diff --git a/.gitattributes b/.gitattributes
index cf4591b5559f578416c25310f63844ed5c561cf4..0f862e83b745d959ba686e2e280dcbe4ddd7a6f6 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -309,6 +309,7 @@ dist/vignettes/xml.png -text
 dist/vignettes/zip.png -text
 dist/win_width.htc -text
 ecrire/action/autoriser.php -text
+ecrire/action/converser.php -text
 ecrire/action/dater.php -text
 ecrire/action/documenter.php -text
 ecrire/action/editer_article.php -text
@@ -492,6 +493,7 @@ ecrire/inc/plugin.php -text
 ecrire/inc/popularites.php -text
 ecrire/inc/referencer_traduction.php -text
 ecrire/inc/regler_moderation.php -text
+ecrire/inc/securiser_action.php -text
 ecrire/inc/selectionner.php -text
 ecrire/inc/selectionner_auteur.php -text
 ecrire/inc/sites_voir.php -text
diff --git a/dist/formulaires/formulaire_forum.html b/dist/formulaires/formulaire_forum.html
index bc6d139b560c560f0cafafe7d2db506dc6f479eb..ffb0b3b2cd24db3630c0f2842b35d4bf7c42494d 100644
--- a/dist/formulaires/formulaire_forum.html
+++ b/dist/formulaires/formulaire_forum.html
@@ -4,7 +4,7 @@
 
 <form action="#ENV{url}#formulaire_forum" method="post">
 [(#ENV{url_post}|form_hidden)]
-[<input type="hidden" name="alea" value="(#ENV{alea})" />]
+[<input type="hidden" name="arg" value="(#ENV{arg})" />]
 [<input type="hidden" name="hash" value="(#ENV{hash})" />]
 [<input type="hidden" name="verif_(#ENV{hash})" value="ok" />]
 [<input type="hidden" name="afficher_texte" value="(#ENV{afficher_texte})" />]
diff --git a/ecrire/action/converser.php b/ecrire/action/converser.php
new file mode 100644
index 0000000000000000000000000000000000000000..14607f5299d29ef4e73adae8f86a7cb7f4f0f95d
--- /dev/null
+++ b/ecrire/action/converser.php
@@ -0,0 +1,48 @@
+<?php
+
+/***************************************************************************\
+ *  SPIP, Systeme de publication pour l'internet                           *
+ *                                                                         *
+ *  Copyright (c) 2001-2006                                                *
+ *  Arnaud Martin, Antoine Pitrou, Philippe Riviere, Emmanuel Saint-James  *
+ *                                                                         *
+ *  Ce programme est un logiciel libre distribue sous licence GNU/GPL.     *
+ *  Pour plus de details voir le fichier COPYING.txt ou l'aide en ligne.   *
+\***************************************************************************/
+
+if (!defined("_ECRIRE_INC_VERSION")) return;
+
+include_spip('inc/cookie');
+
+// changer de langue espace prive (ou login)
+
+function action_converser_dist()
+{
+	$lang = _request('var_lang_ecrire');
+
+	if (_FILE_CONNECT AND $lang) {
+		$var_f = charger_fonction('securiser_action', 'inc');
+		$var_f();
+		spip_query("UPDATE spip_auteurs SET lang = " . _q($lang) . " WHERE id_auteur = " . $GLOBALS['auteur_session']['id_auteur']);
+		$auteur_session['lang'] = $lang;
+		$var_f = charger_fonction('session', 'inc');
+		$var_f($auteur_session);
+	}
+}
+
+function action_converser_post()
+{
+	if ($lang = _request('var_lang_ecrire')) {
+		include_spip('inc/lang');
+
+		spip_setcookie('spip_lang_ecrire', $lang, time() + 365 * 24 * 3600);
+		spip_setcookie('spip_lang', $lang, time() + 365 * 24 * 3600);
+	}
+	$redirect = rawurldecode(_request('url'));
+	spip_log("acp $redirect");
+	if (!$redirect) $redirect = _DIR_RESTREINT_ABS;
+	$redirect = parametre_url($redirect,'lang',$lang,'&');
+	redirige_par_entete($redirect, true);
+}
+
+?>
diff --git a/ecrire/action/cookie.php b/ecrire/action/cookie.php
index 7892e12abb164d46c928e0fce2909e79da5d49c1..8893d23a9dad59832ae41d5a37a9cab6eddc9d49 100644
--- a/ecrire/action/cookie.php
+++ b/ecrire/action/cookie.php
@@ -161,24 +161,11 @@ if ($var_lang) {
 	}
  }
 
-// changer de langue espace prive (ou login)
-if ($var_lang_ecrire) {
-	include_spip('inc/lang');
-
-	spip_setcookie('spip_lang_ecrire', $var_lang_ecrire, time() + 365 * 24 * 3600);
-	spip_setcookie('spip_lang', $var_lang_ecrire, time() + 365 * 24 * 3600);
-
-	if (_FILE_CONNECT
-	AND verifier_action_auteur("cookie-var_lang_ecrire", $hash)) {
-		spip_query("UPDATE spip_auteurs SET lang = " . _q($var_lang_ecrire) . " WHERE id_auteur = " . $GLOBALS['auteur_session']['id_auteur']);
-		$auteur_session['lang'] = $var_lang_ecrire;
-		$var_f = charger_fonction('session', 'inc');
-		$var_f($auteur_session);
-	}
-
-	$redirect = parametre_url($redirect,'lang',$var_lang_ecrire,'&');
+// changer de langue espace prive avant le login (i.e. pas authentfie)
+elseif ($var_lang_ecrire) {
+	include_spip('action/converser');
+	action_converser_post();
  }
-
   redirige_par_entete($redirect, true);
 }
 ?>
diff --git a/ecrire/action/dater.php b/ecrire/action/dater.php
index fedab6711135183d91618d84380d940d84a9a04f..250da0243941059a2f26586e484e8fa425fa40b0 100644
--- a/ecrire/action/dater.php
+++ b/ecrire/action/dater.php
@@ -15,8 +15,7 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 // http://doc.spip.org/@action_dater_dist
 function action_dater_dist() {
 	
-	include_spip('inc/actions');
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/documenter.php b/ecrire/action/documenter.php
index 0141b1f2a68ed3bfd6331de433b9a7ae99141647..98fbf6676a72cd6badb82832fd7d390d9fb3006d 100644
--- a/ecrire/action/documenter.php
+++ b/ecrire/action/documenter.php
@@ -17,7 +17,7 @@ include_spip('action/supprimer');
 // http://doc.spip.org/@action_documenter_dist
 function action_documenter_dist()
 {
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/editer_article.php b/ecrire/action/editer_article.php
index 5b82bb37bc7415d355b6b7eaba9eb1211f1ff0f6..2444079ce2fa703ea2bf72fdd9f0de51e6abde7d 100644
--- a/ecrire/action/editer_article.php
+++ b/ecrire/action/editer_article.php
@@ -12,12 +12,11 @@
 
 if (!defined("_ECRIRE_INC_VERSION")) return;
 
-include_spip('inc/actions');
 
 // http://doc.spip.org/@action_editer_article_dist
 function action_editer_article_dist() {
 
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/editer_auteurs.php b/ecrire/action/editer_auteurs.php
index bbef1cb854d69c4f463744d4f0f8d5b28ea6de27..7655da669e819db6542c6dd61ed4599e0b099768 100644
--- a/ecrire/action/editer_auteurs.php
+++ b/ecrire/action/editer_auteurs.php
@@ -13,12 +13,11 @@
 if (!defined("_ECRIRE_INC_VERSION")) return;
 
 include_spip('base/abstract_sql');
-include_spip('inc/actions');
 
 // http://doc.spip.org/@action_editer_auteurs_dist
 function action_editer_auteurs_dist() {
 	
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/editer_breve.php b/ecrire/action/editer_breve.php
index c202842e3e1022f848719d42fe4339695edaf507..4cf8d548e71534d575c5506e99e72500b57d3280 100644
--- a/ecrire/action/editer_breve.php
+++ b/ecrire/action/editer_breve.php
@@ -12,12 +12,11 @@
 
 if (!defined("_ECRIRE_INC_VERSION")) return;
 
-include_spip('inc/actions');
 
 // http://doc.spip.org/@action_editer_breve_dist
 function action_editer_breve_dist() {
 
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/editer_mot.php b/ecrire/action/editer_mot.php
index 7ed52ef808edd05d8de3aab476bc0540e6f1c32f..72f880ce8be353f36b979eee66f755ff4a35eb60 100644
--- a/ecrire/action/editer_mot.php
+++ b/ecrire/action/editer_mot.php
@@ -15,8 +15,7 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 // http://doc.spip.org/@action_editer_mot_dist
 function action_editer_mot_dist() {
 
-	include_spip('inc/actions');
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/editer_rubrique.php b/ecrire/action/editer_rubrique.php
index 442ae698809b0139cb03c056e922f0803307b851..2ba0293086fc055e908540d4bd2e6048bf5c0423 100644
--- a/ecrire/action/editer_rubrique.php
+++ b/ecrire/action/editer_rubrique.php
@@ -12,13 +12,12 @@
 
 if (!defined("_ECRIRE_INC_VERSION")) return;
 
-include_spip('inc/actions');
 include_spip('inc/rubriques');
 
 // http://doc.spip.org/@action_editer_rubrique_dist
 function action_editer_rubrique_dist() {
 
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/editer_signatures.php b/ecrire/action/editer_signatures.php
index fc77601ec4e1d7c9b38284e3a7aca76b91e758c6..993fc49cb0b6b3781373045c242b73d8fa966f1e 100644
--- a/ecrire/action/editer_signatures.php
+++ b/ecrire/action/editer_signatures.php
@@ -12,13 +12,12 @@
 
 if (!defined("_ECRIRE_INC_VERSION")) return;
 
-include_spip('inc/actions');
 
 // Modifier le reglage des forums publics de l'article x
 // http://doc.spip.org/@action_editer_signatures_dist
 function action_editer_signatures_dist()
 {
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/editer_site.php b/ecrire/action/editer_site.php
index be6d608fc39154e18f0cc0ec357493e3339cafc4..37918111a632b81d11f7fe37d6ee577d94dc1b52 100644
--- a/ecrire/action/editer_site.php
+++ b/ecrire/action/editer_site.php
@@ -12,12 +12,11 @@
 
 if (!defined("_ECRIRE_INC_VERSION")) return;
 
-include_spip('inc/actions');
 
 // http://doc.spip.org/@action_editer_site_dist
 function action_editer_site_dist() {
 
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/iconifier.php b/ecrire/action/iconifier.php
index fee8d7824cd3aed39186802d453baec134fd9011..3af731f0822e39b49e518135024512c7cb3d906b 100644
--- a/ecrire/action/iconifier.php
+++ b/ecrire/action/iconifier.php
@@ -16,7 +16,7 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 function action_iconifier_dist()
 {
 	include_spip('inc/actions');
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 	$arg = _request('arg');
 	$iframe_redirect = _request('iframe_redirect');
diff --git a/ecrire/action/instituer_article.php b/ecrire/action/instituer_article.php
index 5a61d584f28fdb5152c03117e5cb183f041a08f4..92ecd3f931ad604996c56026e10fda9933631ce8 100644
--- a/ecrire/action/instituer_article.php
+++ b/ecrire/action/instituer_article.php
@@ -15,8 +15,7 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 // http://doc.spip.org/@action_instituer_article_dist
 function action_instituer_article_dist() {
 
-	include_spip('inc/actions');
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/instituer_auteur.php b/ecrire/action/instituer_auteur.php
index aee5128d49a181f98f7e6ca80fd468ba9cd66f4c..bd038ba9f41fdab9c228ba9a9c74feea6f34455f 100644
--- a/ecrire/action/instituer_auteur.php
+++ b/ecrire/action/instituer_auteur.php
@@ -15,8 +15,7 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 // http://doc.spip.org/@action_instituer_auteur_dist
 function action_instituer_auteur_dist() {
 
-	include_spip('inc/actions');
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/instituer_breve.php b/ecrire/action/instituer_breve.php
index b11babd458655379e75e3d066aa675f0eb4dde41..54f8d8a6e7059a7bf11ae22b4874594847a42274 100644
--- a/ecrire/action/instituer_breve.php
+++ b/ecrire/action/instituer_breve.php
@@ -15,8 +15,7 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 // http://doc.spip.org/@action_instituer_breve_dist
 function action_instituer_breve_dist() {
 
-	include_spip('inc/actions');
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/instituer_collaboration.php b/ecrire/action/instituer_collaboration.php
index c56d5274b9e04474101832d375d5ee1c292dc2fd..c9ee8b49ddc576d42834ce4e86811a9a737e2203 100644
--- a/ecrire/action/instituer_collaboration.php
+++ b/ecrire/action/instituer_collaboration.php
@@ -15,8 +15,7 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 // http://doc.spip.org/@action_instituer_collaboration_dist
 function action_instituer_collaboration_dist() {
 
-	include_spip('inc/actions');
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/instituer_forum.php b/ecrire/action/instituer_forum.php
index fb00e7a7a1612418ffa718cdf1f31e332f597abd..76bc0ab7eb11f87119e2ec4c7137737b44710159 100644
--- a/ecrire/action/instituer_forum.php
+++ b/ecrire/action/instituer_forum.php
@@ -15,8 +15,7 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 // http://doc.spip.org/@action_instituer_forum_dist
 function action_instituer_forum_dist() {
 
-	include_spip('inc/actions');
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/instituer_groupe_mots.php b/ecrire/action/instituer_groupe_mots.php
index 685aa5f8032cf62530b95075358ffda5c9c62c89..d99749429a4b4116c1deccbb7bc500598791b194 100644
--- a/ecrire/action/instituer_groupe_mots.php
+++ b/ecrire/action/instituer_groupe_mots.php
@@ -12,14 +12,13 @@
 
 if (!defined("_ECRIRE_INC_VERSION")) return;
 
-include_spip('inc/actions');
 include_spip('inc/filtres');
 include_spip('base/abstract_sql');
 
 // http://doc.spip.org/@action_instituer_groupe_mots_dist
 function action_instituer_groupe_mots_dist()
 {
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/instituer_langue_rubrique.php b/ecrire/action/instituer_langue_rubrique.php
index e0dc25453fbd6489de67e28a7bca0d464a801ae3..d84119926e0220f5f7a47d09c1494a6acb58b626 100644
--- a/ecrire/action/instituer_langue_rubrique.php
+++ b/ecrire/action/instituer_langue_rubrique.php
@@ -15,8 +15,7 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 // http://doc.spip.org/@action_instituer_langue_rubrique_dist
 function action_instituer_langue_rubrique_dist() {
 
-	include_spip('inc/actions');
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/instituer_mot.php b/ecrire/action/instituer_mot.php
index 47642858c3696a9bcaeae66c851c274a000d3ee2..ffb90af76b5cd5d8688aa8e7f871db7fcfb059cc 100644
--- a/ecrire/action/instituer_mot.php
+++ b/ecrire/action/instituer_mot.php
@@ -12,7 +12,6 @@
 
 if (!defined("_ECRIRE_INC_VERSION")) return;
 
-include_spip('inc/actions');
 include_spip('inc/filtres');
 include_spip('base/abstract_sql');
 
@@ -20,7 +19,7 @@ include_spip('base/abstract_sql');
 // http://doc.spip.org/@action_instituer_mot_dist
 function action_instituer_mot_dist()
 {
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/instituer_syndic.php b/ecrire/action/instituer_syndic.php
index ea14ebe0a8664e818437185795b926a67490faba..3298dffb9ed6c271c3589193e522951bd6dd580b 100644
--- a/ecrire/action/instituer_syndic.php
+++ b/ecrire/action/instituer_syndic.php
@@ -15,8 +15,7 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 // http://doc.spip.org/@action_instituer_syndic_dist
 function action_instituer_syndic_dist() {
 
-	include_spip('inc/actions');
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/joindre.php b/ecrire/action/joindre.php
index e824dc5a8a7f2018e8303ed995a186bfe9c09121..8852155f125ec342e0f56e17b609add5334e128a 100644
--- a/ecrire/action/joindre.php
+++ b/ecrire/action/joindre.php
@@ -27,7 +27,7 @@ function action_joindre_dist()
 	  $sousaction5,
 	  $_FILES,  $HTTP_POST_FILES;
 
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$redirect = _request('redirect');
diff --git a/ecrire/action/legender.php b/ecrire/action/legender.php
index b6ad9f370d61e1c65f9c15dc7880038a097756ca..c3384cfe51c1e5f2032c5b3b04056ffd1b3a8387 100644
--- a/ecrire/action/legender.php
+++ b/ecrire/action/legender.php
@@ -13,7 +13,6 @@
 if (!defined("_ECRIRE_INC_VERSION")) return;
 
 include_spip('inc/filtres');
-include_spip('inc/actions');
 
 // En Ajax on utilise GET et sinon POST.
 // De plus Ajax en POST ne remplit pas $_POST 
@@ -23,7 +22,7 @@ include_spip('inc/actions');
 // http://doc.spip.org/@action_legender_dist
 function action_legender_dist() {
 	
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/legender_auteur.php b/ecrire/action/legender_auteur.php
index fa3d84a6debe283beb441e6614f4bcd4db709266..38c2d20e426eb5cd08b66562d7e2c6d3899f52ba 100644
--- a/ecrire/action/legender_auteur.php
+++ b/ecrire/action/legender_auteur.php
@@ -13,14 +13,13 @@
 if (!defined("_ECRIRE_INC_VERSION")) return;
 
 include_spip('inc/filtres');
-include_spip('inc/actions');
 include_spip('inc/acces');
 include_spip('base/abstract_sql');
 
 // http://doc.spip.org/@action_legender_auteur_dist
 function action_legender_auteur_dist()
 {
-        $var_f = charger_fonction('controler_action_auteur', 'inc');
+        $var_f = charger_fonction('securiser_action', 'inc');
         $var_f();
 
         $arg = _request('arg');
diff --git a/ecrire/action/petitionner.php b/ecrire/action/petitionner.php
index 46172020270c8ef318d7072856c1a8e4512df28b..a408fd6a740b6f9082b6d8ea9a4d0b7efca46ed0 100644
--- a/ecrire/action/petitionner.php
+++ b/ecrire/action/petitionner.php
@@ -15,10 +15,9 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 // http://doc.spip.org/@action_petitionner_dist
 function action_petitionner_dist() {
 
-	include_spip('inc/actions');
 	include_spip('inc/autoriser');
 
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/poster_forum_prive.php b/ecrire/action/poster_forum_prive.php
index 616e3d3903225d89187864f0ba00e6ddc7ca07cd..9c498d117aa2a49bdade7a5c1daec7f97f81877f 100644
--- a/ecrire/action/poster_forum_prive.php
+++ b/ecrire/action/poster_forum_prive.php
@@ -15,8 +15,7 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 // http://doc.spip.org/@action_poster_forum_prive_dist
 function action_poster_forum_prive_dist() {
 
-	include_spip('inc/actions');
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/purger.php b/ecrire/action/purger.php
index b38b96ce979a6c1f57033efd9ce46ef84a36c841..71123a953aa532b9f023728c38593708864fd2f7 100644
--- a/ecrire/action/purger.php
+++ b/ecrire/action/purger.php
@@ -15,8 +15,7 @@ if (!defined("_ECRIRE_INC_VERSION")) return; // securiser
 // http://doc.spip.org/@action_purger_dist
 function action_purger_dist()
 {
-	include_spip('inc/actions');
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/referencer_traduction.php b/ecrire/action/referencer_traduction.php
index ae3dad508203c637e183935d9dec08aa8fa958e2..4386626e3165e3bb6b7b1b711a1cd32f41fd2564 100644
--- a/ecrire/action/referencer_traduction.php
+++ b/ecrire/action/referencer_traduction.php
@@ -13,12 +13,11 @@
 if (!defined("_ECRIRE_INC_VERSION")) return;
 
 include_spip('inc/filtres');
-include_spip('inc/actions');
 
 // http://doc.spip.org/@action_referencer_traduction_dist
 function action_referencer_traduction_dist() {
 	
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/regler_moderation.php b/ecrire/action/regler_moderation.php
index 44d2cf0c3d57b49da189a7efe815948b70205c2b..ea7300bfb8acc045b0c5fbf42775f8cd5a2945cb 100644
--- a/ecrire/action/regler_moderation.php
+++ b/ecrire/action/regler_moderation.php
@@ -16,10 +16,9 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 // http://doc.spip.org/@action_regler_moderation_dist
 function action_regler_moderation_dist()
 {
-	include_spip('inc/actions');
 	include_spip('inc/autoriser');
 
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/reorganiser.php b/ecrire/action/reorganiser.php
index 31ccbcafff60f79a86e227781551c5adfdf370fe..32a8deac38370031ec4f403d4daf02e7b6d046ed 100644
--- a/ecrire/action/reorganiser.php
+++ b/ecrire/action/reorganiser.php
@@ -12,7 +12,6 @@
 
 if (!defined("_ECRIRE_INC_VERSION")) return;
 
-include_spip('inc/actions');
 include_spip('inc/autoriser');
 
 // http://doc.spip.org/@gerer_deplacements
@@ -40,17 +39,16 @@ function gerer_deplacements($deplacements){
 
 // http://doc.spip.org/@action_reorganiser_dist
 function action_reorganiser_dist(){
-	global $auteur_session;
-	$arg = _request('arg');
-	$hash = _request('hash');
-	$id_auteur = $auteur_session['id_auteur'];
+
+	$var_f = charger_fonction('securiser_action', 'inc');
+	$var_f();
+
+	if (_request('deplacements')!==NULL)
+		  gerer_deplacements(_request('deplacements'));
+
 	$redirect = _request('redirect');
 	if ($redirect==NULL) $redirect="";
-	include_spip("inc/actions");
-	if (verifier_action_auteur("reorganiser-$arg",$hash,$id_auteur)==TRUE) {
-		if (_request('deplacements')!==NULL)
-			gerer_deplacements(_request('deplacements'));
-	}
+
 	redirige_par_entete(str_replace("&amp;","&",urldecode($redirect)));
 }
 
diff --git a/ecrire/action/supprimer.php b/ecrire/action/supprimer.php
index 1643db848a6117092c6dcfbfdbc18e9bb3489789..2f8943c9ebf44b9afdcbb97f5cc29702a29a24f7 100644
--- a/ecrire/action/supprimer.php
+++ b/ecrire/action/supprimer.php
@@ -14,13 +14,12 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 
 include_spip('inc/charsets');	# pour le nom de fichier
 include_spip('base/abstract_sql');
-include_spip('inc/actions');
 
 // Effacer un doc (et sa vignette)
 // http://doc.spip.org/@action_supprimer_dist
 function action_supprimer_dist() {
 
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/supprimer_traduction.php b/ecrire/action/supprimer_traduction.php
index 236a2efd5c4ea44ac8c2b9f854f9402d1e04157c..fad48a8f5067abe205930b3905f6f035fabe97f3 100644
--- a/ecrire/action/supprimer_traduction.php
+++ b/ecrire/action/supprimer_traduction.php
@@ -15,8 +15,7 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 // http://doc.spip.org/@action_supprimer_traduction_dist
 function action_supprimer_traduction_dist() {
 
-	include_spip('inc/actions');
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/tourner.php b/ecrire/action/tourner.php
index c7093c9fddec00e72d62a22783941813c9147362..48029f13e4f25206d8474b4adce94a094e685aef 100644
--- a/ecrire/action/tourner.php
+++ b/ecrire/action/tourner.php
@@ -14,13 +14,12 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 
 include_spip('inc/charsets');	# pour le nom de fichier
 include_spip('base/abstract_sql');
-include_spip('inc/actions');
 
 // http://doc.spip.org/@action_tourner_dist
 function action_tourner_dist() {
 	include_spip('inc/distant'); # pour copie_locale
 
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/action/virtualiser.php b/ecrire/action/virtualiser.php
index dd4ed55a8ed09636a9e53c37b67d6c159cf0ef1b..4c90d5ca8d0b804a3264cd3f630909152b0f59e9 100644
--- a/ecrire/action/virtualiser.php
+++ b/ecrire/action/virtualiser.php
@@ -13,12 +13,11 @@
 if (!defined("_ECRIRE_INC_VERSION")) return;
 
 include_spip('inc/filtres');
-include_spip('inc/actions');
 
 // http://doc.spip.org/@action_virtualiser_dist
 function action_virtualiser_dist() {
 
-	$var_f = charger_fonction('controler_action_auteur', 'inc');
+	$var_f = charger_fonction('securiser_action', 'inc');
 	$var_f();
 
 	$arg = _request('arg');
diff --git a/ecrire/balise/formulaire_forum.php b/ecrire/balise/formulaire_forum.php
index 63c340eb405702104ec0ee0ca6018bff9b96294d..8fd286d2681b4b68ed1251a3cbfdcc182716cb6d 100644
--- a/ecrire/balise/formulaire_forum.php
+++ b/ecrire/balise/formulaire_forum.php
@@ -161,10 +161,11 @@ $ajouter_mot, $ajouter_groupe, $afficher_texte, $url_param_retour)
 		if ($afficher_texte != 'non') 
 			$previsu = inclure_previsu($texte, $titre, $email_auteur, $auteur, $url_site, $nom_site_forum, $ajouter_mot);
 
-		$alea = forum_fichier_tmp();
+		$arg = forum_fichier_tmp(join('', $ids));
 
-		include_spip('inc/actions');
-		$hash = calculer_action_auteur('ajout_forum'.join(' ', $ids).' '.$alea);
+		$securiser_action = charger_fonction('securiser_action', 'inc');
+		// on sait que cette fonction est dans le fichier associe
+		$hash = calculer_action_auteur("ajout_forum-$arg");
 
 		// Poser un cookie pour ne pas retaper les infos invariables
 		include_spip('inc/cookie');
@@ -194,7 +195,7 @@ $ajouter_mot, $ajouter_groupe, $afficher_texte, $url_param_retour)
 		'url' => $script, # ce sur quoi on fait le action='...'
 		'url_post' => $script_hidden, # pour les variables hidden
 		'url_site' => ($url_site ? $url_site : "http://"),
-		'alea' => $alea,
+		'arg' => $arg,
 		'hash' => $hash,
 		'nobot' => _request('nobot'),
 		'ajouter_groupe' => $ajouter_groupe,
@@ -253,10 +254,10 @@ function inclure_previsu($texte,$titre, $email_auteur, $auteur, $url_site, $nom_
 // si $afficher_texte = 'non')
 
 // http://doc.spip.org/@forum_fichier_tmp
-function forum_fichier_tmp()
+function forum_fichier_tmp($arg)
 {
 # astuce : mt_rand pour autoriser les hits simultanes
-	while (($alea = time() + @mt_rand())
+	while (($alea = time() + @mt_rand()) + intval($arg)
 	       AND @file_exists($f = _DIR_TMP."forum_$alea.lck"))
 	  {};
 	spip_touch ($f);
diff --git a/ecrire/inc/actions.php b/ecrire/inc/actions.php
index 2c1f82b8a046b68e1bd24f95504dff73f7b2f1a1..bbbc4b74de8fcc23a9f080936d0324b1ef4ea2db 100644
--- a/ecrire/inc/actions.php
+++ b/ecrire/inc/actions.php
@@ -14,100 +14,10 @@ if (!defined("_ECRIRE_INC_VERSION")) return;
 
 include_spip('inc/meta');
 
-// fonction de securite appelee par les scripts de action/
-// cf fabrication des arguments dans generer_action_auteur
-
-// http://doc.spip.org/@inc_controler_action_auteur_dist
-function inc_controler_action_auteur_dist()
-{
-	$arg = _request('arg');
-	$hash = _request('hash');
-	$action = _request('action');
-
-	if (!verifier_action_auteur("$action-$arg", $hash)) {
-		include_spip('inc/minipres');
-		minipres(_T('info_acces_interdit'));
-	}
-}
-
-// http://doc.spip.org/@caracteriser_auteur
-function caracteriser_auteur() {
-	global $auteur_session;
-	static $caracterisation = array();
-
-	if ($caracterisation) return $caracterisation;
-
-	$id_auteur = $auteur_session['id_auteur'];
-	if (!$id_auteur) {
-  // si l'auteur courant n'est pas connu alors qu'il peut demander une action
-  // c'est une connexion par php_auth, on se rabat sur le cookie.
-  // S'il n'avait pas le droit de realiser cette action, le hash sera faux.
-		if (isset($_COOKIE['spip_session'])
-		AND (preg_match('/^(\d+)/',$_COOKIE['spip_session'],$r))) {
-			  return array($r[1], '');
-			  // Necessaire aux forums anonymes.
-			  // Pour le reste, ca echouera.
-		} else return array('',''); 	  
-	}
-	// Eviter l'acces SQL si le pass est connu de PHP
-
-	if ($auteur_session['pass'])
-		return $caracterisation = array($id_auteur, $auteur_session['pass']); 
-	else {
-		$t = spip_query("SELECT id_auteur, pass FROM spip_auteurs WHERE id_auteur=$id_auteur");
-		if ($t = spip_fetch_array($t))
-			return $caracterisation = array($t['id_auteur'], $t['pass']);
-		spip_log("auteur $id_auteur sans caracterisation");
-		die(_T('info_acces_interdit'));
-	}
-}
-
-// http://doc.spip.org/@_action_auteur
-function _action_auteur($action, $id_auteur, $pass, $nom_alea) {
-	return md5($action.$id_auteur.$pass .$GLOBALS['meta'][$nom_alea]);
-}
-
-// http://doc.spip.org/@calculer_action_auteur
-function calculer_action_auteur($action) {
-	list($id_auteur, $pass) = caracteriser_auteur();
-	return _action_auteur($action, $id_auteur, $pass, 'alea_ephemere');
-}
-
-// http://doc.spip.org/@verifier_action_auteur
-function verifier_action_auteur($action, $valeur) {
-	list($id_auteur, $pass) = caracteriser_auteur();
-
-	if ($valeur == _action_auteur($action, $id_auteur, $pass, 'alea_ephemere'))
-		return true;
-	if ($valeur == _action_auteur($action, $id_auteur, $pass, 'alea_ephemere_ancien'))
-		return true;
-	spip_log("verifier action $action $id_auteur : echec");
-	return false;
-}
-
-
-// http://doc.spip.org/@generer_action_auteur
 function generer_action_auteur($action, $arg, $redirect="", $mode=false, $att='')
 {
-	static $id_auteur=0, $pass;
-	if (!$id_auteur) {
-		list($id_auteur, $pass) =  caracteriser_auteur();
-	}
-	$hash = _action_auteur("$action-$arg", $id_auteur, $pass, 'alea_ephemere');
-	$r = rawurlencode($redirect);
-	if (!is_string($mode))
-	  return generer_url_action($action, "arg=$arg&hash=$hash" . (!$r ? '' : "&redirect=$r"), $mode);
-
-	// Attention, JS n'aime pas le melange de param GET/POST
-	return "\n<form style='margin:0px' action='" .
-		generer_url_public('') .
-		"'$att>\n\t<div>
-		<input name='hash' type='hidden' value='$hash' />
-		<input name='action' type='hidden' value='$action' />
-		<input name='arg' type='hidden' value='$arg' />" .
-		(!$r ? '' : "\n\t\t<input name='redirect' type='hidden' value='$r' />") .
-		$mode .
-		"\n\t</div>\n</form>\n";
+	$securiser_action = charger_fonction('securiser_action', 'inc');
+	return $securiser_action($action, $arg, $redirect, $mode, $att);
 }
 
 // http://doc.spip.org/@redirige_action_auteur
diff --git a/ecrire/inc/forum_insert.php b/ecrire/inc/forum_insert.php
index f8b6d355971280a3b89fb7a032c592daae163f08..468cd0138e1fffbe928ed4883f6bf838df9458c0 100644
--- a/ecrire/inc/forum_insert.php
+++ b/ecrire/inc/forum_insert.php
@@ -113,28 +113,6 @@ function mots_du_forum($ajouter_mot, $id_message)
 		  spip_abstract_insert('spip_mots_forum', '(id_mot, id_forum)', "($id_mot, $id_message)");
 }
 
-// Recalcule la signature faite dans formulaires/inc-formulaire-forum
-// en fonction des input POST (ne pas se fier aux parametres d'URL)
-// Retourne le fichier verrouillant si correct
-
-// http://doc.spip.org/@forum_insert_secure
-function forum_insert_secure($alea, $hash)
-{
-	$ids = array();
-
-	foreach (array('id_article', 'id_breve', 'id_forum', 'id_rubrique', 'id_syndic') as $o) {
-		$ids[$o] = ($x = intval($_POST[$o])) ? $x : '';
-	}
-
-	if (!verifier_action_auteur('ajout_forum'.join(' ', $ids).' '.$alea,
-		$hash)) {
-		spip_log('erreur hash forum');
-		die (_T('forum_titre_erreur')); 	# echec du POST
-	}
-
-	$file = _DIR_TMP ."forum_" . preg_replace('/[^0-9]/', '', $alea) .".lck";
-	return  file_exists($file) ? $file : '';
-}
 
 // http://doc.spip.org/@reduce_strlen
 function reduce_strlen($n, $c) 
@@ -204,8 +182,15 @@ function inc_forum_insert_dist() {
 
 	// Verifier hash securite pour les forums avec previsu
 	if ($afficher_texte <> 'non') {
-		$file = forum_insert_secure(_request('alea'), _request('hash'));
-		if (!$file) {
+
+		// simuler une action venant de l'espace public
+		// pour se conformer au a general.
+		set_request('action', 'ajout_forum');
+	        $var_f = charger_fonction('securiser_action', 'inc');
+        	$var_f();
+
+		$file = _DIR_TMP ."forum_" . preg_replace('/[^0-9]/', '', _request('arg')) .".lck";
+		if (!file_exists($file)) {
 			# ne pas tracer cette erreur, peut etre due a un double POST
 			# tracer_erreur_forum('session absente');
 			return $retour_forum; # echec silencieux du POST
diff --git a/ecrire/inc/lang.php b/ecrire/inc/lang.php
index b3f21ccef866ba3c6304a29fffadc51a2c3e8501..7ccf45f4be6d8f30d327c4241bd80623ea7cb66c 100644
--- a/ecrire/inc/lang.php
+++ b/ecrire/inc/lang.php
@@ -129,7 +129,7 @@ function menu_langues($nom_select = 'var_lang', $default = '', $texte = '', $her
 		} else {
 			$cible = _DIR_RESTREINT_ABS . $lien;
 			if (_FILE_CONNECT) {
-				$lien = generer_action_auteur('cookie','var_lang_ecrire');
+			  $lien = generer_action_auteur('converser','');
 			} else $lien = generer_url_action('cookie');
 		}
 	}
diff --git a/ecrire/inc/securiser_action.php b/ecrire/inc/securiser_action.php
new file mode 100644
index 0000000000000000000000000000000000000000..3b5099311478bf39653c57a3dc4d7ac546d0cff3
--- /dev/null
+++ b/ecrire/inc/securiser_action.php
@@ -0,0 +1,111 @@
+<?php
+
+/***************************************************************************\
+ *  SPIP, Systeme de publication pour l'internet                           *
+ *                                                                         *
+ *  Copyright (c) 2001-2006                                                *
+ *  Arnaud Martin, Antoine Pitrou, Philippe Riviere, Emmanuel Saint-James  *
+ *                                                                         *
+ *  Ce programme est un logiciel libre distribue sous licence GNU/GPL.     *
+ *  Pour plus de details voir le fichier COPYING.txt ou l'aide en ligne.   *
+\***************************************************************************/
+
+if (!defined("_ECRIRE_INC_VERSION")) return;
+
+include_spip('inc/meta');
+
+// interface d'appel:
+// - avec au moins un argument, construit une URL ou un formulaire securises
+// - sans argument: verifie que les param HTTP attestent de la securite
+
+function inc_securiser_action_dist($action='', $arg='', $redirect="", $mode=false, $att='')
+{
+	if ($action)
+		return securiser_action_auteur($action, $arg, $redirect, $mode, $att);
+	elseif (!verifier_action_auteur(_request('action') . '-' . _request('arg'), _request('hash'))) {
+		include_spip('inc/minipres');
+		minipres(_T('info_acces_interdit'));
+	}
+}
+
+// http://doc.spip.org/@generer_action_auteur
+function securiser_action_auteur($action, $arg, $redirect="", $mode=false, $att='')
+{
+	static $id_auteur=0, $pass;
+	if (!$id_auteur) {
+		list($id_auteur, $pass) =  caracteriser_auteur();
+	}
+	$hash = _action_auteur("$action-$arg", $id_auteur, $pass, 'alea_ephemere');
+	$r = rawurlencode($redirect);
+	if (!is_string($mode))
+	  return generer_url_action($action, "arg=$arg&hash=$hash" . (!$r ? '' : "&redirect=$r"), $mode);
+
+	// Attention, JS n'aime pas le melange de param GET/POST
+	return "\n<form style='margin:0px' action='" .
+		generer_url_public('') .
+		"'$att>\n\t<div>
+		<input name='hash' type='hidden' value='$hash' />
+		<input name='action' type='hidden' value='$action' />
+		<input name='arg' type='hidden' value='$arg' />" .
+		(!$r ? '' : "\n\t\t<input name='redirect' type='hidden' value='$r' />") .
+		$mode .
+		"\n\t</div>\n</form>\n";
+}
+
+// http://doc.spip.org/@caracteriser_auteur
+function caracteriser_auteur() {
+	global $auteur_session;
+	static $caracterisation = array();
+
+	if ($caracterisation) return $caracterisation;
+
+	$id_auteur = $auteur_session['id_auteur'];
+	if (!$id_auteur) {
+  // si l'auteur courant n'est pas connu alors qu'il peut demander une action
+  // c'est une connexion par php_auth, on se rabat sur le cookie.
+  // S'il n'avait pas le droit de realiser cette action, le hash sera faux.
+		if (isset($_COOKIE['spip_session'])
+		AND (preg_match('/^(\d+)/',$_COOKIE['spip_session'],$r))) {
+			  return array($r[1], '');
+			  // Necessaire aux forums anonymes.
+			  // Pour le reste, ca echouera.
+		} else return array('',''); 	  
+	}
+	// Eviter l'acces SQL si le pass est connu de PHP
+
+	if ($auteur_session['pass'])
+		return $caracterisation = array($id_auteur, $auteur_session['pass']); 
+	else {
+		$t = spip_query("SELECT id_auteur, pass FROM spip_auteurs WHERE id_auteur=$id_auteur");
+		if ($t = spip_fetch_array($t))
+			return $caracterisation = array($t['id_auteur'], $t['pass']);
+		spip_log("auteur $id_auteur sans caracterisation");
+		die(_T('info_acces_interdit'));
+	}
+}
+
+// http://doc.spip.org/@_action_auteur
+function _action_auteur($action, $id_auteur, $pass, $nom_alea) {
+	return md5($action.$id_auteur.$pass .$GLOBALS['meta'][$nom_alea]);
+}
+
+// http://doc.spip.org/@calculer_action_auteur
+function calculer_action_auteur($action) {
+	list($id_auteur, $pass) = caracteriser_auteur();
+	return _action_auteur($action, $id_auteur, $pass, 'alea_ephemere');
+}
+
+// http://doc.spip.org/@verifier_action_auteur
+function verifier_action_auteur($action, $valeur) {
+	list($id_auteur, $pass) = caracteriser_auteur();
+
+	if ($valeur == _action_auteur($action, $id_auteur, $pass, 'alea_ephemere'))
+		return true;
+	if ($valeur == _action_auteur($action, $id_auteur, $pass, 'alea_ephemere_ancien'))
+		return true;
+	spip_log("verifier action $action $id_auteur : echec");
+	return false;
+}
+
+
+?>
\ No newline at end of file
diff --git a/spip.php b/spip.php
index 665e940a09bb2376a8a2c34ebe9ee714e86b26e7..e8300e1eae797aae0d509e57acf92d53ef69dda7 100644
--- a/spip.php
+++ b/spip.php
@@ -15,8 +15,10 @@
 include_once _DIR_RESTREINT_ABS.'inc_version.php';
 
 # rediriger les anciens URLs de la forme page.php3fond=xxx
-if (isset($_GET['fond']))
+if (isset($_GET['fond'])) {
+	include_spip('inc/headers');
 	redirige_par_entete(generer_url_public($_GET['fond']));
+ }
 
 # au travail...
 include _DIR_RESTREINT_ABS.'public.php';