16 files changed, 210 insertions, 85 deletions
diff --git a/phpBB/phpbb/cache/driver/memcached.php b/phpBB/phpbb/cache/driver/memcached.php
index 808e15afe8..7d66759ec2 100644
--- a/phpBB/phpbb/cache/driver/memcached.php
+++ b/phpBB/phpbb/cache/driver/memcached.php
@@ -65,7 +65,7 @@ class memcached extends \phpbb\cache\driver\memory
 			$this->memcached->setOption(\Memcached::OPT_COMPRESSION, false);
 		}
 
-		foreach (explode(',', PHPBB_ACM_MEMCACHE) as $u)
+		foreach (explode(',', PHPBB_ACM_MEMCACHED) as $u)
 		{
 			preg_match('#(.*)/(\d+)#', $u, $parts);
 			$this->memcached->addServer(trim($parts[1]), (int) trim($parts[2]));
diff --git a/phpBB/phpbb/console/exception_subscriber.php b/phpBB/phpbb/console/exception_subscriber.php
index b920d4abae..b240993203 100644
--- a/phpBB/phpbb/console/exception_subscriber.php
+++ b/phpBB/phpbb/console/exception_subscriber.php
@@ -29,12 +29,10 @@ class exception_subscriber implements EventSubscriberInterface
 	 * Construct method
 	 *
 	 * @param \phpbb\language\language $language Language object
-	 * @param bool $debug Debug mode
 	 */
-	public function __construct(\phpbb\language\language $language, $debug = false)
+	public function __construct(\phpbb\language\language $language)
 	{
 		$this->language = $language;
-		$this->debug = $debug;
 	}
 
 	/**
@@ -52,14 +50,7 @@ class exception_subscriber implements EventSubscriberInterface
 			$parameters = array_merge(array($original_exception->getMessage()), $original_exception->get_parameters());
 			$message = call_user_func_array(array($this->language, 'lang'), $parameters);
 
-			if ($this->debug)
-			{
-				$exception = new \RuntimeException($message , $original_exception->getCode(), $original_exception);
-			}
-			else
-			{
-				$exception = new \RuntimeException($message , $original_exception->getCode());
-			}
+			$exception = new \RuntimeException($message , $original_exception->getCode(), $original_exception);
 
 			$event->setException($exception);
 		}
diff --git a/phpBB/phpbb/db/migration/data/v310/style_update_p1.php b/phpBB/phpbb/db/migration/data/v310/style_update_p1.php
index 2c7b7edf2e..f50ab33830 100644
--- a/phpBB/phpbb/db/migration/data/v310/style_update_p1.php
+++ b/phpBB/phpbb/db/migration/data/v310/style_update_p1.php
@@ -160,12 +160,12 @@ class style_update_p1 extends \phpbb\db\migration\migration
 				FROM ' . STYLES_TABLE . "
 				WHERE style_name = 'prosilver'";
 			$result = $this->sql_query($sql);
-			$default_style = $this->db->sql_fetchfield('style_id');
+			$default_style = (int) $this->db->sql_fetchfield('style_id');
 			$this->db->sql_freeresult($result);
 
 			$this->config->set('default_style', $default_style);
 
-			$sql = 'UPDATE ' . USERS_TABLE . ' SET user_style = 0';
+			$sql = 'UPDATE ' . USERS_TABLE . ' SET user_style = ' .  (int) $default_style;
 			$this->sql_query($sql);
 		}
 		else
@@ -183,9 +183,9 @@ class style_update_p1 extends \phpbb\db\migration\migration
 			}
 
 			// Reset styles for users
-			$this->sql_query('UPDATE ' . USERS_TABLE . '
-				SET user_style = 0
-				WHERE ' . $this->db->sql_in_set('user_style', $valid_styles, true));
+			$this->sql_query('UPDATE ' . USERS_TABLE . "
+				SET user_style = '" . (int) $valid_styles[0] . "'
+				WHERE " . $this->db->sql_in_set('user_style', $valid_styles, true));
 		}
 	}
 }
diff --git a/phpBB/phpbb/db/migration/data/v32x/f_list_topics_permission_add.php b/phpBB/phpbb/db/migration/data/v32x/f_list_topics_permission_add.php
new file mode 100644
index 0000000000..49727e5a62
--- /dev/null
+++ b/phpBB/phpbb/db/migration/data/v32x/f_list_topics_permission_add.php
@@ -0,0 +1,31 @@
+<?php
+/**
+ *
+ * This file is part of the phpBB Forum Software package.
+ *
+ * @copyright (c) phpBB Limited <https://www.phpbb.com>
+ * @license GNU General Public License, version 2 (GPL-2.0)
+ *
+ * For full copyright and license information, please see
+ * the docs/CREDITS.txt file.
+ *
+ */
+
+namespace phpbb\db\migration\data\v32x;
+
+class f_list_topics_permission_add extends \phpbb\db\migration\migration
+{
+	static public function depends_on()
+	{
+		return array(
+			'\phpbb\db\migration\data\v32x\v321',
+		);
+	}
+
+	public function update_data()
+	{
+		return array(
+			array('permission.add', array('f_list_topics', false, 'f_read')),
+		);
+	}
+}
diff --git a/phpBB/phpbb/db/migration/data/v32x/fix_user_styles.php b/phpBB/phpbb/db/migration/data/v32x/fix_user_styles.php
new file mode 100644
index 0000000000..282c6bef2f
--- /dev/null
+++ b/phpBB/phpbb/db/migration/data/v32x/fix_user_styles.php
@@ -0,0 +1,50 @@
+<?php
+/**
+*
+* This file is part of the phpBB Forum Software package.
+*
+* @copyright (c) phpBB Limited <https://www.phpbb.com>
+* @license GNU General Public License, version 2 (GPL-2.0)
+*
+* For full copyright and license information, please see
+* the docs/CREDITS.txt file.
+*
+*/
+
+namespace phpbb\db\migration\data\v32x;
+
+class fix_user_styles extends \phpbb\db\migration\migration
+{
+
+	static public function depends_on()
+	{
+		return array(
+			'\phpbb\db\migration\data\v320\v320',
+		);
+	}
+
+	public function update_data()
+	{
+		return array(
+			array('custom', array(array($this, 'styles_fix'))),
+		);
+	}
+
+	public function styles_fix()
+	{
+		$default_style = (int) $this->config['default_style'];
+
+		// Get enabled styles
+		$sql = 'SELECT style_id
+			FROM ' . STYLES_TABLE . '
+			WHERE style_active = 1';
+		$result = $this->db->sql_query($sql);
+		$enabled_styles = $result->fetch_array();
+		$this->db->sql_freeresult($result);
+
+		// Set the default style to users who have an invalid style
+		$this->sql_query('UPDATE ' . USERS_TABLE . '
+			SET user_style = ' . (int) $default_style . '
+			WHERE ' . $this->db->sql_in_set('user_style', $enabled_styles, true));
+	}
+}
diff --git a/phpBB/phpbb/db/migrator.php b/phpBB/phpbb/db/migrator.php
index d7d7f18d2b..6c026c3ae1 100644
--- a/phpBB/phpbb/db/migrator.php
+++ b/phpBB/phpbb/db/migrator.php
@@ -503,11 +503,14 @@ class migrator
 			return;
 		}
 
-		foreach ($this->migration_state as $name => $state)
+		foreach ($this->migrations as $name)
 		{
-			if (!empty($state['migration_depends_on']) && in_array($migration, $state['migration_depends_on']))
+			$state = $this->migration_state($name);
+
+			if ($state && in_array($migration, $state['migration_depends_on']) && ($state['migration_schema_done'] || $state['migration_data_done']))
 			{
 				$this->revert_do($name);
+				return;
 			}
 		}
 
diff --git a/phpBB/phpbb/event/dispatcher.php b/phpBB/phpbb/event/dispatcher.php
index 1c4abeb108..1ba2ab8987 100644
--- a/phpBB/phpbb/event/dispatcher.php
+++ b/phpBB/phpbb/event/dispatcher.php
@@ -57,7 +57,12 @@ class dispatcher extends ContainerAwareEventDispatcher implements dispatcher_int
 			return $event;
 		}
 
-		return parent::dispatch($eventName, $event);
+		foreach ((array) $eventName as $name)
+		{
+			$event = parent::dispatch($name, $event);
+		}
+
+		return $event;
 	}
 
 	/**
diff --git a/phpBB/phpbb/event/php_exporter.php b/phpBB/phpbb/event/php_exporter.php
index 26d7e2b426..7b80863305 100644
--- a/phpBB/phpbb/event/php_exporter.php
+++ b/phpBB/phpbb/event/php_exporter.php
@@ -196,13 +196,13 @@ class php_exporter
 		$content = file_get_contents($this->path . $this->current_file);
 		$num_events_found = 0;
 
-		if (strpos($content, "dispatcher->trigger_event('") || strpos($content, "dispatcher->dispatch('"))
+		if (strpos($content, 'dispatcher->trigger_event(') || strpos($content, 'dispatcher->dispatch('))
 		{
 			$this->set_content(explode("\n", $content));
 			for ($i = 0, $num_lines = sizeof($this->file_lines); $i < $num_lines; $i++)
 			{
 				$event_line = false;
-				$found_trigger_event = strpos($this->file_lines[$i], "dispatcher->trigger_event('");
+				$found_trigger_event = strpos($this->file_lines[$i], 'dispatcher->trigger_event(');
 				$arguments = array();
 				if ($found_trigger_event !== false)
 				{
@@ -216,7 +216,7 @@ class php_exporter
 				}
 				else
 				{
-					$found_dispatch = strpos($this->file_lines[$i], "dispatcher->dispatch('");
+					$found_dispatch = strpos($this->file_lines[$i], 'dispatcher->dispatch(');
 					if ($found_dispatch !== false)
 					{
 						$event_line = $i;
@@ -316,17 +316,17 @@ class php_exporter
 
 		if ($is_dispatch)
 		{
-			$regex = '#\$([a-z](?:[a-z0-9_]|->)*)';
-			$regex .= '->dispatch\(';
-			$regex .= '\'' . $this->preg_match_event_name() . '\'';
-			$regex .= '\);#';
+			$regex = '#\$[a-z](?:[a-z0-9_]|->)*';
+			$regex .= '->dispatch\((\[)?';
+			$regex .= '\'' . $this->preg_match_event_name() . '(?(1)\', \'(?2))+\'';
+			$regex .= '(?(1)\])\);#';
 		}
 		else
 		{
-			$regex = '#extract\(\$([a-z](?:[a-z0-9_]|->)*)';
-			$regex .= '->trigger_event\(';
-			$regex .= '\'' . $this->preg_match_event_name() . '\'';
-			$regex .= ', compact\(\$vars\)\)\);#';
+			$regex = '#extract\(\$[a-z](?:[a-z0-9_]|->)*';
+			$regex .= '->trigger_event\((\[)?';
+			$regex .= '\'' . $this->preg_match_event_name() . '(?(1)\', \'(?2))+\'';
+			$regex .= '(?(1)\]), compact\(\$vars\)\)\);#';
 		}
 
 		$match = array();
@@ -359,7 +359,7 @@ class php_exporter
 	public function get_vars_from_array()
 	{
 		$line = ltrim($this->file_lines[$this->current_event_line - 1], "\t");
-		if ($line === ');')
+		if ($line === ');' || $line === '];')
 		{
 			$vars_array = $this->get_vars_from_multi_line_array();
 		}
@@ -370,7 +370,7 @@ class php_exporter
 
 		foreach ($vars_array as $var)
 		{
-			if (!preg_match('#^([a-zA-Z_][a-zA-Z0-9_]*)$#', $var))
+			if (!preg_match('#^[a-z_][a-z0-9_]*$#i', $var))
 			{
 				throw new \LogicException("Found invalid var '{$var}' in array for event '{$this->current_event}' in file '{$this->current_file}:{$this->current_event_line}'", 3);
 			}
@@ -392,11 +392,11 @@ class php_exporter
 	public function get_vars_from_single_line_array($line, $throw_multiline = true)
 	{
 		$match = array();
-		preg_match('#^\$vars = (?:\[|array\()\'([a-zA-Z0-9_\' ,]+)\'[\)\]];$#', $line, $match);
+		preg_match('#^\$vars = (?:(\[)|array\()\'([a-z0-9_\' ,]+)\'(?(1)\]|\));$#i', $line, $match);
 
-		if (isset($match[1]))
+		if (isset($match[2]))
 		{
-			$vars_array = explode("', '", $match[1]);
+			$vars_array = explode("', '", $match[2]);
 			if ($throw_multiline && sizeof($vars_array) > 6)
 			{
 				throw new \LogicException('Should use multiple lines for $vars definition '
@@ -420,7 +420,7 @@ class php_exporter
 	{
 		$current_vars_line = 2;
 		$var_lines = array();
-		while (ltrim($this->file_lines[$this->current_event_line - $current_vars_line], "\t") !== '$vars = array(')
+		while (!in_array(ltrim($this->file_lines[$this->current_event_line - $current_vars_line], "\t"), ['$vars = array(', '$vars = [']))
 		{
 			$var_lines[] = substr(trim($this->file_lines[$this->current_event_line - $current_vars_line]), 0, -1);
 
@@ -485,7 +485,7 @@ class php_exporter
 
 		foreach ($doc_vars as $var)
 		{
-			if (!preg_match('#^([a-zA-Z_][a-zA-Z0-9_]*)$#', $var))
+			if (!preg_match('#^[a-z_][a-z0-9_]*$#i', $var))
 			{
 				throw new \LogicException("Found invalid @var '{$var}' in docblock for event "
 					. "'{$this->current_event}' in file '{$this->current_file}:{$this->current_event_line}'", 4);
diff --git a/phpBB/phpbb/feed/helper.php b/phpBB/phpbb/feed/helper.php
index e15d1e131e..7d50b7ce7d 100644
--- a/phpBB/phpbb/feed/helper.php
+++ b/phpBB/phpbb/feed/helper.php
@@ -13,41 +13,52 @@
 
 namespace phpbb\feed;
 
+use phpbb\config\config;
+use phpbb\path_helper;
+use phpbb\textformatter\s9e\renderer;
+use phpbb\user;
+use Symfony\Component\DependencyInjection\ContainerInterface;
+
 /**
  * Class with some helpful functions used in feeds
  */
 class helper
 {
-	/** @var \phpbb\config\config */
+	/** @var config */
 	protected $config;
 
-	/** @var \phpbb\user */
-	protected $user;
+	/** @var ContainerInterface */
+	protected $container;
 
-	/** @var string */
-	protected $phpbb_root_path;
+	/** @var path_helper */
+	protected $path_helper;
 
-	/** @var string */
-	protected $phpEx;
+	/** @var renderer */
+	protected $renderer;
+
+	/** @var user */
+	protected $user;
 
 	/**
 	 * Constructor
 	 *
-	 * @param	\phpbb\config\config	$config		Config object
-	 * @param	\phpbb\user		$user		User object
-	 * @param	string	$phpbb_root_path	Root path
-	 * @param	string	$phpEx				PHP file extension
+	 * @param	config				$config			Config object
+	 * @param	ContainerInterface	$container		Service container object
+	 * @param	path_helper			$path_helper 	Path helper object
+	 * @param	renderer			$renderer		TextFormatter renderer object
+	 * @param	user				$user			User object
 	 */
-	public function __construct(\phpbb\config\config $config, \phpbb\user $user, $phpbb_root_path, $phpEx)
+	public function __construct(config $config, ContainerInterface $container, path_helper $path_helper, renderer $renderer, user $user)
 	{
 		$this->config = $config;
+		$this->container = $container;
+		$this->path_helper = $path_helper;
+		$this->renderer = $renderer;
 		$this->user = $user;
-		$this->phpbb_root_path = $phpbb_root_path;
-		$this->phpEx = $phpEx;
 	}
 
 	/**
-	 * Run links through append_sid(), prepend generate_board_url() and remove session id
+	 * Returns the board url (and caches it in the function)
 	 */
 	public function get_board_url()
 	{
@@ -104,16 +115,12 @@ class helper
 			return '';
 		}
 
-		// Prepare some bbcodes for better parsing
-		$content	= preg_replace("#\[quote(=&quot;.*?&quot;)?:$uid\]\s*(.*?)\s*\[/quote:$uid\]#si", "[quote$1:$uid]<br />$2<br />[/quote:$uid]", $content);
-
-		$content = generate_text_for_display($content, $uid, $bitfield, $options);
+		// Setup our own quote_helper to remove all attributes from quotes
+		$this->renderer->configure_quote_helper($this->container->get('feed.quote_helper'));
 
-		// Add newlines
-		$content = str_replace('<br />', '<br />' . "\n", $content);
+		$this->renderer->set_smilies_path($this->get_board_url() . '/' . $this->config['smilies_path']);
 
-		// Convert smiley Relative paths to Absolute path, Windows style
-		$content = str_replace($this->phpbb_root_path . $this->config['smilies_path'], $this->get_board_url() . '/' . $this->config['smilies_path'], $content);
+		$content = generate_text_for_display($content, $uid, $bitfield, $options);
 
 		// Remove "Select all" link and mouse events
 		$content = str_replace('<a href="#" onclick="selectCode(this); return false;">' . $this->user->lang['SELECT_ALL_CODE'] . '</a>', '', $content);
@@ -152,7 +159,7 @@ class helper
 			$content .= implode('<br />', $post_attachments);
 
 			// Convert attachments' relative path to absolute path
-			$content = str_replace($this->phpbb_root_path . 'download/file.' . $this->phpEx, $this->get_board_url() . '/download/file.' . $this->phpEx, $content);
+			$content = str_replace($this->path_helper->get_web_root_path() . 'download/file.' . $this->path_helper->get_php_ext(), $this->get_board_url() . '/download/file.' . $this->path_helper->get_php_ext(), $content);
 		}
 
 		// Remove Comments from inline attachments [ia]
diff --git a/phpBB/phpbb/feed/quote_helper.php b/phpBB/phpbb/feed/quote_helper.php
new file mode 100644
index 0000000000..843d075028
--- /dev/null
+++ b/phpBB/phpbb/feed/quote_helper.php
@@ -0,0 +1,36 @@
+<?php
+/**
+ *
+ * This file is part of the phpBB Forum Software package.
+ *
+ * @copyright (c) phpBB Limited <https://www.phpbb.com>
+ * @license GNU General Public License, version 2 (GPL-2.0)
+ *
+ * For full copyright and license information, please see
+ * the docs/CREDITS.txt file.
+ *
+ */
+
+namespace phpbb\feed;
+
+/**
+ * Modified quote_helper for feeds (basically just removing all attributes)
+ */
+class quote_helper extends \phpbb\textformatter\s9e\quote_helper
+{
+	/**
+	 * {@inheritdoc}
+	 */
+	public function inject_metadata($xml)
+	{
+		// In feeds we don't want any attributes, so delete all of them
+		return \s9e\TextFormatter\Utils::replaceAttributes(
+			$xml,
+			'QUOTE',
+			function ()
+			{
+				return [];
+			}
+		);
+	}
+}
diff --git a/phpBB/phpbb/feed/topics_active.php b/phpBB/phpbb/feed/topics_active.php
index 7ae0bde56b..ea9ee97b9d 100644
--- a/phpBB/phpbb/feed/topics_active.php
+++ b/phpBB/phpbb/feed/topics_active.php
@@ -119,7 +119,7 @@ class topics_active extends topic_base
 				FROM ' . FORUMS_TABLE . '
 				WHERE forum_type = ' . FORUM_POST . '
 					AND ' . $this->db->sql_bit_and('forum_options', FORUM_OPTION_FEED_EXCLUDE, '= 0') . '
-					AND ' . $this->db->sql_bit_and('forum_flags', log(FORUM_FLAG_ACTIVE_TOPICS, 2), '<> 0');
+					AND ' . $this->db->sql_bit_and('forum_flags', round(log(FORUM_FLAG_ACTIVE_TOPICS, 2)), '<> 0');
 			$result = $this->db->sql_query($sql);
 
 			$forum_ids = array();
diff --git a/phpBB/phpbb/log/log.php b/phpBB/phpbb/log/log.php
index 5aad7ee326..dcc4cdde51 100644
--- a/phpBB/phpbb/log/log.php
+++ b/phpBB/phpbb/log/log.php
@@ -933,6 +933,20 @@ class log implements \phpbb\log\log_interface
 				$forum_auth['f_read'][$row['topic_id']] = $row['forum_id'];
 			}
 
+			/**
+			 * Allow modifying SQL query after topic data is retrieved (inside loop).
+			 *
+			 * @event core.phpbb_log_get_topic_auth_sql_after
+			 * @var	array	forum_auth	Forum permissions
+			 * @var	array	row			One row of data from SQL query
+			 * @since 3.2.2-RC1
+			 */
+			$vars = array(
+				'forum_auth',
+				'row',
+			);
+			extract($this->dispatcher->trigger_event('core.phpbb_log_get_topic_auth_sql_after', compact($vars)));
+
 			if ($this->auth->acl_gets('a_', 'm_', $row['forum_id']))
 			{
 				$forum_auth['m_'][$row['topic_id']] = $row['forum_id'];
diff --git a/phpBB/phpbb/pagination.php b/phpBB/phpbb/pagination.php
index a5a95b096d..40af5eda6b 100644
--- a/phpBB/phpbb/pagination.php
+++ b/phpBB/phpbb/pagination.php
@@ -136,6 +136,11 @@ class pagination
 	*/
 	public function generate_template_pagination($base_url, $block_var_name, $start_name, $num_items, $per_page, $start = 1, $reverse_count = false, $ignore_on_page = false)
 	{
+		if (empty($base_url))
+		{
+			return;
+		}
+
 		$total_pages = ceil($num_items / $per_page);
 		$on_page = $this->get_on_page($per_page, $start);
 		$u_previous_page = $u_next_page = '';
diff --git a/phpBB/phpbb/permissions.php b/phpBB/phpbb/permissions.php
index c9181e6202..7697884b6a 100644
--- a/phpBB/phpbb/permissions.php
+++ b/phpBB/phpbb/permissions.php
@@ -260,6 +260,7 @@ class permissions
 
 		// Forum Permissions
 		'f_list'		=> array('lang' => 'ACL_F_LIST', 'cat' => 'actions'),
+		'f_list_topics' => array('lang' => 'ACL_F_LIST_TOPICS', 'cat' => 'actions'),
 		'f_read'		=> array('lang' => 'ACL_F_READ', 'cat' => 'actions'),
 		'f_search'		=> array('lang' => 'ACL_F_SEARCH', 'cat' => 'actions'),
 		'f_subscribe'	=> array('lang' => 'ACL_F_SUBSCRIBE', 'cat' => 'actions'),
diff --git a/phpBB/phpbb/search/fulltext_sphinx.php b/phpBB/phpbb/search/fulltext_sphinx.php
index 89c615e087..59c3d55076 100644
--- a/phpBB/phpbb/search/fulltext_sphinx.php
+++ b/phpBB/phpbb/search/fulltext_sphinx.php
@@ -648,7 +648,7 @@ class fulltext_sphinx
 		$this->sphinx->SetFilter('deleted', array(0));
 
 		$this->sphinx->SetLimits($start, (int) $per_page, SPHINX_MAX_MATCHES);
-		$result = $this->sphinx->Query($search_query_prefix . str_replace('&quot;', '"', $this->search_query), $this->indexes);
+		$result = $this->sphinx->Query($search_query_prefix . $this->sphinx->EscapeString(str_replace('&quot;', '"', $this->search_query)), $this->indexes);
 
 		// Could be connection to localhost:9312 failed (errno=111,
 		// msg=Connection refused) during rotate, retry if so
@@ -656,7 +656,7 @@ class fulltext_sphinx
 		while (!$result && (strpos($this->sphinx->GetLastError(), "errno=111,") !== false) && $retries--)
 		{
 			usleep(SPHINX_CONNECT_WAIT_TIME);
-			$result = $this->sphinx->Query($search_query_prefix . str_replace('&quot;', '"', $this->search_query), $this->indexes);
+			$result = $this->sphinx->Query($search_query_prefix . $this->sphinx->EscapeString(str_replace('&quot;', '"', $this->search_query)), $this->indexes);
 		}
 
 		if ($this->sphinx->GetLastError())
@@ -679,7 +679,7 @@ class fulltext_sphinx
 			$start = floor(($result_count - 1) / $per_page) * $per_page;
 
 			$this->sphinx->SetLimits((int) $start, (int) $per_page, SPHINX_MAX_MATCHES);
-			$result = $this->sphinx->Query($search_query_prefix . str_replace('&quot;', '"', $this->search_query), $this->indexes);
+			$result = $this->sphinx->Query($search_query_prefix . $this->sphinx->EscapeString(str_replace('&quot;', '"', $this->search_query)), $this->indexes);
 
 			// Could be connection to localhost:9312 failed (errno=111,
 			// msg=Connection refused) during rotate, retry if so
@@ -687,7 +687,7 @@ class fulltext_sphinx
 			while (!$result && (strpos($this->sphinx->GetLastError(), "errno=111,") !== false) && $retries--)
 			{
 				usleep(SPHINX_CONNECT_WAIT_TIME);
-				$result = $this->sphinx->Query($search_query_prefix . str_replace('&quot;', '"', $this->search_query), $this->indexes);
+				$result = $this->sphinx->Query($search_query_prefix . $this->sphinx->EscapeString(str_replace('&quot;', '"', $this->search_query)), $this->indexes);
 			}
 		}
 
diff --git a/phpBB/phpbb/user.php b/phpBB/phpbb/user.php
index d4097f53ee..5899dff2f5 100644
--- a/phpBB/phpbb/user.php
+++ b/phpBB/phpbb/user.php
@@ -278,24 +278,6 @@ class user extends \phpbb\session
 			$db->sql_freeresult($result);
 		}
 
-		// User has wrong style
-		if (!$this->style && $style_id == $this->data['user_style'])
-		{
-			$style_id = $this->data['user_style'] = $config['default_style'];
-
-			$sql = 'UPDATE ' . USERS_TABLE . "
-				SET user_style = $style_id
-				WHERE user_id = {$this->data['user_id']}";
-			$db->sql_query($sql);
-
-			$sql = 'SELECT *
-				FROM ' . STYLES_TABLE . " s
-				WHERE s.style_id = $style_id";
-			$result = $db->sql_query($sql, 3600);
-			$this->style = $db->sql_fetchrow($result);
-			$db->sql_freeresult($result);
-		}
-
 		if (!$this->style)
 		{
 			trigger_error('NO_STYLE_DATA', E_USER_ERROR);