Index: trunk/lib/App.inc.php
===================================================================
--- trunk/lib/App.inc.php	(revision 452)
+++ trunk/lib/App.inc.php	(revision 453)
@@ -964,7 +964,14 @@
             // urlencode is not used here, not for form data!
             $query_args = array_merge($this->_carry_queries, $one_time_carry_queries);
-            foreach ($query_args as $key=>$val) {
-                printf('<input type="hidden" name="%s" value="%s" />', $key, $val);
-            }
+            foreach ($query_args as $key => $val) {
+                if (is_array($val)) {
+                    foreach ($val as $subval) {
+                        printf('<input type="hidden" name="%s[]" value="%s" />', $key, $subval);
+                    }
+                } else {
+                    printf('<input type="hidden" name="%s" value="%s" />', $key, $val);
+                }
+            }
+            unset($query_args, $key, $val, $subval);
         }
 
Index: trunk/lib/Auth_SQL.inc.php
===================================================================
--- trunk/lib/Auth_SQL.inc.php	(revision 452)
+++ trunk/lib/Auth_SQL.inc.php	(revision 453)
@@ -4,5 +4,5 @@
  * For details visit the project site: <http://trac.strangecode.com/codebase/>
  * Copyright 2001-2012 Strangecode, LLC
- * 
+ *
  * This file is part of The Strangecode Codebase.
  *
@@ -11,10 +11,10 @@
  * Free Software Foundation, either version 3 of the License, or (at your option)
  * any later version.
- * 
+ *
  * The Strangecode Codebase is distributed in the hope that it will be useful, but
  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
  * details.
- * 
+ *
  * You should have received a copy of the GNU General Public License along with
  * The Strangecode Codebase. If not, see <http://www.gnu.org/licenses/>.
@@ -39,8 +39,8 @@
 
 class Auth_SQL {
-        
+
     // Namespace of this auth object.
     var $_ns;
-    
+
     // Static var for test.
     var $_authentication_tested;
@@ -130,7 +130,7 @@
     {
 		$app =& App::getInstance();
-        
+
         $this->_ns = $namespace;
-        
+
         // Initialize default parameters.
         $this->setParam($this->_default_params);
@@ -157,6 +157,6 @@
 		$app =& App::getInstance();
 		$db =& DB::getInstance();
-	
-    
+
+
         static $_db_tested = false;
 
@@ -277,5 +277,5 @@
     {
 		$app =& App::getInstance();
-    
+
         if (isset($this->_params[$param])) {
             return $this->_params[$param];
@@ -294,5 +294,5 @@
     {
 		$db =& DB::getInstance();
-	
+
         $this->initDB();
 
@@ -416,5 +416,5 @@
 		$app =& App::getInstance();
     	$db =& DB::getInstance();
-	
+
         $this->initDB();
 
@@ -425,5 +425,10 @@
             return false;
         }
-        
+
+        // Convert 'priv' to 'user_type' nomenclature to support older implementations.
+        if (isset($user_data['priv'])) {
+            $user_data['user_type'] = $user_data['priv'];
+        }
+
         // Register authenticated session.
         $_SESSION['_auth_sql'][$this->_ns] = array(
@@ -563,5 +568,5 @@
         $this->_authentication_tested = true;
 
-        // Some users will access from networks with a changing IP number (i.e. behind a proxy server). 
+        // Some users will access from networks with a changing IP number (i.e. behind a proxy server).
         // These users must be allowed entry by adding their IP to the list of trusted_networks, or their usernames to the list of match_remote_ip_exempt_usernames.
         if ($trusted_net = ipInRange(getRemoteAddr(), $this->_params['trusted_networks'])) {
@@ -579,10 +584,10 @@
             $user_in_trusted_network = false;
         }
-        
+
         // Do we match the user's remote IP at all? Yes, if set in config and not disabled for specific user.
         if ($this->getParam('match_remote_ip') && !$this->get('match_remote_ip_exempt')) {
             $remote_ip_is_matched = (isset($_SESSION['_auth_sql'][$this->_ns]['remote_ip']) && $_SESSION['_auth_sql'][$this->_ns]['remote_ip'] == getRemoteAddr()) || $user_in_trusted_network;
         } else {
-            $app->logMsg(sprintf('User_id %s exempt from remote_ip match (comparing %s == %s)', 
+            $app->logMsg(sprintf('User_id %s exempt from remote_ip match (comparing %s == %s)',
                 ($this->get('user_id') ? $this->get('user_id') . ' (' .  $this->get('username') . ')' : 'unknown'),
                 $_SESSION['_auth_sql'][$this->_ns]['remote_ip'],
@@ -593,5 +598,5 @@
 
         // Test login with information stored in session. Skip IP matching for users from trusted networks.
-        if (isset($_SESSION['_auth_sql'][$this->_ns]['authenticated']) 
+        if (isset($_SESSION['_auth_sql'][$this->_ns]['authenticated'])
             && true === $_SESSION['_auth_sql'][$this->_ns]['authenticated']
             && isset($_SESSION['_auth_sql'][$this->_ns]['username'])
@@ -671,5 +676,5 @@
     {
 		$app =& App::getInstance();
-    
+
         if (!$this->isLoggedIn()) {
             // Display message for requiring login. (RaiseMsg will ignore empty strings.)
@@ -694,5 +699,5 @@
 		$app =& App::getInstance();
     	$db =& DB::getInstance();
-	
+
         $this->initDB();
 
@@ -730,5 +735,5 @@
             $user_id = isset($user_id) ? $user_id : $this->getVal('user_id');
             $qid = $db->query("
-                SELECT 1 
+                SELECT 1
                 FROM " . $this->_params['db_table'] . "
                 WHERE blocked = 'true'
@@ -745,7 +750,7 @@
     {
 		$db =& DB::getInstance();
-	
+
         $this->initDB();
-	
+
         if ($this->getParam('blocking')) {
             // Get user_id if specified.
@@ -769,5 +774,5 @@
     {
 		$db =& DB::getInstance();
-	
+
         $this->initDB();
 
@@ -789,5 +794,5 @@
     {
 		$db =& DB::getInstance();
-	
+
         $this->initDB();
 
@@ -846,9 +851,9 @@
     {
         $app =& App::getInstance();
-        
+
         // Existing password hashes rely on the same key/salt being used to compare encryptions.
         // Don't change this (or the value applied to signing_key) unless you know existing hashes or signatures will not be affected!
         $more_salt = 'B36D18E5-3FE4-4D58-8150-F26642852B81';
-        
+
         switch ($this->_params['encryption_type']) {
         case AUTH_ENCRYPT_PLAINTEXT :
@@ -868,7 +873,7 @@
             $hash = sha1($app->getParam('signing_key') . $password . $more_salt);
             // Increase key strength by 12 bits.
-            for ($i=0; $i < 4096; $i++) { 
-                $hash = sha1($hash); 
-            } 
+            for ($i=0; $i < 4096; $i++) {
+                $hash = sha1($hash);
+            }
             return $hash;
             break;
@@ -882,7 +887,7 @@
             $hash = md5($app->getParam('signing_key') . $password . $more_salt);
             // Increase key strength by 12 bits.
-            for ($i=0; $i < 4096; $i++) { 
-                $hash = md5($hash); 
-            } 
+            for ($i=0; $i < 4096; $i++) {
+                $hash = md5($hash);
+            }
             return $hash;
             break;
@@ -902,5 +907,5 @@
 		$app =& App::getInstance();
     	$db =& DB::getInstance();
-	
+
         $this->initDB();
 
@@ -909,5 +914,5 @@
 
         // Get old password.
-        $qid = $db->query(" 
+        $qid = $db->query("
             SELECT userpass
             FROM " . $this->_params['db_table'] . "
@@ -918,5 +923,5 @@
             return false;
         }
-        
+
         // Compare old with new to ensure we're actually *changing* the password.
         $encrypted_password = $this->encryptPassword($password);
@@ -932,10 +937,10 @@
             WHERE " . $this->_params['db_primary_key'] . " = '" . $db->escapeString($user_id) . "'
         ");
-        
+
         if (mysql_affected_rows($db->getDBH()) != 1) {
             $app->logMsg(sprintf('Failed to update password for user_id %s', $user_id), LOG_WARNING, __FILE__, __LINE__);
             return false;
         }
-        
+
         return true;
     }
@@ -952,5 +957,5 @@
 		$app =& App::getInstance();
     	$db =& DB::getInstance();
-	
+
         $this->initDB();
 
@@ -1039,5 +1044,5 @@
     {
 		$app =& App::getInstance();
-    
+
         // return true; /// WTF?
         $zone_members = preg_split('/,\s*/', $security_zone);
