Index: .hgtags
===================================================================
--- .hgtags	(revision 279)
+++ .hgtags	(revision 369)
@@ -1,1 +1,2 @@
 ec077f3c6b20bc6f7f40a113acaff0220457a2c4 2.3.0
+4e0137ddb12474d62b88c4966d5895a391b6d382 2.3.1
Index: CHANGELOG
===================================================================
--- CHANGELOG	(revision 343)
+++ CHANGELOG	(revision 372)
@@ -3,5 +3,5 @@
 * handling of postgres non default schemas (db_prefix = 'schema.prefix')
 
-Dotclear 2.3.1 - ongoing dev
+Dotclear 2.3.1 - 2001-06-14
 ===========================================================
 * Updated makefile for cleaner distrib.
@@ -9,4 +9,6 @@
 * Misc JS & CSS cleaning.
 * Import/Export preferences-related bugfix.
+* Administrative mail address is now configurable.
+* Security: one minor fix and changes for two potential problems. Thanks to Jeremie Boutoille
 
 Dotclear 2.3.0 - 2011-05-16
Index: admin/auth.php
===================================================================
--- admin/auth.php	(revision 356)
+++ admin/auth.php	(revision 372)
@@ -23,5 +23,5 @@
 $dlang = http::getAcceptLanguage();
 $dlang = ($dlang == '' ? 'en' : $dlang);
-if ($dlang != 'en')
+if ($dlang != 'en' && preg_match('/^[a-z]{2}(-[a-z]{2})?$/',$dlang))
 {
 	l10n::set(dirname(__FILE__).'/../locales/'.$dlang.'/main');
@@ -90,5 +90,5 @@
 		$page_url.'?akey='.$recover_key;
 		
-		$headers[] = 'From: dotclear@'.$_SERVER['HTTP_HOST'];
+		$headers[] = 'From: '.(defined('DC_ADMIN_MAILFROM') && DC_ADMIN_MAILFROM ? DC_ADMIN_MAILFROM : 'dotclear@local');
 		$headers[] = 'Content-Type: text/plain; charset=UTF-8;';
 		
@@ -126,6 +126,21 @@
 }
 # Change password and retry to log
-elseif ($change_pwd and $data = unserialize(base64_decode($_POST['login_data'])))
-{
+elseif ($change_pwd)
+{
+	try
+	{
+		$tmp_data = explode('/',$_POST['login_data']);
+		if (count($tmp_data) != 3) {
+			throw new Exception();
+		}
+		$data = array(
+			'user_id'=>base64_decode($tmp_data[0]),
+			'cookie_admin'=>$tmp_data[1],
+			'user_remember'=>$tmp_data[2]=='1'
+		);
+		if ($data['user_id'] === false) {
+			throw new Exception();
+		}
+		
 	# Check login informations
 	$check_user = false;
@@ -142,6 +157,4 @@
 	}
 	
-	try
-	{
 		if (!$core->auth->allowPassChange() || !$check_user) {
 			$change_pwd = false;
@@ -166,9 +179,5 @@
 		$_SESSION['sess_browser_uid'] = http::browserUID(DC_MASTER_KEY);
 		
-		if (!empty($data['blog_id'])) {
-			$_SESSION['sess_blog_id'] = $data['blog_id'];
-		}
-		
-		if (!empty($data['user_remember']))
+		if ($data['user_remember'])
 		{
 			setcookie('dc_admin',$data['cookie_admin'],strtotime('+15 days'),'','',DC_ADMIN_SSL);
@@ -193,10 +202,9 @@
 	if ($check_user && $core->auth->mustChangePassword())
 	{
-		$login_data = base64_encode(serialize(array(
-			'user_id'=>$user_id,
-			'cookie_admin'=>$cookie_admin,
-			'blog_id'=>(!empty($_POST['blog']) ? $_POST['blog'] : ''),
-			'user_remember'=>!empty($_POST['user_remember'])
-		)));
+		$login_data = join('/',array(
+			base64_encode($user_id),
+			$cookie_admin,
+			empty($_POST['user_remember'])?'0':'1'
+		));
 		
 		if (!$core->auth->allowPassChange()) {
Index: admin/install/wizard.php
===================================================================
--- admin/install/wizard.php	(revision 270)
+++ admin/install/wizard.php	(revision 363)
@@ -100,4 +100,5 @@
 		$admin_url = preg_replace('%install/wizard.php$%','',$_SERVER['REQUEST_URI']);
 		writeConfigValue('DC_ADMIN_URL',http::getHost().$admin_url,$full_conf);
+		writeConfigValue('DC_ADMIN_MAILFROM','dotclear@'.$_SERVER['HTTP_HOST'],$full_conf);
 		writeConfigValue('DC_MASTER_KEY',md5(uniqid()),$full_conf);
 		
Index: inc/config.php.in
===================================================================
--- inc/config.php.in	(revision 270)
+++ inc/config.php.in	(revision 362)
@@ -40,4 +40,7 @@
 define('DC_ADMIN_URL','');
 
+// Admin mail from address. For password recovery and such.
+define('DC_ADMIN_MAILFROM','');
+
 // Cookie's name
 define('DC_SESSION_NAME','dcxd');
