- User mail is not working - Registration process is not working (IMHO we should use SHA1 or stronger algorithm instead of MD5 for storing passwords) (We can use multiple hash algorithms (so we'll have backward DB compatibility): {SHA256}0654209dbde29a5c17e4f04ab63a91d303d2e7c791c7b5777581a7fa6550054e {SHA1}f67c52c4a27cf05c99e4f3f946d6500f045a4735 5b077a0ab90992d9763c5b120b22c9d7 ) - Cron scripts are not executed (no automatic logouts, no K generation, ...) - fix uploading of files - fix ALL sql injections - remove absolute paths from all source files (!) (over 50) - remove hard-coded kyberia.sk from: ( ./inc/eventz/configure_email.inc ) ( ./inc/eventz/delete.inc ) ( ./inc/smarty/node_methodz/modifier.replaceLocalURLs.php ) ( ./inc/replaceLocalURLs.inc ) ( ./nodes.php ) ( ./cron/rssparse.php ) ( ./scripts/contentregexp.php ) (obsolete?) Fix https vs http problem (url) - Suspected security holes: ( cron/process-img.sh ) ( sms_payment.php => yes, sqli but is it really used? ) ( inc/eventz/upload_data_node.php => Shell injections in .zip handling, .jpg handling, "strange" filenames like .htacess (to allow listing of folder) - Implement URL handling using PATH_INFO instead of mod_rewrite - Refactor directory structure - Deprecated PHP features ( Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 163 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 184 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 196 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 208 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 220 Deprecated: Assigning the return value of new by reference is deprecated in /srv/kyberia/wwwroot/nodes.php on line 242 ) - keep fixing XSS - documentation/installation guide (see README) - Clean code => fix uninitialized variables