diff --git a/js/lib/irc.js b/js/lib/irc.js
--- a/js/lib/irc.js
+++ b/js/lib/irc.js
@@ -1600,17 +1600,21 @@ function serv_005 (e)
 /* users */
 CIRCServer.prototype.on251 =
 function serv_251(e)
 {
     // 251 is the first message we get after 005, so it's now safe to do
     // things that might depend upon server features.
 
     if (("namesx" in this.supports) && this.supports.namesx)
+    {
+        // "multi-prefix" is the same as "namesx" but PROTOCTL doesn't reply.
+        this.caps["multi-prefix"] = true;
         this.sendData("PROTOCTL NAMESX\n");
+    }
 
     if (this.parent.INITIAL_CHANNEL)
     {
         this.parent.primChan = this.addChannel(this.parent.INITIAL_CHANNEL);
         this.parent.primChan.join();
     }
 
     e.destObject = this.parent;
@@ -1997,19 +2001,20 @@ function my_cap (e)
 
     if (e.params[2] == "LS")
     {
         /* We're getting a list of all server capabilities. Set them all to
          * null (if they don't exist) to indicate we don't know if they're
          * enabled or not (but this will evaluate to false which matches that
          * capabilities are only enabled on request).
          */
-        for (var i = 3; i < e.params.length; i++)
+        var caps = e.params[3].split(/\s+/);
+        for (var i = 0; i < caps.length; i++)
         {
-            var cap = e.params[i].replace(/^-/, "").trim();
+            var cap = caps[i].replace(/^-/, "").trim();
             if (!(cap in this.caps))
                 this.caps[cap] = null;
         }
     }
     else if (e.params[2] == "ACK")
     {
         /* A capability change has been successfully applied. An enabled
          * capability is just "cap" whilst a disabled capability is "-cap".
diff --git a/xul/content/static.js b/xul/content/static.js
--- a/xul/content/static.js
+++ b/xul/content/static.js
@@ -3318,16 +3318,17 @@ function cli_installPlugin(name, source)
                     }
                 }
             }
 
             // Test init.js for a plugin ID.
             var initJSFile = getTempFile(client.prefs["profilePath"],
                                          "install-plugin.temp");
             zipReader.extract(initPath, initJSFile);
+            initJSFile.permissions = 438; // 0666
             var initJSFileH = fopen(initJSFile, "<");
             var initJSData = initJSFileH.read();
             initJSFileH.close();
             initJSFile.remove(false);
 
             //XXXgijs: this is fragile. Anyone got a better idea?
             ary = initJSData.match(/plugin\.id\s*=\s*(['"])(.*?)(\1)/);
             if (ary && (name != ary[2]))
@@ -3365,16 +3366,17 @@ function cli_installPlugin(name, source)
                             zipFile.create(DIRECTORY_TYPE, 0700);
                     }
                     zipFile.append(dirs[dirs.length - 1]);
 
                     if (zipFile.leafName == "init.js")
                         destInit = zipFile;
 
                     zipReader.extract(itemName, zipFile);
+                    zipFile.permissions = 438; // 0666
                 }
             }
 
             var rv = dispatch("load ", {url: getURLSpecFromFile(destInit)});
             if (rv)
             {
                 display(getMsg(MSG_INSTALL_PLUGIN_DONE, name));
             }