diff --git a/src/diff.c b/src/diff.c
index 40d2292..bc75503 100644
--- a/src/diff.c
+++ b/src/diff.c
@@ -840,7 +840,7 @@
 #ifdef FEAT_BROWSE
     if (cmdmod.browse)
     {
-	browseFile = do_browse(FALSE, (char_u *)_("Patch file"),
+	browseFile = do_browse(0, (char_u *)_("Patch file"),
 			 eap->arg, NULL, NULL, BROWSE_FILTER_ALL_FILES, NULL);
 	if (browseFile == NULL)
 	    return;		/* operation cancelled */
diff --git a/src/ex_docmd.c b/src/ex_docmd.c
index 418de48..e818f82 100644
--- a/src/ex_docmd.c
+++ b/src/ex_docmd.c
@@ -1594,6 +1594,9 @@
     int			save_msg_scroll = 0;
     int			did_silent = 0;
     int			did_esilent = 0;
+#ifdef HAVE_SANDBOX
+    int			did_sandbox = FALSE;
+#endif
     cmdmod_T		save_cmdmod;
     int			ni;			/* set when Not Implemented */
 
@@ -1732,7 +1735,16 @@
 #endif
 			continue;
 
-	    case 's':	if (!checkforcmd(&ea.cmd, "silent", 3))
+	    case 's':	if (checkforcmd(&ea.cmd, "sandbox", 3))
+			{
+#ifdef HAVE_SANDBOX
+			    if (!did_sandbox)
+				++sandbox;
+			    did_sandbox = TRUE;
+#endif
+			    continue;
+			}
+			if (!checkforcmd(&ea.cmd, "silent", 3))
 			    break;
 			++did_silent;
 			++msg_silent;
@@ -2565,6 +2577,11 @@
 	msg_scroll = save_msg_scroll;
     }
 
+#ifdef HAVE_SANDBOX
+    if (did_sandbox)
+	--sandbox;
+#endif
+
     if (ea.nextcmd && *ea.nextcmd == NUL)	/* not really a next command */
 	ea.nextcmd = NULL;
 
@@ -2800,6 +2817,7 @@
 	{"leftabove", 5},
 	{"lockmarks", 3},
 	{"rightbelow", 6},
+	{"sandbox", 3},
 	{"silent", 3},
 	{"topleft", 2},
 	{"verbose", 4},
@@ -6462,7 +6480,7 @@
 #endif
 	    && eap->cmdidx != CMD_new)
     {
-	fname = do_browse(FALSE, (char_u *)_("Edit File in new window"),
+	fname = do_browse(0, (char_u *)_("Edit File in new window"),
 					  eap->arg, NULL, NULL, NULL, curbuf);
 	if (fname == NULL)
 	    goto theend;
@@ -6882,7 +6900,7 @@
 	{
 	    char_u *browseFile;
 
-	    browseFile = do_browse(FALSE, (char_u *)_("Append File"), eap->arg,
+	    browseFile = do_browse(0, (char_u *)_("Append File"), eap->arg,
 						    NULL, NULL, NULL, curbuf);
 	    if (browseFile != NULL)
 	    {
@@ -7470,8 +7488,9 @@
 	    {
 		char_u	*browseFile;
 
-		browseFile = do_browse(TRUE, (char_u *)_("Save Redirection"),
-		       fname, NULL, NULL, BROWSE_FILTER_ALL_FILES, curbuf);
+		browseFile = do_browse(BROWSE_SAVE,
+			(char_u *)_("Save Redirection"),
+			fname, NULL, NULL, BROWSE_FILTER_ALL_FILES, curbuf);
 		if (browseFile == NULL)
 		    return;		/* operation cancelled */
 		vim_free(fname);
@@ -7658,7 +7677,7 @@
 #ifdef FEAT_BROWSE
     if (cmdmod.browse)
     {
-	browseFile = do_browse(TRUE,
+	browseFile = do_browse(BROWSE_SAVE,
 # ifdef FEAT_SESSION
 		eap->cmdidx == CMD_mkview ? (char_u *)_("Save View") :
 		eap->cmdidx == CMD_mksession ? (char_u *)_("Save Session") :
diff --git a/src/globals.h b/src/globals.h
index 9337134..84adb7f 100644
--- a/src/globals.h
+++ b/src/globals.h
@@ -1346,6 +1346,7 @@
 EXTERN char_u e_readonly[]	INIT(=N_("E45: 'readonly' option is set (add ! to override)"));
 #ifdef FEAT_EVAL
 EXTERN char_u e_readonlyvar[]	INIT(=N_("E46: Cannot set read-only variable \"%s\""));
+EXTERN char_u e_readonlysbx[]	INIT(=N_("E46: Cannot set variable in the sandbox: \"%s\""));
 #endif
 #ifdef FEAT_QUICKFIX
 EXTERN char_u e_readerrf[]	INIT(=N_("E47: Error while reading errorfile"));
diff --git a/src/gui.c b/src/gui.c
index 9b33f9d..71b738c 100644
--- a/src/gui.c
+++ b/src/gui.c
@@ -4411,9 +4411,8 @@
 }
 #endif
 
-#if defined(FEAT_GUI_GTK) || defined(FEAT_GUI_MOTIF) \
-	|| defined(MSWIN_FIND_REPLACE) || defined(FEAT_SUN_WORKSHOP) \
-	|| defined(PROTO) || defined(FEAT_GUI_KDE)
+#if defined(FIND_REPLACE_DIALOG) || defined(FEAT_SUN_WORKSHOP) \
+	|| defined(PROTO)
 /*
  * Update the current window and the screen.
  */
@@ -4430,8 +4429,7 @@
 }
 #endif
 
-#if defined(FEAT_GUI_GTK) || defined(FEAT_GUI_MOTIF) \
-	|| defined(MSWIN_FIND_REPLACE) || defined(PROTO) || defined(FEAT_GUI_KDE)
+#if defined(FIND_REPLACE_DIALOG) || defined(PROTO)
 static void concat_esc __ARGS((garray_T *gap, char_u *text, int what));
 
 /*
@@ -4539,28 +4537,10 @@
     int		i;
     int		type = (flags & FRD_TYPE_MASK);
     char_u	*p;
+    regmatch_T	regmatch;
 
     ga_init2(&ga, 1, 100);
-
-    if (type == FRD_REPLACE)
-    {
-	/* Do the replacement when the text under the cursor matches. */
-	i = STRLEN(find_text);
-	p = ml_get_cursor();
-	if (((flags & FRD_MATCH_CASE)
-		    ? STRNCMP(p, find_text, i) == 0
-		    : STRNICMP(p, find_text, i) == 0)
-		&& u_save_cursor() == OK)
-	{
-	    /* A button was pressed thus undo should be synced. */
-	    if (no_u_sync == 0)
-		u_sync();
-
-	    del_bytes((long)i, FALSE);
-	    ins_str(repl_text);
-	}
-    }
-    else if (type == FRD_REPLACEALL)
+    if (type == FRD_REPLACEALL)
 	ga_concat(&ga, (char_u *)"%s/");
 
     ga_concat(&ga, (char_u *)"\\V");
@@ -4579,21 +4559,56 @@
 
     if (type == FRD_REPLACEALL)
     {
-	/* A button was pressed, thus undo should be synced. */
-	if (no_u_sync == 0)
-	    u_sync();
-
 	ga_concat(&ga, (char_u *)"/");
 	concat_esc(&ga, repl_text, '/');	/* escape slashes */
 	ga_concat(&ga, (char_u *)"/g");
-	ga_append(&ga, NUL);
+    }
+    ga_append(&ga, NUL);
+
+    if (type == FRD_REPLACE)
+    {
+	/* Do the replacement when the text at the cursor matches.  Thus no
+	 * replacement is done if the cursor was moved! */
+	regmatch.regprog = vim_regcomp(ga.ga_data, RE_MAGIC + RE_STRING);
+	regmatch.rm_ic = 0;
+	if (regmatch.regprog != NULL)
+	{
+	    p = ml_get_cursor();
+	    if (vim_regexec_nl(&regmatch, p, (colnr_T)0)
+						   && regmatch.startp[0] == p)
+	    {
+		/* Clear the command line to remove any old "No match"
+		 * error. */
+		msg_end_prompt();
+
+		if (u_save_cursor() == OK)
+		{
+		    /* A button was pressed thus undo should be synced. */
+		    if (no_u_sync == 0)
+			u_sync();
+
+		    del_bytes((long)(regmatch.endp[0] - regmatch.startp[0]),
+								       FALSE);
+		    ins_str(repl_text);
+		}
+	    }
+	    else
+		MSG(_("No match at cursor, finding next"));
+	    vim_free(regmatch.regprog);
+	}
+    }
+
+    if (type == FRD_REPLACEALL)
+    {
+	/* A button was pressed, thus undo should be synced. */
+	if (no_u_sync == 0)
+	    u_sync();
 	do_cmdline_cmd(ga.ga_data);
     }
     else
     {
 	/* Search for the next match. */
 	i = msg_scroll;
-	ga_append(&ga, NUL);
 	do_search(NULL, down ? '/' : '?', ga.ga_data, 1L,
 						    SEARCH_MSG + SEARCH_MARK);
 	msg_scroll = i;	    /* don't let an error message set msg_scroll */
diff --git a/src/gui.h b/src/gui.h
index 02028f2..bcb36de 100644
--- a/src/gui.h
+++ b/src/gui.h
@@ -542,8 +542,7 @@
 }
 gui_win_pos_T;
 
-#if defined(FEAT_GUI_MOTIF) || defined(FEAT_GUI_GTK) || defined(FEAT_GUI_KDE) \
-	|| defined(MSWIN_FIND_REPLACE)
+#ifdef FIND_REPLACE_DIALOG
 /*
  * Flags used to distinguish the different contexts in which the
  * find/replace callback may be called.
diff --git a/src/gui_w48.c b/src/gui_w48.c
index eeaf651..4f0bab7 100644
--- a/src/gui_w48.c
+++ b/src/gui_w48.c
@@ -2980,6 +2980,18 @@
 }
 
 /*
+ * Select a directory.
+ */
+    char_u *
+gui_mch_browsedir(char_u *title, char_u *initdir)
+{
+    /* We fake this: Use a filter that doesn't select anything and a default
+     * file name that won't be used. */
+    return gui_mch_browse(0, title, (char_u *)_("Not Used"), NULL,
+			      initdir, (char_u *)_("Directory\t*.nothing\n"));
+}
+
+/*
  * Pop open a file browser and return the file selected, in allocated memory,
  * or NULL if Cancel is hit.
  *  saving  - TRUE if the file will be saved to, FALSE if it will be opened.
diff --git a/src/if_xcmdsrv.c b/src/if_xcmdsrv.c
index fb5999a..fe127a4 100644
--- a/src/if_xcmdsrv.c
+++ b/src/if_xcmdsrv.c
@@ -1021,7 +1021,7 @@
     char_u	*regProp, *entry = NULL;
     char_u	*p;
     long_u	numItems;
-    Window	wwin;
+    int_u	wwin;
 
     /*
      * Read the registry property.
@@ -1034,8 +1034,8 @@
     {
 	if (*p != 0)
 	{
-	    sscanf((char *)p, "%x", (int_u *)&wwin);
-	    if (wwin == win)
+	    sscanf((char *)p, "%x", &wwin);
+	    if ((Window)wwin == win)
 	    {
 		int lastHalf;
 
diff --git a/src/message.c b/src/message.c
index 5b8da3f..d678bf3 100644
--- a/src/message.c
+++ b/src/message.c
@@ -813,14 +813,12 @@
     msg_hist_off = FALSE;
 }
 
-#if defined(FEAT_CON_DIALOG) || defined(PROTO)
-static void msg_end_prompt __ARGS((void));
-
+#if defined(FEAT_CON_DIALOG) || defined(FIND_REPLACE_DIALOG) || defined(PROTO)
 /*
  * Call this after prompting the user.  This will avoid a hit-return message
  * and a delay.
  */
-    static void
+    void
 msg_end_prompt()
 {
     need_wait_return = FALSE;
@@ -3046,8 +3044,8 @@
  * Later this may pop-up a non-GUI file selector (external command?).
  */
     char_u *
-do_browse(saving, title, dflt, ext, initdir, filter, buf)
-    int		saving;		/* write action */
+do_browse(flags, title, dflt, ext, initdir, filter, buf)
+    int		flags;		/* BROWSE_SAVE and BROWSE_DIR */
     char_u	*title;		/* title for the window */
     char_u	*dflt;		/* default file name (may include directory) */
     char_u	*ext;		/* extension added */
@@ -3065,9 +3063,11 @@
      * flag too!  */
     cmdmod.browse = FALSE;
 
-    if (title == NULL)
+    if (title == NULL || *title == NUL)
     {
-	if (saving)
+	if (flags & BROWSE_DIR)
+	    title = (char_u *)_("Select Directory dialog");
+	else if (flags & BROWSE_SAVE)
 	    title = (char_u *)_("Save File dialog");
 	else
 	    title = (char_u *)_("Open File dialog");
@@ -3097,10 +3097,13 @@
     if (initdir == NULL || *initdir == NUL)
     {
 	/* When 'browsedir' is a directory, use it */
-	if (mch_isdir(p_bsdir))
+	if (STRCMP(p_bsdir, "last") != 0
+		&& STRCMP(p_bsdir, "buffer") != 0
+		&& STRCMP(p_bsdir, "current") != 0
+		&& mch_isdir(p_bsdir))
 	    initdir = p_bsdir;
 	/* When saving or 'browsedir' is "buffer", use buffer fname */
-	else if ((saving || *p_bsdir == 'b')
+	else if (((flags & BROWSE_SAVE) || *p_bsdir == 'b')
 		&& buf != NULL && buf->b_ffname != NULL)
 	{
 	    if (dflt == NULL || *dflt == NUL)
@@ -3129,7 +3132,36 @@
 #  endif
 	)
 	    filter = BROWSE_FILTER_DEFAULT;
-	fname = gui_mch_browse(saving, title, dflt, ext, initdir, filter);
+	if (flags & BROWSE_DIR)
+	{
+#  if defined(HAVE_GTK2) || defined(WIN3264)
+	    /* For systems that have a directory dialog. */
+	    fname = gui_mch_browsedir(title, initdir);
+#  else
+	    /* Generic solution for selecting a directory: select a file and
+	     * remove the file name. */
+	    fname = gui_mch_browse(0, title, dflt, ext, initdir, (char_u *)"");
+#  endif
+#  if !defined(HAVE_GTK2)
+	    /* Win32 adds a dummy file name, others return an arbitrary file
+	     * name.  GTK+ 2 returns only the directory, */
+	    if (fname != NULL && *fname != NUL && !mch_isdir(fname))
+	    {
+		/* Remove the file name. */
+		char_u	    *s = get_past_head(fname);
+		char_u	    *tail = gettail(fname);
+
+		while (tail > s && vim_ispathsep(tail[-1]))
+		    --tail;
+		if (tail == fname)
+		    *tail++ = '.';	/* use current dir */
+		*tail = NUL;
+	    }
+#  endif
+	}
+	else
+	    fname = gui_mch_browse(flags & BROWSE_SAVE,
+					   title, dflt, ext, initdir, filter);
 
 	/* We hang around in the dialog for a while, the user might do some
 	 * things to our files.  The Win32 dialog allows deleting or renaming
@@ -3150,7 +3182,7 @@
     {
 	vim_free(last_dir);
 	last_dir = vim_strsave(fname);
-	if (last_dir != NULL)
+	if (last_dir != NULL && !(flags & BROWSE_DIR))
 	{
 	    *gettail(last_dir) = NUL;
 	    if (*last_dir == NUL)
diff --git a/src/proto/fold.pro b/src/proto/fold.pro
index 75af305..3318bbd 100644
--- a/src/proto/fold.pro
+++ b/src/proto/fold.pro
@@ -35,6 +35,7 @@
 void deleteFoldRecurse __ARGS((garray_T *gap));
 void foldMarkAdjust __ARGS((win_T *wp, linenr_T line1, linenr_T line2, long amount, long amount_after));
 int getDeepestNesting __ARGS((void));
+char_u *get_foldtext __ARGS((win_T *wp, linenr_T lnum, linenr_T lnume, foldinfo_T *foldinfo, char_u *buf));
 void foldtext_cleanup __ARGS((char_u *str));
 int put_folds __ARGS((FILE *fd, win_T *wp));
 /* vim: set ft=c : */
diff --git a/src/proto/gui_w32.pro b/src/proto/gui_w32.pro
index 58ad4f4..a953a1d 100644
--- a/src/proto/gui_w32.pro
+++ b/src/proto/gui_w32.pro
@@ -51,6 +51,7 @@
 void gui_mch_newfont __ARGS((void));
 void gui_mch_settitle __ARGS((char_u *title, char_u *icon));
 void mch_set_mouse_shape __ARGS((int shape));
+char_u *gui_mch_browsedir __ARGS((char_u *title, char_u *initdir));
 char_u *gui_mch_browse __ARGS((int saving, char_u *title, char_u *dflt, char_u *ext, char_u *initdir, char_u *filter));
 int get_cmd_args __ARGS((char *prog, char *cmdline, char ***argvp, char **tofree));
 int gui_is_win32s __ARGS((void));
diff --git a/src/vim.h b/src/vim.h
index 11ff2a5..2ca581f 100644
--- a/src/vim.h
+++ b/src/vim.h
@@ -1664,6 +1664,8 @@
 #  define BROWSE_FILTER_DEFAULT \
 	(char_u *)"All Files (*)\t*\nC source (*.c, *.h)\t*.c;*.h\nC++ source (*.cpp, *.hpp)\t*.cpp;*.hpp\nVim files (*.vim, _vimrc, _gvimrc)\t*.vim;_vimrc;_gvimrc\n"
 # endif
+# define BROWSE_SAVE 1	    /* flag for do_browse() */
+# define BROWSE_DIR 2	    /* flag for do_browse() */
 #endif
 
 /* stop using fastcall for Borland */