector>"
+	end if
 
 	Response.End
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/asp/commands.asp
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/asp/commands.asp	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/asp/commands.asp	(revision 3825)
@@ -131,5 +131,5 @@
 
 	' Create the "Error" node.
-	Response.Write "<Error number=""" & sErrorNumber & """ originalNumber=""" & iErrNumber & """ originalDescription=""" & ConvertToXmlAttribute( sErrDescription ) & """ />"
+	Response.Write "<Error number=""" & sErrorNumber & """ />"
 End Sub
 
@@ -193,5 +193,9 @@
 	sFileUrl = CombinePaths( sFileUrl, sFileName )
 
-	SendUploadResults sErrorNumber, sFileUrl, sFileName, ""
+	If ( sErrorNumber = "0" or sErrorNumber = "201" ) then
+		SendUploadResults sErrorNumber, sFileUrl, sFileName, ""
+	Else
+		SendUploadResults sErrorNumber, "", "", ""
+	End If
 End Sub
 
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/asp/connector.asp
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/asp/connector.asp	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/asp/connector.asp	(revision 3825)
@@ -58,5 +58,5 @@
 	' Check if it is an allowed resource type.
 	if ( Not IsAllowedType( sResourceType ) ) Then
-		SendError 1, "The """ & sResourceType & """ resource type isn't allowed"
+		SendError 1, "Invalid type specified"
 	end if
 
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/asp/io.asp
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/asp/io.asp	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/asp/io.asp	(revision 3825)
@@ -176,4 +176,6 @@
 function GetCurrentFolder()
 	dim sCurrentFolder
+	dim oRegex
+
 	sCurrentFolder = Request.QueryString("CurrentFolder")
 	If ( sCurrentFolder = "" ) Then sCurrentFolder = "/"
@@ -185,4 +187,12 @@
 	' Check for invalid folder paths (..)
 	If ( InStr( 1, sCurrentFolder, ".." ) <> 0 OR InStr( 1, sCurrentFolder, "\" ) <> 0) Then
+		SendError 102, ""
+	End If
+
+	Set oRegex = New RegExp
+	oRegex.Global		= True
+	oRegex.Pattern = "(/\.)|(//)|([\\:\*\?\""\<\>\|]|[\u0000-\u001F]|\u007F)"
+
+	if (oRegex.Test(sCurrentFolder)) Then
 		SendError 102, ""
 	End If
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/asp/upload.asp
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/asp/upload.asp	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/asp/upload.asp	(revision 3825)
@@ -49,5 +49,5 @@
 	If ( sResourceType = "" ) Then sResourceType = "File"
 
-	sCurrentFolder = GetCurrentFolder()
+	sCurrentFolder = "/"
 
 	' Is Upload enabled?
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf5_connector.cfm
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf5_connector.cfm	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf5_connector.cfm	(revision 3825)
@@ -103,6 +103,31 @@
 	rootPath = left( serverPath, Len(serverPath) - Len(userFilesPath) ) ;
 	xmlContent = ""; // append to this string to build content
+	invalidName = false;
 </cfscript>
 
+
+<cfif not config.enabled>
+
+	<cfset xmlContent = "<Error number=""1"" text=""This connector is disabled. Please check the 'editor/filemanager/connectors/cfm/config.cfm' file"" />">
+
+<cfelseif find("..",url.currentFolder) or find("\",url.currentFolder) or REFind('(/\.)|(//)|[[:cntrl:]]|([\\:\*\?\"<>])', url.currentFolder)>
+
+	<cfset invalidName = true>
+	<cfset xmlContent = "<Error number=""102"" />">
+
+<cfelseif isDefined("Config.ConfigAllowedCommands") and not ListFind(Config.ConfigAllowedCommands, url.command)>
+
+	<cfset invalidName = true>
+	<cfset xmlContent = '<Error number="1" text="The &quot;' & HTMLEditFormat(url.command) & '&quot; command isn''t allowed" />'>
+
+<cfelseif isDefined("Config.ConfigAllowedTypes") and not ListFind(Config.ConfigAllowedTypes, url.type)>
+
+	<cfset invalidName = true>
+	<cfset xmlContent = '<Error number="1" text="Invalid type specified" />'>
+
+</cfif>
+
+<cfset resourceTypeUrl = "">
+<cfif not len(xmlContent)>
 <cfset resourceTypeUrl = rereplace( replace( Config.FileTypesPath[url.type], fs, "/", "all"), "/$", "") >
 
@@ -126,23 +151,6 @@
 <cfset userFilesServerPath = replace( userFilesServerPath, fs & fs, fs, "all") >
 
-<cfif not config.enabled>
-
-	<cfset xmlContent = "<Error number=""1"" text=""This connector is disabled. Please check the 'editor/filemanager/connectors/cfm/config.cfm' file"" />">
-
-<cfelseif find("..",url.currentFolder) or find("\",url.currentFolder)>
-
-	<cfset xmlContent = "<Error number=""102"" />">
-
-<cfelseif isDefined("Config.ConfigAllowedCommands") and not ListFind(Config.ConfigAllowedCommands, url.command)>
-
-	<cfset xmlContent = '<Error number="1" text="The &quot;' & url.command & '&quot; command isn''t allowed" />'>
-
-<cfelseif isDefined("Config.ConfigAllowedTypes") and not ListFind(Config.ConfigAllowedTypes, url.type)>
-
-	<cfset xmlContent = '<Error number="1" text="The &quot;' & url.type & '&quot; type isn''t allowed" />'>
-
-</cfif>
-
 <cfset resourceTypeDirectory = left( userFilesServerPath, Len(userFilesServerPath) - Len(url.currentFolder) )>
+</cfif>
 
 <cfif not len(xmlContent) and not directoryexists(resourceTypeDirectory)>
@@ -264,4 +272,5 @@
 					newFolderName = reReplace(newFolderName, "([^_]+)_+$", "\1", "all");
 					newFolderName = reReplace(newFolderName, "$_([^_]+)$", "\1", "all");
+					newFolderName = reReplace(newFolderName, '\.+', "_", "all" );
 				}
 			</cfscript>
@@ -272,5 +281,5 @@
 				<cfset errorNumber = 101>
 			<cfelseif reFind("^\.\.",newFolderName)>
-				<cfset errorNumber = 103>
+				<cfset errorNumber = 102>
 			<cfelse>
 				<cfset errorNumber = 0>
@@ -304,6 +313,12 @@
 
 <cfscript>
-	xmlHeader = '<?xml version="1.0" encoding="utf-8" ?><Connector command="#url.command#" resourceType="#url.type#">';
-	xmlHeader = xmlHeader & '<CurrentFolder path="#url.currentFolder#" url="#resourceTypeUrl##url.currentFolder#" />';
+	xmlHeader = '<?xml version="1.0" encoding="utf-8" ?>';
+	if (invalidName) {
+		xmlHeader = xmlHeader & '<Connector>';
+	}
+	else {
+		xmlHeader = xmlHeader & '<Connector command="#url.command#" resourceType="#url.type#">';
+		xmlHeader = xmlHeader & '<CurrentFolder path="#url.currentFolder#" url="#resourceTypeUrl##url.currentFolder#" />';
+	}
 	xmlFooter = '</Connector>';
 </cfscript>
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf5_upload.cfm
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf5_upload.cfm	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf5_upload.cfm	(revision 3825)
@@ -40,4 +40,8 @@
 <cfparam name="url.currentFolder" default="/">
 
+<cfif url.command eq "QuickUpload">
+	<cfset url.currentFolder = "/">
+</cfif>
+
 <cfif not isDefined("config_included")>
 	<cfinclude template="config.cfm">
@@ -75,4 +79,10 @@
 	<cfabort>
 </cfif>
+
+<cfif REFind('(/\.)|(//)|[[:cntrl:]]|([\\:\*\?\"<>])', url.currentFolder)>
+	<cfset SendUploadResults(102)>
+	<cfabort>
+</cfif>
+
 
 <cfscript>
@@ -139,5 +149,5 @@
 		</cftry>
 	</cfif>
-<cfelse>
+<cfelseif url.command eq "FileUpload">
 	<cfset resourceTypeUrl = rereplace( replace( Config.FileTypesPath[url.type], fs, "/", "all"), "/$", "") >
 	<cfif isDefined( "Config.FileTypesAbsolutePath" )
@@ -287,5 +297,5 @@
 <cfif errorNumber EQ 0>
 	<!--- file was uploaded succesfully --->
-	<cfset SendUploadResults(errorNumber, '#resourceTypeUrl##url.currentFolder##fileName#.#fileExt#', "", "")>
+	<cfset SendUploadResults(errorNumber, '#resourceTypeUrl##url.currentFolder##fileName#.#fileExt#', replace( fileName & "." & fileExt, "'", "\'", "ALL"), "")>
 	<cfabort>
 <cfelseif errorNumber EQ 201>
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf_basexml.cfm
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf_basexml.cfm	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf_basexml.cfm	(revision 3825)
@@ -65,4 +65,8 @@
 	<cfargument name="number" required="true" type="Numeric">
 	<cfargument name="text" required="true">
-	<cfoutput><Error number="#ARGUMENTS.number#" text="#htmleditformat(ARGUMENTS.text)#" /></cfoutput>
+	<cfif Len(ARGUMENTS.text)>
+		<cfoutput><Error number="#ARGUMENTS.number#" text="#htmleditformat(ARGUMENTS.text)#" /></cfoutput>
+	<cfelse>
+		<cfoutput><Error number="#ARGUMENTS.number#" /></cfoutput>
+	</cfif>
 </cffunction>
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf_commands.cfm
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf_commands.cfm	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf_commands.cfm	(revision 3825)
@@ -36,5 +36,5 @@
 	<cfset var sTempFilePath = "">
 	<cfset var errorNumber = 0>
-	<cfset var customMsg = 0>
+	<cfset var customMsg = "">
 	<cfset var counter = 0>
 	<cfset var destination = "">
@@ -227,4 +227,4 @@
 	</cfif>
 
-	<cfoutput><Error number="#errorNumber#" originalDescription="#HTMLEditFormat(sErrorMsg)#" /></cfoutput>
-</cffunction>
+	<cfoutput><Error number="#errorNumber#" /></cfoutput>
+</cffunction>
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf_io.cfm
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf_io.cfm	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf_io.cfm	(revision 3825)
@@ -194,6 +194,10 @@
 	<cfset sCurrentFolder = rereplace( sCurrentFolder, "//+", "/", "all" )>
 
-	<cfif find( "..", sCurrentFolder) or find( "\", sCurrentFolder) >
-		<cfset SendError( 102, "" )>
+	<cfif find( "..", sCurrentFolder) or find( "\", sCurrentFolder) or REFind('(/\.)|(//)|[[:cntrl:]]|([\\:\*\?\"<>])', sCurrentFolder)>
+		<cfif URL.Command eq "FileUpload" or URL.Command eq "QuickUpload">
+			<cfset SendUploadResults( 102, "", "", "") >
+		<cfelse>
+			<cfset SendError( 102, "" )>
+		</cfif>
 	</cfif>
 
@@ -266,4 +270,8 @@
 	<cfargument name="customMsg" required="false" type="String" default="">
 
+	<cfif errorNumber and errorNumber neq 201>
+		<cfset fileUrl = "">
+		<cfset fileName = "">
+	</cfif>
 	<!--- Minified version of the document.domain automatic fix script (#1919).
 	The original script can be found at _dev/domain_fix_template.js --->
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf_upload.cfm
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf_upload.cfm	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/cf_upload.cfm	(revision 3825)
@@ -25,5 +25,4 @@
 
 <cfparam name="url.type" default="File">
-<cfparam name="url.currentFolder" default="/">
 
 <!--- note: no serverPath url parameter - see config.cfm if you need to set the serverPath manually --->
@@ -37,5 +36,5 @@
 	<cfargument name="number" required="true" type="Numeric">
 	<cfargument name="text" required="true">
-	<cfreturn SendUploadResults( "#ARGUMENTS.number#", "", "", "ARGUMENTS.text" )>
+	<cfreturn SendUploadResults( "#ARGUMENTS.number#", "", "", "#ARGUMENTS.text#" )>
 </cffunction>
 
@@ -58,5 +57,5 @@
 </cfif>
 
-<cfset sCurrentFolder = GetCurrentFolder()>
+<cfset sCurrentFolder = "/">
 
 <!--- Is enabled the upload? --->
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/config.cfm
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/config.cfm	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/cfm/config.cfm	(revision 3825)
@@ -28,5 +28,4 @@
 	// SECURITY: You must explicitly enable this "connector". (Set enabled to "true")
 	Config.Enabled = false ;
-
 
 	// Path to uploaded files relative to the document root.
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/lasso/connector.lasso
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/lasso/connector.lasso	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/lasso/connector.lasso	(revision 3825)
@@ -39,6 +39,6 @@
     */
 	var(
-		'Command'		=	action_param('Command'),
-		'Type'			=	action_param('Type'),
+		'Command'		=	(Encode_HTML: action_param('Command')),
+		'Type'			=	(Encode_HTML: action_param('Type')),
 		'CurrentFolder'	=	action_param('CurrentFolder'),
 		'ServerPath'	=	action_param('ServerPath'),
@@ -71,43 +71,14 @@
 		$__html_reply__ = '\
 <script type="text/javascript">
-(function()
-{
-	var d = document.domain ;
-
-	while ( true )
-	{
-		// Test if we can access a parent property.
-		try
-		{
-			var test = window.top.opener.document.domain ;
-			break ;
-		}
-		catch( e ) {}
-
-		// Remove a domain part: www.mytest.example.com => mytest.example.com => example.com ...
-		d = d.replace( /.*?(?:\\.|$)/, "" ) ;
-
-		if ( d.length == 0 )
-			break ;		// It was not able to detect the domain.
-
-		try
-		{
-			document.domain = d ;
-		}
-		catch (e)
-		{
-			break ;
-		}
-	}
-})() ;
+(function(){var d=document.domain;while (true){try{var A=window.parent.document.domain;break;}catch(e) {};d=d.replace(/.*?(?:\\.|$)/,\'\');if (d.length==0) break;try{document.domain=d;}catch (e){break;}}})();
 ';
 			if($uploadResult == '0' || $uploadResult == '201');
 			$__html_reply__ = $__html_reply__ + '\
-	window.parent.OnUploadCompleted(' + $uploadResult + ',\'' + $NewFilePath + '\',\'' + $NewFilePath->split('/')->last + '\');
+	window.parent.OnUploadCompleted(' + $uploadResult + ',"' + $NewFilePath + '","' + $NewFilePath->split('/')->last + '");
 </script>
 			';
 			else;
 			$__html_reply__ = $__html_reply__ + '\
-	window.parent.OnUploadCompleted(' + $uploadResult + ');
+	window.parent.OnUploadCompleted(' + $uploadResult + ',"","");
 </script>
 			';
@@ -126,5 +97,18 @@
 	);
 
-	if($CurrentFolder->(Find: '..') || $CurrentFolder->(Find: '\\'));
+	$currentFolderURL = string_replace($currentFolderURL, -find='//', -replace='/');
+
+	if (!$config->find('Subdirectories')->find(action_param('Type')));
+		if($Command == 'FileUpload');
+			$responseType = 'html';
+			$uploadResult = '1';
+			fck_htmlreply(
+				-uploadResult=$uploadResult
+			);
+		else;
+			$errorNumber = 1;
+			$commandData += '<Error number="' + $errorNumber + '" text="Invalid type specified" />\n';
+		/if;
+	else if($CurrentFolder->(Find: '..') || (String_FindRegExp: $CurrentFolder, -Find='(/\\.)|(//)|[\\\\:\\*\\?\\""\\<\\>\\|]|\\000|[\u007F]|[\u0001-\u001F]'));
 		if($Command == 'FileUpload');
 			$responseType = 'html';
@@ -143,5 +127,6 @@
     entire process in an inline for file tag permissions.
     */
-	inline($connection);
+		if($config->find('Enabled'));
+		inline($connection);
 		select($Command);
             /*.............................................................
@@ -167,5 +152,11 @@
 						$folders += '\t\t<Folder name="' + #this->removetrailing('/')& + '" />\n';
 					else;
-						local('size') = file_getsize($currentFolderURL + #this) / 1024;
+						local('size') = file_getsize($currentFolderURL + #this);
+						if($size>0);
+							$size = $size/1024;
+							if ($size==0);
+								$size = 1;
+							/if;
+						/if;
 						$files += '\t\t<File name="' + #this + '" size="' + #size + '" />\n';
 					/if;
@@ -182,5 +173,5 @@
             */
 			case('CreateFolder');
-				$NewFolderName = (String_ReplaceRegExp: $NewFolderName, -find='\\.|\\\\|\\/|\\||\\:|\\?|\\*|"|<|>', -replace='_');
+				$NewFolderName = (String_ReplaceRegExp: $NewFolderName, -find='\\.|\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|\\000|[\u007F]|[\u0001-\u001F]', -replace='_');
 				var('newFolder' = $currentFolderURL + $NewFolderName + '/');
 				file_create($newFolder);
@@ -234,9 +225,10 @@
                     */
 					$NewFileName = $NewFile->find('OrigName');
-					$NewFileName = (String_ReplaceRegExp: $NewFileName, -find='\\\\|\\/|\\||\\:|\\?|\\*|"|<|>', -replace='_');
+					$NewFileName = (String_ReplaceRegExp: $NewFileName, -find='\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|\\000|[\u007F]|[\u0001-\u001F]', -replace='_');
+					$NewFileName = (String_ReplaceRegExp: $NewFileName, -find='\\.(?![^.]*$)', -replace='_');
 					$OrigFilePath = $currentFolderURL + $NewFileName;
 					$NewFilePath = $OrigFilePath;
 					local('fileExtension') = '.' + $NewFile->find('OrigExtension');
-					#fileExtension = (String_ReplaceRegExp: #fileExtension, -find='\\\\|\\/|\\||\\:|\\?|\\*|"|<|>', -replace='_');
+					#fileExtension = (String_ReplaceRegExp: #fileExtension, -find='\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|\\000|[\u007F]|[\u0001-\u001F]', -replace='_');
 					local('shortFileName') = $NewFileName->removetrailing(#fileExtension)&;
 
@@ -245,5 +237,9 @@
                     Make sure the file extension is allowed.
                     */
-					if($config->find('DeniedExtensions')->find($Type) >> $NewFile->find('OrigExtension'));
+					local('allowedExt') = $config->find('AllowedExtensions')->find($Type);
+					local('deniedExt') = $config->find('DeniedExtensions')->find($Type);
+					if($allowedExt->Size > 0 && $allowedExt !>> $NewFile->find('OrigExtension'));
+						$uploadResult = '202';
+					else($deniedExt->Size > 0 && $deniedExt >> $NewFile->find('OrigExtension'));
 						$uploadResult = '202';
 					else;
@@ -278,6 +274,13 @@
 					-NewFilePath=$NewFilePath
 				);
+			case;
+				$errorNumber = 1;
+				$commandData += '<Error number="' + $errorNumber + '" text="Command isn\'t allowed" />\n';
 		/select;
-	/inline;
+		/inline;
+		else;
+			$errorNumber = 1;
+			$commandData += '<Error number="' + $errorNumber + '" text="This file uploader is disabled. Please check the editor/filemanager/upload/lasso/config.lasso file." />\n';
+		/if;
 	/if;
 
@@ -310,9 +313,14 @@
 		*/
 		$__html_reply__ = '\
-<?xml version="1.0" encoding="utf-8" ?>
-<Connector command="' + $Command + '" resourceType="' + $Type + '">';
+<?xml version="1.0" encoding="utf-8" ?>';
 
 		if($errorNumber != '102');
-			$__html_reply__ += '<CurrentFolder path="' + $CurrentFolder + '" url="' + $currentFolderURL + '" />';
+			$__html_reply__ += '<Connector command="' + (Encode_HTML: $Command) + '" resourceType="' + (Encode_HTML: $Type) + '">';
+		else;
+			$__html_reply__ += '<Connector>';
+		/if;
+
+		if($errorNumber != '102');
+			$__html_reply__ += '<CurrentFolder path="' + (Encode_HTML: $CurrentFolder) + '" url="' + (Encode_HTML: $currentFolderURL) + '" />';
 		/if;
 
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/lasso/upload.lasso
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/lasso/upload.lasso	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/lasso/upload.lasso	(revision 3825)
@@ -33,6 +33,6 @@
     */
 	var(
-		'Type'			=	action_param('Type'),
-		'CurrentFolder'	=	action_param('CurrentFolder'),
+		'Type'			=	(Encode_HTML: action_param('Type')),
+		'CurrentFolder'	=	"/",
 		'ServerPath'	=	action_param('ServerPath'),
 		'NewFile'		=	null,
@@ -54,6 +54,8 @@
 	var('currentFolderURL' = $ServerPath
 		+ $config->find('Subdirectories')->find(action_param('Type'))
-		+ action_param('CurrentFolder')
+		+ $CurrentFolder
 	);
+
+	$currentFolderURL = string_replace($currentFolderURL, -find='//', -replace='/');
 
 	/*.....................................................................
@@ -85,12 +87,12 @@
 		$__html_reply__ = $__html_reply__ + '\
 	window.parent.OnUploadCompleted(' + #errorNumber + ',"'
-		+ string_replace(#fileUrl, -find='"', -replace='\\"') + '","'
-		+ string_replace(#fileName, -find='"', -replace='\\"') + '","'
-		+ string_replace(#customMsg, -find='"', -replace='\\"') + '");
+		+ string_replace((Encode_HTML: #fileUrl), -find='"', -replace='\\"') + '","'
+		+ string_replace((Encode_HTML: #fileUrl->split('/')->last), -find='"', -replace='\\"') + '","'
+		+ string_replace((Encode_HTML: #customMsg), -find='"', -replace='\\"') + '");
 </script>
 		';
 	/define_tag;
 
-	if($CurrentFolder->(Find: '..') || $CurrentFolder->(Find: '\\'));
+	if($CurrentFolder->(Find: '..') || (String_FindRegExp: $CurrentFolder, -Find='(/\\.)|(//)|[\\\\:\\*\\?\\""\\<\\>\\|]|\\000|[\u007F]|[\u0001-\u001F]'));
 		$errorNumber = 102;
 	/if;
@@ -115,4 +117,6 @@
 				*/
 				$NewFileName = $NewFile->find('OrigName');
+				$NewFileName = (String_ReplaceRegExp: $NewFileName, -find='\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|\\000|[\u007F]|[\u0001-\u001F]', -replace='_');
+				$NewFileName = (String_ReplaceRegExp: $NewFileName, -find='\\.(?![^.]*$)', -replace='_');
 				$OrigFilePath = $currentFolderURL + $NewFileName;
 				$NewFilePath = $OrigFilePath;
@@ -125,5 +129,9 @@
 				*/
 
-				if($config->find('DeniedExtensions')->find($Type) >> $NewFile->find('OrigExtension'));
+				local('allowedExt') = $config->find('AllowedExtensions')->find($Type);
+				local('deniedExt') = $config->find('DeniedExtensions')->find($Type);
+				if($allowedExt->Size > 0 && $allowedExt !>> $NewFile->find('OrigExtension'));
+					$errorNumber = 202;
+				else($deniedExt->Size > 0 && $deniedExt >> $NewFile->find('OrigExtension'));
 					$errorNumber = 202;
 				else;
@@ -154,4 +162,7 @@
 				/if;
 			/if;
+			if ($errorNumber != 0 && $errorNumber != 201);
+				$NewFilePath = "";
+			/if;
 		/inline;
 	else;
@@ -163,5 +174,4 @@
 		-errorNumber=$errorNumber,
 		-fileUrl=$NewFilePath,
-		-fileName=$NewFileName,
 		-customMsg=$customMsg
 	);
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/perl/basexml.pl
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/perl/basexml.pl	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/perl/basexml.pl	(revision 3825)
@@ -56,5 +56,10 @@
 	print '<?xml version="1.0" encoding="utf-8" ?>' ;
 
-	print '<Connector><Error number="' . $number . '" text="' . &specialchar_cnv( $text ) . '" /></Connector>' ;
+	if ($text) {
+		print '<Connector><Error number="' . $number . '" text="' . &specialchar_cnv( $text ) . '" /></Connector>' ;
+	}
+	else {
+		print '<Connector><Error number="' . $number . '" /></Connector>' ;
+	}
 
 	exit ;
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/perl/commands.pl
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/perl/commands.pl	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/perl/commands.pl	(revision 3825)
@@ -113,5 +113,5 @@
 	# Create the "Error" node.
 	$cnv_errmsg = &ConvertToXmlAttribute($sErrorMsg);
-	print '<Error number="' . $sErrorNumber . '" originalDescription="' . $cnv_errmsg . '" />';
+	print '<Error number="' . $sErrorNumber . '" />';
 }
 
@@ -121,4 +121,5 @@
 
 	local($resourceType, $currentFolder) = @_;
+	$allowedExtensions = $allowedExtensions{$resourceType};
 
 	$sErrorNumber = '0' ;
@@ -131,4 +132,16 @@
 		$sFileName = $new_fname;
 		$sFileName =~ s/\\|\/|\||\:|\?|\*|\"|<|>|[[:cntrl:]]/_/g;
+		$sFileName =~ s/\.(?![^.]*$)/_/g;
+
+		$ext = '';
+		if($sFileName =~ /([^\\\/]*)\.(.*)$/) {
+			$ext  = $2;
+		}
+
+		$allowedRegex = qr/^($allowedExtensions)$/i;
+		if (!($ext =~ $allowedRegex)) {
+			SendUploadResults('202', '', '', '');
+		}
+
 		$sOriginalFileName = $sFileName;
 
@@ -162,5 +175,5 @@
 	$sFileName	=~ s/"/\\"/g;
 
-	SendUploadResults($sErrorNumber, $resourceType.$currentFolder.$sFileName, $sFileName, '');
+	SendUploadResults($sErrorNumber, $GLOBALS{'UserFilesPath'}.$resourceType.$currentFolder.$sFileName, $sFileName, '');
 }
 
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/perl/config.pl
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/perl/config.pl	(revision 3825)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/perl/config.pl	(revision 3825)
@@ -0,0 +1,39 @@
+#####
+#  FCKeditor - The text editor for Internet - http://www.fckeditor.net
+#  Copyright (C) 2003-2009 Frederico Caldeira Knabben
+#
+#  == BEGIN LICENSE ==
+#
+#  Licensed under the terms of any of the following licenses at your
+#  choice:
+#
+#   - GNU General Public License Version 2 or later (the "GPL")
+#     http://www.gnu.org/licenses/gpl.html
+#
+#   - GNU Lesser General Public License Version 2.1 or later (the "LGPL")
+#     http://www.gnu.org/licenses/lgpl.html
+#
+#   - Mozilla Public License Version 1.1 or later (the "MPL")
+#     http://www.mozilla.org/MPL/MPL-1.1.html
+#
+#  == END LICENSE ==
+#
+#  This is the File Manager Connector for Perl.
+#####
+
+##
+# SECURITY: REMOVE/COMMENT THE FOLLOWING LINE TO ENABLE THIS CONNECTOR.
+##
+&SendError( 1, 'This connector is disabled. Please check the "editor/filemanager/connectors/perl/config.cgi" file' ) ;
+
+$GLOBALS{'UserFilesPath'} = '/userfiles/';
+
+# Map the "UserFiles" path to a local directory.
+$rootpath = &GetRootPath();
+$GLOBALS{'UserFilesDirectory'} = $rootpath . $GLOBALS{'UserFilesPath'};
+
+%allowedExtensions =  ("File", "7z|aiff|asf|avi|bmp|csv|doc|fla|flv|gif|gz|gzip|jpeg|jpg|mid|mov|mp3|mp4|mpc|mpeg|mpg|ods|odt|pdf|png|ppt|pxd|qt|ram|rar|rm|rmi|rmvb|rtf|sdc|sitd|swf|sxc|sxw|tar|tgz|tif|tiff|txt|vsd|wav|wma|wmv|xls|xml|zip",
+"Image", "bmp|gif|jpeg|jpg|png",
+"Flash", "swf|flv",
+"Media", "aiff|asf|avi|bmp|fla|flv|gif|jpeg|jpg|mid|mov|mp3|mp4|mpc|mpeg|mpg|png|qt|ram|rm|rmi|rmvb|swf|tif|tiff|wav|wma|wmv"
+);
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/perl/connector.cgi
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/perl/connector.cgi	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/perl/connector.cgi	(revision 3825)
@@ -25,5 +25,5 @@
 
 ##
-# ATTENTION: To enable this connector, look for the "SECURITY" comment in this file.
+# ATTENTION: To enable this connector, look for the "SECURITY" comment in config.pl.
 ##
 
@@ -59,26 +59,8 @@
 require 'commands.pl';
 require 'upload_fck.pl';
+require 'config.pl';
 
-##
-# SECURITY: REMOVE/COMMENT THE FOLLOWING LINE TO ENABLE THIS CONNECTOR.
-##
-	&SendError( 1, 'This connector is disabled. Please check the "editor/filemanager/connectors/perl/connector.cgi" file' ) ;
-
-	&read_input();
-
-	if($FORM{'ServerPath'} ne "") {
-		$GLOBALS{'UserFilesPath'} = $FORM{'ServerPath'};
-		if(!($GLOBALS{'UserFilesPath'} =~ /\/$/)) {
-			$GLOBALS{'UserFilesPath'} .= '/' ;
-		}
-	} else {
-		$GLOBALS{'UserFilesPath'} = '/userfiles/';
-	}
-
-	# Map the "UserFiles" path to a local directory.
-	$rootpath = &GetRootPath();
-	$GLOBALS{'UserFilesDirectory'} = $rootpath . $GLOBALS{'UserFilesPath'};
-
-	&DoResponse();
+&read_input();
+&DoResponse();
 
 sub DoResponse
@@ -89,7 +71,15 @@
 	}
 	# Get the main request informaiton.
-	$sCommand		= $FORM{'Command'};
-	$sResourceType	= $FORM{'Type'};
+	$sCommand		= &specialchar_cnv($FORM{'Command'});
+	$sResourceType	= &specialchar_cnv($FORM{'Type'});
 	$sCurrentFolder	= $FORM{'CurrentFolder'};
+
+	if ( !($sCommand =~ /^(FileUpload|GetFolders|GetFoldersAndFiles|CreateFolder)$/) ) {
+		SendError( 1, "Command not allowed" ) ;
+	}
+
+	if ( !($sResourceType =~ /^(File|Image|Flash|Media)$/) ) {
+		SendError( 1, "Invalid type specified" ) ;
+	}
 
 	# Check the current folder syntax (must begin and start with a slash).
@@ -103,4 +93,7 @@
 	# Check for invalid folder paths (..)
 	if ( $sCurrentFolder =~ /(?:\.\.|\\)/ ) {
+		SendError( 102, "" ) ;
+	}
+	if ( $sCurrentFolder =~ /(\/\.)|[[:cntrl:]]|(\/\/)|(\\\\)|([\:\*\?\"\<\>\|])/ ) {
 		SendError( 102, "" ) ;
 	}
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/perl/io.pl
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/perl/io.pl	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/perl/io.pl	(revision 3825)
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/perl/upload.cgi
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/perl/upload.cgi	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/perl/upload.cgi	(revision 3825)
@@ -25,5 +25,5 @@
 
 ##
-# ATTENTION: To enable this connector, look for the "SECURITY" comment in this file.
+# ATTENTION: To enable this connector, look for the "SECURITY" comment in config.pl.
 ##
 
@@ -59,52 +59,22 @@
 require 'commands.pl';
 require 'upload_fck.pl';
+require 'config.pl';
 
-##
-# SECURITY: REMOVE/COMMENT THE FOLLOWING LINE TO ENABLE THIS CONNECTOR.
-##
-	&SendUploadResults(1, '', '', 'This connector is disabled. Please check the "editor/filemanager/connectors/perl/upload.cgi" file' ) ;
-
-	&read_input();
-
-	if($FORM{'ServerPath'} ne "") {
-		$GLOBALS{'UserFilesPath'} = $FORM{'ServerPath'};
-		if(!($GLOBALS{'UserFilesPath'} =~ /\/$/)) {
-			$GLOBALS{'UserFilesPath'} .= '/' ;
-		}
-	} else {
-		$GLOBALS{'UserFilesPath'} = '/userfiles/';
-	}
-
-	# Map the "UserFiles" path to a local directory.
-	$rootpath = &GetRootPath();
-	$GLOBALS{'UserFilesDirectory'} = $rootpath . $GLOBALS{'UserFilesPath'};
-
-	&DoResponse();
+&read_input();
+&DoResponse();
 
 sub DoResponse
 {
 	# Get the main request information.
-	$sCommand		= 'FileUpload'; #$FORM{'Command'};
-	$sResourceType	= $FORM{'Type'};
-	$sCurrentFolder	= $FORM{'CurrentFolder'};
+	$sCommand		= 'FileUpload';
+	$sResourceType	= &specialchar_cnv($FORM{'Type'});
+	$sCurrentFolder	= "/";
 
 	if ($sResourceType eq '') {
 		$sResourceType = 'File' ;
 	}
-	if ($sCurrentFolder eq '') {
-		$sCurrentFolder = '/' ;
-	}
 
-	# Check the current folder syntax (must begin and start with a slash).
-	if(!($sCurrentFolder =~ /\/$/)) {
-		$sCurrentFolder .= '/';
-	}
-	if(!($sCurrentFolder =~ /^\//)) {
-		$sCurrentFolder = '/' . $sCurrentFolder;
-	}
-
-	# Check for invalid folder paths (..)
-	if ( $sCurrentFolder =~ /(?:\.\.|\\)/ ) {
-		SendError( 102, "" ) ;
+	if ( !($sResourceType =~ /^(File|Image|Flash|Media)$/) ) {
+		SendError( 1, "Invalid type specified" ) ;
 	}
 
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/perl/upload_fck.pl
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/perl/upload_fck.pl	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/perl/upload_fck.pl	(revision 3825)
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/perl/util.pl
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/perl/util.pl	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/perl/util.pl	(revision 3825)
@@ -41,7 +41,5 @@
 {
 	local($value) = @_;
-	return $value;
-#	return utf8_encode(htmlspecialchars($value));
-
+	return(&specialchar_cnv($value));
 }
 
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/php/basexml.php
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/php/basexml.php	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/php/basexml.php	(revision 3825)
@@ -66,4 +66,7 @@
 function SendError( $number, $text )
 {
+	if ( $_GET['Command'] == 'FileUpload' )
+		SendUploadResults( $number, "", "", $text ) ;
+
 	if ( isset( $GLOBALS['HeaderSent'] ) && $GLOBALS['HeaderSent'] )
 	{
@@ -89,5 +92,8 @@
 function SendErrorNode(  $number, $text )
 {
-	echo '<Error number="' . $number . '" text="' . htmlspecialchars( $text ) . '" />' ;
+	if ($text)
+		echo '<Error number="' . $number . '" text="' . htmlspecialchars( $text ) . '" />' ;
+	else
+		echo '<Error number="' . $number . '" />' ;
 }
 ?>
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/php/commands.php
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/php/commands.php	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/php/commands.php	(revision 3825)
@@ -31,13 +31,15 @@
 	$aFolders	= array() ;
 
-	$oCurrentFolder = opendir( $sServerDir ) ;
-
-	while ( $sFile = readdir( $oCurrentFolder ) )
-	{
-		if ( $sFile != '.' && $sFile != '..' && is_dir( $sServerDir . $sFile ) )
-			$aFolders[] = '<Folder name="' . ConvertToXmlAttribute( $sFile ) . '" />' ;
-	}
-
-	closedir( $oCurrentFolder ) ;
+	$oCurrentFolder = @opendir( $sServerDir ) ;
+
+	if ($oCurrentFolder !== false)
+	{
+		while ( $sFile = readdir( $oCurrentFolder ) )
+		{
+			if ( $sFile != '.' && $sFile != '..' && is_dir( $sServerDir . $sFile ) )
+				$aFolders[] = '<Folder name="' . ConvertToXmlAttribute( $sFile ) . '" />' ;
+		}
+		closedir( $oCurrentFolder ) ;
+	}
 
 	// Open the "Folders" node.
@@ -61,27 +63,32 @@
 	$aFiles		= array() ;
 
-	$oCurrentFolder = opendir( $sServerDir ) ;
-
-	while ( $sFile = readdir( $oCurrentFolder ) )
-	{
-		if ( $sFile != '.' && $sFile != '..' )
-		{
-			if ( is_dir( $sServerDir . $sFile ) )
-				$aFolders[] = '<Folder name="' . ConvertToXmlAttribute( $sFile ) . '" />' ;
-			else
-			{
-				$iFileSize = @filesize( $sServerDir . $sFile ) ;
-				if ( !$iFileSize ) {
-					$iFileSize = 0 ;
-				}
-				if ( $iFileSize > 0 )
-				{
-					$iFileSize = round( $iFileSize / 1024 ) ;
-					if ( $iFileSize < 1 ) $iFileSize = 1 ;
-				}
-
-				$aFiles[] = '<File name="' . ConvertToXmlAttribute( $sFile ) . '" size="' . $iFileSize . '" />' ;
-			}
-		}
+	$oCurrentFolder = @opendir( $sServerDir ) ;
+
+	if ($oCurrentFolder !== false)
+	{
+		while ( $sFile = readdir( $oCurrentFolder ) )
+		{
+			if ( $sFile != '.' && $sFile != '..' )
+			{
+				if ( is_dir( $sServerDir . $sFile ) )
+					$aFolders[] = '<Folder name="' . ConvertToXmlAttribute( $sFile ) . '" />' ;
+				else
+				{
+					$iFileSize = @filesize( $sServerDir . $sFile ) ;
+					if ( !$iFileSize ) {
+						$iFileSize = 0 ;
+					}
+					if ( $iFileSize > 0 )
+					{
+						$iFileSize = round( $iFileSize / 1024 ) ;
+						if ( $iFileSize < 1 )
+							$iFileSize = 1 ;
+					}
+
+					$aFiles[] = '<File name="' . ConvertToXmlAttribute( $sFile ) . '" size="' . $iFileSize . '" />' ;
+				}
+			}
+		}
+		closedir( $oCurrentFolder ) ;
 	}
 
@@ -153,5 +160,5 @@
 
 	// Create the "Error" node.
-	echo '<Error number="' . $sErrorNumber . '" originalDescription="' . ConvertToXmlAttribute( $sErrorMsg ) . '" />' ;
+	echo '<Error number="' . $sErrorNumber . '" />' ;
 }
 
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/php/config.php
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/php/config.php	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/php/config.php	(revision 3825)
@@ -29,5 +29,4 @@
 //		authenticated users can access this file or use some kind of session checking.
 $Config['Enabled'] = false ;
-
 
 // Path to user files relative to the document root.
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/php/io.php
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/php/io.php	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/php/io.php	(revision 3825)
@@ -246,4 +246,7 @@
 		SendError( 102, '' ) ;
 
+	if ( preg_match(",(/\.)|[[:cntrl:]]|(//)|(\\\\)|([\:\*\?\"\<\>\|]),", $sCurrentFolder))
+		SendError( 102, '' ) ;
+
 	return $sCurrentFolder ;
 }
@@ -287,4 +290,9 @@
 EOF;
 
+	if ($errorNumber && $errorNumber != 201) {
+		$fileUrl = "";
+		$fileName = "";
+	}
+
 	$rpl = array( '\\' => '\\\\', '"' => '\\"' ) ;
 	echo 'window.parent.OnUploadCompleted(' . $errorNumber . ',"' . strtr( $fileUrl, $rpl ) . '","' . strtr( $fileName, $rpl ) . '", "' . strtr( $customMsg, $rpl ) . '") ;' ;
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/php/upload.php
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/php/upload.php	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/php/upload.php	(revision 3825)
@@ -44,5 +44,5 @@
 $sType = isset( $_GET['Type'] ) ? $_GET['Type'] : 'File' ;
 
-$sCurrentFolder	= GetCurrentFolder() ;
+$sCurrentFolder	= "/" ;
 
 // Is enabled the upload?
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/py/connector.py
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/py/connector.py	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/py/connector.py	(revision 3825)
@@ -57,5 +57,8 @@
 		# Check for invalid paths
 		if currentFolder is None:
-			return self.sendError(102, "")
+			if (command == "FileUpload"):
+				return self.sendUploadResults( errorNo = 102, customMsg = "" )
+			else:
+				return self.sendError(102, "")
 
 		# Check if it is an allowed command
@@ -80,5 +83,5 @@
 		if not os.path.exists(self.userFilesFolder):
 			try:
-				self.createServerFoldercreateServerFolder( self.userFilesFolder )
+				self.createServerFolder( self.userFilesFolder )
 			except:
 				return self.sendError(1, "This connector couldn\'t access to local user\'s files directories.  Please check the UserFilesAbsolutePath in \"editor/filemanager/connectors/py/config.py\" and try again. ")
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/py/fckcommands.py
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/py/fckcommands.py	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/py/fckcommands.py	(revision 3825)
@@ -72,7 +72,11 @@
 			elif os.path.isfile(someObjectPath):
 				size = os.path.getsize(someObjectPath)
-				files += """<File name="%s" size="%s" />""" % (
+				if size > 0:
+					size = round(size/1024)
+					if size < 1:
+						size = 1
+				files += """<File name="%s" size="%d" />""" % (
 						convertToXmlAttribute(someObject),
-						os.path.getsize(someObjectPath)
+						size
 						)
 		# Close the folders / files node
@@ -164,5 +168,5 @@
 					if os.path.exists(newFilePath):
 						i += 1
-						newFileName = "%s(%04d).%s" % (
+						newFileName = "%s(%d).%s" % (
 								newFileNameOnly, i, newFileExtension
 								)
@@ -190,9 +194,9 @@
 								os.umask( oldumask )
 
-						newFileUrl = self.webUserFilesFolder + currentFolder + newFileName
+						newFileUrl = combinePaths(self.webUserFilesFolder, currentFolder) + newFileName
 
 						return self.sendUploadResults( errorNo , newFileUrl, newFileName )
 			else:
-				return self.sendUploadResults( errorNo = 203, customMsg = "Extension not allowed" )
+				return self.sendUploadResults( errorNo = 202, customMsg = "" )
 		else:
 			return self.sendUploadResults( errorNo = 202, customMsg = "No File" )
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/py/fckoutput.py
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/py/fckoutput.py	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/py/fckoutput.py	(revision 3825)
@@ -96,5 +96,8 @@
 
 	def sendErrorNode(self, number, text):
-		return """<Error number="%s" text="%s" />""" % (number, convertToXmlAttribute(text))
+		if number != 1:
+			return """<Error number="%s" />""" % (number)
+		else:
+			return """<Error number="%s" text="%s" />""" % (number, convertToXmlAttribute(text))
 
 class BaseHtmlMixin(object):
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/py/fckutil.py
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/py/fckutil.py	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/py/fckutil.py	(revision 3825)
@@ -63,5 +63,5 @@
 	"Do a cleanup of the folder name to avoid possible problems"
 	# Remove . \ / | : ? * " < > and control characters
-	return re.sub( '(?u)\\.|\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|[^\u0000-\u001f\u007f-\u009f]', '_', newFolderName )
+	return re.sub( '\\.|\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|[\x00-\x1f\x7f-\x9f]', '_', newFolderName )
 
 def sanitizeFileName( newFileName ):
@@ -69,9 +69,9 @@
 	# Replace dots in the name with underscores (only one dot can be there... security issue).
 	if ( Config.ForceSingleExtension ): # remove dots
-		newFileName = re.sub ( '/\\.(?![^.]*$)/', '_', newFileName ) ;
+		newFileName = re.sub ( '\\.(?![^.]*$)', '_', newFileName ) ;
 	newFileName = newFileName.replace('\\','/')		# convert windows to unix path
 	newFileName = os.path.basename (newFileName)	# strip directories
 	# Remove \ / | : ? *
-	return re.sub ( '(?u)/\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|[^\u0000-\u001f\u007f-\u009f]/', '_', newFileName )
+	return re.sub ( '\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|[\x00-\x1f\x7f-\x9f]/', '_', newFileName )
 
 def getCurrentFolder(currentFolder):
@@ -91,4 +91,8 @@
 	# Check for invalid folder paths (..)
 	if '..' in currentFolder or '\\' in currentFolder:
+		return None
+
+	# Check for invalid folder paths (..)
+	if re.search( '(/\\.)|(//)|([\\\\:\\*\\?\\""\\<\\>\\|]|[\x00-\x1F]|[\x7f-\x9f])', currentFolder ):
 		return None
 
Index: /FCKeditor/releases/latest/editor/filemanager/connectors/py/upload.py
===================================================================
--- /FCKeditor/releases/latest/editor/filemanager/connectors/py/upload.py	(revision 3824)
+++ /FCKeditor/releases/latest/editor/filemanager/connectors/py/upload.py	(revision 3825)
@@ -42,5 +42,5 @@
 		# The file type (from the QueryString, by default 'File').
 		resourceType  = self.request.get('Type','File')
-		currentFolder = getCurrentFolder(self.request.get("CurrentFolder",""))
+		currentFolder = "/"
 		# Check for invalid paths
 		if currentFolder is None:
Index: /FCKeditor/releases/latest/editor/js/fckeditorcode_gecko.js
===================================================================
--- /FCKeditor/releases/latest/editor/js/fckeditorcode_gecko.js	(revision 3824)
+++ /FCKeditor/releases/latest/editor/js/fckeditorcode_gecko.js	(revision 3825)
@@ -36,5 +36,5 @@
 var FCKTools={};FCKTools.CreateBogusBR=function(A){var B=A.createElement('br');B.setAttribute('type','_moz');return B;};FCKTools.FixCssUrls=function(A,B){if (!A||A.length==0) return B;return B.replace(/url\s*\(([\s'"]*)(.*?)([\s"']*)\)/g,function(match,opener,path,closer){if (/^\/|^\w?:/.test(path)) return match;else return 'url('+opener+A+path+closer+')';});};FCKTools._GetUrlFixedCss=function(A,B){var C=A.match(/^([^|]+)\|([\s\S]*)/);if (C) return FCKTools.FixCssUrls(C[1],C[2]);else return A;};FCKTools.AppendStyleSheet=function(A,B){if (!B) return [];if (typeof(B)=='string'){if (/[\\\/\.][^{}]*$/.test(B)){return this.AppendStyleSheet(A,B.split(','));}else return [this.AppendStyleString(A,FCKTools._GetUrlFixedCss(B))];}else{var C=[];for (var i=0;i<B.length;i++) C.push(this._AppendStyleSheet(A,B[i]));return C;}};FCKTools.GetStyleHtml=(function(){var A=function(styleDef,markTemp){if (styleDef.length==0) return '';var B=markTemp?' _fcktemp="true"':'';return '<style type="text/css"'+B+'>'+styleDef+'</style>';};var C=function(cssFileUrl,markTemp){if (cssFileUrl.length==0) return '';var B=markTemp?' _fcktemp="true"':'';return '<link href="'+cssFileUrl+'" type="text/css" rel="stylesheet" '+B+'/>';};return function(cssFileOrArrayOrDef,markTemp){if (!cssFileOrArrayOrDef) return '';if (typeof(cssFileOrArrayOrDef)=='string'){if (/[\\\/\.][^{}]*$/.test(cssFileOrArrayOrDef)){return this.GetStyleHtml(cssFileOrArrayOrDef.split(','),markTemp);}else return A(this._GetUrlFixedCss(cssFileOrArrayOrDef),markTemp);}else{var E='';for (var i=0;i<cssFileOrArrayOrDef.length;i++) E+=C(cssFileOrArrayOrDef[i],markTemp);return E;}}})();FCKTools.GetElementDocument=function (A){return A.ownerDocument||A.document;};FCKTools.GetElementWindow=function(A){return this.GetDocumentWindow(this.GetElementDocument(A));};FCKTools.GetDocumentWindow=function(A){if (FCKBrowserInfo.IsSafari&&!A.parentWindow) this.FixDocumentParentWindow(window.top);return A.parentWindow||A.defaultView;};FCKTools.FixDocumentParentWindow=function(A){if (A.document) A.document.parentWindow=A;for (var i=0;i<A.frames.length;i++) FCKTools.FixDocumentParentWindow(A.frames[i]);};FCKTools.HTMLEncode=function(A){if (!A) return '';A=A.replace(/&/g,'&amp;');A=A.replace(/</g,'&lt;');A=A.replace(/>/g,'&gt;');return A;};FCKTools.HTMLDecode=function(A){if (!A) return '';A=A.replace(/&gt;/g,'>');A=A.replace(/&lt;/g,'<');A=A.replace(/&amp;/g,'&');return A;};FCKTools._ProcessLineBreaksForPMode=function(A,B,C,D,E){var F=0;var G="<p>";var H="</p>";var I="<br />";if (C){G="<li>";H="</li>";F=1;}while (D&&D!=A.FCK.EditorDocument.body){if (D.tagName.toLowerCase()=='p'){F=1;break;};D=D.parentNode;};for (var i=0;i<B.length;i++){var c=B.charAt(i);if (c=='\r') continue;if (c!='\n'){E.push(c);continue;};var n=B.charAt(i+1);if (n=='\r'){i++;n=B.charAt(i+1);};if (n=='\n'){i++;if (F) E.push(H);E.push(G);F=1;}else E.push(I);}};FCKTools._ProcessLineBreaksForDivMode=function(A,B,C,D,E){var F=0;var G="<div>";var H="</div>";if (C){G="<li>";H="</li>";F=1;}while (D&&D!=A.FCK.EditorDocument.body){if (D.tagName.toLowerCase()=='div'){F=1;break;};D=D.parentNode;};for (var i=0;i<B.length;i++){var c=B.charAt(i);if (c=='\r') continue;if (c!='\n'){E.push(c);continue;};if (F){if (E[E.length-1]==G){E.push("&nbsp;");};E.push(H);};E.push(G);F=1;};if (F) E.push(H);};FCKTools._ProcessLineBreaksForBrMode=function(A,B,C,D,E){var F=0;var G="<br />";var H="";if (C){G="<li>";H="</li>";F=1;};for (var i=0;i<B.length;i++){var c=B.charAt(i);if (c=='\r') continue;if (c!='\n'){E.push(c);continue;};if (F&&H.length) E.push (H);E.push(G);F=1;}};FCKTools.ProcessLineBreaks=function(A,B,C){var D=B.EnterMode.toLowerCase();var E=[];var F=0;var G=new A.FCKDomRange(A.FCK.EditorWindow);G.MoveToSelection();var H=G._Range.startContainer;while (H&&H.nodeType!=1) H=H.parentNode;if (H&&H.tagName.toLowerCase()=='li') F=1;if (D=='p') this._ProcessLineBreaksForPMode(A,C,F,H,E);else if (D=='div') this._ProcessLineBreaksForDivMode(A,C,F,H,E);else if (D=='br') this._ProcessLineBreaksForBrMode(A,C,F,H,E);return E.join("");};FCKTools.AddSelectOption=function(A,B,C){var D=FCKTools.GetElementDocument(A).createElement("OPTION");D.text=B;D.value=C;A.options.add(D);return D;};FCKTools.RunFunction=function(A,B,C,D){if (A) this.SetTimeout(A,0,B,C,D);};FCKTools.SetTimeout=function(A,B,C,D,E){return (E||window).setTimeout(function(){if (D) A.apply(C,[].concat(D));else A.apply(C);},B);};FCKTools.SetInterval=function(A,B,C,D,E){return (E||window).setInterval(function(){A.apply(C,D||[]);},B);};FCKTools.ConvertStyleSizeToHtml=function(A){return A.EndsWith('%')?A:parseInt(A,10);};FCKTools.ConvertHtmlSizeToStyle=function(A){return A.EndsWith('%')?A:(A+'px');};FCKTools.GetElementAscensor=function(A,B){var e=A;var C=","+B.toUpperCase()+",";while (e){if (C.indexOf(","+e.nodeName.toUpperCase()+",")!=-1) return e;e=e.parentNode;};return null;};FCKTools.CreateEventListener=function(A,B){var f=function(){var C=[];for (var i=0;i<arguments.length;i++) C.push(arguments[i]);A.apply(this,C.concat(B));};return f;};FCKTools.IsStrictMode=function(A){return ('CSS1Compat'==(A.compatMode||(FCKBrowserInfo.IsSafari?'CSS1Compat':null)));};FCKTools.ArgumentsToArray=function(A,B,C){B=B||0;C=C||A.length;var D=[];for (var i=B;i<B+C&&i<A.length;i++) D.push(A[i]);return D;};FCKTools.CloneObject=function(A){var B=function() {};B.prototype=A;return new B;};FCKTools.AppendBogusBr=function(A){if (!A) return;var B=this.GetLastItem(A.getElementsByTagName('br'));if (!B||(B.getAttribute('type',2)!='_moz'&&B.getAttribute('_moz_dirty')==null)){var C=this.GetElementDocument(A);if (FCKBrowserInfo.IsOpera) A.appendChild(C.createTextNode(''));else A.appendChild(this.CreateBogusBR(C));}};FCKTools.GetLastItem=function(A){if (A.length>0) return A[A.length-1];return null;};FCKTools.GetDocumentPosition=function(w,A){var x=0;var y=0;var B=A;var C=null;var D=FCKTools.GetElementWindow(B);while (B&&!(D==w&&(B==w.document.body||B==w.document.documentElement))){x+=B.offsetLeft-B.scrollLeft;y+=B.offsetTop-B.scrollTop;if (!FCKBrowserInfo.IsOpera){var E=C;while (E&&E!=B){x-=E.scrollLeft;y-=E.scrollTop;E=E.parentNode;}};C=B;if (B.offsetParent) B=B.offsetParent;else{if (D!=w){B=D.frameElement;C=null;if (B) D=B.contentWindow.parent;}else B=null;}};if (FCKDomTools.GetCurrentElementStyle(w.document.body,'position')!='static'||(FCKBrowserInfo.IsIE&&FCKDomTools.GetPositionedAncestor(A)==null)){x+=w.document.body.offsetLeft;y+=w.document.body.offsetTop;};return { "x":x,"y":y };};FCKTools.GetWindowPosition=function(w,A){var B=this.GetDocumentPosition(w,A);var C=FCKTools.GetScrollPosition(w);B.x-=C.X;B.y-=C.Y;return B;};FCKTools.ProtectFormStyles=function(A){if (!A||A.nodeType!=1||A.tagName.toLowerCase()!='form') return [];var B=[];var C=['style','className'];for (var i=0;i<C.length;i++){var D=C[i];if (A.elements.namedItem(D)){var E=A.elements.namedItem(D);B.push([E,E.nextSibling]);A.removeChild(E);}};return B;};FCKTools.RestoreFormStyles=function(A,B){if (!A||A.nodeType!=1||A.tagName.toLowerCase()!='form') return;if (B.length>0){for (var i=B.length-1;i>=0;i--){var C=B[i][0];var D=B[i][1];if (D) A.insertBefore(C,D);else A.appendChild(C);}}};FCKTools.GetNextNode=function(A,B){if (A.firstChild) return A.firstChild;else if (A.nextSibling) return A.nextSibling;else{var C=A.parentNode;while (C){if (C==B) return null;if (C.nextSibling) return C.nextSibling;else C=C.parentNode;}};return null;};FCKTools.GetNextTextNode=function(A,B,C){node=this.GetNextNode(A,B);if (C&&node&&C(node)) return null;while (node&&node.nodeType!=3){node=this.GetNextNode(node,B);if (C&&node&&C(node)) return null;};return node;};FCKTools.Merge=function(){var A=arguments;var o=A[0];for (var i=1;i<A.length;i++){var B=A[i];for (var p in B) o[p]=B[p];};return o;};FCKTools.IsArray=function(A){return (A instanceof Array);};FCKTools.AppendLengthProperty=function(A,B){var C=0;for (var n in A) C++;return A[B||'length']=C;};FCKTools.NormalizeCssText=function(A){var B=document.createElement('span');B.style.cssText=A;return B.style.cssText;};FCKTools.Bind=function(A,B){return function(){ return B.apply(A,arguments);};};FCKTools.GetVoidUrl=function(){if (FCK_IS_CUSTOM_DOMAIN) return "javascript: void( function(){document.open();document.write('<html><head><title></title></head><body></body></html>');document.domain = '"+FCK_RUNTIME_DOMAIN+"';document.close();}() ) ;";if (FCKBrowserInfo.IsIE){if (FCKBrowserInfo.IsIE7||!FCKBrowserInfo.IsIE6) return "";else return "javascript: '';";};return "javascript: void(0);";};FCKTools.ResetStyles=function(A){A.style.cssText='margin:0;padding:0;border:0;background-color:transparent;background-image:none;';};
 FCKTools.CancelEvent=function(e){if (e) e.preventDefault();};FCKTools.DisableSelection=function(A){if (FCKBrowserInfo.IsGecko) A.style.MozUserSelect='none';else if (FCKBrowserInfo.IsSafari) A.style.KhtmlUserSelect='none';else A.style.userSelect='none';};FCKTools._AppendStyleSheet=function(A,B){var e=A.createElement('LINK');e.rel='stylesheet';e.type='text/css';e.href=B;A.getElementsByTagName("HEAD")[0].appendChild(e);return e;};FCKTools.AppendStyleString=function(A,B){if (!B) return null;var e=A.createElement("STYLE");e.appendChild(A.createTextNode(B));A.getElementsByTagName("HEAD")[0].appendChild(e);return e;};FCKTools.ClearElementAttributes=function(A){for (var i=0;i<A.attributes.length;i++){A.removeAttribute(A.attributes[i].name,0);}};FCKTools.GetAllChildrenIds=function(A){var B=[];var C=function(parent){for (var i=0;i<parent.childNodes.length;i++){var D=parent.childNodes[i].id;if (D&&D.length>0) B[B.length]=D;C(parent.childNodes[i]);}};C(A);return B;};FCKTools.RemoveOuterTags=function(e){var A=e.ownerDocument.createDocumentFragment();for (var i=0;i<e.childNodes.length;i++) A.appendChild(e.childNodes[i].cloneNode(true));e.parentNode.replaceChild(A,e);};FCKTools.CreateXmlObject=function(A){switch (A){case 'XmlHttp':return new XMLHttpRequest();case 'DOMDocument':var B=(new DOMParser()).parseFromString('<tmp></tmp>','text/xml');FCKDomTools.RemoveNode(B.firstChild);return B;};return null;};FCKTools.GetScrollPosition=function(A){return { X:A.pageXOffset,Y:A.pageYOffset };};FCKTools.AddEventListener=function(A,B,C){A.addEventListener(B,C,false);};FCKTools.RemoveEventListener=function(A,B,C){A.removeEventListener(B,C,false);};FCKTools.AddEventListenerEx=function(A,B,C,D){A.addEventListener(B,function(e){C.apply(A,[e].concat(D||[]));},false);};FCKTools.GetViewPaneSize=function(A){return { Width:A.innerWidth,Height:A.innerHeight };};FCKTools.SaveStyles=function(A){var B=FCKTools.ProtectFormStyles(A);var C={};if (A.className.length>0){C.Class=A.className;A.className='';};var D=A.getAttribute('style');if (D&&D.length>0){C.Inline=D;A.setAttribute('style','',0);};FCKTools.RestoreFormStyles(A,B);return C;};FCKTools.RestoreStyles=function(A,B){var C=FCKTools.ProtectFormStyles(A);A.className=B.Class||'';if (B.Inline) A.setAttribute('style',B.Inline,0);else A.removeAttribute('style',0);FCKTools.RestoreFormStyles(A,C);};FCKTools.RegisterDollarFunction=function(A){A.$=function(id){return A.document.getElementById(id);};};FCKTools.AppendElement=function(A,B){return A.appendChild(A.ownerDocument.createElement(B));};FCKTools.GetElementPosition=function(A,B){var c={ X:0,Y:0 };var C=B||window;var D=FCKTools.GetElementWindow(A);var E=null;while (A){var F=D.getComputedStyle(A,'').position;if (F&&F!='static'&&A.style.zIndex!=FCKConfig.FloatingPanelsZIndex) break;c.X+=A.offsetLeft-A.scrollLeft;c.Y+=A.offsetTop-A.scrollTop;if (!FCKBrowserInfo.IsOpera){var G=E;while (G&&G!=A){c.X-=G.scrollLeft;c.Y-=G.scrollTop;G=G.parentNode;}};E=A;if (A.offsetParent) A=A.offsetParent;else{if (D!=C){A=D.frameElement;E=null;if (A) D=FCKTools.GetElementWindow(A);}else{c.X+=A.scrollLeft;c.Y+=A.scrollTop;break;}}};return c;};
-var FCKeditorAPI;function InitializeAPI(){var A=window.parent;if (!(FCKeditorAPI=A.FCKeditorAPI)){var B='window.FCKeditorAPI = {Version : "2.6.4",VersionBuild : "21629",Instances : window.FCKeditorAPI && window.FCKeditorAPI.Instances || {},GetInstance : function( name ){return this.Instances[ name ];},_FormSubmit : function(){for ( var name in FCKeditorAPI.Instances ){var oEditor = FCKeditorAPI.Instances[ name ] ;if ( oEditor.GetParentForm && oEditor.GetParentForm() == this )oEditor.UpdateLinkedField() ;}this._FCKOriginalSubmit() ;},_FunctionQueue	: window.FCKeditorAPI && window.FCKeditorAPI._FunctionQueue || {Functions : new Array(),IsRunning : false,Add : function( f ){this.Functions.push( f );if ( !this.IsRunning )this.StartNext();},StartNext : function(){var aQueue = this.Functions ;if ( aQueue.length > 0 ){this.IsRunning = true;aQueue[0].call();}else this.IsRunning = false;},Remove : function( f ){var aQueue = this.Functions;var i = 0, fFunc;while( (fFunc = aQueue[ i ]) ){if ( fFunc == f )aQueue.splice( i,1 );i++ ;}this.StartNext();}}}';if (A.execScript) A.execScript(B,'JavaScript');else{if (FCKBrowserInfo.IsGecko10){eval.call(A,B);}else if(FCKBrowserInfo.IsAIR){FCKAdobeAIR.FCKeditorAPI_Evaluate(A,B);}else if (FCKBrowserInfo.IsSafari){var C=A.document;var D=C.createElement('script');D.appendChild(C.createTextNode(B));C.documentElement.appendChild(D);}else A.eval(B);};FCKeditorAPI=A.FCKeditorAPI;FCKeditorAPI.__Instances=FCKeditorAPI.Instances;};FCKeditorAPI.Instances[FCK.Name]=FCK;};function _AttachFormSubmitToAPI(){var A=FCK.GetParentForm();if (A){FCKTools.AddEventListener(A,'submit',FCK.UpdateLinkedField);if (!A._FCKOriginalSubmit&&(typeof(A.submit)=='function'||(!A.submit.tagName&&!A.submit.length))){A._FCKOriginalSubmit=A.submit;A.submit=FCKeditorAPI._FormSubmit;}}};function FCKeditorAPI_Cleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat&&!window.FCKUnloadFlag) return;delete FCKeditorAPI.Instances[FCK.Name];};function FCKeditorAPI_ConfirmCleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat) window.FCKUnloadFlag=true;};FCKTools.AddEventListener(window,'unload',FCKeditorAPI_Cleanup);FCKTools.AddEventListener(window,'beforeunload',FCKeditorAPI_ConfirmCleanup);
+var FCKeditorAPI;function InitializeAPI(){var A=window.parent;if (!(FCKeditorAPI=A.FCKeditorAPI)){var B='window.FCKeditorAPI = {Version : "2.6.4.1",VersionBuild : "23187",Instances : window.FCKeditorAPI && window.FCKeditorAPI.Instances || {},GetInstance : function( name ){return this.Instances[ name ];},_FormSubmit : function(){for ( var name in FCKeditorAPI.Instances ){var oEditor = FCKeditorAPI.Instances[ name ] ;if ( oEditor.GetParentForm && oEditor.GetParentForm() == this )oEditor.UpdateLinkedField() ;}this._FCKOriginalSubmit() ;},_FunctionQueue	: window.FCKeditorAPI && window.FCKeditorAPI._FunctionQueue || {Functions : new Array(),IsRunning : false,Add : function( f ){this.Functions.push( f );if ( !this.IsRunning )this.StartNext();},StartNext : function(){var aQueue = this.Functions ;if ( aQueue.length > 0 ){this.IsRunning = true;aQueue[0].call();}else this.IsRunning = false;},Remove : function( f ){var aQueue = this.Functions;var i = 0, fFunc;while( (fFunc = aQueue[ i ]) ){if ( fFunc == f )aQueue.splice( i,1 );i++ ;}this.StartNext();}}}';if (A.execScript) A.execScript(B,'JavaScript');else{if (FCKBrowserInfo.IsGecko10){eval.call(A,B);}else if(FCKBrowserInfo.IsAIR){FCKAdobeAIR.FCKeditorAPI_Evaluate(A,B);}else if (FCKBrowserInfo.IsSafari){var C=A.document;var D=C.createElement('script');D.appendChild(C.createTextNode(B));C.documentElement.appendChild(D);}else A.eval(B);};FCKeditorAPI=A.FCKeditorAPI;FCKeditorAPI.__Instances=FCKeditorAPI.Instances;};FCKeditorAPI.Instances[FCK.Name]=FCK;};function _AttachFormSubmitToAPI(){var A=FCK.GetParentForm();if (A){FCKTools.AddEventListener(A,'submit',FCK.UpdateLinkedField);if (!A._FCKOriginalSubmit&&(typeof(A.submit)=='function'||(!A.submit.tagName&&!A.submit.length))){A._FCKOriginalSubmit=A.submit;A.submit=FCKeditorAPI._FormSubmit;}}};function FCKeditorAPI_Cleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat&&!window.FCKUnloadFlag) return;delete FCKeditorAPI.Instances[FCK.Name];};function FCKeditorAPI_ConfirmCleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat) window.FCKUnloadFlag=true;};FCKTools.AddEventListener(window,'unload',FCKeditorAPI_Cleanup);FCKTools.AddEventListener(window,'beforeunload',FCKeditorAPI_ConfirmCleanup);
 var FCKImagePreloader=function(){this._Images=[];};FCKImagePreloader.prototype={AddImages:function(A){if (typeof(A)=='string') A=A.split(';');this._Images=this._Images.concat(A);},Start:function(){var A=this._Images;this._PreloadCount=A.length;for (var i=0;i<A.length;i++){var B=document.createElement('img');FCKTools.AddEventListenerEx(B,'load',_FCKImagePreloader_OnImage,this);FCKTools.AddEventListenerEx(B,'error',_FCKImagePreloader_OnImage,this);B.src=A[i];_FCKImagePreloader_ImageCache.push(B);}}};var _FCKImagePreloader_ImageCache=[];function _FCKImagePreloader_OnImage(A,B){if ((--B._PreloadCount)==0&&B.OnComplete) B.OnComplete();};
 var FCKRegexLib={AposEntity:/&apos;/gi,ObjectElements:/^(?:IMG|TABLE|TR|TD|TH|INPUT|SELECT|TEXTAREA|HR|OBJECT|A|UL|OL|LI)$/i,NamedCommands:/^(?:Cut|Copy|Paste|Print|SelectAll|RemoveFormat|Unlink|Undo|Redo|Bold|Italic|Underline|StrikeThrough|Subscript|Superscript|JustifyLeft|JustifyCenter|JustifyRight|JustifyFull|Outdent|Indent|InsertOrderedList|InsertUnorderedList|InsertHorizontalRule)$/i,BeforeBody:/(^[\s\S]*\<body[^\>]*\>)/i,AfterBody:/(\<\/body\>[\s\S]*$)/i,ToReplace:/___fcktoreplace:([\w]+)/ig,MetaHttpEquiv:/http-equiv\s*=\s*["']?([^"' ]+)/i,HasBaseTag:/<base /i,HasBodyTag:/<body[\s|>]/i,HtmlOpener:/<html\s?[^>]*>/i,HeadOpener:/<head\s?[^>]*>/i,HeadCloser:/<\/head\s*>/i,FCK_Class:/\s*FCK__[^ ]*(?=\s+|$)/,ElementName:/(^[a-z_:][\w.\-:]*\w$)|(^[a-z_]$)/,ForceSimpleAmpersand:/___FCKAmp___/g,SpaceNoClose:/\/>/g,EmptyParagraph:/^<(p|div|address|h\d|center)(?=[ >])[^>]*>\s*(<\/\1>)?$/,EmptyOutParagraph:/^<(p|div|address|h\d|center)(?=[ >])[^>]*>(?:\s*|&nbsp;)(<\/\1>)?$/,TagBody:/></,GeckoEntitiesMarker:/#\?-\:/g,ProtectUrlsImg:/<img(?=\s).*?\ssrc=((?:(?:\s*)("|').*?\2)|(?:[^"'][^ >]+))/gi,ProtectUrlsA:/<a(?=\s).*?\shref=((?:(?:\s*)("|').*?\2)|(?:[^"'][^ >]+))/gi,ProtectUrlsArea:/<area(?=\s).*?\shref=((?:(?:\s*)("|').*?\2)|(?:[^"'][^ >]+))/gi,Html4DocType:/HTML 4\.0 Transitional/i,DocTypeTag:/<!DOCTYPE[^>]*>/i,HtmlDocType:/DTD HTML/,TagsWithEvent:/<[^\>]+ on\w+[\s\r\n]*=[\s\r\n]*?('|")[\s\S]+?\>/g,EventAttributes:/\s(on\w+)[\s\r\n]*=[\s\r\n]*?('|")([\s\S]*?)\2/g,ProtectedEvents:/\s\w+_fckprotectedatt="([^"]+)"/g,StyleProperties:/\S+\s*:/g,InvalidSelfCloseTags:/(<(?!base|meta|link|hr|br|param|img|area|input)([a-zA-Z0-9:]+)[^>]*)\/>/gi,StyleVariableAttName:/#\(\s*("|')(.+?)\1[^\)]*\s*\)/g,RegExp:/^\/(.*)\/([gim]*)$/,HtmlTag:/<[^\s<>](?:"[^"]*"|'[^']*'|[^<])*>/};
Index: /FCKeditor/releases/latest/editor/js/fckeditorcode_ie.js
===================================================================
--- /FCKeditor/releases/latest/editor/js/fckeditorcode_ie.js	(revision 3824)
+++ /FCKeditor/releases/latest/editor/js/fckeditorcode_ie.js	(revision 3825)
@@ -37,5 +37,5 @@
 var FCKTools={};FCKTools.CreateBogusBR=function(A){var B=A.createElement('br');B.setAttribute('type','_moz');return B;};FCKTools.FixCssUrls=function(A,B){if (!A||A.length==0) return B;return B.replace(/url\s*\(([\s'"]*)(.*?)([\s"']*)\)/g,function(match,opener,path,closer){if (/^\/|^\w?:/.test(path)) return match;else return 'url('+opener+A+path+closer+')';});};FCKTools._GetUrlFixedCss=function(A,B){var C=A.match(/^([^|]+)\|([\s\S]*)/);if (C) return FCKTools.FixCssUrls(C[1],C[2]);else return A;};FCKTools.AppendStyleSheet=function(A,B){if (!B) return [];if (typeof(B)=='string'){if (/[\\\/\.][^{}]*$/.test(B)){return this.AppendStyleSheet(A,B.split(','));}else return [this.AppendStyleString(A,FCKTools._GetUrlFixedCss(B))];}else{var C=[];for (var i=0;i<B.length;i++) C.push(this._AppendStyleSheet(A,B[i]));return C;}};FCKTools.GetStyleHtml=(function(){var A=function(styleDef,markTemp){if (styleDef.length==0) return '';var B=markTemp?' _fcktemp="true"':'';return '<style type="text/css"'+B+'>'+styleDef+'</style>';};var C=function(cssFileUrl,markTemp){if (cssFileUrl.length==0) return '';var B=markTemp?' _fcktemp="true"':'';return '<link href="'+cssFileUrl+'" type="text/css" rel="stylesheet" '+B+'/>';};return function(cssFileOrArrayOrDef,markTemp){if (!cssFileOrArrayOrDef) return '';if (typeof(cssFileOrArrayOrDef)=='string'){if (/[\\\/\.][^{}]*$/.test(cssFileOrArrayOrDef)){return this.GetStyleHtml(cssFileOrArrayOrDef.split(','),markTemp);}else return A(this._GetUrlFixedCss(cssFileOrArrayOrDef),markTemp);}else{var E='';for (var i=0;i<cssFileOrArrayOrDef.length;i++) E+=C(cssFileOrArrayOrDef[i],markTemp);return E;}}})();FCKTools.GetElementDocument=function (A){return A.ownerDocument||A.document;};FCKTools.GetElementWindow=function(A){return this.GetDocumentWindow(this.GetElementDocument(A));};FCKTools.GetDocumentWindow=function(A){if (FCKBrowserInfo.IsSafari&&!A.parentWindow) this.FixDocumentParentWindow(window.top);return A.parentWindow||A.defaultView;};FCKTools.FixDocumentParentWindow=function(A){if (A.document) A.document.parentWindow=A;for (var i=0;i<A.frames.length;i++) FCKTools.FixDocumentParentWindow(A.frames[i]);};FCKTools.HTMLEncode=function(A){if (!A) return '';A=A.replace(/&/g,'&amp;');A=A.replace(/</g,'&lt;');A=A.replace(/>/g,'&gt;');return A;};FCKTools.HTMLDecode=function(A){if (!A) return '';A=A.replace(/&gt;/g,'>');A=A.replace(/&lt;/g,'<');A=A.replace(/&amp;/g,'&');return A;};FCKTools._ProcessLineBreaksForPMode=function(A,B,C,D,E){var F=0;var G="<p>";var H="</p>";var I="<br />";if (C){G="<li>";H="</li>";F=1;}while (D&&D!=A.FCK.EditorDocument.body){if (D.tagName.toLowerCase()=='p'){F=1;break;};D=D.parentNode;};for (var i=0;i<B.length;i++){var c=B.charAt(i);if (c=='\r') continue;if (c!='\n'){E.push(c);continue;};var n=B.charAt(i+1);if (n=='\r'){i++;n=B.charAt(i+1);};if (n=='\n'){i++;if (F) E.push(H);E.push(G);F=1;}else E.push(I);}};FCKTools._ProcessLineBreaksForDivMode=function(A,B,C,D,E){var F=0;var G="<div>";var H="</div>";if (C){G="<li>";H="</li>";F=1;}while (D&&D!=A.FCK.EditorDocument.body){if (D.tagName.toLowerCase()=='div'){F=1;break;};D=D.parentNode;};for (var i=0;i<B.length;i++){var c=B.charAt(i);if (c=='\r') continue;if (c!='\n'){E.push(c);continue;};if (F){if (E[E.length-1]==G){E.push("&nbsp;");};E.push(H);};E.push(G);F=1;};if (F) E.push(H);};FCKTools._ProcessLineBreaksForBrMode=function(A,B,C,D,E){var F=0;var G="<br />";var H="";if (C){G="<li>";H="</li>";F=1;};for (var i=0;i<B.length;i++){var c=B.charAt(i);if (c=='\r') continue;if (c!='\n'){E.push(c);continue;};if (F&&H.length) E.push (H);E.push(G);F=1;}};FCKTools.ProcessLineBreaks=function(A,B,C){var D=B.EnterMode.toLowerCase();var E=[];var F=0;var G=new A.FCKDomRange(A.FCK.EditorWindow);G.MoveToSelection();var H=G._Range.startContainer;while (H&&H.nodeType!=1) H=H.parentNode;if (H&&H.tagName.toLowerCase()=='li') F=1;if (D=='p') this._ProcessLineBreaksForPMode(A,C,F,H,E);else if (D=='div') this._ProcessLineBreaksForDivMode(A,C,F,H,E);else if (D=='br') this._ProcessLineBreaksForBrMode(A,C,F,H,E);return E.join("");};FCKTools.AddSelectOption=function(A,B,C){var D=FCKTools.GetElementDocument(A).createElement("OPTION");D.text=B;D.value=C;A.options.add(D);return D;};FCKTools.RunFunction=function(A,B,C,D){if (A) this.SetTimeout(A,0,B,C,D);};FCKTools.SetTimeout=function(A,B,C,D,E){return (E||window).setTimeout(function(){if (D) A.apply(C,[].concat(D));else A.apply(C);},B);};FCKTools.SetInterval=function(A,B,C,D,E){return (E||window).setInterval(function(){A.apply(C,D||[]);},B);};FCKTools.ConvertStyleSizeToHtml=function(A){return A.EndsWith('%')?A:parseInt(A,10);};FCKTools.ConvertHtmlSizeToStyle=function(A){return A.EndsWith('%')?A:(A+'px');};FCKTools.GetElementAscensor=function(A,B){var e=A;var C=","+B.toUpperCase()+",";while (e){if (C.indexOf(","+e.nodeName.toUpperCase()+",")!=-1) return e;e=e.parentNode;};return null;};FCKTools.CreateEventListener=function(A,B){var f=function(){var C=[];for (var i=0;i<arguments.length;i++) C.push(arguments[i]);A.apply(this,C.concat(B));};return f;};FCKTools.IsStrictMode=function(A){return ('CSS1Compat'==(A.compatMode||(FCKBrowserInfo.IsSafari?'CSS1Compat':null)));};FCKTools.ArgumentsToArray=function(A,B,C){B=B||0;C=C||A.length;var D=[];for (var i=B;i<B+C&&i<A.length;i++) D.push(A[i]);return D;};FCKTools.CloneObject=function(A){var B=function() {};B.prototype=A;return new B;};FCKTools.AppendBogusBr=function(A){if (!A) return;var B=this.GetLastItem(A.getElementsByTagName('br'));if (!B||(B.getAttribute('type',2)!='_moz'&&B.getAttribute('_moz_dirty')==null)){var C=this.GetElementDocument(A);if (FCKBrowserInfo.IsOpera) A.appendChild(C.createTextNode(''));else A.appendChild(this.CreateBogusBR(C));}};FCKTools.GetLastItem=function(A){if (A.length>0) return A[A.length-1];return null;};FCKTools.GetDocumentPosition=function(w,A){var x=0;var y=0;var B=A;var C=null;var D=FCKTools.GetElementWindow(B);while (B&&!(D==w&&(B==w.document.body||B==w.document.documentElement))){x+=B.offsetLeft-B.scrollLeft;y+=B.offsetTop-B.scrollTop;if (!FCKBrowserInfo.IsOpera){var E=C;while (E&&E!=B){x-=E.scrollLeft;y-=E.scrollTop;E=E.parentNode;}};C=B;if (B.offsetParent) B=B.offsetParent;else{if (D!=w){B=D.frameElement;C=null;if (B) D=B.contentWindow.parent;}else B=null;}};if (FCKDomTools.GetCurrentElementStyle(w.document.body,'position')!='static'||(FCKBrowserInfo.IsIE&&FCKDomTools.GetPositionedAncestor(A)==null)){x+=w.document.body.offsetLeft;y+=w.document.body.offsetTop;};return { "x":x,"y":y };};FCKTools.GetWindowPosition=function(w,A){var B=this.GetDocumentPosition(w,A);var C=FCKTools.GetScrollPosition(w);B.x-=C.X;B.y-=C.Y;return B;};FCKTools.ProtectFormStyles=function(A){if (!A||A.nodeType!=1||A.tagName.toLowerCase()!='form') return [];var B=[];var C=['style','className'];for (var i=0;i<C.length;i++){var D=C[i];if (A.elements.namedItem(D)){var E=A.elements.namedItem(D);B.push([E,E.nextSibling]);A.removeChild(E);}};return B;};FCKTools.RestoreFormStyles=function(A,B){if (!A||A.nodeType!=1||A.tagName.toLowerCase()!='form') return;if (B.length>0){for (var i=B.length-1;i>=0;i--){var C=B[i][0];var D=B[i][1];if (D) A.insertBefore(C,D);else A.appendChild(C);}}};FCKTools.GetNextNode=function(A,B){if (A.firstChild) return A.firstChild;else if (A.nextSibling) return A.nextSibling;else{var C=A.parentNode;while (C){if (C==B) return null;if (C.nextSibling) return C.nextSibling;else C=C.parentNode;}};return null;};FCKTools.GetNextTextNode=function(A,B,C){node=this.GetNextNode(A,B);if (C&&node&&C(node)) return null;while (node&&node.nodeType!=3){node=this.GetNextNode(node,B);if (C&&node&&C(node)) return null;};return node;};FCKTools.Merge=function(){var A=arguments;var o=A[0];for (var i=1;i<A.length;i++){var B=A[i];for (var p in B) o[p]=B[p];};return o;};FCKTools.IsArray=function(A){return (A instanceof Array);};FCKTools.AppendLengthProperty=function(A,B){var C=0;for (var n in A) C++;return A[B||'length']=C;};FCKTools.NormalizeCssText=function(A){var B=document.createElement('span');B.style.cssText=A;return B.style.cssText;};FCKTools.Bind=function(A,B){return function(){ return B.apply(A,arguments);};};FCKTools.GetVoidUrl=function(){if (FCK_IS_CUSTOM_DOMAIN) return "javascript: void( function(){document.open();document.write('<html><head><title></title></head><body></body></html>');document.domain = '"+FCK_RUNTIME_DOMAIN+"';document.close();}() ) ;";if (FCKBrowserInfo.IsIE){if (FCKBrowserInfo.IsIE7||!FCKBrowserInfo.IsIE6) return "";else return "javascript: '';";};return "javascript: void(0);";};FCKTools.ResetStyles=function(A){A.style.cssText='margin:0;padding:0;border:0;background-color:transparent;background-image:none;';};
 FCKTools.CancelEvent=function(e){return false;};FCKTools._AppendStyleSheet=function(A,B){return A.createStyleSheet(B).owningElement;};FCKTools.AppendStyleString=function(A,B){if (!B) return null;var s=A.createStyleSheet("");s.cssText=B;return s;};FCKTools.ClearElementAttributes=function(A){A.clearAttributes();};FCKTools.GetAllChildrenIds=function(A){var B=[];for (var i=0;i<A.all.length;i++){var C=A.all[i].id;if (C&&C.length>0) B[B.length]=C;};return B;};FCKTools.RemoveOuterTags=function(e){e.insertAdjacentHTML('beforeBegin',e.innerHTML);e.parentNode.removeChild(e);};FCKTools.CreateXmlObject=function(A){var B;switch (A){case 'XmlHttp':if (document.location.protocol!='file:') try { return new XMLHttpRequest();} catch (e) {};B=['MSXML2.XmlHttp','Microsoft.XmlHttp'];break;case 'DOMDocument':B=['MSXML2.DOMDocument','Microsoft.XmlDom'];break;};for (var i=0;i<2;i++){try { return new ActiveXObject(B[i]);}catch (e){}};if (FCKLang.NoActiveX){alert(FCKLang.NoActiveX);FCKLang.NoActiveX=null;};return null;};FCKTools.DisableSelection=function(A){A.unselectable='on';var e,i=0;while ((e=A.all[i++])){switch (e.tagName){case 'IFRAME':case 'TEXTAREA':case 'INPUT':case 'SELECT':break;default:e.unselectable='on';}}};FCKTools.GetScrollPosition=function(A){var B=A.document;var C={ X:B.documentElement.scrollLeft,Y:B.documentElement.scrollTop };if (C.X>0||C.Y>0) return C;return { X:B.body.scrollLeft,Y:B.body.scrollTop };};FCKTools.AddEventListener=function(A,B,C){A.attachEvent('on'+B,C);};FCKTools.RemoveEventListener=function(A,B,C){A.detachEvent('on'+B,C);};FCKTools.AddEventListenerEx=function(A,B,C,D){var o={};o.Source=A;o.Params=D||[];o.Listener=function(ev){return C.apply(o.Source,[ev].concat(o.Params));};if (FCK.IECleanup) FCK.IECleanup.AddItem(null,function() { o.Source=null;o.Params=null;});A.attachEvent('on'+B,o.Listener);A=null;D=null;};FCKTools.GetViewPaneSize=function(A){var B;var C=A.document.documentElement;if (C&&C.clientWidth) B=C;else B=A.document.body;if (B) return { Width:B.clientWidth,Height:B.clientHeight };else return { Width:0,Height:0 };};FCKTools.SaveStyles=function(A){var B=FCKTools.ProtectFormStyles(A);var C={};if (A.className.length>0){C.Class=A.className;A.className='';};var D=A.style.cssText;if (D.length>0){C.Inline=D;A.style.cssText='';};FCKTools.RestoreFormStyles(A,B);return C;};FCKTools.RestoreStyles=function(A,B){var C=FCKTools.ProtectFormStyles(A);A.className=B.Class||'';A.style.cssText=B.Inline||'';FCKTools.RestoreFormStyles(A,C);};FCKTools.RegisterDollarFunction=function(A){A.$=A.document.getElementById;};FCKTools.AppendElement=function(A,B){return A.appendChild(this.GetElementDocument(A).createElement(B));};FCKTools.ToLowerCase=function(A){return A.toLowerCase();};
-var FCKeditorAPI;function InitializeAPI(){var A=window.parent;if (!(FCKeditorAPI=A.FCKeditorAPI)){var B='window.FCKeditorAPI = {Version : "2.6.4",VersionBuild : "21629",Instances : window.FCKeditorAPI && window.FCKeditorAPI.Instances || {},GetInstance : function( name ){return this.Instances[ name ];},_FormSubmit : function(){for ( var name in FCKeditorAPI.Instances ){var oEditor = FCKeditorAPI.Instances[ name ] ;if ( oEditor.GetParentForm && oEditor.GetParentForm() == this )oEditor.UpdateLinkedField() ;}this._FCKOriginalSubmit() ;},_FunctionQueue	: window.FCKeditorAPI && window.FCKeditorAPI._FunctionQueue || {Functions : new Array(),IsRunning : false,Add : function( f ){this.Functions.push( f );if ( !this.IsRunning )this.StartNext();},StartNext : function(){var aQueue = this.Functions ;if ( aQueue.length > 0 ){this.IsRunning = true;aQueue[0].call();}else this.IsRunning = false;},Remove : function( f ){var aQueue = this.Functions;var i = 0, fFunc;while( (fFunc = aQueue[ i ]) ){if ( fFunc == f )aQueue.splice( i,1 );i++ ;}this.StartNext();}}}';if (A.execScript) A.execScript(B,'JavaScript');else{if (FCKBrowserInfo.IsGecko10){eval.call(A,B);}else if(FCKBrowserInfo.IsAIR){FCKAdobeAIR.FCKeditorAPI_Evaluate(A,B);}else if (FCKBrowserInfo.IsSafari){var C=A.document;var D=C.createElement('script');D.appendChild(C.createTextNode(B));C.documentElement.appendChild(D);}else A.eval(B);};FCKeditorAPI=A.FCKeditorAPI;FCKeditorAPI.__Instances=FCKeditorAPI.Instances;};FCKeditorAPI.Instances[FCK.Name]=FCK;};function _AttachFormSubmitToAPI(){var A=FCK.GetParentForm();if (A){FCKTools.AddEventListener(A,'submit',FCK.UpdateLinkedField);if (!A._FCKOriginalSubmit&&(typeof(A.submit)=='function'||(!A.submit.tagName&&!A.submit.length))){A._FCKOriginalSubmit=A.submit;A.submit=FCKeditorAPI._FormSubmit;}}};function FCKeditorAPI_Cleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat&&!window.FCKUnloadFlag) return;delete FCKeditorAPI.Instances[FCK.Name];};function FCKeditorAPI_ConfirmCleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat) window.FCKUnloadFlag=true;};FCKTools.AddEventListener(window,'unload',FCKeditorAPI_Cleanup);FCKTools.AddEventListener(window,'beforeunload',FCKeditorAPI_ConfirmCleanup);
+var FCKeditorAPI;function InitializeAPI(){var A=window.parent;if (!(FCKeditorAPI=A.FCKeditorAPI)){var B='window.FCKeditorAPI = {Version : "2.6.4.1",VersionBuild : "23187",Instances : window.FCKeditorAPI && window.FCKeditorAPI.Instances || {},GetInstance : function( name ){return this.Instances[ name ];},_FormSubmit : function(){for ( var name in FCKeditorAPI.Instances ){var oEditor = FCKeditorAPI.Instances[ name ] ;if ( oEditor.GetParentForm && oEditor.GetParentForm() == this )oEditor.UpdateLinkedField() ;}this._FCKOriginalSubmit() ;},_FunctionQueue	: window.FCKeditorAPI && window.FCKeditorAPI._FunctionQueue || {Functions : new Array(),IsRunning : false,Add : function( f ){this.Functions.push( f );if ( !this.IsRunning )this.StartNext();},StartNext : function(){var aQueue = this.Functions ;if ( aQueue.length > 0 ){this.IsRunning = true;aQueue[0].call();}else this.IsRunning = false;},Remove : function( f ){var aQueue = this.Functions;var i = 0, fFunc;while( (fFunc = aQueue[ i ]) ){if ( fFunc == f )aQueue.splice( i,1 );i++ ;}this.StartNext();}}}';if (A.execScript) A.execScript(B,'JavaScript');else{if (FCKBrowserInfo.IsGecko10){eval.call(A,B);}else if(FCKBrowserInfo.IsAIR){FCKAdobeAIR.FCKeditorAPI_Evaluate(A,B);}else if (FCKBrowserInfo.IsSafari){var C=A.document;var D=C.createElement('script');D.appendChild(C.createTextNode(B));C.documentElement.appendChild(D);}else A.eval(B);};FCKeditorAPI=A.FCKeditorAPI;FCKeditorAPI.__Instances=FCKeditorAPI.Instances;};FCKeditorAPI.Instances[FCK.Name]=FCK;};function _AttachFormSubmitToAPI(){var A=FCK.GetParentForm();if (A){FCKTools.AddEventListener(A,'submit',FCK.UpdateLinkedField);if (!A._FCKOriginalSubmit&&(typeof(A.submit)=='function'||(!A.submit.tagName&&!A.submit.length))){A._FCKOriginalSubmit=A.submit;A.submit=FCKeditorAPI._FormSubmit;}}};function FCKeditorAPI_Cleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat&&!window.FCKUnloadFlag) return;delete FCKeditorAPI.Instances[FCK.Name];};function FCKeditorAPI_ConfirmCleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat) window.FCKUnloadFlag=true;};FCKTools.AddEventListener(window,'unload',FCKeditorAPI_Cleanup);FCKTools.AddEventListener(window,'beforeunload',FCKeditorAPI_ConfirmCleanup);
 var FCKImagePreloader=function(){this._Images=[];};FCKImagePreloader.prototype={AddImages:function(A){if (typeof(A)=='string') A=A.split(';');this._Images=this._Images.concat(A);},Start:function(){var A=this._Images;this._PreloadCount=A.length;for (var i=0;i<A.length;i++){var B=document.createElement('img');FCKTools.AddEventListenerEx(B,'load',_FCKImagePreloader_OnImage,this);FCKTools.AddEventListenerEx(B,'error',_FCKImagePreloader_OnImage,this);B.src=A[i];_FCKImagePreloader_ImageCache.push(B);}}};var _FCKImagePreloader_ImageCache=[];function _FCKImagePreloader_OnImage(A,B){if ((--B._PreloadCount)==0&&B.OnComplete) B.OnComplete();};
 var FCKRegexLib={AposEntity:/&apos;/gi,ObjectElements:/^(?:IMG|TABLE|TR|TD|TH|INPUT|SELECT|TEXTAREA|HR|OBJECT|A|UL|OL|LI)$/i,NamedCommands:/^(?:Cut|Copy|Paste|Print|SelectAll|RemoveFormat|Unlink|Undo|Redo|Bold|Italic|Underline|StrikeThrough|Subscript|Superscript|JustifyLeft|JustifyCenter|JustifyRight|JustifyFull|Outdent|Indent|InsertOrderedList|InsertUnorderedList|InsertHorizontalRule)$/i,BeforeBody:/(^[\s\S]*\<body[^\>]*\>)/i,AfterBody:/(\<\/body\>[\s\S]*$)/i,ToReplace:/___fcktoreplace:([\w]+)/ig,MetaHttpEquiv:/http-equiv\s*=\s*["']?([^"' ]+)/i,HasBaseTag:/<base /i,HasBodyTag:/<body[\s|>]/i,HtmlOpener:/<html\s?[^>]*>/i,HeadOpener:/<head\s?[^>]*>/i,HeadCloser:/<\/head\s*>/i,FCK_Class:/\s*FCK__[^ ]*(?=\s+|$)/,ElementName:/(^[a-z_:][\w.\-:]*\w$)|(^[a-z_]$)/,ForceSimpleAmpersand:/___FCKAmp___/g,SpaceNoClose:/\/>/g,EmptyParagraph:/^<(p|div|address|h\d|center)(?=[ >])[^>]*>\s*(<\/\1>)?$/,EmptyOutParagraph:/^<(p|div|address|h\d|center)(?=[ >])[^>]*>(?:\s*|&nbsp;)(<\/\1>)?$/,TagBody:/></,GeckoEntitiesMarker:/#\?-\:/g,ProtectUrlsImg:/<img(?=\s).*?\ssrc=((?:(?:\s*)("|').*?\2)|(?:[^"'][^ >]+))/gi,ProtectUrlsA:/<a(?=\s).*?\shref=((?:(?:\s*)("|').*?\2)|(?:[^"'][^ >]+))/gi,ProtectUrlsArea:/<area(?=\s).*?\shref=((?:(?:\s*)("|').*?\2)|(?:[^"'][^ >]+))/gi,Html4DocType:/HTML 4\.0 Transitional/i,DocTypeTag:/<!DOCTYPE[^>]*>/i,HtmlDocType:/DTD HTML/,TagsWithEvent:/<[^\>]+ on\w+[\s\r\n]*=[\s\r\n]*?('|")[\s\S]+?\>/g,EventAttributes:/\s(on\w+)[\s\r\n]*=[\s\r\n]*?('|")([\s\S]*?)\2/g,ProtectedEvents:/\s\w+_fckprotectedatt="([^"]+)"/g,StyleProperties:/\S+\s*:/g,InvalidSelfCloseTags:/(<(?!base|meta|link|hr|br|param|img|area|input)([a-zA-Z0-9:]+)[^>]*)\/>/gi,StyleVariableAttName:/#\(\s*("|')(.+?)\1[^\)]*\s*\)/g,RegExp:/^\/(.*)\/([gim]*)$/,HtmlTag:/<[^\s<>](?:"[^"]*"|'[^']*'|[^<])*>/};
Index: /FCKeditor/releases/latest/fckeditor.js
===================================================================
--- /FCKeditor/releases/latest/fckeditor.js	(revision 3824)
+++ /FCKeditor/releases/latest/fckeditor.js	(revision 3825)
@@ -60,6 +60,6 @@
 FCKeditor.MinWidth = 750 ;
 
-FCKeditor.prototype.Version			= '2.6.4' ;
-FCKeditor.prototype.VersionBuild	= '21629' ;
+FCKeditor.prototype.Version			= '2.6.4.1' ;
+FCKeditor.prototype.VersionBuild	= '23187' ;
 
 FCKeditor.prototype.Create = function()
Index: /FCKeditor/releases/latest/fckeditor.pl
===================================================================
--- /FCKeditor/releases/latest/fckeditor.pl	(revision 3824)
+++ /FCKeditor/releases/latest/fckeditor.pl	(revision 3825)
Index: /FCKeditor/releases/stable/_samples/asp/sample02.asp
===================================================================
--- /FCKeditor/releases/stable/_samples/asp/sample02.asp	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/asp/sample02.asp	(revision 3825)
@@ -87,4 +87,10 @@
 sBasePath = Left( sBasePath, InStrRev( sBasePath, "/_samples" ) )
 
+'This RegExp is used to sanitize recived lang parameter
+Dim oRegex
+Set oRegex = New RegExp
+oRegex.Global		= True
+oRegex.Pattern = "[^a-z\-]"
+
 Dim oFCKeditor
 Set oFCKeditor = New FCKeditor
@@ -96,5 +102,5 @@
 Else
 	oFCKeditor.Config("AutoDetectLanguage") = False
-	oFCKeditor.Config("DefaultLanguage")    = Request.QueryString("Lang")
+	oFCKeditor.Config("DefaultLanguage")    =  oRegex.Replace( Request.QueryString("Lang"), "")
 End If
 
Index: /FCKeditor/releases/stable/_samples/asp/sample03.asp
===================================================================
--- /FCKeditor/releases/stable/_samples/asp/sample03.asp	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/asp/sample03.asp	(revision 3825)
@@ -75,4 +75,10 @@
 sBasePath = Left( sBasePath, InStrRev( sBasePath, "/_samples" ) )
 
+'This RegExp is used to sanitize recived toolbar parameter
+Dim oRegex
+Set oRegex = New RegExp
+oRegex.Global		= True
+oRegex.Pattern = "[^a-zA-Z]"
+
 Dim oFCKeditor
 Set oFCKeditor = New FCKeditor
@@ -80,5 +86,5 @@
 
 If Request.QueryString("Toolbar") <> "" Then
-	oFCKeditor.ToolbarSet = Server.HTMLEncode( Request.QueryString("Toolbar") )
+	oFCKeditor.ToolbarSet = oRegex.Replace( Request.QueryString("Toolbar"), "" )
 End If
 
Index: /FCKeditor/releases/stable/_samples/asp/sample04.asp
===================================================================
--- /FCKeditor/releases/stable/_samples/asp/sample04.asp	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/asp/sample04.asp	(revision 3825)
@@ -81,4 +81,10 @@
 sBasePath = Left( sBasePath, InStrRev( sBasePath, "/_samples" ) )
 
+'This RegExp is used to sanitize recived skin parameter
+Dim oRegex
+Set oRegex = New RegExp
+oRegex.Global		= True
+oRegex.Pattern = "[^a-zA-Z0-9]"
+
 Dim oFCKeditor
 Set oFCKeditor = New FCKeditor
@@ -86,5 +92,5 @@
 
 If Request.QueryString("Skin") <> "" Then
-	oFCKeditor.Config("SkinPath") = sBasePath + "editor/skins/" & Server.HTMLEncode( Request.QueryString("Skin") ) + "/"
+	oFCKeditor.Config("SkinPath") = sBasePath + "editor/skins/" & oRegex.Replace( Request.QueryString("Skin"), "" ) + "/"
 End If
 
Index: /FCKeditor/releases/stable/_samples/asp/sampleposteddata.asp
===================================================================
--- /FCKeditor/releases/stable/_samples/asp/sampleposteddata.asp	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/asp/sampleposteddata.asp	(revision 3825)
@@ -48,5 +48,5 @@
 			%>
 			<tr>
-				<th><%=sForm%></th>
+				<th><%=Server.HTMLEncode( sForm )%></th>
 				<td><pre><%=Server.HTMLEncode( Request.Form(sForm) )%></pre></td>
 			</tr>
Index: /FCKeditor/releases/stable/_samples/cfm/sample02.cfm
===================================================================
--- /FCKeditor/releases/stable/_samples/cfm/sample02.cfm	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/cfm/sample02.cfm	(revision 3825)
@@ -83,5 +83,5 @@
 <cfif isDefined( "URL.Lang" )>
 	<cfset config["AutoDetectLanguage"]		= false>
-	<cfset config["DefaultLanguage"]		= HTMLEditFormat( URL.Lang )>
+	<cfset config["DefaultLanguage"]		= REReplaceNoCase( URL.Lang, "[^a-z\-]", "", "all" )>
 <cfelse>
 	<cfset config["AutoDetectLanguage"]		= true>
Index: /FCKeditor/releases/stable/_samples/cfm/sample02_mx.cfm
===================================================================
--- /FCKeditor/releases/stable/_samples/cfm/sample02_mx.cfm	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/cfm/sample02_mx.cfm	(revision 3825)
@@ -96,5 +96,5 @@
 		{
 			fckEditor.config["AutoDetectLanguage"]		= false ;
-			fckEditor.config["DefaultLanguage"]			= HTMLEditFormat( URL.Lang ) ;
+			fckEditor.config["DefaultLanguage"]			= REReplaceNoCase( URL.Lang, "[^a-z\-]", "", "all" ) ;
 		}
 		else
Index: /FCKeditor/releases/stable/_samples/cfm/sample03.cfm
===================================================================
--- /FCKeditor/releases/stable/_samples/cfm/sample03.cfm	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/cfm/sample03.cfm	(revision 3825)
@@ -68,5 +68,5 @@
 
 <cfif isDefined( "URL.Toolbar" )>
-	<cfset toolbarSet = HTMLEditFormat( URL.Toolbar )>
+	<cfset toolbarSet = REReplaceNoCase( URL.Toolbar, "[^a-z]", "", "all" )>
 <cfelse>
 	<cfset toolbarSet = "Default">
Index: /FCKeditor/releases/stable/_samples/cfm/sample03_mx.cfm
===================================================================
--- /FCKeditor/releases/stable/_samples/cfm/sample03_mx.cfm	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/cfm/sample03_mx.cfm	(revision 3825)
@@ -82,5 +82,5 @@
 		if ( isDefined( "URL.Toolbar" ) )
 		{
-			fckEditor.ToolbarSet		= HTMLEditFormat( URL.Toolbar ) ;
+			fckEditor.ToolbarSet		= REReplaceNoCase( URL.Toolbar, "[^a-z]", "", "all" ) ;
 		}
 		fckEditor.create() ; // create the editor.
Index: /FCKeditor/releases/stable/_samples/cfm/sample04.cfm
===================================================================
--- /FCKeditor/releases/stable/_samples/cfm/sample04.cfm	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/cfm/sample04.cfm	(revision 3825)
@@ -78,5 +78,5 @@
 <cfset config = structNew()>
 <cfif isDefined( "URL.Skin" )>
-	<cfset config["SkinPath"] = basePath & 'editor/skins/' & HTMLEditFormat( URL.Skin ) & '/'>
+	<cfset config["SkinPath"] = basePath & 'editor/skins/' & REReplaceNoCase( URL.Skin, "[^a-z0-9]", "", "all" ) & '/'>
 </cfif>
 
Index: /FCKeditor/releases/stable/_samples/cfm/sample04_mx.cfm
===================================================================
--- /FCKeditor/releases/stable/_samples/cfm/sample04_mx.cfm	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/cfm/sample04_mx.cfm	(revision 3825)
@@ -88,5 +88,5 @@
 		if ( isDefined( "URL.Skin" ) )
 		{
-			fckEditor.config['SkinPath'] = basePath & 'editor/skins/' & HTMLEditFormat( URL.Skin ) & '/' ;
+			fckEditor.config['SkinPath'] = basePath & 'editor/skins/' & REReplaceNoCase( URL.Skin, "[^a-z0-9]", "", "all" ) & '/' ;
 		}
 		fckEditor.create() ; // create the editor.
Index: /FCKeditor/releases/stable/_samples/cfm/sampleposteddata.cfm
===================================================================
--- /FCKeditor/releases/stable/_samples/cfm/sampleposteddata.cfm	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/cfm/sampleposteddata.cfm	(revision 3825)
@@ -35,5 +35,4 @@
 		This page lists all data posted by the form.
 		<hr>
-<cfif listFirst( server.coldFusion.productVersion ) LT 6>
 	<cfif isDefined( 'FORM.fieldnames' )>
 		<cfoutput>
@@ -49,20 +48,23 @@
 		<tr>
 			<th>FieldNames</th>
-			<td>#FORM.fieldNames#</td>
+			<td>#HTMLEditFormat( FORM.fieldNames )#</td>
 		</tr>
 		<cfloop list="#FORM.fieldnames#" index="key">
-		<tr>
-			<th>#key#</th>
-			<td><pre>#HTMLEditFormat( evaluate( "FORM.#key#" ) )#</pre></td>
-		</tr>
+			<tr>
+				<th>#HTMLEditFormat( key )#</th>
+				<td><pre>
+			<cftry>
+				<cfif isDefined( 'FORM.' & #key# ) and REFindNoCase("^[a-z0-9]+$", key)>
+					#HTMLEditFormat( evaluate( "FORM.#key#" ) )#
+				</cfif>
+			<cfcatch type="any">
+			</cfcatch>
+			</cftry>
+				</pre></td>
+			</tr>
 		</cfloop>
 		</table>
 		</cfoutput>
 	</cfif>
-<cfelse>
-	<cfdump var="#FORM#" label="Dump of FORM Variables">
-</cfif>
-
-
 	</body>
 </html>
Index: /FCKeditor/releases/stable/_samples/lasso/sample02.lasso
===================================================================
--- /FCKeditor/releases/stable/_samples/lasso/sample02.lasso	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/lasso/sample02.lasso	(revision 3825)
@@ -85,5 +85,5 @@
 		var('config') = array(
 			'AutoDetectLanguage' = 'false',
-			'DefaultLanguage' = action_param('Lang')
+			'DefaultLanguage' = (String_ReplaceRegExp: action_param('Lang'), -find='[^a-z\-]', -replace='')
 		);
 	else;
Index: /FCKeditor/releases/stable/_samples/lasso/sample03.lasso
===================================================================
--- /FCKeditor/releases/stable/_samples/lasso/sample03.lasso	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/lasso/sample03.lasso	(revision 3825)
@@ -76,5 +76,5 @@
 
 	if(action_param('Toolbar'));
-		$myeditor->toolbarset = action_param('Toolbar');
+		$myeditor->toolbarset = (String_ReplaceRegExp: action_param('Toolbar'), -find='[^a-zA-Z]', -replace='');
 	/if;
 
Index: /FCKeditor/releases/stable/_samples/lasso/sample04.lasso
===================================================================
--- /FCKeditor/releases/stable/_samples/lasso/sample04.lasso	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/lasso/sample04.lasso	(revision 3825)
@@ -82,5 +82,6 @@
 
 	if(action_param('Skin'));
-		$myeditor->config = array('SkinPath' = $basepath + 'editor/skins/' + action_param('Skin') + '/');
+		var('skin') = (String_ReplaceRegExp: action_param('Skin'), -find='[^a-zA-Z0-9]', -replace='');
+		$myeditor->config = array('SkinPath' = $basepath + 'editor/skins/' + $skin + '/');
 	/if;
 
Index: /FCKeditor/releases/stable/_samples/lasso/sampleposteddata.lasso
===================================================================
--- /FCKeditor/releases/stable/_samples/lasso/sampleposteddata.lasso	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/lasso/sampleposteddata.lasso	(revision 3825)
@@ -45,6 +45,6 @@
 [iterate(client_postparams, local('this'))]
 			<tr>
-				<th>[#this->first]</th>
-				<td><pre>[#this->second]</pre></td>
+				<th>[Encode_HTML: #this->first]</th>
+				<td><pre>[Encode_HTML: #this->second]</pre></td>
 			</tr>
 [/iterate]
Index: /FCKeditor/releases/stable/_samples/perl/sample01.cgi
===================================================================
--- /FCKeditor/releases/stable/_samples/perl/sample01.cgi	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/perl/sample01.cgi	(revision 3825)
Index: /FCKeditor/releases/stable/_samples/perl/sample02.cgi
===================================================================
--- /FCKeditor/releases/stable/_samples/perl/sample02.cgi	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/perl/sample02.cgi	(revision 3825)
@@ -145,5 +145,7 @@
 	if($FORM{'Lang'} ne "") {
 		$Config{'AutoDetectLanguage'}	= "false";
-		$Config{'DefaultLanguage'}		= $FORM{'Lang'};
+		$lang = $FORM{'Lang'};
+		$lang =~ s/[^a-z\-]//ig;
+		$Config{'DefaultLanguage'}		= $lang;
 	} else {
 		$Config{'AutoDetectLanguage'}	= "true";
Index: /FCKeditor/releases/stable/_samples/perl/sample03.cgi
===================================================================
--- /FCKeditor/releases/stable/_samples/perl/sample03.cgi	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/perl/sample03.cgi	(revision 3825)
@@ -133,5 +133,6 @@
 
 	if($FORM{'Toolbar'} ne "") {
-		$ToolbarSet = &specialchar_cnv( $FORM{'Toolbar'} );
+		$ToolbarSet = $FORM{'Toolbar'};
+		$ToolbarSet =~ s/[^a-z]//ig;
 	}
 	$Value = '<p>This is some <strong>sample text</strong>. You are using <a href="http://www.fckeditor.net/">FCKeditor</a>.</p>' ;
Index: /FCKeditor/releases/stable/_samples/perl/sample04.cgi
===================================================================
--- /FCKeditor/releases/stable/_samples/perl/sample04.cgi	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/perl/sample04.cgi	(revision 3825)
@@ -140,5 +140,7 @@
 
 	if($FORM{'Skin'} ne "") {
-		$Config{'SkinPath'} = $sBasePath . 'editor/skins/' . &specialchar_cnv( $FORM{'Skin'} ) . '/' ;
+		$skin = $FORM{'Skin'};
+		$skin =~ s/[^a-z0-9]//ig;
+		$Config{'SkinPath'} = $sBasePath . 'editor/skins/' . $skin . '/' ;
 	}
 	$Value = '<p>This is some <strong>sample text</strong>. You are using <a href="http://www.fckeditor.net/">FCKeditor</a>.</p>' ;
Index: /FCKeditor/releases/stable/_samples/perl/sampleposteddata.cgi
===================================================================
--- /FCKeditor/releases/stable/_samples/perl/sampleposteddata.cgi	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/perl/sampleposteddata.cgi	(revision 3825)
@@ -94,4 +94,5 @@
 	foreach $key (keys %FORM) {
 		$postedValue = &specialchar_cnv($FORM{$key});
+		$key = &specialchar_cnv($key);
 		print <<"_HTML_TAG_";
 			<tr>
Index: /FCKeditor/releases/stable/_samples/php/sample02.php
===================================================================
--- /FCKeditor/releases/stable/_samples/php/sample02.php	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/php/sample02.php	(revision 3825)
@@ -92,5 +92,5 @@
 {
 	$oFCKeditor->Config['AutoDetectLanguage']	= false ;
-	$oFCKeditor->Config['DefaultLanguage']		= $_GET['Lang'] ;
+	$oFCKeditor->Config['DefaultLanguage']		= preg_replace("/[^a-z\-]/i", "", $_GET['Lang']) ;
 }
 else
Index: /FCKeditor/releases/stable/_samples/php/sample03.php
===================================================================
--- /FCKeditor/releases/stable/_samples/php/sample03.php	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/php/sample03.php	(revision 3825)
@@ -78,5 +78,5 @@
 
 if ( isset($_GET['Toolbar']) )
-	$oFCKeditor->ToolbarSet = htmlspecialchars($_GET['Toolbar']);
+	$oFCKeditor->ToolbarSet = preg_replace("/[^a-z]/i", "", $_GET['Toolbar']);
 
 $oFCKeditor->Value = '<p>This is some <strong>sample text</strong>. You are using <a href="http://www.fckeditor.net/">FCKeditor</a>.</p>' ;
Index: /FCKeditor/releases/stable/_samples/php/sample04.php
===================================================================
--- /FCKeditor/releases/stable/_samples/php/sample04.php	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/php/sample04.php	(revision 3825)
@@ -84,5 +84,5 @@
 
 if ( isset($_GET['Skin']) )
-	$oFCKeditor->Config['SkinPath'] = $sBasePath . 'editor/skins/' . htmlspecialchars($_GET['Skin']) . '/' ;
+	$oFCKeditor->Config['SkinPath'] = $sBasePath . 'editor/skins/' . preg_replace("/[^a-z0-9]/i", "", $_GET['Skin']) . '/' ;
 
 $oFCKeditor->Value = '<p>This is some <strong>sample text</strong>. You are using <a href="http://www.fckeditor.net/">FCKeditor</a>.</p>' ;
Index: /FCKeditor/releases/stable/_samples/php/sampleposteddata.php
===================================================================
--- /FCKeditor/releases/stable/_samples/php/sampleposteddata.php	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/php/sampleposteddata.php	(revision 3825)
@@ -59,5 +59,5 @@
 ?>
 			<tr>
-				<th><?php echo $sForm?></th>
+				<th><?php echo htmlspecialchars($sForm) ?></th>
 				<td><pre><?php echo $postedValue?></pre></td>
 			</tr>
Index: /FCKeditor/releases/stable/_samples/py/sample01.py
===================================================================
--- /FCKeditor/releases/stable/_samples/py/sample01.py	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/py/sample01.py	(revision 3825)
@@ -69,8 +69,8 @@
 
 # For testing your environments
-print "<hr>"
-for key in os.environ.keys():
-	print "%s: %s<br>" % (key, os.environ.get(key, ""))
-print "<hr>"
+#print "<hr>"
+#for key in os.environ.keys():
+#	print "%s: %s<br>" % (key, os.environ.get(key, ""))
+#print "<hr>"
 
 # Document footer
Index: /FCKeditor/releases/stable/_samples/py/sampleposteddata.py
===================================================================
--- /FCKeditor/releases/stable/_samples/py/sampleposteddata.py	(revision 3824)
+++ /FCKeditor/releases/stable/_samples/py/sampleposteddata.py	(revision 3825)
@@ -71,5 +71,5 @@
 					<td><pre>%s</pre></td>
 				</tr>
-			""" % (key, value)
+			""" % (cgi.escape(key), cgi.escape(value))
 	except Exception, e:
 		print e
@@ -77,8 +77,8 @@
 
 # For testing your environments
-print "<hr>"
-for key in os.environ.keys():
-	print "%s: %s<br>" % (key, os.environ.get(key, ""))
-print "<hr>"
+#print "<hr>"
+#for key in os.environ.keys():
+#	print "%s: %s<br>" % (key, os.environ.get(key, ""))
+#print "<hr>"
 
 # Document footer
Index: /FCKeditor/releases/stable/_whatsnew.html
===================================================================
--- /FCKeditor/releases/stable/_whatsnew.html	(revision 3824)
+++ /FCKeditor/releases/stable/_whatsnew.html	(revision 3825)
@@ -33,4 +33,11 @@
 	<h1>
 		FCKeditor ChangeLog - What's New?</h1>
+	<h3>
+		Version 2.6.4.1</h3>
+	<p>
+		Fixed Bugs:</p>
+	<ul>
+		<li><strong>Security release, upgrade is highly recommended.</strong></li>
+	</ul>
 	<h3>
 		Version 2.6.4</h3>
Index: /FCKeditor/releases/stable/editor/_source/fckeditorapi.js
===================================================================
--- /FCKeditor/releases/stable/editor/_source/fckeditorapi.js	(revision 3824)
+++ /FCKeditor/releases/stable/editor/_source/fckeditorapi.js	(revision 3825)
@@ -41,6 +41,6 @@
 		var sScript =
 			'window.FCKeditorAPI = {' +
-				'Version : "2.6.4",' +
-				'VersionBuild : "21629",' +
+				'Version : "2.6.4.1",' +
+				'VersionBuild : "23187",' +
 				'Instances : window.FCKeditorAPI && window.FCKeditorAPI.Instances || {},' +
 
Index: /FCKeditor/releases/stable/editor/dialog/fck_about.html
===================================================================
--- /FCKeditor/releases/stable/editor/dialog/fck_about.html	(revision 3824)
+++ /FCKeditor/releases/stable/editor/dialog/fck_about.html	(revision 3825)
@@ -79,6 +79,6 @@
 								<span fcklang="DlgAboutVersion">version</span>
 								<br />
-								<b>2.6.4</b><br />
-								Build 21629</td>
+								<b>2.6.4.1</b><br />
+								Build 23187</td>
 						</tr>
 					</table>
Index: /FCKeditor/releases/stable/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.pl
===================================================================
--- /FCKeditor/releases/stable/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.pl	(revision 3824)
+++ /FCKeditor/releases/stable/editor/dialog/fck_spellerpages/spellerpages/server-scripts/spellchecker.pl	(revision 3825)
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/asp/basexml.asp
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/asp/basexml.asp	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/asp/basexml.asp	(revision 3825)
@@ -57,5 +57,9 @@
 	Response.Write "<?xml version=""1.0"" encoding=""utf-8"" ?>"
 
+	If text <> "" then
 	Response.Write "<Connector><Error number=""" & number & """ text=""" & Server.HTMLEncode( text ) & """ /></Connector>"
+	else
+	Response.Write "<Connector><Error number=""" & number & """ /></Connector>"
+	end if
 
 	Response.End
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/asp/commands.asp
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/asp/commands.asp	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/asp/commands.asp	(revision 3825)
@@ -131,5 +131,5 @@
 
 	' Create the "Error" node.
-	Response.Write "<Error number=""" & sErrorNumber & """ originalNumber=""" & iErrNumber & """ originalDescription=""" & ConvertToXmlAttribute( sErrDescription ) & """ />"
+	Response.Write "<Error number=""" & sErrorNumber & """ />"
 End Sub
 
@@ -193,5 +193,9 @@
 	sFileUrl = CombinePaths( sFileUrl, sFileName )
 
-	SendUploadResults sErrorNumber, sFileUrl, sFileName, ""
+	If ( sErrorNumber = "0" or sErrorNumber = "201" ) then
+		SendUploadResults sErrorNumber, sFileUrl, sFileName, ""
+	Else
+		SendUploadResults sErrorNumber, "", "", ""
+	End If
 End Sub
 
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/asp/connector.asp
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/asp/connector.asp	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/asp/connector.asp	(revision 3825)
@@ -58,5 +58,5 @@
 	' Check if it is an allowed resource type.
 	if ( Not IsAllowedType( sResourceType ) ) Then
-		SendError 1, "The """ & sResourceType & """ resource type isn't allowed"
+		SendError 1, "Invalid type specified"
 	end if
 
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/asp/io.asp
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/asp/io.asp	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/asp/io.asp	(revision 3825)
@@ -176,4 +176,6 @@
 function GetCurrentFolder()
 	dim sCurrentFolder
+	dim oRegex
+
 	sCurrentFolder = Request.QueryString("CurrentFolder")
 	If ( sCurrentFolder = "" ) Then sCurrentFolder = "/"
@@ -185,4 +187,12 @@
 	' Check for invalid folder paths (..)
 	If ( InStr( 1, sCurrentFolder, ".." ) <> 0 OR InStr( 1, sCurrentFolder, "\" ) <> 0) Then
+		SendError 102, ""
+	End If
+
+	Set oRegex = New RegExp
+	oRegex.Global		= True
+	oRegex.Pattern = "(/\.)|(//)|([\\:\*\?\""\<\>\|]|[\u0000-\u001F]|\u007F)"
+
+	if (oRegex.Test(sCurrentFolder)) Then
 		SendError 102, ""
 	End If
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/asp/upload.asp
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/asp/upload.asp	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/asp/upload.asp	(revision 3825)
@@ -49,5 +49,5 @@
 	If ( sResourceType = "" ) Then sResourceType = "File"
 
-	sCurrentFolder = GetCurrentFolder()
+	sCurrentFolder = "/"
 
 	' Is Upload enabled?
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf5_connector.cfm
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf5_connector.cfm	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf5_connector.cfm	(revision 3825)
@@ -103,6 +103,31 @@
 	rootPath = left( serverPath, Len(serverPath) - Len(userFilesPath) ) ;
 	xmlContent = ""; // append to this string to build content
+	invalidName = false;
 </cfscript>
 
+
+<cfif not config.enabled>
+
+	<cfset xmlContent = "<Error number=""1"" text=""This connector is disabled. Please check the 'editor/filemanager/connectors/cfm/config.cfm' file"" />">
+
+<cfelseif find("..",url.currentFolder) or find("\",url.currentFolder) or REFind('(/\.)|(//)|[[:cntrl:]]|([\\:\*\?\"<>])', url.currentFolder)>
+
+	<cfset invalidName = true>
+	<cfset xmlContent = "<Error number=""102"" />">
+
+<cfelseif isDefined("Config.ConfigAllowedCommands") and not ListFind(Config.ConfigAllowedCommands, url.command)>
+
+	<cfset invalidName = true>
+	<cfset xmlContent = '<Error number="1" text="The &quot;' & HTMLEditFormat(url.command) & '&quot; command isn''t allowed" />'>
+
+<cfelseif isDefined("Config.ConfigAllowedTypes") and not ListFind(Config.ConfigAllowedTypes, url.type)>
+
+	<cfset invalidName = true>
+	<cfset xmlContent = '<Error number="1" text="Invalid type specified" />'>
+
+</cfif>
+
+<cfset resourceTypeUrl = "">
+<cfif not len(xmlContent)>
 <cfset resourceTypeUrl = rereplace( replace( Config.FileTypesPath[url.type], fs, "/", "all"), "/$", "") >
 
@@ -126,23 +151,6 @@
 <cfset userFilesServerPath = replace( userFilesServerPath, fs & fs, fs, "all") >
 
-<cfif not config.enabled>
-
-	<cfset xmlContent = "<Error number=""1"" text=""This connector is disabled. Please check the 'editor/filemanager/connectors/cfm/config.cfm' file"" />">
-
-<cfelseif find("..",url.currentFolder) or find("\",url.currentFolder)>
-
-	<cfset xmlContent = "<Error number=""102"" />">
-
-<cfelseif isDefined("Config.ConfigAllowedCommands") and not ListFind(Config.ConfigAllowedCommands, url.command)>
-
-	<cfset xmlContent = '<Error number="1" text="The &quot;' & url.command & '&quot; command isn''t allowed" />'>
-
-<cfelseif isDefined("Config.ConfigAllowedTypes") and not ListFind(Config.ConfigAllowedTypes, url.type)>
-
-	<cfset xmlContent = '<Error number="1" text="The &quot;' & url.type & '&quot; type isn''t allowed" />'>
-
-</cfif>
-
 <cfset resourceTypeDirectory = left( userFilesServerPath, Len(userFilesServerPath) - Len(url.currentFolder) )>
+</cfif>
 
 <cfif not len(xmlContent) and not directoryexists(resourceTypeDirectory)>
@@ -264,4 +272,5 @@
 					newFolderName = reReplace(newFolderName, "([^_]+)_+$", "\1", "all");
 					newFolderName = reReplace(newFolderName, "$_([^_]+)$", "\1", "all");
+					newFolderName = reReplace(newFolderName, '\.+', "_", "all" );
 				}
 			</cfscript>
@@ -272,5 +281,5 @@
 				<cfset errorNumber = 101>
 			<cfelseif reFind("^\.\.",newFolderName)>
-				<cfset errorNumber = 103>
+				<cfset errorNumber = 102>
 			<cfelse>
 				<cfset errorNumber = 0>
@@ -304,6 +313,12 @@
 
 <cfscript>
-	xmlHeader = '<?xml version="1.0" encoding="utf-8" ?><Connector command="#url.command#" resourceType="#url.type#">';
-	xmlHeader = xmlHeader & '<CurrentFolder path="#url.currentFolder#" url="#resourceTypeUrl##url.currentFolder#" />';
+	xmlHeader = '<?xml version="1.0" encoding="utf-8" ?>';
+	if (invalidName) {
+		xmlHeader = xmlHeader & '<Connector>';
+	}
+	else {
+		xmlHeader = xmlHeader & '<Connector command="#url.command#" resourceType="#url.type#">';
+		xmlHeader = xmlHeader & '<CurrentFolder path="#url.currentFolder#" url="#resourceTypeUrl##url.currentFolder#" />';
+	}
 	xmlFooter = '</Connector>';
 </cfscript>
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf5_upload.cfm
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf5_upload.cfm	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf5_upload.cfm	(revision 3825)
@@ -40,4 +40,8 @@
 <cfparam name="url.currentFolder" default="/">
 
+<cfif url.command eq "QuickUpload">
+	<cfset url.currentFolder = "/">
+</cfif>
+
 <cfif not isDefined("config_included")>
 	<cfinclude template="config.cfm">
@@ -75,4 +79,10 @@
 	<cfabort>
 </cfif>
+
+<cfif REFind('(/\.)|(//)|[[:cntrl:]]|([\\:\*\?\"<>])', url.currentFolder)>
+	<cfset SendUploadResults(102)>
+	<cfabort>
+</cfif>
+
 
 <cfscript>
@@ -139,5 +149,5 @@
 		</cftry>
 	</cfif>
-<cfelse>
+<cfelseif url.command eq "FileUpload">
 	<cfset resourceTypeUrl = rereplace( replace( Config.FileTypesPath[url.type], fs, "/", "all"), "/$", "") >
 	<cfif isDefined( "Config.FileTypesAbsolutePath" )
@@ -287,5 +297,5 @@
 <cfif errorNumber EQ 0>
 	<!--- file was uploaded succesfully --->
-	<cfset SendUploadResults(errorNumber, '#resourceTypeUrl##url.currentFolder##fileName#.#fileExt#', "", "")>
+	<cfset SendUploadResults(errorNumber, '#resourceTypeUrl##url.currentFolder##fileName#.#fileExt#', replace( fileName & "." & fileExt, "'", "\'", "ALL"), "")>
 	<cfabort>
 <cfelseif errorNumber EQ 201>
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf_basexml.cfm
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf_basexml.cfm	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf_basexml.cfm	(revision 3825)
@@ -65,4 +65,8 @@
 	<cfargument name="number" required="true" type="Numeric">
 	<cfargument name="text" required="true">
-	<cfoutput><Error number="#ARGUMENTS.number#" text="#htmleditformat(ARGUMENTS.text)#" /></cfoutput>
+	<cfif Len(ARGUMENTS.text)>
+		<cfoutput><Error number="#ARGUMENTS.number#" text="#htmleditformat(ARGUMENTS.text)#" /></cfoutput>
+	<cfelse>
+		<cfoutput><Error number="#ARGUMENTS.number#" /></cfoutput>
+	</cfif>
 </cffunction>
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf_commands.cfm
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf_commands.cfm	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf_commands.cfm	(revision 3825)
@@ -36,5 +36,5 @@
 	<cfset var sTempFilePath = "">
 	<cfset var errorNumber = 0>
-	<cfset var customMsg = 0>
+	<cfset var customMsg = "">
 	<cfset var counter = 0>
 	<cfset var destination = "">
@@ -227,4 +227,4 @@
 	</cfif>
 
-	<cfoutput><Error number="#errorNumber#" originalDescription="#HTMLEditFormat(sErrorMsg)#" /></cfoutput>
-</cffunction>
+	<cfoutput><Error number="#errorNumber#" /></cfoutput>
+</cffunction>
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf_io.cfm
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf_io.cfm	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf_io.cfm	(revision 3825)
@@ -194,6 +194,10 @@
 	<cfset sCurrentFolder = rereplace( sCurrentFolder, "//+", "/", "all" )>
 
-	<cfif find( "..", sCurrentFolder) or find( "\", sCurrentFolder) >
-		<cfset SendError( 102, "" )>
+	<cfif find( "..", sCurrentFolder) or find( "\", sCurrentFolder) or REFind('(/\.)|(//)|[[:cntrl:]]|([\\:\*\?\"<>])', sCurrentFolder)>
+		<cfif URL.Command eq "FileUpload" or URL.Command eq "QuickUpload">
+			<cfset SendUploadResults( 102, "", "", "") >
+		<cfelse>
+			<cfset SendError( 102, "" )>
+		</cfif>
 	</cfif>
 
@@ -266,4 +270,8 @@
 	<cfargument name="customMsg" required="false" type="String" default="">
 
+	<cfif errorNumber and errorNumber neq 201>
+		<cfset fileUrl = "">
+		<cfset fileName = "">
+	</cfif>
 	<!--- Minified version of the document.domain automatic fix script (#1919).
 	The original script can be found at _dev/domain_fix_template.js --->
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf_upload.cfm
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf_upload.cfm	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/cf_upload.cfm	(revision 3825)
@@ -25,5 +25,4 @@
 
 <cfparam name="url.type" default="File">
-<cfparam name="url.currentFolder" default="/">
 
 <!--- note: no serverPath url parameter - see config.cfm if you need to set the serverPath manually --->
@@ -37,5 +36,5 @@
 	<cfargument name="number" required="true" type="Numeric">
 	<cfargument name="text" required="true">
-	<cfreturn SendUploadResults( "#ARGUMENTS.number#", "", "", "ARGUMENTS.text" )>
+	<cfreturn SendUploadResults( "#ARGUMENTS.number#", "", "", "#ARGUMENTS.text#" )>
 </cffunction>
 
@@ -58,5 +57,5 @@
 </cfif>
 
-<cfset sCurrentFolder = GetCurrentFolder()>
+<cfset sCurrentFolder = "/">
 
 <!--- Is enabled the upload? --->
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/config.cfm
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/config.cfm	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/cfm/config.cfm	(revision 3825)
@@ -28,5 +28,4 @@
 	// SECURITY: You must explicitly enable this "connector". (Set enabled to "true")
 	Config.Enabled = false ;
-
 
 	// Path to uploaded files relative to the document root.
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/lasso/connector.lasso
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/lasso/connector.lasso	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/lasso/connector.lasso	(revision 3825)
@@ -39,6 +39,6 @@
     */
 	var(
-		'Command'		=	action_param('Command'),
-		'Type'			=	action_param('Type'),
+		'Command'		=	(Encode_HTML: action_param('Command')),
+		'Type'			=	(Encode_HTML: action_param('Type')),
 		'CurrentFolder'	=	action_param('CurrentFolder'),
 		'ServerPath'	=	action_param('ServerPath'),
@@ -71,43 +71,14 @@
 		$__html_reply__ = '\
 <script type="text/javascript">
-(function()
-{
-	var d = document.domain ;
-
-	while ( true )
-	{
-		// Test if we can access a parent property.
-		try
-		{
-			var test = window.top.opener.document.domain ;
-			break ;
-		}
-		catch( e ) {}
-
-		// Remove a domain part: www.mytest.example.com => mytest.example.com => example.com ...
-		d = d.replace( /.*?(?:\\.|$)/, "" ) ;
-
-		if ( d.length == 0 )
-			break ;		// It was not able to detect the domain.
-
-		try
-		{
-			document.domain = d ;
-		}
-		catch (e)
-		{
-			break ;
-		}
-	}
-})() ;
+(function(){var d=document.domain;while (true){try{var A=window.parent.document.domain;break;}catch(e) {};d=d.replace(/.*?(?:\\.|$)/,\'\');if (d.length==0) break;try{document.domain=d;}catch (e){break;}}})();
 ';
 			if($uploadResult == '0' || $uploadResult == '201');
 			$__html_reply__ = $__html_reply__ + '\
-	window.parent.OnUploadCompleted(' + $uploadResult + ',\'' + $NewFilePath + '\',\'' + $NewFilePath->split('/')->last + '\');
+	window.parent.OnUploadCompleted(' + $uploadResult + ',"' + $NewFilePath + '","' + $NewFilePath->split('/')->last + '");
 </script>
 			';
 			else;
 			$__html_reply__ = $__html_reply__ + '\
-	window.parent.OnUploadCompleted(' + $uploadResult + ');
+	window.parent.OnUploadCompleted(' + $uploadResult + ',"","");
 </script>
 			';
@@ -126,5 +97,18 @@
 	);
 
-	if($CurrentFolder->(Find: '..') || $CurrentFolder->(Find: '\\'));
+	$currentFolderURL = string_replace($currentFolderURL, -find='//', -replace='/');
+
+	if (!$config->find('Subdirectories')->find(action_param('Type')));
+		if($Command == 'FileUpload');
+			$responseType = 'html';
+			$uploadResult = '1';
+			fck_htmlreply(
+				-uploadResult=$uploadResult
+			);
+		else;
+			$errorNumber = 1;
+			$commandData += '<Error number="' + $errorNumber + '" text="Invalid type specified" />\n';
+		/if;
+	else if($CurrentFolder->(Find: '..') || (String_FindRegExp: $CurrentFolder, -Find='(/\\.)|(//)|[\\\\:\\*\\?\\""\\<\\>\\|]|\\000|[\u007F]|[\u0001-\u001F]'));
 		if($Command == 'FileUpload');
 			$responseType = 'html';
@@ -143,5 +127,6 @@
     entire process in an inline for file tag permissions.
     */
-	inline($connection);
+		if($config->find('Enabled'));
+		inline($connection);
 		select($Command);
             /*.............................................................
@@ -167,5 +152,11 @@
 						$folders += '\t\t<Folder name="' + #this->removetrailing('/')& + '" />\n';
 					else;
-						local('size') = file_getsize($currentFolderURL + #this) / 1024;
+						local('size') = file_getsize($currentFolderURL + #this);
+						if($size>0);
+							$size = $size/1024;
+							if ($size==0);
+								$size = 1;
+							/if;
+						/if;
 						$files += '\t\t<File name="' + #this + '" size="' + #size + '" />\n';
 					/if;
@@ -182,5 +173,5 @@
             */
 			case('CreateFolder');
-				$NewFolderName = (String_ReplaceRegExp: $NewFolderName, -find='\\.|\\\\|\\/|\\||\\:|\\?|\\*|"|<|>', -replace='_');
+				$NewFolderName = (String_ReplaceRegExp: $NewFolderName, -find='\\.|\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|\\000|[\u007F]|[\u0001-\u001F]', -replace='_');
 				var('newFolder' = $currentFolderURL + $NewFolderName + '/');
 				file_create($newFolder);
@@ -234,9 +225,10 @@
                     */
 					$NewFileName = $NewFile->find('OrigName');
-					$NewFileName = (String_ReplaceRegExp: $NewFileName, -find='\\\\|\\/|\\||\\:|\\?|\\*|"|<|>', -replace='_');
+					$NewFileName = (String_ReplaceRegExp: $NewFileName, -find='\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|\\000|[\u007F]|[\u0001-\u001F]', -replace='_');
+					$NewFileName = (String_ReplaceRegExp: $NewFileName, -find='\\.(?![^.]*$)', -replace='_');
 					$OrigFilePath = $currentFolderURL + $NewFileName;
 					$NewFilePath = $OrigFilePath;
 					local('fileExtension') = '.' + $NewFile->find('OrigExtension');
-					#fileExtension = (String_ReplaceRegExp: #fileExtension, -find='\\\\|\\/|\\||\\:|\\?|\\*|"|<|>', -replace='_');
+					#fileExtension = (String_ReplaceRegExp: #fileExtension, -find='\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|\\000|[\u007F]|[\u0001-\u001F]', -replace='_');
 					local('shortFileName') = $NewFileName->removetrailing(#fileExtension)&;
 
@@ -245,5 +237,9 @@
                     Make sure the file extension is allowed.
                     */
-					if($config->find('DeniedExtensions')->find($Type) >> $NewFile->find('OrigExtension'));
+					local('allowedExt') = $config->find('AllowedExtensions')->find($Type);
+					local('deniedExt') = $config->find('DeniedExtensions')->find($Type);
+					if($allowedExt->Size > 0 && $allowedExt !>> $NewFile->find('OrigExtension'));
+						$uploadResult = '202';
+					else($deniedExt->Size > 0 && $deniedExt >> $NewFile->find('OrigExtension'));
 						$uploadResult = '202';
 					else;
@@ -278,6 +274,13 @@
 					-NewFilePath=$NewFilePath
 				);
+			case;
+				$errorNumber = 1;
+				$commandData += '<Error number="' + $errorNumber + '" text="Command isn\'t allowed" />\n';
 		/select;
-	/inline;
+		/inline;
+		else;
+			$errorNumber = 1;
+			$commandData += '<Error number="' + $errorNumber + '" text="This file uploader is disabled. Please check the editor/filemanager/upload/lasso/config.lasso file." />\n';
+		/if;
 	/if;
 
@@ -310,9 +313,14 @@
 		*/
 		$__html_reply__ = '\
-<?xml version="1.0" encoding="utf-8" ?>
-<Connector command="' + $Command + '" resourceType="' + $Type + '">';
+<?xml version="1.0" encoding="utf-8" ?>';
 
 		if($errorNumber != '102');
-			$__html_reply__ += '<CurrentFolder path="' + $CurrentFolder + '" url="' + $currentFolderURL + '" />';
+			$__html_reply__ += '<Connector command="' + (Encode_HTML: $Command) + '" resourceType="' + (Encode_HTML: $Type) + '">';
+		else;
+			$__html_reply__ += '<Connector>';
+		/if;
+
+		if($errorNumber != '102');
+			$__html_reply__ += '<CurrentFolder path="' + (Encode_HTML: $CurrentFolder) + '" url="' + (Encode_HTML: $currentFolderURL) + '" />';
 		/if;
 
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/lasso/upload.lasso
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/lasso/upload.lasso	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/lasso/upload.lasso	(revision 3825)
@@ -33,6 +33,6 @@
     */
 	var(
-		'Type'			=	action_param('Type'),
-		'CurrentFolder'	=	action_param('CurrentFolder'),
+		'Type'			=	(Encode_HTML: action_param('Type')),
+		'CurrentFolder'	=	"/",
 		'ServerPath'	=	action_param('ServerPath'),
 		'NewFile'		=	null,
@@ -54,6 +54,8 @@
 	var('currentFolderURL' = $ServerPath
 		+ $config->find('Subdirectories')->find(action_param('Type'))
-		+ action_param('CurrentFolder')
+		+ $CurrentFolder
 	);
+
+	$currentFolderURL = string_replace($currentFolderURL, -find='//', -replace='/');
 
 	/*.....................................................................
@@ -85,12 +87,12 @@
 		$__html_reply__ = $__html_reply__ + '\
 	window.parent.OnUploadCompleted(' + #errorNumber + ',"'
-		+ string_replace(#fileUrl, -find='"', -replace='\\"') + '","'
-		+ string_replace(#fileName, -find='"', -replace='\\"') + '","'
-		+ string_replace(#customMsg, -find='"', -replace='\\"') + '");
+		+ string_replace((Encode_HTML: #fileUrl), -find='"', -replace='\\"') + '","'
+		+ string_replace((Encode_HTML: #fileUrl->split('/')->last), -find='"', -replace='\\"') + '","'
+		+ string_replace((Encode_HTML: #customMsg), -find='"', -replace='\\"') + '");
 </script>
 		';
 	/define_tag;
 
-	if($CurrentFolder->(Find: '..') || $CurrentFolder->(Find: '\\'));
+	if($CurrentFolder->(Find: '..') || (String_FindRegExp: $CurrentFolder, -Find='(/\\.)|(//)|[\\\\:\\*\\?\\""\\<\\>\\|]|\\000|[\u007F]|[\u0001-\u001F]'));
 		$errorNumber = 102;
 	/if;
@@ -115,4 +117,6 @@
 				*/
 				$NewFileName = $NewFile->find('OrigName');
+				$NewFileName = (String_ReplaceRegExp: $NewFileName, -find='\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|\\000|[\u007F]|[\u0001-\u001F]', -replace='_');
+				$NewFileName = (String_ReplaceRegExp: $NewFileName, -find='\\.(?![^.]*$)', -replace='_');
 				$OrigFilePath = $currentFolderURL + $NewFileName;
 				$NewFilePath = $OrigFilePath;
@@ -125,5 +129,9 @@
 				*/
 
-				if($config->find('DeniedExtensions')->find($Type) >> $NewFile->find('OrigExtension'));
+				local('allowedExt') = $config->find('AllowedExtensions')->find($Type);
+				local('deniedExt') = $config->find('DeniedExtensions')->find($Type);
+				if($allowedExt->Size > 0 && $allowedExt !>> $NewFile->find('OrigExtension'));
+					$errorNumber = 202;
+				else($deniedExt->Size > 0 && $deniedExt >> $NewFile->find('OrigExtension'));
 					$errorNumber = 202;
 				else;
@@ -154,4 +162,7 @@
 				/if;
 			/if;
+			if ($errorNumber != 0 && $errorNumber != 201);
+				$NewFilePath = "";
+			/if;
 		/inline;
 	else;
@@ -163,5 +174,4 @@
 		-errorNumber=$errorNumber,
 		-fileUrl=$NewFilePath,
-		-fileName=$NewFileName,
 		-customMsg=$customMsg
 	);
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/perl/basexml.pl
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/perl/basexml.pl	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/perl/basexml.pl	(revision 3825)
@@ -56,5 +56,10 @@
 	print '<?xml version="1.0" encoding="utf-8" ?>' ;
 
-	print '<Connector><Error number="' . $number . '" text="' . &specialchar_cnv( $text ) . '" /></Connector>' ;
+	if ($text) {
+		print '<Connector><Error number="' . $number . '" text="' . &specialchar_cnv( $text ) . '" /></Connector>' ;
+	}
+	else {
+		print '<Connector><Error number="' . $number . '" /></Connector>' ;
+	}
 
 	exit ;
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/perl/commands.pl
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/perl/commands.pl	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/perl/commands.pl	(revision 3825)
@@ -113,5 +113,5 @@
 	# Create the "Error" node.
 	$cnv_errmsg = &ConvertToXmlAttribute($sErrorMsg);
-	print '<Error number="' . $sErrorNumber . '" originalDescription="' . $cnv_errmsg . '" />';
+	print '<Error number="' . $sErrorNumber . '" />';
 }
 
@@ -121,4 +121,5 @@
 
 	local($resourceType, $currentFolder) = @_;
+	$allowedExtensions = $allowedExtensions{$resourceType};
 
 	$sErrorNumber = '0' ;
@@ -131,4 +132,16 @@
 		$sFileName = $new_fname;
 		$sFileName =~ s/\\|\/|\||\:|\?|\*|\"|<|>|[[:cntrl:]]/_/g;
+		$sFileName =~ s/\.(?![^.]*$)/_/g;
+
+		$ext = '';
+		if($sFileName =~ /([^\\\/]*)\.(.*)$/) {
+			$ext  = $2;
+		}
+
+		$allowedRegex = qr/^($allowedExtensions)$/i;
+		if (!($ext =~ $allowedRegex)) {
+			SendUploadResults('202', '', '', '');
+		}
+
 		$sOriginalFileName = $sFileName;
 
@@ -162,5 +175,5 @@
 	$sFileName	=~ s/"/\\"/g;
 
-	SendUploadResults($sErrorNumber, $resourceType.$currentFolder.$sFileName, $sFileName, '');
+	SendUploadResults($sErrorNumber, $GLOBALS{'UserFilesPath'}.$resourceType.$currentFolder.$sFileName, $sFileName, '');
 }
 
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/perl/config.pl
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/perl/config.pl	(revision 3825)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/perl/config.pl	(revision 3825)
@@ -0,0 +1,39 @@
+#####
+#  FCKeditor - The text editor for Internet - http://www.fckeditor.net
+#  Copyright (C) 2003-2009 Frederico Caldeira Knabben
+#
+#  == BEGIN LICENSE ==
+#
+#  Licensed under the terms of any of the following licenses at your
+#  choice:
+#
+#   - GNU General Public License Version 2 or later (the "GPL")
+#     http://www.gnu.org/licenses/gpl.html
+#
+#   - GNU Lesser General Public License Version 2.1 or later (the "LGPL")
+#     http://www.gnu.org/licenses/lgpl.html
+#
+#   - Mozilla Public License Version 1.1 or later (the "MPL")
+#     http://www.mozilla.org/MPL/MPL-1.1.html
+#
+#  == END LICENSE ==
+#
+#  This is the File Manager Connector for Perl.
+#####
+
+##
+# SECURITY: REMOVE/COMMENT THE FOLLOWING LINE TO ENABLE THIS CONNECTOR.
+##
+&SendError( 1, 'This connector is disabled. Please check the "editor/filemanager/connectors/perl/config.cgi" file' ) ;
+
+$GLOBALS{'UserFilesPath'} = '/userfiles/';
+
+# Map the "UserFiles" path to a local directory.
+$rootpath = &GetRootPath();
+$GLOBALS{'UserFilesDirectory'} = $rootpath . $GLOBALS{'UserFilesPath'};
+
+%allowedExtensions =  ("File", "7z|aiff|asf|avi|bmp|csv|doc|fla|flv|gif|gz|gzip|jpeg|jpg|mid|mov|mp3|mp4|mpc|mpeg|mpg|ods|odt|pdf|png|ppt|pxd|qt|ram|rar|rm|rmi|rmvb|rtf|sdc|sitd|swf|sxc|sxw|tar|tgz|tif|tiff|txt|vsd|wav|wma|wmv|xls|xml|zip",
+"Image", "bmp|gif|jpeg|jpg|png",
+"Flash", "swf|flv",
+"Media", "aiff|asf|avi|bmp|fla|flv|gif|jpeg|jpg|mid|mov|mp3|mp4|mpc|mpeg|mpg|png|qt|ram|rm|rmi|rmvb|swf|tif|tiff|wav|wma|wmv"
+);
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/perl/connector.cgi
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/perl/connector.cgi	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/perl/connector.cgi	(revision 3825)
@@ -25,5 +25,5 @@
 
 ##
-# ATTENTION: To enable this connector, look for the "SECURITY" comment in this file.
+# ATTENTION: To enable this connector, look for the "SECURITY" comment in config.pl.
 ##
 
@@ -59,26 +59,8 @@
 require 'commands.pl';
 require 'upload_fck.pl';
+require 'config.pl';
 
-##
-# SECURITY: REMOVE/COMMENT THE FOLLOWING LINE TO ENABLE THIS CONNECTOR.
-##
-	&SendError( 1, 'This connector is disabled. Please check the "editor/filemanager/connectors/perl/connector.cgi" file' ) ;
-
-	&read_input();
-
-	if($FORM{'ServerPath'} ne "") {
-		$GLOBALS{'UserFilesPath'} = $FORM{'ServerPath'};
-		if(!($GLOBALS{'UserFilesPath'} =~ /\/$/)) {
-			$GLOBALS{'UserFilesPath'} .= '/' ;
-		}
-	} else {
-		$GLOBALS{'UserFilesPath'} = '/userfiles/';
-	}
-
-	# Map the "UserFiles" path to a local directory.
-	$rootpath = &GetRootPath();
-	$GLOBALS{'UserFilesDirectory'} = $rootpath . $GLOBALS{'UserFilesPath'};
-
-	&DoResponse();
+&read_input();
+&DoResponse();
 
 sub DoResponse
@@ -89,7 +71,15 @@
 	}
 	# Get the main request informaiton.
-	$sCommand		= $FORM{'Command'};
-	$sResourceType	= $FORM{'Type'};
+	$sCommand		= &specialchar_cnv($FORM{'Command'});
+	$sResourceType	= &specialchar_cnv($FORM{'Type'});
 	$sCurrentFolder	= $FORM{'CurrentFolder'};
+
+	if ( !($sCommand =~ /^(FileUpload|GetFolders|GetFoldersAndFiles|CreateFolder)$/) ) {
+		SendError( 1, "Command not allowed" ) ;
+	}
+
+	if ( !($sResourceType =~ /^(File|Image|Flash|Media)$/) ) {
+		SendError( 1, "Invalid type specified" ) ;
+	}
 
 	# Check the current folder syntax (must begin and start with a slash).
@@ -103,4 +93,7 @@
 	# Check for invalid folder paths (..)
 	if ( $sCurrentFolder =~ /(?:\.\.|\\)/ ) {
+		SendError( 102, "" ) ;
+	}
+	if ( $sCurrentFolder =~ /(\/\.)|[[:cntrl:]]|(\/\/)|(\\\\)|([\:\*\?\"\<\>\|])/ ) {
 		SendError( 102, "" ) ;
 	}
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/perl/io.pl
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/perl/io.pl	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/perl/io.pl	(revision 3825)
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/perl/upload.cgi
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/perl/upload.cgi	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/perl/upload.cgi	(revision 3825)
@@ -25,5 +25,5 @@
 
 ##
-# ATTENTION: To enable this connector, look for the "SECURITY" comment in this file.
+# ATTENTION: To enable this connector, look for the "SECURITY" comment in config.pl.
 ##
 
@@ -59,52 +59,22 @@
 require 'commands.pl';
 require 'upload_fck.pl';
+require 'config.pl';
 
-##
-# SECURITY: REMOVE/COMMENT THE FOLLOWING LINE TO ENABLE THIS CONNECTOR.
-##
-	&SendUploadResults(1, '', '', 'This connector is disabled. Please check the "editor/filemanager/connectors/perl/upload.cgi" file' ) ;
-
-	&read_input();
-
-	if($FORM{'ServerPath'} ne "") {
-		$GLOBALS{'UserFilesPath'} = $FORM{'ServerPath'};
-		if(!($GLOBALS{'UserFilesPath'} =~ /\/$/)) {
-			$GLOBALS{'UserFilesPath'} .= '/' ;
-		}
-	} else {
-		$GLOBALS{'UserFilesPath'} = '/userfiles/';
-	}
-
-	# Map the "UserFiles" path to a local directory.
-	$rootpath = &GetRootPath();
-	$GLOBALS{'UserFilesDirectory'} = $rootpath . $GLOBALS{'UserFilesPath'};
-
-	&DoResponse();
+&read_input();
+&DoResponse();
 
 sub DoResponse
 {
 	# Get the main request information.
-	$sCommand		= 'FileUpload'; #$FORM{'Command'};
-	$sResourceType	= $FORM{'Type'};
-	$sCurrentFolder	= $FORM{'CurrentFolder'};
+	$sCommand		= 'FileUpload';
+	$sResourceType	= &specialchar_cnv($FORM{'Type'});
+	$sCurrentFolder	= "/";
 
 	if ($sResourceType eq '') {
 		$sResourceType = 'File' ;
 	}
-	if ($sCurrentFolder eq '') {
-		$sCurrentFolder = '/' ;
-	}
 
-	# Check the current folder syntax (must begin and start with a slash).
-	if(!($sCurrentFolder =~ /\/$/)) {
-		$sCurrentFolder .= '/';
-	}
-	if(!($sCurrentFolder =~ /^\//)) {
-		$sCurrentFolder = '/' . $sCurrentFolder;
-	}
-
-	# Check for invalid folder paths (..)
-	if ( $sCurrentFolder =~ /(?:\.\.|\\)/ ) {
-		SendError( 102, "" ) ;
+	if ( !($sResourceType =~ /^(File|Image|Flash|Media)$/) ) {
+		SendError( 1, "Invalid type specified" ) ;
 	}
 
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/perl/upload_fck.pl
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/perl/upload_fck.pl	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/perl/upload_fck.pl	(revision 3825)
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/perl/util.pl
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/perl/util.pl	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/perl/util.pl	(revision 3825)
@@ -41,7 +41,5 @@
 {
 	local($value) = @_;
-	return $value;
-#	return utf8_encode(htmlspecialchars($value));
-
+	return(&specialchar_cnv($value));
 }
 
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/php/basexml.php
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/php/basexml.php	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/php/basexml.php	(revision 3825)
@@ -66,4 +66,7 @@
 function SendError( $number, $text )
 {
+	if ( $_GET['Command'] == 'FileUpload' )
+		SendUploadResults( $number, "", "", $text ) ;
+
 	if ( isset( $GLOBALS['HeaderSent'] ) && $GLOBALS['HeaderSent'] )
 	{
@@ -89,5 +92,8 @@
 function SendErrorNode(  $number, $text )
 {
-	echo '<Error number="' . $number . '" text="' . htmlspecialchars( $text ) . '" />' ;
+	if ($text)
+		echo '<Error number="' . $number . '" text="' . htmlspecialchars( $text ) . '" />' ;
+	else
+		echo '<Error number="' . $number . '" />' ;
 }
 ?>
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/php/commands.php
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/php/commands.php	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/php/commands.php	(revision 3825)
@@ -31,13 +31,15 @@
 	$aFolders	= array() ;
 
-	$oCurrentFolder = opendir( $sServerDir ) ;
-
-	while ( $sFile = readdir( $oCurrentFolder ) )
-	{
-		if ( $sFile != '.' && $sFile != '..' && is_dir( $sServerDir . $sFile ) )
-			$aFolders[] = '<Folder name="' . ConvertToXmlAttribute( $sFile ) . '" />' ;
-	}
-
-	closedir( $oCurrentFolder ) ;
+	$oCurrentFolder = @opendir( $sServerDir ) ;
+
+	if ($oCurrentFolder !== false)
+	{
+		while ( $sFile = readdir( $oCurrentFolder ) )
+		{
+			if ( $sFile != '.' && $sFile != '..' && is_dir( $sServerDir . $sFile ) )
+				$aFolders[] = '<Folder name="' . ConvertToXmlAttribute( $sFile ) . '" />' ;
+		}
+		closedir( $oCurrentFolder ) ;
+	}
 
 	// Open the "Folders" node.
@@ -61,27 +63,32 @@
 	$aFiles		= array() ;
 
-	$oCurrentFolder = opendir( $sServerDir ) ;
-
-	while ( $sFile = readdir( $oCurrentFolder ) )
-	{
-		if ( $sFile != '.' && $sFile != '..' )
-		{
-			if ( is_dir( $sServerDir . $sFile ) )
-				$aFolders[] = '<Folder name="' . ConvertToXmlAttribute( $sFile ) . '" />' ;
-			else
-			{
-				$iFileSize = @filesize( $sServerDir . $sFile ) ;
-				if ( !$iFileSize ) {
-					$iFileSize = 0 ;
-				}
-				if ( $iFileSize > 0 )
-				{
-					$iFileSize = round( $iFileSize / 1024 ) ;
-					if ( $iFileSize < 1 ) $iFileSize = 1 ;
-				}
-
-				$aFiles[] = '<File name="' . ConvertToXmlAttribute( $sFile ) . '" size="' . $iFileSize . '" />' ;
-			}
-		}
+	$oCurrentFolder = @opendir( $sServerDir ) ;
+
+	if ($oCurrentFolder !== false)
+	{
+		while ( $sFile = readdir( $oCurrentFolder ) )
+		{
+			if ( $sFile != '.' && $sFile != '..' )
+			{
+				if ( is_dir( $sServerDir . $sFile ) )
+					$aFolders[] = '<Folder name="' . ConvertToXmlAttribute( $sFile ) . '" />' ;
+				else
+				{
+					$iFileSize = @filesize( $sServerDir . $sFile ) ;
+					if ( !$iFileSize ) {
+						$iFileSize = 0 ;
+					}
+					if ( $iFileSize > 0 )
+					{
+						$iFileSize = round( $iFileSize / 1024 ) ;
+						if ( $iFileSize < 1 )
+							$iFileSize = 1 ;
+					}
+
+					$aFiles[] = '<File name="' . ConvertToXmlAttribute( $sFile ) . '" size="' . $iFileSize . '" />' ;
+				}
+			}
+		}
+		closedir( $oCurrentFolder ) ;
 	}
 
@@ -153,5 +160,5 @@
 
 	// Create the "Error" node.
-	echo '<Error number="' . $sErrorNumber . '" originalDescription="' . ConvertToXmlAttribute( $sErrorMsg ) . '" />' ;
+	echo '<Error number="' . $sErrorNumber . '" />' ;
 }
 
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/php/config.php
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/php/config.php	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/php/config.php	(revision 3825)
@@ -29,5 +29,4 @@
 //		authenticated users can access this file or use some kind of session checking.
 $Config['Enabled'] = false ;
-
 
 // Path to user files relative to the document root.
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/php/io.php
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/php/io.php	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/php/io.php	(revision 3825)
@@ -246,4 +246,7 @@
 		SendError( 102, '' ) ;
 
+	if ( preg_match(",(/\.)|[[:cntrl:]]|(//)|(\\\\)|([\:\*\?\"\<\>\|]),", $sCurrentFolder))
+		SendError( 102, '' ) ;
+
 	return $sCurrentFolder ;
 }
@@ -287,4 +290,9 @@
 EOF;
 
+	if ($errorNumber && $errorNumber != 201) {
+		$fileUrl = "";
+		$fileName = "";
+	}
+
 	$rpl = array( '\\' => '\\\\', '"' => '\\"' ) ;
 	echo 'window.parent.OnUploadCompleted(' . $errorNumber . ',"' . strtr( $fileUrl, $rpl ) . '","' . strtr( $fileName, $rpl ) . '", "' . strtr( $customMsg, $rpl ) . '") ;' ;
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/php/upload.php
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/php/upload.php	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/php/upload.php	(revision 3825)
@@ -44,5 +44,5 @@
 $sType = isset( $_GET['Type'] ) ? $_GET['Type'] : 'File' ;
 
-$sCurrentFolder	= GetCurrentFolder() ;
+$sCurrentFolder	= "/" ;
 
 // Is enabled the upload?
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/py/connector.py
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/py/connector.py	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/py/connector.py	(revision 3825)
@@ -57,5 +57,8 @@
 		# Check for invalid paths
 		if currentFolder is None:
-			return self.sendError(102, "")
+			if (command == "FileUpload"):
+				return self.sendUploadResults( errorNo = 102, customMsg = "" )
+			else:
+				return self.sendError(102, "")
 
 		# Check if it is an allowed command
@@ -80,5 +83,5 @@
 		if not os.path.exists(self.userFilesFolder):
 			try:
-				self.createServerFoldercreateServerFolder( self.userFilesFolder )
+				self.createServerFolder( self.userFilesFolder )
 			except:
 				return self.sendError(1, "This connector couldn\'t access to local user\'s files directories.  Please check the UserFilesAbsolutePath in \"editor/filemanager/connectors/py/config.py\" and try again. ")
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/py/fckcommands.py
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/py/fckcommands.py	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/py/fckcommands.py	(revision 3825)
@@ -72,7 +72,11 @@
 			elif os.path.isfile(someObjectPath):
 				size = os.path.getsize(someObjectPath)
-				files += """<File name="%s" size="%s" />""" % (
+				if size > 0:
+					size = round(size/1024)
+					if size < 1:
+						size = 1
+				files += """<File name="%s" size="%d" />""" % (
 						convertToXmlAttribute(someObject),
-						os.path.getsize(someObjectPath)
+						size
 						)
 		# Close the folders / files node
@@ -164,5 +168,5 @@
 					if os.path.exists(newFilePath):
 						i += 1
-						newFileName = "%s(%04d).%s" % (
+						newFileName = "%s(%d).%s" % (
 								newFileNameOnly, i, newFileExtension
 								)
@@ -190,9 +194,9 @@
 								os.umask( oldumask )
 
-						newFileUrl = self.webUserFilesFolder + currentFolder + newFileName
+						newFileUrl = combinePaths(self.webUserFilesFolder, currentFolder) + newFileName
 
 						return self.sendUploadResults( errorNo , newFileUrl, newFileName )
 			else:
-				return self.sendUploadResults( errorNo = 203, customMsg = "Extension not allowed" )
+				return self.sendUploadResults( errorNo = 202, customMsg = "" )
 		else:
 			return self.sendUploadResults( errorNo = 202, customMsg = "No File" )
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/py/fckoutput.py
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/py/fckoutput.py	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/py/fckoutput.py	(revision 3825)
@@ -96,5 +96,8 @@
 
 	def sendErrorNode(self, number, text):
-		return """<Error number="%s" text="%s" />""" % (number, convertToXmlAttribute(text))
+		if number != 1:
+			return """<Error number="%s" />""" % (number)
+		else:
+			return """<Error number="%s" text="%s" />""" % (number, convertToXmlAttribute(text))
 
 class BaseHtmlMixin(object):
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/py/fckutil.py
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/py/fckutil.py	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/py/fckutil.py	(revision 3825)
@@ -63,5 +63,5 @@
 	"Do a cleanup of the folder name to avoid possible problems"
 	# Remove . \ / | : ? * " < > and control characters
-	return re.sub( '(?u)\\.|\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|[^\u0000-\u001f\u007f-\u009f]', '_', newFolderName )
+	return re.sub( '\\.|\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|[\x00-\x1f\x7f-\x9f]', '_', newFolderName )
 
 def sanitizeFileName( newFileName ):
@@ -69,9 +69,9 @@
 	# Replace dots in the name with underscores (only one dot can be there... security issue).
 	if ( Config.ForceSingleExtension ): # remove dots
-		newFileName = re.sub ( '/\\.(?![^.]*$)/', '_', newFileName ) ;
+		newFileName = re.sub ( '\\.(?![^.]*$)', '_', newFileName ) ;
 	newFileName = newFileName.replace('\\','/')		# convert windows to unix path
 	newFileName = os.path.basename (newFileName)	# strip directories
 	# Remove \ / | : ? *
-	return re.sub ( '(?u)/\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|[^\u0000-\u001f\u007f-\u009f]/', '_', newFileName )
+	return re.sub ( '\\\\|\\/|\\||\\:|\\?|\\*|"|<|>|[\x00-\x1f\x7f-\x9f]/', '_', newFileName )
 
 def getCurrentFolder(currentFolder):
@@ -91,4 +91,8 @@
 	# Check for invalid folder paths (..)
 	if '..' in currentFolder or '\\' in currentFolder:
+		return None
+
+	# Check for invalid folder paths (..)
+	if re.search( '(/\\.)|(//)|([\\\\:\\*\\?\\""\\<\\>\\|]|[\x00-\x1F]|[\x7f-\x9f])', currentFolder ):
 		return None
 
Index: /FCKeditor/releases/stable/editor/filemanager/connectors/py/upload.py
===================================================================
--- /FCKeditor/releases/stable/editor/filemanager/connectors/py/upload.py	(revision 3824)
+++ /FCKeditor/releases/stable/editor/filemanager/connectors/py/upload.py	(revision 3825)
@@ -42,5 +42,5 @@
 		# The file type (from the QueryString, by default 'File').
 		resourceType  = self.request.get('Type','File')
-		currentFolder = getCurrentFolder(self.request.get("CurrentFolder",""))
+		currentFolder = "/"
 		# Check for invalid paths
 		if currentFolder is None:
Index: /FCKeditor/releases/stable/editor/js/fckeditorcode_gecko.js
===================================================================
--- /FCKeditor/releases/stable/editor/js/fckeditorcode_gecko.js	(revision 3824)
+++ /FCKeditor/releases/stable/editor/js/fckeditorcode_gecko.js	(revision 3825)
@@ -36,5 +36,5 @@
 var FCKTools={};FCKTools.CreateBogusBR=function(A){var B=A.createElement('br');B.setAttribute('type','_moz');return B;};FCKTools.FixCssUrls=function(A,B){if (!A||A.length==0) return B;return B.replace(/url\s*\(([\s'"]*)(.*?)([\s"']*)\)/g,function(match,opener,path,closer){if (/^\/|^\w?:/.test(path)) return match;else return 'url('+opener+A+path+closer+')';});};FCKTools._GetUrlFixedCss=function(A,B){var C=A.match(/^([^|]+)\|([\s\S]*)/);if (C) return FCKTools.FixCssUrls(C[1],C[2]);else return A;};FCKTools.AppendStyleSheet=function(A,B){if (!B) return [];if (typeof(B)=='string'){if (/[\\\/\.][^{}]*$/.test(B)){return this.AppendStyleSheet(A,B.split(','));}else return [this.AppendStyleString(A,FCKTools._GetUrlFixedCss(B))];}else{var C=[];for (var i=0;i<B.length;i++) C.push(this._AppendStyleSheet(A,B[i]));return C;}};FCKTools.GetStyleHtml=(function(){var A=function(styleDef,markTemp){if (styleDef.length==0) return '';var B=markTemp?' _fcktemp="true"':'';return '<style type="text/css"'+B+'>'+styleDef+'</style>';};var C=function(cssFileUrl,markTemp){if (cssFileUrl.length==0) return '';var B=markTemp?' _fcktemp="true"':'';return '<link href="'+cssFileUrl+'" type="text/css" rel="stylesheet" '+B+'/>';};return function(cssFileOrArrayOrDef,markTemp){if (!cssFileOrArrayOrDef) return '';if (typeof(cssFileOrArrayOrDef)=='string'){if (/[\\\/\.][^{}]*$/.test(cssFileOrArrayOrDef)){return this.GetStyleHtml(cssFileOrArrayOrDef.split(','),markTemp);}else return A(this._GetUrlFixedCss(cssFileOrArrayOrDef),markTemp);}else{var E='';for (var i=0;i<cssFileOrArrayOrDef.length;i++) E+=C(cssFileOrArrayOrDef[i],markTemp);return E;}}})();FCKTools.GetElementDocument=function (A){return A.ownerDocument||A.document;};FCKTools.GetElementWindow=function(A){return this.GetDocumentWindow(this.GetElementDocument(A));};FCKTools.GetDocumentWindow=function(A){if (FCKBrowserInfo.IsSafari&&!A.parentWindow) this.FixDocumentParentWindow(window.top);return A.parentWindow||A.defaultView;};FCKTools.FixDocumentParentWindow=function(A){if (A.document) A.document.parentWindow=A;for (var i=0;i<A.frames.length;i++) FCKTools.FixDocumentParentWindow(A.frames[i]);};FCKTools.HTMLEncode=function(A){if (!A) return '';A=A.replace(/&/g,'&amp;');A=A.replace(/</g,'&lt;');A=A.replace(/>/g,'&gt;');return A;};FCKTools.HTMLDecode=function(A){if (!A) return '';A=A.replace(/&gt;/g,'>');A=A.replace(/&lt;/g,'<');A=A.replace(/&amp;/g,'&');return A;};FCKTools._ProcessLineBreaksForPMode=function(A,B,C,D,E){var F=0;var G="<p>";var H="</p>";var I="<br />";if (C){G="<li>";H="</li>";F=1;}while (D&&D!=A.FCK.EditorDocument.body){if (D.tagName.toLowerCase()=='p'){F=1;break;};D=D.parentNode;};for (var i=0;i<B.length;i++){var c=B.charAt(i);if (c=='\r') continue;if (c!='\n'){E.push(c);continue;};var n=B.charAt(i+1);if (n=='\r'){i++;n=B.charAt(i+1);};if (n=='\n'){i++;if (F) E.push(H);E.push(G);F=1;}else E.push(I);}};FCKTools._ProcessLineBreaksForDivMode=function(A,B,C,D,E){var F=0;var G="<div>";var H="</div>";if (C){G="<li>";H="</li>";F=1;}while (D&&D!=A.FCK.EditorDocument.body){if (D.tagName.toLowerCase()=='div'){F=1;break;};D=D.parentNode;};for (var i=0;i<B.length;i++){var c=B.charAt(i);if (c=='\r') continue;if (c!='\n'){E.push(c);continue;};if (F){if (E[E.length-1]==G){E.push("&nbsp;");};E.push(H);};E.push(G);F=1;};if (F) E.push(H);};FCKTools._ProcessLineBreaksForBrMode=function(A,B,C,D,E){var F=0;var G="<br />";var H="";if (C){G="<li>";H="</li>";F=1;};for (var i=0;i<B.length;i++){var c=B.charAt(i);if (c=='\r') continue;if (c!='\n'){E.push(c);continue;};if (F&&H.length) E.push (H);E.push(G);F=1;}};FCKTools.ProcessLineBreaks=function(A,B,C){var D=B.EnterMode.toLowerCase();var E=[];var F=0;var G=new A.FCKDomRange(A.FCK.EditorWindow);G.MoveToSelection();var H=G._Range.startContainer;while (H&&H.nodeType!=1) H=H.parentNode;if (H&&H.tagName.toLowerCase()=='li') F=1;if (D=='p') this._ProcessLineBreaksForPMode(A,C,F,H,E);else if (D=='div') this._ProcessLineBreaksForDivMode(A,C,F,H,E);else if (D=='br') this._ProcessLineBreaksForBrMode(A,C,F,H,E);return E.join("");};FCKTools.AddSelectOption=function(A,B,C){var D=FCKTools.GetElementDocument(A).createElement("OPTION");D.text=B;D.value=C;A.options.add(D);return D;};FCKTools.RunFunction=function(A,B,C,D){if (A) this.SetTimeout(A,0,B,C,D);};FCKTools.SetTimeout=function(A,B,C,D,E){return (E||window).setTimeout(function(){if (D) A.apply(C,[].concat(D));else A.apply(C);},B);};FCKTools.SetInterval=function(A,B,C,D,E){return (E||window).setInterval(function(){A.apply(C,D||[]);},B);};FCKTools.ConvertStyleSizeToHtml=function(A){return A.EndsWith('%')?A:parseInt(A,10);};FCKTools.ConvertHtmlSizeToStyle=function(A){return A.EndsWith('%')?A:(A+'px');};FCKTools.GetElementAscensor=function(A,B){var e=A;var C=","+B.toUpperCase()+",";while (e){if (C.indexOf(","+e.nodeName.toUpperCase()+",")!=-1) return e;e=e.parentNode;};return null;};FCKTools.CreateEventListener=function(A,B){var f=function(){var C=[];for (var i=0;i<arguments.length;i++) C.push(arguments[i]);A.apply(this,C.concat(B));};return f;};FCKTools.IsStrictMode=function(A){return ('CSS1Compat'==(A.compatMode||(FCKBrowserInfo.IsSafari?'CSS1Compat':null)));};FCKTools.ArgumentsToArray=function(A,B,C){B=B||0;C=C||A.length;var D=[];for (var i=B;i<B+C&&i<A.length;i++) D.push(A[i]);return D;};FCKTools.CloneObject=function(A){var B=function() {};B.prototype=A;return new B;};FCKTools.AppendBogusBr=function(A){if (!A) return;var B=this.GetLastItem(A.getElementsByTagName('br'));if (!B||(B.getAttribute('type',2)!='_moz'&&B.getAttribute('_moz_dirty')==null)){var C=this.GetElementDocument(A);if (FCKBrowserInfo.IsOpera) A.appendChild(C.createTextNode(''));else A.appendChild(this.CreateBogusBR(C));}};FCKTools.GetLastItem=function(A){if (A.length>0) return A[A.length-1];return null;};FCKTools.GetDocumentPosition=function(w,A){var x=0;var y=0;var B=A;var C=null;var D=FCKTools.GetElementWindow(B);while (B&&!(D==w&&(B==w.document.body||B==w.document.documentElement))){x+=B.offsetLeft-B.scrollLeft;y+=B.offsetTop-B.scrollTop;if (!FCKBrowserInfo.IsOpera){var E=C;while (E&&E!=B){x-=E.scrollLeft;y-=E.scrollTop;E=E.parentNode;}};C=B;if (B.offsetParent) B=B.offsetParent;else{if (D!=w){B=D.frameElement;C=null;if (B) D=B.contentWindow.parent;}else B=null;}};if (FCKDomTools.GetCurrentElementStyle(w.document.body,'position')!='static'||(FCKBrowserInfo.IsIE&&FCKDomTools.GetPositionedAncestor(A)==null)){x+=w.document.body.offsetLeft;y+=w.document.body.offsetTop;};return { "x":x,"y":y };};FCKTools.GetWindowPosition=function(w,A){var B=this.GetDocumentPosition(w,A);var C=FCKTools.GetScrollPosition(w);B.x-=C.X;B.y-=C.Y;return B;};FCKTools.ProtectFormStyles=function(A){if (!A||A.nodeType!=1||A.tagName.toLowerCase()!='form') return [];var B=[];var C=['style','className'];for (var i=0;i<C.length;i++){var D=C[i];if (A.elements.namedItem(D)){var E=A.elements.namedItem(D);B.push([E,E.nextSibling]);A.removeChild(E);}};return B;};FCKTools.RestoreFormStyles=function(A,B){if (!A||A.nodeType!=1||A.tagName.toLowerCase()!='form') return;if (B.length>0){for (var i=B.length-1;i>=0;i--){var C=B[i][0];var D=B[i][1];if (D) A.insertBefore(C,D);else A.appendChild(C);}}};FCKTools.GetNextNode=function(A,B){if (A.firstChild) return A.firstChild;else if (A.nextSibling) return A.nextSibling;else{var C=A.parentNode;while (C){if (C==B) return null;if (C.nextSibling) return C.nextSibling;else C=C.parentNode;}};return null;};FCKTools.GetNextTextNode=function(A,B,C){node=this.GetNextNode(A,B);if (C&&node&&C(node)) return null;while (node&&node.nodeType!=3){node=this.GetNextNode(node,B);if (C&&node&&C(node)) return null;};return node;};FCKTools.Merge=function(){var A=arguments;var o=A[0];for (var i=1;i<A.length;i++){var B=A[i];for (var p in B) o[p]=B[p];};return o;};FCKTools.IsArray=function(A){return (A instanceof Array);};FCKTools.AppendLengthProperty=function(A,B){var C=0;for (var n in A) C++;return A[B||'length']=C;};FCKTools.NormalizeCssText=function(A){var B=document.createElement('span');B.style.cssText=A;return B.style.cssText;};FCKTools.Bind=function(A,B){return function(){ return B.apply(A,arguments);};};FCKTools.GetVoidUrl=function(){if (FCK_IS_CUSTOM_DOMAIN) return "javascript: void( function(){document.open();document.write('<html><head><title></title></head><body></body></html>');document.domain = '"+FCK_RUNTIME_DOMAIN+"';document.close();}() ) ;";if (FCKBrowserInfo.IsIE){if (FCKBrowserInfo.IsIE7||!FCKBrowserInfo.IsIE6) return "";else return "javascript: '';";};return "javascript: void(0);";};FCKTools.ResetStyles=function(A){A.style.cssText='margin:0;padding:0;border:0;background-color:transparent;background-image:none;';};
 FCKTools.CancelEvent=function(e){if (e) e.preventDefault();};FCKTools.DisableSelection=function(A){if (FCKBrowserInfo.IsGecko) A.style.MozUserSelect='none';else if (FCKBrowserInfo.IsSafari) A.style.KhtmlUserSelect='none';else A.style.userSelect='none';};FCKTools._AppendStyleSheet=function(A,B){var e=A.createElement('LINK');e.rel='stylesheet';e.type='text/css';e.href=B;A.getElementsByTagName("HEAD")[0].appendChild(e);return e;};FCKTools.AppendStyleString=function(A,B){if (!B) return null;var e=A.createElement("STYLE");e.appendChild(A.createTextNode(B));A.getElementsByTagName("HEAD")[0].appendChild(e);return e;};FCKTools.ClearElementAttributes=function(A){for (var i=0;i<A.attributes.length;i++){A.removeAttribute(A.attributes[i].name,0);}};FCKTools.GetAllChildrenIds=function(A){var B=[];var C=function(parent){for (var i=0;i<parent.childNodes.length;i++){var D=parent.childNodes[i].id;if (D&&D.length>0) B[B.length]=D;C(parent.childNodes[i]);}};C(A);return B;};FCKTools.RemoveOuterTags=function(e){var A=e.ownerDocument.createDocumentFragment();for (var i=0;i<e.childNodes.length;i++) A.appendChild(e.childNodes[i].cloneNode(true));e.parentNode.replaceChild(A,e);};FCKTools.CreateXmlObject=function(A){switch (A){case 'XmlHttp':return new XMLHttpRequest();case 'DOMDocument':var B=(new DOMParser()).parseFromString('<tmp></tmp>','text/xml');FCKDomTools.RemoveNode(B.firstChild);return B;};return null;};FCKTools.GetScrollPosition=function(A){return { X:A.pageXOffset,Y:A.pageYOffset };};FCKTools.AddEventListener=function(A,B,C){A.addEventListener(B,C,false);};FCKTools.RemoveEventListener=function(A,B,C){A.removeEventListener(B,C,false);};FCKTools.AddEventListenerEx=function(A,B,C,D){A.addEventListener(B,function(e){C.apply(A,[e].concat(D||[]));},false);};FCKTools.GetViewPaneSize=function(A){return { Width:A.innerWidth,Height:A.innerHeight };};FCKTools.SaveStyles=function(A){var B=FCKTools.ProtectFormStyles(A);var C={};if (A.className.length>0){C.Class=A.className;A.className='';};var D=A.getAttribute('style');if (D&&D.length>0){C.Inline=D;A.setAttribute('style','',0);};FCKTools.RestoreFormStyles(A,B);return C;};FCKTools.RestoreStyles=function(A,B){var C=FCKTools.ProtectFormStyles(A);A.className=B.Class||'';if (B.Inline) A.setAttribute('style',B.Inline,0);else A.removeAttribute('style',0);FCKTools.RestoreFormStyles(A,C);};FCKTools.RegisterDollarFunction=function(A){A.$=function(id){return A.document.getElementById(id);};};FCKTools.AppendElement=function(A,B){return A.appendChild(A.ownerDocument.createElement(B));};FCKTools.GetElementPosition=function(A,B){var c={ X:0,Y:0 };var C=B||window;var D=FCKTools.GetElementWindow(A);var E=null;while (A){var F=D.getComputedStyle(A,'').position;if (F&&F!='static'&&A.style.zIndex!=FCKConfig.FloatingPanelsZIndex) break;c.X+=A.offsetLeft-A.scrollLeft;c.Y+=A.offsetTop-A.scrollTop;if (!FCKBrowserInfo.IsOpera){var G=E;while (G&&G!=A){c.X-=G.scrollLeft;c.Y-=G.scrollTop;G=G.parentNode;}};E=A;if (A.offsetParent) A=A.offsetParent;else{if (D!=C){A=D.frameElement;E=null;if (A) D=FCKTools.GetElementWindow(A);}else{c.X+=A.scrollLeft;c.Y+=A.scrollTop;break;}}};return c;};
-var FCKeditorAPI;function InitializeAPI(){var A=window.parent;if (!(FCKeditorAPI=A.FCKeditorAPI)){var B='window.FCKeditorAPI = {Version : "2.6.4",VersionBuild : "21629",Instances : window.FCKeditorAPI && window.FCKeditorAPI.Instances || {},GetInstance : function( name ){return this.Instances[ name ];},_FormSubmit : function(){for ( var name in FCKeditorAPI.Instances ){var oEditor = FCKeditorAPI.Instances[ name ] ;if ( oEditor.GetParentForm && oEditor.GetParentForm() == this )oEditor.UpdateLinkedField() ;}this._FCKOriginalSubmit() ;},_FunctionQueue	: window.FCKeditorAPI && window.FCKeditorAPI._FunctionQueue || {Functions : new Array(),IsRunning : false,Add : function( f ){this.Functions.push( f );if ( !this.IsRunning )this.StartNext();},StartNext : function(){var aQueue = this.Functions ;if ( aQueue.length > 0 ){this.IsRunning = true;aQueue[0].call();}else this.IsRunning = false;},Remove : function( f ){var aQueue = this.Functions;var i = 0, fFunc;while( (fFunc = aQueue[ i ]) ){if ( fFunc == f )aQueue.splice( i,1 );i++ ;}this.StartNext();}}}';if (A.execScript) A.execScript(B,'JavaScript');else{if (FCKBrowserInfo.IsGecko10){eval.call(A,B);}else if(FCKBrowserInfo.IsAIR){FCKAdobeAIR.FCKeditorAPI_Evaluate(A,B);}else if (FCKBrowserInfo.IsSafari){var C=A.document;var D=C.createElement('script');D.appendChild(C.createTextNode(B));C.documentElement.appendChild(D);}else A.eval(B);};FCKeditorAPI=A.FCKeditorAPI;FCKeditorAPI.__Instances=FCKeditorAPI.Instances;};FCKeditorAPI.Instances[FCK.Name]=FCK;};function _AttachFormSubmitToAPI(){var A=FCK.GetParentForm();if (A){FCKTools.AddEventListener(A,'submit',FCK.UpdateLinkedField);if (!A._FCKOriginalSubmit&&(typeof(A.submit)=='function'||(!A.submit.tagName&&!A.submit.length))){A._FCKOriginalSubmit=A.submit;A.submit=FCKeditorAPI._FormSubmit;}}};function FCKeditorAPI_Cleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat&&!window.FCKUnloadFlag) return;delete FCKeditorAPI.Instances[FCK.Name];};function FCKeditorAPI_ConfirmCleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat) window.FCKUnloadFlag=true;};FCKTools.AddEventListener(window,'unload',FCKeditorAPI_Cleanup);FCKTools.AddEventListener(window,'beforeunload',FCKeditorAPI_ConfirmCleanup);
+var FCKeditorAPI;function InitializeAPI(){var A=window.parent;if (!(FCKeditorAPI=A.FCKeditorAPI)){var B='window.FCKeditorAPI = {Version : "2.6.4.1",VersionBuild : "23187",Instances : window.FCKeditorAPI && window.FCKeditorAPI.Instances || {},GetInstance : function( name ){return this.Instances[ name ];},_FormSubmit : function(){for ( var name in FCKeditorAPI.Instances ){var oEditor = FCKeditorAPI.Instances[ name ] ;if ( oEditor.GetParentForm && oEditor.GetParentForm() == this )oEditor.UpdateLinkedField() ;}this._FCKOriginalSubmit() ;},_FunctionQueue	: window.FCKeditorAPI && window.FCKeditorAPI._FunctionQueue || {Functions : new Array(),IsRunning : false,Add : function( f ){this.Functions.push( f );if ( !this.IsRunning )this.StartNext();},StartNext : function(){var aQueue = this.Functions ;if ( aQueue.length > 0 ){this.IsRunning = true;aQueue[0].call();}else this.IsRunning = false;},Remove : function( f ){var aQueue = this.Functions;var i = 0, fFunc;while( (fFunc = aQueue[ i ]) ){if ( fFunc == f )aQueue.splice( i,1 );i++ ;}this.StartNext();}}}';if (A.execScript) A.execScript(B,'JavaScript');else{if (FCKBrowserInfo.IsGecko10){eval.call(A,B);}else if(FCKBrowserInfo.IsAIR){FCKAdobeAIR.FCKeditorAPI_Evaluate(A,B);}else if (FCKBrowserInfo.IsSafari){var C=A.document;var D=C.createElement('script');D.appendChild(C.createTextNode(B));C.documentElement.appendChild(D);}else A.eval(B);};FCKeditorAPI=A.FCKeditorAPI;FCKeditorAPI.__Instances=FCKeditorAPI.Instances;};FCKeditorAPI.Instances[FCK.Name]=FCK;};function _AttachFormSubmitToAPI(){var A=FCK.GetParentForm();if (A){FCKTools.AddEventListener(A,'submit',FCK.UpdateLinkedField);if (!A._FCKOriginalSubmit&&(typeof(A.submit)=='function'||(!A.submit.tagName&&!A.submit.length))){A._FCKOriginalSubmit=A.submit;A.submit=FCKeditorAPI._FormSubmit;}}};function FCKeditorAPI_Cleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat&&!window.FCKUnloadFlag) return;delete FCKeditorAPI.Instances[FCK.Name];};function FCKeditorAPI_ConfirmCleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat) window.FCKUnloadFlag=true;};FCKTools.AddEventListener(window,'unload',FCKeditorAPI_Cleanup);FCKTools.AddEventListener(window,'beforeunload',FCKeditorAPI_ConfirmCleanup);
 var FCKImagePreloader=function(){this._Images=[];};FCKImagePreloader.prototype={AddImages:function(A){if (typeof(A)=='string') A=A.split(';');this._Images=this._Images.concat(A);},Start:function(){var A=this._Images;this._PreloadCount=A.length;for (var i=0;i<A.length;i++){var B=document.createElement('img');FCKTools.AddEventListenerEx(B,'load',_FCKImagePreloader_OnImage,this);FCKTools.AddEventListenerEx(B,'error',_FCKImagePreloader_OnImage,this);B.src=A[i];_FCKImagePreloader_ImageCache.push(B);}}};var _FCKImagePreloader_ImageCache=[];function _FCKImagePreloader_OnImage(A,B){if ((--B._PreloadCount)==0&&B.OnComplete) B.OnComplete();};
 var FCKRegexLib={AposEntity:/&apos;/gi,ObjectElements:/^(?:IMG|TABLE|TR|TD|TH|INPUT|SELECT|TEXTAREA|HR|OBJECT|A|UL|OL|LI)$/i,NamedCommands:/^(?:Cut|Copy|Paste|Print|SelectAll|RemoveFormat|Unlink|Undo|Redo|Bold|Italic|Underline|StrikeThrough|Subscript|Superscript|JustifyLeft|JustifyCenter|JustifyRight|JustifyFull|Outdent|Indent|InsertOrderedList|InsertUnorderedList|InsertHorizontalRule)$/i,BeforeBody:/(^[\s\S]*\<body[^\>]*\>)/i,AfterBody:/(\<\/body\>[\s\S]*$)/i,ToReplace:/___fcktoreplace:([\w]+)/ig,MetaHttpEquiv:/http-equiv\s*=\s*["']?([^"' ]+)/i,HasBaseTag:/<base /i,HasBodyTag:/<body[\s|>]/i,HtmlOpener:/<html\s?[^>]*>/i,HeadOpener:/<head\s?[^>]*>/i,HeadCloser:/<\/head\s*>/i,FCK_Class:/\s*FCK__[^ ]*(?=\s+|$)/,ElementName:/(^[a-z_:][\w.\-:]*\w$)|(^[a-z_]$)/,ForceSimpleAmpersand:/___FCKAmp___/g,SpaceNoClose:/\/>/g,EmptyParagraph:/^<(p|div|address|h\d|center)(?=[ >])[^>]*>\s*(<\/\1>)?$/,EmptyOutParagraph:/^<(p|div|address|h\d|center)(?=[ >])[^>]*>(?:\s*|&nbsp;)(<\/\1>)?$/,TagBody:/></,GeckoEntitiesMarker:/#\?-\:/g,ProtectUrlsImg:/<img(?=\s).*?\ssrc=((?:(?:\s*)("|').*?\2)|(?:[^"'][^ >]+))/gi,ProtectUrlsA:/<a(?=\s).*?\shref=((?:(?:\s*)("|').*?\2)|(?:[^"'][^ >]+))/gi,ProtectUrlsArea:/<area(?=\s).*?\shref=((?:(?:\s*)("|').*?\2)|(?:[^"'][^ >]+))/gi,Html4DocType:/HTML 4\.0 Transitional/i,DocTypeTag:/<!DOCTYPE[^>]*>/i,HtmlDocType:/DTD HTML/,TagsWithEvent:/<[^\>]+ on\w+[\s\r\n]*=[\s\r\n]*?('|")[\s\S]+?\>/g,EventAttributes:/\s(on\w+)[\s\r\n]*=[\s\r\n]*?('|")([\s\S]*?)\2/g,ProtectedEvents:/\s\w+_fckprotectedatt="([^"]+)"/g,StyleProperties:/\S+\s*:/g,InvalidSelfCloseTags:/(<(?!base|meta|link|hr|br|param|img|area|input)([a-zA-Z0-9:]+)[^>]*)\/>/gi,StyleVariableAttName:/#\(\s*("|')(.+?)\1[^\)]*\s*\)/g,RegExp:/^\/(.*)\/([gim]*)$/,HtmlTag:/<[^\s<>](?:"[^"]*"|'[^']*'|[^<])*>/};
Index: /FCKeditor/releases/stable/editor/js/fckeditorcode_ie.js
===================================================================
--- /FCKeditor/releases/stable/editor/js/fckeditorcode_ie.js	(revision 3824)
+++ /FCKeditor/releases/stable/editor/js/fckeditorcode_ie.js	(revision 3825)
@@ -37,5 +37,5 @@
 var FCKTools={};FCKTools.CreateBogusBR=function(A){var B=A.createElement('br');B.setAttribute('type','_moz');return B;};FCKTools.FixCssUrls=function(A,B){if (!A||A.length==0) return B;return B.replace(/url\s*\(([\s'"]*)(.*?)([\s"']*)\)/g,function(match,opener,path,closer){if (/^\/|^\w?:/.test(path)) return match;else return 'url('+opener+A+path+closer+')';});};FCKTools._GetUrlFixedCss=function(A,B){var C=A.match(/^([^|]+)\|([\s\S]*)/);if (C) return FCKTools.FixCssUrls(C[1],C[2]);else return A;};FCKTools.AppendStyleSheet=function(A,B){if (!B) return [];if (typeof(B)=='string'){if (/[\\\/\.][^{}]*$/.test(B)){return this.AppendStyleSheet(A,B.split(','));}else return [this.AppendStyleString(A,FCKTools._GetUrlFixedCss(B))];}else{var C=[];for (var i=0;i<B.length;i++) C.push(this._AppendStyleSheet(A,B[i]));return C;}};FCKTools.GetStyleHtml=(function(){var A=function(styleDef,markTemp){if (styleDef.length==0) return '';var B=markTemp?' _fcktemp="true"':'';return '<style type="text/css"'+B+'>'+styleDef+'</style>';};var C=function(cssFileUrl,markTemp){if (cssFileUrl.length==0) return '';var B=markTemp?' _fcktemp="true"':'';return '<link href="'+cssFileUrl+'" type="text/css" rel="stylesheet" '+B+'/>';};return function(cssFileOrArrayOrDef,markTemp){if (!cssFileOrArrayOrDef) return '';if (typeof(cssFileOrArrayOrDef)=='string'){if (/[\\\/\.][^{}]*$/.test(cssFileOrArrayOrDef)){return this.GetStyleHtml(cssFileOrArrayOrDef.split(','),markTemp);}else return A(this._GetUrlFixedCss(cssFileOrArrayOrDef),markTemp);}else{var E='';for (var i=0;i<cssFileOrArrayOrDef.length;i++) E+=C(cssFileOrArrayOrDef[i],markTemp);return E;}}})();FCKTools.GetElementDocument=function (A){return A.ownerDocument||A.document;};FCKTools.GetElementWindow=function(A){return this.GetDocumentWindow(this.GetElementDocument(A));};FCKTools.GetDocumentWindow=function(A){if (FCKBrowserInfo.IsSafari&&!A.parentWindow) this.FixDocumentParentWindow(window.top);return A.parentWindow||A.defaultView;};FCKTools.FixDocumentParentWindow=function(A){if (A.document) A.document.parentWindow=A;for (var i=0;i<A.frames.length;i++) FCKTools.FixDocumentParentWindow(A.frames[i]);};FCKTools.HTMLEncode=function(A){if (!A) return '';A=A.replace(/&/g,'&amp;');A=A.replace(/</g,'&lt;');A=A.replace(/>/g,'&gt;');return A;};FCKTools.HTMLDecode=function(A){if (!A) return '';A=A.replace(/&gt;/g,'>');A=A.replace(/&lt;/g,'<');A=A.replace(/&amp;/g,'&');return A;};FCKTools._ProcessLineBreaksForPMode=function(A,B,C,D,E){var F=0;var G="<p>";var H="</p>";var I="<br />";if (C){G="<li>";H="</li>";F=1;}while (D&&D!=A.FCK.EditorDocument.body){if (D.tagName.toLowerCase()=='p'){F=1;break;};D=D.parentNode;};for (var i=0;i<B.length;i++){var c=B.charAt(i);if (c=='\r') continue;if (c!='\n'){E.push(c);continue;};var n=B.charAt(i+1);if (n=='\r'){i++;n=B.charAt(i+1);};if (n=='\n'){i++;if (F) E.push(H);E.push(G);F=1;}else E.push(I);}};FCKTools._ProcessLineBreaksForDivMode=function(A,B,C,D,E){var F=0;var G="<div>";var H="</div>";if (C){G="<li>";H="</li>";F=1;}while (D&&D!=A.FCK.EditorDocument.body){if (D.tagName.toLowerCase()=='div'){F=1;break;};D=D.parentNode;};for (var i=0;i<B.length;i++){var c=B.charAt(i);if (c=='\r') continue;if (c!='\n'){E.push(c);continue;};if (F){if (E[E.length-1]==G){E.push("&nbsp;");};E.push(H);};E.push(G);F=1;};if (F) E.push(H);};FCKTools._ProcessLineBreaksForBrMode=function(A,B,C,D,E){var F=0;var G="<br />";var H="";if (C){G="<li>";H="</li>";F=1;};for (var i=0;i<B.length;i++){var c=B.charAt(i);if (c=='\r') continue;if (c!='\n'){E.push(c);continue;};if (F&&H.length) E.push (H);E.push(G);F=1;}};FCKTools.ProcessLineBreaks=function(A,B,C){var D=B.EnterMode.toLowerCase();var E=[];var F=0;var G=new A.FCKDomRange(A.FCK.EditorWindow);G.MoveToSelection();var H=G._Range.startContainer;while (H&&H.nodeType!=1) H=H.parentNode;if (H&&H.tagName.toLowerCase()=='li') F=1;if (D=='p') this._ProcessLineBreaksForPMode(A,C,F,H,E);else if (D=='div') this._ProcessLineBreaksForDivMode(A,C,F,H,E);else if (D=='br') this._ProcessLineBreaksForBrMode(A,C,F,H,E);return E.join("");};FCKTools.AddSelectOption=function(A,B,C){var D=FCKTools.GetElementDocument(A).createElement("OPTION");D.text=B;D.value=C;A.options.add(D);return D;};FCKTools.RunFunction=function(A,B,C,D){if (A) this.SetTimeout(A,0,B,C,D);};FCKTools.SetTimeout=function(A,B,C,D,E){return (E||window).setTimeout(function(){if (D) A.apply(C,[].concat(D));else A.apply(C);},B);};FCKTools.SetInterval=function(A,B,C,D,E){return (E||window).setInterval(function(){A.apply(C,D||[]);},B);};FCKTools.ConvertStyleSizeToHtml=function(A){return A.EndsWith('%')?A:parseInt(A,10);};FCKTools.ConvertHtmlSizeToStyle=function(A){return A.EndsWith('%')?A:(A+'px');};FCKTools.GetElementAscensor=function(A,B){var e=A;var C=","+B.toUpperCase()+",";while (e){if (C.indexOf(","+e.nodeName.toUpperCase()+",")!=-1) return e;e=e.parentNode;};return null;};FCKTools.CreateEventListener=function(A,B){var f=function(){var C=[];for (var i=0;i<arguments.length;i++) C.push(arguments[i]);A.apply(this,C.concat(B));};return f;};FCKTools.IsStrictMode=function(A){return ('CSS1Compat'==(A.compatMode||(FCKBrowserInfo.IsSafari?'CSS1Compat':null)));};FCKTools.ArgumentsToArray=function(A,B,C){B=B||0;C=C||A.length;var D=[];for (var i=B;i<B+C&&i<A.length;i++) D.push(A[i]);return D;};FCKTools.CloneObject=function(A){var B=function() {};B.prototype=A;return new B;};FCKTools.AppendBogusBr=function(A){if (!A) return;var B=this.GetLastItem(A.getElementsByTagName('br'));if (!B||(B.getAttribute('type',2)!='_moz'&&B.getAttribute('_moz_dirty')==null)){var C=this.GetElementDocument(A);if (FCKBrowserInfo.IsOpera) A.appendChild(C.createTextNode(''));else A.appendChild(this.CreateBogusBR(C));}};FCKTools.GetLastItem=function(A){if (A.length>0) return A[A.length-1];return null;};FCKTools.GetDocumentPosition=function(w,A){var x=0;var y=0;var B=A;var C=null;var D=FCKTools.GetElementWindow(B);while (B&&!(D==w&&(B==w.document.body||B==w.document.documentElement))){x+=B.offsetLeft-B.scrollLeft;y+=B.offsetTop-B.scrollTop;if (!FCKBrowserInfo.IsOpera){var E=C;while (E&&E!=B){x-=E.scrollLeft;y-=E.scrollTop;E=E.parentNode;}};C=B;if (B.offsetParent) B=B.offsetParent;else{if (D!=w){B=D.frameElement;C=null;if (B) D=B.contentWindow.parent;}else B=null;}};if (FCKDomTools.GetCurrentElementStyle(w.document.body,'position')!='static'||(FCKBrowserInfo.IsIE&&FCKDomTools.GetPositionedAncestor(A)==null)){x+=w.document.body.offsetLeft;y+=w.document.body.offsetTop;};return { "x":x,"y":y };};FCKTools.GetWindowPosition=function(w,A){var B=this.GetDocumentPosition(w,A);var C=FCKTools.GetScrollPosition(w);B.x-=C.X;B.y-=C.Y;return B;};FCKTools.ProtectFormStyles=function(A){if (!A||A.nodeType!=1||A.tagName.toLowerCase()!='form') return [];var B=[];var C=['style','className'];for (var i=0;i<C.length;i++){var D=C[i];if (A.elements.namedItem(D)){var E=A.elements.namedItem(D);B.push([E,E.nextSibling]);A.removeChild(E);}};return B;};FCKTools.RestoreFormStyles=function(A,B){if (!A||A.nodeType!=1||A.tagName.toLowerCase()!='form') return;if (B.length>0){for (var i=B.length-1;i>=0;i--){var C=B[i][0];var D=B[i][1];if (D) A.insertBefore(C,D);else A.appendChild(C);}}};FCKTools.GetNextNode=function(A,B){if (A.firstChild) return A.firstChild;else if (A.nextSibling) return A.nextSibling;else{var C=A.parentNode;while (C){if (C==B) return null;if (C.nextSibling) return C.nextSibling;else C=C.parentNode;}};return null;};FCKTools.GetNextTextNode=function(A,B,C){node=this.GetNextNode(A,B);if (C&&node&&C(node)) return null;while (node&&node.nodeType!=3){node=this.GetNextNode(node,B);if (C&&node&&C(node)) return null;};return node;};FCKTools.Merge=function(){var A=arguments;var o=A[0];for (var i=1;i<A.length;i++){var B=A[i];for (var p in B) o[p]=B[p];};return o;};FCKTools.IsArray=function(A){return (A instanceof Array);};FCKTools.AppendLengthProperty=function(A,B){var C=0;for (var n in A) C++;return A[B||'length']=C;};FCKTools.NormalizeCssText=function(A){var B=document.createElement('span');B.style.cssText=A;return B.style.cssText;};FCKTools.Bind=function(A,B){return function(){ return B.apply(A,arguments);};};FCKTools.GetVoidUrl=function(){if (FCK_IS_CUSTOM_DOMAIN) return "javascript: void( function(){document.open();document.write('<html><head><title></title></head><body></body></html>');document.domain = '"+FCK_RUNTIME_DOMAIN+"';document.close();}() ) ;";if (FCKBrowserInfo.IsIE){if (FCKBrowserInfo.IsIE7||!FCKBrowserInfo.IsIE6) return "";else return "javascript: '';";};return "javascript: void(0);";};FCKTools.ResetStyles=function(A){A.style.cssText='margin:0;padding:0;border:0;background-color:transparent;background-image:none;';};
 FCKTools.CancelEvent=function(e){return false;};FCKTools._AppendStyleSheet=function(A,B){return A.createStyleSheet(B).owningElement;};FCKTools.AppendStyleString=function(A,B){if (!B) return null;var s=A.createStyleSheet("");s.cssText=B;return s;};FCKTools.ClearElementAttributes=function(A){A.clearAttributes();};FCKTools.GetAllChildrenIds=function(A){var B=[];for (var i=0;i<A.all.length;i++){var C=A.all[i].id;if (C&&C.length>0) B[B.length]=C;};return B;};FCKTools.RemoveOuterTags=function(e){e.insertAdjacentHTML('beforeBegin',e.innerHTML);e.parentNode.removeChild(e);};FCKTools.CreateXmlObject=function(A){var B;switch (A){case 'XmlHttp':if (document.location.protocol!='file:') try { return new XMLHttpRequest();} catch (e) {};B=['MSXML2.XmlHttp','Microsoft.XmlHttp'];break;case 'DOMDocument':B=['MSXML2.DOMDocument','Microsoft.XmlDom'];break;};for (var i=0;i<2;i++){try { return new ActiveXObject(B[i]);}catch (e){}};if (FCKLang.NoActiveX){alert(FCKLang.NoActiveX);FCKLang.NoActiveX=null;};return null;};FCKTools.DisableSelection=function(A){A.unselectable='on';var e,i=0;while ((e=A.all[i++])){switch (e.tagName){case 'IFRAME':case 'TEXTAREA':case 'INPUT':case 'SELECT':break;default:e.unselectable='on';}}};FCKTools.GetScrollPosition=function(A){var B=A.document;var C={ X:B.documentElement.scrollLeft,Y:B.documentElement.scrollTop };if (C.X>0||C.Y>0) return C;return { X:B.body.scrollLeft,Y:B.body.scrollTop };};FCKTools.AddEventListener=function(A,B,C){A.attachEvent('on'+B,C);};FCKTools.RemoveEventListener=function(A,B,C){A.detachEvent('on'+B,C);};FCKTools.AddEventListenerEx=function(A,B,C,D){var o={};o.Source=A;o.Params=D||[];o.Listener=function(ev){return C.apply(o.Source,[ev].concat(o.Params));};if (FCK.IECleanup) FCK.IECleanup.AddItem(null,function() { o.Source=null;o.Params=null;});A.attachEvent('on'+B,o.Listener);A=null;D=null;};FCKTools.GetViewPaneSize=function(A){var B;var C=A.document.documentElement;if (C&&C.clientWidth) B=C;else B=A.document.body;if (B) return { Width:B.clientWidth,Height:B.clientHeight };else return { Width:0,Height:0 };};FCKTools.SaveStyles=function(A){var B=FCKTools.ProtectFormStyles(A);var C={};if (A.className.length>0){C.Class=A.className;A.className='';};var D=A.style.cssText;if (D.length>0){C.Inline=D;A.style.cssText='';};FCKTools.RestoreFormStyles(A,B);return C;};FCKTools.RestoreStyles=function(A,B){var C=FCKTools.ProtectFormStyles(A);A.className=B.Class||'';A.style.cssText=B.Inline||'';FCKTools.RestoreFormStyles(A,C);};FCKTools.RegisterDollarFunction=function(A){A.$=A.document.getElementById;};FCKTools.AppendElement=function(A,B){return A.appendChild(this.GetElementDocument(A).createElement(B));};FCKTools.ToLowerCase=function(A){return A.toLowerCase();};
-var FCKeditorAPI;function InitializeAPI(){var A=window.parent;if (!(FCKeditorAPI=A.FCKeditorAPI)){var B='window.FCKeditorAPI = {Version : "2.6.4",VersionBuild : "21629",Instances : window.FCKeditorAPI && window.FCKeditorAPI.Instances || {},GetInstance : function( name ){return this.Instances[ name ];},_FormSubmit : function(){for ( var name in FCKeditorAPI.Instances ){var oEditor = FCKeditorAPI.Instances[ name ] ;if ( oEditor.GetParentForm && oEditor.GetParentForm() == this )oEditor.UpdateLinkedField() ;}this._FCKOriginalSubmit() ;},_FunctionQueue	: window.FCKeditorAPI && window.FCKeditorAPI._FunctionQueue || {Functions : new Array(),IsRunning : false,Add : function( f ){this.Functions.push( f );if ( !this.IsRunning )this.StartNext();},StartNext : function(){var aQueue = this.Functions ;if ( aQueue.length > 0 ){this.IsRunning = true;aQueue[0].call();}else this.IsRunning = false;},Remove : function( f ){var aQueue = this.Functions;var i = 0, fFunc;while( (fFunc = aQueue[ i ]) ){if ( fFunc == f )aQueue.splice( i,1 );i++ ;}this.StartNext();}}}';if (A.execScript) A.execScript(B,'JavaScript');else{if (FCKBrowserInfo.IsGecko10){eval.call(A,B);}else if(FCKBrowserInfo.IsAIR){FCKAdobeAIR.FCKeditorAPI_Evaluate(A,B);}else if (FCKBrowserInfo.IsSafari){var C=A.document;var D=C.createElement('script');D.appendChild(C.createTextNode(B));C.documentElement.appendChild(D);}else A.eval(B);};FCKeditorAPI=A.FCKeditorAPI;FCKeditorAPI.__Instances=FCKeditorAPI.Instances;};FCKeditorAPI.Instances[FCK.Name]=FCK;};function _AttachFormSubmitToAPI(){var A=FCK.GetParentForm();if (A){FCKTools.AddEventListener(A,'submit',FCK.UpdateLinkedField);if (!A._FCKOriginalSubmit&&(typeof(A.submit)=='function'||(!A.submit.tagName&&!A.submit.length))){A._FCKOriginalSubmit=A.submit;A.submit=FCKeditorAPI._FormSubmit;}}};function FCKeditorAPI_Cleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat&&!window.FCKUnloadFlag) return;delete FCKeditorAPI.Instances[FCK.Name];};function FCKeditorAPI_ConfirmCleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat) window.FCKUnloadFlag=true;};FCKTools.AddEventListener(window,'unload',FCKeditorAPI_Cleanup);FCKTools.AddEventListener(window,'beforeunload',FCKeditorAPI_ConfirmCleanup);
+var FCKeditorAPI;function InitializeAPI(){var A=window.parent;if (!(FCKeditorAPI=A.FCKeditorAPI)){var B='window.FCKeditorAPI = {Version : "2.6.4.1",VersionBuild : "23187",Instances : window.FCKeditorAPI && window.FCKeditorAPI.Instances || {},GetInstance : function( name ){return this.Instances[ name ];},_FormSubmit : function(){for ( var name in FCKeditorAPI.Instances ){var oEditor = FCKeditorAPI.Instances[ name ] ;if ( oEditor.GetParentForm && oEditor.GetParentForm() == this )oEditor.UpdateLinkedField() ;}this._FCKOriginalSubmit() ;},_FunctionQueue	: window.FCKeditorAPI && window.FCKeditorAPI._FunctionQueue || {Functions : new Array(),IsRunning : false,Add : function( f ){this.Functions.push( f );if ( !this.IsRunning )this.StartNext();},StartNext : function(){var aQueue = this.Functions ;if ( aQueue.length > 0 ){this.IsRunning = true;aQueue[0].call();}else this.IsRunning = false;},Remove : function( f ){var aQueue = this.Functions;var i = 0, fFunc;while( (fFunc = aQueue[ i ]) ){if ( fFunc == f )aQueue.splice( i,1 );i++ ;}this.StartNext();}}}';if (A.execScript) A.execScript(B,'JavaScript');else{if (FCKBrowserInfo.IsGecko10){eval.call(A,B);}else if(FCKBrowserInfo.IsAIR){FCKAdobeAIR.FCKeditorAPI_Evaluate(A,B);}else if (FCKBrowserInfo.IsSafari){var C=A.document;var D=C.createElement('script');D.appendChild(C.createTextNode(B));C.documentElement.appendChild(D);}else A.eval(B);};FCKeditorAPI=A.FCKeditorAPI;FCKeditorAPI.__Instances=FCKeditorAPI.Instances;};FCKeditorAPI.Instances[FCK.Name]=FCK;};function _AttachFormSubmitToAPI(){var A=FCK.GetParentForm();if (A){FCKTools.AddEventListener(A,'submit',FCK.UpdateLinkedField);if (!A._FCKOriginalSubmit&&(typeof(A.submit)=='function'||(!A.submit.tagName&&!A.submit.length))){A._FCKOriginalSubmit=A.submit;A.submit=FCKeditorAPI._FormSubmit;}}};function FCKeditorAPI_Cleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat&&!window.FCKUnloadFlag) return;delete FCKeditorAPI.Instances[FCK.Name];};function FCKeditorAPI_ConfirmCleanup(){if (window.FCKConfig&&FCKConfig.MsWebBrowserControlCompat) window.FCKUnloadFlag=true;};FCKTools.AddEventListener(window,'unload',FCKeditorAPI_Cleanup);FCKTools.AddEventListener(window,'beforeunload',FCKeditorAPI_ConfirmCleanup);
 var FCKImagePreloader=function(){this._Images=[];};FCKImagePreloader.prototype={AddImages:function(A){if (typeof(A)=='string') A=A.split(';');this._Images=this._Images.concat(A);},Start:function(){var A=this._Images;this._PreloadCount=A.length;for (var i=0;i<A.length;i++){var B=document.createElement('img');FCKTools.AddEventListenerEx(B,'load',_FCKImagePreloader_OnImage,this);FCKTools.AddEventListenerEx(B,'error',_FCKImagePreloader_OnImage,this);B.src=A[i];_FCKImagePreloader_ImageCache.push(B);}}};var _FCKImagePreloader_ImageCache=[];function _FCKImagePreloader_OnImage(A,B){if ((--B._PreloadCount)==0&&B.OnComplete) B.OnComplete();};
 var FCKRegexLib={AposEntity:/&apos;/gi,ObjectElements:/^(?:IMG|TABLE|TR|TD|TH|INPUT|SELECT|TEXTAREA|HR|OBJECT|A|UL|OL|LI)$/i,NamedCommands:/^(?:Cut|Copy|Paste|Print|SelectAll|RemoveFormat|Unlink|Undo|Redo|Bold|Italic|Underline|StrikeThrough|Subscript|Superscript|JustifyLeft|JustifyCenter|JustifyRight|JustifyFull|Outdent|Indent|InsertOrderedList|InsertUnorderedList|InsertHorizontalRule)$/i,BeforeBody:/(^[\s\S]*\<body[^\>]*\>)/i,AfterBody:/(\<\/body\>[\s\S]*$)/i,ToReplace:/___fcktoreplace:([\w]+)/ig,MetaHttpEquiv:/http-equiv\s*=\s*["']?([^"' ]+)/i,HasBaseTag:/<base /i,HasBodyTag:/<body[\s|>]/i,HtmlOpener:/<html\s?[^>]*>/i,HeadOpener:/<head\s?[^>]*>/i,HeadCloser:/<\/head\s*>/i,FCK_Class:/\s*FCK__[^ ]*(?=\s+|$)/,ElementName:/(^[a-z_:][\w.\-:]*\w$)|(^[a-z_]$)/,ForceSimpleAmpersand:/___FCKAmp___/g,SpaceNoClose:/\/>/g,EmptyParagraph:/^<(p|div|address|h\d|center)(?=[ >])[^>]*>\s*(<\/\1>)?$/,EmptyOutParagraph:/^<(p|div|address|h\d|center)(?=[ >])[^>]*>(?:\s*|&nbsp;)(<\/\1>)?$/,TagBody:/></,GeckoEntitiesMarker:/#\?-\:/g,ProtectUrlsImg:/<img(?=\s).*?\ssrc=((?:(?:\s*)("|').*?\2)|(?:[^"'][^ >]+))/gi,ProtectUrlsA:/<a(?=\s).*?\shref=((?:(?:\s*)("|').*?\2)|(?:[^"'][^ >]+))/gi,ProtectUrlsArea:/<area(?=\s).*?\shref=((?:(?:\s*)("|').*?\2)|(?:[^"'][^ >]+))/gi,Html4DocType:/HTML 4\.0 Transitional/i,DocTypeTag:/<!DOCTYPE[^>]*>/i,HtmlDocType:/DTD HTML/,TagsWithEvent:/<[^\>]+ on\w+[\s\r\n]*=[\s\r\n]*?('|")[\s\S]+?\>/g,EventAttributes:/\s(on\w+)[\s\r\n]*=[\s\r\n]*?('|")([\s\S]*?)\2/g,ProtectedEvents:/\s\w+_fckprotectedatt="([^"]+)"/g,StyleProperties:/\S+\s*:/g,InvalidSelfCloseTags:/(<(?!base|meta|link|hr|br|param|img|area|input)([a-zA-Z0-9:]+)[^>]*)\/>/gi,StyleVariableAttName:/#\(\s*("|')(.+?)\1[^\)]*\s*\)/g,RegExp:/^\/(.*)\/([gim]*)$/,HtmlTag:/<[^\s<>](?:"[^"]*"|'[^']*'|[^<])*>/};
Index: /FCKeditor/releases/stable/fckeditor.js
===================================================================
--- /FCKeditor/releases/stable/fckeditor.js	(revision 3824)
+++ /FCKeditor/releases/stable/fckeditor.js	(revision 3825)
@@ -60,6 +60,6 @@
 FCKeditor.MinWidth = 750 ;
 
-FCKeditor.prototype.Version			= '2.6.4' ;
-FCKeditor.prototype.VersionBuild	= '21629' ;
+FCKeditor.prototype.Version			= '2.6.4.1' ;
+FCKeditor.prototype.VersionBuild	= '23187' ;
 
 FCKeditor.prototype.Create = function()
Index: /FCKeditor/releases/stable/fckeditor.pl
===================================================================
--- /FCKeditor/releases/stable/fckeditor.pl	(revision 3824)
+++ /FCKeditor/releases/stable/fckeditor.pl	(revision 3825)