@@ -347,7 +347,7 @@ else if(isset($_POST['submit'])) {

 				<td><label for='newlanguage'>"._LANGUAGE.":</label></td><td><select name='newlanguage'>";

 		$directory = opendir(_BASEDIR."languages");

 			while($filename = readdir($directory)) {

-				if($filename=="." || $filename==".." || substr($filename, 2) == "_admin.php") continue;

+				if($filename=="." || $filename==".." || $filename=="mailer" || substr($filename, 2) == "_admin.php") continue;

 				$output .= "<option value='".substr($filename, 0, 2)."'".

 					($language == substr($filename, 0, strpos($filename, ".php")) ? " selected" : "").">

 				".substr($filename, 0, strpos($filename, ".php"))."</option>";

@@ -233,7 +233,7 @@ else if(isset($_POST['submit'])) {

 	}

 	else if($sect == "sitesettings") {

-		$tinyMCE = ($_POST['newtinyMCE'] == 1  OR $_POST['newtinyMCE'] == 2 OR $_POST['newtinyMCE'] == 3 OR $_POST['newtinyMCE'] == 4) ? $_POST['newtinyMCE'] : 0;

+		$tinyMCE = ($_POST['newtinyMCE'] == 1  OR $_POST['newtinyMCE'] == 2 OR $_POST['newtinyMCE'] == 3 OR $_POST['newtinyMCE'] == 4 OR $_POST['newtinyMCE'] == 5) ? $_POST['newtinyMCE'] : 0;

 		$allowed_tags = $_POST['newallowed_tags'];

 		$favorites = $_POST['newfavorites'] == 1 ? 1 : 0;

 		$multiplecats = $_POST['newmultiplecats'] == 1 ? 1 : 0;

@@ -419,7 +419,8 @@ else if(isset($_POST['submit'])) {

 		<table class='acp' style='margin: 0 auto;'>

 			<tr>

 				<td><label for='newtinyMCE'>"._USETINYMCE. ": </label></td><td><select name='newtinyMCE'>

-				<option value=\"4\"" . ($tinyMCE == 4 ? " selected" : "") . ">tinyMCE 6</option>

+				<option value=\"5\"" . ($tinyMCE == 5 ? " selected" : "") . ">tinyMCE 6</option>

+				<option value=\"4\"" . ($tinyMCE == 4 ? " selected" : "") . ">tinyMCE 5</option>

 				<option value=\"3\"" . ($tinyMCE == 3 ? " selected" : "") . ">tinyMCE 4</option>

 				<option value=\"2\"" . ($tinyMCE == 2 ? " selected" : "") . ">tinyMCE 3</option>

 				<option value=\"1\"" . ($tinyMCE == 1 ? " selected" : "") . ">tinyMCE 2</option>

@@ -636,6 +636,7 @@ else if(isset($_POST['submit'])) {

 	if($sect == "email") {

 		$output .= "<div class='sectionheader'>"._TESTSMTP_HEADER."</div>

 		<div align='center'>

+			<p>

 				<form method='POST' action='admin.php?action=settings&amp;sect=email' style='display:inline'>

 					<input type='submit' class='button' name='testsmtp' value='"._TESTSMTP."'>

 				</form>

@@ -410,7 +410,7 @@ else if(isset($_POST['submit'])) {

 				<td><label for='newstoriespath'>"._STORIESPATH.":</label></td><td><input type='text' class='textbox=' name='newstoriespath' value='$storiespath'> <a href='#' class='pophelp'>[?]<span>"._HELP_STORIESPATH."</span></a></td>

 			</tr>

 			<tr>

-				<td colspan='2'><fieldset style='margin: 0 auto;'><legend>"._MAXMINWORDS."<a href='#' class='pophelp'>[?]<span>"._HELP_MINMAXWORDS."</span></a></legend>

+				<td colspan='2'><fieldset style='margin: 0 auto;'><legend>"._MAXMINWORDS." <a href='#' class='pophelp'>[?]<span>"._HELP_MINMAXWORDS."</span></a></legend>

 				<label for='newminwords'>"._MIN.":</label> <span style='padding-left: 38.44%;'> <input  type='text' class='textbox=' name='newminwords' value='$minwords' size='5'> <br />

 				<label for='newmaxwords'>"._MAX.":</label> <span style='padding-left: 37.7%;'> <input  type='text' class='textbox=' name='newmaxwords' value='$maxwords' size='7'></fieldset></td></tr>";

 	}

@@ -433,7 +433,7 @@ else if(isset($_POST['submit'])) {

 				<td><label for='newfavorites'>"._FAVORITES.": </label></td><td><select name='newfavorites'>

 				<option value='1'".($favorites == "1" ? " selected" : "").">"._YES."</option>

 				<option value='0'".($favorites == "0" ? " selected" : "").">"._NO."</option>

-				</select><a href='#' class='pophelp'>[?]<span>"._HELP_FAVORITES."</span></a></td>

+				</select> <a href='#' class='pophelp'>[?]<span>"._HELP_FAVORITES."</span></a></td>

 			</tr>

 			<tr>

 				<td><label for='newmultiplecats'>"._NUMCATS.": </label></td><td><select name='newmultiplecats'>

@@ -475,7 +475,7 @@ else if(isset($_POST['submit'])) {

 				<td><label for='newcaptcha'>"._CAPTCHA.": </label></td><td><select name='newcaptcha'>

 				<option value='1'".($captcha == "1" ? " selected" : "").">"._YES."</option>

 				<option value='0'".(!isset($captcha) || $captcha == "0" ? " selected" : "").">"._NO."</option>

-				</select><a href='#' class='pophelp'>[?]<span>"._HELP_CAPTCHA."</span></a></td></tr>";

+				</select> <a href='#' class='pophelp'>[?]<span>"._HELP_CAPTCHA."</span></a></td></tr>";

 	}

 	else if($sect == "display") {

 		$settings = dbquery("SELECT defaultsort, displayindex FROM ".$settingsprefix."fanfiction_settings WHERE sitekey ='".SITEKEY."'");

@@ -436,7 +436,7 @@ else if(isset($_POST['submit'])) {

 				</select><a href='#' class='pophelp'>[?]<span>"._HELP_FAVORITES."</span></a></td>

 			</tr>

 			<tr>

-				<td><label for='newmultplecats'>"._NUMCATS.": </label></td><td><select name='newmultiplecats'>

+				<td><label for='newmultiplecats'>"._NUMCATS.": </label></td><td><select name='newmultiplecats'>

 				<option value='1'".($multiplecats == "1" ? "selected" : "").">"._MORETHANONE."</option>

 				<option value='0'".($multiplecats == "0" ? "selected" : "").">"._ONLYONE."</option>

 				</select> <a href='#' class='pophelp'>[?]<span>"._HELP_NUMCATS."</span></a></td>

@@ -237,12 +237,13 @@ else if(isset($_POST['submit'])) {

 		$allowed_tags = $_POST['newallowed_tags'];

 		$favorites = $_POST['newfavorites'] == 1 ? 1 : 0;

 		$multiplecats = $_POST['newmultiplecats'] == 1 ? 1 : 0;

+		$setreg = $_POST['newsetreg'] == 1 ? 1 : 0;

 		$newscomments = $_POST['newnewscomments'] == 1 ? 1 : 0;

 		$logging = $_POST['newlogging'] == 1 ? 1 : 0;

 		$maintenance = $_POST['newmaint'] == 1 ? 1 : 0;

 		$debug = $_POST['newdebug'] == 1 ? 1 : 0;

 		$captcha = $_POST['newcaptcha'] == 1 ? 1 : 0;

-		$result = dbquery("UPDATE ".$settingsprefix."fanfiction_settings SET tinyMCE = '$tinyMCE', favorites = '$favorites', multiplecats = '$multiplecats', allowed_tags = '$allowed_tags', newscomments = '$newscomments', logging = '$logging', maintenance = '$maintenance', debug = '$debug', captcha = '$captcha' WHERE sitekey ='".SITEKEY."'");

+		$result = dbquery("UPDATE ".$settingsprefix."fanfiction_settings SET tinyMCE = '$tinyMCE', favorites = '$favorites', multiplecats = '$multiplecats', setreg = '$setreg', allowed_tags = '$allowed_tags', newscomments = '$newscomments', logging = '$logging', maintenance = '$maintenance', debug = '$debug', captcha = '$captcha' WHERE sitekey ='".SITEKEY."'");

 	}

 	else if($sect == "display") {

 		$dateformat = $_POST['newdateformat'] ? descript(strip_tags($_POST['newdateformat'])) : descript(strip_tags($_POST['customdateformat']));

@@ -418,7 +419,7 @@ else if(isset($_POST['submit'])) {

 		<table class='acp' style='margin: 0 auto;'>

 			<tr>

 				<td><label for='newtinyMCE'>"._USETINYMCE. ": </label></td><td><select name='newtinyMCE'>

-				<option value=\"4\"" . ($tinyMCE == 4 ? " selected" : "") . ">tinyMCE 4</option>

+				<option value=\"4\"" . ($tinyMCE == 4 ? " selected" : "") . ">tinyMCE 6</option>

 				<option value=\"3\"" . ($tinyMCE == 3 ? " selected" : "") . ">tinyMCE 4</option>

 				<option value=\"2\"" . ($tinyMCE == 2 ? " selected" : "") . ">tinyMCE 3</option>

 				<option value=\"1\"" . ($tinyMCE == 1 ? " selected" : "") . ">tinyMCE 2</option>

@@ -440,6 +441,12 @@ else if(isset($_POST['submit'])) {

 				<option value='0'".($multiplecats == "0" ? "selected" : "").">"._ONLYONE."</option>

 				</select> <a href='#' class='pophelp'>[?]<span>"._HELP_NUMCATS."</span></a></td>

 			</tr>

+			<tr>

+				<td><label for='newsetreg'>"._SETREG.": </label></td><td><select name='newsetreg'>

+				<option value='1'".($setreg == "1" ? "selected" : "").">"._YES."</option>

+				<option value='0'".($setreg == "0" ? "selected" : "").">"._NO."</option>

+				</select> <a href='#' class='pophelp'>[?]<span>"._HELP_SETREG."</span></a></td>

+			</tr>

 			<tr>

 				<td><label for='newnewscomments'>"._NEWSCOMMENTS.": </label></td><td><select name='newnewscomments'>

 				<option value='1'".($newscomments == "1" ? " selected" : "").">"._YES."</option>

@@ -233,7 +233,7 @@ else if(isset($_POST['submit'])) {

 	}

 	else if($sect == "sitesettings") {

-		$tinyMCE = ($_POST['newtinyMCE'] == 1  OR $_POST['newtinyMCE'] == 2 OR $_POST['newtinyMCE'] == 3) ? $_POST['newtinyMCE'] : 0;

+		$tinyMCE = ($_POST['newtinyMCE'] == 1  OR $_POST['newtinyMCE'] == 2 OR $_POST['newtinyMCE'] == 3 OR $_POST['newtinyMCE'] == 4) ? $_POST['newtinyMCE'] : 0;

 		$allowed_tags = $_POST['newallowed_tags'];

 		$favorites = $_POST['newfavorites'] == 1 ? 1 : 0;

 		$multiplecats = $_POST['newmultiplecats'] == 1 ? 1 : 0;

@@ -418,6 +418,7 @@ else if(isset($_POST['submit'])) {

 		<table class='acp' style='margin: 0 auto;'>

 			<tr>

 				<td><label for='newtinyMCE'>"._USETINYMCE. ": </label></td><td><select name='newtinyMCE'>

+				<option value=\"4\"" . ($tinyMCE == 4 ? " selected" : "") . ">tinyMCE 4</option>

 				<option value=\"3\"" . ($tinyMCE == 3 ? " selected" : "") . ">tinyMCE 4</option>

 				<option value=\"2\"" . ($tinyMCE == 2 ? " selected" : "") . ">tinyMCE 3</option>

 				<option value=\"1\"" . ($tinyMCE == 1 ? " selected" : "") . ">tinyMCE 2</option>

@@ -396,8 +396,8 @@ else if(isset($_POST['submit'])) {

 			</tr>

 			<tr>

 				<td colspan='2'><fieldset style='margin: 0 auto;'><legend>"._IMAGESIZE." <a href='#' class='pophelp'>[?]<span>"._HELP_IMAGESIZE."</span></a></legend>

-				<label for='newimageheight'>"._MAXHEIGHT.":</label> <span style='padding-left: 19.3%;'> <input  type='text' class='textbox=' name='newimageheight' value='$imageheight' size='5'> <br />

-				<label for='newimagewidth'>"._MAXWIDTH.":</label> <span style='padding-left: 20.3%;'> <input  type='text' class='textbox=' name='newimagewidth' value='$imagewidth' size='5'></fieldset></td>

+				<label for='newimageheight'>"._MAXHEIGHT.":</label> <span style='padding-left: 24.3%;'> <input  type='text' class='textbox=' name='newimageheight' value='$imageheight' size='5'> <br />

+				<label for='newimagewidth'>"._MAXWIDTH.":</label> <span style='padding-left: 25.3%;'> <input  type='text' class='textbox=' name='newimagewidth' value='$imagewidth' size='5'></fieldset></td>

 			</tr>

 			<tr>

 				<td><label for='newstore'>"._HOWSTORE.":</label></td><td><select name='newstore' onChange='if (this.disabled) this.selectedIndex=0' disabled>

@@ -410,8 +410,8 @@ else if(isset($_POST['submit'])) {

 			</tr>

 			<tr>

 				<td colspan='2'><fieldset style='margin: 0 auto;'><legend>"._MAXMINWORDS."<a href='#' class='pophelp'>[?]<span>"._HELP_MINMAXWORDS."</span></a></legend>

-				<label for='newminwords'>"._MIN.":</label> <span style='padding-left: 33.44%;'> <input  type='text' class='textbox=' name='newminwords' value='$minwords' size='5'> <br />

-				<label for='newmaxwords'>"._MAX.":</label> <span style='padding-left: 32.7%;'> <input  type='text' class='textbox=' name='newmaxwords' value='$maxwords' size='7'></fieldset></td></tr>";

+				<label for='newminwords'>"._MIN.":</label> <span style='padding-left: 38.44%;'> <input  type='text' class='textbox=' name='newminwords' value='$minwords' size='5'> <br />

+				<label for='newmaxwords'>"._MAX.":</label> <span style='padding-left: 37.7%;'> <input  type='text' class='textbox=' name='newmaxwords' value='$maxwords' size='7'></fieldset></td></tr>";

 	}

 	else if($sect == "sitesettings") {

 		$output .= "<div class='sectionheader'>"._SITESETTINGS."</div>

@@ -326,13 +326,13 @@ else if(isset($_POST['submit'])) {

 			<tr>

 				<td><label for='newurl'>"._SITEURL.":</label></td><td><input type='text' class='textbox' name='newsiteurl' value='$url'> <a href='#' class='pophelp'>[?]<span>"._HELP_URL."</span></a></td>

 			</tr>

-			<tr>				

+			<tr>

 				<td><label for='newtableprefix'>"._TABLEPREFIX.":</label></td><td><input type='text' class='textbox' name='newtableprefix' value='".TABLEPREFIX."'> <a href='#' class='pophelp'>[?]<span>"._HELP_TABLEPREFIX."</span></a></td>

 			</tr>

-			<tr>				

+			<tr>

 				<td><label for='newsiteemail'>"._ADMINEMAIL.":</label></td><td><input type='text' class='textbox' name='newsiteemail' value='$siteemail'> <a href='#' class='pophelp'>[?]<span>"._HELP_SITEEMAIL."</span></a></td>

 			</tr>

-			<tr>				

+			<tr>

 				<td><label for='newsiteskin'>"._DEFAULTSKIN.":</label></td><td><select name='newskin'>";

 		$directory = opendir(_BASEDIR."skins");

 		while($filename = readdir($directory)) {

@@ -418,9 +418,9 @@ else if(isset($_POST['submit'])) {

 		<table class='acp' style='margin: 0 auto;'>

 			<tr>

 				<td><label for='newtinyMCE'>"._USETINYMCE. ": </label></td><td><select name='newtinyMCE'>

-				<option value=\"3\"" . ($tinyMCE == 3 ? " selected" : "") . ">TinyMce4</option>

-				<option value=\"2\"" . ($tinyMCE == 2 ? " selected" : "") . ">TinyMce3</option>

-				<option value=\"1\"" . ($tinyMCE == 1 ? " selected" : "") . ">TinyMce2</option>

+				<option value=\"3\"" . ($tinyMCE == 3 ? " selected" : "") . ">tinyMCE 4</option>

+				<option value=\"2\"" . ($tinyMCE == 2 ? " selected" : "") . ">tinyMCE 3</option>

+				<option value=\"1\"" . ($tinyMCE == 1 ? " selected" : "") . ">tinyMCE 2</option>

 				<option value=\"0\"" . (!$tinyMCE ? " selected" : "") . ">" . _NO . "</option>

 				</select> <a href='#' class='pophelp'>[?]<span>"._HELP_TINYMCE." "._TINYMCENOTE."</span></a></td>

 			</tr>

@@ -233,7 +233,7 @@ else if(isset($_POST['submit'])) {

 	}

 	else if($sect == "sitesettings") {

-		$tinyMCE = ($_POST['newtinyMCE'] == 1  OR $_POST['newtinyMCE'] == 2) ? $_POST['newtinyMCE'] : 0;

+		$tinyMCE = ($_POST['newtinyMCE'] == 1  OR $_POST['newtinyMCE'] == 2 OR $_POST['newtinyMCE'] == 3) ? $_POST['newtinyMCE'] : 0;

 		$allowed_tags = $_POST['newallowed_tags'];

 		$favorites = $_POST['newfavorites'] == 1 ? 1 : 0;

 		$multiplecats = $_POST['newmultiplecats'] == 1 ? 1 : 0;

@@ -396,8 +396,8 @@ else if(isset($_POST['submit'])) {

 			</tr>

 			<tr>

 				<td colspan='2'><fieldset style='margin: 0 auto;'><legend>"._IMAGESIZE." <a href='#' class='pophelp'>[?]<span>"._HELP_IMAGESIZE."</span></a></legend>

-				<label for='newimageheight'>"._MAXHEIGHT.":</label> <span style='padding-left: 24.3%;'> <input  type='text' class='textbox=' name='newimageheight' value='$imageheight' size='5'> <br />

-				<label for='newimagewidth'>"._MAXWIDTH.":</label> <span style='padding-left: 25.3%;'> <input  type='text' class='textbox=' name='newimagewidth' value='$imagewidth' size='5'></fieldset></td>

+				<label for='newimageheight'>"._MAXHEIGHT.":</label> <span style='padding-left: 19.3%;'> <input  type='text' class='textbox=' name='newimageheight' value='$imageheight' size='5'> <br />

+				<label for='newimagewidth'>"._MAXWIDTH.":</label> <span style='padding-left: 20.3%;'> <input  type='text' class='textbox=' name='newimagewidth' value='$imagewidth' size='5'></fieldset></td>

 			</tr>

 			<tr>

 				<td><label for='newstore'>"._HOWSTORE.":</label></td><td><select name='newstore' onChange='if (this.disabled) this.selectedIndex=0' disabled>

@@ -410,16 +410,17 @@ else if(isset($_POST['submit'])) {

 			</tr>

 			<tr>

 				<td colspan='2'><fieldset style='margin: 0 auto;'><legend>"._MAXMINWORDS."<a href='#' class='pophelp'>[?]<span>"._HELP_MINMAXWORDS."</span></a></legend>

-				<label for='newminwords'>"._MIN.":</label> <span style='padding-left: 38.44%;'> <input  type='text' class='textbox=' name='newminwords' value='$minwords' size='5'> <br />

-				<label for='newmaxwords'>"._MAX.":</label> <span style='padding-left: 37.7%;'> <input  type='text' class='textbox=' name='newmaxwords' value='$maxwords' size='7'></fieldset></td></tr>";

+				<label for='newminwords'>"._MIN.":</label> <span style='padding-left: 33.44%;'> <input  type='text' class='textbox=' name='newminwords' value='$minwords' size='5'> <br />

+				<label for='newmaxwords'>"._MAX.":</label> <span style='padding-left: 32.7%;'> <input  type='text' class='textbox=' name='newmaxwords' value='$maxwords' size='7'></fieldset></td></tr>";

 	}

 	else if($sect == "sitesettings") {

 		$output .= "<div class='sectionheader'>"._SITESETTINGS."</div>

 		<table class='acp' style='margin: 0 auto;'>

 			<tr>

 				<td><label for='newtinyMCE'>"._USETINYMCE. ": </label></td><td><select name='newtinyMCE'>

-				<option value=\"2\"" . ($tinyMCE == 2 ? " selected" : "") . ">TinyMce4</option>

-				<option value=\"1\"" . ($tinyMCE == 1 ? " selected" : "") . ">TinyMce3</option>

+				<option value=\"3\"" . ($tinyMCE == 3 ? " selected" : "") . ">TinyMce4</option>

+				<option value=\"2\"" . ($tinyMCE == 2 ? " selected" : "") . ">TinyMce3</option>

+				<option value=\"1\"" . ($tinyMCE == 1 ? " selected" : "") . ">TinyMce2</option>

 				<option value=\"0\"" . (!$tinyMCE ? " selected" : "") . ">" . _NO . "</option>

 				</select> <a href='#' class='pophelp'>[?]<span>"._HELP_TINYMCE." "._TINYMCENOTE."</span></a></td>

 			</tr>

@@ -410,7 +410,7 @@ else if(isset($_POST['submit'])) {

 			</tr>

 			<tr>

 				<td colspan='2'><fieldset style='margin: 0 auto;'><legend>"._MAXMINWORDS."<a href='#' class='pophelp'>[?]<span>"._HELP_MINMAXWORDS."</span></a></legend>

-				<label for='newminwords'>"._MIN.":</label> <span style='padding-left: 38.5%;'> <input  type='text' class='textbox=' name='newminwords' value='$minwords' size='5'> <br />

+				<label for='newminwords'>"._MIN.":</label> <span style='padding-left: 38.44%;'> <input  type='text' class='textbox=' name='newminwords' value='$minwords' size='5'> <br />

 				<label for='newmaxwords'>"._MAX.":</label> <span style='padding-left: 37.7%;'> <input  type='text' class='textbox=' name='newmaxwords' value='$maxwords' size='7'></fieldset></td></tr>";

 	}

 	else if($sect == "sitesettings") {

@@ -396,8 +396,8 @@ else if(isset($_POST['submit'])) {

 			</tr>

 			<tr>

 				<td colspan='2'><fieldset style='margin: 0 auto;'><legend>"._IMAGESIZE." <a href='#' class='pophelp'>[?]<span>"._HELP_IMAGESIZE."</span></a></legend>

-				<label for='newimageheight'>"._MAXHEIGHT.":</label> &nbsp; &nbsp; &nbsp; <input  type='text' class='textbox=' name='newimageheight' value='$imageheight' size='5'> <br />

-				<label for='newimagewidth'>"._MAXWIDTH.":</label> &nbsp; &nbsp; &nbsp; &nbsp; <input  type='text' class='textbox=' name='newimagewidth' value='$imagewidth' size='5'></fieldset></td>

+				<label for='newimageheight'>"._MAXHEIGHT.":</label> <span style='padding-left: 24.3%;'> <input  type='text' class='textbox=' name='newimageheight' value='$imageheight' size='5'> <br />

+				<label for='newimagewidth'>"._MAXWIDTH.":</label> <span style='padding-left: 25.3%;'> <input  type='text' class='textbox=' name='newimagewidth' value='$imagewidth' size='5'></fieldset></td>

 			</tr>

 			<tr>

 				<td><label for='newstore'>"._HOWSTORE.":</label></td><td><select name='newstore' onChange='if (this.disabled) this.selectedIndex=0' disabled>

@@ -410,8 +410,8 @@ else if(isset($_POST['submit'])) {

 			</tr>

 			<tr>

 				<td colspan='2'><fieldset style='margin: 0 auto;'><legend>"._MAXMINWORDS."<a href='#' class='pophelp'>[?]<span>"._HELP_MINMAXWORDS."</span></a></legend>

-				<label for='newminwords'>"._MIN.":</label> &nbsp; &nbsp; &nbsp; <input  type='text' class='textbox=' name='newminwords' value='$minwords' size='5'> <br />

-				<label for='newmaxwords'>"._MAX.":</label> &nbsp; &nbsp; &nbsp; <input  type='text' class='textbox=' name='newmaxwords' value='$maxwords' size='7'></fieldset></td></tr>";

+				<label for='newminwords'>"._MIN.":</label> <span style='padding-left: 38.5%;'> <input  type='text' class='textbox=' name='newminwords' value='$minwords' size='5'> <br />

+				<label for='newmaxwords'>"._MAX.":</label> <span style='padding-left: 37.7%;'> <input  type='text' class='textbox=' name='newmaxwords' value='$maxwords' size='7'></fieldset></td></tr>";

 	}

 	else if($sect == "sitesettings") {

 		$output .= "<div class='sectionheader'>"._SITESETTINGS."</div>

@@ -310,10 +310,10 @@ else if(isset($_POST['submit'])) {

 		$$var = stripslashes($val );

 	}

-	$output .= "<form method='POST' class='tblborder' style='width:30%; margin:0 auto' enctype='multipart/form-data' action='".((isset($action) && $action == "settings") ? "admin.php?action=settings" : $_SERVER['PHP_SELF']."?step=".$_GET['step'])."&amp;sect=$sect'>";

+	$output .= "<br><form method='POST' class='tblborder' style='width: 45%; margin: 0 auto;' enctype='multipart/form-data' action='".((isset($action) && $action == "settings") ? "admin.php?action=settings" : $_SERVER['PHP_SELF']."?step=".$_GET['step'])."&amp;sect=$sect'>";

 	if($sect == "main") {

 		$output .= "<div class='sectionheader'>"._SITEINFO."</div>

-		<table class='acp'>

+		<table class='acp' style='margin: 0 auto;'>

 			<tr>

 				<td><label for='newsitekey'>"._SITEKEY.":</label></td><td><input type='text' class='textbox' name='newsitekey' value='".SITEKEY."'> <a href='#' class='pophelp'>[?]<span>"._HELP_SITEKEY."</span></a></td>

 			</tr>

@@ -356,7 +356,7 @@ else if(isset($_POST['submit'])) {

 	}

 	else if($sect == "submissions") {

 		$output .= "<div class='sectionheader'>"._SUBMISSIONSETTINGS."</div>

-		<table class='acp'>

+		<table class='acp' style='margin: 0 auto;'>

 			<tr>

 				<td><label for='newsubmissionsoff'>"._NOSUBS.":</label></td><td><select name='newsubmissionsoff'>

 				<option value='1'".($submissionsoff == "1" ? " selected" : "").">"._YES."</option>

@@ -396,8 +396,8 @@ else if(isset($_POST['submit'])) {

 			</tr>

 			<tr>

 				<td colspan='2'><fieldset style='margin: 0 auto;'><legend>"._IMAGESIZE." <a href='#' class='pophelp'>[?]<span>"._HELP_IMAGESIZE."</span></a></legend>

-				<label for='newimageheight'>"._MAXHEIGHT.":</label> &nbsp; &nbsp; <input  type='text' class='textbox=' name='newimageheight' value='$imageheight' size='5'> <br />

-				<label for='newimagewidth'>"._MAXWIDTH.":</label> &nbsp; &nbsp; &nbsp; <input  type='text' class='textbox=' name='newimagewidth' value='$imagewidth' size='5'></fieldset></td>

+				<label for='newimageheight'>"._MAXHEIGHT.":</label> &nbsp; &nbsp; &nbsp; <input  type='text' class='textbox=' name='newimageheight' value='$imageheight' size='5'> <br />

+				<label for='newimagewidth'>"._MAXWIDTH.":</label> &nbsp; &nbsp; &nbsp; &nbsp; <input  type='text' class='textbox=' name='newimagewidth' value='$imagewidth' size='5'></fieldset></td>

 			</tr>

 			<tr>

 				<td><label for='newstore'>"._HOWSTORE.":</label></td><td><select name='newstore' onChange='if (this.disabled) this.selectedIndex=0' disabled>

@@ -415,7 +415,7 @@ else if(isset($_POST['submit'])) {

 	}

 	else if($sect == "sitesettings") {

 		$output .= "<div class='sectionheader'>"._SITESETTINGS."</div>

-		<table class='acp'>

+		<table class='acp' style='margin: 0 auto;'>

 			<tr>

 				<td><label for='newtinyMCE'>"._USETINYMCE. ": </label></td><td><select name='newtinyMCE'>

 				<option value=\"2\"" . ($tinyMCE == 2 ? " selected" : "") . ">TinyMce4</option>

@@ -475,7 +475,7 @@ else if(isset($_POST['submit'])) {

 				"d.m.y", "Y.m.d", "m.d.Y", "d-m-y", "m-d-y", "M d Y", "M d, Y", "F d Y", "F d, Y");

 		$defaulttimes = array("h:i a", "h:i A", "H:i", "g:i a", "g:i A", "G:i", "h:i:s a", "H:i:s", "g:i:s a", "g:i:s A", "G:i:s");

 		$output .= "<div class='sectionheader'>"._DISPLAYSETTINGS."</div>

-		<table class='acp'>

+		<table class='acp' style='margin: 0 auto;'>

 			<tr>

 				<td><label for='newdateformat'>"._DATEFORMAT.":</label></td><td><select name='newdateformat'><option value=''>"._SELECTONE."</option>";

 		foreach($defaultdates as $date) {

@@ -536,7 +536,7 @@ else if(isset($_POST['submit'])) {

 	}

 	else if($sect == "reviews") {

 		$output .= "<div class='sectionheader'>"._REVIEWSETTINGS."</div>

-		<table class='acp'>

+		<table class='acp' style='margin: 0 auto;'>

 			<tr>

 				<td><label for='newreviewsallowed'>"._ONREVIEWS.":</label></td><td><select name='newreviewsallowed'>

 				<option value='1'".($reviewsallowed == "1" ? " selected" : "").">"._YES."</option>

@@ -572,7 +572,7 @@ else if(isset($_POST['submit'])) {

 	}

 	else if($sect == "useropts") {

 		$output .= "<div class='sectionheader'>"._USERSETTINGS."</div>

-		<table class='acp'>

+		<table class='acp' style='margin: 0 auto;'>

 			<tr>

 				<td><label for='newalertson'>"._ALERTSON.":</label></td><td><select name='newalertson'>

 				<option value='1'".($alertson == "1" ? " selected" : "").">"._YES."</option>

@@ -599,7 +599,7 @@ else if(isset($_POST['submit'])) {

 	}

 	else if($sect == "email") {

 		$output .= "<div class='sectionheader'>"._EMAILSETTINGS."</div>

-		<table class='acp'>

+		<table class='acp' style='margin: 0 auto;'>

 			<tr>

 				<td><label for='newsmtp_host'>"._SMTPHOST.":</label></td><td><input name='newsmtp_host' type='text' value='$smtp_host'> <a href='#' class='pophelp'>[?]<span>"._HELP_SMTPHOST."</span></a></td>

 		</tr>

@@ -619,20 +619,19 @@ else if(isset($_POST['submit'])) {

 				</select> <a href='#' class='pophelp'>[?]<span>"._HELP_SMTPSECURE."</span></a></td></tr>";

 		$output .= 	write_message(_SMTPOFF);

 	}

-	$output .= "<tr><td colspan='2'><div align='center'><input type='submit' id='submit' class='button' name='submit' value='"._SUBMIT."'></div></form></td></tr></table>";

+	$output .= "<tr><td colspan='2'><div align='center'><br><input type='submit' id='submit' class='button' name='submit' value='"._SUBMIT."'><p></div></form></td></tr></table>";

 	// The SMTP test button lives OUTSIDE the main settings form (nested forms are

 	// invalid HTML). It is its own POST mini-form -- a submit button, not a GET

 	// link -- so the outbound SMTP connection can't be triggered by a plain link

 	// or a browser prefetch. The existing testsmtp handler posts to the same URL.

 	if($sect == "email") {

 		$output .= "<div class='sectionheader'>"._TESTSMTP_HEADER."</div>

-		<ul>

-			<li>

+		<div align='center'>

 				<form method='POST' action='admin.php?action=settings&amp;sect=email' style='display:inline'>

 					<input type='submit' class='button' name='testsmtp' value='"._TESTSMTP."'>

 				</form>

 				<a href='#' class='pophelp'>[?]<span>"._HELP_TESTSMTP."</span></a>

-			</li>

-		</ul>";

+			<p>

+		</div>";

 	}

 ?>

@@ -50,7 +50,7 @@ function updatePanelOrder( ) {

 }

 if($action == "settings") {

-$output .= "<h1>"._SETTINGS."</h1><div style='text-align: center;'>

+$output .= "<div id='pagetitle'>"._SETTINGS."</div><div style='text-align: center;'>

 	<a href='admin.php?action=settings&amp;sect=main'>"._MAINSETTINGS."</a> |

 	<a href='admin.php?action=settings&amp;sect=submissions'>"._SUBMISSIONSETTINGS."</a> |

 	<a href='admin.php?action=settings&amp;sect=sitesettings'>"._SITESETTINGS."</a> |

@@ -310,9 +310,9 @@ else if(isset($_POST['submit'])) {

 		$$var = stripslashes($val );

 	}

-	$output .= "<form method='POST' class='tblborder' style='' enctype='multipart/form-data' action='".((isset($action) && $action == "settings") ? "admin.php?action=settings" : $_SERVER['PHP_SELF']."?step=".$_GET['step'])."&amp;sect=$sect'>";

+	$output .= "<form method='POST' class='tblborder' style='width:30%; margin:0 auto' enctype='multipart/form-data' action='".((isset($action) && $action == "settings") ? "admin.php?action=settings" : $_SERVER['PHP_SELF']."?step=".$_GET['step'])."&amp;sect=$sect'>";

 	if($sect == "main") {

-		$output .= "<h2>"._SITEINFO."</h2>

+		$output .= "<div class='sectionheader'>"._SITEINFO."</div>

 		<table class='acp'>

 			<tr>

 				<td><label for='newsitekey'>"._SITEKEY.":</label></td><td><input type='text' class='textbox' name='newsitekey' value='".SITEKEY."'> <a href='#' class='pophelp'>[?]<span>"._HELP_SITEKEY."</span></a></td>

@@ -355,7 +355,7 @@ else if(isset($_POST['submit'])) {

 		$output .= "</select> <a href='#' class='pophelp'>[?]<span>"._HELP_LANGUAGE."</span></a></td></tr>";

 	}

 	else if($sect == "submissions") {

-		$output .= "<h2>"._SUBMISSIONSETTINGS."</h2>

+		$output .= "<div class='sectionheader'>"._SUBMISSIONSETTINGS."</div>

 		<table class='acp'>

 			<tr>

 				<td><label for='newsubmissionsoff'>"._NOSUBS.":</label></td><td><select name='newsubmissionsoff'>

@@ -396,8 +396,8 @@ else if(isset($_POST['submit'])) {

 			</tr>

 			<tr>

 				<td colspan='2'><fieldset style='margin: 0 auto;'><legend>"._IMAGESIZE." <a href='#' class='pophelp'>[?]<span>"._HELP_IMAGESIZE."</span></a></legend>

-				<label for='newimageheight'>"._MAXHEIGHT.":</label> <input  type='text' class='textbox=' name='newimageheight' value='$imageheight' size='5'> <br />

-				<label for='newimagewidth'>"._MAXWIDTH.":</label> <input  type='text' class='textbox=' name='newimagewidth' value='$imagewidth' size='5'></fieldset></td>

+				<label for='newimageheight'>"._MAXHEIGHT.":</label> &nbsp; &nbsp; <input  type='text' class='textbox=' name='newimageheight' value='$imageheight' size='5'> <br />

+				<label for='newimagewidth'>"._MAXWIDTH.":</label> &nbsp; &nbsp; &nbsp; <input  type='text' class='textbox=' name='newimagewidth' value='$imagewidth' size='5'></fieldset></td>

 			</tr>

 			<tr>

 				<td><label for='newstore'>"._HOWSTORE.":</label></td><td><select name='newstore' onChange='if (this.disabled) this.selectedIndex=0' disabled>

@@ -410,11 +410,11 @@ else if(isset($_POST['submit'])) {

 			</tr>

 			<tr>

 				<td colspan='2'><fieldset style='margin: 0 auto;'><legend>"._MAXMINWORDS."<a href='#' class='pophelp'>[?]<span>"._HELP_MINMAXWORDS."</span></a></legend>

-				<label for='newminwords'>"._MIN.":</label> <input  type='text' class='textbox=' name='newminwords' value='$minwords' size='5'> <br />

-				<label for='newmaxwords'>"._MAX.":</label> <input  type='text' class='textbox=' name='newmaxwords' value='$maxwords' size='7'></fieldset></td></tr>";

+				<label for='newminwords'>"._MIN.":</label> &nbsp; &nbsp; &nbsp; <input  type='text' class='textbox=' name='newminwords' value='$minwords' size='5'> <br />

+				<label for='newmaxwords'>"._MAX.":</label> &nbsp; &nbsp; &nbsp; <input  type='text' class='textbox=' name='newmaxwords' value='$maxwords' size='7'></fieldset></td></tr>";

 	}

 	else if($sect == "sitesettings") {

-		$output .= "<h2>"._SITESETTINGS."</h2>

+		$output .= "<div class='sectionheader'>"._SITESETTINGS."</div>

 		<table class='acp'>

 			<tr>

 				<td><label for='newtinyMCE'>"._USETINYMCE. ": </label></td><td><select name='newtinyMCE'>

@@ -474,7 +474,7 @@ else if(isset($_POST['submit'])) {

 		$defaultdates = array("m/d/y", "m/d/Y", "m/d/Y", "d/m/Y", "d/m/y", "d M Y", 

 				"d.m.y", "Y.m.d", "m.d.Y", "d-m-y", "m-d-y", "M d Y", "M d, Y", "F d Y", "F d, Y");

 		$defaulttimes = array("h:i a", "h:i A", "H:i", "g:i a", "g:i A", "G:i", "h:i:s a", "H:i:s", "g:i:s a", "g:i:s A", "G:i:s");

-		$output .= "<h2>"._DISPLAYSETTINGS."</h2>

+		$output .= "<div class='sectionheader'>"._DISPLAYSETTINGS."</div>

 		<table class='acp'>

 			<tr>

 				<td><label for='newdateformat'>"._DATEFORMAT.":</label></td><td><select name='newdateformat'><option value=''>"._SELECTONE."</option>";

@@ -535,7 +535,7 @@ else if(isset($_POST['submit'])) {

 			<td><label for='newlinkrange'>"._LINKRANGE.":</label></td><td><input  type='text' class='textbox=' name='newlinkrange' size='3' value='$linkrange'> <a href='#' class='pophelp'>[?]<span>"._HELP_LINKRANGE."</span></a></td></tr>";

 	}

 	else if($sect == "reviews") {

-		$output .= "<h2>"._REVIEWSETTINGS."</h2>

+		$output .= "<div class='sectionheader'>"._REVIEWSETTINGS."</div>

 		<table class='acp'>

 			<tr>

 				<td><label for='newreviewsallowed'>"._ONREVIEWS.":</label></td><td><select name='newreviewsallowed'>

@@ -571,7 +571,7 @@ else if(isset($_POST['submit'])) {

 				</select> <a href='#' class='pophelp'>[?]<span>"._HELP_RATEONLY."</span></a></td></tr>";

 	}

 	else if($sect == "useropts") {

-		$output .= "<h2>"._USERSETTINGS."</h2>

+		$output .= "<div class='sectionheader'>"._USERSETTINGS."</div>

 		<table class='acp'>

 			<tr>

 				<td><label for='newalertson'>"._ALERTSON.":</label></td><td><select name='newalertson'>

@@ -598,7 +598,7 @@ else if(isset($_POST['submit'])) {

 			</select> <a href='#' class='pophelp'>[?]<span>"._HELP_PWD."</span></a></td></tr>";

 	}

 	else if($sect == "email") {

-		$output .= "<h2>"._EMAILSETTINGS."</h2>

+		$output .= "<div class='sectionheader'>"._EMAILSETTINGS."</div>

 		<table class='acp'>

 			<tr>

 				<td><label for='newsmtp_host'>"._SMTPHOST.":</label></td><td><input name='newsmtp_host' type='text' value='$smtp_host'> <a href='#' class='pophelp'>[?]<span>"._HELP_SMTPHOST."</span></a></td>

@@ -625,7 +625,7 @@ else if(isset($_POST['submit'])) {

 	// link -- so the outbound SMTP connection can't be triggered by a plain link

 	// or a browser prefetch. The existing testsmtp handler posts to the same URL.

 	if($sect == "email") {

-		$output .= "<h2>"._TESTSMTP_HEADER."</h2>

+		$output .= "<div class='sectionheader'>"._TESTSMTP_HEADER."</div>

 		<ul>

 			<li>

 				<form method='POST' action='admin.php?action=settings&amp;sect=email' style='display:inline'>

@@ -558,6 +558,7 @@ else if(isset($_POST['submit'])) {

 		</tr>

 		<tr>

 				<td><label for='newratings'>"._WHATRATINGS.":</label></td><td><select name='newratings'>

+				<option value='3'".($ratings == "3" ? " selected" : "").">"._LIKES_NUMBER_SYS."</option>

 				<option value='2'".($ratings == "2" ? " selected" : "").">"._LIKESYS."</option>

 				<option value='1'".($ratings == "1" ? " selected" : "").">"._STARS."</option>

 				<option value='0'".($ratings == "0" ? " selected" : "").">"._NONE."</option>

@@ -301,6 +301,7 @@ else if(isset($_POST['submit'])) {

 	} else {

 		$output .= write_error(_ERROR);

 	}

+}

 	$settingsresults = dbquery("SELECT * FROM ".$settingsprefix."fanfiction_settings WHERE sitekey ='".SITEKEY."'");

 	$settings = dbassoc($settingsresults);

@@ -308,7 +309,6 @@ else if(isset($_POST['submit'])) {

 		if(is_NULL($val)) $val = '';

 		$$var = stripslashes($val );

 	}

-	}

 	$output .= "<form method='POST' class='tblborder' style='' enctype='multipart/form-data' action='".((isset($action) && $action == "settings") ? "admin.php?action=settings" : $_SERVER['PHP_SELF']."?step=".$_GET['step'])."&amp;sect=$sect'>";

 	if($sect == "main") {

@@ -557,8 +557,7 @@ else if(isset($_POST['submit'])) {

 				</select> <a href='#' class='pophelp'>[?]<span>"._HELP_REVDELETE."</span></a></td>

 		</tr>

 		<tr>

-				<td><label for='newratings'>"._WHATRATINGS. ":</label></td><td><select name='newratings'>

-				<option value='3'" . ($ratings == "3" ? " selected" : "") . ">" . _LIKES_NUMBER . "</option>

+				<td><label for='newratings'>"._WHATRATINGS.":</label></td><td><select name='newratings'>

 				<option value='2'".($ratings == "2" ? " selected" : "").">"._LIKESYS."</option>

 				<option value='1'".($ratings == "1" ? " selected" : "").">"._STARS."</option>

 				<option value='0'".($ratings == "0" ? " selected" : "").">"._NONE."</option>

@@ -77,7 +77,117 @@ $sects = array("main", "submissions", "sitesettings", "display", "reviews", "use

 //if(!isset($_GET['sect'])) $sect = "main";

 //else $sect = $_GET['sect'];

 $sect = isset($_GET['sect']) ? $_GET['sect'] : "main";

-if(isset($_POST['submit'])) {

+if(isset($_POST['testsmtp']) && $sect == "email") {

+	// SMTP connection test. Runs only on POST (the Test button), never via a GET

+	// parameter. It verifies the SAVED settings loaded from fanfiction_settings

+	// (via header.php) -- NOT the unsaved form values -- by opening a real SMTP

+	// connection and reporting each step. It never sends an email and never writes

+	// to the database, so it must not touch $result or advance $sects.

+	$output .= "<h2>"._TESTSMTP_HEADER."</h2>";

+	if(empty($smtp_host)) {

+		$output .= write_error(_TESTSMTP_NOHOST);

+	}

+	else {

+		// Effective values MUST mirror the real sending behaviour of sendemail():

+		// PHPMailer's default port is 25, and 'ssl' uses an ssl:// transport prefix.

+		$port   = !empty($smtp_port) ? (int) $smtp_port : 25;

+		$secure = !empty($smtp_secure) ? $smtp_secure : '';

+		$host   = ($secure === 'ssl') ? 'ssl://'.$smtp_host : $smtp_host;

+

+		$output .= write_message(sprintf(_TESTSMTP_PORTNOTE, htmlspecialchars((string) $port), htmlspecialchars($secure !== '' ? $secure : '(none)')));

+		// If encryption is requested but no port is saved, warn about the usual port

+		// -- but still run the test on the effective values, since that is what real

+		// sending will do.

+		if(empty($smtp_port) && $secure === 'ssl') $output .= write_message(_TESTSMTP_SSLPORTWARN);

+		if(empty($smtp_port) && $secure === 'tls') $output .= write_message(_TESTSMTP_TLSPORTWARN);

+

+		// Load the SMTP class the same way emailer.php loads PHPMailer, via the

+		// autoloader -- NOT by requiring class.smtp.php directly. After the planned

+		// PHPMailer 6.x upgrade the autoload file becomes a shim and this must keep

+		// working (that upgrade must alias the SMTP class name; see issue #2).

+		require_once(_BASEDIR."includes/PHPMailerAutoload.php");

+

+		$steps = "";

+		ob_start();

+		$smtp = new SMTP;

+		$smtp->do_debug = 2;

+		try {

+			if(!$smtp->connect($host, $port, 10)) {

+				$steps .= write_error(sprintf(_TESTSMTP_CONNECTFAIL, htmlspecialchars($host), htmlspecialchars((string) $port)));

+			}

+			else {

+				$steps .= write_message(sprintf(_TESTSMTP_CONNECTOK, htmlspecialchars($host), htmlspecialchars((string) $port)));

+				if(!$smtp->hello(gethostname())) {

+					$err = $smtp->getError();

+					$steps .= write_error(sprintf(_TESTSMTP_HELOFAIL, htmlspecialchars(!empty($err['error']) ? $err['error'] : '')));

+				}

+				else {

+					$steps .= write_message(_TESTSMTP_HELOOK);

+					$ext = $smtp->getServerExtList();

+					$hasStartTls = is_array($ext) && array_key_exists('STARTTLS', $ext);

+					if($hasStartTls) {

+						$steps .= write_message(_TESTSMTP_STARTTLSOK);

+						if($secure === 'tls') {

+							if(!$smtp->startTLS()) {

+								$err = $smtp->getError();

+								$steps .= write_error(sprintf(_TESTSMTP_STARTTLSFAIL, htmlspecialchars(!empty($err['error']) ? $err['error'] : '')));

+							}

+							else {

+								// Re-issue EHLO over the now-encrypted channel and refresh caps.

+								$smtp->hello(gethostname());

+								$ext = $smtp->getServerExtList();

+							}

+						}

+					}

+					else if($secure === 'tls') {

+						$steps .= write_error(_TESTSMTP_STARTTLSMISSING);

+					}

+					$hasAuth = is_array($ext) && array_key_exists('AUTH', $ext);

+					if($hasAuth) {

+						if(!empty($smtp_username)) {

+							if(!$smtp->authenticate($smtp_username, $smtp_password)) {

+								// NOTE: never include the password in this message.

+								$err = $smtp->getError();

+								$steps .= write_error(sprintf(_TESTSMTP_AUTHFAIL, htmlspecialchars(!empty($err['error']) ? $err['error'] : '')));

+							}

+							else {

+								$steps .= write_message(_TESTSMTP_AUTHOK);

+							}

+						}

+						else {

+							$steps .= write_message(_TESTSMTP_AUTHSKIP);

+						}

+					}

+					else {

+						$steps .= write_message(_TESTSMTP_NOAUTH);

+					}

+				}

+			}

+		} catch (Exception $e) {

+			$steps .= write_error(htmlspecialchars($e->getMessage()));

+		}

+		// Always close the connection, even if we stopped early above.

+		$smtp->quit(true);

+		$debug = ob_get_clean();

+

+		// SECURITY: the debug transcript at level 2 echoes client commands, which

+		// during AUTH include the base64-encoded credentials. Redact every form of

+		// the password before it is ever shown so it is never printed anywhere.

+		if(!empty($smtp_password)) {

+			$secrets = array(

+				$smtp_password,

+				base64_encode($smtp_password),

+				base64_encode("\0".$smtp_username."\0".$smtp_password), // AUTH PLAIN

+			);

+			$debug = str_replace($secrets, "***REDACTED***", $debug);

+		}

+

+		$output .= $steps;

+		// Server banners are untrusted input -> escape the whole transcript (XSS).

+		$output .= "<h3>"._TESTSMTP_TRANSCRIPT."</h3><pre style='text-align:left; overflow:auto; background-color: rgba(0, 0, 0, .6); margin-top: 10px; color: #fff; padding: 8px;'>".htmlspecialchars($debug)."</pre>";

+	}

+}

+else if(isset($_POST['submit'])) {

 	if($sect == "main") {

 		if(!preg_match("!^[a-z0-9_]{3,30}$!i", $_POST['newsitekey'])) $output .= write_error(_BADSITEKEY);

 		else {

@@ -164,21 +274,29 @@ if(isset($_POST['submit'])) {

 		$result = dbquery("UPDATE ".$settingsprefix."fanfiction_settings SET alertson = '$alertson', disablepopups = '$disablepopups', agestatement = '$agestatement', pwdsetting = '$pwdsetting' WHERE sitekey ='".SITEKEY."'");

 	}

 	else if($sect == "email") {

-		$smtp_host = $_POST['newsmtp_host'];

-		$smtp_username = $_POST['newsmtp_username'];

-		$smtp_password = $_POST['newsmtp_password'];

-		$result = dbquery("UPDATE ".$settingsprefix."fanfiction_settings SET smtp_host = '$smtp_host', smtp_username = '$smtp_username', smtp_password = '$smtp_password' WHERE sitekey ='".SITEKEY."'");

+		$smtp_host = escapestring(descript(strip_tags($_POST['newsmtp_host'])));

+		$smtp_username = escapestring(descript(strip_tags($_POST['newsmtp_username'])));

+		$smtp_password = escapestring(descript(strip_tags($_POST['newsmtp_password'])));

+		$smtp_port = !empty($_POST['newsmtp_port']) ? (int) $_POST['newsmtp_port'] : '';

+		$smtp_secure = in_array($_POST['newsmtp_secure'], array('', 'tls', 'ssl'), true) ? $_POST['newsmtp_secure'] : '';

+		$result = dbquery("UPDATE ".$settingsprefix."fanfiction_settings SET smtp_host = '$smtp_host', smtp_username = '$smtp_username', smtp_password = '$smtp_password', smtp_port = '$smtp_port', smtp_secure = '$smtp_secure' WHERE sitekey ='".SITEKEY."'");

 	}

 	if ($result) {

 		$output .= write_message(_ACTIONSUCCESSFUL);

-		

-		$idx = array_search($sect, $sects);

-		if ($idx !== false) {

-			$next_idx = $idx + 1;

-			if ($next_idx >= count($sects)) {

-				$next_idx = 0;

+		// The section-advance wizard is for the INSTALLER only (install/install.php

+		// includes this file and steps through sections). In admin, "email" is the

+		// last entry in $sects, so advancing would wrap to 0 and jump back to the

+		// first tab while the URL still says sect=email. $action is undefined in the

+		// installer include context, so guard with isset() to avoid a PHP 8 warning.

+		if (!isset($action) || $action != "settings") {

+			$idx = array_search($sect, $sects);

+			if ($idx !== false) {

+				$next_idx = $idx + 1;

+				if ($next_idx >= count($sects)) {

+					$next_idx = 0;

+				}

+				$sect = $sects[$next_idx];

 			}

-			$sect = $sects[$next_idx];

 		}

 	} else {

 		$output .= write_error(_ERROR);

@@ -190,8 +308,9 @@ if(isset($_POST['submit'])) {

 		if(is_NULL($val)) $val = '';

 		$$var = stripslashes($val );

 	}

+	}

-	$output .= "<form method='POST' class='tblborder' style='' enctype='multipart/form-data' action='".($action == "settings" ? "admin.php?action=settings" : $_SERVER['PHP_SELF']."?step=".$_GET['step'])."&amp;sect=$sect'>";

+	$output .= "<form method='POST' class='tblborder' style='' enctype='multipart/form-data' action='".((isset($action) && $action == "settings") ? "admin.php?action=settings" : $_SERVER['PHP_SELF']."?step=".$_GET['step'])."&amp;sect=$sect'>";

 	if($sect == "main") {

 		$output .= "<h2>"._SITEINFO."</h2>

 		<table class='acp'>

@@ -488,8 +607,32 @@ if(isset($_POST['submit'])) {

 				<td><label for='newsmtp_username'>"._SMTPUSER.":</label></td><td><input name='newsmtp_username' type='text' value='$smtp_username'> <a href='#' class='pophelp'>[?]<span>"._HELP_SMTPUSER."</span></a></td>

 		</tr>

 		<tr>

-				<td><label for='newsmtp_password'>"._SMTPPASS.":</label></td><td><input name='newsmtp_password' type='password' value='$smtp_password'> <a href='#' class='pophelp'>[?]<span>"._HELP_SMTPPWD."</span></a></td></tr>";		

+				<td><label for='newsmtp_password'>"._SMTPPASS.":</label></td><td><input name='newsmtp_password' type='password' value='$smtp_password'> <a href='#' class='pophelp'>[?]<span>"._HELP_SMTPPWD."</span></a></td></tr>

+		<tr>

+				<td><label for='newsmtp_port'>"._SMTPPORT.":</label></td><td><input name='newsmtp_port' type='text' value='".((isset($smtp_port) && $smtp_port !== '') ? $smtp_port : '')."'> <a href='#' class='pophelp'>[?]<span>"._HELP_SMTPPORT."</span></a></td>

+		</tr>

+		<tr>

+				<td><label for='newsmtp_secure'>"._SMTPSECURE.":</label></td><td><select name='newsmtp_secure'>

+					<option value=''".((!isset($smtp_secure) || $smtp_secure === '') ? " selected" : "").">(none)</option>

+					<option value='tls'".((isset($smtp_secure) && $smtp_secure == 'tls') ? " selected" : "").">STARTTLS / 587</option>

+					<option value='ssl'".((isset($smtp_secure) && $smtp_secure == 'ssl') ? " selected" : "").">SSL / 465</option>

+				</select> <a href='#' class='pophelp'>[?]<span>"._HELP_SMTPSECURE."</span></a></td></tr>";

 		$output .= 	write_message(_SMTPOFF);

 	}

 	$output .= "<tr><td colspan='2'><div align='center'><input type='submit' id='submit' class='button' name='submit' value='"._SUBMIT."'></div></form></td></tr></table>";

+	// The SMTP test button lives OUTSIDE the main settings form (nested forms are

+	// invalid HTML). It is its own POST mini-form -- a submit button, not a GET

+	// link -- so the outbound SMTP connection can't be triggered by a plain link

+	// or a browser prefetch. The existing testsmtp handler posts to the same URL.

+	if($sect == "email") {

+		$output .= "<h2>"._TESTSMTP_HEADER."</h2>

+		<ul>

+			<li>

+				<form method='POST' action='admin.php?action=settings&amp;sect=email' style='display:inline'>

+					<input type='submit' class='button' name='testsmtp' value='"._TESTSMTP."'>

+				</form>

+				<a href='#' class='pophelp'>[?]<span>"._HELP_TESTSMTP."</span></a>

+			</li>

+		</ul>";

+	}

 ?>

@@ -169,13 +169,20 @@ if(isset($_POST['submit'])) {

 		$smtp_password = $_POST['newsmtp_password'];

 		$result = dbquery("UPDATE ".$settingsprefix."fanfiction_settings SET smtp_host = '$smtp_host', smtp_username = '$smtp_username', smtp_password = '$smtp_password' WHERE sitekey ='".SITEKEY."'");

 	}

-	if($result) {

+	if ($result) {

 		$output .= write_message(_ACTIONSUCCESSFUL);

-		$sect = $sects[(array_search($sect, $sects) + 1)];

-		if(!$sect) $sect = $sects[0];

+		

+		$idx = array_search($sect, $sects);

+		if ($idx !== false) {

+			$next_idx = $idx + 1;

+			if ($next_idx >= count($sects)) {

+				$next_idx = 0;

+			}

+			$sect = $sects[$next_idx];

+		}

+	} else {

+		$output .= write_error(_ERROR);

 	}

-	else $output .= write_error(_ERROR);

-}

 	$settingsresults = dbquery("SELECT * FROM ".$settingsprefix."fanfiction_settings WHERE sitekey ='".SITEKEY."'");

 	$settings = dbassoc($settingsresults);

@@ -431,7 +431,8 @@ if(isset($_POST['submit'])) {

 				</select> <a href='#' class='pophelp'>[?]<span>"._HELP_REVDELETE."</span></a></td>

 		</tr>

 		<tr>

-				<td><label for='newratings'>"._WHATRATINGS.":</label></td><td><select name='newratings'>

+				<td><label for='newratings'>"._WHATRATINGS. ":</label></td><td><select name='newratings'>

+				<option value='3'" . ($ratings == "3" ? " selected" : "") . ">" . _LIKES_NUMBER . "</option>

 				<option value='2'".($ratings == "2" ? " selected" : "").">"._LIKESYS."</option>

 				<option value='1'".($ratings == "1" ? " selected" : "").">"._STARS."</option>

 				<option value='0'".($ratings == "0" ? " selected" : "").">"._NONE."</option>

@@ -86,8 +86,8 @@ if(isset($_POST['submit'])) {

 			$sitename = escapestring(descript(strip_tags($_POST['newsitename'])));

 			$slogan = escapestring(descript(strip_tags($_POST['newslogan'])));

 			$url = escapestring(descript(strip_tags($_POST['newsiteurl'])));

-			// if the http:// is missing add it.

-			if(substr($url, 0, 7) != "http://") $url = "http://".$url;

+			// if the https:// is missing add it.

+			if(substr($url, 0, 8) != "https://" && substr($url, 0, 7) != "http://") $url = "https://".$url;

 			// we also want to check for a trailing slash.

 			if(substr($url, -1, 1) == "/") $url = substr($url, 0, strlen($url) - 1);

 			$tableprefix = escapestring(descript(strip_tags($_POST['newtableprefix'])));

@@ -484,4 +484,4 @@ if(isset($_POST['submit'])) {

 		$output .= 	write_message(_SMTPOFF);

 	}

 	$output .= "<tr><td colspan='2'><div align='center'><input type='submit' id='submit' class='button' name='submit' value='"._SUBMIT."'></div></form></td></tr></table>";

-?>

\ No newline at end of file

+?>

new file mode 100644

@@ -0,0 +1,487 @@

+<?php

+// ----------------------------------------------------------------------

+// eFiction 3.2

+// Copyright (c) 2007 by Tammy Keefer

+// Valid HTML 4.01 Transitional

+// Based on eFiction 1.1

+// Copyright (C) 2003 by Rebecca Smallwood.

+// http://efiction.sourceforge.net/

+// ----------------------------------------------------------------------

+// LICENSE

+//

+// This program is free software; you can redistribute it and/or

+// modify it under the terms of the GNU General Public License (GPL)

+// as published by the Free Software Foundation; either version 2

+// of the License, or (at your option) any later version.

+//

+// This program is distributed in the hope that it will be useful,

+// but WITHOUT ANY WARRANTY; without even the implied warranty of

+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

+// GNU General Public License for more details.

+//

+// To read the license please visit http://www.gnu.org/copyleft/gpl.html

+// ----------------------------------------------------------------------

+

+if(!defined("_CHARSET")) exit( );

+

+function updatePanelOrder( ) {

+	

+	$ptypes = dbquery("SELECT panel_type FROM ".TABLEPREFIX."fanfiction_panels GROUP BY panel_type");

+	while($ptype = dbassoc($ptypes)) {

+		if($ptype['panel_type'] == "A") {

+			for($x = 1; $x < 5; $x++) {

+				$count = 1;

+				$plist = dbquery("SELECT panel_name, panel_id FROM ".TABLEPREFIX."fanfiction_panels WHERE panel_hidden = '0' AND panel_type = '".$ptype['panel_type']."' AND panel_level = '$x' ORDER BY panel_level, panel_order");

+				while($p = dbassoc($plist)) {

+					dbquery("UPDATE ".TABLEPREFIX."fanfiction_panels SET panel_order = '$count' WHERE panel_id = '".$p['panel_id']."' LIMIT 1");

+					$count++;

+				}

+			}

+		}

+		else {

+			$count = 1;

+			$plist = dbquery("SELECT panel_name, panel_id FROM ".TABLEPREFIX."fanfiction_panels WHERE panel_hidden = '0' AND panel_type = '".$ptype['panel_type']."' ORDER BY ".($ptype['panel_type'] == "A" ? "panel_level," : "")."panel_order");

+			while($p = dbassoc($plist)) {

+				dbquery("UPDATE ".TABLEPREFIX."fanfiction_panels SET panel_order = '$count' WHERE panel_id = '".$p['panel_id']."' LIMIT 1");

+				$count++;

+			}

+		}

+	}

+}

+

+if($action == "settings") {

+$output .= "<h1>"._SETTINGS."</h1><div style='text-align: center;'>

+	<a href='admin.php?action=settings&amp;sect=main'>"._MAINSETTINGS."</a> |

+	<a href='admin.php?action=settings&amp;sect=submissions'>"._SUBMISSIONSETTINGS."</a> |

+	<a href='admin.php?action=settings&amp;sect=sitesettings'>"._SITESETTINGS."</a> |

+	<a href='admin.php?action=settings&amp;sect=display'>"._DISPLAYSETTINGS."</a> |

+	<a href='admin.php?action=settings&amp;sect=reviews'>"._REVIEWSETTINGS."</a> |

+	<a href='admin.php?action=settings&amp;sect=useropts'>"._USERSETTINGS."</a> |

+	<a href='admin.php?action=settings&amp;sect=email'>"._EMAILSETTINGS."</a> |

+	<a href='admin.php?action=censor'>"._CENSOR."</a> <br />

+	<a href='admin.php?action=messages&message=welcome'>"._WELCOME."</a> | 

+	<a href='admin.php?action=messages&message=copyright'>"._COPYRIGHT."</a> | 

+	<a href='admin.php?action=messages&message=printercopyright'>"._PRINTERCOPYRIGHT."</a> | 

+	<a href='admin.php?action=messages&message=tinyMCE'>"._TINYMCE."</a> | 

+	<a href='admin.php?action=messages&message=nothankyou'>"._NOTHANKYOU."</a> | 

+	<a href='admin.php?action=messages&message=thankyou'>"._THANKYOU."</a><br />";

+	$settingsquery = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_panels WHERE panel_type = 'AS' ORDER BY panel_title");

+	while($os = dbassoc($settingsquery)) {

+		if($os['panel_url']) $othersettings[] = "<a href='".$os['panel_url']."'>".$os['panel_title']."</a>";

+	}

+	if(isset($othersettings)) $output .= implode(" | ", $othersettings);

+$output .= "</div> ";

+}	

+

+$sects = array("main", "submissions", "sitesettings", "display", "reviews", "useropts", "email");

+//if(!isset($_GET['sect'])) $sect = "main";

+//else $sect = $_GET['sect'];

+$sect = isset($_GET['sect']) ? $_GET['sect'] : "main";

+if(isset($_POST['submit'])) {

+	if($sect == "main") {

+		if(!preg_match("!^[a-z0-9_]{3,30}$!i", $_POST['newsitekey'])) $output .= write_error(_BADSITEKEY);

+		else {

+			$oldsitekey = $sitekey;

+			$sitekey = descript($_POST['newsitekey']);

+			$sitename = escapestring(descript(strip_tags($_POST['newsitename'])));

+			$slogan = escapestring(descript(strip_tags($_POST['newslogan'])));

+			$url = escapestring(descript(strip_tags($_POST['newsiteurl'])));

+			// if the http:// is missing add it.

+			if(substr($url, 0, 7) != "http://") $url = "http://".$url;

+			// we also want to check for a trailing slash.

+			if(substr($url, -1, 1) == "/") $url = substr($url, 0, strlen($url) - 1);

+			$tableprefix = escapestring(descript(strip_tags($_POST['newtableprefix'])));

+			$siteemail = escapestring(descript(strip_tags($_POST['newsiteemail'])));

+			$skin = escapestring(descript(strip_tags($_POST['newskin'])));

+			$language = escapestring(descript(strip_tags($_POST['newlanguage'])));

+			if(empty($sitekey)) $output .= write_message(_SITEKEYREQUIRED);

+			else {

+				if($sitekey != $oldsitekey) $output .= write_message(_SITEKEYCHANGED);

+				$result = dbquery("UPDATE ".$settingsprefix."fanfiction_settings SET sitekey = '$sitekey', sitename = '$sitename', slogan = '$slogan', url = '$url', tableprefix = '$tableprefix', siteemail = '$siteemail', skin = '$skin', language = '$language' WHERE sitekey = '$oldsitekey'");