Merge branch 'develop' into pr/1051

2026-01-09 11:44:10 +09:00 · 2018-08-06 01:08:51 +09:00 · 2018-08-06 01:08:51 +09:00 · 2c9bb88a14
commit 2c9bb88a14
parent 25d2e4892a e58214d13a
19 changed files with 132 additions and 159 deletions
--- a/classes/context/Context.class.php
+++ b/classes/context/Context.class.php
@ -91,13 +91,7 @@ class Context
 	 * @var string
 	 */
 	public $canonical_url = '';
-	
-	/**
-	 * unloaded basic files
-	 * @var array
-	 */
-	public $unloaded_basic_files = array();
-	
+
 	/**
 	 * language type - changed by HTTP_USER_AGENT or user's cookie
 	 * @var string
@ -2116,44 +2110,7 @@ class Context
 	{
 		self::$_oFrontEndFileHandler->unloadAllFiles($type);
 	}
-	
-	/**
-	 * unload basic files that load in HTMLDisplayHandler (filename|all|common|admin|mobile)
-	 *
-	 * @return void
-	 */
-	public static function unloadBasicFiles()
-	{
-		if(func_num_args() < 1)
-		{
-			return;
-		}
-		foreach(func_get_args() as $file)
-		{
-			self::$_instance->unloaded_basic_files[] = $file;
-		}
-	}
-	
-	/**
-	 * get unloaded basic files
-	 *
-	 * @return array unloaded basic files
-	 */
-	public static function getUnloadedBasicFiles()
-	{
-		return self::$_instance->unloaded_basic_files;
-	}
-	
-	/**
-	 * clear unloaded basic files
-	 *
-	 * @return void
-	 */
-	public static function clearUnloadedBasicFiles()
-	{
-		self::$_instance->unloaded_basic_files = array();
-	}
-	
+
 	/**
 	 * Add the js file
 	 *
--- a/classes/display/HTMLDisplayHandler.php
+++ b/classes/display/HTMLDisplayHandler.php
@ -235,25 +235,18 @@ class HTMLDisplayHandler
 		Context::set('favicon_url', $favicon_url);
 		Context::set('mobicon_url', $mobicon_url);

-		// set content variable that will be inserted in common layout
+		// convert the final layout
 		Context::set('content', $output);
-		
-		// load basic files
-		if(!in_array('all', Context::getUnloadedBasicFiles()))
+		$oTemplate = TemplateHandler::getInstance();
+		if(Mobile::isFromMobilePhone())
 		{
-			if(Mobile::isFromMobilePhone())
-			{
-				$this->_loadMobileJSCSS();
-			}
-			else
-			{
-				$this->_loadDesktopJSCSS();
-			}
-			$this->_loadCommonJSCSS();
+			$this->_loadMobileJSCSS();
 		}
-		
-		// set common layout
-		$output = TemplateHandler::getInstance()->compile('common/tpl', 'common_layout');
+		else
+		{
+			$this->_loadDesktopJSCSS();
+		}
+		$output = $oTemplate->compile('./common/tpl', 'common_layout');
 		
 		// replace the user-defined-language
 		$oModuleController = getController('module');
@ -567,20 +560,20 @@ class HTMLDisplayHandler
 	 * import basic .js files.
 	 * @return void
 	 */
-	private function _loadDesktopJSCSS()
+	function _loadDesktopJSCSS()
 	{
-		// add admin css
-		if(!in_array('admin', Context::getUnloadedBasicFiles()))
+		$lang_type = Context::getLangType();
+		$this->_loadCommonJSCSS();
+		
+		// for admin page, add admin css
+		if(Context::get('module') == 'admin' || strpos(Context::get('act'), 'Admin') > 0)
 		{
-			if(Context::get('module') == 'admin' || strpos(Context::get('act'), 'Admin') > 0)
-			{
-				$this->_loadBasicFile('modules/admin/tpl/css/admin.css', 10);
-				$this->_loadBasicFile('modules/admin/tpl/css/admin.iefix.css', 10, '', true);
-				$this->_loadBasicFile('modules/admin/tpl/css/admin.bootstrap.css', 1);
-				$this->_loadBasicFile('modules/admin/tpl/js/admin.js');
-				$this->_loadBasicFile('modules/admin/tpl/js/jquery.tmpl.js', 1);
-				$this->_loadBasicFile('modules/admin/tpl/js/jquery.jstree.js', 1);
-			}
+			Context::loadFile(array('./modules/admin/tpl/css/admin.css', '', '', 10), true);
+			Context::loadFile(array("./modules/admin/tpl/css/admin.iefix.css", '', 'ie', 10), true);
+			Context::loadFile('./modules/admin/tpl/js/admin.js', true);
+			Context::loadFile(array('./modules/admin/tpl/css/admin.bootstrap.css', '', '', 1), true);
+			Context::loadFile(array('./modules/admin/tpl/js/jquery.tmpl.js', '', '', 1), true);
+			Context::loadFile(array('./modules/admin/tpl/js/jquery.jstree.js', '', '', 1), true);
 		}
 	}

@ -589,12 +582,8 @@ class HTMLDisplayHandler
 	 */
 	private function _loadMobileJSCSS()
 	{
-		if(in_array('mobile', Context::getUnloadedBasicFiles()))
-		{
-			return;
-		}
-		
-		$this->_loadBasicFile('common/css/mobile.css', -1500000000);
+		$this->_loadCommonJSCSS();
+		Context::loadFile(array('./common/css/mobile.css', '', '', -1500000000), true);
 	}

 	/**
@ -602,12 +591,7 @@ class HTMLDisplayHandler
 	 */
 	private function _loadCommonJSCSS()
 	{
-		if(in_array('common', Context::getUnloadedBasicFiles()))
-		{
-			return;
-		}
-		
-		$jquery_version = preg_match('/MSIE [5-8]\./', $_SERVER['HTTP_USER_AGENT']) ? self::JQUERY_V1 : self::JQUERY_V2;
+		Context::loadFile(array('./common/css/rhymix.less', '', '', -1600000000), true);
 		$original_file_list = array(
 			'plugins/jquery.migrate/jquery-migrate-1.4.1.min.js',
 			'plugins/blankshield/blankshield.min.js',
@ -618,57 +602,40 @@ class HTMLDisplayHandler
 			'xml_handler.js',
 			'xml_js_filter.js',
 		);
-		
-		$this->_loadBasicFile('common/css/rhymix.less', -1600000000);
-		$this->_loadBasicFile('common/js/jquery-' . $jquery_version . (config('view.minify_scripts') !== 'none' ? '.min' : '') . '.js', -1800000000, 'head');
+		$jquery_version = preg_match('/MSIE [5-8]\./', $_SERVER['HTTP_USER_AGENT']) ? self::JQUERY_V1 : self::JQUERY_V2;
 		
 		if(config('view.minify_scripts') === 'none')
 		{
+			Context::loadFile(array('./common/js/jquery-' . $jquery_version . '.js', 'head', '', -1800000000), true);
 			foreach($original_file_list as $filename)
 			{
-				$this->_loadBasicFile('common/js/' . $filename, -1700000000, 'head');
+				Context::loadFile(array('./common/js/' . $filename, 'head', '', -1700000000), true);
 			}
 		}
 		else
 		{
+			Context::loadFile(array('./common/js/jquery-' . $jquery_version . '.min.js', 'head', '', -1800000000), true);
 			$concat_target_filename = 'files/cache/assets/minified/rhymix.min.js';
 			if(file_exists(\RX_BASEDIR . $concat_target_filename))
 			{
-				$original_mtime = 0;
 				$concat_target_mtime = filemtime(\RX_BASEDIR . $concat_target_filename);
+				$original_mtime = 0;
 				foreach($original_file_list as $filename)
 				{
 					$original_mtime = max($original_mtime, filemtime(\RX_BASEDIR . 'common/js/' . $filename));
 				}
 				if($concat_target_mtime > $original_mtime)
 				{
-					$no_renew = true;
+					Context::loadFile(array('./' . $concat_target_filename, 'head', '', -1700000000), true);
+					return;
 				}
 			}
-			if(!isset($no_renew))
-			{
-				$target_file_list = array();
-				foreach($original_file_list as $filename)
-				{
-					$target_file_list[] = \RX_BASEDIR . 'common/js/' . $filename;
-				}
-				Rhymix\Framework\Formatter::minifyJS($target_file_list, \RX_BASEDIR . $concat_target_filename);
-			}
-			$this->_loadBasicFile($concat_target_filename, -1700000000, 'head');
+			Rhymix\Framework\Formatter::minifyJS(array_map(function($str) {
+				return \RX_BASEDIR . 'common/js/' . $str;
+			}, $original_file_list), \RX_BASEDIR . $concat_target_filename);
+			Context::loadFile(array('./' . $concat_target_filename, 'head', '', -1700000000), true);
 		}
 	}
-	
-	/**
-	 * load basic file
-	 */
-	private function _loadBasicFile($filename, $index = 0, $type = '', $ie = false)
-	{
-		if(in_array(pathinfo($filename, PATHINFO_BASENAME), Context::getUnloadedBasicFiles()))
-		{
-			return;
-		}
-		Context::loadFile(array($filename, $type, $ie ? 'ie' : '', $index));
-	}
 }
 /* End of file HTMLDisplayHandler.class.php */
 /* Location: ./classes/display/HTMLDisplayHandler.class.php */
--- a/classes/extravar/Extravar.class.php
+++ b/classes/extravar/Extravar.class.php
@ -396,7 +396,7 @@ class ExtraItem
 				foreach($default as $v)
 				{
 					$checked = '';
-					if($value && in_array(trim($v), $value))
+					if(strval($value) !== '' && in_array(trim($v), $value))
 					{
 						$checked = ' checked="checked"';
 					}
@ -414,7 +414,7 @@ class ExtraItem
 				foreach($default as $v)
 				{
 					$selected = '';
-					if($value && in_array(trim($v), $value))
+					if(strval($value) !== '' && in_array(trim($v), $value))
 					{
 						$selected = ' selected="selected"';
 					}
@ -428,7 +428,7 @@ class ExtraItem
 				foreach($default as $v)
 				{
 					$checked = '';
-					if($value && in_array(trim($v), $value))
+					if(strval($value) !== '' && in_array(trim($v), $value))
 					{
 						$checked = ' checked="checked"';
 					}
--- a/common/css/rhymix.less
+++ b/common/css/rhymix.less
@ -33,6 +33,10 @@ a img {
 	.word_break(@default_word_break);
 	p {
 		margin: 0 0 @default_paragraph_spacing 0;
+		line-height: @default_line_height;
+		span {
+			line-height: @default_line_height;
+		}
 	}
 	img {
 		max-width: 100%;
--- a/common/defaults/config.php
+++ b/common/defaults/config.php
@ -56,6 +56,7 @@ return array(
 		'use_db' => false,
 		'use_keys' => false,
 		'use_ssl' => false,
+		'use_ssl_cookies' => false,
 		'domain' => null,
 		'path' => null,
 		'lifetime' => 0,
--- a/common/defaults/whitelist.php
+++ b/common/defaults/whitelist.php
@ -78,5 +78,7 @@ return array(
 		'player.vimeo.com/',
 		// Afreeca
 		'afree.ca/',
+		// Soundcloud
+		'w.soundcloud.com/',
 	),
 );
--- a/common/framework/url.php
+++ b/common/framework/url.php
@ -18,7 +18,8 @@ class URL
 	 */
 	public static function getCurrentURL(array $changes = array())
 	{
-		$url = self::getCurrentDomainURL(isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '/');
+		$request_uri = preg_replace('/[<>"]/', '', isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '/');
+		$url = self::getCurrentDomainURL($request_uri);
 		if (count($changes))
 		{
 			return self::modifyURL($url, $changes);
--- a/common/legacy.php
+++ b/common/legacy.php
@ -917,7 +917,7 @@ function getScriptPath()
 */
 function getRequestUriByServerEnviroment()
 {
-	return escape($_SERVER['REQUEST_URI']);
+	return preg_replace('/[<>"]/', '', $_SERVER['REQUEST_URI']);
 }

 /**
--- a/modules/admin/admin.admin.controller.php
+++ b/modules/admin/admin.admin.controller.php
@ -726,6 +726,9 @@ class adminAdminController extends admin
 		
 		Rhymix\Framework\Config::set('admin.allow', array_values($allowed_ip));
 		Rhymix\Framework\Config::set('admin.deny', array_values($denied_ip));
+		Rhymix\Framework\Config::set('session.use_keys', $vars->use_session_keys === 'Y');
+		Rhymix\Framework\Config::set('session.use_ssl', $vars->use_session_ssl === 'Y');
+		Rhymix\Framework\Config::set('session.use_ssl_cookies', $vars->use_cookies_ssl === 'Y');
 		
 		// Save
 		if (!Rhymix\Framework\Config::save())
@ -824,8 +827,6 @@ class adminAdminController extends admin
 		Rhymix\Framework\Config::set('use_rewrite', $vars->use_rewrite === 'Y');
 		Rhymix\Framework\Config::set('session.delay', $vars->delay_session === 'Y');
 		Rhymix\Framework\Config::set('session.use_db', $vars->use_db_session === 'Y');
-		Rhymix\Framework\Config::set('session.use_keys', $vars->use_session_keys === 'Y');
-		Rhymix\Framework\Config::set('session.use_ssl', $vars->use_session_ssl === 'Y');
 		Rhymix\Framework\Config::set('view.minify_scripts', $vars->minify_scripts ?: 'common');
 		Rhymix\Framework\Config::set('view.concat_scripts', $vars->concat_scripts ?: 'none');
 		Rhymix\Framework\Config::set('view.server_push', $vars->use_server_push === 'Y');
--- a/modules/admin/admin.admin.view.php
+++ b/modules/admin/admin.admin.view.php
@ -450,6 +450,11 @@ class adminAdminView extends admin
 		Context::set('admin_denied_ip', implode(PHP_EOL, $denied_ip));
 		Context::set('remote_addr', RX_CLIENT_IP);
 		
+		// Session and cookie security settings
+		Context::set('use_session_keys', Rhymix\Framework\Config::get('session.use_keys'));
+		Context::set('use_session_ssl', Rhymix\Framework\Config::get('session.use_ssl'));
+		Context::set('use_cookies_ssl', Rhymix\Framework\Config::get('session.use_ssl_cookies'));
+		
 		$this->setTemplateFile('config_security');
 	}
 	
@ -538,8 +543,6 @@ class adminAdminView extends admin
 		Context::set('mobile_viewport', config('mobile.viewport') ?: 'width=device-width, initial-scale=1.0, user-scalable=yes');
 		Context::set('use_ssl', Rhymix\Framework\Config::get('url.ssl'));
 		Context::set('delay_session', Rhymix\Framework\Config::get('session.delay'));
-		Context::set('use_session_keys', Rhymix\Framework\Config::get('session.use_keys'));
-		Context::set('use_session_ssl', Rhymix\Framework\Config::get('session.use_ssl'));
 		Context::set('use_db_session', Rhymix\Framework\Config::get('session.use_db'));
 		Context::set('minify_scripts', Rhymix\Framework\Config::get('view.minify_scripts'));
 		Context::set('concat_scripts', Rhymix\Framework\Config::get('view.concat_scripts'));
@ -779,6 +782,7 @@ class adminAdminView extends admin
 		$info['session.use_db'] = config('session.use_db') ? 'true' : 'false';
 		$info['session.use_keys'] = config('session.use_keys') ? 'true' : 'false';
 		$info['session.use_ssl'] = config('session.use_ssl') ? 'true' : 'false';
+		$info['session.use_ssl_cookies'] = config('session.use_ssl_cookies') ? 'true' : 'false';
 		$info['view.concat_scripts'] = config('view.concat_scripts');
 		$info['view.minify_scripts'] = config('view.minify_scripts');
 		$info['use_rewrite'] = config('use_rewrite') ? 'true' : 'false';
--- a/modules/admin/lang/en.php
+++ b/modules/admin/lang/en.php
@ -162,7 +162,9 @@ $lang->about_delay_session = 'To improve performance when using a caching proxy
 $lang->use_session_keys = 'Use session security keys';
 $lang->about_use_session_keys = 'Use additional security keys to guard against session theft. This setting is highly recommended if you don\'t use SSL-only sessions.<br>This setting may cause some users to become logged out.';
 $lang->use_session_ssl = 'Use SSL-only session';
-$lang->about_use_session_ssl = 'Prevent the session from being used on non-SSL pages.<br>This helps improve security if your site always uses SSL and your server is configured to redirect all non-SSL pages to SSL.';
+$lang->about_use_session_ssl = 'Force the session to be SSL-only.<br>This helps improve security if your site always uses SSL.';
+$lang->use_cookies_ssl = 'Use SSL-only cookies';
+$lang->about_use_cookies_ssl = 'Force all cookies to be SSL-only.';
 $lang->use_object_cache = 'Use Cache';
 $lang->cache_default_ttl = 'Cache default TTL';
 $lang->cache_host = 'Host';
--- a/modules/admin/lang/ko.php
+++ b/modules/admin/lang/ko.php
@ -163,7 +163,9 @@ $lang->about_delay_session = 'Varnish 등의 프록시 캐싱 서버 사용시
 $lang->use_session_keys = '세션 보안키 사용';
 $lang->about_use_session_keys = '세션 탈취를 방지하기 위한 보안키를 사용합니다. SSL 전용 세션을 사용하지 않을 경우 반드시 보안키를 사용하시기를 권장합니다.<br>사용자 환경에 따라 로그인이 풀리는 문제가 발생할 수 있습니다.';
 $lang->use_session_ssl = 'SSL 전용 세션 사용';
-$lang->about_use_session_ssl = '세션을 SSL 전용으로 지정하여 SSL이 아닌 페이지에서 사용할 수 없도록 합니다.<br>SSL을 항상 사용하고, SSL이 아닌 페이지 방문시 자동으로 SSL 페이지로 리다이렉트되도록 서버가 설정되어 있는 경우<br>이 옵션을 사용하면 보안이 향상됩니다. (애드온 등을 사용하여 리다이렉트하는 경우 제외)';
+$lang->about_use_session_ssl = '세션을 SSL 전용으로 지정하여 SSL이 아닌 페이지에서는 사용할 수 없도록 합니다.<br>SSL을 항상 사용하도록 설정되어 있는 경우에만 활성화됩니다.';
+$lang->use_cookies_ssl = 'SSL 전용 쿠키 사용';
+$lang->about_use_cookies_ssl = '세션뿐 아니라 모든 쿠키를 SSL 전용으로 지정합니다.<br>SSL을 항상 사용하도록 설정되어 있는 경우에만 활성화됩니다.';
 $lang->use_object_cache = '캐시 사용';
 $lang->cache_default_ttl = '캐시 기본 TTL';
 $lang->cache_host = '호스트';
--- a/modules/admin/tpl/config_advanced.html
+++ b/modules/admin/tpl/config_advanced.html
@ -105,24 +105,6 @@
 				<p class="x_help-block">{$lang->about_delay_session}</p>
 			</div>
 		</div>
-		<div class="x_control-group">
-			<label class="x_control-label">{$lang->use_session_keys}</label>
-			<div class="x_controls">
-				<label for="use_session_keys_y" class="x_inline"><input type="radio" name="use_session_keys" id="use_session_keys_y" value="Y" checked="checked"|cond="$use_session_keys !== false" /> {$lang->cmd_yes}</label>
-				<label for="use_session_keys_n" class="x_inline"><input type="radio" name="use_session_keys" id="use_session_keys_n" value="N" checked="checked"|cond="$use_session_keys === false" /> {$lang->cmd_no}</label>
-				<br />
-				<p class="x_help-block">{$lang->about_use_session_keys}</p>
-			</div>
-		</div>
-		<div class="x_control-group">
-			<label class="x_control-label">{$lang->use_session_ssl}</label>
-			<div class="x_controls">
-				<label for="use_session_ssl_y" class="x_inline"><input type="radio" name="use_session_ssl" id="use_session_ssl_y" value="Y" checked="checked"|cond="$use_session_ssl && $use_ssl === 'always'" disabled="disabled"|cond="$use_ssl !== 'always'" /> {$lang->cmd_yes}</label>
-				<label for="use_session_ssl_n" class="x_inline"><input type="radio" name="use_session_ssl" id="use_session_ssl_n" value="N" checked="checked"|cond="!$use_session_ssl || $use_ssl !== 'always'" disabled="disabled"|cond="$use_ssl !== 'always'" /> {$lang->cmd_no}</label>
-				<br />
-				<p class="x_help-block">{$lang->about_use_session_ssl}</p>
-			</div>
-		</div>
 		<div class="x_control-group">
 			<label class="x_control-label">{$lang->thumbnail_target}</label>
 			<div class="x_controls">
--- a/modules/admin/tpl/config_security.html
+++ b/modules/admin/tpl/config_security.html
@ -39,6 +39,33 @@
 				<p class="x_help-block">{$lang->about_admin_ip_deny}</p>
 			</div>
 		</div>
+		<div class="x_control-group">
+			<label class="x_control-label">{$lang->use_session_keys}</label>
+			<div class="x_controls">
+				<label for="use_session_keys_y" class="x_inline"><input type="radio" name="use_session_keys" id="use_session_keys_y" value="Y" checked="checked"|cond="$use_session_keys !== false" /> {$lang->cmd_yes}</label>
+				<label for="use_session_keys_n" class="x_inline"><input type="radio" name="use_session_keys" id="use_session_keys_n" value="N" checked="checked"|cond="$use_session_keys === false" /> {$lang->cmd_no}</label>
+				<br />
+				<p class="x_help-block">{$lang->about_use_session_keys}</p>
+			</div>
+		</div>
+		<div class="x_control-group">
+			<label class="x_control-label">{$lang->use_session_ssl}</label>
+			<div class="x_controls">
+				<label for="use_session_ssl_y" class="x_inline"><input type="radio" name="use_session_ssl" id="use_session_ssl_y" value="Y" checked="checked"|cond="$use_session_ssl && $use_ssl === 'always'" disabled="disabled"|cond="$use_ssl !== 'always'" /> {$lang->cmd_yes}</label>
+				<label for="use_session_ssl_n" class="x_inline"><input type="radio" name="use_session_ssl" id="use_session_ssl_n" value="N" checked="checked"|cond="!$use_session_ssl || $use_ssl !== 'always'" disabled="disabled"|cond="$use_ssl !== 'always'" /> {$lang->cmd_no}</label>
+				<br />
+				<p class="x_help-block">{$lang->about_use_session_ssl}</p>
+			</div>
+		</div>
+		<div class="x_control-group">
+			<label class="x_control-label">{$lang->use_cookies_ssl}</label>
+			<div class="x_controls">
+				<label for="use_cookies_ssl_y" class="x_inline"><input type="radio" name="use_cookies_ssl" id="use_cookies_ssl_y" value="Y" checked="checked"|cond="$use_cookies_ssl && $use_ssl === 'always'" disabled="disabled"|cond="$use_ssl !== 'always'" /> {$lang->cmd_yes}</label>
+				<label for="use_cookies_ssl_n" class="x_inline"><input type="radio" name="use_cookies_ssl" id="use_cookies_ssl_n" value="N" checked="checked"|cond="!$use_cookies_ssl || $use_ssl !== 'always'" disabled="disabled"|cond="$use_ssl !== 'always'" /> {$lang->cmd_no}</label>
+				<br />
+				<p class="x_help-block">{$lang->about_use_cookies_ssl}</p>
+			</div>
+		</div>
 		<div class="x_clearfix btnArea">
 			<div class="x_pull-right">
 				<button type="submit" class="x_btn x_btn-primary">{$lang->cmd_save}</button>
--- a/modules/board/skins/default/_comment.html
+++ b/modules/board/skins/default/_comment.html
@ -15,7 +15,11 @@
 				</h3>
 				<p class="time">{$comment->getRegdate('Y.m.d H:i')}</p>
 			</div>
-			<!--@if(!$comment->isAccessible())-->
+			<!--@if($comment->status == RX_STATUS_DELETED)-->
+				<div class="xe_content deleted">{$lang->msg_deleted_comment}</div>
+			<!--@elseif($comment->status == RX_STATUS_DELETED_BY_ADMIN)-->
+				<div class="xe_content deleted deleted_by_admin">{$lang->msg_admin_deleted_comment}</div>
+			<!--@elseif(!$comment->isAccessible())-->
 			<form action="./" method="get" class="xe_content" onsubmit="return procFilter(this, input_password)">
 				<p><label for="cpw_{$comment->comment_srl}">{$lang->msg_is_secret} {$lang->msg_input_password}</label></p>
 				<p><input type="password" name="password" id="cpw_{$comment->comment_srl}" class="iText" /><input type="submit" class="btn" value="{$lang->cmd_input}" /></p>
@ -25,14 +29,7 @@
 				<input type="hidden" name="comment_srl" value="{$comment->get('comment_srl')}" />
 			</form>
 			<!--@else-->
-				<!--@if($comment->status == 7)-->
-				{$lang->msg_deleted_comment}
-				<!--@elseif($comment->status == 8)-->
-				{$lang->msg_admin_deleted_comment}
-				<!--@end-->
-				<block cond="$comment->status < 7">
-					{$comment->getContent(false)}
-				</block>
+				{$comment->getContent(false)}
 			<!--@end-->
 			<div cond="$comment->hasUploadedFiles()" class="fileList">
 				<button type="button" class="toggleFile" onclick="jQuery(this).next('ul.files').toggle();">{$lang->uploaded_file} [<strong>{$comment->get('uploaded_count')}</strong>]</button>
--- a/modules/board/skins/xedition/_comment.html
+++ b/modules/board/skins/xedition/_comment.html
@ -15,7 +15,11 @@
 				</h3>
 				<p class="time">{$comment->getRegdate('Y.m.d H:i')}</p>
 			</div>
-			<!--@if(!$comment->isAccessible())-->
+			<!--@if($comment->status == RX_STATUS_DELETED)-->
+				<div class="xe_content deleted">{$lang->msg_deleted_comment}</div>
+			<!--@elseif($comment->status == RX_STATUS_DELETED_BY_ADMIN)-->
+				<div class="xe_content deleted deleted_by_admin">{$lang->msg_admin_deleted_comment}</div>
+			<!--@elseif(!$comment->isAccessible())-->
 			<form action="./" method="get" class="xe_content secretForm" onsubmit="return procFilter(this, input_password)">
 				<p><label for="cpw_{$comment->comment_srl}">{$lang->msg_is_secret} {$lang->msg_input_password}</label></p>
 				<p><input type="password" name="password" id="cpw_{$comment->comment_srl}" class="iText" /><input type="submit" class="btn" value="{$lang->cmd_input}" /></p>
@ -25,7 +29,7 @@
 				<input type="hidden" name="comment_srl" value="{$comment->get('comment_srl')}" />
 			</form>
 			<!--@else-->
-			{$comment->getContent(false)}
+				{$comment->getContent(false)}
 			<!--@end-->
 			<div cond="$comment->hasUploadedFiles()" class="fileList">
 				<button type="button" class="toggleFile" onclick="jQuery(this).next('ul.files').toggle();"><i class="xi-diskette"></i> {$lang->uploaded_file} [<strong>{$comment->get('uploaded_count')}</strong>]</button>
--- a/modules/document/document.model.php
+++ b/modules/document/document.model.php
@ -81,7 +81,7 @@ class documentModel extends document
 		$output = $this->getDocumentExtraVarsFromDB($document_srls);
 		foreach($output->data as $key => $val)
 		{
-			if(!$val->value)
+			if(strval($val->value) === '')
 			{
 				continue;
 			}
--- a/modules/page/page.view.php
+++ b/modules/page/page.view.php
@ -204,17 +204,32 @@ class pageView extends page
 			FileHandler::writeFile($cache_file, $script);
 		}

+		// Import Context and lang as local variables.
 		$__Context = &$GLOBALS['__Context__'];
 		$__Context->tpl_path = $filepath;
+		global $lang;

+		// Start the output buffer.
+		$__ob_level_before_fetch = ob_get_level();
 		ob_start();
-		include($cache_file);
+		
+		// Include the compiled template.
+		include $cache_file;

+		// Fetch contents of the output buffer until the buffer level is the same as before.
 		$contents = '';
-		while (ob_get_level() - $level > 0) {
-			$contents .= ob_get_contents();
-			ob_end_clean();
+		while (ob_get_level() > $__ob_level_before_fetch)
+		{
+			$contents .= ob_get_clean();
 		}
+		
+		// Insert template path comment tag.
+		if(Rhymix\Framework\Debug::isEnabledForCurrentUser() && Context::getResponseMethod() === 'HTML' && !starts_with('<!DOCTYPE', $contents) && !starts_with('<?xml', $contents))
+		{
+			$sign = PHP_EOL . '<!-- Template %s : ' . $target_file . ' -->' . PHP_EOL;
+			$contents = sprintf($sign, 'start') . $contents . sprintf($sign, 'end');
+		}
+		
 		return $contents;
 	}

--- a/tests/unit/framework/URLTest.php
+++ b/tests/unit/framework/URLTest.php
@ -9,7 +9,7 @@ class URLTest extends \Codeception\TestCase\Test
 		
 		// Getting the current URL
 		$this->assertEquals('https://www.rhymix.org/rhymix/index.php?foo=bar&xe=sucks', Rhymix\Framework\URL::getCurrentURL());
-		
+
 		// Adding items to the query string
 		$this->assertEquals('https://www.rhymix.org/rhymix/index.php?foo=bar&xe=sucks&var=1&arr%5B0%5D=2&arr%5B1%5D=3', Rhymix\Framework\URL::getCurrentURL(array('var' => '1', 'arr' => array(2, 3))));
 		
@ -22,6 +22,13 @@ class URLTest extends \Codeception\TestCase\Test
 		// Adding and removing parameters at the same time
 		$this->assertEquals('https://www.rhymix.org/rhymix/index.php?xe=sucks&l=ko', Rhymix\Framework\URL::getCurrentURL(array('l' => 'ko', 'foo' => null)));
 		
+		// Removing invalid characters in the current URL
+		$_SERVER['REQUEST_URI'] = '/rhymix/?foo="bar"';
+		$this->assertEquals('https://www.rhymix.org/rhymix/?foo=bar', Rhymix\Framework\URL::getCurrentURL());
+		$_SERVER['REQUEST_URI'] = '/rhymix/?foo=<bar&baz=rhymix>';
+		$this->assertEquals('https://www.rhymix.org/rhymix/?foo=bar&baz=rhymix', Rhymix\Framework\URL::getCurrentURL());
+		$this->assertEquals('https://www.rhymix.org/rhymix/?baz=rhymix&l=ko', Rhymix\Framework\URL::getCurrentURL(array('l' => 'ko', 'foo' => null)));
+		
 		$_SERVER['REQUEST_URI'] = $old_request_uri;
 	}