diff --git a/ChangeLog b/ChangeLog
index 13eb36a..6fe49c5 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,15 @@
-$Id: ChangeLog,v 1.106 2006/02/06 21:17:59 stpohle Exp $
+$Id: ChangeLog,v 1.107 2006/07/30 11:44:57 stpohle Exp $
 Version 0.11.7 (still in progress)
+
+- Fixed: Security Problem found by Stefan Cornelius.
+  For more information look here:
+  https://lists.uni-koeln.de/pipermail/sec-info/Week-of-Mon-20060313/006561.html
+    
+- Added: "more random" by Patrik Nilsson:
+  This map type is just a hacked version of "autogenerated",
+  and is as the name tells more random. Since both block, 
+  rock and nothing are placed randomly inside the border.
+
 - Fixed: High CPU usage in menus.
   This fix was made by Chris E..
  
diff --git a/include/basic.h b/include/basic.h
index 7c0dd1a..988dad1 100644
--- a/include/basic.h
+++ b/include/basic.h
@@ -1,4 +1,4 @@
-/* $Id: basic.h,v 1.33 2005/07/06 13:11:55 stpohle Exp $ */
+/* $Id: basic.h,v 1.34 2006/07/30 11:44:57 stpohle Exp $ */
 /* basic types which we need everywhere */
 
 #ifndef _BC_BASIC_H_
@@ -164,7 +164,8 @@ enum _direction {               // to handle directions better
 enum _mapselection {
         MAPS_select = 0,
         MAPS_randmap,
-        MAPS_randgen
+        MAPS_randgen,
+        MAPS_morerand
 };
 
 enum _mstatus {
diff --git a/include/map.h b/include/map.h
index bfb6dec..8c871e3 100644
--- a/include/map.h
+++ b/include/map.h
@@ -1,4 +1,4 @@
-/* $Id: map.h,v 1.15 2004/02/08 01:34:46 stpohle Exp $ */
+/* $Id: map.h,v 1.16 2006/07/30 11:44:57 stpohle Exp $ */
 /* map.h */
 
 #ifndef _MAP_H_
@@ -83,6 +83,7 @@ extern void mapgamesetting ();
 // map.c
 extern void map_random ();
 extern void map_genrandom ();
+extern void map_genmorerandom ();
 extern void init_map_tileset();
 extern void map_new (char *filename);
 extern void map_load (FILE * fmap);
diff --git a/src/map.c b/src/map.c
index eadaea5..c4dd035 100644
--- a/src/map.c
+++ b/src/map.c
@@ -1,4 +1,4 @@
-/* $Id: map.c,v 1.26 2004/04/03 14:48:43 stpohle Exp $ */
+/* $Id: map.c,v 1.27 2006/07/30 11:44:57 stpohle Exp $ */
 /* map handling, like generate and load maps. */
 
 #include "bomberclone.h"
@@ -60,8 +60,12 @@ map_new (char *filename)
 
     // Clean and create the field //
     if (fmap == NULL)
-        map_genrandom ();
-
+		map_genrandom ();
+	
+	/* Generate a More random map if requested */
+    if (map.map_selection == MAPS_morerand)
+        map_genmorerandom();
+    
     if (map.type == -1)
         map.type = s_random (MAPT_max);
 
@@ -197,6 +201,54 @@ map_genrandom ()
 	// map_ensure_corner_start_points();
 }
 
+void
+map_genmorerandom ()
+{
+    int x,
+      y,
+      d,
+      ra;
+
+    /* This is an enhanced version of genrandom() used by "more random" */
+    d_printf("genmorerandom: *** init ***\n");
+    /* if we can't load the map check first the fieldsize settings */
+    if (map.size.x < MIN_FIELDSIZE_X)
+        map.size.x = MIN_FIELDSIZE_X;
+    if (map.size.x > MAX_FIELDSIZE_X)
+        map.size.x = MAX_FIELDSIZE_X;
+
+    for (x = 0; x < map.size.x; x++)
+        for (y = 0; y < map.size.y; y++) {
+            if ((y == 0) || (y == map.size.y - 1))
+                map.field[x][y].type = FT_block;
+            else if ((x == 0) || (x == map.size.x - 1))
+                map.field[x][y].type = FT_block;
+            else {
+                // create random field
+                ra = s_random (256) & 3;
+                d_printf("genmorerandom: ra = %i\n", ra);
+                
+                if (ra == 0)
+                    map.field[x][y].type = FT_nothing;
+                else if (ra == 1)
+                    map.field[x][y].type = FT_block;
+                else
+                    map.field[x][y].type = FT_stone;
+            }
+
+            for (d = 0; d < 4; d++)
+                map.field[x][y].ex[d].frame = map.field[x][y].ex[d].count = 0;
+            map.field[x][y].ex_nr = -1;
+            map.field[x][y].frame = 0.0f;
+            map.field[x][y].special = FT_nothing;
+        }
+	
+	d_printf("genmorerandom: *** exit ***\n");
+	/* set the corners of the map to be valid start points */
+	
+	// map_ensure_corner_start_points();
+}
+
 
 /* will set the playerposition but in a way that we won't start on a block */
 /* i am just too lazy to write this all again and again */
@@ -265,6 +317,8 @@ init_map_tileset ()
         		break;
     		case (2):
         		map_new (NULL);
+            case (3):
+				map_new (NULL); /* for more random */
         	break;
 		}
 		if (map.random_tileset)
diff --git a/src/mapmenu.c b/src/mapmenu.c
index 7f7667c..91ba5d4 100644
--- a/src/mapmenu.c
+++ b/src/mapmenu.c
@@ -1,4 +1,4 @@
-/* $Id: mapmenu.c,v 1.26 2005/08/07 17:46:21 stpohle Exp $ */
+/* $Id: mapmenu.c,v 1.27 2006/07/30 11:44:58 stpohle Exp $ */
 /* map/tileset selection menu */
 
 #include "bomberclone.h"
@@ -14,7 +14,8 @@ mapmenu ()
     _charlist maptypes[] = {
         {"selected file", NULL},
         {"random file", NULL},
-        {"autogenerated", NULL}
+        {"autogenerated", NULL},
+        {"more random", NULL}
     }, tiletypes[] = {
         {
         "random"}, {
@@ -27,7 +28,7 @@ mapmenu ()
     char mname[100];
 	_menu *menu;
 
-    charlist_fillarraypointer (maptypes, 3);
+    charlist_fillarraypointer (maptypes, 4);
     charlist_fillarraypointer (tiletypes, 2);
     charlist_fillarraypointer (tunneltypes, 3);
 
@@ -52,6 +53,12 @@ mapmenu ()
             menu_create_entry (menu, "X Size:", 20, 160, 120, &map.size.x, MAX_FIELDSIZE_X, MENU_entryint16, 2);
             menu_create_entry (menu, "Y Size:", 20, 180, 120, &map.size.y, MAX_FIELDSIZE_Y, MENU_entryint16, 3);
             break;
+        case (MAPS_morerand): // More Random
+            selmt = charlist_findtext (maptypes, "more random");
+            d_printf ("more random\n");
+            menu_create_entry (menu, "X Size:", 20, 160, 120, &map.size.x, MAX_FIELDSIZE_X, MENU_entryint16, 2);
+            menu_create_entry (menu, "Y Size:", 20, 180, 120, &map.size.y, MAX_FIELDSIZE_Y, MENU_entryint16, 3);
+            break;
         }
         if (map.random_tileset)
 			selts = &tiletypes[0];