diff -aruN --binary 20/administrator/includes/framework.php 21/administrator/includes/framework.php
--- 20/administrator/includes/framework.php	2010-07-18 05:15:44.000000000 +0200
+++ 21/administrator/includes/framework.php	2010-10-08 07:39:10.000000000 +0200
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version		$Id: framework.php 18172 2010-07-17 19:46:57Z ian $
+* @version		$Id: framework.php 19058 2010-10-08 04:15:39Z dextercowley $
 * @package		Joomla
 * @copyright	Copyright (C) 2005 - 2010 Open Source Matters. All rights reserved.
 * @license		GNU/GPL, see LICENSE.php
diff -aruN --binary 20/CHANGELOG.php 21/CHANGELOG.php
--- 20/CHANGELOG.php	2010-07-18 05:15:44.000000000 +0200
+++ 21/CHANGELOG.php	2010-10-08 07:39:10.000000000 +0200
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version		$Id: CHANGELOG.php 18172 2010-07-17 19:46:57Z ian $
+* @version		$Id: CHANGELOG.php 19058 2010-10-08 04:15:39Z dextercowley $
 * @package		Joomla
 * @copyright	Copyright (C) 2005 - 2010 Open Source Matters. All rights reserved.
 * @license		GNU/GPL, see LICENSE.php
@@ -36,6 +36,8 @@
 - -> Removed
 ! -> Note
 
+-------------------- 1.5.21 Stable Release [08-October-2010] ------------------
+
 
 -------------------- 1.5.20 Stable Release [18-July-2010] ------------------
 
diff -aruN --binary 20/includes/framework.php 21/includes/framework.php
--- 20/includes/framework.php	2010-07-18 05:15:44.000000000 +0200
+++ 21/includes/framework.php	2010-10-08 07:39:10.000000000 +0200
@@ -1,6 +1,6 @@
 <?php
 /**
-* @version		$Id: framework.php 18172 2010-07-17 19:46:57Z ian $
+* @version		$Id: framework.php 19058 2010-10-08 04:15:39Z dextercowley $
 * @package		Joomla
 * @copyright	Copyright (C) 2005 - 2010 Open Source Matters. All rights reserved.
 * @license		GNU/GPL, see LICENSE.php
diff -aruN --binary 20/libraries/joomla/environment/uri.php 21/libraries/joomla/environment/uri.php
--- 20/libraries/joomla/environment/uri.php	2010-04-23 13:40:18.000000000 +0200
+++ 21/libraries/joomla/environment/uri.php	2010-10-08 07:39:10.000000000 +0200
@@ -1,6 +1,6 @@
 <?php
 /**
- * @version		$Id: uri.php 16382 2010-04-23 09:33:59Z ian $
+ * @version		$Id: uri.php 19058 2010-10-08 04:15:39Z dextercowley $
  * @package		Joomla.Framework
  * @subpackage	Environment
  * @copyright	Copyright (C) 2005 - 2010 Open Source Matters. All rights reserved.
@@ -175,7 +175,24 @@
 				}
 
 				// Now we need to clean what we got since we can't trust the server var
-				$theURI = urldecode($theURI);
+				// Need to check that the URI is fully decoded in case of multiple-encoded attack vectors.
+				$halt	= 0;
+				while (true)
+				{
+					$last	= $theURI;
+					$theURI = urldecode($theURI);
+
+					// Check whether the last decode is equal to the first.
+					if ($theURI == $last) {
+						// Break out of the while if the URI is stable.
+						break;
+					}
+					else if (++$halt > 10) {
+						// Runaway check. URI has been seriously compromised.
+						jexit();
+					}
+				}
+
 				$theURI = str_replace('"', '&quot;',$theURI);
 				$theURI = str_replace('<', '&lt;',$theURI);
 				$theURI = str_replace('>', '&gt;',$theURI);
diff -aruN --binary 20/libraries/joomla/version.php 21/libraries/joomla/version.php
--- 20/libraries/joomla/version.php	2010-07-18 05:15:44.000000000 +0200
+++ 21/libraries/joomla/version.php	2010-10-08 07:39:10.000000000 +0200
@@ -1,6 +1,6 @@
 <?php
 /**
- * @version		$Id: version.php 18172 2010-07-17 19:46:57Z ian $
+ * @version		$Id: version.php 19058 2010-10-08 04:15:39Z dextercowley $
  * @package	Joomla.Framework
  * @copyright	Copyright (C) 2005 - 2010 Open Source Matters. All rights reserved.
  * @license		GNU/GPL, see LICENSE.php
@@ -26,13 +26,13 @@
 	/** @var string Development Status */
 	var $DEV_STATUS = 'Stable';
 	/** @var int Sub Release Level */
-	var $DEV_LEVEL 	= '20';
+	var $DEV_LEVEL 	= '21';
 	/** @var int build Number */
 	var $BUILD	= '';
 	/** @var string Codename */
-	var $CODENAME 	= 'senu takaa';
+	var $CODENAME 	= 'senu takaa ama wepulai';
 	/** @var string Date */
-	var $RELDATE 	= '18-July-2010';
+	var $RELDATE 	= '08-October-2010';
 	/** @var string Time */
 	var $RELTIME 	= '18:00';
 	/** @var string Timezone */
