I am guessing that older version of 3.0 should have the flaw patched by 2.2.8 too. I can not upgrade to HEAD yet. If my 3.0a21 has the flaw, can someone point me to what files I need to look for a merge? Thanks, Chere