diff --git a/platform/provision_drupal.drush.inc b/platform/provision_drupal.drush.inc
index 8ceec25ef8f302991eba4e0914d76c4219f855dc..48abca6465231e1b06be550652dbf7d092f1e593 100644
--- a/platform/provision_drupal.drush.inc
+++ b/platform/provision_drupal.drush.inc
@@ -147,7 +147,7 @@ function _provision_drupal_create_settings_file(&$data, $url = NULL) {
 
 
   $fp = fopen("sites/$url/settings.php", "w");
-  $text = variable_get('provision_drupal_settings_template', _provision_drupal_default_template());
+  $text =  _provision_drupal_default_template();
   fwrite($fp, "<?php\n". provision_render_config($text, $data));
   fclose($fp);
 
diff --git a/provision.drush.inc b/provision.drush.inc
index 8d7b472b3874d46b4f3ca4ba588d8a37f3f386d3..9f5b94f2c83fa4c7be37c19610f033491d43c1d9 100644
--- a/provision.drush.inc
+++ b/provision.drush.inc
@@ -120,7 +120,7 @@ function provision_drush_command() {
     'callback arguments' => array('install'),
     'arguments' => array('domain.com' => dt('The domain of the site to install.')),
     'description' => dt('Provision a new site using the provided data.'),
-    'bootstrap' => DRUPAL_BOOTSTRAP_CONFIGURATION
+    'bootstrap' => -1
   );
 
   $items['provision import'] = array(
@@ -128,14 +128,15 @@ function provision_drush_command() {
     'callback arguments' => array('import'),
     'arguments' => array('domain.com' => dt('The domain of the site to import.')),
     'description' => dt('Turn an already running site into a provisioned site.'),
-    'bootstrap' => DRUPAL_BOOTSTRAP_CONFIGURATION
+    'bootstrap' => -1
   );
 
   $items['provision update'] = array(
     'callback' => 'provision_command',
     'callback arguments' => array('update'),
     'arguments' => array('domain.com' => dt('The domain of the site to update.')),
-    'description' => dt('Run any outstanding updates on the site.')
+    'description' => dt('Run any outstanding updates on the site.'),
+    'bootstrap' => -1
   );
   
   $items['provision backup'] = array(
@@ -143,20 +144,23 @@ function provision_drush_command() {
     'callback arguments' => array('backup'),
     'arguments' => array('domain.com' => dt('The domain of the site to back up.')),
     'optional arguments' => array('backup-file' => dt('The file to save the backup to. This will be a gzipped tarball.')),
-    'description' => dt('Generate a back up for the site.')
+    'description' => dt('Generate a back up for the site.'),
+    'bootstrap' => -1
   );
   
   $items['provision enable'] = array(
     'callback' => 'provision_command',
     'callback arguments' => array('enable'), 
     'arguments' => array('domain.com' => dt('The domain of the site to enable (only if enabled).')),
-    'description' => 'Enable a disabled site.'
+    'description' => 'Enable a disabled site.',
+    'bootstrap' => -1
   );
   $items['provision disable'] = array(
     'callback' => 'provision_command',
     'callback arguments' => array('disable'), 
     'arguments' => array('domain.com' => dt('The domain of the site to disable (only if disabled).')),    
-    'description' => 'Disable a site.'
+    'description' => 'Disable a site.',
+    'bootstrap' => -1
   );
 
   $items['provision verify'] = array(
@@ -164,7 +168,7 @@ function provision_drush_command() {
     'callback arguments' => array('verify'),
     'arguments' => array('domain.com' => dt('The domain of the site to verify).')),    
     'description' => 'Verify that the provisioning framework is correctly installed.',
-    'bootstrap' => DRUPAL_BOOTSTRAP_CONFIGURATION,
+    'bootstrap' => -1
   );
  
   $items['provision restore'] = array(
@@ -172,26 +176,30 @@ function provision_drush_command() {
     'callback arguments' => array('restore'),
     'description' => 'Restore the site to a previous backup. This will also generate a backup of the site as it was.',
     'arguments' => array('domain.com' => dt('The domain of the site to be restored'),
-                    'site_backup.tar.gz' => dt('The backup to restore the site to.'))
+    'site_backup.tar.gz' => dt('The backup to restore the site to.')),
+    'bootstrap' => -1
   );
  
   $items['provision delete'] = array(
     'callback' => 'provision_command',
     'callback arguments' => array('delete'),
-    'description' => 'Delete a site.'
+    'description' => 'Delete a site.',
+    'bootstrap' => -1
   );
 
   $items['provision cron'] = array(
     'callback' => 'provision_command',
     'callback arguments' => array('cron'),
     'description' => 'Run cron process for site.',
-    'arguments' => array('domain.com' => dt('The domain of the site to be processed'))
+    'arguments' => array('domain.com' => dt('The domain of the site to be processed')),
+    'bootstrap' => -1
   );
  
   if (!function_exists('hosting_setup')) {
     $items['provision setup'] = array(
       'callback' => '_provision_setup_cmd',
       'description' => 'Initialize this platform to be able to create hosted sites.',
+      'bootstrap' => -1
     );
   }
 
@@ -210,7 +218,8 @@ function provision_drush_command() {
  */
 function _provision_setup() {
   $success = TRUE;
-  $drush_path = sprintf("%s/%s/drush.php", PROVISION_DOCROOT_PATH, drupal_get_path('module', 'drush'));
+  
+  $drush_path = realpath($_SERVER['argv'][0]);
 
   $success &= provision_path('symlink', $drush_path, PROVISION_DOCROOT_PATH . '/drush.php', 
     dt('Created symlink for drush.php file'), 
@@ -225,9 +234,7 @@ function _provision_setup() {
  * Drush command wrapper for the setup of the platform
  */
 function _provision_setup_cmd() {
-  if (_provision_setup()) {
-    variable_set('provision_setup', TRUE); 
-  }
+  _provision_setup();
  
   // @TODO use provision_output for this, but we need pretty print first.
   $logs = provision_get_log();
diff --git a/provision.inc b/provision.inc
index 07fb8012e8f22ffb3a92242bc4ad9ef3f0d6a870..0ecf81b4c4da7e81fd37566c1f1ad30032009f2f 100644
--- a/provision.inc
+++ b/provision.inc
@@ -111,21 +111,23 @@ function provision_command($hook, $arg1 = NULL, $arg2 = NULL, $arg3 = NULL, $arg
  * Turn drupal_set_message errors into provision_log errors
  */
 function _provision_log_messages() {
-  $messages = drupal_get_messages();
+  if (function_exists('drupal_get_messages')) {
 
-  //Drupal message errors.
-  foreach ((array) $messages['error'] as $error) {
-    if (preg_match('/^warning:/', $error)) {
-      provision_log('warning', ereg_replace('/^warning: /', '', $error));  
-    }
-    elseif (preg_match('/^user warning:/', $error)) {
-      provision_log("error", ereg_replace('/^user warning: /', '', $error));  
-    }
-    else {
-      provision_log('error', $error);
+    $messages = drupal_get_messages();
+
+    //Drupal message errors.
+    foreach ((array) $messages['error'] as $error) {
+      if (preg_match('/^warning:/', $error)) {
+        provision_log('warning', ereg_replace('/^warning: /', '', $error));  
+      }
+      elseif (preg_match('/^user warning:/', $error)) {
+        provision_log("error", ereg_replace('/^user warning: /', '', $error));  
+      }
+      else {
+        provision_log('error', $error);
+      }
     }
   }
-
 }
 
 function provision_parse_output($string) {
@@ -177,7 +179,6 @@ function provision_output($data = array()) {
   }
   $return['error_status'] = $error; // error code being returned
   $return['log'] = provision_get_log(); // Append logging information
-  $return['messages'] = drupal_get_messages();
   if (PROVISION_DRUSH_BACKEND) {
     printf(PROVISION_OUTPUT, serialize($return));
   }
@@ -337,9 +338,9 @@ function provision_get_site_data($url) {
   $site_data['task_type'] = $args['commands'][1];
   $site_data['task_id'] = drush_get_option('task_id', NULL);
   $site_data['publish_path'] = PROVISION_DOCROOT_PATH;
-  $site_data['profile'] = ($site_data['profile']) ? $site_data['profile'] : variable_get('provision_default_profile', 'default');
-  $site_data['site_ip'] =  variable_get('provision_apache_server_ip', '127.0.0.1');
-  $site_data['site_port'] =  variable_get('provision_apache_server_ip', 80);
+  $site_data['profile'] = ($site_data['profile']) ? $site_data['profile'] : 'default';
+  $site_data['site_ip'] =  ($site_data['site_ip']) ? $site_data['site_ip'] : '127.0.0.1';
+  $site_data['site_port'] =  ($site_data['site_port']) ? $site_data['site_port'] : '80';
     
   //Default to english language
   $site_data['language'] = $site_data['language'] ? $site_data['language'] : 'en';
@@ -504,7 +505,7 @@ function _provision_recursive_delete($path) {
     while (($entry = $d->read()) !== FALSE) {
       if ($entry == '.' || $entry == '..') continue;
       $entry_path = $path .'/'. $entry;
-      if (file_check_location($entry_path, $path)) {
+      if (_provision_file_check_location($entry_path, $path)) {
         $ret = _provision_recursive_delete($entry_path);
       } 
       else {
@@ -526,6 +527,22 @@ function _provision_recursive_delete($path) {
   return $ret;
 }
 
+function _provision_file_check_location($source, $directory = '') {
+  $check = realpath($source);
+  if ($check) {
+    $source = $check;
+  }
+  else {
+    // This file does not yet exist
+    $source = realpath(dirname($source)) .'/'. basename($source);
+  }
+  $directory = realpath($directory);
+  if ($directory && strpos($source, $directory) !== 0) {
+    return 0;
+  }
+  return $source;
+}
+
 /**
  * Wrapper around drush_shell_exec to provide sprintf functionality with some more safety.
  *
@@ -735,12 +752,12 @@ function pt($string, $args = array()) {
       switch ($key[0]) {
         // Escaped only
         case '@':
-          $args[$key] = check_plain($value);
+          $args[$key] = htmlspecialchars($value, ENT_QUOTES);
           break;
         // Escaped and placeholder
         case '%':
         default:
-          $args[$key] = '<em>'. check_plain($value) .'</em>';
+          $args[$key] = '<em>'. htmlspecialchars($value, ENT_QUOTES) .'</em>';
           break;
         // Pass-through
         case '!':
diff --git a/web_server/provision_apache.drush.inc b/web_server/provision_apache.drush.inc
index ba32c446538ccab5fb4efbb0f3d78eea73c17fff..55e4c956574086d2e9f90b43a927307d06c7641c 100644
--- a/web_server/provision_apache.drush.inc
+++ b/web_server/provision_apache.drush.inc
@@ -37,7 +37,7 @@ function _provision_apache_delete_vhost_config($url, $data) {
  */
 function _provision_apache_create_vhost_config($data, $url, $template = NULL) {
   if (is_null($template)) {
-    $template = variable_get('provision_apache_vhost_template', _provision_apache_default_template());
+    $template = _provision_apache_default_template();
   }
   provision_log("Notice", dt("Generate virtual host configuration file."));
   $writable = provision_path("writable", PROVISION_VHOST_PATH, TRUE , NULL,