=== modified file 'includes/bootstrap.inc'
--- includes/bootstrap.inc	2010-08-11 22:02:23 +0000
+++ includes/bootstrap.inc	2010-08-23 15:48:37 +0000
@@ -431,14 +431,16 @@
 
     // $_SERVER['SCRIPT_NAME'] can, in contrast to $_SERVER['PHP_SELF'], not
     // be modified by a visitor.
+/*
     if ($dir = trim(dirname($_SERVER['SCRIPT_NAME']), '\,/')) {
       $base_path = "/$dir";
       $base_url .= $base_path;
       $base_path .= '/';
     }
     else {
+*/
       $base_path = '/';
-    }
+#    }
   }
 
   if ($cookie_domain) {

=== modified file 'includes/unicode.inc'
--- includes/unicode.inc	2010-08-11 20:54:17 +0000
+++ includes/unicode.inc	2010-09-22 15:16:22 +0000
@@ -335,7 +335,35 @@
  *   The input $text, with all HTML entities decoded once.
  */
 function decode_entities($text, $exclude = array()) {
-  static $table;
+  // Prepare the callback function.
+  _decode_entities_preg_replace_callback(NULL, $exclude);
+  
+  // Use a regexp to select all entities in one pass, to avoid decoding double-escaped entities twice.
+  return preg_replace_callback('/&(#x?)?([A-Za-z0-9]+);/', '_decode_entities_preg_replace_callback', $text);
+}
+
+/**
+ * Helper for decode_entities(). Does not exist in all Drupal 6 releases.
+ *
+ * @param $matches
+ *   An array of matches found by preg_replace_callback(). Elements 0, 1, and 2
+ *   of $matches must be the original entity, its prefix, and its codepoint.
+ * @param $set_exclude
+ *   An array of entities that should be excluded from decoding. This should
+ *   only be set during a preparatory call before preg_replace_callback().
+ *
+ * @return
+ *   The decoded entity for a given match, or the original encoded entity if
+ *   the entity is in the list of excluded entities.
+ */
+function _decode_entities_preg_replace_callback($matches = NULL, $set_exclude = NULL) {
+  static $table, $exclude;
+  if (isset($set_exclude)) {
+    // This is a preparatory call.
+    $exclude = $set_exclude;
+    return;
+  }
+  
   // We store named entities in a table for quick processing.
   if (!isset($table)) {
     // Get all named HTML entities.
@@ -346,13 +374,11 @@
     $table['''] = "'";
   }
   $newtable = array_diff($table, $exclude);
-
-  // Use a regexp to select all entities in one pass, to avoid decoding double-escaped entities twice.
-  return preg_replace('/&(#x?)?([A-Za-z0-9]+);/e', '_decode_entities("$1", "$2", "$0", $newtable, $exclude)', $text);
+  return _decode_entities($matches[1], $matches[2], $matches[0], $newtable, $exclude);
 }
 
 /**
- * Helper function for decode_entities
+ * Helper function for decode_entities_preg_replace_callback().
  */
 function _decode_entities($prefix, $codepoint, $original, &$table, &$exclude) {
   // Named entity

=== modified file 'sites/all/modules/codefilter/codefilter.module'
--- sites/all/modules/codefilter/codefilter.module	2010-04-29 22:38:06 +0000
+++ sites/all/modules/codefilter/codefilter.module	2010-08-23 14:58:25 +0000
@@ -105,6 +105,20 @@
 }
 
 /**
+ * Callback to replace <code> elements.
+ */
+function _codefilter_escape_code_tag($matches) {
+  return codefilter_escape($matches[1], 'code');
+}
+
+/**
+ * Callback to replace <?php ?>, [?php ?], <% %>, and [% %] elements.
+ */
+function _codefilter_escape_php_tag($matches) {
+  return codefilter_escape($matches[2], 'php');
+}
+
+/**
  * Implementation of hook_filter()
  */
 function codefilter_filter($op, $delta = 0, $format = -1, $text = '') {
@@ -118,13 +132,13 @@
     case 'prepare':
       /* Note: we replace <code> </code>, <?php ?>, [?php ?], <% %>, and [% %]
          to prevent other filters from acting on them. */
-      $text = preg_replace('@<code>(.+?)</code>@se', "codefilter_escape('$1', 'code')", $text);
-      $text = preg_replace('@[\[<](\?php|%)(.+?)(\?|%)[\]>]@se', "codefilter_escape('$2', 'php')", $text);
+      $text = preg_replace_callback('@<code>(.+?)</code>@s', '_codefilter_escape_code_tag', $text);
+      $text = preg_replace_callback('@[\[<](\?php|%)(.+?)(\?|%)[\]>]@s', '_codefilter_escape_php_tag', $text);
       return $text;
 
     case 'process':
-      $text = preg_replace('@\[codefilter_code\](.+?)\[/codefilter_code\]@se', "codefilter_process_code('$1')", $text);
-      $text = preg_replace('@\[codefilter_php\](.+?)\[/codefilter_php\]@se', "codefilter_process_php('$1')", $text);
+      $text = preg_replace_callback('@\[codefilter_code\](.+?)\[/codefilter_code\]@s', 'codefilter_process_code', $text);
+      $text = preg_replace_callback('@\[codefilter_php\](.+?)\[/codefilter_php\]@s', 'codefilter_process_php', $text);
       return $text;
 
     default:

=== modified file 'sites/all/modules/cvslog/cvs.module'
--- sites/all/modules/cvslog/cvs.module	2010-08-19 16:32:38 +0000
+++ sites/all/modules/cvslog/cvs.module	2010-08-23 14:57:56 +0000
@@ -1393,8 +1393,12 @@
 
 function theme_cvs_commit_message($commit) {
   $repositories = cvs_get_repository_info();
+
+  // Pass the tracker URL to the replacement callback.
   $trackerurl = $repositories[$commit->rid]->trackerurl;
-  $commit->message = preg_replace('/#(\d+)\b/ie', "strtr('<a href=\"$trackerurl\">#\\1</a>', array('%d' => '\\1'))", htmlspecialchars($commit->message));
+  _cvs_commit_message_replace_callback(NULL, $trackerurl);
+  $commit->message = preg_replace_callback('/#(\d+)\b/i', '_cvs_commit_message_replace_callback', htmlspecialchars($commit->message));
+
   $commit->files = cvs_files($commit);
 
   $output .= '<div class="title">' . t('Commit !link by !name at !time',
@@ -1408,6 +1412,14 @@
   return $output;
 }
 
+function _cvs_commit_message_replace_callback($matches, $set_url = NULL) {
+  static $url;
+  if (!isset($matches)) {
+    $url = $set_url;
+  }
+  return strtr('<a href="' . $url . '">#' . $matches[1] . '</a>', array('%d' => $matches[1]));
+}
+
 function cvs_show_messages() {
   global $languages;