diff --git a/app/src/main/java/org/apache/roller/weblogger/business/WebloggerImpl.java b/app/src/main/java/org/apache/roller/weblogger/business/WebloggerImpl.java
index 1cf6359..476ad89 100644
--- a/app/src/main/java/org/apache/roller/weblogger/business/WebloggerImpl.java
+++ b/app/src/main/java/org/apache/roller/weblogger/business/WebloggerImpl.java
@@ -33,6 +33,15 @@
 import org.apache.roller.weblogger.business.runnable.ThreadManager;
 import org.apache.roller.weblogger.business.themes.ThemeManager;
 import org.apache.roller.weblogger.config.PingConfig;
+import org.apache.roller.weblogger.config.WebloggerConfig;
+import org.apache.roller.weblogger.config.WebloggerRuntimeConfig;
+import org.apache.xmlrpc.util.SAXParsers;
+import org.springframework.security.access.method.P;
+import org.xml.sax.SAXNotRecognizedException;
+import org.xml.sax.SAXNotSupportedException;
+
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParserFactory;
 
 
 /**
@@ -134,7 +143,7 @@
     /**
      * 
      * 
-     * @see org.apache.roller.weblogger.modelWebloggerr#getThreadManager()
+     * @see org.apache.roller.weblogger.business.Weblogger#getThreadManager()
      */
     public ThreadManager getThreadManager() {
         return threadManager;
@@ -144,7 +153,7 @@
     /**
      * 
      * 
-     * @see org.apache.roller.weblogger.model.Weblogger#getIndexManager()
+     * @see org.apache.roller.weblogger.business.Weblogger#getIndexManager()
      */
     public IndexManager getIndexManager() {
         return indexManager;
@@ -154,7 +163,7 @@
     /**
      * 
      * 
-     * @see org.apache.roller.weblogger.modelWebloggerr#getThemeManager()
+     * @see org.apache.roller.weblogger.business.Weblogger#getThemeManager()
      */
     public ThemeManager getThemeManager() {
         return themeManager;
@@ -164,7 +173,7 @@
     /**
      * 
      * 
-     * @see org.apache.roller.weblogger.modelWebloggerr#getUserManager()
+     * @see org.apache.roller.weblogger.business.Weblogger#getUserManager()
      */
     public UserManager getUserManager() {
         return userManager;
@@ -174,7 +183,7 @@
     /**
      * 
      * 
-     * @see org.apache.roller.weblogger.modelWebloggerr#getBookmarkManager()
+     * @see org.apache.roller.weblogger.business.Weblogger#getBookmarkManager()
      */
     public BookmarkManager getBookmarkManager() {
         return bookmarkManager;
@@ -184,7 +193,7 @@
     /**
      * 
      * 
-     * @see org.apache.roller.weblogger.modelWebloggerr#getMediaFileManager()
+     * @see org.apache.roller.weblogger.business.Weblogger#getMediaFileManager()
      */
     public MediaFileManager getMediaFileManager() {
         return mediaFileManager;
@@ -193,7 +202,7 @@
     /**
      * 
      * 
-     * @see org.apache.roller.weblogger.modelWebloggerr#getFileContentManager()
+     * @see org.apache.roller.weblogger.business.Weblogger#getFileContentManager()
      */
     public FileContentManager getFileContentManager() {
         return fileContentManager;
@@ -203,7 +212,7 @@
     /**
      * 
      * 
-     * @see org.apache.roller.weblogger.modelWebloggerr#getWeblogEntryManager()
+     * @see org.apache.roller.weblogger.business.Weblogger#getWeblogEntryManager()
      */
     public WeblogEntryManager getWeblogEntryManager() {
         return weblogEntryManager;
@@ -213,7 +222,7 @@
     /**
      * 
      * 
-     * @see org.apache.roller.weblogger.modelWebloggerr#getWeblogManager()
+     * @see org.apache.roller.weblogger.business.Weblogger#getWeblogManager()
      */
     public WeblogManager getWeblogManager() {
         return weblogManager;
@@ -223,7 +232,7 @@
     /**
      * 
      * 
-     * @see org.apache.roller.weblogger.modelWebloggerr#getPropertiesManager()
+     * @see org.apache.roller.weblogger.business.Weblogger#getPropertiesManager()
      */
     public PropertiesManager getPropertiesManager() {
         return propertiesManager;
@@ -233,7 +242,7 @@
     /**
      * 
      * 
-     * @see org.apache.roller.weblogger.modelWebloggerr#getPingTargetManager()
+     * @see org.apache.roller.weblogger.business.Weblogger#getPingTargetManager()
      */
     public PingQueueManager getPingQueueManager() {
         return pingQueueManager;
@@ -243,7 +252,7 @@
     /**
      * 
      * 
-     * @see org.apache.roller.weblogger.modelWebloggerr#getPingTargetManager()
+     * @see org.apache.roller.weblogger.business.Weblogger#getPingTargetManager()
      */
     public AutoPingManager getAutopingManager() {
         return autoPingManager;
@@ -253,7 +262,7 @@
     /**
      * 
      * 
-     * @see org.apache.roller.weblogger.modelWebloggerr#getPingTargetManager()
+     * @see org.apache.roller.weblogger.business.Weblogger#getPingTargetManager()
      */
     public PingTargetManager getPingTargetManager() {
         return pingTargetManager;
@@ -263,7 +272,7 @@
     /**
      *
      *
-     * @see org.apache.roller.weblogger.modelWebloggerr#getPluginManager()
+     * @see org.apache.roller.weblogger.business.Weblogger#getPluginManager()
      */
     public PluginManager getPluginManager() {
         return pluginManager;
@@ -273,7 +282,7 @@
     /**
      *
      *
-     * @see org.apache.roller.weblogger.modelWebloggerr#getOauthManager()
+     * @see org.apache.roller.weblogger.business.Weblogger#getOAuthManager()
      */
     public OAuthManager getOAuthManager() {
         return oauthManager;
@@ -334,7 +343,21 @@
         getThreadManager().initialize();
         getIndexManager().initialize();
         getMediaFileManager().initialize();
-        
+
+        // Turn off External DTD support in SAXParser to protect Roller from vulnerability.
+        SAXParserFactory spf = SAXParsers.getSAXParserFactory();
+        try {
+            spf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+            spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false);
+        } catch (ParserConfigurationException | SAXNotRecognizedException | SAXNotSupportedException e) {
+            String message = "Unable to turn off External DTD support in SAXParser. XML-RLC is vulnerable";
+            if ( log.isDebugEnabled() ) {
+                log.error(message, e);
+            } else {
+                log.error(message);
+            }
+        }
+
         try {
             // Initialize ping systems
             // TODO: this should probably be moving inside ping manager initialize() methods?
diff --git a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/admin/GlobalConfig.java b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/admin/GlobalConfig.java
index da71a41..0ee3641 100644
--- a/app/src/main/java/org/apache/roller/weblogger/ui/struts2/admin/GlobalConfig.java
+++ b/app/src/main/java/org/apache/roller/weblogger/ui/struts2/admin/GlobalConfig.java
@@ -169,16 +169,17 @@
             // it may not always be the case, but we should be okay for now
             // null check below needed w/Oracle
             if( updProp.getValue() != null
-                    && (updProp.getValue().equals("true") || updProp.getValue().equals("false"))) {
-                
-                if(incomingProp == null || !incomingProp.equals("on")) {
-                    incomingProp = "false";
-                }
-                else {
+                    && (   updProp.getValue().equals("true") || updProp.getValue().equals("false")
+                        || updProp.getValue().equals("on")   || updProp.getValue().equals("off")
+                       )) {
+                if (incomingProp != null && (incomingProp.equalsIgnoreCase("true") || incomingProp.equalsIgnoreCase("on"))) {
                     incomingProp = "true";
                 }
+                else {
+                    incomingProp = "false";
+                }
             }
-            
+
             // only work on props that were submitted with the request
             if(incomingProp != null) {
                 log.debug("Setting new value for ["+propName+"]");
diff --git a/app/src/main/webapp/WEB-INF/velocity/feeds.vm b/app/src/main/webapp/WEB-INF/velocity/feeds.vm
index 228e11e..065a548 100644
--- a/app/src/main/webapp/WEB-INF/velocity/feeds.vm
+++ b/app/src/main/webapp/WEB-INF/velocity/feeds.vm
@@ -141,4 +141,9 @@
 #if($pager.prevLink && $pager.items.size() > 0)
     <link rel="previous" type="application/atom+xml" href="$utils.escapeXML($pager.prevLink)" />
 #end
+#end
+
+#macro(showFirefoxFeedWorkaround)
+<!-- 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153
+-->
 #end
\ No newline at end of file
diff --git a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-comments-atom.vm b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-comments-atom.vm
index a7ce1fa..5cd92c4 100644
--- a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-comments-atom.vm
+++ b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-comments-atom.vm
@@ -16,6 +16,7 @@
   directory of this distribution.
 
 *#<?xml version="1.0" encoding='utf-8'?>
+#showFirefoxFeedWorkaround()
 #if($config.feedStyle)<?xml-stylesheet type="text/xsl" href="$url.absoluteSite/roller-ui/styles/atom.xsl" media="screen"?>#end
 #set($pager = $site.getCommentsPager(-1, $config.feedSize) )
 <feed xmlns="http://www.w3.org/2005/Atom">
diff --git a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-comments-rss.vm b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-comments-rss.vm
index 01ee0e7..b45c984 100644
--- a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-comments-rss.vm
+++ b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-comments-rss.vm
@@ -16,6 +16,7 @@
   directory of this distribution.
 
 *#<?xml version="1.0" encoding="utf-8"?>
+#showFirefoxFeedWorkaround()
 #if($config.feedStyle)<?xml-stylesheet type="text/xsl" href="$url.absoluteSite/roller-ui/styles/rss.xsl" media="screen"?>#end
 <rss version="2.0" 
   xmlns:dc="http://purl.org/dc/elements/1.1/"
diff --git a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-entries-atom.vm b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-entries-atom.vm
index 84a43a9..73ad02f 100644
--- a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-entries-atom.vm
+++ b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-entries-atom.vm
@@ -16,6 +16,7 @@
   directory of this distribution.
 
 *#<?xml version="1.0" encoding='utf-8'?>
+#showFirefoxFeedWorkaround()
 #if($config.feedStyle)<?xml-stylesheet type="text/xsl" href="$url.absoluteSite/roller-ui/styles/atom.xsl" media="screen"?>#end
 #set($pager = $site.getWeblogEntriesPager(-1, $config.feedSize))
 <feed xmlns="http://www.w3.org/2005/Atom">
diff --git a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-entries-rss.vm b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-entries-rss.vm
index acfe54b..fa693f8 100644
--- a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-entries-rss.vm
+++ b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-entries-rss.vm
@@ -16,6 +16,7 @@
   directory of this distribution.
 
 *#<?xml version="1.0" encoding="utf-8"?>
+#showFirefoxFeedWorkaround()
 #if($config.feedStyle)<?xml-stylesheet type="text/xsl" href="$url.absoluteSite/roller-ui/styles/rss.xsl" media="screen"?>#end
 <rss version="2.0" 
   xmlns:dc="http://purl.org/dc/elements/1.1/"
diff --git a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-search-atom.vm b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-search-atom.vm
index 510e77a..b18405c 100644
--- a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-search-atom.vm
+++ b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/site-search-atom.vm
@@ -16,6 +16,7 @@
   directory of this distribution.
 
 *#<?xml version="1.0" encoding='utf-8'?>
+#showFirefoxFeedWorkaround()
 #if($config.feedStyle)<?xml-stylesheet type="text/xsl" href="$url.absoluteSite/roller-ui/styles/atom.xsl" media="screen"?>#end
 #set($pager = $model.searchResultsPager)
 <feed xmlns="http://www.w3.org/2005/Atom" 
diff --git a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-comments-atom.vm b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-comments-atom.vm
index b923542..bda27a1 100644
--- a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-comments-atom.vm
+++ b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-comments-atom.vm
@@ -16,6 +16,7 @@
   directory of this distribution.
 
 *#<?xml version="1.0" encoding='utf-8'?>
+#showFirefoxFeedWorkaround()
 #if($config.feedStyle)<?xml-stylesheet type="text/xsl" href="$url.absoluteSite/roller-ui/styles/atom.xsl" media="screen"?>#end
 #set($pager = $model.commentsPager)
 <feed xmlns="http://www.w3.org/2005/Atom">
diff --git a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-comments-rss.vm b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-comments-rss.vm
index 0529875..8b3ad81 100644
--- a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-comments-rss.vm
+++ b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-comments-rss.vm
@@ -16,6 +16,7 @@
   directory of this distribution.
 
 *#<?xml version="1.0" encoding="utf-8"?>
+#showFirefoxFeedWorkaround()
 #if($config.feedStyle)<?xml-stylesheet type="text/xsl" href="$url.absoluteSite/roller-ui/styles/rss.xsl" media="screen"?>#end
 <rss version="2.0" 
   xmlns:dc="http://purl.org/dc/elements/1.1/"
diff --git a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-entries-atom.vm b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-entries-atom.vm
index 7c8e4cf..eee05c3 100644
--- a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-entries-atom.vm
+++ b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-entries-atom.vm
@@ -16,6 +16,7 @@
   directory of this distribution.
 
 *#<?xml version="1.0" encoding='utf-8'?>
+#showFirefoxFeedWorkaround()
 #if($config.feedStyle)<?xml-stylesheet type="text/xsl" href="$url.absoluteSite/roller-ui/styles/atom.xsl" media="screen"?>#end
 #set($pager = $model.weblogEntriesPager)
 <feed xmlns="http://www.w3.org/2005/Atom">
diff --git a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-entries-rss.vm b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-entries-rss.vm
index 0be1bfe..0b70113 100644
--- a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-entries-rss.vm
+++ b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-entries-rss.vm
@@ -16,6 +16,7 @@
   directory of this distribution.
 
 *#<?xml version="1.0" encoding="utf-8"?>
+#showFirefoxFeedWorkaround()
 #if($config.feedStyle)<?xml-stylesheet type="text/xsl" href="$url.absoluteSite/roller-ui/styles/rss.xsl" media="screen"?>#end
 <rss version="2.0" 
   xmlns:dc="http://purl.org/dc/elements/1.1/"
diff --git a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-files-atom.vm b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-files-atom.vm
index 5fdf545..95537d3 100644
--- a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-files-atom.vm
+++ b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-files-atom.vm
@@ -16,6 +16,7 @@
   directory of this distribution.
 
 *#<?xml version="1.0" encoding='utf-8'?>
+#showFirefoxFeedWorkaround()
 #if($config.feedStyle)<?xml-stylesheet type="text/xsl" href="$url.absoluteSite/roller-ui/styles/atom.xsl" media="screen"?>#end
 #set($pager = $model.mediaFilesPager)
 <feed xmlns="http://www.w3.org/2005/Atom">
diff --git a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-search-atom.vm b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-search-atom.vm
index 2efbc79..0e9d247 100644
--- a/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-search-atom.vm
+++ b/app/src/main/webapp/WEB-INF/velocity/templates/feeds/weblog-search-atom.vm
@@ -16,6 +16,7 @@
   directory of this distribution.
 
 *#<?xml version="1.0" encoding='utf-8'?>
+#showFirefoxFeedWorkaround()
 #if($config.feedStyle)<?xml-stylesheet type="text/xsl" href="$url.absoluteSite/roller-ui/styles/atom.xsl" media="screen"?>#end
 #set($pager = $model.searchResultsPager)
 <feed xmlns="http://www.w3.org/2005/Atom"