found it! Phwew - there's no closing brace after the
if ( !isset($conf) )
{
$conf="shoutboxconf.php";
}
else
{
# michel v was there :)
$conf = str_replace(':', '', $conf); // hi cross-site scripting, bye cross-site scripting
$conf = str_replace('%3a', '', $conf); // hi cross-site scripting, bye cross-site scripting
$conf = str_replace('./', '', $conf); // to avoid directory traversal }//*/
}
Bit about 40 lines down (I've added it there, just add it yourself