6 files changed, 600 insertions, 41 deletions
diff --git a/phpBB/includes/acp/acp_ban.php b/phpBB/includes/acp/acp_ban.php
new file mode 100644
index 0000000000..acef324c42
--- /dev/null
+++ b/phpBB/includes/acp/acp_ban.php
@@ -0,0 +1,214 @@
+<?php
+/** 
+*
+* @package acp
+* @version $Id$
+* @copyright (c) 2005 phpBB Group 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+*
+*/
+
+/**
+* @package acp
+*/
+class acp_ban
+{
+	function main($id, $mode)
+	{
+		global $config, $db, $user, $auth, $template, $cache;
+		global $SID, $phpbb_root_path, $phpbb_admin_path, $phpEx, $table_prefix;
+
+		include($phpbb_root_path . 'includes/functions_user.' . $phpEx);
+
+		$bansubmit	= (isset($_POST['bansubmit'])) ? true : false;
+		$unbansubmit= (isset($_POST['unbansubmit'])) ? true : false;
+		$current_time = time();
+
+		$user->add_lang('acp/ban');
+		$this->tpl_name = 'acp_ban';
+
+		$u_action = "{$phpbb_admin_path}index.$phpEx$SID&amp;i=$id&amp;mode=$mode";
+
+		// Ban submitted?
+		if ($bansubmit)
+		{
+			// Grab the list of entries
+			$ban				= request_var('ban', '');
+			$ban_len			= request_var('banlength', 0);
+			$ban_len_other		= request_var('banlengthother', '');
+			$ban_exclude		= request_var('banexclude', 0);
+			$ban_reason			= request_var('banreason', '');
+			$ban_give_reason	= request_var('bangivereason', '');
+
+			user_ban($mode, $ban, $ban_len, $ban_len_other, $ban_exclude, $ban_reason, $ban_give_reason);
+
+			trigger_error($user->lang['BAN_UPDATE_SUCESSFUL'] . adm_back_link($u_action));
+		}
+		else if ($unbansubmit)
+		{
+			$ban = request_var('unban', array(''));
+
+			user_unban($mode, $ban);
+
+			trigger_error($user->lang['BAN_UPDATE_SUCESSFUL'] . adm_back_link($u_action));
+		}
+
+		// Ban length options
+		$ban_end_text = array(0 => $user->lang['PERMANENT'], 30 => $user->lang['30_MINS'], 60 => $user->lang['1_HOUR'], 360 => $user->lang['6_HOURS'], 1440 => $user->lang['1_DAY'], 10080 => $user->lang['7_DAYS'], 20160 => $user->lang['2_WEEKS'], 40320 => $user->lang['1_MONTH'], -1 => $user->lang['UNTIL'] . ' -&gt; ');
+
+		$ban_end_options = '';
+		foreach ($ban_end_text as $length => $text)
+		{
+			$ban_end_options .= '<option value="' . $length . '">' . $text . '</option>';
+		}
+
+		// Define language vars
+		$this->page_title = $user->lang[strtoupper($mode) . '_BAN'];
+
+		$l_ban_explain = $user->lang[strtoupper($mode) . '_BAN_EXPLAIN'];
+		$l_ban_exclude_explain = $user->lang[strtoupper($mode) . '_BAN_EXCLUDE_EXPLAIN'];
+		$l_unban_title = $user->lang[strtoupper($mode) . '_UNBAN'];
+		$l_unban_explain = $user->lang[strtoupper($mode) . '_UNBAN_EXPLAIN'];
+		$l_no_ban_cell = $user->lang[strtoupper($mode) . '_NO_BANNED'];
+
+		switch ($mode)
+		{
+			case 'user':
+
+				$field = 'username';
+				$l_ban_cell = $user->lang['USERNAME'];
+
+				$sql = 'SELECT b.*, u.user_id, u.username
+					FROM ' . BANLIST_TABLE . ' b, ' . USERS_TABLE . ' u
+					WHERE (b.ban_end >= ' . time() . '
+							OR b.ban_end = 0)
+						AND u.user_id = b.ban_userid
+						AND b.ban_userid <> 0
+						AND u.user_id <> ' . ANONYMOUS . '
+					ORDER BY u.user_id ASC';
+			break;
+
+			case 'ip':
+
+				$field = 'ban_ip';
+				$l_ban_cell = $user->lang['IP_HOSTNAME'];
+
+				$sql = 'SELECT *
+					FROM ' . BANLIST_TABLE . '
+					WHERE (ban_end >= ' . time() . "
+							OR ban_end = 0)
+						AND ban_ip <> ''";
+			break;
+
+			case 'email':
+
+				$field = 'ban_email';
+				$l_ban_cell = $user->lang['EMAIL_ADDRESS'];
+
+				$sql = 'SELECT *
+					FROM ' . BANLIST_TABLE . '
+					WHERE (ban_end >= ' . time() . "
+							OR ban_end = 0)
+						AND ban_email <> ''";
+			break;
+		}
+		$result = $db->sql_query($sql);
+
+		$banned_options = '';
+		$ban_length = $ban_reasons = $ban_give_reasons = array();
+
+		while ($row = $db->sql_fetchrow($result))
+		{
+			$banned_options .=  '<option' . (($row['ban_exclude']) ? ' class="sep"' : '') . ' value="' . $row['ban_id'] . '">' . $row[$field] . '</option>';
+
+			$time_length = ($row['ban_end']) ? ($row['ban_end'] - $row['ban_start']) / 60 : 0;
+			$ban_length[$row['ban_id']] = (isset($ban_end_text[$time_length])) ? $ban_end_text[$time_length] : $user->lang['UNTIL'] . ' -> ' . $user->format_date($row['ban_end']);
+
+			$ban_reasons[$row['ban_id']] = $row['ban_reason'];
+			$ban_give_reasons[$row['ban_id']] = $row['ban_give_reason'];
+		}
+		$db->sql_freeresult($result);
+
+		if (sizeof($ban_length))
+		{
+			foreach ($ban_length as $ban_id => $length)
+			{
+				$template->assign_block_vars('ban_length', array(
+					'BAN_ID'	=> $ban_id,
+					'LENGTH'	=> $length)
+				);
+			}
+		}
+
+		if (sizeof($ban_reasons))
+		{
+			foreach ($ban_reasons as $ban_id => $reason)
+			{
+				$template->assign_block_vars('ban_reason', array(
+					'BAN_ID'	=> $ban_id,
+					'REASON'	=> addslashes(html_entity_decode($reason)))
+				);
+			}
+		}
+
+		if (sizeof($ban_give_reasons))
+		{
+			foreach ($ban_give_reasons as $ban_id => $reason)
+			{
+				$template->assign_block_vars('ban_give_reason', array(
+					'BAN_ID'	=> $ban_id,
+					'REASON'	=> addslashes(html_entity_decode($reason)))
+				);
+			}
+		}
+
+		$template->assign_vars(array(
+			'L_TITLE'				=> $this->page_title,
+			'L_EXPLAIN'				=> $l_ban_explain,
+			'L_UNBAN_TITLE'			=> $l_unban_title,
+			'L_UNBAN_EXPLAIN'		=> $l_unban_explain,
+			'L_BAN_CELL'			=> $l_ban_cell,
+			'L_BAN_EXCLUDE_EXPLAIN'	=> $l_ban_exclude_explain,
+			'L_NO_BAN_CELL'			=> $l_no_ban_cell,
+
+			'S_USERNAME_BAN'	=> ($mode == 'user') ? true : false,
+			'S_BAN_END_OPTIONS'	=> $ban_end_options,
+			'S_BANNED_OPTIONS'	=> ($banned_options) ? true : false,
+			'BANNED_OPTIONS'	=> $banned_options,
+			
+			'U_ACTION'			=> $u_action,
+			'U_FIND_USER'		=> $phpbb_root_path . "memberlist.$phpEx$SID&amp;mode=searchuser&amp;form=acp_ban&amp;field=ban",
+			)
+		);
+	}
+}
+
+/**
+* @package module_install
+*/
+class acp_ban_info
+{
+	function module()
+	{
+		return array(
+			'filename'	=> 'acp_ban',
+			'title'		=> 'ACP_BAN',
+			'version'	=> '1.0.0',
+			'modes'		=> array(
+				'email'		=> array('title' => 'ACP_BAN_EMAILS', 'auth' => 'acl_a_ban'),
+				'ip'		=> array('title' => 'ACP_BAN_IPS', 'auth' => 'acl_a_ban'),
+				'user'		=> array('title' => 'ACP_BAN_USERNAMES', 'auth' => 'acl_a_ban'),
+			),
+		);
+	}
+
+	function install()
+	{
+	}
+
+	function uninstall()
+	{
+	}
+}
+
+?>
+\ No newline at end of file
diff --git a/phpBB/includes/acp/acp_disallow.php b/phpBB/includes/acp/acp_disallow.php
new file mode 100644
index 0000000000..5d0e3fd787
--- /dev/null
+++ b/phpBB/includes/acp/acp_disallow.php
@@ -0,0 +1,114 @@
+<?php
+/** 
+*
+* @package acp
+* @version $Id$
+* @copyright (c) 2005 phpBB Group 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+*
+*/
+
+/**
+* @package acp
+*/
+class acp_disallow
+{
+	function main($id, $mode)
+	{
+		global $db, $user, $auth, $template, $cache;
+		global $config, $SID, $phpbb_root_path, $phpbb_admin_path, $phpEx;
+
+		include($phpbb_root_path . 'includes/functions_user.' . $phpEx);
+
+		$user->add_lang('acp/posting');
+
+		// Set up general vars
+		$this->tpl_name = 'acp_disallow';
+		$this->page_header = 'ACP_DISALLOW_USERNAMES';
+
+		$disallow = (isset($_POST['disallow'])) ? true : false;
+		$allow = (isset($_POST['allow'])) ? true : false;
+
+		$u_action = "{$phpbb_admin_path}index.$phpEx$SID&amp;i=$id&amp;mode=$mode";
+
+		if ($disallow)
+		{
+			$disallowed_user = str_replace('*', '%', request_var('disallowed_user', ''));
+			$message = validate_username($disallowed_user);
+
+			if (!$message)
+			{
+				$sql = 'INSERT INTO ' . DISALLOW_TABLE . ' ' . $db->sql_build_array('INSERT', array('disallow_username' => $disallowed_user));
+				$db->sql_query($sql);
+
+				$message = $user->lang['DISALLOW_SUCCESSFUL'];
+				add_log('admin', 'LOG_DISALLOW_ADD', str_replace('%', '*', $disallowed_user));
+			}
+
+			trigger_error($message . adm_back_link($u_action));
+		}
+		else if ($allow)
+		{
+			$disallowed_id = request_var('disallowed_id', 0);
+
+			if (!$disallowed_id)
+			{
+				trigger_error($user->lang['NO_USER'] . adm_back_link($u_action));
+			}
+
+			$sql = 'DELETE FROM ' . DISALLOW_TABLE . "
+				WHERE disallow_id = $disallowed_id";
+			$db->sql_query($sql);
+
+			add_log('admin', 'LOG_DISALLOW_DELETE');
+
+			trigger_error($user->lang['DISALLOWED_DELETED'] . adm_back_link($u_action));
+		}
+
+		// Grab the current list of disallowed usernames...
+		$sql = 'SELECT *
+			FROM ' . DISALLOW_TABLE;
+		$result = $db->sql_query($sql);
+
+		$disallow_select = '';
+		while ($row = $db->sql_fetchrow($result))
+		{
+			$disallow_select .= '<option value="' . $row['disallow_id'] . '">' . str_replace('%', '*', $row['disallow_username']) . '</option>';
+		}
+		$db->sql_freeresult($result);
+
+		$template->assign_vars(array(
+			'U_ACTION'				=> $u_action,
+			'S_DISALLOWED_NAMES'	=> $disallow_select)
+		);
+	}
+}
+
+/**
+* @package module_install
+*/
+class acp_disallow_info
+{
+	function module()
+	{
+		return array(
+			'filename'	=> 'acp_disallow',
+			'title'		=> 'ACP_DISALLOW',
+			'version'	=> '1.0.0',
+			'modes'		=> array(
+				'usernames'		=> array('title' => 'ACP_DISALLOW_USERNAMES', 'auth' => 'acl_a_names'),
+			),
+		);
+	}
+
+	function install()
+	{
+	}
+
+	function uninstall()
+	{
+	}
+}
+
+
+?>
+\ No newline at end of file
diff --git a/phpBB/includes/acp/acp_ranks.php b/phpBB/includes/acp/acp_ranks.php
new file mode 100644
index 0000000000..66c899d290
--- /dev/null
+++ b/phpBB/includes/acp/acp_ranks.php
@@ -0,0 +1,228 @@
+<?php
+/** 
+*
+* @package acp
+* @version $Id$
+* @copyright (c) 2005 phpBB Group 
+* @license http://opensource.org/licenses/gpl-license.php GNU Public License 
+*
+*/
+
+/**
+* @package acp
+*/
+class acp_ranks
+{
+	function main($id, $mode)
+	{
+		global $db, $user, $auth, $template, $cache;
+		global $config, $SID, $phpbb_root_path, $phpbb_admin_path, $phpEx;
+
+		$user->add_lang('acp/posting');
+
+		// Set up general vars
+		$action = request_var('action', '');
+		$action = (isset($_POST['add'])) ? 'add' : $action;
+		$action = (isset($_POST['save'])) ? 'save' : $action;
+		$rank_id = request_var('id', 0);
+
+		$this->tpl_name = 'acp_ranks';
+		$this->page_title = 'ACP_MANAGE_RANKS';
+
+		$u_action = "{$phpbb_admin_path}index.$phpEx$SID&amp;i=$id&amp;mode=$mode";
+
+		switch ($action)
+		{
+			case 'save':
+				
+				$rank_title = request_var('title', '');
+				$special_rank = request_var('special_rank', 0);
+				$min_posts = ($special_rank) ? -1 : request_var('min_posts', 0);
+				$rank_image = request_var('rank_image', '');
+
+				// The rank image has to be a jpg, gif or png
+				if ($rank_image != '' && !preg_match('#(\.gif|\.png|\.jpg|\.jpeg)$#i', $rank_image))
+				{
+					$rank_image = '';
+				}
+
+				if (!$rank_title)
+				{
+					trigger_error($user->lang['NO_RANK_TITLE'] . adm_back_link($u_action));
+				}
+
+				$sql_ary = array(
+					'rank_title'		=> $rank_title,
+					'rank_special'		=> $special_rank,
+					'rank_min'			=> $min_posts,
+					'rank_image'		=> html_entity_decode($rank_image)
+				);
+				
+				if ($rank_id)
+				{
+					$sql = 'UPDATE ' . RANKS_TABLE . ' SET ' . $db->sql_build_array('UPDATE', $sql_ary) . " WHERE rank_id = $rank_id";
+					$message = $user->lang['RANK_UPDATED'];
+				}
+				else
+				{
+					$sql = 'INSERT INTO ' . RANKS_TABLE . ' ' . $db->sql_build_array('INSERT', $sql_ary);
+					$message = $user->lang['RANK_ADDED'];
+				}
+				$db->sql_query($sql);
+
+				$cache->destroy('ranks');
+
+				trigger_error($message . adm_back_link($u_action));
+
+			break;
+
+			case 'delete':
+
+				// Ok, they want to delete their rank
+				if ($rank_id)
+				{
+					$sql = 'DELETE FROM ' . RANKS_TABLE . "
+						WHERE rank_id = $rank_id";
+					$db->sql_query($sql);
+
+					$sql = 'UPDATE ' . USERS_TABLE . "
+						SET user_rank = 0
+						WHERE user_rank = $rank_id";
+					$db->sql_query($sql);
+
+					$cache->destroy('ranks');
+
+					trigger_error($user->lang['RANK_REMOVED'] . adm_back_link($u_action));
+				}
+				else
+				{
+					trigger_error($user->lang['MUST_SELECT_RANK'] . adm_back_link($u_action));
+				}
+
+			break;
+
+			case 'edit':
+			case 'add':
+
+				$data = $ranks = $existing_imgs = array();
+				
+				$sql = 'SELECT * 
+					FROM ' . RANKS_TABLE . ' 
+					ORDER BY rank_min ASC, rank_special ASC';
+				$result = $db->sql_query($sql);
+
+				while ($row = $db->sql_fetchrow($result))
+				{
+					$existing_imgs[] = $row['rank_image'];
+
+					if ($action == 'edit' && $rank_id == $row['rank_id'])
+					{
+						$ranks = $row;
+					}
+				}
+				$db->sql_freeresult($result);
+
+				$imglist = filelist($phpbb_root_path . $config['ranks_path'], '');
+
+				$edit_img = $filename_list = '';
+
+				foreach ($imglist as $path => $img_ary)
+				{
+					foreach ($img_ary as $img)
+					{
+						$img = substr($path, 1) . (($path != '') ? '/' : '') . $img; 
+
+						if (!in_array($img, $existing_imgs) || $action == 'edit')
+						{
+							if ($ranks && $img == $ranks['rank_image'])
+							{
+								$selected = ' selected="selected"';
+								$edit_img = $img;
+							}
+							else
+							{
+								$selected = '';
+							}
+
+							$filename_list .= '<option value="' . htmlspecialchars($img) . '"' . $selected . '>' . $img . '</option>';
+						}
+					}
+				}
+
+				$filename_list = '<option value=""' . (($edit_img == '') ? ' selected="selected"' : '') . '>----------</option>' . $filename_list;
+				unset($existing_imgs, $imglist);
+
+				$template->assign_vars(array(
+					'S_EDIT'			=> true,
+					'U_BACK'			=> $u_action,
+					'RANKS_PATH'		=> $phpbb_root_path . $config['ranks_path'],
+					'U_ACTION'			=> $u_action . '&amp;id=' . $rank_id,
+
+					'RANK_TITLE'		=> (isset($ranks['rank_title'])) ? $ranks['rank_title'] : '',
+					'S_FILENAME_LIST'	=> $filename_list,
+					'RANK_IMAGE'		=> ($edit_img) ? $phpbb_root_path . $config['ranks_path'] . '/' . $edit_img : $phpbb_admin_path . 'images/spacer.gif',
+					'S_SPECIAL_RANK'	=> (!isset($ranks['rank_special']) || $ranks['rank_special']) ? true : false,
+					'MIN_POSTS'			=> (isset($ranks['rank_min']) && !$ranks['rank_special']) ? $ranks['rank_min'] : 0)
+				);
+						
+
+				return;
+
+			break;
+		}
+	
+		$template->assign_vars(array(
+			'U_ACTION'		=> $u_action)
+		);
+
+		$sql = 'SELECT *
+			FROM ' . RANKS_TABLE . '
+			ORDER BY rank_min ASC, rank_special ASC, rank_title ASC';
+		$result = $db->sql_query($sql);
+
+		while ($row = $db->sql_fetchrow($result))
+		{
+			$template->assign_block_vars('ranks', array(
+				'S_RANK_IMAGE'		=> ($row['rank_image']) ? true : false,
+				'S_SPECIAL_RANK'	=> ($row['rank_special']) ? true : false,
+
+				'RANK_IMAGE'		=> $phpbb_root_path . $config['ranks_path'] . '/' . $row['rank_image'],
+				'RANK_TITLE'		=> $row['rank_title'],
+				'MIN_POSTS'			=> $row['rank_min'],
+
+				'U_EDIT'			=> $u_action . '&amp;action=edit&amp;id=' . $row['rank_id'],
+				'U_DELETE'			=> $u_action . '&amp;action=delete&amp;id=' . $row['rank_id'])
+			);	
+		}
+		$db->sql_freeresult($result);
+
+	}
+}
+
+/**
+* @package module_install
+*/
+class acp_ranks_info
+{
+	function module()
+	{
+		return array(
+			'filename'	=> 'acp_ranks',
+			'title'		=> 'ACP_RANKS',
+			'version'	=> '1.0.0',
+			'modes'		=> array(
+				'ranks'		=> array('title' => 'ACP_MANAGE_RANKS', 'auth' => 'acl_a_ranks'),
+			),
+		);
+	}
+
+	function install()
+	{
+	}
+
+	function uninstall()
+	{
+	}
+}
+
+?>
+\ No newline at end of file
diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php
index 6e40431f62..431e4c7731 100644
--- a/phpBB/includes/functions.php
+++ b/phpBB/includes/functions.php
@@ -1202,7 +1202,7 @@ function login_box($redirect = '', $l_explain = '', $l_success = '', $admin = fa
 	if (!$redirect)
 	{
 		$split_page = array();
-		preg_match_all('#^.*?([a-z]+?)\.' . $phpEx . '\?(.*?)$#i', $user->page, $split_page, PREG_SET_ORDER);
+		preg_match_all('#^.*?([a-z_-]+?)\.' . $phpEx . '?(.*?)$#i', $user->page, $split_page, PREG_SET_ORDER);
 
 		// No script name set? Assume index
 		if (empty($split_page[0][1]))
diff --git a/phpBB/includes/functions_user.php b/phpBB/includes/functions_user.php
index f308f4805f..5e72c21536 100644
--- a/phpBB/includes/functions_user.php
+++ b/phpBB/includes/functions_user.php
@@ -303,12 +303,12 @@ function user_active_flip($user_id, $user_type, $user_actkey = false, $username
  * @param string $mode Type of ban. One of the following: user, ip, email
  * @param mixed $ban Banned entity. Either string or array with usernames, ips or email addresses
  * @param int $ban_len Ban length in minutes
- * @param string $ban_len_other Ban length as a date (Y-m-d)
+ * @param string $ban_len_other Ban length as a date (YYYY-MM-DD)
  * @param boolean $ban_exclude Exclude these entities from banning?
  * @param string $ban_reason String describing the reason for this ban
  * @return boolean
  */
-function user_ban($mode, $ban, $ban_len, $ban_len_other, $ban_exclude, $ban_reason)
+function user_ban($mode, $ban, $ban_len, $ban_len_other, $ban_exclude, $ban_reason, $ban_give_reason = '')
 {
 	global $db, $user, $auth;
 
@@ -362,10 +362,11 @@ function user_ban($mode, $ban, $ban_len, $ban_len_other, $ban_exclude, $ban_reas
 					$username = trim($username);
 					if ($username != '')
 					{
-						$sql_usernames[] = "'" . $db->sql_escape($username) . "'";
+						$sql_usernames[] = "'" . $username . "'";
 					}
 				}
 				$sql_usernames = implode(', ', $sql_usernames);
+
 				$sql = 'SELECT user_id
 					FROM ' . USERS_TABLE . '
 					WHERE username IN (' . $sql_usernames . ')';
@@ -383,6 +384,7 @@ function user_ban($mode, $ban, $ban_len, $ban_len_other, $ban_exclude, $ban_reas
 				{
 					trigger_error($user->lang['NO_USERS']);
 				}
+				$db->sql_freeresult($result);
 			}
 			break;
 
@@ -492,8 +494,7 @@ function user_ban($mode, $ban, $ban_len, $ban_len_other, $ban_exclude, $ban_reas
 
 			if (sizeof($ban_list) == 0)
 			{
-				// TODO: translate this
-				trigger_error('No valid email addresses found');
+				trigger_error('NO_EMAILS_DEFINED');
 			}
 			break;
 	}
@@ -539,17 +540,19 @@ function user_ban($mode, $ban, $ban_len, $ban_len_other, $ban_exclude, $ban_reas
 		foreach ($banlist_ary as $ban_entry)
 		{
 			$sql_ary[] = array(
-				$type => $ban_entry,
-				'ban_start' => $current_time,
-				'ban_end' => $ban_end,
-				'ban_exclude' => $ban_exclude,
-				'ban_reason' => $ban_reason);
+				$type				=> $ban_entry,
+				'ban_start'			=> $current_time,
+				'ban_end'			=> $ban_end,
+				'ban_exclude'		=> $ban_exclude,
+				'ban_reason'		=> $ban_reason,
+				'ban_give_reason'	=> $ban_give_reason,
+			);
 		}
 		$sql = $db->sql_build_array('MULTI_INSERT', $sql_ary);
 
 		if ($sql)
 		{
-			$sql = 'INSERT INTO ' . BANLIST_TABLE . $sql;
+			$sql = 'INSERT INTO ' . BANLIST_TABLE . ' ' . $sql;
 			$db->sql_query($sql);
 		}
 
@@ -635,7 +638,12 @@ function user_unban($mode, $ban)
 			AND ban_end <> 0';
 	$db->sql_query($sql);
 
-	$unban_sql = implode(', ', $ban);
+	if (!is_array($ban))
+	{
+		$ban = array($ban);
+	}
+	
+	$unban_sql = implode(', ', array_map('intval', $ban));
 
 	if ($unban_sql)
 	{
@@ -663,15 +671,16 @@ function user_unban($mode, $ban)
 		}
 		$result = $db->sql_query($sql);
 
-		$sql = 'DELETE FROM ' . BANLIST_TABLE . "
-			WHERE ban_id IN ($unban_sql)";
-		$db->sql_query($sql);
-
 		$l_unban_list = '';
 		while ($row = $db->sql_fetchrow($result))
 		{
 			$l_unban_list .= (($l_unban_list != '') ? ', ' : '') . $row['unban_info'];
 		}
+		$db->sql_freeresult($result);
+
+		$sql = 'DELETE FROM ' . BANLIST_TABLE . "
+			WHERE ban_id IN ($unban_sql)";
+		$db->sql_query($sql);
 
 		if (!function_exists('add_log'))
 		{
@@ -871,7 +880,7 @@ function validate_username($username)
 
 	while ($row = $db->sql_fetchrow($result))
 	{
-		if (preg_match('#^' . str_replace('*', '.*?', preg_quote($row['disallow_username'], '$#')) . '#i', $username))
+		if (preg_match('#^' . str_replace('%', '.*?', preg_quote($row['disallow_username'], '$#')) . '#i', $username))
 		{
 			return 'USERNAME_DISALLOWED';
 		}
diff --git a/phpBB/includes/session.php b/phpBB/includes/session.php
index c1c6de36c9..cc60d42db8 100644
--- a/phpBB/includes/session.php
+++ b/phpBB/includes/session.php
@@ -588,28 +588,24 @@ class session
 				OR ban_end = 0';
 		$result = $db->sql_query($sql);
 
-		if ($row = $db->sql_fetchrow($result))
+		while ($row = $db->sql_fetchrow($result))
 		{
-			do
+			if ((!empty($row['ban_userid']) && intval($row['ban_userid']) == $user_id) ||
+				(!empty($row['ban_ip']) && preg_match('#^' . str_replace('*', '.*?', $row['ban_ip']) . '$#i', $user_ip)) ||
+				(!empty($row['ban_email']) && preg_match('#^' . str_replace('*', '.*?', $row['ban_email']) . '$#i', $user_email)))
 			{
-				if ((!empty($row['ban_userid']) && intval($row['ban_userid']) == $user_id) ||
-					(!empty($row['ban_ip']) && preg_match('#^' . str_replace('*', '.*?', $row['ban_ip']) . '$#i', $user_ip)) ||
-					(!empty($row['ban_email']) && preg_match('#^' . str_replace('*', '.*?', $row['ban_email']) . '$#i', $user_email)))
+				if (!empty($row['ban_exclude']))
 				{
-					if (!empty($row['ban_exclude']))
-					{
-						$banned = false;
-						break;
-					}
-					else
-					{
-						$banned = true;
-						$ban_row = $row;
-						// Don't break. Check if there is an exclude rule for this user
-					}
+					$banned = false;
+					break;
+				}
+				else
+				{
+					$banned = true;
+					$ban_row = $row;
+					// Don't break. Check if there is an exclude rule for this user
 				}
 			}
-			while ($row = $db->sql_fetchrow($result));
 		}
 		$db->sql_freeresult($result);
 
@@ -620,17 +616,15 @@ class session
 
 			// Logout the user, banned users are unable to use the normal 'logout' link
 			if ($this->data['user_id'] != ANONYMOUS)
-			{  
+			{
 				$this->session_kill();
 			}
 			// Determine which message to output
-			$till_date = (!empty($ban_row['ban_end'])) ? $this->format_date($ban_row['ban_end']) : '';
-			$message = (!empty($ban_row['ban_end'])) ? 'BOARD_BAN_TIME' : 'BOARD_BAN_PERM';
+			$till_date = ($ban_row['ban_end']) ? $this->format_date($ban_row['ban_end']) : '';
+			$message = ($ban_row['ban_end']) ? 'BOARD_BAN_TIME' : 'BOARD_BAN_PERM';
 
 			$message = sprintf($this->lang[$message], $till_date, '<a href="mailto:' . $config['board_contact'] . '">', '</a>');
-			// More internal HTML ...
-			// TODO: 'ban_show_reason' isn't used in the admin yet.
-			$message .= (!empty($ban_row['ban_show_reason'])) ? '<br /><br />' . sprintf($this->lang['BOARD_BAN_REASON'], $ban_row['ban_show_reason']) : '';
+			$message .= ($ban_row['ban_give_reason']) ? '<br /><br />' . sprintf($this->lang['BOARD_BAN_REASON'], $ban_row['ban_give_reason']) : '';
 			trigger_error($message);
 		}