diff --git a/module/install/model.php b/module/install/model.php
index 6ffa1ff05b..5961e2d9b2 100644
--- a/module/install/model.php
+++ b/module/install/model.php
@@ -502,10 +502,14 @@ class installModel extends model
      */
     public function grantPriv()
     {
+        $data = fixer::input('post')
+            ->stripTags('company')
+            ->get();
+
         $requiredFields = explode(',', $this->config->install->step5RequiredFields);
         foreach($requiredFields as $field)
         {
-            if($this->post->{$field} == '')
+            if(empty($data->{$field}))
             {
                 dao::$errors[] = $this->lang->install->errorEmpty[$field];
                 return false;
@@ -514,7 +518,7 @@ class installModel extends model
 
         /* Insert a company. */
         $company = new stdclass();
-        $company->name   = $this->post->company;
+        $company->name   = $data->company;
         $company->admins = ",{$this->post->account},";
         $this->dao->insert(TABLE_COMPANY)->data($company)->autoCheck()->exec();
         if(!dao::isError())
diff --git a/module/upgrade/model.php b/module/upgrade/model.php
index 9fea8b78e4..62f61e14e6 100644
--- a/module/upgrade/model.php
+++ b/module/upgrade/model.php
@@ -1260,7 +1260,7 @@ class upgradeModel extends model
                 if(file_exists($fullPath))
                 {
                     $isDir = is_dir($fullPath);
-                    if(($isDir  and !$zfile->removeDir($fullPath)) or
+                    if(!is_writable($fullPath) or ($isDir and !$zfile->removeDir($fullPath)) or
                        (!$isDir and !$zfile->removeFile($fullPath)))
                     {
                         $result[] = 'rm -f ' . ($isDir ? '-r ' : '') . $fullPath;
diff --git a/module/user/model.php b/module/user/model.php
index eadbe7e435..4ad6e0849c 100644
--- a/module/user/model.php
+++ b/module/user/model.php
@@ -126,7 +126,7 @@ class userModel extends model
             }
             else
             {
-                $firstLetter = ucfirst(substr($user->account, 0, 1)) . ':';
+                $firstLetter = ucfirst(mb_substr($user->account, 0, 1)) . ':';
                 if(strpos($params, 'noletter') !== false or !empty($this->config->isINT)) $firstLetter = '';
                 $users[$account] =  $firstLetter . (($user->deleted and strpos($params, 'realname') === false) ? $user->account : ($user->realname ? $user->realname : $user->account));
             }