diff -ur drupal-5.11/CHANGELOG.txt drupal-5.12/CHANGELOG.txt
--- drupal-5.11/CHANGELOG.txt	2008-10-09 07:10:25.000000000 +1100
+++ drupal-5.12/CHANGELOG.txt	2008-10-23 06:25:27.000000000 +1100
@@ -1,4 +1,9 @@
-// $Id: CHANGELOG.txt,v 1.173.2.27 2008/10/08 20:10:25 drumm Exp $
+// $Id: CHANGELOG.txt,v 1.173.2.29 2008/10/22 19:25:27 drumm Exp $
+
+Drupal 5.12, 2008-10-22
+-----------------------
+- fixed security issues, (File inclusion), see SA-2008-067
+
 
 Drupal 5.11, 2008-10-08
 -----------------------
diff -ur drupal-5.11/includes/bootstrap.inc drupal-5.12/includes/bootstrap.inc
--- drupal-5.11/includes/bootstrap.inc	2008-08-24 19:00:25.000000000 +1000
+++ drupal-5.12/includes/bootstrap.inc	2008-10-23 06:25:28.000000000 +1100
@@ -1,5 +1,5 @@
 <?php
-// $Id: bootstrap.inc,v 1.145.2.9 2008/08/24 09:00:25 drumm Exp $
+// $Id: bootstrap.inc,v 1.145.2.10 2008/10/22 19:25:28 drumm Exp $
 
 /**
  * @file
@@ -201,6 +201,11 @@
 
   $confdir = 'sites';
   $uri = explode('/', $_SERVER['SCRIPT_NAME'] ? $_SERVER['SCRIPT_NAME'] : $_SERVER['SCRIPT_FILENAME']);
+  if (strpos($_SERVER['HTTP_HOST'], '/') !== FALSE) {
+    // A HTTP_HOST containing slashes may be an attack and is invalid.
+    header('HTTP/1.1 400 Bad Request');
+    exit;
+  }
   $server = explode('.', implode('.', array_reverse(explode(':', rtrim($_SERVER['HTTP_HOST'], '.')))));
   for ($i = count($uri) - 1; $i > 0; $i--) {
     for ($j = count($server); $j > 0; $j--) {
diff -ur drupal-5.11/modules/aggregator/aggregator.info drupal-5.12/modules/aggregator/aggregator.info
--- drupal-5.11/modules/aggregator/aggregator.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/aggregator/aggregator.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/block/block.info drupal-5.12/modules/block/block.info
--- drupal-5.11/modules/block/block.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/block/block.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - required
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/blog/blog.info drupal-5.12/modules/blog/blog.info
--- drupal-5.11/modules/blog/blog.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/blog/blog.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/blogapi/blogapi.info drupal-5.12/modules/blogapi/blogapi.info
--- drupal-5.11/modules/blogapi/blogapi.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/blogapi/blogapi.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/book/book.info drupal-5.12/modules/book/book.info
--- drupal-5.11/modules/book/book.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/book/book.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/color/color.info drupal-5.12/modules/color/color.info
--- drupal-5.11/modules/color/color.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/color/color.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/comment/comment.info drupal-5.12/modules/comment/comment.info
--- drupal-5.11/modules/comment/comment.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/comment/comment.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/contact/contact.info drupal-5.12/modules/contact/contact.info
--- drupal-5.11/modules/contact/contact.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/contact/contact.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/drupal/drupal.info drupal-5.12/modules/drupal/drupal.info
--- drupal-5.11/modules/drupal/drupal.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/drupal/drupal.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/filter/filter.info drupal-5.12/modules/filter/filter.info
--- drupal-5.11/modules/filter/filter.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/filter/filter.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - required
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/forum/forum.info drupal-5.12/modules/forum/forum.info
--- drupal-5.11/modules/forum/forum.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/forum/forum.info	2008-10-23 06:30:13.000000000 +1100
@@ -5,8 +5,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/help/help.info drupal-5.12/modules/help/help.info
--- drupal-5.11/modules/help/help.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/help/help.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/legacy/legacy.info drupal-5.12/modules/legacy/legacy.info
--- drupal-5.11/modules/legacy/legacy.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/legacy/legacy.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/locale/locale.info drupal-5.12/modules/locale/locale.info
--- drupal-5.11/modules/locale/locale.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/locale/locale.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/menu/menu.info drupal-5.12/modules/menu/menu.info
--- drupal-5.11/modules/menu/menu.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/menu/menu.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/node/node.info drupal-5.12/modules/node/node.info
--- drupal-5.11/modules/node/node.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/node/node.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - required
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/path/path.info drupal-5.12/modules/path/path.info
--- drupal-5.11/modules/path/path.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/path/path.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/ping/ping.info drupal-5.12/modules/ping/ping.info
--- drupal-5.11/modules/ping/ping.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/ping/ping.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/poll/poll.info drupal-5.12/modules/poll/poll.info
--- drupal-5.11/modules/poll/poll.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/poll/poll.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/profile/profile.info drupal-5.12/modules/profile/profile.info
--- drupal-5.11/modules/profile/profile.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/profile/profile.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/search/search.info drupal-5.12/modules/search/search.info
--- drupal-5.11/modules/search/search.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/search/search.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/statistics/statistics.info drupal-5.12/modules/statistics/statistics.info
--- drupal-5.11/modules/statistics/statistics.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/statistics/statistics.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/system/system.info drupal-5.12/modules/system/system.info
--- drupal-5.11/modules/system/system.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/system/system.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - required
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/system/system.module drupal-5.12/modules/system/system.module
--- drupal-5.11/modules/system/system.module	2008-10-09 07:10:26.000000000 +1100
+++ drupal-5.12/modules/system/system.module	2008-10-23 06:25:28.000000000 +1100
@@ -1,12 +1,12 @@
 <?php
-// $Id: system.module,v 1.440.2.37 2008/10/08 20:10:26 drumm Exp $
+// $Id: system.module,v 1.440.2.39 2008/10/22 19:25:28 drumm Exp $
 
 /**
  * @file
  * Configuration system that lets administrators modify the workings of the site.
  */
 
-define('VERSION', '5.11');
+define('VERSION', '5.12');
 
 /**
  * Implementation of hook_help().
diff -ur drupal-5.11/modules/taxonomy/taxonomy.info drupal-5.12/modules/taxonomy/taxonomy.info
--- drupal-5.11/modules/taxonomy/taxonomy.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/taxonomy/taxonomy.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/throttle/throttle.info drupal-5.12/modules/throttle/throttle.info
--- drupal-5.11/modules/throttle/throttle.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/throttle/throttle.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/tracker/tracker.info drupal-5.12/modules/tracker/tracker.info
--- drupal-5.11/modules/tracker/tracker.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/tracker/tracker.info	2008-10-23 06:30:13.000000000 +1100
@@ -5,8 +5,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/upload/upload.info drupal-5.12/modules/upload/upload.info
--- drupal-5.11/modules/upload/upload.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/upload/upload.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - optional
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/user/user.info drupal-5.12/modules/user/user.info
--- drupal-5.11/modules/user/user.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/user/user.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - required
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"
 
diff -ur drupal-5.11/modules/watchdog/watchdog.info drupal-5.12/modules/watchdog/watchdog.info
--- drupal-5.11/modules/watchdog/watchdog.info	2008-10-09 07:15:09.000000000 +1100
+++ drupal-5.12/modules/watchdog/watchdog.info	2008-10-23 06:30:13.000000000 +1100
@@ -4,8 +4,8 @@
 package = Core - required
 version = VERSION
 
-; Information added by drupal.org packaging script on 2008-10-08
-version = "5.11"
+; Information added by drupal.org packaging script on 2008-10-22
+version = "5.12"
 project = "drupal"
-datestamp = "1223496909"
+datestamp = "1224703813"