Security

There are some concerns I have about security. It looks like a lot has been done to make dotproject secure, which is good, but I have the feeling that the security model could be accidentally broken without knowing it. The access control lists are a good idea, and the login security methods seem OK, but what concerns me the most is how files are included. There appear to be some inclusion of files based upon get variables, which is obviously a no-no. It also looks like this has been guarded pretty well, but since I'm making destructive changes to the software, I'm not sure if I'm going to break the security model at the same time.