Index: bin/html2text.php
===================================================================
--- bin/html2text.php	(revision 300fc65a461ce37999e3f0df991b24ed1b3c1bd3)
+++ bin/html2text.php	(revision 1608f432826a41e035ee7ddb0dd409bbcf559b43)
@@ -21,10 +21,18 @@
 
 define('INSTALL_PATH', realpath(dirname(__FILE__) . '/..') . '/');
-require INSTALL_PATH.'program/include/iniset.php';
+require INSTALL_PATH . 'program/include/iniset.php';
 
-$converter = new html2text($HTTP_RAW_POST_DATA);
+$RCMAIL = rcmail::get_instance();
 
-header('Content-Type: text/plain; charset=UTF-8');
-print trim($converter->get_text());
+if (!empty($RCMAIL->user->ID)) {
+  $converter = new html2text($HTTP_RAW_POST_DATA);
+
+  header('Content-Type: text/plain; charset=UTF-8');
+  print trim($converter->get_text());
+}
+else {
+  header("HTTP/1.0 403 Forbidden");
+  echo "Requires a valid user session";
+}
 
 ?>
Index: bin/modcss.php
===================================================================
--- bin/modcss.php	(revision b685e9e47cebc0577c338e420a04d0ec89e25156)
+++ bin/modcss.php	(revision 1608f432826a41e035ee7ddb0dd409bbcf559b43)
@@ -21,8 +21,10 @@
 
 define('INSTALL_PATH', realpath(dirname(__FILE__) . '/..') . '/');
-require INSTALL_PATH.'program/include/iniset.php';
+require INSTALL_PATH . 'program/include/iniset.php';
+
+$RCMAIL = rcmail::get_instance();
 
 $source = "";
-if ($url = preg_replace('/[^a-z0-9.-_\?\$&=%]/i', '', $_GET['u']))
+if (!empty($RCMAIL->user->ID) && ($url = preg_replace('/[^a-z0-9.-_\?\$&=%]/i', '', $_GET['u'])))
 {
 	$a_uri = parse_url($url);
@@ -60,6 +62,8 @@
 	echo rcmail_mod_css_styles($source, preg_replace('/[^a-z0-9]/i', '', $_GET['c']), $url);
 }
-else
+else {
 	header("HTTP/1.0 404 Not Found");
+	echo "Requires a valid user session and source url";
+}
 
 ?>
Index: bin/quotaimg.php
===================================================================
--- bin/quotaimg.php	(revision fe3e67884d2947a635f0e3150860aaedb10bae9e)
+++ bin/quotaimg.php	(revision 1608f432826a41e035ee7ddb0dd409bbcf559b43)
@@ -18,4 +18,9 @@
 
 */
+
+define('INSTALL_PATH', realpath(dirname(__FILE__).'/..') . '/');
+require INSTALL_PATH . 'program/include/iniset.php';
+
+$RCMAIL = rcmail::get_instance();
 
 $used   = isset($_GET['u']) ? intval($_GET['u']) : '??';
@@ -187,9 +192,10 @@
 }
 
-if ($width > 1 && $height > 1) {
-	genQuota($used, $quota, $width, $height);  
+if (!empty($RCMAIL->user->ID) && $width > 1 && $height > 1) {
+	genQuota($used, $quota, $width, $height);
 }
 else {
-	header("HTTP/1.0 404 Not Found");
+	header("HTTP/1.0 403 Forbidden");
+	echo "Requires a valid user session and positive values";
 }
 
Index: program/include/main.inc
===================================================================
--- program/include/main.inc	(revision 77e2322271b0374f20e3e06345e42df6bd105d85)
+++ program/include/main.inc	(revision 1608f432826a41e035ee7ddb0dd409bbcf559b43)
@@ -613,16 +613,24 @@
       '/(^\s*<!--)|(-->\s*$)/',
       '/(^\s*|,\s*|\}\s*)([a-z0-9\._#][a-z0-9\.\-_]*)/im',
-      '/@import\s+(url\()?[\'"]?([^\)\'"]+)[\'"]?(\))?/ime',
-      '/<<str_replacement\[([0-9]+)\]>>/e',
-      "/$container_id\s+body/i"
+      "/$container_id\s+body/i",
     ),
     array(
       '',
       "\\1#$container_id \\2",
-      "sprintf(\"@import url('./bin/modcss.php?u=%s&c=%s')\", urlencode(make_absolute_url('\\2','$base_url')), urlencode($container_id))",
-      "\$a_css_values[\\1]",
-      "$container_id div.rcmBody"
+      "$container_id div.rcmBody",
     ),
     $source);
+  
+  // replace all @import statements to modify the imported CSS sources too
+  $styles = preg_replace_callback(
+    '/@import\s+(url\()?[\'"]?([^\)\'"]+)[\'"]?(\))?/im',
+    create_function('$matches', "return sprintf(\"@import url('./bin/modcss.php?u=%s&c=%s')\", urlencode(make_absolute_url(\$matches[2],'$base_url')), urlencode('$container_id'));"),
+    $styles);
+  
+  // put block contents back in
+  $styles = preg_replace_callback(
+    '/<<str_replacement\[([0-9]+)\]>>/',
+    create_function('$matches', "\$values = ".var_export($a_css_values, true)."; return \$values[\$matches[1]];"),
+    $styles);
 
   return $styles;
@@ -640,5 +648,5 @@
 {
   $out = html_entity_decode(html_entity_decode($content));
-  $out = preg_replace('/\\\([0-9a-f]{4})/ie', "chr(hexdec('\\1'))", $out);
+  $out = preg_replace_callback('/\\\([0-9a-f]{4})/i', create_function('$matches', 'return chr(hexdec($matches[1]));'), $out);
   $out = preg_replace('#/\*.*\*/#Um', '', $out);
   return $out;