Index: openacs-4/packages/bug-tracker/lib/nav-bar.adp
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/bug-tracker/lib/nav-bar.adp,v
diff -u -r1.6 -r1.7
--- openacs-4/packages/bug-tracker/lib/nav-bar.adp	15 Dec 2010 18:25:25 -0000	1.6
+++ openacs-4/packages/bug-tracker/lib/nav-bar.adp	25 May 2016 07:38:02 -0000	1.7
@@ -10,7 +10,8 @@
       <form action="@form_search_url@" method="get" name="search">
         <input name="q" type="text" size="15" class="bt_navbar" value="#bug-tracker.Search#" 
           onFocus="javascript:this.value='';">
-        <input name="search_package_id" type="hidden" value="@package_id@">
+          <input name="search_package_id" type="hidden" value="@package_id@">
+          <if @::__csrf_token@ defined><input type="hidden" name="__csrf_token" value="@::__csrf_token;literal@"></if>
           <input type="submit" value="#bug-tracker.Search#" class="bt_navbar_btn">
       </form>
   </if>
Index: openacs-4/packages/bug-tracker/lib/one-bug.adp
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/bug-tracker/lib/one-bug.adp,v
diff -u -r1.1 -r1.2
--- openacs-4/packages/bug-tracker/lib/one-bug.adp	26 Jul 2004 13:10:21 -0000	1.1
+++ openacs-4/packages/bug-tracker/lib/one-bug.adp	25 May 2016 07:38:02 -0000	1.2
@@ -9,12 +9,12 @@
   @param style string (either "feed" or "display" -- default is display)
   @param base_url url to the package (ok for this to be empty if in the package, trailing / expected)
 </contract>
-<h1>Bug @bug.bug_number_display@ - @bug.summary@ [@bug.component_name@]</h1>
+<h1>Bug @bug.bug_number_display@ - @bug.summary;noi18n@ [@bug.component_name@]</h1>
 <p>State: @bug.pretty_state@</p>
 <if @bug.found_in_version_name@ not nil><p>Found in version: @bug.found_in_version_name@</p></if>
 <if @bug.fix_for_version_name@ not nil><p>Fix for version: @bug.fix_for_version_name@</p></if>
 <if @bug.fixed_in_version_name@ not nil><p>Fixed in version: @bug.fixed_in_version_name@</p></if>
 
 <multiple name="roles"><p>@roles.role_pretty@: <a href="@roles.user_url@">@roles.user_name@</a></p></multiple>
 
-@comments;noquote@
\ No newline at end of file
+@comments;literal@
\ No newline at end of file
Index: openacs-4/packages/bug-tracker/www/bug.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/bug-tracker/www/bug.tcl,v
diff -u -r1.52 -r1.53
--- openacs-4/packages/bug-tracker/www/bug.tcl	18 May 2016 07:15:59 -0000	1.52
+++ openacs-4/packages/bug-tracker/www/bug.tcl	25 May 2016 07:38:02 -0000	1.53
@@ -14,6 +14,11 @@
 	    ad_complain "invalid value for show_patch_status"
 	}
     }
+    check_bug_number -requires bug_number:integer {
+	if {$bug_number > 2**31} {
+	    ad_complain "invalid bug number"
+	}
+    }
 }
 
 #####
Index: openacs-4/packages/bug-tracker/www/patch.adp
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/bug-tracker/www/patch.adp,v
diff -u -r1.10 -r1.11
--- openacs-4/packages/bug-tracker/www/patch.adp	3 Jul 2015 11:19:06 -0000	1.10
+++ openacs-4/packages/bug-tracker/www/patch.adp	25 May 2016 07:38:02 -0000	1.11
@@ -1,7 +1,7 @@
 <master src="../lib/master">
 <property name="doc(title)">@page_title;literal@</property>
 <property name="context">@context;literal@</property>
-<property name="displayed_object_id">@patch.patch_id;literal@</property>
+<if @patch.patch_id@ defined><property name="displayed_object_id">@patch.patch_id;literal@</property></if>
 
 <formtemplate id="patch"></formtemplate>
 
Index: openacs-4/packages/bug-tracker/www/patch.tcl
===================================================================
RCS file: /usr/local/cvsroot/openacs-4/packages/bug-tracker/www/patch.tcl,v
diff -u -r1.27 -r1.28
--- openacs-4/packages/bug-tracker/www/patch.tcl	18 May 2016 07:15:14 -0000	1.27
+++ openacs-4/packages/bug-tracker/www/patch.tcl	25 May 2016 07:38:02 -0000	1.28
@@ -6,7 +6,7 @@
     @cvs-id $Id$
 } {
     patch_number:integer,notnull
-    mode:optional
+    mode:word,optional
     cancel_edit:optional    
     edit:optional
     accept:optional
@@ -40,7 +40,7 @@
 set versions_p [bug_tracker::versions_p]
 
 # Abort editing and return to view mode if the user hit cancel on the edit form
-if { ([info exists cancel_edit] && $cancel_edit ne "") } {
+if { [info exists cancel_edit] && $cancel_edit ne "" } {
     ad_returnredirect $view_patch_url
     ad_script_abort
 }
@@ -58,17 +58,17 @@
 # Initialize the page mode variable
 # We are in view mode per default
 if { ![info exists mode] } {
-    if { ([info exists edit] && $edit ne "") } {
+    if { [info exists edit] && $edit ne "" } {
         set mode edit
-    } elseif { ([info exists accept] && $accept ne "") } {        
+    } elseif { [info exists accept] && $accept ne "" } {        
         set mode accept
-    } elseif { ([info exists refuse] && $refuse ne "") } {
+    } elseif { [info exists refuse] && $refuse ne "" } {
         set mode refuse
-    } elseif { ([info exists delete] && $delete ne "") } {
+    } elseif { [info exists delete] && $delete ne "" } {
         set mode delete
-    } elseif { ([info exists reopen] && $reopen ne "") } {
+    } elseif { [info exists reopen] && $reopen ne "" } {
         set mode reopen
-    } elseif { ([info exists comment] && $comment ne "") } {
+    } elseif { [info exists comment] && $comment ne "" } {
         set mode comment
     } else {
         set mode view
@@ -416,7 +416,7 @@
     }
 }
 
-if { [form is_valid patch] } {
+if { [form is_valid patch] && $mode ne "view"} {
     # A valid submit of the form
 
     set update_exprs [list]