From 89d7dbb68a179432c68a78a14703497e2b03a56e Mon Sep 17 00:00:00 2001
From: Garvin Hicking <mail@garv.in>
Date: Tue, 14 Jul 2009 11:40:16 +0000
Subject: [PATCH] PHP 5.3 compatibility, upgrade Smarty to 2.6.26

---
 bundled-libs/HTTP/Request.php                 |  8 +-
 bundled-libs/Net/DNSBL/SURBL.php              |  2 +-
 bundled-libs/Onyx/RSS.php                     |  4 +-
 bundled-libs/Smarty/NEWS                      | 19 ++++
 bundled-libs/Smarty/README                    |  2 +-
 .../Smarty/libs/Config_File.class.php         |  4 +-
 bundled-libs/Smarty/libs/Smarty.class.php     | 17 ++--
 .../Smarty/libs/Smarty_Compiler.class.php     | 90 +++++++++++--------
 .../Smarty/libs/plugins/function.math.php     |  3 +-
 docs/NEWS                                     |  2 +
 include/admin/images.inc.php                  |  2 +-
 include/admin/importers/blogger.inc.php       |  4 +-
 include/admin/importers/generic.inc.php       |  4 +-
 include/compat.inc.php                        |  6 ++
 include/functions_trackbacks.inc.php          |  6 +-
 .../serendipity_event_spamblock.php           |  8 +-
 .../serendipity_event_spartacus.php           |  4 +-
 .../serendipity_plugin_remoterss.php          |  6 +-
 18 files changed, 117 insertions(+), 74 deletions(-)

diff --git a/bundled-libs/HTTP/Request.php b/bundled-libs/HTTP/Request.php
index 770d9c79..17bc0861 100644
--- a/bundled-libs/HTTP/Request.php
+++ b/bundled-libs/HTTP/Request.php
@@ -237,7 +237,7 @@ class HTTP_Request {
     */
     function HTTP_Request($url = '', $params = array())
     {
-        $this->_sock           = &new Net_Socket();
+        $this->_sock           = new Net_Socket();
         $this->_method         =  HTTP_REQUEST_METHOD_GET;
         $this->_http           =  HTTP_REQUEST_HTTP_VER_1_1;
         $this->_requestHeaders = array();
@@ -334,7 +334,7 @@ class HTTP_Request {
     */
     function setURL($url)
     {
-        $this->_url = &new Net_URL($url, $this->_useBrackets);
+        $this->_url = new Net_URL($url, $this->_useBrackets);
 
         if (!empty($this->_url->user) || !empty($this->_url->pass)) {
             $this->setBasicAuth($this->_url->user, $this->_url->pass);
@@ -627,7 +627,7 @@ class HTTP_Request {
             $this->_notify('sentRequest');
 
             // Read the response
-            $this->_response = &new HTTP_Response($this->_sock, $this->_listeners);
+            $this->_response = new HTTP_Response($this->_sock, $this->_listeners);
             $err = $this->_response->process($this->_saveBody && $saveBody);
         }
 
@@ -650,7 +650,7 @@ class HTTP_Request {
 
             // Absolute URL
             if (preg_match('/^https?:\/\//i', $redirect)) {
-                $this->_url = &new Net_URL($redirect);
+                $this->_url = new Net_URL($redirect);
                 $this->addHeader('Host', $this->_generateHostHeader());
             // Absolute path
             } elseif ($redirect[0] == '/') {
diff --git a/bundled-libs/Net/DNSBL/SURBL.php b/bundled-libs/Net/DNSBL/SURBL.php
index 9ffd7866..9fe4b448 100644
--- a/bundled-libs/Net/DNSBL/SURBL.php
+++ b/bundled-libs/Net/DNSBL/SURBL.php
@@ -91,7 +91,7 @@ class Net_DNSBL_SURBL extends Net_DNSBL {
             // Cache hit
         } else {
             // Cache miss
-            $http = &new HTTP_Request($this->doubleCcTldFile);
+            $http = new HTTP_Request($this->doubleCcTldFile);
             if (!PEAR::isError($http->sendRequest())) {
                 $data = $http->getResponseBody();
             }
diff --git a/bundled-libs/Onyx/RSS.php b/bundled-libs/Onyx/RSS.php
index 1bd838f7..c0d680f7 100644
--- a/bundled-libs/Onyx/RSS.php
+++ b/bundled-libs/Onyx/RSS.php
@@ -130,7 +130,7 @@ class ONYX_RSS
          
          require_once S9Y_PEAR_PATH . 'HTTP/Request.php';
          serendipity_request_start();
-         $req = &new HTTP_Request($uri, array('allowRedirects' => true, 'maxRedirects' => 5));
+         $req = new HTTP_Request($uri, array('allowRedirects' => true, 'maxRedirects' => 5));
          $res = $req->sendRequest();
         
          if (PEAR::isError($res) || $req->getResponseCode() != '200')
@@ -349,7 +349,7 @@ class ONYX_RSS
       {
          require_once S9Y_PEAR_PATH . 'HTTP/Request.php';
          serendipity_request_start();
-         $req = &new HTTP_Request($uri);
+         $req = new HTTP_Request($uri);
 
          if (PEAR::isError($req->sendRequest()) || $req->getResponseCode() != '200') {
             serendipity_request_end();
diff --git a/bundled-libs/Smarty/NEWS b/bundled-libs/Smarty/NEWS
index 39c5f001..cbab78f5 100644
--- a/bundled-libs/Smarty/NEWS
+++ b/bundled-libs/Smarty/NEWS
@@ -1,3 +1,22 @@
+Version 2.6.26 (June 18th, 2009)
+-------------------------------
+- revert super global access changes, and instead rely on
+  USE_SUPER_GLOBALS for security
+
+Version 2.6.25 (May 19th, 2009)
+-------------------------------
+- fix E_NOTICE when sessions are disabled (mohrt)
+
+Version 2.6.24 (May 16th, 2009)
+-------------------------------
+- fix problem introduced with super global changes (mohrt)
+
+Version 2.6.23 (May 13th, 2009)
+-------------------------------
+- strip backticks from {math} equations (mohrt)
+- make PHP super globals read-only from template (mohrt)
+- throw error when template exists but not readable (mohrt)
+
 Version 2.6.22 (Dec 17th, 2008)
 -------------------------------
 
diff --git a/bundled-libs/Smarty/README b/bundled-libs/Smarty/README
index 13ff7609..15992d09 100644
--- a/bundled-libs/Smarty/README
+++ b/bundled-libs/Smarty/README
@@ -3,7 +3,7 @@ NAME:
 
     Smarty - the PHP compiling template engine
 
-VERSION: 2.6.22
+VERSION: 2.6.26
 
 AUTHORS:
     
diff --git a/bundled-libs/Smarty/libs/Config_File.class.php b/bundled-libs/Smarty/libs/Config_File.class.php
index 31b89075..5787ad15 100644
--- a/bundled-libs/Smarty/libs/Config_File.class.php
+++ b/bundled-libs/Smarty/libs/Config_File.class.php
@@ -22,14 +22,14 @@
  * smarty-discussion-subscribe@googlegroups.com 
  *
  * @link http://www.smarty.net/
- * @version 2.6.22
+ * @version 2.6.26
  * @copyright Copyright: 2001-2005 New Digital Group, Inc.
  * @author Andrei Zmievski <andrei@php.net>
  * @access public
  * @package Smarty
  */
 
-/* $Id: Config_File.class.php 2786 2008-09-18 21:04:38Z Uwe.Tews $ */
+/* $Id: Config_File.class.php 3149 2009-05-23 20:59:25Z monte.ohrt $ */
 
 /**
  * Config file reading class
diff --git a/bundled-libs/Smarty/libs/Smarty.class.php b/bundled-libs/Smarty/libs/Smarty.class.php
index 95ec67ba..e7298f2e 100644
--- a/bundled-libs/Smarty/libs/Smarty.class.php
+++ b/bundled-libs/Smarty/libs/Smarty.class.php
@@ -27,10 +27,10 @@
  * @author Monte Ohrt <monte at ohrt dot com>
  * @author Andrei Zmievski <andrei@php.net>
  * @package Smarty
- * @version 2.6.22
+ * @version 2.6.26
  */
 
-/* $Id: Smarty.class.php 2785 2008-09-18 21:04:12Z Uwe.Tews $ */
+/* $Id: Smarty.class.php 3163 2009-06-17 14:39:24Z monte.ohrt $ */
 
 /**
  * DIR_SEP isn't used anymore, but third party apps might
@@ -107,7 +107,7 @@ class Smarty
     /**
      * When set, smarty does uses this value as error_reporting-level.
      *
-     * @var boolean
+     * @var integer
      */
     var $error_reporting  =  null;
 
@@ -236,7 +236,8 @@ class Smarty
                                     'INCLUDE_ANY'     => false,
                                     'PHP_TAGS'        => false,
                                     'MODIFIER_FUNCS'  => array('count'),
-                                    'ALLOW_CONSTANTS'  => false
+                                    'ALLOW_CONSTANTS'  => false,
+                                    'ALLOW_SUPER_GLOBALS' => true
                                    );
 
     /**
@@ -464,7 +465,7 @@ class Smarty
      *
      * @var string
      */
-    var $_version              = '2.6.22';
+    var $_version              = '2.6.26';
 
     /**
      * current template inclusion depth
@@ -1548,7 +1549,7 @@ class Smarty
                         $params['source_content'] = $this->_read_file($_resource_name);
                     }
                     $params['resource_timestamp'] = filemtime($_resource_name);
-                    $_return = is_file($_resource_name);
+                    $_return = is_file($_resource_name) && is_readable($_resource_name);
                     break;
 
                 default:
@@ -1711,7 +1712,7 @@ class Smarty
      */
     function _read_file($filename)
     {
-        if ( file_exists($filename) && ($fd = @fopen($filename, 'rb')) ) {
+        if ( file_exists($filename) && is_readable($filename) && ($fd = @fopen($filename, 'rb')) ) {
             $contents = '';
             while (!feof($fd)) {
                 $contents .= fread($fd, 8192);
@@ -1950,7 +1951,7 @@ class Smarty
 			return $function;
 		}
 	}
-    
+  
     /**#@-*/
 
 }
diff --git a/bundled-libs/Smarty/libs/Smarty_Compiler.class.php b/bundled-libs/Smarty/libs/Smarty_Compiler.class.php
index 374ba3d0..1178b84d 100644
--- a/bundled-libs/Smarty/libs/Smarty_Compiler.class.php
+++ b/bundled-libs/Smarty/libs/Smarty_Compiler.class.php
@@ -18,15 +18,15 @@
  * License along with this library; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  *
- * @link http://www.smarty.net/
+ * @link http://smarty.php.net/
  * @author Monte Ohrt <monte at ohrt dot com>
  * @author Andrei Zmievski <andrei@php.net>
- * @version 2.6.22
+ * @version 2.6.26
  * @copyright 2001-2005 New Digital Group, Inc.
  * @package Smarty
  */
 
-/* $Id: Smarty_Compiler.class.php 2966 2008-12-08 15:10:03Z monte.ohrt $ */
+/* $Id: Smarty_Compiler.class.php 3163 2009-06-17 14:39:24Z monte.ohrt $ */
 
 /**
  * Template compiling class
@@ -73,9 +73,6 @@ class Smarty_Compiler extends Smarty {
 
     var $_strip_depth           =   0;
     var $_additional_newline    =   "\n";
-    
-    var $_phpversion            =   0;
-
 
     /**#@-*/
     /**
@@ -83,8 +80,6 @@ class Smarty_Compiler extends Smarty {
      */
     function Smarty_Compiler()
     {
-        $this->_phpversion = substr(phpversion(),0,1);
-
         // matches double quoted strings:
         // "foobar"
         // "foo\"bar"
@@ -157,20 +152,16 @@ class Smarty_Compiler extends Smarty {
         // $foo->bar($foo->bar)
         // $foo->bar($foo->bar())
         // $foo->bar($foo->bar($blah,$foo,44,"foo",$foo[0].bar))
-        // $foo->getBar()->getFoo()
-        // $foo->getBar()->foo
         $this->_obj_ext_regexp = '\->(?:\$?' . $this->_dvar_guts_regexp . ')';
         $this->_obj_restricted_param_regexp = '(?:'
-             . '(?:' . $this->_var_regexp . '|' . $this->_num_const_regexp . ')(?:' . $this->_obj_ext_regexp . '(?:\((?:(?:' . $this->_var_regexp . '|' . $this->_num_const_regexp . ')'
-             . '(?:\s*,\s*(?:' . $this->_var_regexp . '|' . $this->_num_const_regexp . '))*)?\))?)*)';
-
-       $this->_obj_single_param_regexp = '(?:\w+|' . $this->_obj_restricted_param_regexp . '(?:\s*,\s*(?:(?:\w+|'
+                . '(?:' . $this->_var_regexp . '|' . $this->_num_const_regexp . ')(?:' . $this->_obj_ext_regexp . '(?:\((?:(?:' . $this->_var_regexp . '|' . $this->_num_const_regexp . ')'
+                . '(?:\s*,\s*(?:' . $this->_var_regexp . '|' . $this->_num_const_regexp . '))*)?\))?)*)';
+        $this->_obj_single_param_regexp = '(?:\w+|' . $this->_obj_restricted_param_regexp . '(?:\s*,\s*(?:(?:\w+|'
                 . $this->_var_regexp . $this->_obj_restricted_param_regexp . ')))*)';
-
-       $this->_obj_params_regexp = '\((?:' . $this->_obj_single_param_regexp
+        $this->_obj_params_regexp = '\((?:' . $this->_obj_single_param_regexp
                 . '(?:\s*,\s*' . $this->_obj_single_param_regexp . ')*)?\)';
-       $this->_obj_start_regexp = '(?:' . $this->_dvar_regexp . '(?:' . $this->_obj_ext_regexp . ')+)';
-       $this->_obj_call_regexp = '(?:' . $this->_obj_start_regexp . '(?:' . $this->_obj_params_regexp . ')?(?:' . $this->_dvar_math_regexp . '(?:' . $this->_num_const_regexp . '|' . $this->_dvar_math_var_regexp . ')*)?)';
+        $this->_obj_start_regexp = '(?:' . $this->_dvar_regexp . '(?:' . $this->_obj_ext_regexp . ')+)';
+        $this->_obj_call_regexp = '(?:' . $this->_obj_start_regexp . '(?:' . $this->_obj_params_regexp . ')?(?:' . $this->_dvar_math_regexp . '(?:' . $this->_num_const_regexp . '|' . $this->_dvar_math_var_regexp . ')*)?)';
         
         // matches valid modifier syntax:
         // |foo
@@ -1705,8 +1696,6 @@ class Smarty_Compiler extends Smarty {
         }
         // replace double quoted literal string with single quotes
         $_return = preg_replace('~^"([\s\w]+)"$~',"'\\1'",$_return);
-        // escape dollar sign if not printing a var
-        $_return = preg_replace('~\$(\W)~',"\\\\\$\\1",$_return);
         return $_return;
     }
 
@@ -1720,7 +1709,6 @@ class Smarty_Compiler extends Smarty {
     function _parse_var($var_expr)
     {
         $_has_math = false;
-        $_has_php4_method_chaining = false;
         $_math_vars = preg_split('~('.$this->_dvar_math_regexp.'|'.$this->_qstr_regexp.')~', $var_expr, -1, PREG_SPLIT_DELIM_CAPTURE);
 
         if(count($_math_vars) > 1) {
@@ -1833,10 +1821,6 @@ class Smarty_Compiler extends Smarty {
                             $_output .= '->{(($_var=$this->_tpl_vars[\''.substr($_index,3).'\']) && substr($_var,0,2)!=\'__\') ? $_var : $this->trigger_error("cannot access property \\"$_var\\"")}';
                         }
                     } else {
-                       if ($this->_phpversion < 5) {
-                         $_has_php4_method_chaining = true;
-                         $_output .= "; \$_foo = \$_foo";
-                       }
                         $_output .= $_index;
                     }
                 } elseif (substr($_index, 0, 1) == '(') {
@@ -1848,12 +1832,7 @@ class Smarty_Compiler extends Smarty {
             }
         }
 
-        if ($_has_php4_method_chaining) {
-           $_tmp = str_replace("'","\'",'$_foo = '.$_output.'; return $_foo;');
-           return "eval('".$_tmp."')";
-        } else {
-           return $_output; 
-        }
+        return $_output;
     }
 
     /**
@@ -2068,27 +2047,57 @@ class Smarty_Compiler extends Smarty {
                 break;
 
             case 'get':
-                $compiled_ref = ($this->request_use_auto_globals) ? '$_GET' : "\$GLOBALS['HTTP_GET_VARS']";
+                if ($this->security && !$this->security_settings['ALLOW_SUPER_GLOBALS']) {
+                    $this->_syntax_error("(secure mode) super global access not permitted",
+                                         E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
+                $compiled_ref = "\$_GET";
                 break;
 
             case 'post':
-                $compiled_ref = ($this->request_use_auto_globals) ? '$_POST' : "\$GLOBALS['HTTP_POST_VARS']";
+                if ($this->security && !$this->security_settings['ALLOW_SUPER_GLOBALS']) {
+                    $this->_syntax_error("(secure mode) super global access not permitted",
+                                         E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
+                $compiled_ref = "\$_POST";
                 break;
 
             case 'cookies':
-                $compiled_ref = ($this->request_use_auto_globals) ? '$_COOKIE' : "\$GLOBALS['HTTP_COOKIE_VARS']";
+                if ($this->security && !$this->security_settings['ALLOW_SUPER_GLOBALS']) {
+                    $this->_syntax_error("(secure mode) super global access not permitted",
+                                         E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
+                $compiled_ref = "\$_COOKIE";
                 break;
 
             case 'env':
-                $compiled_ref = ($this->request_use_auto_globals) ? '$_ENV' : "\$GLOBALS['HTTP_ENV_VARS']";
+                if ($this->security && !$this->security_settings['ALLOW_SUPER_GLOBALS']) {
+                    $this->_syntax_error("(secure mode) super global access not permitted",
+                                         E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
+                $compiled_ref = "\$_ENV";
                 break;
 
             case 'server':
-                $compiled_ref = ($this->request_use_auto_globals) ? '$_SERVER' : "\$GLOBALS['HTTP_SERVER_VARS']";
+                if ($this->security && !$this->security_settings['ALLOW_SUPER_GLOBALS']) {
+                    $this->_syntax_error("(secure mode) super global access not permitted",
+                                         E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
+                $compiled_ref = "\$_SERVER";
                 break;
 
             case 'session':
-                $compiled_ref = ($this->request_use_auto_globals) ? '$_SESSION' : "\$GLOBALS['HTTP_SESSION_VARS']";
+                if ($this->security && !$this->security_settings['ALLOW_SUPER_GLOBALS']) {
+                    $this->_syntax_error("(secure mode) super global access not permitted",
+                                         E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
+                $compiled_ref = "\$_SESSION";
                 break;
 
             /*
@@ -2096,8 +2105,13 @@ class Smarty_Compiler extends Smarty {
              * compiler.
              */
             case 'request':
+                if ($this->security && !$this->security_settings['ALLOW_SUPER_GLOBALS']) {
+                    $this->_syntax_error("(secure mode) super global access not permitted",
+                                         E_USER_WARNING, __FILE__, __LINE__);
+                    return;
+                }
                 if ($this->request_use_auto_globals) {
-                    $compiled_ref = '$_REQUEST';
+                    $compiled_ref = "\$_REQUEST";
                     break;
                 } else {
                     $this->_init_smarty_vars = true;
diff --git a/bundled-libs/Smarty/libs/plugins/function.math.php b/bundled-libs/Smarty/libs/plugins/function.math.php
index 71672fea..bb78dac2 100644
--- a/bundled-libs/Smarty/libs/plugins/function.math.php
+++ b/bundled-libs/Smarty/libs/plugins/function.math.php
@@ -27,7 +27,8 @@ function smarty_function_math($params, &$smarty)
         return;
     }
 
-    $equation = $params['equation'];
+    // strip out backticks, not necessary for math
+    $equation = str_replace('`','',$params['equation']);
 
     // make sure parenthesis are balanced
     if (substr_count($equation,"(") != substr_count($equation,")")) {
diff --git a/docs/NEWS b/docs/NEWS
index f71eb2b1..f262c172 100644
--- a/docs/NEWS
+++ b/docs/NEWS
@@ -3,6 +3,8 @@
 Version 1.5 ()
 ------------------------------------------------------------------------
 
+    * Upgrade to Smarty 2.6.26
+
     * Removed inline styles of the s9y media insertion, they will now
       properly utilize CSS classes (defined in the new file 
       style_fallback.css). Also added support for entering "ALT/TITLE"
diff --git a/include/admin/images.inc.php b/include/admin/images.inc.php
index 9bd1703c..0b8d966b 100644
--- a/include/admin/images.inc.php
+++ b/include/admin/images.inc.php
@@ -243,7 +243,7 @@ switch ($serendipity['GET']['adminAction']) {
         $options = array();
         serendipity_plugin_api::hook_event('backend_http_request', $options, 'image');
         serendipity_request_start();
-        $req = &new HTTP_Request($serendipity['POST']['imageurl'], $options);
+        $req = new HTTP_Request($serendipity['POST']['imageurl'], $options);
         // Try to get the URL
 
         if (PEAR::isError($req->sendRequest()) || $req->getResponseCode() != '200') {
diff --git a/include/admin/importers/blogger.inc.php b/include/admin/importers/blogger.inc.php
index ebf5b296..52edba6c 100644
--- a/include/admin/importers/blogger.inc.php
+++ b/include/admin/importers/blogger.inc.php
@@ -78,7 +78,7 @@ class Serendipity_Import_Blogger extends Serendipity_Import {
 			                                         'default'   => $tokens['Token']));
 
 			// Prepare blog list request
-			$req = &new HTTP_Request('http://www.blogger.com/feeds/default/blogs');
+			$req = new HTTP_Request('http://www.blogger.com/feeds/default/blogs');
 			$req->addHeader('GData-Version', 2);
 			$req->addHeader('Authorization', 'AuthSub token="'. $tokens['Token'] .'"');
 			
@@ -140,7 +140,7 @@ class Serendipity_Import_Blogger extends Serendipity_Import {
         $this->getTransTable();
         		
 		// Prepare export request
-		$req = &new HTTP_Request('http://www.blogger.com/feeds/'. $this->data['bId'] .'/archive');
+		$req = new HTTP_Request('http://www.blogger.com/feeds/'. $this->data['bId'] .'/archive');
 		$req->addHeader('GData-Version', 2);
 		$req->addHeader('Authorization', 'AuthSub token="'. $this->data['bAuthToken'] .'"');
 				
diff --git a/include/admin/importers/generic.inc.php b/include/admin/importers/generic.inc.php
index f6264f72..38887319 100644
--- a/include/admin/importers/generic.inc.php
+++ b/include/admin/importers/generic.inc.php
@@ -138,7 +138,7 @@ class Serendipity_Import_Generic extends Serendipity_Import {
         $uri = $this->data['url'];
         require_once S9Y_PEAR_PATH . 'HTTP/Request.php';
         serendipity_request_start();
-        $req = &new HTTP_Request($uri, array('allowRedirects' => true, 'maxRedirects' => 5));
+        $req = new HTTP_Request($uri, array('allowRedirects' => true, 'maxRedirects' => 5));
         $res = $req->sendRequest();
         
         if (PEAR::isError($res) || $req->getResponseCode() != '200') {
@@ -320,7 +320,7 @@ class Serendipity_Import_Generic extends Serendipity_Import {
             return $this->import_wpxrss();
         }
 
-        $c = &new Onyx_RSS($this->data['charset']);
+        $c = new Onyx_RSS($this->data['charset']);
         $c->parse($this->data['url']);
         $this->data['encoding'] = $c->rss['encoding'];
 
diff --git a/include/compat.inc.php b/include/compat.inc.php
index c044496d..2f16811e 100644
--- a/include/compat.inc.php
+++ b/include/compat.inc.php
@@ -316,4 +316,10 @@ if (!isset($serendipity['serendipityPath'])) {
 
 $serendipity['indexFile'] = 'index.php';
 
+if (function_exists('date_default_timezone_get')) {
+    // We currently offer no Timezone setting (only offset to UTC), so we
+    // rely on the OS' timezone.
+    date_default_timezone_set(date_default_timezone_get());
+}
+
 /* vim: set sts=4 ts=4 expandtab : */
diff --git a/include/functions_trackbacks.inc.php b/include/functions_trackbacks.inc.php
index 93bccc1e..74b4e9ce 100644
--- a/include/functions_trackbacks.inc.php
+++ b/include/functions_trackbacks.inc.php
@@ -130,7 +130,7 @@ function _serendipity_send($loc, $data, $contenttype = null) {
     serendipity_plugin_api::hook_event('backend_http_request', $options, 'trackback_send');
     serendipity_request_start();
 
-    $req = &new HTTP_Request($uri, $options);
+    $req = new HTTP_Request($uri, $options);
     if (isset($contenttype)){
        $req->addHeader('Content-Type', $contenttype);
     }
@@ -271,7 +271,7 @@ global $serendipity;
     $options = array('allowRedirects' => true, 'maxRedirects' => 5, 'method' => 'GET');
     serendipity_plugin_api::hook_event('backend_http_request', $options, 'trackback_detect');
     serendipity_request_start();
-    $req = &new HTTP_Request($parsed_loc, $options);
+    $req = new HTTP_Request($parsed_loc, $options);
     $res = $req->sendRequest();
 
     if (PEAR::isError($res)) {
@@ -503,7 +503,7 @@ function fetchPingbackData( &$comment) {
     if (function_exists('serendipity_request_start')) serendipity_request_start();
     
     // Request the page
-    $req = &new HTTP_Request($url, array('allowRedirects' => true, 'maxRedirects' => 5, 'timeout' => 20, 'readTimeout' => array(5,0)));
+    $req = new HTTP_Request($url, array('allowRedirects' => true, 'maxRedirects' => 5, 'timeout' => 20, 'readTimeout' => array(5,0)));
 
     // code 200: OK, code 30x: REDIRECTION
     $responses = "/(200 OK)|(30[0-9] Found)/"; // |(30[0-9] Moved)
diff --git a/plugins/serendipity_event_spamblock/serendipity_event_spamblock.php b/plugins/serendipity_event_spamblock/serendipity_event_spamblock.php
index 8afc5344..1dfac485 100644
--- a/plugins/serendipity_event_spamblock/serendipity_event_spamblock.php
+++ b/plugins/serendipity_event_spamblock/serendipity_event_spamblock.php
@@ -533,7 +533,7 @@ var $filter_defaults;
                 } else {
                     $this->log($this->logfile, $eventData['id'], 'AKISMET_SERVER', 'Using Akismet server at ' . $server, $addData);
                 }
-                $req    = &new HTTP_Request(
+                $req    = new HTTP_Request(
                     'http://' . $server . '/1.1/verify-key',
                      $opt
                 );
@@ -558,7 +558,7 @@ var $filter_defaults;
                     break;
                 }
 
-                $req    = &new HTTP_Request(
+                $req    = new HTTP_Request(
                     'http://' . $api_key . '.' . $server . '/1.1/comment-check',
                     $opt
                 );
@@ -602,7 +602,7 @@ var $filter_defaults;
                 } else {
                     $data = '';
 
-                    $req    = &new HTTP_Request('http://spam.blogg.de/blacklist.txt');
+                    $req    = new HTTP_Request('http://spam.blogg.de/blacklist.txt');
 
                     if (PEAR::isError($req->sendRequest()) || $req->getResponseCode() != '200') {
                         if (file_exists($target) && filesize($target) > 0) {
@@ -978,7 +978,7 @@ var $filter_defaults;
                             require_once S9Y_PEAR_PATH . 'HTTP/Request.php';
 
                             if (function_exists('serendipity_request_start')) serendipity_request_start();
-                            $req     = &new HTTP_Request($addData['url'], array('allowRedirects' => true, 'maxRedirects' => 5, 'readTimeout' => array(5,0)));
+                            $req     = new HTTP_Request($addData['url'], array('allowRedirects' => true, 'maxRedirects' => 5, 'readTimeout' => array(5,0)));
                             $is_valid = false;
                             if (PEAR::isError($req->sendRequest()) || $req->getResponseCode() != '200') {
                                 $is_valid = false;
diff --git a/plugins/serendipity_event_spartacus/serendipity_event_spartacus.php b/plugins/serendipity_event_spartacus/serendipity_event_spartacus.php
index 99f1c66e..deacf033 100644
--- a/plugins/serendipity_event_spartacus/serendipity_event_spartacus.php
+++ b/plugins/serendipity_event_spartacus/serendipity_event_spartacus.php
@@ -397,7 +397,7 @@ class serendipity_event_spartacus extends serendipity_event
             serendipity_plugin_api::hook_event('backend_http_request', $options, 'spartacus');
             serendipity_request_start();
 
-            $req = &new HTTP_Request($url, $options);
+            $req = new HTTP_Request($url, $options);
 
             if (PEAR::isError($req->sendRequest()) || $req->getResponseCode() != '200') {
                 $resolved_url = $url . ' (IP ' . $url_ip . ')';
@@ -441,7 +441,7 @@ class serendipity_event_spartacus extends serendipity_event
 
                 $health_options = $options;
                 serendipity_plugin_api::hook_event('backend_http_request', $health_options, 'spartacus_health');
-                $health_req = &new HTTP_Request($health_url, $health_options);
+                $health_req = new HTTP_Request($health_url, $health_options);
                 $health_result = $health_req->sendRequest();
                 if (PEAR::isError($health_result)) {
                     $fp = @fsockopen('www.google.com', 80, $errno, $errstr);
diff --git a/plugins/serendipity_plugin_remoterss/serendipity_plugin_remoterss.php b/plugins/serendipity_plugin_remoterss/serendipity_plugin_remoterss.php
index ef025010..2a0cfeae 100644
--- a/plugins/serendipity_plugin_remoterss/serendipity_plugin_remoterss.php
+++ b/plugins/serendipity_plugin_remoterss/serendipity_plugin_remoterss.php
@@ -48,7 +48,7 @@ class s9y_remoterss_XMLTree {
     function GetXMLTree($file) {
         require_once S9Y_PEAR_PATH . 'HTTP/Request.php';
         serendipity_request_start();
-        $req = &new HTTP_Request($file);
+        $req = new HTTP_Request($file);
 
         if (PEAR::isError($req->sendRequest()) || $req->getResponseCode() != '200') {
             $data = file_get_contents($file);
@@ -424,7 +424,7 @@ class serendipity_plugin_remoterss extends serendipity_plugin {
         return true;
         require_once S9Y_PEAR_PATH . 'HTTP/Request.php';
         serendipity_request_start();
-        $req = &new HTTP_Request($uri);
+        $req = new HTTP_Request($uri);
 
         if (PEAR::isError($req->sendRequest()) || !preg_match('@^[23]..@', $req->getResponseCode())) {
             serendipity_request_end();
@@ -494,7 +494,7 @@ class serendipity_plugin_remoterss extends serendipity_plugin {
                     // Touching the feedcache file will prevent loops of death when the RSS target is the same URI than our blog.
                     @touch($feedcache);
                     require_once S9Y_PEAR_PATH . 'Onyx/RSS.php';
-                    $c = &new Onyx_RSS($charset);
+                    $c = new Onyx_RSS($charset);
                     $this->debug('Running Onyx Parser');
                     $c->parse($rssuri);
                     $this->encoding = $c->rss['encoding'];